@workos-inc/node 8.1.0 → 8.3.0

package/lib/api-keys-CrR113By.d.cts

@@ -0,0 +1,744 @@
+import { t as CryptoProvider } from "./crypto-provider-CYvkctEg.cjs";
+import { t as Directory } from "./directory.interface-RS2zVVSH.cjs";
+import { t as DirectoryGroup } from "./directory-group.interface-RhiHiiPX.cjs";
+import { t as PaginationOptions } from "./pagination-options.interface-SKgiNnuZ.cjs";
+import { n as SerializedListDirectoriesOptions, t as ListDirectoriesOptions } from "./list-directories-options.interface-Bq6Ctiub.cjs";
+import { t as ListDirectoryGroupsOptions } from "./list-groups-options.interface-U_gybSue.cjs";
+import { t as ListDirectoryUsersOptions } from "./list-directory-users-options.interface-B3hWSKfC.cjs";
+import { n as EnvironmentRoleList, t as EnvironmentRole } from "./environment-role.interface-B59FS29B.cjs";
+import { t as CreateEnvironmentRoleOptions } from "./create-environment-role-options.interface-BzAxMcvk.cjs";
+import { n as UpdateEnvironmentRoleOptions } from "./update-environment-role-options.interface-dosXnOZd.cjs";
+import { t as SetEnvironmentRolePermissionsOptions } from "./set-environment-role-permissions-options.interface-CJm4G5CM.cjs";
+import { t as AddEnvironmentRolePermissionOptions } from "./add-environment-role-permission-options.interface-Pk9Z0RBF.cjs";
+import { t as OrganizationRole } from "./organization-role.interface-evatb3Ca.cjs";
+import { t as CreateOrganizationRoleOptions } from "./create-organization-role-options.interface-D47Tf3Ep.cjs";
+import { n as UpdateOrganizationRoleOptions } from "./update-organization-role-options.interface-rE638uDV.cjs";
+import { t as SetOrganizationRolePermissionsOptions } from "./set-organization-role-permissions-options.interface-F54jbJ3q.cjs";
+import { t as AddOrganizationRolePermissionOptions } from "./add-organization-role-permission-options.interface-Oc11Zzvq.cjs";
+import { t as RemoveOrganizationRolePermissionOptions } from "./remove-organization-role-permission-options.interface-ZMh36f0F.cjs";
+import { n as PermissionList, t as Permission } from "./permission.interface-BBwAYH07.cjs";
+import { t as CreatePermissionOptions } from "./create-permission-options.interface-ClaSX7df.cjs";
+import { n as UpdatePermissionOptions } from "./update-permission-options.interface-1DDWIS6-.cjs";
+import { Cn as CreateOrganizationApiKeyRequestOptions, Dn as SerializedListOrganizationMembershipsOptions, En as ListOrganizationMembershipsOptions, Gn as Role, In as Profile, Jn as RoleList, Mn as SerializedListInvitationsOptions, Nn as ListAuthFactorsOptions, On as OrganizationMembership, Pn as ProfileAndToken, Rn as DefaultCustomAttributes, Sn as CreateOrganizationApiKeyOptions, Tn as ListUserFeatureFlagsOptions, Vn as DirectoryUserWithGroups, Xn as ListPermissionsOptions, ct as Event, jn as ListInvitationsOptions, n as CreateOrganizationRequestOptions, t as CreateOrganizationOptions } from "./index-DHEILHGo.cjs";
+import { n as SSOPKCEAuthorizationURLResult, t as SSOAuthorizationURLOptions } from "./authorization-url-options.interface-C5ABtdiE.cjs";
+import { t as Connection } from "./connection.interface-D1HP4q90.cjs";
+import { t as GetProfileOptions } from "./get-profile-options.interface-BTqozSx_.cjs";
+import { t as GetProfileAndTokenOptions } from "./get-profile-and-token-options.interface-B4HEexcv.cjs";
+import { n as SerializedListConnectionsOptions, t as ListConnectionsOptions } from "./list-connections-options.interface-zYzKu8PV.cjs";
+import { t as UnknownRecord } from "./unknown-record.interface-DSMWbzCc.cjs";
+import { n as AuthenticateWithCodeOptions } from "./authenticate-with-code-options.interface-CtsvRTYS.cjs";
+import { t as AuthenticateWithCodeAndVerifierOptions } from "./authenticate-with-code-and-verifier-options.interface-CifpWY0M.cjs";
+import { n as AuthenticateWithEmailVerificationOptions } from "./authenticate-with-email-verification-options.interface-BCC2K9Zp.cjs";
+import { n as AuthenticateWithMagicAuthOptions } from "./authenticate-with-magic-auth-options.interface-Dmxc0Aes.cjs";
+import { n as AuthenticateWithOrganizationSelectionOptions } from "./authenticate-with-organization-selection.interface-DYOjeIvu.cjs";
+import { n as AuthenticateWithPasswordOptions } from "./authenticate-with-password-options.interface-BbjZEbmt.cjs";
+import { n as AuthenticateWithRefreshTokenOptions } from "./authenticate-with-refresh-token-options.interface-CqS4TJ3X.cjs";
+import { t as User } from "./user.interface-BJY1-A6X.cjs";
+import { t as AuthenticationResponse } from "./authentication-response.interface-DITy4Tzw.cjs";
+import { a as AuthenticateWithSessionCookieSuccessResponse, i as AuthenticateWithSessionCookieOptions, n as AuthenticateWithSessionCookieFailedResponse, o as SessionCookieData } from "./authenticate-with-session-cookie.interface-CoZAMXL_.cjs";
+import { n as AuthenticateWithTotpOptions } from "./authenticate-with-totp-options.interface-C0Jr3YDb.cjs";
+import { n as UserManagementAuthorizationURLOptions, t as PKCEAuthorizationURLResult } from "./authorization-url-options.interface-BwBNFg0Z.cjs";
+import { t as CreateMagicAuthOptions } from "./create-magic-auth-options.interface-KljIsFrM.cjs";
+import { t as CreateOrganizationMembershipOptions } from "./create-organization-membership-options.interface-CT78k_RG.cjs";
+import { t as CreatePasswordResetOptions } from "./create-password-reset-options.interface-DugfAPGw.cjs";
+import { t as CreateUserOptions } from "./create-user-options.interface-ord6dU_x.cjs";
+import { t as EmailVerification } from "./email-verification.interface-DPOUBm9v.cjs";
+import { t as EnrollAuthFactorOptions } from "./enroll-auth-factor.interface-EhGkRx_t.cjs";
+import { r as FactorWithSecrets, t as Factor } from "./factor.interface-DebkGvZh.cjs";
+import { t as Identity } from "./identity.interface-fsQohx9t.cjs";
+import { t as Invitation } from "./invitation.interface-BGj97ho-.cjs";
+import { n as SerializedListSessionsOptions, t as ListSessionsOptions } from "./list-sessions-options.interface-3wEl-9ph.cjs";
+import { n as SerializedListUsersOptions, t as ListUsersOptions } from "./list-users-options.interface-CwR5WeUq.cjs";
+import { t as LogoutURLOptions } from "./logout-url-options.interface-DhTgF8Hk.cjs";
+import { t as MagicAuth } from "./magic-auth.interface-BECeWMH_.cjs";
+import { t as PasswordReset } from "./password-reset.interface-Yi4hon-d.cjs";
+import { n as RefreshSessionResponse } from "./refresh-and-seal-session-data.interface-BSKQWqmn.cjs";
+import { t as ResendInvitationOptions } from "./resend-invitation-options.interface-BqrfHp3r.cjs";
+import { t as ResetPasswordOptions } from "./reset-password-options.interface-uWGx-EHg.cjs";
+import { t as RevokeSessionOptions } from "./revoke-session-options.interface-20LkWyox.cjs";
+import { t as SendInvitationOptions } from "./send-invitation-options.interface-C2RofyVU.cjs";
+import { t as SendVerificationEmailOptions } from "./send-verification-email-options.interface-BtOygLys.cjs";
+import { n as Session } from "./session.interface-zszewQtk.cjs";
+import { n as UpdateOrganizationMembershipOptions } from "./update-organization-membership-options.interface-vwSowDwp.cjs";
+import { n as UpdateUserOptions } from "./update-user-options.interface-yJ1zfqXv.cjs";
+import { n as VerifyEmailOptions } from "./verify-email-options.interface-C0_VqDVK.cjs";
+import { t as CreateOrganizationDomainOptions } from "./create-organization-domain-options.interface-BorRBhyO.cjs";
+import { t as OrganizationDomain } from "./organization-domain.interface-ozdxzINN.cjs";
+import { t as ApiKey } from "./api-key.interface-SUHnxEHj.cjs";
+import { t as CreatedApiKey } from "./created-api-key.interface-DkDQVw2T.cjs";
+import { t as ListOrganizationApiKeysOptions } from "./list-organization-api-keys-options.interface-YUTCTNS6.cjs";
+import { n as ValidateApiKeyOptions, r as ValidateApiKeyResponse } from "./validate-api-key.interface-DNV_9W09.cjs";
+import { t as GetOptions } from "./get-options.interface-DtIaBrYo.cjs";
+import { t as List } from "./list.interface-C8ZxDYyJ.cjs";
+import { t as PatchOptions } from "./patch-options.interface-46BCssmo.cjs";
+import { t as PostOptions } from "./post-options.interface-DlEjJsYu.cjs";
+import { t as PutOptions } from "./put-options.interface-7lk8rQLi.cjs";
+import { t as WorkOSOptions } from "./workos-options.interface-DsrGUZeh.cjs";
+import { t as ListOrganizationFeatureFlagsOptions } from "./list-organization-feature-flags-options.interface-DnLCq59G.cjs";
+import { t as ListOrganizationsOptions } from "./list-organizations-options.interface-EgR4w6S9.cjs";
+import { t as Organization } from "./organization.interface-v9vB3M2o.cjs";
+import { n as UpdateOrganizationOptions } from "./update-organization-options.interface-C5szqmv1.cjs";
+import { t as Actions } from "./actions-CGa0wSPO.cjs";
+import { t as PKCE } from "./pkce-n0rRYj_Q.cjs";
+import { t as AutoPaginatable } from "./pagination-D--sr3e2.cjs";
+import { t as ListEventOptions } from "./list-events-options.interface-BimW6YlK.cjs";
+import { t as FeatureFlag } from "./feature-flag.interface-Dc9oPNTI.cjs";
+import { t as ListOrganizationRolesOptions } from "./list-organization-roles-options.interface-BuvnLvwK.cjs";
+import { t as PasswordlessSession } from "./passwordless-session.interface-BgyPqlZF.cjs";
+import { t as CreatePasswordlessSessionOptions } from "./create-passwordless-session-options.interface-DCAzOCvV.cjs";
+import { t as SendSessionResponse } from "./send-session-response.interface-CMl4tWw_.cjs";
+import { n as GetAccessTokenOptions, r as GetAccessTokenResponse } from "./get-access-token.interface-C8vDOoS4.cjs";
+import { t as GeneratePortalLinkIntent } from "./generate-portal-link-intent.interface-DvAjnRTH.cjs";
+import { t as Webhooks } from "./webhooks-BlEjg80a.cjs";
+import { t as ChallengeFactorOptions } from "./challenge-factor-options-DQBD-OBq.cjs";
+import { t as Challenge } from "./challenge.interface-CGUxrdzT.cjs";
+import { t as EnrollFactorOptions } from "./enroll-factor-options-IU9WQYZu.cjs";
+import { r as FactorWithSecrets$1, t as Factor$1 } from "./factor.interface-DzLmWxJJ.cjs";
+import { t as VerifyChallengeOptions } from "./verify-challenge-options-BNCpUNrV.cjs";
+import { t as VerifyResponse } from "./verify-challenge-response-DpXoIuSX.cjs";
+import { t as AuditLogExportOptions } from "./audit-log-export-options.interface-BLw_RWFk.cjs";
+import { t as AuditLogExport } from "./audit-log-export.interface-oDR72O0J.cjs";
+import { i as CreateAuditLogEventRequestOptions, r as CreateAuditLogEventOptions } from "./create-audit-log-event-options.interface-B-eEsjZw.cjs";
+import { a as CreateAuditLogSchemaOptions, n as AuditLogSchema, o as CreateAuditLogSchemaRequestOptions } from "./create-audit-log-schema-options.interface-VEGNQUoR.cjs";
+import { t as SessionHandlerOptions } from "./session-handler-options.interface-BVTuA5uU.cjs";
+import { c as ResourceInterface, g as UpdateResourceOptions, i as DeleteResourceOptions, l as ResourceOptions, m as SerializedListResourcesOptions, o as ListResourcesOptions, r as CreateResourceOptions, s as Resource, t as BatchWriteResourcesOptions } from "./resource.interface-BZ27Ar_A.cjs";
+import { c as Warrant, i as SerializedListWarrantsOptions, n as ListWarrantsRequestOptions, t as ListWarrantsOptions, u as WriteWarrantOptions } from "./warrant.interface-80A3Pew0.cjs";
+import { i as CheckResult, n as CheckOptions, r as CheckRequestOptions, t as CheckBatchOptions } from "./check.interface-oac-oCtg.cjs";
+import { a as SerializedQueryOptions, n as QueryRequestOptions, r as QueryResult, t as QueryOptions } from "./query.interface-BuOZQoFM.cjs";
+import { t as WarrantToken } from "./warrant-token.interface-DPxaBIlh.cjs";
+import { t as FgaPaginatable } from "./fga-paginatable-BGfH6hKb.cjs";
+import { t as AddFlagTargetOptions } from "./add-flag-target-options.interface-CJ7M40Wi.cjs";
+import { t as ListFeatureFlagsOptions } from "./list-feature-flags-options.interface-DBQ7vrv_.cjs";
+import { t as RemoveFlagTargetOptions } from "./remove-flag-target-options.interface-BZBcjHE7.cjs";
+import { t as HttpClient } from "./http-client-Cs56_alu.cjs";
+import { t as GetTokenOptions } from "./get-token-CRyPuAyd.cjs";
+import { n as DataKeyPair, r as KeyContext, t as DataKey } from "./key.interface-CFC2qwl7.cjs";
+import { t as CreateDataKeyOptions } from "./create-data-key.interface-uWGAAWZC.cjs";
+import { t as DecryptDataKeyOptions } from "./decrypt-data-key.interface-BwEc_O_A.cjs";
+import { n as CreateObjectOptions } from "./create-object.interface-q1p30YMV.cjs";
+import { t as DeleteObjectOptions } from "./delete-object.interface-B_P7yrm3.cjs";
+import { a as VaultObject, i as ObjectVersion, n as ObjectMetadata, t as ObjectDigest } from "./object.interface-CB8MiPSx.cjs";
+import { n as ReadObjectOptions } from "./read-object.interface-D0Poz3-p.cjs";
+import { n as UpdateObjectOptions } from "./update-object.interface-H3nqYCkH.cjs";
+import * as jose0 from "jose";
+
+//#region src/directory-sync/directory-sync.d.ts
+declare class DirectorySync {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  listDirectories(options?: ListDirectoriesOptions): Promise<AutoPaginatable<Directory, SerializedListDirectoriesOptions>>;
+  getDirectory(id: string): Promise<Directory>;
+  deleteDirectory(id: string): Promise<void>;
+  listGroups(options: ListDirectoryGroupsOptions): Promise<AutoPaginatable<DirectoryGroup, ListDirectoryGroupsOptions>>;
+  listUsers<TCustomAttributes extends object = DefaultCustomAttributes>(options: ListDirectoryUsersOptions): Promise<AutoPaginatable<DirectoryUserWithGroups<TCustomAttributes>, ListDirectoryUsersOptions>>;
+  getUser<TCustomAttributes extends object = DefaultCustomAttributes>(user: string): Promise<DirectoryUserWithGroups<TCustomAttributes>>;
+  getGroup(group: string): Promise<DirectoryGroup>;
+}
+//#endregion
+//#region src/events/events.d.ts
+declare class Events {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  listEvents(options: ListEventOptions): Promise<List<Event>>;
+}
+//#endregion
+//#region src/organizations/organizations.d.ts
+declare class Organizations {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  listOrganizations(options?: ListOrganizationsOptions): Promise<AutoPaginatable<Organization, ListOrganizationsOptions>>;
+  createOrganization(payload: CreateOrganizationOptions, requestOptions?: CreateOrganizationRequestOptions): Promise<Organization>;
+  deleteOrganization(id: string): Promise<void>;
+  getOrganization(id: string): Promise<Organization>;
+  getOrganizationByExternalId(externalId: string): Promise<Organization>;
+  updateOrganization(options: UpdateOrganizationOptions): Promise<Organization>;
+  listOrganizationRoles(options: ListOrganizationRolesOptions): Promise<RoleList>;
+  listOrganizationFeatureFlags(options: ListOrganizationFeatureFlagsOptions): Promise<AutoPaginatable<FeatureFlag>>;
+  listOrganizationApiKeys(options: ListOrganizationApiKeysOptions): Promise<AutoPaginatable<ApiKey>>;
+  createOrganizationApiKey(options: CreateOrganizationApiKeyOptions, requestOptions?: CreateOrganizationApiKeyRequestOptions): Promise<CreatedApiKey>;
+}
+//#endregion
+//#region src/organization-domains/organization-domains.d.ts
+declare class OrganizationDomains {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  get(id: string): Promise<OrganizationDomain>;
+  verify(id: string): Promise<OrganizationDomain>;
+  create(payload: CreateOrganizationDomainOptions): Promise<OrganizationDomain>;
+  delete(id: string): Promise<void>;
+}
+//#endregion
+//#region src/passwordless/passwordless.d.ts
+declare class Passwordless {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  createSession({
+    redirectURI,
+    expiresIn,
+    ...options
+  }: CreatePasswordlessSessionOptions): Promise<PasswordlessSession>;
+  sendSession(sessionId: string): Promise<SendSessionResponse>;
+}
+//#endregion
+//#region src/pipes/pipes.d.ts
+declare class Pipes {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  getAccessToken({
+    provider,
+    ...options
+  }: GetAccessTokenOptions & {
+    provider: string;
+  }): Promise<GetAccessTokenResponse>;
+}
+//#endregion
+//#region src/portal/portal.d.ts
+declare class Portal {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  generateLink({
+    intent,
+    organization,
+    returnUrl,
+    successUrl
+  }: {
+    intent: GeneratePortalLinkIntent;
+    organization: string;
+    returnUrl?: string;
+    successUrl?: string;
+  }): Promise<{
+    link: string;
+  }>;
+}
+//#endregion
+//#region src/sso/sso.d.ts
+declare class SSO {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  listConnections(options?: ListConnectionsOptions): Promise<AutoPaginatable<Connection, SerializedListConnectionsOptions>>;
+  deleteConnection(id: string): Promise<void>;
+  getAuthorizationUrl(options: SSOAuthorizationURLOptions): string;
+  /**
+   * Generates an authorization URL with PKCE parameters automatically generated.
+   * Use this for public clients (CLI apps, Electron, mobile) that cannot
+   * securely store a client secret.
+   *
+   * @returns Object containing url, state, and codeVerifier
+   *
+   * @example
+   * ```typescript
+   * const { url, state, codeVerifier } = await workos.sso.getAuthorizationUrlWithPKCE({
+   *   connection: 'conn_123',
+   *   clientId: 'client_123',
+   *   redirectUri: 'myapp://callback',
+   * });
+   *
+   * // Store state and codeVerifier securely, then redirect user to url
+   * // After callback, exchange the code:
+   * const { profile, accessToken } = await workos.sso.getProfileAndToken({
+   *   code: authorizationCode,
+   *   codeVerifier,
+   *   clientId: 'client_123',
+   * });
+   * ```
+   */
+  getAuthorizationUrlWithPKCE(options: Omit<SSOAuthorizationURLOptions, 'codeChallenge' | 'codeChallengeMethod' | 'state'>): Promise<SSOPKCEAuthorizationURLResult>;
+  getConnection(id: string): Promise<Connection>;
+  /**
+   * Exchange an authorization code for a profile and access token.
+   *
+   * Auto-detects public vs confidential client mode:
+   * - If codeVerifier is provided: Uses PKCE flow (public client)
+   * - If no codeVerifier: Uses client_secret from API key (confidential client)
+   * - If both: Uses both client_secret AND codeVerifier (confidential client with PKCE)
+   *
+   * Using PKCE with confidential clients is recommended by OAuth 2.1 for defense
+   * in depth and provides additional CSRF protection on the authorization flow.
+   *
+   * @throws Error if neither codeVerifier nor API key is available
+   */
+  getProfileAndToken<CustomAttributesType extends UnknownRecord = UnknownRecord>({
+    code,
+    clientId,
+    codeVerifier
+  }: GetProfileAndTokenOptions): Promise<ProfileAndToken<CustomAttributesType>>;
+  getProfile<CustomAttributesType extends UnknownRecord = UnknownRecord>({
+    accessToken
+  }: GetProfileOptions): Promise<Profile<CustomAttributesType>>;
+}
+//#endregion
+//#region src/mfa/mfa.d.ts
+declare class Mfa {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  deleteFactor(id: string): Promise<void>;
+  getFactor(id: string): Promise<Factor$1>;
+  enrollFactor(options: EnrollFactorOptions): Promise<FactorWithSecrets$1>;
+  challengeFactor(options: ChallengeFactorOptions): Promise<Challenge>;
+  verifyChallenge(options: VerifyChallengeOptions): Promise<VerifyResponse>;
+}
+//#endregion
+//#region src/audit-logs/audit-logs.d.ts
+declare class AuditLogs {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  createEvent(organization: string, event: CreateAuditLogEventOptions, options?: CreateAuditLogEventRequestOptions): Promise<void>;
+  createExport(options: AuditLogExportOptions): Promise<AuditLogExport>;
+  getExport(auditLogExportId: string): Promise<AuditLogExport>;
+  createSchema(schema: CreateAuditLogSchemaOptions, options?: CreateAuditLogSchemaRequestOptions): Promise<AuditLogSchema>;
+}
+//#endregion
+//#region src/user-management/session.d.ts
+type RefreshOptions = {
+  cookiePassword?: string;
+  organizationId?: string;
+};
+declare class CookieSession {
+  private userManagement;
+  private cookiePassword;
+  private sessionData;
+  constructor(userManagement: UserManagement, sessionData: string, cookiePassword: string);
+  /**
+   * Authenticates a user with a session cookie.
+   *
+   * @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.
+   */
+  authenticate(): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
+  /**
+   * Refreshes the user's session.
+   *
+   * @param options - Optional options for refreshing the session.
+   * @param options.cookiePassword - The password to use for the new session cookie.
+   * @param options.organizationId - The organization ID to use for the new session cookie.
+   * @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.
+   */
+  refresh(options?: RefreshOptions): Promise<RefreshSessionResponse>;
+  /**
+   * Gets the URL to redirect the user to for logging out.
+   *
+   * @returns The URL to redirect the user to for logging out.
+   */
+  getLogoutUrl({
+    returnTo
+  }?: {
+    returnTo?: string;
+  }): Promise<string>;
+  private isValidJwt;
+}
+//#endregion
+//#region src/user-management/user-management.d.ts
+declare class UserManagement {
+  private readonly workos;
+  private _jwks;
+  clientId: string | undefined;
+  constructor(workos: WorkOS);
+  /**
+   * Resolve clientId from method options or fall back to constructor-provided value.
+   * @throws TypeError if clientId is not available from either source
+   */
+  private resolveClientId;
+  getJWKS(): Promise<ReturnType<typeof jose0.createRemoteJWKSet> | undefined>;
+  /**
+   * Loads a sealed session using the provided session data and cookie password.
+   *
+   * @param options - The options for loading the sealed session.
+   * @param options.sessionData - The sealed session data.
+   * @param options.cookiePassword - The password used to encrypt the session data.
+   * @returns The session class.
+   */
+  loadSealedSession(options: {
+    sessionData: string;
+    cookiePassword: string;
+  }): CookieSession;
+  getUser(userId: string): Promise<User>;
+  getUserByExternalId(externalId: string): Promise<User>;
+  listUsers(options?: ListUsersOptions): Promise<AutoPaginatable<User, SerializedListUsersOptions>>;
+  createUser(payload: CreateUserOptions): Promise<User>;
+  authenticateWithMagicAuth(payload: AuthenticateWithMagicAuthOptions): Promise<AuthenticationResponse>;
+  authenticateWithPassword(payload: AuthenticateWithPasswordOptions): Promise<AuthenticationResponse>;
+  /**
+   * Exchange an authorization code for tokens.
+   *
+   * Auto-detects public vs confidential client mode:
+   * - If codeVerifier is provided: Uses PKCE flow (public client)
+   * - If no codeVerifier: Uses client_secret from API key (confidential client)
+   * - If both: Uses both client_secret AND codeVerifier (confidential client with PKCE)
+   *
+   * Using PKCE with confidential clients is recommended by OAuth 2.1 for defense
+   * in depth and provides additional CSRF protection on the authorization flow.
+   *
+   * @throws Error if neither codeVerifier nor API key is available
+   */
+  authenticateWithCode(payload: AuthenticateWithCodeOptions): Promise<AuthenticationResponse>;
+  /**
+   * Exchange an authorization code for tokens using PKCE (public client flow).
+   * Use this instead of authenticateWithCode() when the client cannot securely
+   * store a client_secret (browser, mobile, CLI, desktop apps).
+   *
+   * @param payload.clientId - Your WorkOS client ID
+   * @param payload.code - The authorization code from the OAuth callback
+   * @param payload.codeVerifier - The PKCE code verifier used to generate the code challenge
+   */
+  authenticateWithCodeAndVerifier(payload: AuthenticateWithCodeAndVerifierOptions): Promise<AuthenticationResponse>;
+  /**
+   * Refresh an access token using a refresh token.
+   * Automatically detects public client mode - if no API key is configured,
+   * omits client_secret from the request.
+   */
+  authenticateWithRefreshToken(payload: AuthenticateWithRefreshTokenOptions): Promise<AuthenticationResponse>;
+  authenticateWithTotp(payload: AuthenticateWithTotpOptions): Promise<AuthenticationResponse>;
+  authenticateWithEmailVerification(payload: AuthenticateWithEmailVerificationOptions): Promise<AuthenticationResponse>;
+  authenticateWithOrganizationSelection(payload: AuthenticateWithOrganizationSelectionOptions): Promise<AuthenticationResponse>;
+  authenticateWithSessionCookie({
+    sessionData,
+    cookiePassword
+  }: AuthenticateWithSessionCookieOptions): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
+  private isValidJwt;
+  private prepareAuthenticationResponse;
+  private sealSessionDataFromAuthenticationResponse;
+  getSessionFromCookie({
+    sessionData,
+    cookiePassword
+  }: SessionHandlerOptions): Promise<SessionCookieData | undefined>;
+  getEmailVerification(emailVerificationId: string): Promise<EmailVerification>;
+  sendVerificationEmail({
+    userId
+  }: SendVerificationEmailOptions): Promise<{
+    user: User;
+  }>;
+  getMagicAuth(magicAuthId: string): Promise<MagicAuth>;
+  createMagicAuth(options: CreateMagicAuthOptions): Promise<MagicAuth>;
+  verifyEmail({
+    code,
+    userId
+  }: VerifyEmailOptions): Promise<{
+    user: User;
+  }>;
+  getPasswordReset(passwordResetId: string): Promise<PasswordReset>;
+  createPasswordReset(options: CreatePasswordResetOptions): Promise<PasswordReset>;
+  resetPassword(payload: ResetPasswordOptions): Promise<{
+    user: User;
+  }>;
+  updateUser(payload: UpdateUserOptions): Promise<User>;
+  enrollAuthFactor(payload: EnrollAuthFactorOptions): Promise<{
+    authenticationFactor: FactorWithSecrets;
+    authenticationChallenge: Challenge;
+  }>;
+  listAuthFactors(options: ListAuthFactorsOptions): Promise<AutoPaginatable<Factor, PaginationOptions>>;
+  listUserFeatureFlags(options: ListUserFeatureFlagsOptions): Promise<AutoPaginatable<FeatureFlag>>;
+  listSessions(userId: string, options?: ListSessionsOptions): Promise<AutoPaginatable<Session, SerializedListSessionsOptions>>;
+  deleteUser(userId: string): Promise<void>;
+  getUserIdentities(userId: string): Promise<Identity[]>;
+  getOrganizationMembership(organizationMembershipId: string): Promise<OrganizationMembership>;
+  listOrganizationMemberships(options: ListOrganizationMembershipsOptions): Promise<AutoPaginatable<OrganizationMembership, SerializedListOrganizationMembershipsOptions>>;
+  createOrganizationMembership(options: CreateOrganizationMembershipOptions): Promise<OrganizationMembership>;
+  updateOrganizationMembership(organizationMembershipId: string, options: UpdateOrganizationMembershipOptions): Promise<OrganizationMembership>;
+  deleteOrganizationMembership(organizationMembershipId: string): Promise<void>;
+  deactivateOrganizationMembership(organizationMembershipId: string): Promise<OrganizationMembership>;
+  reactivateOrganizationMembership(organizationMembershipId: string): Promise<OrganizationMembership>;
+  getInvitation(invitationId: string): Promise<Invitation>;
+  findInvitationByToken(invitationToken: string): Promise<Invitation>;
+  listInvitations(options: ListInvitationsOptions): Promise<AutoPaginatable<Invitation, SerializedListInvitationsOptions>>;
+  sendInvitation(payload: SendInvitationOptions): Promise<Invitation>;
+  acceptInvitation(invitationId: string): Promise<Invitation>;
+  revokeInvitation(invitationId: string): Promise<Invitation>;
+  resendInvitation(invitationId: string, options?: ResendInvitationOptions): Promise<Invitation>;
+  revokeSession(payload: RevokeSessionOptions): Promise<void>;
+  /**
+   * Generate an OAuth 2.0 authorization URL.
+   *
+   * For public clients (browser, mobile, CLI), include PKCE parameters:
+   * - Generate PKCE using workos.pkce.generate()
+   * - Pass codeChallenge and codeChallengeMethod here
+   * - Store codeVerifier and pass to authenticateWithCode() later
+   *
+   * Or use getAuthorizationUrlWithPKCE() which handles PKCE automatically.
+   */
+  getAuthorizationUrl(options: UserManagementAuthorizationURLOptions): string;
+  /**
+   * Generate an OAuth 2.0 authorization URL with automatic PKCE.
+   *
+   * This method generates PKCE parameters internally and returns them along with
+   * the authorization URL. Use this for public clients (CLI apps, Electron, mobile)
+   * that cannot securely store a client secret.
+   *
+   * @returns Object containing url, state, and codeVerifier
+   *
+   * @example
+   * ```typescript
+   * const { url, state, codeVerifier } = await workos.userManagement.getAuthorizationUrlWithPKCE({
+   *   provider: 'authkit',
+   *   clientId: 'client_123',
+   *   redirectUri: 'myapp://callback',
+   * });
+   *
+   * // Store state and codeVerifier securely, then redirect user to url
+   * // After callback, exchange the code:
+   * const response = await workos.userManagement.authenticateWithCode({
+   *   code: authorizationCode,
+   *   codeVerifier,
+   *   clientId: 'client_123',
+   * });
+   * ```
+   */
+  getAuthorizationUrlWithPKCE(options: Omit<UserManagementAuthorizationURLOptions, 'codeChallenge' | 'codeChallengeMethod' | 'state'>): Promise<PKCEAuthorizationURLResult>;
+  getLogoutUrl(options: LogoutURLOptions): string;
+  getJwksUrl(clientId: string): string;
+}
+//#endregion
+//#region src/fga/fga.d.ts
+declare class FGA {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  check(checkOptions: CheckOptions, options?: CheckRequestOptions): Promise<CheckResult>;
+  checkBatch(checkOptions: CheckBatchOptions, options?: CheckRequestOptions): Promise<CheckResult[]>;
+  createResource(resource: CreateResourceOptions): Promise<Resource>;
+  getResource(resource: ResourceInterface | ResourceOptions): Promise<Resource>;
+  listResources(options?: ListResourcesOptions): Promise<AutoPaginatable<Resource, SerializedListResourcesOptions>>;
+  updateResource(options: UpdateResourceOptions): Promise<Resource>;
+  deleteResource(resource: DeleteResourceOptions): Promise<void>;
+  batchWriteResources(options: BatchWriteResourcesOptions): Promise<Resource[]>;
+  writeWarrant(options: WriteWarrantOptions): Promise<WarrantToken>;
+  batchWriteWarrants(options: WriteWarrantOptions[]): Promise<WarrantToken>;
+  listWarrants(options?: ListWarrantsOptions, requestOptions?: ListWarrantsRequestOptions): Promise<AutoPaginatable<Warrant, SerializedListWarrantsOptions>>;
+  query(options: QueryOptions, requestOptions?: QueryRequestOptions): Promise<FgaPaginatable<QueryResult, SerializedQueryOptions>>;
+}
+//#endregion
+//#region src/feature-flags/feature-flags.d.ts
+declare class FeatureFlags {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  listFeatureFlags(options?: ListFeatureFlagsOptions): Promise<AutoPaginatable<FeatureFlag>>;
+  getFeatureFlag(slug: string): Promise<FeatureFlag>;
+  enableFeatureFlag(slug: string): Promise<FeatureFlag>;
+  disableFeatureFlag(slug: string): Promise<FeatureFlag>;
+  addFlagTarget(options: AddFlagTargetOptions): Promise<void>;
+  removeFlagTarget(options: RemoveFlagTargetOptions): Promise<void>;
+}
+//#endregion
+//#region src/widgets/widgets.d.ts
+declare class Widgets {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  getToken(payload: GetTokenOptions): Promise<string>;
+}
+//#endregion
+//#region src/authorization/authorization.d.ts
+declare class Authorization {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  createEnvironmentRole(options: CreateEnvironmentRoleOptions): Promise<EnvironmentRole>;
+  listEnvironmentRoles(): Promise<EnvironmentRoleList>;
+  getEnvironmentRole(slug: string): Promise<EnvironmentRole>;
+  updateEnvironmentRole(slug: string, options: UpdateEnvironmentRoleOptions): Promise<EnvironmentRole>;
+  setEnvironmentRolePermissions(slug: string, options: SetEnvironmentRolePermissionsOptions): Promise<EnvironmentRole>;
+  addEnvironmentRolePermission(slug: string, options: AddEnvironmentRolePermissionOptions): Promise<EnvironmentRole>;
+  createOrganizationRole(organizationId: string, options: CreateOrganizationRoleOptions): Promise<OrganizationRole>;
+  listOrganizationRoles(organizationId: string): Promise<RoleList>;
+  getOrganizationRole(organizationId: string, slug: string): Promise<Role>;
+  updateOrganizationRole(organizationId: string, slug: string, options: UpdateOrganizationRoleOptions): Promise<OrganizationRole>;
+  deleteOrganizationRole(organizationId: string, slug: string): Promise<void>;
+  setOrganizationRolePermissions(organizationId: string, slug: string, options: SetOrganizationRolePermissionsOptions): Promise<OrganizationRole>;
+  addOrganizationRolePermission(organizationId: string, slug: string, options: AddOrganizationRolePermissionOptions): Promise<OrganizationRole>;
+  removeOrganizationRolePermission(organizationId: string, slug: string, options: RemoveOrganizationRolePermissionOptions): Promise<void>;
+  createPermission(options: CreatePermissionOptions): Promise<Permission>;
+  listPermissions(options?: ListPermissionsOptions): Promise<PermissionList>;
+  getPermission(slug: string): Promise<Permission>;
+  updatePermission(slug: string, options: UpdatePermissionOptions): Promise<Permission>;
+  deletePermission(slug: string): Promise<void>;
+}
+//#endregion
+//#region src/factory.d.ts
+/**
+ * Method names available without API key - single source of truth.
+ * Add new public methods here to expose them on PublicUserManagement.
+ */
+type PublicUserManagementMethods = 'getAuthorizationUrl' | 'getAuthorizationUrlWithPKCE' | 'authenticateWithCode' | 'authenticateWithCodeAndVerifier' | 'authenticateWithRefreshToken' | 'getLogoutUrl' | 'getJwksUrl';
+/**
+ * SSO method names available without API key.
+ */
+type PublicSSOMethods = 'getAuthorizationUrl' | 'getAuthorizationUrlWithPKCE' | 'getProfileAndToken';
+/**
+ * Subset of UserManagement methods available without an API key.
+ * Used by public clients (browser, mobile, CLI, desktop apps).
+ */
+type PublicUserManagement = Pick<UserManagement, PublicUserManagementMethods>;
+/**
+ * Subset of SSO methods available without an API key.
+ */
+type PublicSSO = Pick<SSO, PublicSSOMethods>;
+/**
+ * WorkOS client for public/PKCE-only usage.
+ * Returned when initialized with only clientId (no API key).
+ *
+ * For browser, mobile, CLI, and desktop applications that cannot
+ * securely store an API key.
+ */
+interface PublicWorkOS {
+  readonly baseURL: string;
+  readonly clientId: string;
+  readonly pkce: PKCE;
+  readonly userManagement: PublicUserManagement;
+  readonly sso: PublicSSO;
+}
+/**
+ * Options for creating a public client (PKCE-only, no API key).
+ */
+interface PublicClientOptions extends Omit<WorkOSOptions, 'apiKey'> {
+  clientId: string;
+  /** Discriminant: ensures TypeScript selects PublicWorkOS overload when apiKey is absent */
+  apiKey?: never;
+}
+/**
+ * Options for creating a confidential client (with API key).
+ */
+interface ConfidentialClientOptions extends WorkOSOptions {
+  apiKey: string;
+}
+/**
+ * Create a type-safe WorkOS client.
+ *
+ * Returns a narrowed `PublicWorkOS` type when only `clientId` is provided,
+ * ensuring compile-time safety for public client usage. Returns the full
+ * `WorkOS` type when an API key is provided.
+ *
+ * Unlike the `WorkOS` constructor, this factory does NOT read from
+ * environment variables. Pass credentials explicitly for predictable types.
+ *
+ * @example
+ * // Public client (browser, mobile, CLI) - returns PublicWorkOS
+ * const workos = createWorkOS({ clientId: 'client_123' });
+ * await workos.userManagement.getAuthorizationUrlWithPKCE({...}); // OK
+ * workos.userManagement.listUsers(); // TypeScript error!
+ *
+ * @example
+ * // Confidential client (server) - returns full WorkOS
+ * const workos = createWorkOS({
+ *   apiKey: process.env.WORKOS_API_KEY!,
+ *   clientId: 'client_123'
+ * });
+ * await workos.userManagement.listUsers(); // OK
+ */
+declare function createWorkOS(options: PublicClientOptions): PublicWorkOS;
+declare function createWorkOS(options: ConfidentialClientOptions): WorkOS;
+//#endregion
+//#region src/index.worker.d.ts
+declare class WorkOSWorker extends WorkOS {
+  /** @override */
+  createHttpClient(options: WorkOSOptions, userAgent: string): HttpClient;
+  /** @override */
+  createWebhookClient(): Webhooks;
+  getCryptoProvider(): CryptoProvider;
+  /** @override */
+  createActionsClient(): Actions;
+  /** @override */
+  emitWarning(warning: string): void;
+}
+//#endregion
+//#region src/vault/vault.d.ts
+declare class Vault {
+  private readonly workos;
+  private cryptoProvider;
+  constructor(workos: WorkOS);
+  private decode;
+  createObject(options: CreateObjectOptions): Promise<ObjectMetadata>;
+  listObjects(options?: PaginationOptions | undefined): Promise<List<ObjectDigest>>;
+  listObjectVersions(options: ReadObjectOptions): Promise<ObjectVersion[]>;
+  readObject(options: ReadObjectOptions): Promise<VaultObject>;
+  readObjectByName(name: string): Promise<VaultObject>;
+  describeObject(options: ReadObjectOptions): Promise<VaultObject>;
+  updateObject(options: UpdateObjectOptions): Promise<VaultObject>;
+  deleteObject(options: DeleteObjectOptions): Promise<void>;
+  createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair>;
+  decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey>;
+  encrypt(data: string, context: KeyContext, associatedData?: string): Promise<string>;
+  decrypt(encryptedData: string, associatedData?: string): Promise<string>;
+}
+//#endregion
+//#region src/workos.d.ts
+declare class WorkOS {
+  readonly baseURL: string;
+  readonly client: HttpClient;
+  readonly clientId?: string;
+  readonly key?: string;
+  readonly options: WorkOSOptions;
+  readonly pkce: PKCE;
+  private readonly hasApiKey;
+  readonly actions: Actions;
+  readonly apiKeys: ApiKeys;
+  readonly auditLogs: AuditLogs;
+  readonly authorization: Authorization;
+  readonly directorySync: DirectorySync;
+  readonly events: Events;
+  readonly featureFlags: FeatureFlags;
+  readonly fga: FGA;
+  readonly mfa: Mfa;
+  readonly organizations: Organizations;
+  readonly organizationDomains: OrganizationDomains;
+  readonly passwordless: Passwordless;
+  readonly pipes: Pipes;
+  readonly portal: Portal;
+  readonly sso: SSO;
+  readonly userManagement: UserManagement;
+  readonly vault: Vault;
+  readonly webhooks: Webhooks;
+  readonly widgets: Widgets;
+  /**
+   * Create a new WorkOS client.
+   *
+   * @param keyOrOptions - API key string, or options object
+   * @param maybeOptions - Options when first argument is API key
+   *
+   * @example
+   * // Server-side with API key (string)
+   * const workos = new WorkOS('sk_...');
+   *
+   * @example
+   * // Server-side with API key (object)
+   * const workos = new WorkOS({ apiKey: 'sk_...', clientId: 'client_...' });
+   *
+   * @example
+   * // PKCE/public client (no API key)
+   * const workos = new WorkOS({ clientId: 'client_...' });
+   */
+  constructor(keyOrOptions?: string | WorkOSOptions, maybeOptions?: WorkOSOptions);
+  private createUserAgent;
+  createWebhookClient(): Webhooks;
+  createActionsClient(): Actions;
+  getCryptoProvider(): CryptoProvider;
+  createHttpClient(options: WorkOSOptions, userAgent: string): HttpClient;
+  get version(): string;
+  /**
+   * Require API key for methods that need it.
+   * @param methodName - Name of the method requiring API key (for error message)
+   * @throws ApiKeyRequiredException if no API key was provided
+   */
+  requireApiKey(methodName: string): void;
+  post<Result = any, Entity = any>(path: string, entity: Entity, options?: PostOptions): Promise<{
+    data: Result;
+  }>;
+  get<Result = any>(path: string, options?: GetOptions): Promise<{
+    data: Result;
+  }>;
+  put<Result = any, Entity = any>(path: string, entity: Entity, options?: PutOptions): Promise<{
+    data: Result;
+  }>;
+  patch<Result = any, Entity = any>(path: string, entity: Entity, options?: PatchOptions): Promise<{
+    data: Result;
+  }>;
+  delete(path: string, query?: any): Promise<void>;
+  emitWarning(warning: string): void;
+  private handleParseError;
+  private handleHttpError;
+}
+//#endregion
+//#region src/api-keys/api-keys.d.ts
+declare class ApiKeys {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  validateApiKey(payload: ValidateApiKeyOptions): Promise<ValidateApiKeyResponse>;
+  deleteApiKey(id: string): Promise<void>;
+}
+//#endregion
+export { OrganizationDomains as C, DirectorySync as E, Passwordless as S, Events as T, AuditLogs as _, ConfidentialClientOptions as a, Portal as b, PublicUserManagement as c, Authorization as d, Widgets as f, CookieSession as g, UserManagement as h, WorkOSWorker as i, PublicWorkOS as l, FGA as m, WorkOS as n, PublicClientOptions as o, FeatureFlags as p, Vault as r, PublicSSO as s, ApiKeys as t, createWorkOS as u, Mfa as v, Organizations as w, Pipes as x, SSO as y };
+//# sourceMappingURL=api-keys-CrR113By.d.cts.map