workos 0.18.0 → 0.19.0

package/dist/check-coverage.ts

@@ -1,237 +0,0 @@
-#!/usr/bin/env tsx
-/**
- * Coverage checker: compares the WorkOS OpenAPI spec against the emulator's
- * registered routes to find missing or extra endpoints.
- *
- * Usage:
- *   pnpm check:coverage path/to/openapi.yaml
- *   pnpm check:coverage ~/Developer/workos/packages/api/open-api-spec.yaml
- *
- * Reports:
- *   - Spec endpoints missing from the emulator
- *   - Emulator endpoints not in the spec (custom/internal)
- *   - Coverage percentage
- */
-
-import { readFileSync, existsSync, readdirSync } from 'node:fs';
-import { resolve, extname, join } from 'node:path';
-import YAML from 'yaml';
-
-// ---------------------------------------------------------------------------
-// Parse OpenAPI spec endpoints
-// ---------------------------------------------------------------------------
-
-interface SpecEndpoint {
-  method: string;
-  path: string;
-  operationId?: string;
-  summary?: string;
-  tags: string[];
-}
-
-function parseOpenApiEndpoints(specPath: string): SpecEndpoint[] {
-  const raw = readFileSync(specPath, 'utf-8');
-  const ext = extname(specPath).toLowerCase();
-  const spec = ext === '.yaml' || ext === '.yml' ? YAML.parse(raw) : JSON.parse(raw);
-
-  const endpoints: SpecEndpoint[] = [];
-  const methods = ['get', 'post', 'put', 'patch', 'delete'] as const;
-
-  for (const [path, item] of Object.entries(spec.paths ?? {}) as [string, any][]) {
-    for (const method of methods) {
-      const op = item[method];
-      if (!op) continue;
-
-      // Normalize OpenAPI path params {id} → :id
-      const normalizedPath = path.replace(/\{([^}]+)\}/g, ':$1');
-
-      endpoints.push({
-        method: method.toUpperCase(),
-        path: normalizedPath,
-        operationId: op.operationId,
-        summary: op.summary,
-        tags: op.tags ?? [],
-      });
-    }
-  }
-
-  return endpoints;
-}
-
-// ---------------------------------------------------------------------------
-// Parse emulator registered routes from source files
-// ---------------------------------------------------------------------------
-
-interface EmulatorEndpoint {
-  method: string;
-  path: string;
-  file: string;
-  line: number;
-}
-
-function parseEmulatorEndpoints(): EmulatorEndpoint[] {
-  const routesDir = resolve('src/emulate/workos/routes');
-  const serverFile = resolve('src/emulate/core/server.ts');
-  const endpoints: EmulatorEndpoint[] = [];
-
-  const routePattern = /app\.(get|post|put|patch|delete)\('([^']+)'/g;
-
-  const filesToScan: string[] = [];
-
-  // Collect route files
-  if (existsSync(routesDir)) {
-    for (const file of readdirSync(routesDir)) {
-      if (file.endsWith('.ts') && !file.endsWith('.spec.ts')) {
-        filesToScan.push(join(routesDir, file));
-      }
-    }
-  }
-
-  // Also scan server.ts for JWKS and other direct routes
-  if (existsSync(serverFile)) {
-    filesToScan.push(serverFile);
-  }
-
-  for (const filePath of filesToScan) {
-    const content = readFileSync(filePath, 'utf-8');
-    const lines = content.split('\n');
-
-    for (let i = 0; i < lines.length; i++) {
-      routePattern.lastIndex = 0;
-      let match;
-      while ((match = routePattern.exec(lines[i])) !== null) {
-        endpoints.push({
-          method: match[1].toUpperCase(),
-          path: match[2],
-          file: filePath.replace(resolve('.') + '/', ''),
-          line: i + 1,
-        });
-      }
-    }
-  }
-
-  return endpoints;
-}
-
-// ---------------------------------------------------------------------------
-// Normalize paths for comparison
-// ---------------------------------------------------------------------------
-
-/** Normalize path params to a canonical form for matching.
- *  e.g., :id, :orgId, :organization_id all become :param in the same position */
-function normalizePath(path: string): string {
-  return path
-    .replace(/:[a-zA-Z_]+/g, ':param')
-    .replace(/\/+$/, '')
-    .toLowerCase();
-}
-
-function routeKey(method: string, path: string): string {
-  return `${method} ${normalizePath(path)}`;
-}
-
-// ---------------------------------------------------------------------------
-// Main
-// ---------------------------------------------------------------------------
-
-function main(): void {
-  const specPath = process.argv[2];
-  if (!specPath) {
-    console.error('Usage: check-coverage <openapi-spec-path>');
-    console.error('  e.g.: pnpm check:coverage ~/Developer/workos/packages/api/open-api-spec.yaml');
-    process.exit(1);
-  }
-
-  const resolvedSpec = resolve(specPath);
-  if (!existsSync(resolvedSpec)) {
-    console.error(`Spec file not found: ${resolvedSpec}`);
-    process.exit(1);
-  }
-
-  const specEndpoints = parseOpenApiEndpoints(resolvedSpec);
-  const emulatorEndpoints = parseEmulatorEndpoints();
-
-  // Build lookup maps
-  const specMap = new Map<string, SpecEndpoint>();
-  for (const ep of specEndpoints) {
-    specMap.set(routeKey(ep.method, ep.path), ep);
-  }
-
-  const emulatorMap = new Map<string, EmulatorEndpoint>();
-  for (const ep of emulatorEndpoints) {
-    emulatorMap.set(routeKey(ep.method, ep.path), ep);
-  }
-
-  // Find gaps
-  const missing: SpecEndpoint[] = [];
-  const covered: SpecEndpoint[] = [];
-  for (const [key, ep] of specMap) {
-    if (emulatorMap.has(key)) {
-      covered.push(ep);
-    } else {
-      missing.push(ep);
-    }
-  }
-
-  const extra: EmulatorEndpoint[] = [];
-  for (const [key, ep] of emulatorMap) {
-    if (!specMap.has(key)) {
-      extra.push(ep);
-    }
-  }
-
-  // Group missing by tag
-  const missingByTag = new Map<string, SpecEndpoint[]>();
-  for (const ep of missing) {
-    const tag = ep.tags[0] ?? 'untagged';
-    if (!missingByTag.has(tag)) missingByTag.set(tag, []);
-    missingByTag.get(tag)!.push(ep);
-  }
-
-  // Report
-  const total = specEndpoints.length;
-  const coveredCount = covered.length;
-  const pct = total > 0 ? ((coveredCount / total) * 100).toFixed(1) : '0';
-
-  console.log('');
-  console.log('=== Emulator API Coverage Report ===');
-  console.log('');
-  console.log(`  Spec endpoints:     ${total}`);
-  console.log(`  Emulator endpoints: ${emulatorEndpoints.length}`);
-  console.log(`  Covered:            ${coveredCount}/${total} (${pct}%)`);
-  console.log(`  Missing:            ${missing.length}`);
-  console.log(`  Extra (emulator-only): ${extra.length}`);
-  console.log('');
-
-  if (missing.length > 0) {
-    console.log('--- Missing from emulator ---');
-    console.log('');
-    for (const [tag, eps] of [...missingByTag.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
-      console.log(`  [${tag}]`);
-      for (const ep of eps) {
-        const desc = ep.summary ? ` — ${ep.summary}` : '';
-        console.log(`    ${ep.method.padEnd(6)} ${ep.path}${desc}`);
-      }
-      console.log('');
-    }
-  }
-
-  if (extra.length > 0) {
-    console.log('--- Emulator-only (not in spec) ---');
-    console.log('');
-    for (const ep of extra.sort((a, b) => a.path.localeCompare(b.path))) {
-      console.log(`    ${ep.method.padEnd(6)} ${ep.path}  (${ep.file}:${ep.line})`);
-    }
-    console.log('');
-  }
-
-  if (missing.length === 0) {
-    console.log('Full coverage — all spec endpoints are implemented.');
-    console.log('');
-  }
-
-  // Exit 1 if there are missing endpoints (useful for CI later)
-  process.exit(missing.length > 0 ? 1 : 0);
-}
-
-main();

package/dist/emulate/core/id.d.ts

@@ -1,48 +0,0 @@
-export declare function generateId(prefix: string): string;
-export declare function resetIdState(): void;
-export declare const ID_PREFIXES: {
-    readonly user: "user";
-    readonly organization: "org";
-    readonly organization_membership: "om";
-    readonly organization_domain: "org_domain";
-    readonly connection: "conn";
-    readonly connection_domain: "conn_domain";
-    readonly directory: "directory";
-    readonly directory_user: "directory_user";
-    readonly directory_group: "directory_grp";
-    readonly event: "evt";
-    readonly invitation: "inv";
-    readonly session: "session";
-    readonly email_verification: "email_verification";
-    readonly password_reset: "password_reset";
-    readonly magic_auth: "magic_auth";
-    readonly authentication_factor: "auth_factor";
-    readonly authentication_challenge: "auth_challenge";
-    readonly authorization_code: "auth_code";
-    readonly identity: "identity";
-    readonly sso_authorization: "sso_auth";
-    readonly refresh_token: "ref";
-    readonly device_authorization: "dev_auth";
-    readonly api_key: "api_key";
-    readonly profile: "prof";
-    readonly pipe_connection: "pipe_conn";
-    readonly redirect_uri: "redir";
-    readonly cors_origin: "cors";
-    readonly authorized_application: "auth_app";
-    readonly connected_account: "conn_acct";
-    readonly role: "role";
-    readonly permission: "perm";
-    readonly role_permission: "rp";
-    readonly authorization_resource: "auth_res";
-    readonly role_assignment: "ra";
-    readonly audit_log_action: "audit_action";
-    readonly audit_log_event: "audit_event";
-    readonly audit_log_export: "audit_export";
-    readonly feature_flag: "ff";
-    readonly flag_target: "ff_target";
-    readonly connect_application: "connect_app";
-    readonly client_secret: "client_secret";
-    readonly data_integration_auth: "di_auth";
-    readonly radar_attempt: "radar_attempt";
-    readonly webhook_endpoint: "we";
-};

package/dist/emulate/core/id.js

@@ -1,73 +0,0 @@
-const ENCODING = '0123456789ABCDEFGHJKMNPQRSTVWXYZ'; // Crockford's Base32
-const ENCODING_LEN = ENCODING.length; // 32
-const TIME_LEN = 10; // 10 chars encodes 48-bit ms timestamp
-const RANDOM_LEN = 16; // 16 chars of randomness
-let lastTime = 0;
-export function generateId(prefix) {
-    let now = Date.now();
-    if (now <= lastTime) {
-        now = lastTime + 1;
-    }
-    lastTime = now;
-    let timeStr = '';
-    let t = now;
-    for (let i = TIME_LEN - 1; i >= 0; i--) {
-        timeStr = ENCODING[t % ENCODING_LEN] + timeStr;
-        t = Math.floor(t / ENCODING_LEN);
-    }
-    let randStr = '';
-    for (let i = 0; i < RANDOM_LEN; i++) {
-        randStr += ENCODING[Math.floor(Math.random() * ENCODING_LEN)];
-    }
-    return `${prefix}_${timeStr}${randStr}`;
-}
-export function resetIdState() {
-    lastTime = 0;
-}
-export const ID_PREFIXES = {
-    user: 'user',
-    organization: 'org',
-    organization_membership: 'om',
-    organization_domain: 'org_domain',
-    connection: 'conn',
-    connection_domain: 'conn_domain',
-    directory: 'directory',
-    directory_user: 'directory_user',
-    directory_group: 'directory_grp',
-    event: 'evt',
-    invitation: 'inv',
-    session: 'session',
-    email_verification: 'email_verification',
-    password_reset: 'password_reset',
-    magic_auth: 'magic_auth',
-    authentication_factor: 'auth_factor',
-    authentication_challenge: 'auth_challenge',
-    authorization_code: 'auth_code',
-    identity: 'identity',
-    sso_authorization: 'sso_auth',
-    refresh_token: 'ref',
-    device_authorization: 'dev_auth',
-    api_key: 'api_key',
-    profile: 'prof',
-    pipe_connection: 'pipe_conn',
-    redirect_uri: 'redir',
-    cors_origin: 'cors',
-    authorized_application: 'auth_app',
-    connected_account: 'conn_acct',
-    role: 'role',
-    permission: 'perm',
-    role_permission: 'rp',
-    authorization_resource: 'auth_res',
-    role_assignment: 'ra',
-    audit_log_action: 'audit_action',
-    audit_log_event: 'audit_event',
-    audit_log_export: 'audit_export',
-    feature_flag: 'ff',
-    flag_target: 'ff_target',
-    connect_application: 'connect_app',
-    client_secret: 'client_secret',
-    data_integration_auth: 'di_auth',
-    radar_attempt: 'radar_attempt',
-    webhook_endpoint: 'we',
-};
-//# sourceMappingURL=id.js.map

package/dist/emulate/core/id.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"id.js","sourceRoot":"","sources":["../../../src/emulate/core/id.ts"],"names":[],"mappings":"AAAA,MAAM,QAAQ,GAAG,kCAAkC,CAAC,CAAC,qBAAqB;AAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK;AAC3C,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,uCAAuC;AAC5D,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,yBAAyB;AAEhD,IAAI,QAAQ,GAAG,CAAC,CAAC;AAEjB,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrB,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;QACpB,GAAG,GAAG,QAAQ,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,QAAQ,GAAG,GAAG,CAAC;IAEf,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,OAAO,GAAG,QAAQ,CAAC,CAAC,GAAG,YAAY,CAAC,GAAG,OAAO,CAAC;QAC/C,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,GAAG,MAAM,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,QAAQ,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,KAAK;IACnB,uBAAuB,EAAE,IAAI;IAC7B,mBAAmB,EAAE,YAAY;IACjC,UAAU,EAAE,MAAM;IAClB,iBAAiB,EAAE,aAAa;IAChC,SAAS,EAAE,WAAW;IACtB,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,eAAe;IAChC,KAAK,EAAE,KAAK;IACZ,UAAU,EAAE,KAAK;IACjB,OAAO,EAAE,SAAS;IAClB,kBAAkB,EAAE,oBAAoB;IACxC,cAAc,EAAE,gBAAgB;IAChC,UAAU,EAAE,YAAY;IACxB,qBAAqB,EAAE,aAAa;IACpC,wBAAwB,EAAE,gBAAgB;IAC1C,kBAAkB,EAAE,WAAW;IAC/B,QAAQ,EAAE,UAAU;IACpB,iBAAiB,EAAE,UAAU;IAC7B,aAAa,EAAE,KAAK;IACpB,oBAAoB,EAAE,UAAU;IAChC,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,MAAM;IACf,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,OAAO;IACrB,WAAW,EAAE,MAAM;IACnB,sBAAsB,EAAE,UAAU;IAClC,iBAAiB,EAAE,WAAW;IAC9B,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,MAAM;IAClB,eAAe,EAAE,IAAI;IACrB,sBAAsB,EAAE,UAAU;IAClC,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,cAAc;IAChC,eAAe,EAAE,aAAa;IAC9B,gBAAgB,EAAE,cAAc;IAChC,YAAY,EAAE,IAAI;IAClB,WAAW,EAAE,WAAW;IACxB,mBAAmB,EAAE,aAAa;IAClC,aAAa,EAAE,eAAe;IAC9B,qBAAqB,EAAE,SAAS;IAChC,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,IAAI;CACd,CAAC","sourcesContent":["const ENCODING = '0123456789ABCDEFGHJKMNPQRSTVWXYZ'; // Crockford's Base32\nconst ENCODING_LEN = ENCODING.length; // 32\nconst TIME_LEN = 10; // 10 chars encodes 48-bit ms timestamp\nconst RANDOM_LEN = 16; // 16 chars of randomness\n\nlet lastTime = 0;\n\nexport function generateId(prefix: string): string {\n  let now = Date.now();\n  if (now <= lastTime) {\n    now = lastTime + 1;\n  }\n  lastTime = now;\n\n  let timeStr = '';\n  let t = now;\n  for (let i = TIME_LEN - 1; i >= 0; i--) {\n    timeStr = ENCODING[t % ENCODING_LEN] + timeStr;\n    t = Math.floor(t / ENCODING_LEN);\n  }\n\n  let randStr = '';\n  for (let i = 0; i < RANDOM_LEN; i++) {\n    randStr += ENCODING[Math.floor(Math.random() * ENCODING_LEN)];\n  }\n\n  return `${prefix}_${timeStr}${randStr}`;\n}\n\nexport function resetIdState(): void {\n  lastTime = 0;\n}\n\nexport const ID_PREFIXES = {\n  user: 'user',\n  organization: 'org',\n  organization_membership: 'om',\n  organization_domain: 'org_domain',\n  connection: 'conn',\n  connection_domain: 'conn_domain',\n  directory: 'directory',\n  directory_user: 'directory_user',\n  directory_group: 'directory_grp',\n  event: 'evt',\n  invitation: 'inv',\n  session: 'session',\n  email_verification: 'email_verification',\n  password_reset: 'password_reset',\n  magic_auth: 'magic_auth',\n  authentication_factor: 'auth_factor',\n  authentication_challenge: 'auth_challenge',\n  authorization_code: 'auth_code',\n  identity: 'identity',\n  sso_authorization: 'sso_auth',\n  refresh_token: 'ref',\n  device_authorization: 'dev_auth',\n  api_key: 'api_key',\n  profile: 'prof',\n  pipe_connection: 'pipe_conn',\n  redirect_uri: 'redir',\n  cors_origin: 'cors',\n  authorized_application: 'auth_app',\n  connected_account: 'conn_acct',\n  role: 'role',\n  permission: 'perm',\n  role_permission: 'rp',\n  authorization_resource: 'auth_res',\n  role_assignment: 'ra',\n  audit_log_action: 'audit_action',\n  audit_log_event: 'audit_event',\n  audit_log_export: 'audit_export',\n  feature_flag: 'ff',\n  flag_target: 'ff_target',\n  connect_application: 'connect_app',\n  client_secret: 'client_secret',\n  data_integration_auth: 'di_auth',\n  radar_attempt: 'radar_attempt',\n  webhook_endpoint: 'we',\n} as const;\n"]}

package/dist/emulate/core/index.d.ts

@@ -1,8 +0,0 @@
-export { Store, Collection, type Entity, type InsertInput, type FilterFn, type SortFn, type CollectionHooks, } from './store.js';
-export { generateId, resetIdState, ID_PREFIXES } from './id.js';
-export { parseListParams, cursorPaginate, type CursorPaginationOptions, type CursorPaginatedResult, } from './pagination.js';
-export { JWTManager, type JWTPayload } from './jwt.js';
-export { createServer, type ServerOptions } from './server.js';
-export { type ServicePlugin, type RouteContext } from './plugin.js';
-export { WorkOSApiError, createApiErrorHandler, requestIdMiddleware, notFound, validationError, unauthorized, forbidden, parseJsonBody, } from './middleware/error-handler.js';
-export { authMiddleware, type WorkOSAppEnv, type WorkOSAuthContext, type ApiKeyMap } from './middleware/auth.js';

package/dist/emulate/core/index.js

@@ -1,8 +0,0 @@
-export { Store, Collection, } from './store.js';
-export { generateId, resetIdState, ID_PREFIXES } from './id.js';
-export { parseListParams, cursorPaginate, } from './pagination.js';
-export { JWTManager } from './jwt.js';
-export { createServer } from './server.js';
-export { WorkOSApiError, createApiErrorHandler, requestIdMiddleware, notFound, validationError, unauthorized, forbidden, parseJsonBody, } from './middleware/error-handler.js';
-export { authMiddleware } from './middleware/auth.js';
-//# sourceMappingURL=index.js.map

package/dist/emulate/core/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/emulate/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,UAAU,GAMX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EACL,eAAe,EACf,cAAc,GAGf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAE/D,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,mBAAmB,EACnB,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,SAAS,EACT,aAAa,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,cAAc,EAA6D,MAAM,sBAAsB,CAAC","sourcesContent":["export {\n  Store,\n  Collection,\n  type Entity,\n  type InsertInput,\n  type FilterFn,\n  type SortFn,\n  type CollectionHooks,\n} from './store.js';\nexport { generateId, resetIdState, ID_PREFIXES } from './id.js';\nexport {\n  parseListParams,\n  cursorPaginate,\n  type CursorPaginationOptions,\n  type CursorPaginatedResult,\n} from './pagination.js';\nexport { JWTManager, type JWTPayload } from './jwt.js';\nexport { createServer, type ServerOptions } from './server.js';\nexport { type ServicePlugin, type RouteContext } from './plugin.js';\nexport {\n  WorkOSApiError,\n  createApiErrorHandler,\n  requestIdMiddleware,\n  notFound,\n  validationError,\n  unauthorized,\n  forbidden,\n  parseJsonBody,\n} from './middleware/error-handler.js';\nexport { authMiddleware, type WorkOSAppEnv, type WorkOSAuthContext, type ApiKeyMap } from './middleware/auth.js';\n"]}

package/dist/emulate/core/jwt.d.ts

@@ -1,28 +0,0 @@
-export interface JWTPayload {
-    sub: string;
-    sid?: string;
-    org_id?: string;
-    role?: string;
-    permissions?: string[];
-    iss: string;
-    aud: string;
-    exp: number;
-    iat: number;
-}
-interface SignOptions {
-    expiresIn?: number;
-}
-export declare class JWTManager {
-    private privateKey;
-    private publicKey;
-    private kid;
-    issuer: string;
-    constructor(issuer?: string);
-    sign(payload: Omit<JWTPayload, 'iss' | 'iat' | 'exp'>, options?: SignOptions): string;
-    verify(token: string): JWTPayload;
-    getJWKS(): {
-        keys: Record<string, unknown>[];
-    };
-    getPublicKeyPem(): string;
-}
-export {};

package/dist/emulate/core/jwt.js

@@ -1,78 +0,0 @@
-import { createSign, createVerify, generateKeyPairSync } from 'node:crypto';
-function base64url(input) {
-    const buf = typeof input === 'string' ? Buffer.from(input) : input;
-    return buf.toString('base64url');
-}
-function base64urlDecode(input) {
-    return Buffer.from(input, 'base64url');
-}
-export class JWTManager {
-    privateKey;
-    publicKey;
-    kid;
-    issuer;
-    constructor(issuer = 'https://api.workos.com') {
-        this.issuer = issuer;
-        const { privateKey, publicKey } = generateKeyPairSync('rsa', {
-            modulusLength: 2048,
-        });
-        this.privateKey = privateKey;
-        this.publicKey = publicKey;
-        this.kid = `workos_emulate_${Date.now()}`;
-    }
-    sign(payload, options) {
-        const now = Math.floor(Date.now() / 1000);
-        const expiresIn = options?.expiresIn ?? 3600;
-        const fullPayload = {
-            ...payload,
-            iss: this.issuer,
-            iat: now,
-            exp: now + expiresIn,
-        };
-        const header = { alg: 'RS256', typ: 'JWT', kid: this.kid };
-        const headerB64 = base64url(JSON.stringify(header));
-        const payloadB64 = base64url(JSON.stringify(fullPayload));
-        const signingInput = `${headerB64}.${payloadB64}`;
-        const signer = createSign('RSA-SHA256');
-        signer.update(signingInput);
-        const signature = signer.sign(this.privateKey, 'base64url');
-        return `${signingInput}.${signature}`;
-    }
-    verify(token) {
-        const parts = token.split('.');
-        if (parts.length !== 3) {
-            throw new Error('Invalid token format');
-        }
-        const [headerB64, payloadB64, signature] = parts;
-        const signingInput = `${headerB64}.${payloadB64}`;
-        const verifier = createVerify('RSA-SHA256');
-        verifier.update(signingInput);
-        const valid = verifier.verify(this.publicKey, signature, 'base64url');
-        if (!valid) {
-            throw new Error('Invalid token signature');
-        }
-        const payload = JSON.parse(base64urlDecode(payloadB64).toString('utf-8'));
-        const now = Math.floor(Date.now() / 1000);
-        if (payload.exp && payload.exp < now) {
-            throw new Error('Token has expired');
-        }
-        return payload;
-    }
-    getJWKS() {
-        const jwk = this.publicKey.export({ format: 'jwk' });
-        return {
-            keys: [
-                {
-                    ...jwk,
-                    kid: this.kid,
-                    alg: 'RS256',
-                    use: 'sig',
-                },
-            ],
-        };
-    }
-    getPublicKeyPem() {
-        return this.publicKey.export({ type: 'spki', format: 'pem' });
-    }
-}
-//# sourceMappingURL=jwt.js.map

package/dist/emulate/core/jwt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/emulate/core/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,mBAAmB,EAAkB,MAAM,aAAa,CAAC;AAkB5F,SAAS,SAAS,CAAC,KAAsB;IACvC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnE,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,OAAO,UAAU;IACb,UAAU,CAAY;IACtB,SAAS,CAAY;IACrB,GAAG,CAAS;IACpB,MAAM,CAAS;IAEf,YAAY,MAAM,GAAG,wBAAwB;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,kBAAkB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,OAAgD,EAAE,OAAqB;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;QAE7C,MAAM,WAAW,GAAe;YAC9B,GAAG,OAAO;YACV,GAAG,EAAE,IAAI,CAAC,MAAM;YAChB,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,SAAS;SACrB,CAAC;QAEF,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAElD,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAE5D,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QACjD,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAElD,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC5C,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAEtE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAe,CAAC;QAExF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,OAAO;YACL,IAAI,EAAE;gBACJ;oBACE,GAAG,GAAG;oBACN,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,EAAE,OAAO;oBACZ,GAAG,EAAE,KAAK;iBACX;aACF;SACF,CAAC;IACJ,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IAC1E,CAAC;CACF","sourcesContent":["import { createSign, createVerify, generateKeyPairSync, type KeyObject } from 'node:crypto';\n\nexport interface JWTPayload {\n  sub: string;\n  sid?: string;\n  org_id?: string;\n  role?: string;\n  permissions?: string[];\n  iss: string;\n  aud: string;\n  exp: number;\n  iat: number;\n}\n\ninterface SignOptions {\n  expiresIn?: number;\n}\n\nfunction base64url(input: Buffer | string): string {\n  const buf = typeof input === 'string' ? Buffer.from(input) : input;\n  return buf.toString('base64url');\n}\n\nfunction base64urlDecode(input: string): Buffer {\n  return Buffer.from(input, 'base64url');\n}\n\nexport class JWTManager {\n  private privateKey: KeyObject;\n  private publicKey: KeyObject;\n  private kid: string;\n  issuer: string;\n\n  constructor(issuer = 'https://api.workos.com') {\n    this.issuer = issuer;\n    const { privateKey, publicKey } = generateKeyPairSync('rsa', {\n      modulusLength: 2048,\n    });\n    this.privateKey = privateKey;\n    this.publicKey = publicKey;\n    this.kid = `workos_emulate_${Date.now()}`;\n  }\n\n  sign(payload: Omit<JWTPayload, 'iss' | 'iat' | 'exp'>, options?: SignOptions): string {\n    const now = Math.floor(Date.now() / 1000);\n    const expiresIn = options?.expiresIn ?? 3600;\n\n    const fullPayload: JWTPayload = {\n      ...payload,\n      iss: this.issuer,\n      iat: now,\n      exp: now + expiresIn,\n    };\n\n    const header = { alg: 'RS256', typ: 'JWT', kid: this.kid };\n    const headerB64 = base64url(JSON.stringify(header));\n    const payloadB64 = base64url(JSON.stringify(fullPayload));\n    const signingInput = `${headerB64}.${payloadB64}`;\n\n    const signer = createSign('RSA-SHA256');\n    signer.update(signingInput);\n    const signature = signer.sign(this.privateKey, 'base64url');\n\n    return `${signingInput}.${signature}`;\n  }\n\n  verify(token: string): JWTPayload {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n      throw new Error('Invalid token format');\n    }\n\n    const [headerB64, payloadB64, signature] = parts;\n    const signingInput = `${headerB64}.${payloadB64}`;\n\n    const verifier = createVerify('RSA-SHA256');\n    verifier.update(signingInput);\n    const valid = verifier.verify(this.publicKey, signature, 'base64url');\n\n    if (!valid) {\n      throw new Error('Invalid token signature');\n    }\n\n    const payload = JSON.parse(base64urlDecode(payloadB64).toString('utf-8')) as JWTPayload;\n\n    const now = Math.floor(Date.now() / 1000);\n    if (payload.exp && payload.exp < now) {\n      throw new Error('Token has expired');\n    }\n\n    return payload;\n  }\n\n  getJWKS(): { keys: Record<string, unknown>[] } {\n    const jwk = this.publicKey.export({ format: 'jwk' });\n    return {\n      keys: [\n        {\n          ...jwk,\n          kid: this.kid,\n          alg: 'RS256',\n          use: 'sig',\n        },\n      ],\n    };\n  }\n\n  getPublicKeyPem(): string {\n    return this.publicKey.export({ type: 'spki', format: 'pem' }) as string;\n  }\n}\n"]}

package/dist/emulate/core/middleware/auth.d.ts

@@ -1,15 +0,0 @@
-import type { Context, Next } from 'hono';
-export interface WorkOSAuthContext {
-    environment: string;
-    apiKey: string;
-}
-export type WorkOSAppEnv = {
-    Variables: {
-        auth?: WorkOSAuthContext;
-        requestId?: string;
-    };
-};
-export type ApiKeyMap = Record<string, {
-    environment: string;
-}>;
-export declare function authMiddleware(apiKeys: ApiKeyMap): (c: Context, next: Next) => Promise<void>;

package/dist/emulate/core/middleware/auth.js

@@ -1,17 +0,0 @@
-import { unauthorized } from './error-handler.js';
-export function authMiddleware(apiKeys) {
-    return async (c, next) => {
-        const authHeader = c.req.header('Authorization');
-        if (!authHeader)
-            throw unauthorized();
-        const token = authHeader.replace(/^Bearer\s+/i, '').trim();
-        if (!token.startsWith('sk_'))
-            throw unauthorized();
-        const keyInfo = apiKeys[token];
-        if (!keyInfo)
-            throw unauthorized();
-        c.set('auth', { environment: keyInfo.environment, apiKey: token });
-        await next();
-    };
-}
-//# sourceMappingURL=auth.js.map

package/dist/emulate/core/middleware/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../src/emulate/core/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAgBlD,MAAM,UAAU,cAAc,CAAC,OAAkB;IAC/C,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU;YAAE,MAAM,YAAY,EAAE,CAAC;QAEtC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,YAAY,EAAE,CAAC;QAEnD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,MAAM,YAAY,EAAE,CAAC;QAEnC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAA8B,CAAC,CAAC;QAC/F,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { Context, Next } from 'hono';\nimport { unauthorized } from './error-handler.js';\n\nexport interface WorkOSAuthContext {\n  environment: string;\n  apiKey: string;\n}\n\nexport type WorkOSAppEnv = {\n  Variables: {\n    auth?: WorkOSAuthContext;\n    requestId?: string;\n  };\n};\n\nexport type ApiKeyMap = Record<string, { environment: string }>;\n\nexport function authMiddleware(apiKeys: ApiKeyMap) {\n  return async (c: Context, next: Next) => {\n    const authHeader = c.req.header('Authorization');\n    if (!authHeader) throw unauthorized();\n\n    const token = authHeader.replace(/^Bearer\\s+/i, '').trim();\n    if (!token.startsWith('sk_')) throw unauthorized();\n\n    const keyInfo = apiKeys[token];\n    if (!keyInfo) throw unauthorized();\n\n    c.set('auth', { environment: keyInfo.environment, apiKey: token } satisfies WorkOSAuthContext);\n    await next();\n  };\n}\n"]}

package/dist/emulate/core/middleware/error-handler.d.ts

@@ -1,22 +0,0 @@
-import type { Context, ErrorHandler, MiddlewareHandler } from 'hono';
-export declare class WorkOSApiError extends Error {
-    status: number;
-    code: string;
-    errors?: Array<{
-        field: string;
-        code: string;
-        message?: string;
-    }> | undefined;
-    constructor(status: number, message: string, code: string, errors?: Array<{
-        field: string;
-        code: string;
-        message?: string;
-    }> | undefined);
-}
-export declare function createApiErrorHandler(): ErrorHandler;
-export declare function requestIdMiddleware(): MiddlewareHandler;
-export declare function notFound(resource?: string): WorkOSApiError;
-export declare function validationError(message: string, errors?: WorkOSApiError['errors']): WorkOSApiError;
-export declare function unauthorized(): WorkOSApiError;
-export declare function forbidden(): WorkOSApiError;
-export declare function parseJsonBody(c: Context): Promise<Record<string, unknown>>;

package/dist/emulate/core/middleware/error-handler.js

@@ -1,72 +0,0 @@
-export class WorkOSApiError extends Error {
-    status;
-    code;
-    errors;
-    constructor(status, message, code, errors) {
-        super(message);
-        this.status = status;
-        this.code = code;
-        this.errors = errors;
-        this.name = 'WorkOSApiError';
-    }
-}
-export function createApiErrorHandler() {
-    return (err, c) => {
-        if (err instanceof WorkOSApiError) {
-            const body = {
-                message: err.message,
-                code: err.code,
-            };
-            if (err.errors) {
-                body.errors = err.errors;
-            }
-            return c.json(body, err.status);
-        }
-        const status = errorStatus(err);
-        return c.json({
-            message: 'Internal Server Error',
-            code: 'server_error',
-        }, status);
-    };
-}
-export function requestIdMiddleware() {
-    return async (c, next) => {
-        const requestId = c.req.header('X-Request-ID') ?? `req_${crypto.randomUUID()}`;
-        c.set('requestId', requestId);
-        c.header('X-Request-ID', requestId);
-        await next();
-    };
-}
-export function notFound(resource) {
-    return new WorkOSApiError(404, resource ? `${resource} not found` : 'Not Found', 'not_found');
-}
-export function validationError(message, errors) {
-    return new WorkOSApiError(422, message, 'unprocessable_entity', errors);
-}
-export function unauthorized() {
-    return new WorkOSApiError(401, 'Unauthorized', 'unauthorized');
-}
-export function forbidden() {
-    return new WorkOSApiError(403, 'Forbidden', 'forbidden');
-}
-export async function parseJsonBody(c) {
-    try {
-        const body = await c.req.json();
-        if (body && typeof body === 'object' && !Array.isArray(body)) {
-            return body;
-        }
-        return {};
-    }
-    catch {
-        throw new WorkOSApiError(400, 'Problems parsing JSON', 'invalid_request_body');
-    }
-}
-function errorStatus(err) {
-    if (err && typeof err === 'object' && 'status' in err) {
-        const s = err.status;
-        if (typeof s === 'number' && Number.isFinite(s))
-            return s;
-    }
-    return 500;
-}
-//# sourceMappingURL=error-handler.js.map

package/dist/emulate/core/middleware/error-handler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../../../src/emulate/core/middleware/error-handler.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE9B;IAEA;IACA;IAJT,YACS,MAAc,EACrB,OAAe,EACR,IAAY,EACZ,MAAiE;QAExE,KAAK,CAAC,OAAO,CAAC,CAAC;QALR,WAAM,GAAN,MAAM,CAAQ;QAEd,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAA2D;QAGxE,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAChB,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,GAA4B;gBACpC,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC3B,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAA8B,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC,IAAI,CACX;YACE,OAAO,EAAE,uBAAuB;YAChC,IAAI,EAAE,cAAc;SACrB,EACD,MAA8B,CAC/B,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,OAAO,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAC/E,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC9B,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAiB;IACxC,OAAO,IAAI,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAAiC;IAChF,OAAO,IAAI,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAU;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,OAAO,IAA+B,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;QACtD,MAAM,CAAC,GAAI,GAA2B,CAAC,MAAM,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["import type { Context, ErrorHandler, MiddlewareHandler } from 'hono';\nimport type { ContentfulStatusCode } from 'hono/utils/http-status';\n\nexport class WorkOSApiError extends Error {\n  constructor(\n    public status: number,\n    message: string,\n    public code: string,\n    public errors?: Array<{ field: string; code: string; message?: string }>,\n  ) {\n    super(message);\n    this.name = 'WorkOSApiError';\n  }\n}\n\nexport function createApiErrorHandler(): ErrorHandler {\n  return (err, c) => {\n    if (err instanceof WorkOSApiError) {\n      const body: Record<string, unknown> = {\n        message: err.message,\n        code: err.code,\n      };\n      if (err.errors) {\n        body.errors = err.errors;\n      }\n      return c.json(body, err.status as ContentfulStatusCode);\n    }\n\n    const status = errorStatus(err);\n    return c.json(\n      {\n        message: 'Internal Server Error',\n        code: 'server_error',\n      },\n      status as ContentfulStatusCode,\n    );\n  };\n}\n\nexport function requestIdMiddleware(): MiddlewareHandler {\n  return async (c, next) => {\n    const requestId = c.req.header('X-Request-ID') ?? `req_${crypto.randomUUID()}`;\n    c.set('requestId', requestId);\n    c.header('X-Request-ID', requestId);\n    await next();\n  };\n}\n\nexport function notFound(resource?: string): WorkOSApiError {\n  return new WorkOSApiError(404, resource ? `${resource} not found` : 'Not Found', 'not_found');\n}\n\nexport function validationError(message: string, errors?: WorkOSApiError['errors']): WorkOSApiError {\n  return new WorkOSApiError(422, message, 'unprocessable_entity', errors);\n}\n\nexport function unauthorized(): WorkOSApiError {\n  return new WorkOSApiError(401, 'Unauthorized', 'unauthorized');\n}\n\nexport function forbidden(): WorkOSApiError {\n  return new WorkOSApiError(403, 'Forbidden', 'forbidden');\n}\n\nexport async function parseJsonBody(c: Context): Promise<Record<string, unknown>> {\n  try {\n    const body = await c.req.json();\n    if (body && typeof body === 'object' && !Array.isArray(body)) {\n      return body as Record<string, unknown>;\n    }\n    return {};\n  } catch {\n    throw new WorkOSApiError(400, 'Problems parsing JSON', 'invalid_request_body');\n  }\n}\n\nfunction errorStatus(err: unknown): number {\n  if (err && typeof err === 'object' && 'status' in err) {\n    const s = (err as { status: unknown }).status;\n    if (typeof s === 'number' && Number.isFinite(s)) return s;\n  }\n  return 500;\n}\n"]}