@workos-inc/node 8.1.0 → 8.3.0

package/lib/user-management-BiK0k4qR.cjs

@@ -0,0 +1,539 @@
+const require_pagination = require('./pagination-BG1uBuL4.cjs');
+const require_authenticate_with_code_options_serializer = require('./authenticate-with-code-options.serializer-BMz_1tBW.cjs');
+const require_authenticate_with_code_and_verifier_options_serializer = require('./authenticate-with-code-and-verifier-options.serializer-BEILlMya.cjs');
+const require_authenticate_with_magic_auth_options_serializer = require('./authenticate-with-magic-auth-options.serializer-CYU4H_5p.cjs');
+const require_authenticate_with_password_options_serializer = require('./authenticate-with-password-options.serializer-DPYtf-9Q.cjs');
+const require_authenticate_with_refresh_token_options_serializer = require('./authenticate-with-refresh-token.options.serializer-Ba3QVuMY.cjs');
+const require_authenticate_with_refresh_token_public_client_options_serializer = require('./authenticate-with-refresh-token-public-client-options.serializer-BUO_bMxj.cjs');
+const require_authenticate_with_totp_options_serializer = require('./authenticate-with-totp-options.serializer-Dv5iQHm4.cjs');
+const require_user_serializer = require('./user.serializer-Y5EM8MeK.cjs');
+const require_authentication_response_serializer = require('./authentication-response.serializer-DCSj_OPJ.cjs');
+const require_create_magic_auth_options_serializer = require('./create-magic-auth-options.serializer-DN24SZEy.cjs');
+const require_create_password_reset_options_serializer = require('./create-password-reset-options.serializer-C9rwv-Gj.cjs');
+const require_email_verification_serializer = require('./email-verification.serializer-e6Mbvjvd.cjs');
+const require_enroll_auth_factor_options_serializer = require('./enroll-auth-factor-options.serializer-BBfKN5IU.cjs');
+const require_factor_serializer = require('./factor.serializer-CiRgOFhH.cjs');
+const require_invitation_serializer = require('./invitation.serializer-BEVUkLP9.cjs');
+const require_list_sessions_options_serializer = require('./list-sessions-options.serializer-DXI2uV_8.cjs');
+const require_magic_auth_serializer = require('./magic-auth.serializer-By4HyvgZ.cjs');
+const require_password_reset_serializer = require('./password-reset.serializer-D8Kbnirv.cjs');
+const require_reset_password_options_serializer = require('./reset-password-options.serializer-6VTahIzL.cjs');
+const require_session_serializer = require('./session.serializer-Dmj9Hm3q.cjs');
+const require_create_user_options_serializer = require('./create-user-options.serializer-CphvVoaV.cjs');
+const require_update_user_options_serializer = require('./update-user-options.serializer-H11lRdjH.cjs');
+const require_organization_membership_serializer = require('./organization-membership.serializer-DVtJVaRT.cjs');
+const require_fetch_and_deserialize = require('./fetch-and-deserialize-B6lbfouV.cjs');
+const require_feature_flag_serializer = require('./feature-flag.serializer-iuO0V07A.cjs');
+const require_query_string = require('./query-string-B9WibUJl.cjs');
+const require_challenge_serializer = require('./challenge.serializer-Dzoig6Tb.cjs');
+const require_seal = require('./seal-B34v5bmh.cjs');
+const require_env = require('./env-BRem2_1e.cjs');
+const require_authenticate_with_session_cookie_interface = require('./authenticate-with-session-cookie.interface-B4eQTrfN.cjs');
+const require_revoke_session_options_interface = require('./revoke-session-options.interface-DNh6uGcR.cjs');
+const require_authenticate_with_email_verification_serializer = require('./authenticate-with-email-verification.serializer-Bf1j1ew9.cjs');
+const require_authenticate_with_organization_selection_options_serializer = require('./authenticate-with-organization-selection-options.serializer-Did46zvW.cjs');
+const require_create_organization_membership_options_serializer = require('./create-organization-membership-options.serializer-J20uU0fe.cjs');
+const require_identity_serializer = require('./identity.serializer-aL8fr6V6.cjs');
+const require_list_invitations_options_serializer = require('./list-invitations-options.serializer-BBeD69mZ.cjs');
+const require_list_organization_memberships_options_serializer = require('./list-organization-memberships-options.serializer-DHBnW5rP.cjs');
+const require_list_users_options_serializer = require('./list-users-options.serializer-NjRJdnZI.cjs');
+const require_resend_invitation_options_serializer = require('./resend-invitation-options.serializer-DnsrXnYw.cjs');
+const require_send_invitation_options_serializer = require('./send-invitation-options.serializer-D5x3ss8t.cjs');
+const require_update_organization_membership_options_serializer = require('./update-organization-membership-options.serializer-BL-XfapK.cjs');
+const require_jose = require('./jose-B0lH7z8y.cjs');
+const require_session = require('./session-D_vnUDl1.cjs');
+
+//#region src/user-management/user-management.ts
+var UserManagement = class {
+	_jwks;
+	clientId;
+	constructor(workos) {
+		this.workos = workos;
+		const { clientId } = workos.options;
+		this.clientId = clientId;
+	}
+	/**
+	* Resolve clientId from method options or fall back to constructor-provided value.
+	* @throws TypeError if clientId is not available from either source
+	*/
+	resolveClientId(clientId) {
+		const resolved = clientId ?? this.clientId;
+		if (!resolved) throw new TypeError("clientId is required. Provide it in method options or when initializing WorkOS.");
+		return resolved;
+	}
+	async getJWKS() {
+		const { createRemoteJWKSet } = await require_jose.getJose();
+		if (!this.clientId) return;
+		this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), { cooldownDuration: 1e3 * 60 * 5 });
+		return this._jwks;
+	}
+	/**
+	* Loads a sealed session using the provided session data and cookie password.
+	*
+	* @param options - The options for loading the sealed session.
+	* @param options.sessionData - The sealed session data.
+	* @param options.cookiePassword - The password used to encrypt the session data.
+	* @returns The session class.
+	*/
+	loadSealedSession(options) {
+		return new require_session.CookieSession(this, options.sessionData, options.cookiePassword);
+	}
+	async getUser(userId) {
+		const { data } = await this.workos.get(`/user_management/users/${userId}`);
+		return require_user_serializer.deserializeUser(data);
+	}
+	async getUserByExternalId(externalId) {
+		const { data } = await this.workos.get(`/user_management/users/external_id/${externalId}`);
+		return require_user_serializer.deserializeUser(data);
+	}
+	async listUsers(options) {
+		return new require_pagination.AutoPaginatable(await require_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/user_management/users", require_user_serializer.deserializeUser, options ? require_list_users_options_serializer.serializeListUsersOptions(options) : void 0), (params) => require_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/user_management/users", require_user_serializer.deserializeUser, params), options ? require_list_users_options_serializer.serializeListUsersOptions(options) : void 0);
+	}
+	async createUser(payload) {
+		const { data } = await this.workos.post("/user_management/users", require_create_user_options_serializer.serializeCreateUserOptions(payload));
+		return require_user_serializer.deserializeUser(data);
+	}
+	async authenticateWithMagicAuth(payload) {
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
+		const { data } = await this.workos.post("/user_management/authenticate", require_authenticate_with_magic_auth_options_serializer.serializeAuthenticateWithMagicAuthOptions({
+			...remainingPayload,
+			clientId: resolvedClientId,
+			clientSecret: this.workos.key
+		}));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithPassword(payload) {
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
+		const { data } = await this.workos.post("/user_management/authenticate", require_authenticate_with_password_options_serializer.serializeAuthenticateWithPasswordOptions({
+			...remainingPayload,
+			clientId: resolvedClientId,
+			clientSecret: this.workos.key
+		}));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	/**
+	* Exchange an authorization code for tokens.
+	*
+	* Auto-detects public vs confidential client mode:
+	* - If codeVerifier is provided: Uses PKCE flow (public client)
+	* - If no codeVerifier: Uses client_secret from API key (confidential client)
+	* - If both: Uses both client_secret AND codeVerifier (confidential client with PKCE)
+	*
+	* Using PKCE with confidential clients is recommended by OAuth 2.1 for defense
+	* in depth and provides additional CSRF protection on the authorization flow.
+	*
+	* @throws Error if neither codeVerifier nor API key is available
+	*/
+	async authenticateWithCode(payload) {
+		const { session, clientId, codeVerifier, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
+		if (codeVerifier !== void 0 && codeVerifier.trim() === "") throw new TypeError("codeVerifier cannot be an empty string. Generate a valid PKCE pair using workos.pkce.generate().");
+		const hasApiKey = !!this.workos.key;
+		if (!!!codeVerifier && !hasApiKey) throw new TypeError("authenticateWithCode requires either a codeVerifier (for public clients) or an API key configured on the WorkOS instance (for confidential clients).");
+		const { data } = await this.workos.post("/user_management/authenticate", require_authenticate_with_code_options_serializer.serializeAuthenticateWithCodeOptions({
+			...remainingPayload,
+			clientId: resolvedClientId,
+			codeVerifier,
+			clientSecret: hasApiKey ? this.workos.key : void 0
+		}), { skipApiKeyCheck: !hasApiKey });
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	/**
+	* Exchange an authorization code for tokens using PKCE (public client flow).
+	* Use this instead of authenticateWithCode() when the client cannot securely
+	* store a client_secret (browser, mobile, CLI, desktop apps).
+	*
+	* @param payload.clientId - Your WorkOS client ID
+	* @param payload.code - The authorization code from the OAuth callback
+	* @param payload.codeVerifier - The PKCE code verifier used to generate the code challenge
+	*/
+	async authenticateWithCodeAndVerifier(payload) {
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
+		const { data } = await this.workos.post("/user_management/authenticate", require_authenticate_with_code_and_verifier_options_serializer.serializeAuthenticateWithCodeAndVerifierOptions({
+			...remainingPayload,
+			clientId: resolvedClientId
+		}), { skipApiKeyCheck: true });
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	/**
+	* Refresh an access token using a refresh token.
+	* Automatically detects public client mode - if no API key is configured,
+	* omits client_secret from the request.
+	*/
+	async authenticateWithRefreshToken(payload) {
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
+		const isPublicClient = !this.workos.key;
+		const body = isPublicClient ? require_authenticate_with_refresh_token_public_client_options_serializer.serializeAuthenticateWithRefreshTokenPublicClientOptions({
+			...remainingPayload,
+			clientId: resolvedClientId
+		}) : require_authenticate_with_refresh_token_options_serializer.serializeAuthenticateWithRefreshTokenOptions({
+			...remainingPayload,
+			clientId: resolvedClientId,
+			clientSecret: this.workos.key
+		});
+		const { data } = await this.workos.post("/user_management/authenticate", body, { skipApiKeyCheck: isPublicClient });
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithTotp(payload) {
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
+		const { data } = await this.workos.post("/user_management/authenticate", require_authenticate_with_totp_options_serializer.serializeAuthenticateWithTotpOptions({
+			...remainingPayload,
+			clientId: resolvedClientId,
+			clientSecret: this.workos.key
+		}));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithEmailVerification(payload) {
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
+		const { data } = await this.workos.post("/user_management/authenticate", require_authenticate_with_email_verification_serializer.serializeAuthenticateWithEmailVerificationOptions({
+			...remainingPayload,
+			clientId: resolvedClientId,
+			clientSecret: this.workos.key
+		}));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithOrganizationSelection(payload) {
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
+		const { data } = await this.workos.post("/user_management/authenticate", require_authenticate_with_organization_selection_options_serializer.serializeAuthenticateWithOrganizationSelectionOptions({
+			...remainingPayload,
+			clientId: resolvedClientId,
+			clientSecret: this.workos.key
+		}));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithSessionCookie({ sessionData, cookiePassword = require_env.getEnv("WORKOS_COOKIE_PASSWORD") }) {
+		if (!cookiePassword) throw new Error("Cookie password is required");
+		if (!await this.getJWKS()) throw new Error("Must provide clientId to initialize JWKS");
+		const { decodeJwt } = await require_jose.getJose();
+		if (!sessionData) return {
+			authenticated: false,
+			reason: require_authenticate_with_session_cookie_interface.AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED
+		};
+		const session = await require_seal.unsealData(sessionData, { password: cookiePassword });
+		if (!session.accessToken) return {
+			authenticated: false,
+			reason: require_authenticate_with_session_cookie_interface.AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE
+		};
+		if (!await this.isValidJwt(session.accessToken)) return {
+			authenticated: false,
+			reason: require_authenticate_with_session_cookie_interface.AuthenticateWithSessionCookieFailureReason.INVALID_JWT
+		};
+		const { sid: sessionId, org_id: organizationId, role, roles, permissions, entitlements, feature_flags: featureFlags } = decodeJwt(session.accessToken);
+		return {
+			authenticated: true,
+			sessionId,
+			organizationId,
+			role,
+			roles,
+			user: session.user,
+			permissions,
+			entitlements,
+			featureFlags,
+			accessToken: session.accessToken,
+			authenticationMethod: session.authenticationMethod
+		};
+	}
+	async isValidJwt(accessToken) {
+		const jwks = await this.getJWKS();
+		const { jwtVerify } = await require_jose.getJose();
+		if (!jwks) throw new Error("Must provide clientId to initialize JWKS");
+		try {
+			await jwtVerify(accessToken, jwks);
+			return true;
+		} catch (e) {
+			if (e instanceof Error && "code" in e && typeof e.code === "string" && (e.code.startsWith("ERR_JWT_") || e.code.startsWith("ERR_JWS_"))) return false;
+			throw e;
+		}
+	}
+	async prepareAuthenticationResponse({ authenticationResponse, session }) {
+		if (session?.sealSession) {
+			if (!this.workos.key) throw new Error("Session sealing requires server-side usage with an API key. Public clients should store tokens directly (e.g., secure storage on mobile, keychain on desktop).");
+			return {
+				...authenticationResponse,
+				sealedSession: await this.sealSessionDataFromAuthenticationResponse({
+					authenticationResponse,
+					cookiePassword: session.cookiePassword
+				})
+			};
+		}
+		return authenticationResponse;
+	}
+	async sealSessionDataFromAuthenticationResponse({ authenticationResponse, cookiePassword }) {
+		if (!cookiePassword) throw new Error("Cookie password is required");
+		const { decodeJwt } = await require_jose.getJose();
+		const { org_id: organizationIdFromAccessToken } = decodeJwt(authenticationResponse.accessToken);
+		return require_seal.sealData({
+			organizationId: organizationIdFromAccessToken,
+			user: authenticationResponse.user,
+			accessToken: authenticationResponse.accessToken,
+			refreshToken: authenticationResponse.refreshToken,
+			authenticationMethod: authenticationResponse.authenticationMethod,
+			impersonator: authenticationResponse.impersonator
+		}, { password: cookiePassword });
+	}
+	async getSessionFromCookie({ sessionData, cookiePassword = require_env.getEnv("WORKOS_COOKIE_PASSWORD") }) {
+		if (!cookiePassword) throw new Error("Cookie password is required");
+		if (sessionData) return require_seal.unsealData(sessionData, { password: cookiePassword });
+	}
+	async getEmailVerification(emailVerificationId) {
+		const { data } = await this.workos.get(`/user_management/email_verification/${emailVerificationId}`);
+		return require_email_verification_serializer.deserializeEmailVerification(data);
+	}
+	async sendVerificationEmail({ userId }) {
+		const { data } = await this.workos.post(`/user_management/users/${userId}/email_verification/send`, {});
+		return { user: require_user_serializer.deserializeUser(data.user) };
+	}
+	async getMagicAuth(magicAuthId) {
+		const { data } = await this.workos.get(`/user_management/magic_auth/${magicAuthId}`);
+		return require_magic_auth_serializer.deserializeMagicAuth(data);
+	}
+	async createMagicAuth(options) {
+		const { data } = await this.workos.post("/user_management/magic_auth", require_create_magic_auth_options_serializer.serializeCreateMagicAuthOptions({ ...options }));
+		return require_magic_auth_serializer.deserializeMagicAuth(data);
+	}
+	async verifyEmail({ code, userId }) {
+		const { data } = await this.workos.post(`/user_management/users/${userId}/email_verification/confirm`, { code });
+		return { user: require_user_serializer.deserializeUser(data.user) };
+	}
+	async getPasswordReset(passwordResetId) {
+		const { data } = await this.workos.get(`/user_management/password_reset/${passwordResetId}`);
+		return require_password_reset_serializer.deserializePasswordReset(data);
+	}
+	async createPasswordReset(options) {
+		const { data } = await this.workos.post("/user_management/password_reset", require_create_password_reset_options_serializer.serializeCreatePasswordResetOptions({ ...options }));
+		return require_password_reset_serializer.deserializePasswordReset(data);
+	}
+	async resetPassword(payload) {
+		const { data } = await this.workos.post("/user_management/password_reset/confirm", require_reset_password_options_serializer.serializeResetPasswordOptions(payload));
+		return { user: require_user_serializer.deserializeUser(data.user) };
+	}
+	async updateUser(payload) {
+		const { data } = await this.workos.put(`/user_management/users/${payload.userId}`, require_update_user_options_serializer.serializeUpdateUserOptions(payload));
+		return require_user_serializer.deserializeUser(data);
+	}
+	async enrollAuthFactor(payload) {
+		const { data } = await this.workos.post(`/user_management/users/${payload.userId}/auth_factors`, require_enroll_auth_factor_options_serializer.serializeEnrollAuthFactorOptions(payload));
+		return {
+			authenticationFactor: require_factor_serializer.deserializeFactorWithSecrets(data.authentication_factor),
+			authenticationChallenge: require_challenge_serializer.deserializeChallenge(data.authentication_challenge)
+		};
+	}
+	async listAuthFactors(options) {
+		const { userId, ...restOfOptions } = options;
+		return new require_pagination.AutoPaginatable(await require_fetch_and_deserialize.fetchAndDeserialize(this.workos, `/user_management/users/${userId}/auth_factors`, require_factor_serializer.deserializeFactor, restOfOptions), (params) => require_fetch_and_deserialize.fetchAndDeserialize(this.workos, `/user_management/users/${userId}/auth_factors`, require_factor_serializer.deserializeFactor, params), restOfOptions);
+	}
+	async listUserFeatureFlags(options) {
+		const { userId, ...paginationOptions } = options;
+		return new require_pagination.AutoPaginatable(await require_fetch_and_deserialize.fetchAndDeserialize(this.workos, `/user_management/users/${userId}/feature-flags`, require_feature_flag_serializer.deserializeFeatureFlag, paginationOptions), (params) => require_fetch_and_deserialize.fetchAndDeserialize(this.workos, `/user_management/users/${userId}/feature-flags`, require_feature_flag_serializer.deserializeFeatureFlag, params), paginationOptions);
+	}
+	async listSessions(userId, options) {
+		return new require_pagination.AutoPaginatable(await require_fetch_and_deserialize.fetchAndDeserialize(this.workos, `/user_management/users/${userId}/sessions`, require_session_serializer.deserializeSession, options ? require_list_sessions_options_serializer.serializeListSessionsOptions(options) : void 0), (params) => require_fetch_and_deserialize.fetchAndDeserialize(this.workos, `/user_management/users/${userId}/sessions`, require_session_serializer.deserializeSession, params), options ? require_list_sessions_options_serializer.serializeListSessionsOptions(options) : void 0);
+	}
+	async deleteUser(userId) {
+		await this.workos.delete(`/user_management/users/${userId}`);
+	}
+	async getUserIdentities(userId) {
+		if (!userId) throw new TypeError(`Incomplete arguments. Need to specify 'userId'.`);
+		const { data } = await this.workos.get(`/user_management/users/${userId}/identities`);
+		return require_identity_serializer.deserializeIdentities(data);
+	}
+	async getOrganizationMembership(organizationMembershipId) {
+		const { data } = await this.workos.get(`/user_management/organization_memberships/${organizationMembershipId}`);
+		return require_organization_membership_serializer.deserializeOrganizationMembership(data);
+	}
+	async listOrganizationMemberships(options) {
+		const serializedOptions = require_list_organization_memberships_options_serializer.serializeListOrganizationMembershipsOptions(options);
+		return new require_pagination.AutoPaginatable(await require_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/user_management/organization_memberships", require_organization_membership_serializer.deserializeOrganizationMembership, serializedOptions), (params) => require_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/user_management/organization_memberships", require_organization_membership_serializer.deserializeOrganizationMembership, params), serializedOptions);
+	}
+	async createOrganizationMembership(options) {
+		const { data } = await this.workos.post("/user_management/organization_memberships", require_create_organization_membership_options_serializer.serializeCreateOrganizationMembershipOptions(options));
+		return require_organization_membership_serializer.deserializeOrganizationMembership(data);
+	}
+	async updateOrganizationMembership(organizationMembershipId, options) {
+		const { data } = await this.workos.put(`/user_management/organization_memberships/${organizationMembershipId}`, require_update_organization_membership_options_serializer.serializeUpdateOrganizationMembershipOptions(options));
+		return require_organization_membership_serializer.deserializeOrganizationMembership(data);
+	}
+	async deleteOrganizationMembership(organizationMembershipId) {
+		await this.workos.delete(`/user_management/organization_memberships/${organizationMembershipId}`);
+	}
+	async deactivateOrganizationMembership(organizationMembershipId) {
+		const { data } = await this.workos.put(`/user_management/organization_memberships/${organizationMembershipId}/deactivate`, {});
+		return require_organization_membership_serializer.deserializeOrganizationMembership(data);
+	}
+	async reactivateOrganizationMembership(organizationMembershipId) {
+		const { data } = await this.workos.put(`/user_management/organization_memberships/${organizationMembershipId}/reactivate`, {});
+		return require_organization_membership_serializer.deserializeOrganizationMembership(data);
+	}
+	async getInvitation(invitationId) {
+		const { data } = await this.workos.get(`/user_management/invitations/${invitationId}`);
+		return require_invitation_serializer.deserializeInvitation(data);
+	}
+	async findInvitationByToken(invitationToken) {
+		const { data } = await this.workos.get(`/user_management/invitations/by_token/${invitationToken}`);
+		return require_invitation_serializer.deserializeInvitation(data);
+	}
+	async listInvitations(options) {
+		return new require_pagination.AutoPaginatable(await require_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/user_management/invitations", require_invitation_serializer.deserializeInvitation, options ? require_list_invitations_options_serializer.serializeListInvitationsOptions(options) : void 0), (params) => require_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/user_management/invitations", require_invitation_serializer.deserializeInvitation, params), options ? require_list_invitations_options_serializer.serializeListInvitationsOptions(options) : void 0);
+	}
+	async sendInvitation(payload) {
+		const { data } = await this.workos.post("/user_management/invitations", require_send_invitation_options_serializer.serializeSendInvitationOptions({ ...payload }));
+		return require_invitation_serializer.deserializeInvitation(data);
+	}
+	async acceptInvitation(invitationId) {
+		const { data } = await this.workos.post(`/user_management/invitations/${invitationId}/accept`, null);
+		return require_invitation_serializer.deserializeInvitation(data);
+	}
+	async revokeInvitation(invitationId) {
+		const { data } = await this.workos.post(`/user_management/invitations/${invitationId}/revoke`, null);
+		return require_invitation_serializer.deserializeInvitation(data);
+	}
+	async resendInvitation(invitationId, options) {
+		const { data } = await this.workos.post(`/user_management/invitations/${invitationId}/resend`, options ? require_resend_invitation_options_serializer.serializeResendInvitationOptions(options) : {});
+		return require_invitation_serializer.deserializeInvitation(data);
+	}
+	async revokeSession(payload) {
+		await this.workos.post("/user_management/sessions/revoke", require_revoke_session_options_interface.serializeRevokeSessionOptions(payload));
+	}
+	/**
+	* Generate an OAuth 2.0 authorization URL.
+	*
+	* For public clients (browser, mobile, CLI), include PKCE parameters:
+	* - Generate PKCE using workos.pkce.generate()
+	* - Pass codeChallenge and codeChallengeMethod here
+	* - Store codeVerifier and pass to authenticateWithCode() later
+	*
+	* Or use getAuthorizationUrlWithPKCE() which handles PKCE automatically.
+	*/
+	getAuthorizationUrl(options) {
+		const { connectionId, codeChallenge, codeChallengeMethod, clientId, domainHint, loginHint, organizationId, provider, providerQueryParams, providerScopes, prompt, redirectUri, state, screenHint } = options;
+		const resolvedClientId = this.resolveClientId(clientId);
+		if (!provider && !connectionId && !organizationId) throw new TypeError(`Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`);
+		if (provider !== "authkit" && screenHint) throw new TypeError(`'screenHint' is only supported for 'authkit' provider`);
+		const query = require_query_string.toQueryString({
+			connection_id: connectionId,
+			code_challenge: codeChallenge,
+			code_challenge_method: codeChallengeMethod,
+			organization_id: organizationId,
+			domain_hint: domainHint,
+			login_hint: loginHint,
+			provider,
+			provider_query_params: providerQueryParams,
+			provider_scopes: providerScopes,
+			prompt,
+			client_id: resolvedClientId,
+			redirect_uri: redirectUri,
+			response_type: "code",
+			state,
+			screen_hint: screenHint
+		});
+		return `${this.workos.baseURL}/user_management/authorize?${query}`;
+	}
+	/**
+	* Generate an OAuth 2.0 authorization URL with automatic PKCE.
+	*
+	* This method generates PKCE parameters internally and returns them along with
+	* the authorization URL. Use this for public clients (CLI apps, Electron, mobile)
+	* that cannot securely store a client secret.
+	*
+	* @returns Object containing url, state, and codeVerifier
+	*
+	* @example
+	* ```typescript
+	* const { url, state, codeVerifier } = await workos.userManagement.getAuthorizationUrlWithPKCE({
+	*   provider: 'authkit',
+	*   clientId: 'client_123',
+	*   redirectUri: 'myapp://callback',
+	* });
+	*
+	* // Store state and codeVerifier securely, then redirect user to url
+	* // After callback, exchange the code:
+	* const response = await workos.userManagement.authenticateWithCode({
+	*   code: authorizationCode,
+	*   codeVerifier,
+	*   clientId: 'client_123',
+	* });
+	* ```
+	*/
+	async getAuthorizationUrlWithPKCE(options) {
+		const { clientId, connectionId, domainHint, loginHint, organizationId, provider, providerQueryParams, providerScopes, prompt, redirectUri, screenHint } = options;
+		const resolvedClientId = this.resolveClientId(clientId);
+		if (!provider && !connectionId && !organizationId) throw new TypeError(`Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`);
+		if (provider !== "authkit" && screenHint) throw new TypeError(`'screenHint' is only supported for 'authkit' provider`);
+		const pkce = await this.workos.pkce.generate();
+		const state = this.workos.pkce.generateCodeVerifier(43);
+		const query = require_query_string.toQueryString({
+			connection_id: connectionId,
+			code_challenge: pkce.codeChallenge,
+			code_challenge_method: "S256",
+			organization_id: organizationId,
+			domain_hint: domainHint,
+			login_hint: loginHint,
+			provider,
+			provider_query_params: providerQueryParams,
+			provider_scopes: providerScopes,
+			prompt,
+			client_id: resolvedClientId,
+			redirect_uri: redirectUri,
+			response_type: "code",
+			state,
+			screen_hint: screenHint
+		});
+		return {
+			url: `${this.workos.baseURL}/user_management/authorize?${query}`,
+			state,
+			codeVerifier: pkce.codeVerifier
+		};
+	}
+	getLogoutUrl(options) {
+		const { sessionId, returnTo } = options;
+		if (!sessionId) throw new TypeError(`Incomplete arguments. Need to specify 'sessionId'.`);
+		const url = new URL("/user_management/sessions/logout", this.workos.baseURL);
+		url.searchParams.set("session_id", sessionId);
+		if (returnTo) url.searchParams.set("return_to", returnTo);
+		return url.toString();
+	}
+	getJwksUrl(clientId) {
+		if (!clientId) throw new TypeError("clientId must be a valid clientId");
+		return `${this.workos.baseURL}/sso/jwks/${clientId}`;
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'UserManagement', {
+  enumerable: true,
+  get: function () {
+    return UserManagement;
+  }
+});
+//# sourceMappingURL=user-management-BiK0k4qR.cjs.map