@workos-inc/node 8.7.0 → 8.9.0

package/lib/sso/sso.js

@@ -1,130 +0,0 @@
-import { AutoPaginatable } from "../common/utils/pagination.js";
-import { deserializeConnection } from "./serializers/connection.serializer.js";
-import { serializeListConnectionsOptions } from "./serializers/list-connections-options.serializer.js";
-import { deserializeProfile } from "./serializers/profile.serializer.js";
-import { deserializeProfileAndToken } from "./serializers/profile-and-token.serializer.js";
-import { fetchAndDeserialize } from "../common/utils/fetch-and-deserialize.js";
-import { toQueryString } from "../common/utils/query-string.js";
-
-//#region src/sso/sso.ts
-var SSO = class {
-	constructor(workos) {
-		this.workos = workos;
-	}
-	async listConnections(options) {
-		return new AutoPaginatable(await fetchAndDeserialize(this.workos, "/connections", deserializeConnection, options ? serializeListConnectionsOptions(options) : void 0), (params) => fetchAndDeserialize(this.workos, "/connections", deserializeConnection, params), options ? serializeListConnectionsOptions(options) : void 0);
-	}
-	async deleteConnection(id) {
-		await this.workos.delete(`/connections/${id}`);
-	}
-	getAuthorizationUrl(options) {
-		const { codeChallenge, codeChallengeMethod, connection, clientId, domainHint, loginHint, organization, provider, providerQueryParams, providerScopes, redirectUri, state } = options;
-		if (!provider && !connection && !organization) throw new TypeError(`Incomplete arguments. Need to specify either a 'connection', 'organization', or 'provider'.`);
-		const query = toQueryString({
-			code_challenge: codeChallenge,
-			code_challenge_method: codeChallengeMethod,
-			connection,
-			organization,
-			domain_hint: domainHint,
-			login_hint: loginHint,
-			provider,
-			provider_query_params: providerQueryParams,
-			provider_scopes: providerScopes,
-			client_id: clientId,
-			redirect_uri: redirectUri,
-			response_type: "code",
-			state
-		});
-		return `${this.workos.baseURL}/sso/authorize?${query}`;
-	}
-	/**
-	* Generates an authorization URL with PKCE parameters automatically generated.
-	* Use this for public clients (CLI apps, Electron, mobile) that cannot
-	* securely store a client secret.
-	*
-	* @returns Object containing url, state, and codeVerifier
-	*
-	* @example
-	* ```typescript
-	* const { url, state, codeVerifier } = await workos.sso.getAuthorizationUrlWithPKCE({
-	*   connection: 'conn_123',
-	*   clientId: 'client_123',
-	*   redirectUri: 'myapp://callback',
-	* });
-	*
-	* // Store state and codeVerifier securely, then redirect user to url
-	* // After callback, exchange the code:
-	* const { profile, accessToken } = await workos.sso.getProfileAndToken({
-	*   code: authorizationCode,
-	*   codeVerifier,
-	*   clientId: 'client_123',
-	* });
-	* ```
-	*/
-	async getAuthorizationUrlWithPKCE(options) {
-		const { connection, clientId, domainHint, loginHint, organization, provider, providerQueryParams, providerScopes, redirectUri } = options;
-		if (!provider && !connection && !organization) throw new TypeError(`Incomplete arguments. Need to specify either a 'connection', 'organization', or 'provider'.`);
-		const pkce = await this.workos.pkce.generate();
-		const state = this.workos.pkce.generateCodeVerifier(43);
-		const query = toQueryString({
-			code_challenge: pkce.codeChallenge,
-			code_challenge_method: "S256",
-			connection,
-			organization,
-			domain_hint: domainHint,
-			login_hint: loginHint,
-			provider,
-			provider_query_params: providerQueryParams,
-			provider_scopes: providerScopes,
-			client_id: clientId,
-			redirect_uri: redirectUri,
-			response_type: "code",
-			state
-		});
-		return {
-			url: `${this.workos.baseURL}/sso/authorize?${query}`,
-			state,
-			codeVerifier: pkce.codeVerifier
-		};
-	}
-	async getConnection(id) {
-		const { data } = await this.workos.get(`/connections/${id}`);
-		return deserializeConnection(data);
-	}
-	/**
-	* Exchange an authorization code for a profile and access token.
-	*
-	* Auto-detects public vs confidential client mode:
-	* - If codeVerifier is provided: Uses PKCE flow (public client)
-	* - If no codeVerifier: Uses client_secret from API key (confidential client)
-	* - If both: Uses both client_secret AND codeVerifier (confidential client with PKCE)
-	*
-	* Using PKCE with confidential clients is recommended by OAuth 2.1 for defense
-	* in depth and provides additional CSRF protection on the authorization flow.
-	*
-	* @throws Error if neither codeVerifier nor API key is available
-	*/
-	async getProfileAndToken({ code, clientId, codeVerifier }) {
-		if (codeVerifier !== void 0 && codeVerifier.trim() === "") throw new TypeError("codeVerifier cannot be an empty string. Generate a valid PKCE pair using workos.pkce.generate().");
-		const hasApiKey = !!this.workos.key;
-		const hasPKCE = !!codeVerifier;
-		if (!hasPKCE && !hasApiKey) throw new TypeError("getProfileAndToken requires either a codeVerifier (for public clients) or an API key configured on the WorkOS instance (for confidential clients).");
-		const form = new URLSearchParams({
-			client_id: clientId,
-			grant_type: "authorization_code",
-			code
-		});
-		if (hasPKCE) form.set("code_verifier", codeVerifier);
-		if (hasApiKey) form.set("client_secret", this.workos.key);
-		const { data } = await this.workos.post("/sso/token", form, { skipApiKeyCheck: !hasApiKey });
-		return deserializeProfileAndToken(data);
-	}
-	async getProfile({ accessToken }) {
-		const { data } = await this.workos.get("/sso/profile", { accessToken });
-		return deserializeProfile(data);
-	}
-};
-
-//#endregion
-export { SSO };
-//# sourceMappingURL=sso.js.map

package/lib/sso/sso.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sso.js","names":["workos: WorkOS"],"sources":["../../src/sso/sso.ts"],"sourcesContent":["import { UnknownRecord } from '../common/interfaces/unknown-record.interface';\nimport { fetchAndDeserialize } from '../common/utils/fetch-and-deserialize';\nimport { AutoPaginatable } from '../common/utils/pagination';\nimport { toQueryString } from '../common/utils/query-string';\nimport { WorkOS } from '../workos';\nimport {\n  Connection,\n  ConnectionResponse,\n  GetProfileAndTokenOptions,\n  GetProfileOptions,\n  ListConnectionsOptions,\n  Profile,\n  ProfileAndToken,\n  ProfileAndTokenResponse,\n  ProfileResponse,\n  SSOAuthorizationURLOptions,\n  SSOPKCEAuthorizationURLResult,\n  SerializedListConnectionsOptions,\n} from './interfaces';\nimport {\n  deserializeConnection,\n  deserializeProfile,\n  deserializeProfileAndToken,\n  serializeListConnectionsOptions,\n} from './serializers';\n\nexport class SSO {\n  constructor(private readonly workos: WorkOS) {}\n\n  async listConnections(\n    options?: ListConnectionsOptions,\n  ): Promise<AutoPaginatable<Connection, SerializedListConnectionsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<ConnectionResponse, Connection>(\n        this.workos,\n        '/connections',\n        deserializeConnection,\n        options ? serializeListConnectionsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<ConnectionResponse, Connection>(\n          this.workos,\n          '/connections',\n          deserializeConnection,\n          params,\n        ),\n      options ? serializeListConnectionsOptions(options) : undefined,\n    );\n  }\n  async deleteConnection(id: string) {\n    await this.workos.delete(`/connections/${id}`);\n  }\n\n  getAuthorizationUrl(options: SSOAuthorizationURLOptions): string {\n    const {\n      codeChallenge,\n      codeChallengeMethod,\n      connection,\n      clientId,\n      domainHint,\n      loginHint,\n      organization,\n      provider,\n      providerQueryParams,\n      providerScopes,\n      redirectUri,\n      state,\n    } = options;\n\n    if (!provider && !connection && !organization) {\n      throw new TypeError(\n        `Incomplete arguments. Need to specify either a 'connection', 'organization', or 'provider'.`,\n      );\n    }\n\n    const query = toQueryString({\n      code_challenge: codeChallenge,\n      code_challenge_method: codeChallengeMethod,\n      connection,\n      organization,\n      domain_hint: domainHint,\n      login_hint: loginHint,\n      provider,\n      provider_query_params: providerQueryParams,\n      provider_scopes: providerScopes,\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      response_type: 'code',\n      state,\n    });\n\n    return `${this.workos.baseURL}/sso/authorize?${query}`;\n  }\n\n  /**\n   * Generates an authorization URL with PKCE parameters automatically generated.\n   * Use this for public clients (CLI apps, Electron, mobile) that cannot\n   * securely store a client secret.\n   *\n   * @returns Object containing url, state, and codeVerifier\n   *\n   * @example\n   * ```typescript\n   * const { url, state, codeVerifier } = await workos.sso.getAuthorizationUrlWithPKCE({\n   *   connection: 'conn_123',\n   *   clientId: 'client_123',\n   *   redirectUri: 'myapp://callback',\n   * });\n   *\n   * // Store state and codeVerifier securely, then redirect user to url\n   * // After callback, exchange the code:\n   * const { profile, accessToken } = await workos.sso.getProfileAndToken({\n   *   code: authorizationCode,\n   *   codeVerifier,\n   *   clientId: 'client_123',\n   * });\n   * ```\n   */\n  async getAuthorizationUrlWithPKCE(\n    options: Omit<\n      SSOAuthorizationURLOptions,\n      'codeChallenge' | 'codeChallengeMethod' | 'state'\n    >,\n  ): Promise<SSOPKCEAuthorizationURLResult> {\n    const {\n      connection,\n      clientId,\n      domainHint,\n      loginHint,\n      organization,\n      provider,\n      providerQueryParams,\n      providerScopes,\n      redirectUri,\n    } = options;\n\n    if (!provider && !connection && !organization) {\n      throw new TypeError(\n        `Incomplete arguments. Need to specify either a 'connection', 'organization', or 'provider'.`,\n      );\n    }\n\n    // Generate PKCE parameters\n    const pkce = await this.workos.pkce.generate();\n\n    // Generate secure random state\n    const state = this.workos.pkce.generateCodeVerifier(43);\n\n    const query = toQueryString({\n      code_challenge: pkce.codeChallenge,\n      code_challenge_method: 'S256',\n      connection,\n      organization,\n      domain_hint: domainHint,\n      login_hint: loginHint,\n      provider,\n      provider_query_params: providerQueryParams,\n      provider_scopes: providerScopes,\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      response_type: 'code',\n      state,\n    });\n\n    const url = `${this.workos.baseURL}/sso/authorize?${query}`;\n\n    return { url, state, codeVerifier: pkce.codeVerifier };\n  }\n\n  async getConnection(id: string): Promise<Connection> {\n    const { data } = await this.workos.get<ConnectionResponse>(\n      `/connections/${id}`,\n    );\n\n    return deserializeConnection(data);\n  }\n\n  /**\n   * Exchange an authorization code for a profile and access token.\n   *\n   * Auto-detects public vs confidential client mode:\n   * - If codeVerifier is provided: Uses PKCE flow (public client)\n   * - If no codeVerifier: Uses client_secret from API key (confidential client)\n   * - If both: Uses both client_secret AND codeVerifier (confidential client with PKCE)\n   *\n   * Using PKCE with confidential clients is recommended by OAuth 2.1 for defense\n   * in depth and provides additional CSRF protection on the authorization flow.\n   *\n   * @throws Error if neither codeVerifier nor API key is available\n   */\n  async getProfileAndToken<\n    CustomAttributesType extends UnknownRecord = UnknownRecord,\n  >({\n    code,\n    clientId,\n    codeVerifier,\n  }: GetProfileAndTokenOptions): Promise<\n    ProfileAndToken<CustomAttributesType>\n  > {\n    // Validate codeVerifier is not an empty string (common mistake)\n    if (codeVerifier !== undefined && codeVerifier.trim() === '') {\n      throw new TypeError(\n        'codeVerifier cannot be an empty string. ' +\n          'Generate a valid PKCE pair using workos.pkce.generate().',\n      );\n    }\n\n    const hasApiKey = !!this.workos.key;\n    const hasPKCE = !!codeVerifier;\n\n    if (!hasPKCE && !hasApiKey) {\n      throw new TypeError(\n        'getProfileAndToken requires either a codeVerifier (for public clients) ' +\n          'or an API key configured on the WorkOS instance (for confidential clients).',\n      );\n    }\n\n    const form = new URLSearchParams({\n      client_id: clientId,\n      grant_type: 'authorization_code',\n      code,\n    });\n\n    // Support PKCE with confidential clients (OAuth 2.1 best practice)\n    // Both can be sent together for defense in depth\n    if (hasPKCE) {\n      form.set('code_verifier', codeVerifier);\n    }\n    if (hasApiKey) {\n      form.set('client_secret', this.workos.key as string);\n    }\n\n    const { data } = await this.workos.post<\n      ProfileAndTokenResponse<CustomAttributesType>\n    >('/sso/token', form, { skipApiKeyCheck: !hasApiKey });\n\n    return deserializeProfileAndToken(data);\n  }\n\n  async getProfile<CustomAttributesType extends UnknownRecord = UnknownRecord>({\n    accessToken,\n  }: GetProfileOptions): Promise<Profile<CustomAttributesType>> {\n    const { data } = await this.workos.get<\n      ProfileResponse<CustomAttributesType>\n    >('/sso/profile', {\n      accessToken,\n    });\n\n    return deserializeProfile(data);\n  }\n}\n"],"mappings":";;;;;;;;;AA0BA,IAAa,MAAb,MAAiB;CACf,YAAY,AAAiBA,QAAgB;EAAhB;;CAE7B,MAAM,gBACJ,SACwE;AACxE,SAAO,IAAI,gBACT,MAAM,oBACJ,KAAK,QACL,gBACA,uBACA,UAAU,gCAAgC,QAAQ,GAAG,OACtD,GACA,WACC,oBACE,KAAK,QACL,gBACA,uBACA,OACD,EACH,UAAU,gCAAgC,QAAQ,GAAG,OACtD;;CAEH,MAAM,iBAAiB,IAAY;AACjC,QAAM,KAAK,OAAO,OAAO,gBAAgB,KAAK;;CAGhD,oBAAoB,SAA6C;EAC/D,MAAM,EACJ,eACA,qBACA,YACA,UACA,YACA,WACA,cACA,UACA,qBACA,gBACA,aACA,UACE;AAEJ,MAAI,CAAC,YAAY,CAAC,cAAc,CAAC,aAC/B,OAAM,IAAI,UACR,8FACD;EAGH,MAAM,QAAQ,cAAc;GAC1B,gBAAgB;GAChB,uBAAuB;GACvB;GACA;GACA,aAAa;GACb,YAAY;GACZ;GACA,uBAAuB;GACvB,iBAAiB;GACjB,WAAW;GACX,cAAc;GACd,eAAe;GACf;GACD,CAAC;AAEF,SAAO,GAAG,KAAK,OAAO,QAAQ,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BjD,MAAM,4BACJ,SAIwC;EACxC,MAAM,EACJ,YACA,UACA,YACA,WACA,cACA,UACA,qBACA,gBACA,gBACE;AAEJ,MAAI,CAAC,YAAY,CAAC,cAAc,CAAC,aAC/B,OAAM,IAAI,UACR,8FACD;EAIH,MAAM,OAAO,MAAM,KAAK,OAAO,KAAK,UAAU;EAG9C,MAAM,QAAQ,KAAK,OAAO,KAAK,qBAAqB,GAAG;EAEvD,MAAM,QAAQ,cAAc;GAC1B,gBAAgB,KAAK;GACrB,uBAAuB;GACvB;GACA;GACA,aAAa;GACb,YAAY;GACZ;GACA,uBAAuB;GACvB,iBAAiB;GACjB,WAAW;GACX,cAAc;GACd,eAAe;GACf;GACD,CAAC;AAIF,SAAO;GAAE,KAFG,GAAG,KAAK,OAAO,QAAQ,iBAAiB;GAEtC;GAAO,cAAc,KAAK;GAAc;;CAGxD,MAAM,cAAc,IAAiC;EACnD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,KACjB;AAED,SAAO,sBAAsB,KAAK;;;;;;;;;;;;;;;CAgBpC,MAAM,mBAEJ,EACA,MACA,UACA,gBAGA;AAEA,MAAI,iBAAiB,UAAa,aAAa,MAAM,KAAK,GACxD,OAAM,IAAI,UACR,mGAED;EAGH,MAAM,YAAY,CAAC,CAAC,KAAK,OAAO;EAChC,MAAM,UAAU,CAAC,CAAC;AAElB,MAAI,CAAC,WAAW,CAAC,UACf,OAAM,IAAI,UACR,qJAED;EAGH,MAAM,OAAO,IAAI,gBAAgB;GAC/B,WAAW;GACX,YAAY;GACZ;GACD,CAAC;AAIF,MAAI,QACF,MAAK,IAAI,iBAAiB,aAAa;AAEzC,MAAI,UACF,MAAK,IAAI,iBAAiB,KAAK,OAAO,IAAc;EAGtD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAEjC,cAAc,MAAM,EAAE,iBAAiB,CAAC,WAAW,CAAC;AAEtD,SAAO,2BAA2B,KAAK;;CAGzC,MAAM,WAAuE,EAC3E,eAC4D;EAC5D,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IAEjC,gBAAgB,EAChB,aACD,CAAC;AAEF,SAAO,mBAAmB,KAAK"}

package/lib/sso-D_9tMqlC.cjs

@@ -1,135 +0,0 @@
-const require_pagination = require('./pagination-BG1uBuL4.cjs');
-const require_connection_serializer = require('./connection.serializer-sFgaPd28.cjs');
-const require_list_connections_options_serializer = require('./list-connections-options.serializer-B9jyhBCh.cjs');
-const require_profile_serializer = require('./profile.serializer-DM0Zpbrc.cjs');
-const require_profile_and_token_serializer = require('./profile-and-token.serializer-DfWI_L92.cjs');
-const require_fetch_and_deserialize = require('./fetch-and-deserialize-wAuupni3.cjs');
-const require_query_string = require('./query-string-DJDFy7sp.cjs');
-
-//#region src/sso/sso.ts
-var SSO = class {
-	constructor(workos) {
-		this.workos = workos;
-	}
-	async listConnections(options) {
-		return new require_pagination.AutoPaginatable(await require_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/connections", require_connection_serializer.deserializeConnection, options ? require_list_connections_options_serializer.serializeListConnectionsOptions(options) : void 0), (params) => require_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/connections", require_connection_serializer.deserializeConnection, params), options ? require_list_connections_options_serializer.serializeListConnectionsOptions(options) : void 0);
-	}
-	async deleteConnection(id) {
-		await this.workos.delete(`/connections/${id}`);
-	}
-	getAuthorizationUrl(options) {
-		const { codeChallenge, codeChallengeMethod, connection, clientId, domainHint, loginHint, organization, provider, providerQueryParams, providerScopes, redirectUri, state } = options;
-		if (!provider && !connection && !organization) throw new TypeError(`Incomplete arguments. Need to specify either a 'connection', 'organization', or 'provider'.`);
-		const query = require_query_string.toQueryString({
-			code_challenge: codeChallenge,
-			code_challenge_method: codeChallengeMethod,
-			connection,
-			organization,
-			domain_hint: domainHint,
-			login_hint: loginHint,
-			provider,
-			provider_query_params: providerQueryParams,
-			provider_scopes: providerScopes,
-			client_id: clientId,
-			redirect_uri: redirectUri,
-			response_type: "code",
-			state
-		});
-		return `${this.workos.baseURL}/sso/authorize?${query}`;
-	}
-	/**
-	* Generates an authorization URL with PKCE parameters automatically generated.
-	* Use this for public clients (CLI apps, Electron, mobile) that cannot
-	* securely store a client secret.
-	*
-	* @returns Object containing url, state, and codeVerifier
-	*
-	* @example
-	* ```typescript
-	* const { url, state, codeVerifier } = await workos.sso.getAuthorizationUrlWithPKCE({
-	*   connection: 'conn_123',
-	*   clientId: 'client_123',
-	*   redirectUri: 'myapp://callback',
-	* });
-	*
-	* // Store state and codeVerifier securely, then redirect user to url
-	* // After callback, exchange the code:
-	* const { profile, accessToken } = await workos.sso.getProfileAndToken({
-	*   code: authorizationCode,
-	*   codeVerifier,
-	*   clientId: 'client_123',
-	* });
-	* ```
-	*/
-	async getAuthorizationUrlWithPKCE(options) {
-		const { connection, clientId, domainHint, loginHint, organization, provider, providerQueryParams, providerScopes, redirectUri } = options;
-		if (!provider && !connection && !organization) throw new TypeError(`Incomplete arguments. Need to specify either a 'connection', 'organization', or 'provider'.`);
-		const pkce = await this.workos.pkce.generate();
-		const state = this.workos.pkce.generateCodeVerifier(43);
-		const query = require_query_string.toQueryString({
-			code_challenge: pkce.codeChallenge,
-			code_challenge_method: "S256",
-			connection,
-			organization,
-			domain_hint: domainHint,
-			login_hint: loginHint,
-			provider,
-			provider_query_params: providerQueryParams,
-			provider_scopes: providerScopes,
-			client_id: clientId,
-			redirect_uri: redirectUri,
-			response_type: "code",
-			state
-		});
-		return {
-			url: `${this.workos.baseURL}/sso/authorize?${query}`,
-			state,
-			codeVerifier: pkce.codeVerifier
-		};
-	}
-	async getConnection(id) {
-		const { data } = await this.workos.get(`/connections/${id}`);
-		return require_connection_serializer.deserializeConnection(data);
-	}
-	/**
-	* Exchange an authorization code for a profile and access token.
-	*
-	* Auto-detects public vs confidential client mode:
-	* - If codeVerifier is provided: Uses PKCE flow (public client)
-	* - If no codeVerifier: Uses client_secret from API key (confidential client)
-	* - If both: Uses both client_secret AND codeVerifier (confidential client with PKCE)
-	*
-	* Using PKCE with confidential clients is recommended by OAuth 2.1 for defense
-	* in depth and provides additional CSRF protection on the authorization flow.
-	*
-	* @throws Error if neither codeVerifier nor API key is available
-	*/
-	async getProfileAndToken({ code, clientId, codeVerifier }) {
-		if (codeVerifier !== void 0 && codeVerifier.trim() === "") throw new TypeError("codeVerifier cannot be an empty string. Generate a valid PKCE pair using workos.pkce.generate().");
-		const hasApiKey = !!this.workos.key;
-		const hasPKCE = !!codeVerifier;
-		if (!hasPKCE && !hasApiKey) throw new TypeError("getProfileAndToken requires either a codeVerifier (for public clients) or an API key configured on the WorkOS instance (for confidential clients).");
-		const form = new URLSearchParams({
-			client_id: clientId,
-			grant_type: "authorization_code",
-			code
-		});
-		if (hasPKCE) form.set("code_verifier", codeVerifier);
-		if (hasApiKey) form.set("client_secret", this.workos.key);
-		const { data } = await this.workos.post("/sso/token", form, { skipApiKeyCheck: !hasApiKey });
-		return require_profile_and_token_serializer.deserializeProfileAndToken(data);
-	}
-	async getProfile({ accessToken }) {
-		const { data } = await this.workos.get("/sso/profile", { accessToken });
-		return require_profile_serializer.deserializeProfile(data);
-	}
-};
-
-//#endregion
-Object.defineProperty(exports, 'SSO', {
-  enumerable: true,
-  get: function () {
-    return SSO;
-  }
-});
-//# sourceMappingURL=sso-D_9tMqlC.cjs.map

package/lib/sso-D_9tMqlC.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"sso-D_9tMqlC.cjs","names":["workos: WorkOS","AutoPaginatable","fetchAndDeserialize","deserializeConnection","serializeListConnectionsOptions","toQueryString","deserializeProfileAndToken","deserializeProfile"],"sources":["../src/sso/sso.ts"],"sourcesContent":["import { UnknownRecord } from '../common/interfaces/unknown-record.interface';\nimport { fetchAndDeserialize } from '../common/utils/fetch-and-deserialize';\nimport { AutoPaginatable } from '../common/utils/pagination';\nimport { toQueryString } from '../common/utils/query-string';\nimport { WorkOS } from '../workos';\nimport {\n  Connection,\n  ConnectionResponse,\n  GetProfileAndTokenOptions,\n  GetProfileOptions,\n  ListConnectionsOptions,\n  Profile,\n  ProfileAndToken,\n  ProfileAndTokenResponse,\n  ProfileResponse,\n  SSOAuthorizationURLOptions,\n  SSOPKCEAuthorizationURLResult,\n  SerializedListConnectionsOptions,\n} from './interfaces';\nimport {\n  deserializeConnection,\n  deserializeProfile,\n  deserializeProfileAndToken,\n  serializeListConnectionsOptions,\n} from './serializers';\n\nexport class SSO {\n  constructor(private readonly workos: WorkOS) {}\n\n  async listConnections(\n    options?: ListConnectionsOptions,\n  ): Promise<AutoPaginatable<Connection, SerializedListConnectionsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<ConnectionResponse, Connection>(\n        this.workos,\n        '/connections',\n        deserializeConnection,\n        options ? serializeListConnectionsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<ConnectionResponse, Connection>(\n          this.workos,\n          '/connections',\n          deserializeConnection,\n          params,\n        ),\n      options ? serializeListConnectionsOptions(options) : undefined,\n    );\n  }\n  async deleteConnection(id: string) {\n    await this.workos.delete(`/connections/${id}`);\n  }\n\n  getAuthorizationUrl(options: SSOAuthorizationURLOptions): string {\n    const {\n      codeChallenge,\n      codeChallengeMethod,\n      connection,\n      clientId,\n      domainHint,\n      loginHint,\n      organization,\n      provider,\n      providerQueryParams,\n      providerScopes,\n      redirectUri,\n      state,\n    } = options;\n\n    if (!provider && !connection && !organization) {\n      throw new TypeError(\n        `Incomplete arguments. Need to specify either a 'connection', 'organization', or 'provider'.`,\n      );\n    }\n\n    const query = toQueryString({\n      code_challenge: codeChallenge,\n      code_challenge_method: codeChallengeMethod,\n      connection,\n      organization,\n      domain_hint: domainHint,\n      login_hint: loginHint,\n      provider,\n      provider_query_params: providerQueryParams,\n      provider_scopes: providerScopes,\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      response_type: 'code',\n      state,\n    });\n\n    return `${this.workos.baseURL}/sso/authorize?${query}`;\n  }\n\n  /**\n   * Generates an authorization URL with PKCE parameters automatically generated.\n   * Use this for public clients (CLI apps, Electron, mobile) that cannot\n   * securely store a client secret.\n   *\n   * @returns Object containing url, state, and codeVerifier\n   *\n   * @example\n   * ```typescript\n   * const { url, state, codeVerifier } = await workos.sso.getAuthorizationUrlWithPKCE({\n   *   connection: 'conn_123',\n   *   clientId: 'client_123',\n   *   redirectUri: 'myapp://callback',\n   * });\n   *\n   * // Store state and codeVerifier securely, then redirect user to url\n   * // After callback, exchange the code:\n   * const { profile, accessToken } = await workos.sso.getProfileAndToken({\n   *   code: authorizationCode,\n   *   codeVerifier,\n   *   clientId: 'client_123',\n   * });\n   * ```\n   */\n  async getAuthorizationUrlWithPKCE(\n    options: Omit<\n      SSOAuthorizationURLOptions,\n      'codeChallenge' | 'codeChallengeMethod' | 'state'\n    >,\n  ): Promise<SSOPKCEAuthorizationURLResult> {\n    const {\n      connection,\n      clientId,\n      domainHint,\n      loginHint,\n      organization,\n      provider,\n      providerQueryParams,\n      providerScopes,\n      redirectUri,\n    } = options;\n\n    if (!provider && !connection && !organization) {\n      throw new TypeError(\n        `Incomplete arguments. Need to specify either a 'connection', 'organization', or 'provider'.`,\n      );\n    }\n\n    // Generate PKCE parameters\n    const pkce = await this.workos.pkce.generate();\n\n    // Generate secure random state\n    const state = this.workos.pkce.generateCodeVerifier(43);\n\n    const query = toQueryString({\n      code_challenge: pkce.codeChallenge,\n      code_challenge_method: 'S256',\n      connection,\n      organization,\n      domain_hint: domainHint,\n      login_hint: loginHint,\n      provider,\n      provider_query_params: providerQueryParams,\n      provider_scopes: providerScopes,\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      response_type: 'code',\n      state,\n    });\n\n    const url = `${this.workos.baseURL}/sso/authorize?${query}`;\n\n    return { url, state, codeVerifier: pkce.codeVerifier };\n  }\n\n  async getConnection(id: string): Promise<Connection> {\n    const { data } = await this.workos.get<ConnectionResponse>(\n      `/connections/${id}`,\n    );\n\n    return deserializeConnection(data);\n  }\n\n  /**\n   * Exchange an authorization code for a profile and access token.\n   *\n   * Auto-detects public vs confidential client mode:\n   * - If codeVerifier is provided: Uses PKCE flow (public client)\n   * - If no codeVerifier: Uses client_secret from API key (confidential client)\n   * - If both: Uses both client_secret AND codeVerifier (confidential client with PKCE)\n   *\n   * Using PKCE with confidential clients is recommended by OAuth 2.1 for defense\n   * in depth and provides additional CSRF protection on the authorization flow.\n   *\n   * @throws Error if neither codeVerifier nor API key is available\n   */\n  async getProfileAndToken<\n    CustomAttributesType extends UnknownRecord = UnknownRecord,\n  >({\n    code,\n    clientId,\n    codeVerifier,\n  }: GetProfileAndTokenOptions): Promise<\n    ProfileAndToken<CustomAttributesType>\n  > {\n    // Validate codeVerifier is not an empty string (common mistake)\n    if (codeVerifier !== undefined && codeVerifier.trim() === '') {\n      throw new TypeError(\n        'codeVerifier cannot be an empty string. ' +\n          'Generate a valid PKCE pair using workos.pkce.generate().',\n      );\n    }\n\n    const hasApiKey = !!this.workos.key;\n    const hasPKCE = !!codeVerifier;\n\n    if (!hasPKCE && !hasApiKey) {\n      throw new TypeError(\n        'getProfileAndToken requires either a codeVerifier (for public clients) ' +\n          'or an API key configured on the WorkOS instance (for confidential clients).',\n      );\n    }\n\n    const form = new URLSearchParams({\n      client_id: clientId,\n      grant_type: 'authorization_code',\n      code,\n    });\n\n    // Support PKCE with confidential clients (OAuth 2.1 best practice)\n    // Both can be sent together for defense in depth\n    if (hasPKCE) {\n      form.set('code_verifier', codeVerifier);\n    }\n    if (hasApiKey) {\n      form.set('client_secret', this.workos.key as string);\n    }\n\n    const { data } = await this.workos.post<\n      ProfileAndTokenResponse<CustomAttributesType>\n    >('/sso/token', form, { skipApiKeyCheck: !hasApiKey });\n\n    return deserializeProfileAndToken(data);\n  }\n\n  async getProfile<CustomAttributesType extends UnknownRecord = UnknownRecord>({\n    accessToken,\n  }: GetProfileOptions): Promise<Profile<CustomAttributesType>> {\n    const { data } = await this.workos.get<\n      ProfileResponse<CustomAttributesType>\n    >('/sso/profile', {\n      accessToken,\n    });\n\n    return deserializeProfile(data);\n  }\n}\n"],"mappings":";;;;;;;;;AA0BA,IAAa,MAAb,MAAiB;CACf,YAAY,AAAiBA,QAAgB;EAAhB;;CAE7B,MAAM,gBACJ,SACwE;AACxE,SAAO,IAAIC,mCACT,MAAMC,kDACJ,KAAK,QACL,gBACAC,qDACA,UAAUC,4EAAgC,QAAQ,GAAG,OACtD,GACA,WACCF,kDACE,KAAK,QACL,gBACAC,qDACA,OACD,EACH,UAAUC,4EAAgC,QAAQ,GAAG,OACtD;;CAEH,MAAM,iBAAiB,IAAY;AACjC,QAAM,KAAK,OAAO,OAAO,gBAAgB,KAAK;;CAGhD,oBAAoB,SAA6C;EAC/D,MAAM,EACJ,eACA,qBACA,YACA,UACA,YACA,WACA,cACA,UACA,qBACA,gBACA,aACA,UACE;AAEJ,MAAI,CAAC,YAAY,CAAC,cAAc,CAAC,aAC/B,OAAM,IAAI,UACR,8FACD;EAGH,MAAM,QAAQC,mCAAc;GAC1B,gBAAgB;GAChB,uBAAuB;GACvB;GACA;GACA,aAAa;GACb,YAAY;GACZ;GACA,uBAAuB;GACvB,iBAAiB;GACjB,WAAW;GACX,cAAc;GACd,eAAe;GACf;GACD,CAAC;AAEF,SAAO,GAAG,KAAK,OAAO,QAAQ,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BjD,MAAM,4BACJ,SAIwC;EACxC,MAAM,EACJ,YACA,UACA,YACA,WACA,cACA,UACA,qBACA,gBACA,gBACE;AAEJ,MAAI,CAAC,YAAY,CAAC,cAAc,CAAC,aAC/B,OAAM,IAAI,UACR,8FACD;EAIH,MAAM,OAAO,MAAM,KAAK,OAAO,KAAK,UAAU;EAG9C,MAAM,QAAQ,KAAK,OAAO,KAAK,qBAAqB,GAAG;EAEvD,MAAM,QAAQA,mCAAc;GAC1B,gBAAgB,KAAK;GACrB,uBAAuB;GACvB;GACA;GACA,aAAa;GACb,YAAY;GACZ;GACA,uBAAuB;GACvB,iBAAiB;GACjB,WAAW;GACX,cAAc;GACd,eAAe;GACf;GACD,CAAC;AAIF,SAAO;GAAE,KAFG,GAAG,KAAK,OAAO,QAAQ,iBAAiB;GAEtC;GAAO,cAAc,KAAK;GAAc;;CAGxD,MAAM,cAAc,IAAiC;EACnD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,KACjB;AAED,SAAOF,oDAAsB,KAAK;;;;;;;;;;;;;;;CAgBpC,MAAM,mBAEJ,EACA,MACA,UACA,gBAGA;AAEA,MAAI,iBAAiB,UAAa,aAAa,MAAM,KAAK,GACxD,OAAM,IAAI,UACR,mGAED;EAGH,MAAM,YAAY,CAAC,CAAC,KAAK,OAAO;EAChC,MAAM,UAAU,CAAC,CAAC;AAElB,MAAI,CAAC,WAAW,CAAC,UACf,OAAM,IAAI,UACR,qJAED;EAGH,MAAM,OAAO,IAAI,gBAAgB;GAC/B,WAAW;GACX,YAAY;GACZ;GACD,CAAC;AAIF,MAAI,QACF,MAAK,IAAI,iBAAiB,aAAa;AAEzC,MAAI,UACF,MAAK,IAAI,iBAAiB,KAAK,OAAO,IAAc;EAGtD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAEjC,cAAc,MAAM,EAAE,iBAAiB,CAAC,WAAW,CAAC;AAEtD,SAAOG,gEAA2B,KAAK;;CAGzC,MAAM,WAAuE,EAC3E,eAC4D;EAC5D,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IAEjC,gBAAgB,EAChB,aACD,CAAC;AAEF,SAAOC,8CAAmB,KAAK"}

package/lib/subtle-crypto-provider-RQC7QPlf.cjs

@@ -1,99 +0,0 @@
-const require_crypto_provider = require('./crypto-provider-Bhd3lKp3.cjs');
-
-//#region src/common/crypto/subtle-crypto-provider.ts
-/**
-* `CryptoProvider which uses the SubtleCrypto interface of the Web Crypto API.
-*
-* This only supports asynchronous operations.
-*/
-var SubtleCryptoProvider = class extends require_crypto_provider.CryptoProvider {
-	subtleCrypto;
-	constructor(subtleCrypto) {
-		super();
-		this.subtleCrypto = subtleCrypto || crypto.subtle;
-	}
-	computeHMACSignature(_payload, _secret) {
-		throw new Error("SubleCryptoProvider cannot be used in a synchronous context.");
-	}
-	/** @override */
-	async computeHMACSignatureAsync(payload, secret) {
-		const encoder = new TextEncoder();
-		const key = await this.subtleCrypto.importKey("raw", encoder.encode(secret), {
-			name: "HMAC",
-			hash: { name: "SHA-256" }
-		}, false, ["sign"]);
-		const signatureBuffer = await this.subtleCrypto.sign("hmac", key, encoder.encode(payload));
-		const signatureBytes = new Uint8Array(signatureBuffer);
-		const signatureHexCodes = new Array(signatureBytes.length);
-		for (let i = 0; i < signatureBytes.length; i++) signatureHexCodes[i] = byteHexMapping[signatureBytes[i]];
-		return signatureHexCodes.join("");
-	}
-	/** @override */
-	async secureCompare(stringA, stringB) {
-		const bufferA = this.encoder.encode(stringA);
-		const bufferB = this.encoder.encode(stringB);
-		if (bufferA.length !== bufferB.length) return false;
-		const algorithm = {
-			name: "HMAC",
-			hash: "SHA-256"
-		};
-		const key = await crypto.subtle.generateKey(algorithm, false, ["sign", "verify"]);
-		const hmac = await crypto.subtle.sign(algorithm, key, bufferA);
-		return await crypto.subtle.verify(algorithm, key, hmac, bufferB);
-	}
-	async encrypt(plaintext, key, iv, aad) {
-		const actualIv = iv || crypto.getRandomValues(new Uint8Array(32));
-		const cryptoKey = await this.subtleCrypto.importKey("raw", key, { name: "AES-GCM" }, false, ["encrypt"]);
-		const encryptParams = {
-			name: "AES-GCM",
-			iv: actualIv
-		};
-		if (aad) encryptParams.additionalData = aad;
-		const encryptedData = await this.subtleCrypto.encrypt(encryptParams, cryptoKey, plaintext);
-		const encryptedBytes = new Uint8Array(encryptedData);
-		const tagStart = encryptedBytes.length - 16;
-		const tag = encryptedBytes.slice(tagStart);
-		return {
-			ciphertext: encryptedBytes.slice(0, tagStart),
-			iv: actualIv,
-			tag
-		};
-	}
-	async decrypt(ciphertext, key, iv, tag, aad) {
-		const combinedData = new Uint8Array(ciphertext.length + tag.length);
-		combinedData.set(ciphertext, 0);
-		combinedData.set(tag, ciphertext.length);
-		const cryptoKey = await this.subtleCrypto.importKey("raw", key, { name: "AES-GCM" }, false, ["decrypt"]);
-		const decryptParams = {
-			name: "AES-GCM",
-			iv
-		};
-		if (aad) decryptParams.additionalData = aad;
-		const decryptedData = await this.subtleCrypto.decrypt(decryptParams, cryptoKey, combinedData);
-		return new Uint8Array(decryptedData);
-	}
-	randomBytes(length) {
-		const bytes = new Uint8Array(length);
-		crypto.getRandomValues(bytes);
-		return bytes;
-	}
-	randomUUID() {
-		if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
-		const bytes = this.randomBytes(16);
-		bytes[6] = bytes[6] & 15 | 64;
-		bytes[8] = bytes[8] & 63 | 128;
-		const hex = Array.from(bytes, (b) => byteHexMapping[b]).join("");
-		return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-	}
-};
-const byteHexMapping = new Array(256);
-for (let i = 0; i < byteHexMapping.length; i++) byteHexMapping[i] = i.toString(16).padStart(2, "0");
-
-//#endregion
-Object.defineProperty(exports, 'SubtleCryptoProvider', {
-  enumerable: true,
-  get: function () {
-    return SubtleCryptoProvider;
-  }
-});
-//# sourceMappingURL=subtle-crypto-provider-RQC7QPlf.cjs.map

package/lib/subtle-crypto-provider-RQC7QPlf.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"subtle-crypto-provider-RQC7QPlf.cjs","names":["CryptoProvider","encryptParams: AesGcmParams","decryptParams: AesGcmParams"],"sources":["../src/common/crypto/subtle-crypto-provider.ts"],"sourcesContent":["import { CryptoProvider } from './crypto-provider';\n\n/**\n * `CryptoProvider which uses the SubtleCrypto interface of the Web Crypto API.\n *\n * This only supports asynchronous operations.\n */\nexport class SubtleCryptoProvider extends CryptoProvider {\n  subtleCrypto: SubtleCrypto;\n\n  constructor(subtleCrypto?: SubtleCrypto) {\n    super();\n\n    // If no subtle crypto is interface, default to the global namespace. This\n    // is to allow custom interfaces (eg. using the Node webcrypto interface in\n    // tests).\n    this.subtleCrypto = subtleCrypto || crypto.subtle;\n  }\n\n  computeHMACSignature(_payload: string, _secret: string): string {\n    throw new Error(\n      'SubleCryptoProvider cannot be used in a synchronous context.',\n    );\n  }\n\n  /** @override */\n  async computeHMACSignatureAsync(\n    payload: string,\n    secret: string,\n  ): Promise<string> {\n    const encoder = new TextEncoder();\n\n    const key = await this.subtleCrypto.importKey(\n      'raw',\n      encoder.encode(secret),\n      {\n        name: 'HMAC',\n        hash: { name: 'SHA-256' },\n      },\n      false,\n      ['sign'],\n    );\n\n    const signatureBuffer = await this.subtleCrypto.sign(\n      'hmac',\n      key,\n      encoder.encode(payload),\n    );\n\n    // crypto.subtle returns the signature in base64 format. This must be\n    // encoded in hex to match the CryptoProvider contract. We map each byte in\n    // the buffer to its corresponding hex octet and then combine into a string.\n    const signatureBytes = new Uint8Array(signatureBuffer);\n    const signatureHexCodes = new Array(signatureBytes.length);\n\n    for (let i = 0; i < signatureBytes.length; i++) {\n      signatureHexCodes[i] = byteHexMapping[signatureBytes[i]];\n    }\n\n    return signatureHexCodes.join('');\n  }\n\n  /** @override */\n  async secureCompare(stringA: string, stringB: string): Promise<boolean> {\n    const bufferA = this.encoder.encode(stringA);\n    const bufferB = this.encoder.encode(stringB);\n\n    if (bufferA.length !== bufferB.length) {\n      return false;\n    }\n\n    const algorithm = { name: 'HMAC', hash: 'SHA-256' };\n    const key = (await crypto.subtle.generateKey(algorithm, false, [\n      'sign',\n      'verify',\n    ])) as CryptoKey;\n    const hmac = await crypto.subtle.sign(algorithm, key, bufferA);\n    const equal = await crypto.subtle.verify(algorithm, key, hmac, bufferB);\n\n    return equal;\n  }\n\n  async encrypt(\n    plaintext: Uint8Array,\n    key: Uint8Array,\n    iv?: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<{\n    ciphertext: Uint8Array;\n    iv: Uint8Array;\n    tag: Uint8Array;\n  }> {\n    const actualIv = iv || crypto.getRandomValues(new Uint8Array(32));\n\n    const cryptoKey = await this.subtleCrypto.importKey(\n      'raw',\n      key as BufferSource,\n      { name: 'AES-GCM' },\n      false,\n      ['encrypt'],\n    );\n\n    const encryptParams: AesGcmParams = {\n      name: 'AES-GCM',\n      iv: actualIv as BufferSource,\n    };\n\n    if (aad) {\n      encryptParams.additionalData = aad as BufferSource;\n    }\n\n    const encryptedData = await this.subtleCrypto.encrypt(\n      encryptParams,\n      cryptoKey,\n      plaintext as BufferSource,\n    );\n\n    const encryptedBytes = new Uint8Array(encryptedData);\n\n    // Extract tag (last 16 bytes)\n    const tagSize = 16;\n    const tagStart = encryptedBytes.length - tagSize;\n    const tag = encryptedBytes.slice(tagStart);\n    const ciphertext = encryptedBytes.slice(0, tagStart);\n\n    return {\n      ciphertext,\n      iv: actualIv,\n      tag,\n    };\n  }\n\n  async decrypt(\n    ciphertext: Uint8Array,\n    key: Uint8Array,\n    iv: Uint8Array,\n    tag: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<Uint8Array> {\n    // SubtleCrypto expects tag to be appended to ciphertext for AES-GCM\n    const combinedData = new Uint8Array(ciphertext.length + tag.length);\n    combinedData.set(ciphertext, 0);\n    combinedData.set(tag, ciphertext.length);\n\n    const cryptoKey = await this.subtleCrypto.importKey(\n      'raw',\n      key as BufferSource,\n      { name: 'AES-GCM' },\n      false,\n      ['decrypt'],\n    );\n\n    const decryptParams: AesGcmParams = {\n      name: 'AES-GCM',\n      iv: iv as BufferSource,\n    };\n\n    if (aad) {\n      decryptParams.additionalData = aad as BufferSource;\n    }\n\n    const decryptedData = await this.subtleCrypto.decrypt(\n      decryptParams,\n      cryptoKey,\n      combinedData,\n    );\n\n    return new Uint8Array(decryptedData);\n  }\n\n  randomBytes(length: number): Uint8Array {\n    const bytes = new Uint8Array(length);\n    crypto.getRandomValues(bytes);\n    return bytes;\n  }\n\n  randomUUID(): string {\n    if (\n      typeof crypto !== 'undefined' &&\n      typeof crypto.randomUUID === 'function'\n    ) {\n      return crypto.randomUUID();\n    }\n\n    // Fallback for environments without crypto.randomUUID\n    const bytes = this.randomBytes(16);\n    // tslint:disable-next-line:no-bitwise\n    bytes[6] = (bytes[6] & 0x0f) | 0x40; // version 4\n    // tslint:disable-next-line:no-bitwise\n    bytes[8] = (bytes[8] & 0x3f) | 0x80; // variant\n\n    const hex = Array.from(bytes, (b) => byteHexMapping[b]).join('');\n    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(\n      12,\n      16,\n    )}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n  }\n}\n\n// Cached mapping of byte to hex representation. We do this once to avoid re-\n// computing every time we need to convert the result of a signature to hex.\nconst byteHexMapping = new Array(256);\nfor (let i = 0; i < byteHexMapping.length; i++) {\n  byteHexMapping[i] = i.toString(16).padStart(2, '0');\n}\n"],"mappings":";;;;;;;;AAOA,IAAa,uBAAb,cAA0CA,uCAAe;CACvD;CAEA,YAAY,cAA6B;AACvC,SAAO;AAKP,OAAK,eAAe,gBAAgB,OAAO;;CAG7C,qBAAqB,UAAkB,SAAyB;AAC9D,QAAM,IAAI,MACR,+DACD;;;CAIH,MAAM,0BACJ,SACA,QACiB;EACjB,MAAM,UAAU,IAAI,aAAa;EAEjC,MAAM,MAAM,MAAM,KAAK,aAAa,UAClC,OACA,QAAQ,OAAO,OAAO,EACtB;GACE,MAAM;GACN,MAAM,EAAE,MAAM,WAAW;GAC1B,EACD,OACA,CAAC,OAAO,CACT;EAED,MAAM,kBAAkB,MAAM,KAAK,aAAa,KAC9C,QACA,KACA,QAAQ,OAAO,QAAQ,CACxB;EAKD,MAAM,iBAAiB,IAAI,WAAW,gBAAgB;EACtD,MAAM,oBAAoB,IAAI,MAAM,eAAe,OAAO;AAE1D,OAAK,IAAI,IAAI,GAAG,IAAI,eAAe,QAAQ,IACzC,mBAAkB,KAAK,eAAe,eAAe;AAGvD,SAAO,kBAAkB,KAAK,GAAG;;;CAInC,MAAM,cAAc,SAAiB,SAAmC;EACtE,MAAM,UAAU,KAAK,QAAQ,OAAO,QAAQ;EAC5C,MAAM,UAAU,KAAK,QAAQ,OAAO,QAAQ;AAE5C,MAAI,QAAQ,WAAW,QAAQ,OAC7B,QAAO;EAGT,MAAM,YAAY;GAAE,MAAM;GAAQ,MAAM;GAAW;EACnD,MAAM,MAAO,MAAM,OAAO,OAAO,YAAY,WAAW,OAAO,CAC7D,QACA,SACD,CAAC;EACF,MAAM,OAAO,MAAM,OAAO,OAAO,KAAK,WAAW,KAAK,QAAQ;AAG9D,SAFc,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK,MAAM,QAAQ;;CAKzE,MAAM,QACJ,WACA,KACA,IACA,KAKC;EACD,MAAM,WAAW,MAAM,OAAO,gBAAgB,IAAI,WAAW,GAAG,CAAC;EAEjE,MAAM,YAAY,MAAM,KAAK,aAAa,UACxC,OACA,KACA,EAAE,MAAM,WAAW,EACnB,OACA,CAAC,UAAU,CACZ;EAED,MAAMC,gBAA8B;GAClC,MAAM;GACN,IAAI;GACL;AAED,MAAI,IACF,eAAc,iBAAiB;EAGjC,MAAM,gBAAgB,MAAM,KAAK,aAAa,QAC5C,eACA,WACA,UACD;EAED,MAAM,iBAAiB,IAAI,WAAW,cAAc;EAIpD,MAAM,WAAW,eAAe,SADhB;EAEhB,MAAM,MAAM,eAAe,MAAM,SAAS;AAG1C,SAAO;GACL,YAHiB,eAAe,MAAM,GAAG,SAAS;GAIlD,IAAI;GACJ;GACD;;CAGH,MAAM,QACJ,YACA,KACA,IACA,KACA,KACqB;EAErB,MAAM,eAAe,IAAI,WAAW,WAAW,SAAS,IAAI,OAAO;AACnE,eAAa,IAAI,YAAY,EAAE;AAC/B,eAAa,IAAI,KAAK,WAAW,OAAO;EAExC,MAAM,YAAY,MAAM,KAAK,aAAa,UACxC,OACA,KACA,EAAE,MAAM,WAAW,EACnB,OACA,CAAC,UAAU,CACZ;EAED,MAAMC,gBAA8B;GAClC,MAAM;GACF;GACL;AAED,MAAI,IACF,eAAc,iBAAiB;EAGjC,MAAM,gBAAgB,MAAM,KAAK,aAAa,QAC5C,eACA,WACA,aACD;AAED,SAAO,IAAI,WAAW,cAAc;;CAGtC,YAAY,QAA4B;EACtC,MAAM,QAAQ,IAAI,WAAW,OAAO;AACpC,SAAO,gBAAgB,MAAM;AAC7B,SAAO;;CAGT,aAAqB;AACnB,MACE,OAAO,WAAW,eAClB,OAAO,OAAO,eAAe,WAE7B,QAAO,OAAO,YAAY;EAI5B,MAAM,QAAQ,KAAK,YAAY,GAAG;AAElC,QAAM,KAAM,MAAM,KAAK,KAAQ;AAE/B,QAAM,KAAM,MAAM,KAAK,KAAQ;EAE/B,MAAM,MAAM,MAAM,KAAK,QAAQ,MAAM,eAAe,GAAG,CAAC,KAAK,GAAG;AAChE,SAAO,GAAG,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,MACnD,IACA,GACD,CAAC,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,GAAG;;;AAM3C,MAAM,iBAAiB,IAAI,MAAM,IAAI;AACrC,KAAK,IAAI,IAAI,GAAG,IAAI,eAAe,QAAQ,IACzC,gBAAe,KAAK,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI"}

package/lib/totp.interface-DPRsa_Dc.d.cts

@@ -1,22 +0,0 @@
-//#region src/mfa/interfaces/totp.interface.d.ts
-interface Totp {
-  issuer: string;
-  user: string;
-}
-interface TotpWithSecrets extends Totp {
-  qrCode: string;
-  secret: string;
-  uri: string;
-}
-interface TotpResponse {
-  issuer: string;
-  user: string;
-}
-interface TotpWithSecretsResponse extends TotpResponse {
-  qr_code: string;
-  secret: string;
-  uri: string;
-}
-//#endregion
-export { TotpWithSecretsResponse as i, TotpResponse as n, TotpWithSecrets as r, Totp as t };
-//# sourceMappingURL=totp.interface-DPRsa_Dc.d.cts.map

package/lib/totp.serializer-DlQAVrBt.cjs

@@ -1,32 +0,0 @@
-
-//#region src/mfa/serializers/totp.serializer.ts
-const deserializeTotp = (totp) => {
-	return {
-		issuer: totp.issuer,
-		user: totp.user
-	};
-};
-const deserializeTotpWithSecrets = (totp) => {
-	return {
-		issuer: totp.issuer,
-		user: totp.user,
-		qrCode: totp.qr_code,
-		secret: totp.secret,
-		uri: totp.uri
-	};
-};
-
-//#endregion
-Object.defineProperty(exports, 'deserializeTotp', {
-  enumerable: true,
-  get: function () {
-    return deserializeTotp;
-  }
-});
-Object.defineProperty(exports, 'deserializeTotpWithSecrets', {
-  enumerable: true,
-  get: function () {
-    return deserializeTotpWithSecrets;
-  }
-});
-//# sourceMappingURL=totp.serializer-DlQAVrBt.cjs.map

package/lib/totp.serializer-DlQAVrBt.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"totp.serializer-DlQAVrBt.cjs","names":[],"sources":["../src/mfa/serializers/totp.serializer.ts"],"sourcesContent":["import {\n  Totp,\n  TotpResponse,\n  TotpWithSecretsResponse,\n  TotpWithSecrets,\n} from '../interfaces';\n\nexport const deserializeTotp = (totp: TotpResponse): Totp => {\n  return {\n    issuer: totp.issuer,\n    user: totp.user,\n  };\n};\n\nexport const deserializeTotpWithSecrets = (\n  totp: TotpWithSecretsResponse,\n): TotpWithSecrets => {\n  return {\n    issuer: totp.issuer,\n    user: totp.user,\n    qrCode: totp.qr_code,\n    secret: totp.secret,\n    uri: totp.uri,\n  };\n};\n"],"mappings":";;AAOA,MAAa,mBAAmB,SAA6B;AAC3D,QAAO;EACL,QAAQ,KAAK;EACb,MAAM,KAAK;EACZ;;AAGH,MAAa,8BACX,SACoB;AACpB,QAAO;EACL,QAAQ,KAAK;EACb,MAAM,KAAK;EACX,QAAQ,KAAK;EACb,QAAQ,KAAK;EACb,KAAK,KAAK;EACX"}

package/lib/unauthorized.exception-D6PAzuDw.d.cts

@@ -1,13 +0,0 @@
-import { t as RequestException } from "./request-exception.interface-CuuezHgg.cjs";
-
-//#region src/common/exceptions/unauthorized.exception.d.ts
-declare class UnauthorizedException extends Error implements RequestException {
-  readonly requestID: string;
-  readonly status = 401;
-  readonly name = "UnauthorizedException";
-  readonly message: string;
-  constructor(requestID: string);
-}
-//#endregion
-export { UnauthorizedException as t };
-//# sourceMappingURL=unauthorized.exception-D6PAzuDw.d.cts.map

package/lib/unauthorized.exception-hTKkIjP4.cjs

@@ -1,21 +0,0 @@
-
-//#region src/common/exceptions/unauthorized.exception.ts
-var UnauthorizedException = class extends Error {
-	status = 401;
-	name = "UnauthorizedException";
-	message;
-	constructor(requestID) {
-		super();
-		this.requestID = requestID;
-		this.message = `Could not authorize the request. Maybe your API key is invalid?`;
-	}
-};
-
-//#endregion
-Object.defineProperty(exports, 'UnauthorizedException', {
-  enumerable: true,
-  get: function () {
-    return UnauthorizedException;
-  }
-});
-//# sourceMappingURL=unauthorized.exception-hTKkIjP4.cjs.map

package/lib/unauthorized.exception-hTKkIjP4.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"unauthorized.exception-hTKkIjP4.cjs","names":["requestID: string"],"sources":["../src/common/exceptions/unauthorized.exception.ts"],"sourcesContent":["import { RequestException } from '../interfaces/request-exception.interface';\n\nexport class UnauthorizedException extends Error implements RequestException {\n  readonly status = 401;\n  readonly name = 'UnauthorizedException';\n  readonly message: string;\n\n  constructor(readonly requestID: string) {\n    super();\n    this.message = `Could not authorize the request. Maybe your API key is invalid?`;\n  }\n}\n"],"mappings":";;AAEA,IAAa,wBAAb,cAA2C,MAAkC;CAC3E,AAAS,SAAS;CAClB,AAAS,OAAO;CAChB,AAAS;CAET,YAAY,AAASA,WAAmB;AACtC,SAAO;EADY;AAEnB,OAAK,UAAU"}

package/lib/unknown-record.interface-KDwjwNHM.d.cts

@@ -1,5 +0,0 @@
-//#region src/common/interfaces/unknown-record.interface.d.ts
-type UnknownRecord = Record<string, unknown>;
-//#endregion
-export { UnknownRecord as t };
-//# sourceMappingURL=unknown-record.interface-KDwjwNHM.d.cts.map

package/lib/unprocessable-entity-error.interface-sHivwO3Z.d.cts

@@ -1,8 +0,0 @@
-//#region src/common/interfaces/unprocessable-entity-error.interface.d.ts
-interface UnprocessableEntityError {
-  field: string;
-  code: string;
-}
-//#endregion
-export { UnprocessableEntityError as t };
-//# sourceMappingURL=unprocessable-entity-error.interface-sHivwO3Z.d.cts.map

package/lib/unprocessable-entity.exception-B6blaqq0.d.cts

@@ -1,25 +0,0 @@
-import { t as UnprocessableEntityError } from "./unprocessable-entity-error.interface-sHivwO3Z.cjs";
-import { t as RequestException } from "./request-exception.interface-CuuezHgg.cjs";
-
-//#region src/common/exceptions/unprocessable-entity.exception.d.ts
-declare class UnprocessableEntityException extends Error implements RequestException {
-  readonly status = 422;
-  readonly name = "UnprocessableEntityException";
-  readonly message: string;
-  readonly code?: string;
-  readonly requestID: string;
-  constructor({
-    code,
-    errors,
-    message,
-    requestID
-  }: {
-    code?: string;
-    errors?: UnprocessableEntityError[];
-    message?: string;
-    requestID: string;
-  });
-}
-//#endregion
-export { UnprocessableEntityException as t };
-//# sourceMappingURL=unprocessable-entity.exception-B6blaqq0.d.cts.map

package/lib/unprocessable-entity.exception-BdCyQCYX.cjs

@@ -1,28 +0,0 @@
-
-//#region src/common/exceptions/unprocessable-entity.exception.ts
-var UnprocessableEntityException = class extends Error {
-	status = 422;
-	name = "UnprocessableEntityException";
-	message = "Unprocessable entity";
-	code;
-	requestID;
-	constructor({ code, errors, message, requestID }) {
-		super();
-		this.requestID = requestID;
-		if (message) this.message = message;
-		if (code) this.code = code;
-		if (errors) {
-			this.message = `The following ${errors.length === 1 ? "requirement" : "requirements"} must be met:\n`;
-			for (const { code: code$1 } of errors) this.message = this.message.concat(`\t${code$1}\n`);
-		}
-	}
-};
-
-//#endregion
-Object.defineProperty(exports, 'UnprocessableEntityException', {
-  enumerable: true,
-  get: function () {
-    return UnprocessableEntityException;
-  }
-});
-//# sourceMappingURL=unprocessable-entity.exception-BdCyQCYX.cjs.map

package/lib/unprocessable-entity.exception-BdCyQCYX.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"unprocessable-entity.exception-BdCyQCYX.cjs","names":["code"],"sources":["../src/common/exceptions/unprocessable-entity.exception.ts"],"sourcesContent":["import { UnprocessableEntityError } from '../interfaces';\nimport { RequestException } from '../interfaces/request-exception.interface';\n\nexport class UnprocessableEntityException\n  extends Error\n  implements RequestException\n{\n  readonly status = 422;\n  readonly name = 'UnprocessableEntityException';\n  readonly message: string = 'Unprocessable entity';\n  readonly code?: string;\n  readonly requestID: string;\n\n  constructor({\n    code,\n    errors,\n    message,\n    requestID,\n  }: {\n    code?: string;\n    errors?: UnprocessableEntityError[];\n    message?: string;\n    requestID: string;\n  }) {\n    super();\n\n    this.requestID = requestID;\n\n    if (message) {\n      this.message = message;\n    }\n\n    if (code) {\n      this.code = code;\n    }\n\n    if (errors) {\n      const requirement = errors.length === 1 ? 'requirement' : 'requirements';\n\n      this.message = `The following ${requirement} must be met:\\n`;\n\n      for (const { code } of errors) {\n        this.message = this.message.concat(`\\t${code}\\n`);\n      }\n    }\n  }\n}\n"],"mappings":";;AAGA,IAAa,+BAAb,cACU,MAEV;CACE,AAAS,SAAS;CAClB,AAAS,OAAO;CAChB,AAAS,UAAkB;CAC3B,AAAS;CACT,AAAS;CAET,YAAY,EACV,MACA,QACA,SACA,aAMC;AACD,SAAO;AAEP,OAAK,YAAY;AAEjB,MAAI,QACF,MAAK,UAAU;AAGjB,MAAI,KACF,MAAK,OAAO;AAGd,MAAI,QAAQ;AAGV,QAAK,UAAU,iBAFK,OAAO,WAAW,IAAI,gBAAgB,eAEd;AAE5C,QAAK,MAAM,EAAE,kBAAU,OACrB,MAAK,UAAU,KAAK,QAAQ,OAAO,KAAKA,OAAK,IAAI"}

package/lib/unreachable-BxbjIt8H.cjs

@@ -1,23 +0,0 @@
-
-//#region src/common/utils/unreachable.ts
-/**
-* Indicates that code is unreachable.
-*
-* This can be used for exhaustiveness checks in situations where the compiler
-* would not otherwise check for exhaustiveness.
-*
-* If the determination that the code is unreachable proves incorrect, an
-* exception is thrown.
-*/
-const unreachable = (condition, message = `Entered unreachable code. Received '${condition}'.`) => {
-	throw new TypeError(message);
-};
-
-//#endregion
-Object.defineProperty(exports, 'unreachable', {
-  enumerable: true,
-  get: function () {
-    return unreachable;
-  }
-});
-//# sourceMappingURL=unreachable-BxbjIt8H.cjs.map

package/lib/unreachable-BxbjIt8H.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"unreachable-BxbjIt8H.cjs","names":[],"sources":["../src/common/utils/unreachable.ts"],"sourcesContent":["/**\n * Indicates that code is unreachable.\n *\n * This can be used for exhaustiveness checks in situations where the compiler\n * would not otherwise check for exhaustiveness.\n *\n * If the determination that the code is unreachable proves incorrect, an\n * exception is thrown.\n */\nexport const unreachable = (\n  condition: never,\n  message = `Entered unreachable code. Received '${condition}'.`,\n): never => {\n  throw new TypeError(message);\n};\n"],"mappings":";;;;;;;;;;;AASA,MAAa,eACX,WACA,UAAU,uCAAuC,UAAU,QACjD;AACV,OAAM,IAAI,UAAU,QAAQ"}