//#region src/common/crypto/crypto-provider.d.ts
/**
 * Interface encapsulating the various crypto computations used by the library,
 * allowing pluggable underlying crypto implementations.
 */
declare abstract class CryptoProvider {
  encoder: TextEncoder;
  /**
   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).
   * The output HMAC should be encoded in hexadecimal.
   *
   * Sample values for implementations:
   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'
   * - computeHMACSignature('\ud83d\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43
   */
  abstract computeHMACSignature(payload: string, secret: string): string;
  /**
   * Asynchronous version of `computeHMACSignature`. Some implementations may
   * only allow support async signature computation.
   *
   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).
   * The output HMAC should be encoded in hexadecimal.
   *
   * Sample values for implementations:
   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'
   * - computeHMACSignature('\ud83d\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43
   */
  abstract computeHMACSignatureAsync(payload: string, secret: string): Promise<string>;
  /**
   * Cryptographically determine whether two signatures are equal
   */
  abstract secureCompare(stringA: string, stringB: string): Promise<boolean>;
  /**
   * Encrypts data using AES-256-GCM algorithm.
   *
   * @param plaintext The data to encrypt
   * @param key The encryption key (should be 32 bytes for AES-256)
   * @param iv Optional initialization vector (if not provided, a random one will be generated)
   * @param aad Optional additional authenticated data
   * @returns Object containing the encrypted ciphertext, the IV used, and the authentication tag
   */
  abstract encrypt(plaintext: Uint8Array, key: Uint8Array, iv?: Uint8Array, aad?: Uint8Array): Promise<{
    ciphertext: Uint8Array;
    iv: Uint8Array;
    tag: Uint8Array;
  }>;
  /**
   * Decrypts data that was encrypted using AES-256-GCM algorithm.
   *
   * @param ciphertext The encrypted data
   * @param key The decryption key (must be the same key used for encryption)
   * @param iv The initialization vector used during encryption
   * @param tag The authentication tag produced during encryption
   * @param aad Optional additional authenticated data (must match what was used during encryption)
   * @returns The decrypted data
   * @throws Will throw an error if authentication fails or the data has been tampered with
   */
  abstract decrypt(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array, tag: Uint8Array, aad?: Uint8Array): Promise<Uint8Array>;
  /**
   * Generates cryptographically secure random bytes.
   *
   * @param length The number of random bytes to generate
   * @returns A Uint8Array containing the random bytes
   */
  abstract randomBytes(length: number): Uint8Array;
  /**
   * Generates a random UUID v4 string.
   *
   * @returns A UUID v4 string in the format xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
   */
  abstract randomUUID(): string;
}
//#endregion
//#region src/common/interfaces/http-client.interface.d.ts
type RequestHeaders = Record<string, string | number | string[]>;
type RequestOptions = {
  params?: Record<string, any>;
  headers?: RequestHeaders;
  /**
   * Maximum number of retries for this request, overriding the client-wide
   * `maxRetries`. Set to `0` to disable retries for this request.
   */
  maxRetries?: number;
};
type ResponseHeaderValue = string | string[];
type ResponseHeaders = Record<string, ResponseHeaderValue>;
interface HttpClientInterface {
  get(path: string, options: RequestOptions): any;
  post<Entity = any>(path: string, entity: Entity, options: RequestOptions): any;
  put<Entity = any>(path: string, entity: Entity, options: RequestOptions): any;
  delete(path: string, options: RequestOptions): any;
}
interface HttpClientResponseInterface {
  getStatusCode: () => number;
  getHeaders: () => ResponseHeaders;
  getRawResponse: () => unknown;
  toJSON: () => Promise<any | null>;
}
//#endregion
//#region src/common/net/http-client.d.ts
interface HttpClientOptions extends RequestInit {
  /** Per-request timeout in milliseconds. */
  timeout?: number;
  /**
   * Maximum number of retries for transient failures. Set to `0` to disable
   * automatic retries entirely. Defaults to {@link DEFAULT_MAX_RETRY_ATTEMPTS}.
   */
  maxRetries?: number;
}
declare abstract class HttpClient implements HttpClientInterface {
  readonly baseURL: string;
  readonly options?: HttpClientOptions | undefined;
  readonly MAX_RETRY_ATTEMPTS: number;
  readonly BACKOFF_MULTIPLIER = 1.5;
  readonly MINIMUM_SLEEP_TIME_IN_MILLISECONDS = 500;
  readonly MAXIMUM_SLEEP_TIME_IN_MILLISECONDS = 8000;
  readonly RETRY_STATUS_CODES: number[];
  constructor(baseURL: string, options?: HttpClientOptions | undefined);
  abstract get(path: string, options: RequestOptions): Promise<HttpClientResponseInterface>;
  abstract post<Entity = any>(path: string, entity: Entity, options: RequestOptions): Promise<HttpClientResponseInterface>;
  abstract put<Entity = any>(path: string, entity: Entity, options: RequestOptions): Promise<HttpClientResponseInterface>;
  abstract patch<Entity = any>(path: string, entity: Entity, options: RequestOptions): Promise<HttpClientResponseInterface>;
  abstract delete(path: string, options: RequestOptions): Promise<HttpClientResponseInterface>;
  abstract deleteWithBody<Entity = any>(path: string, entity: Entity, options: RequestOptions): Promise<HttpClientResponseInterface>;
  static getResourceURL(baseURL: string, path: string, params?: Record<string, any>): string;
  static getQueryString(queryObj?: Record<string, any>): string | undefined;
  static getContentTypeHeader(entity: any): RequestHeaders | undefined;
  static getBody(entity: any): BodyInit | null | undefined;
  /**
   * Generate a random idempotency key used to make retried write requests
   * safe. Mirrors the behavior of the other WorkOS SDKs (Kotlin, Go), which
   * attach an `Idempotency-Key` header to POST requests that did not already
   * specify one, so a retried request is not applied more than once.
   */
  static generateIdempotencyKey(): string;
  /**
   * Parse a `Retry-After` header value into milliseconds. Supports both the
   * delay-seconds form (e.g. `120`) and the HTTP-date form. The result is
   * capped at {@link MAXIMUM_RETRY_AFTER_TIME_IN_MILLISECONDS}. Returns
   * `null` when the value is absent or unparseable so the caller falls back
   * to the computed exponential backoff.
   */
  static parseRetryAfter(headerValue: string | null | undefined): number | null;
  private getSleepTimeInMilliseconds;
  sleep: (retryAttempt: number, retryAfterMs?: number | null) => Promise<unknown>;
}
//#endregion
//#region src/common/crypto/decode-payload.d.ts
type WebhookPayload = string | Uint8Array | ArrayBuffer | object;
//#endregion
//#region src/directory-sync/interfaces/directory.interface.d.ts
type DirectoryType = 'azure scim v2.0' | 'bamboohr' | 'breathe hr' | 'cezanne hr' | 'cyberark scim v2.0' | 'fourth hr' | 'gsuite directory' | 'generic scim v2.0' | 'hibob' | 'jump cloud scim v2.0' | 'okta scim v2.0' | 'onelogin scim v2.0' | 'people hr' | 'personio' | 'pingfederate scim v2.0' | 'rippling scim v2.0' | 'sftp' | 'sftp workday' | 'workday';
type DirectoryState = 'active' | 'deleting' | 'inactive' | 'invalid_credentials' | 'validating';
type DirectoryStateResponse = 'deleting' | 'invalid_credentials' | 'linked' | 'unlinked' | 'validating';
interface Directory {
  /** Distinguishes the Directory object. */
  object: 'directory';
  /** Unique identifier for the Directory. */
  id: string;
  /** The URL associated with an Enterprise Client. */
  domain: string;
  /** External Key for the Directory. */
  externalKey: string;
  /** The name of the directory. */
  name: string;
  /** The unique identifier for the Organization in which the directory resides. */
  organizationId?: string;
  /** Describes whether the Directory has been successfully connected to an external provider. */
  state: DirectoryState;
  /** The type of external Directory Provider integrated with. */
  type: DirectoryType;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface DirectoryResponse {
  object: 'directory';
  id: string;
  domain: string;
  external_key: string;
  name: string;
  organization_id?: string;
  state: DirectoryStateResponse;
  type: DirectoryType;
  created_at: string;
  updated_at: string;
}
interface EventDirectoryDomain {
  object: 'organization_domain';
  id: string;
  domain: string;
}
interface EventDirectory {
  object: 'directory';
  id: string;
  externalKey: string;
  type: DirectoryType;
  state: DirectoryState;
  name: string;
  organizationId?: string;
  domains: EventDirectoryDomain[];
  createdAt: string;
  updatedAt: string;
}
interface EventDirectoryResponse {
  object: 'directory';
  id: string;
  external_key: string;
  type: DirectoryType;
  state: DirectoryState;
  name: string;
  organization_id?: string;
  domains: EventDirectoryDomain[];
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/directory-sync/interfaces/directory-group.interface.d.ts
interface DirectoryGroup {
  id: string;
  idpId: string;
  directoryId: string;
  organizationId: string | null;
  name: string;
  createdAt: string;
  updatedAt: string;
  rawAttributes: any;
}
interface DirectoryGroupResponse {
  id: string;
  idp_id: string;
  directory_id: string;
  organization_id: string | null;
  name: string;
  created_at: string;
  updated_at: string;
  raw_attributes: any;
}
//#endregion
//#region src/common/interfaces/pagination-options.interface.d.ts
interface PaginationOptions {
  limit?: number;
  before?: string | null;
  after?: string | null;
  order?: 'asc' | 'desc';
}
//#endregion
//#region src/directory-sync/interfaces/list-directories-options.interface.d.ts
interface ListDirectoriesOptions extends PaginationOptions {
  /** Filter Directories by their associated organization. */
  organizationId?: string;
  /** Searchable text to match against Directory names. */
  search?: string;
}
interface SerializedListDirectoriesOptions extends PaginationOptions {
  organization_id?: string;
  search?: string;
}
//#endregion
//#region src/directory-sync/interfaces/list-groups-options.interface.d.ts
interface ListDirectoryGroupsOptions extends PaginationOptions {
  directory?: string;
  user?: string;
}
//#endregion
//#region src/directory-sync/interfaces/list-directory-users-options.interface.d.ts
interface ListDirectoryUsersOptions extends PaginationOptions {
  directory?: string;
  group?: string;
}
//#endregion
//#region src/authorization/interfaces/environment-role.interface.d.ts
interface EnvironmentRole {
  object: 'role';
  id: string;
  name: string;
  slug: string;
  description: string | null;
  permissions: string[];
  resourceTypeSlug: string;
  type: 'EnvironmentRole';
  createdAt: string;
  updatedAt: string;
}
interface EnvironmentRoleResponse {
  object: 'role';
  id: string;
  name: string;
  slug: string;
  description: string | null;
  permissions: string[];
  resource_type_slug: string;
  type: 'EnvironmentRole';
  created_at: string;
  updated_at: string;
}
interface EnvironmentRoleList {
  object: 'list';
  data: EnvironmentRole[];
}
interface EnvironmentRoleListResponse {
  object: 'list';
  data: EnvironmentRoleResponse[];
}
//#endregion
//#region src/authorization/interfaces/create-environment-role-options.interface.d.ts
interface CreateEnvironmentRoleOptions {
  slug: string;
  name: string;
  description?: string;
  resourceTypeSlug?: string;
}
interface SerializedCreateEnvironmentRoleOptions {
  slug: string;
  name: string;
  description?: string;
  resource_type_slug?: string;
}
//#endregion
//#region src/authorization/interfaces/update-environment-role-options.interface.d.ts
interface UpdateEnvironmentRoleOptions {
  name?: string;
  description?: string | null;
}
interface SerializedUpdateEnvironmentRoleOptions {
  name?: string;
  description?: string | null;
}
//#endregion
//#region src/authorization/interfaces/set-environment-role-permissions-options.interface.d.ts
interface SetEnvironmentRolePermissionsOptions {
  permissions: string[];
}
//#endregion
//#region src/authorization/interfaces/add-environment-role-permission-options.interface.d.ts
interface AddEnvironmentRolePermissionOptions {
  permissionSlug: string;
}
//#endregion
//#region src/authorization/interfaces/organization-role.interface.d.ts
interface OrganizationRole {
  object: 'role';
  id: string;
  name: string;
  slug: string;
  description: string | null;
  permissions: string[];
  resourceTypeSlug: string;
  type: 'OrganizationRole';
  createdAt: string;
  updatedAt: string;
}
//#endregion
//#region src/authorization/interfaces/create-organization-role-options.interface.d.ts
interface CreateOrganizationRoleOptions {
  slug?: string;
  name: string;
  description?: string;
  resourceTypeSlug?: string;
}
interface SerializedCreateOrganizationRoleOptions {
  slug?: string;
  name: string;
  description?: string;
  resource_type_slug?: string;
}
//#endregion
//#region src/authorization/interfaces/update-organization-role-options.interface.d.ts
interface UpdateOrganizationRoleOptions {
  name?: string;
  description?: string | null;
}
interface SerializedUpdateOrganizationRoleOptions {
  name?: string;
  description?: string | null;
}
//#endregion
//#region src/authorization/interfaces/set-organization-role-permissions-options.interface.d.ts
interface SetOrganizationRolePermissionsOptions {
  permissions: string[];
}
//#endregion
//#region src/authorization/interfaces/add-organization-role-permission-options.interface.d.ts
interface AddOrganizationRolePermissionOptions {
  permissionSlug: string;
}
//#endregion
//#region src/authorization/interfaces/remove-organization-role-permission-options.interface.d.ts
interface RemoveOrganizationRolePermissionOptions {
  permissionSlug: string;
}
//#endregion
//#region src/authorization/interfaces/permission.interface.d.ts
interface Permission {
  object: 'permission';
  id: string;
  slug: string;
  name: string;
  description: string | null;
  resourceTypeSlug: string;
  system: boolean;
  createdAt: string;
  updatedAt: string;
}
interface PermissionResponse {
  object: 'permission';
  id: string;
  slug: string;
  name: string;
  description: string | null;
  resource_type_slug: string;
  system: boolean;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/authorization/interfaces/create-permission-options.interface.d.ts
interface CreatePermissionOptions {
  slug: string;
  name: string;
  description?: string;
  resourceTypeSlug?: string;
}
interface SerializedCreatePermissionOptions {
  slug: string;
  name: string;
  description?: string;
  resource_type_slug?: string;
}
//#endregion
//#region src/authorization/interfaces/update-permission-options.interface.d.ts
interface UpdatePermissionOptions {
  name?: string;
  description?: string | null;
}
interface SerializedUpdatePermissionOptions {
  name?: string;
  description?: string | null;
}
//#endregion
//#region src/authorization/interfaces/list-permissions-options.interface.d.ts
type ListPermissionsOptions = PaginationOptions;
//#endregion
//#region src/authorization/interfaces/authorization-resource.interface.d.ts
interface AuthorizationResource {
  /** Distinguishes the Resource object. */
  object: 'authorization_resource';
  /** The unique ID of the Resource. */
  id: string;
  /** An identifier you provide to reference the resource in your system. */
  externalId: string;
  /** A human-readable name for the Resource. */
  name: string;
  /** An optional description of the Resource. */
  description: string | null;
  /** The slug of the resource type this resource belongs to. */
  resourceTypeSlug: string;
  /** The ID of the organization that owns the resource. */
  organizationId: string;
  /** The ID of the parent resource, if this resource is nested. */
  parentResourceId: string | null;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface AuthorizationResourceResponse {
  object: 'authorization_resource';
  id: string;
  external_id: string;
  name: string;
  description: string | null;
  resource_type_slug: string;
  organization_id: string;
  parent_resource_id: string | null;
  created_at: string;
  updated_at: string;
}
interface BaseCreateAuthorizationResourceOptions {
  externalId: string;
  name: string;
  description?: string | null;
  resourceTypeSlug: string;
  organizationId: string;
}
interface CreateOptionsWithParentResourceId extends BaseCreateAuthorizationResourceOptions {
  parentResourceId: string;
}
interface CreateOptionsWithParentExternalId extends BaseCreateAuthorizationResourceOptions {
  parentResourceExternalId: string;
  parentResourceTypeSlug: string;
}
type CreateAuthorizationResourceOptions = BaseCreateAuthorizationResourceOptions | CreateOptionsWithParentResourceId | CreateOptionsWithParentExternalId;
interface SerializedCreateAuthorizationResourceOptions {
  external_id: string;
  name: string;
  description?: string | null;
  resource_type_slug: string;
  organization_id: string;
  parent_resource_id?: string | null;
  parent_resource_external_id?: string | null;
  parent_resource_type_slug?: string | null;
}
interface UpdateAuthorizationResourceOptions {
  resourceId: string;
  name?: string;
  description?: string | null;
}
interface SerializedUpdateAuthorizationResourceOptions {
  name?: string;
  description?: string | null;
}
//#endregion
//#region src/authorization/interfaces/list-authorization-resources-options.interface.d.ts
interface ListAuthorizationResourcesOptions extends PaginationOptions {
  organizationId?: string;
  resourceTypeSlug?: string;
  parentResourceId?: string;
  parentResourceTypeSlug?: string;
  parentExternalId?: string;
}
interface SerializedListAuthorizationResourcesOptions extends PaginationOptions {
  organization_id?: string;
  resource_type_slug?: string;
  parent_resource_id?: string;
  parent_resource_type_slug?: string;
  parent_external_id?: string;
}
//#endregion
//#region src/authorization/interfaces/get-authorization-resource-by-external-id-options.interface.d.ts
interface GetAuthorizationResourceByExternalIdOptions {
  organizationId: string;
  resourceTypeSlug: string;
  externalId: string;
}
//#endregion
//#region src/authorization/interfaces/update-authorization-resource-by-external-id-options.interface.d.ts
interface UpdateAuthorizationResourceByExternalIdOptions {
  organizationId: string;
  resourceTypeSlug: string;
  externalId: string;
  name?: string;
  description?: string | null;
}
//#endregion
//#region src/authorization/interfaces/delete-authorization-resource-by-external-id-options.interface.d.ts
interface DeleteAuthorizationResourceByExternalIdOptions {
  organizationId: string;
  resourceTypeSlug: string;
  externalId: string;
  cascadeDelete?: boolean;
}
//#endregion
//#region src/authorization/interfaces/delete-authorization-resource-options.interface.d.ts
interface DeleteAuthorizationResourceOptions {
  resourceId: string;
  cascadeDelete?: boolean;
}
//#endregion
//#region src/authorization/interfaces/authorization-resource-identifier.interface.d.ts
interface AuthorizationResourceIdentifierById {
  resourceId: string;
}
interface AuthorizationResourceIdentifierByExternalId {
  resourceExternalId: string;
  resourceTypeSlug: string;
}
//#endregion
//#region src/authorization/interfaces/authorization-resource-check.interface.d.ts
interface AuthorizationCheckResult {
  authorized: boolean;
}
interface BaseAuthorizationCheckOptions {
  organizationMembershipId: string;
  permissionSlug: string;
}
interface AuthorizationCheckOptionsWithResourceId extends BaseAuthorizationCheckOptions, AuthorizationResourceIdentifierById {}
interface AuthorizationCheckOptionsWithResourceExternalId extends BaseAuthorizationCheckOptions, AuthorizationResourceIdentifierByExternalId {}
type AuthorizationCheckOptions = AuthorizationCheckOptionsWithResourceId | AuthorizationCheckOptionsWithResourceExternalId;
interface SerializedAuthorizationCheckOptions {
  permission_slug: string;
  resource_id?: string;
  resource_external_id?: string;
  resource_type_slug?: string;
}
//#endregion
//#region src/authorization/interfaces/list-resources-for-membership-options.interface.d.ts
interface BaseListResourcesForMembershipOptions extends PaginationOptions {
  organizationMembershipId: string;
  permissionSlug: string;
}
interface ListResourcesForMembershipOptionsWithParentId extends BaseListResourcesForMembershipOptions {
  parentResourceId: string;
}
interface ListResourcesForMembershipOptionsWithParentExternalId extends BaseListResourcesForMembershipOptions {
  parentResourceTypeSlug: string;
  parentResourceExternalId: string;
}
type ListResourcesForMembershipOptions = ListResourcesForMembershipOptionsWithParentId | ListResourcesForMembershipOptionsWithParentExternalId;
interface SerializedListResourcesForMembershipOptions extends PaginationOptions {
  permission_slug: string;
  parent_resource_id?: string;
  parent_resource_type_slug?: string;
  parent_resource_external_id?: string;
}
//#endregion
//#region src/authorization/interfaces/list-memberships-for-resource-options.interface.d.ts
interface ListMembershipsForResourceOptions extends PaginationOptions {
  resourceId: string;
  /** The permission slug to filter by. Only users with this permission on the resource are returned. */
  permissionSlug: string;
  /** Filter by assignment type. Use `direct` for direct assignments only, or `indirect` to include inherited assignments. */
  assignment?: 'direct' | 'indirect';
}
//#endregion
//#region src/authorization/interfaces/list-memberships-for-resource-by-external-id-options.interface.d.ts
interface ListMembershipsForResourceByExternalIdOptions extends PaginationOptions {
  organizationId: string;
  resourceTypeSlug: string;
  externalId: string;
  permissionSlug: string;
  assignment?: 'direct' | 'indirect';
}
//#endregion
//#region src/authorization/interfaces/role-assignment.interface.d.ts
interface RoleAssignmentRole {
  slug: string;
}
interface RoleAssignmentResource {
  id: string;
  externalId: string;
  resourceTypeSlug: string;
}
interface RoleAssignmentResourceResponse {
  id: string;
  external_id: string;
  resource_type_slug: string;
}
interface RoleAssignmentSource {
  /** Whether the role was assigned directly or derived from a group. */
  type: 'direct' | 'group';
  /** The ID of the group role assignment the role was derived from, or null if direct. */
  groupRoleAssignmentId: string | null;
}
interface RoleAssignmentSourceResponse {
  type: 'direct' | 'group';
  group_role_assignment_id: string | null;
}
interface RoleAssignment {
  /** Distinguishes the role assignment object. */
  object: 'role_assignment';
  /** Unique identifier of the role assignment. */
  id: string;
  /** The ID of the organization membership the role is assigned to. */
  organizationMembershipId: string;
  /** The role included in the assignment. */
  role: RoleAssignmentRole;
  /** The resource to which the role is assigned. */
  resource: RoleAssignmentResource;
  /** The origin of the role assignment. */
  source: RoleAssignmentSource;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface RoleAssignmentResponse {
  object: 'role_assignment';
  id: string;
  organization_membership_id: string;
  role: RoleAssignmentRole;
  resource: RoleAssignmentResourceResponse;
  source: RoleAssignmentSourceResponse;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/authorization/interfaces/list-role-assignments-options.interface.d.ts
interface ListRoleAssignmentsOptions extends PaginationOptions {
  organizationMembershipId: string;
  /** Filter role assignments to only those granted on the resource with this ID. */
  resourceId?: string;
  /** Filter role assignments to only those granted on the resource with this external ID. Can be used on its own or combined with `resourceTypeSlug`. */
  resourceExternalId?: string;
  /** Filter role assignments to only those granted on resources of this type. Can be used on its own or combined with `resourceExternalId`. */
  resourceTypeSlug?: string;
}
interface SerializedListRoleAssignmentsOptions extends PaginationOptions {
  resource_id?: string;
  resource_external_id?: string;
  resource_type_slug?: string;
}
//#endregion
//#region src/authorization/interfaces/list-role-assignments-for-resource-options.interface.d.ts
interface ListRoleAssignmentsForResourceOptions extends PaginationOptions {
  resourceId: string;
  /** Filter role assignments to only those that grant this role. */
  roleSlug?: string;
}
interface SerializedListRoleAssignmentsForResourceOptions extends PaginationOptions {
  role_slug?: string;
}
//#endregion
//#region src/authorization/interfaces/list-role-assignments-for-resource-by-external-id-options.interface.d.ts
interface ListRoleAssignmentsForResourceByExternalIdOptions extends PaginationOptions {
  organizationId: string;
  resourceTypeSlug: string;
  externalId: string;
  /** Filter role assignments to only those that grant this role. */
  roleSlug?: string;
}
//#endregion
//#region src/authorization/interfaces/assign-role-options.interface.d.ts
interface BaseAssignRoleOptions {
  organizationMembershipId: string;
  roleSlug: string;
}
interface AssignRoleOptionsWithResourceId extends BaseAssignRoleOptions, AuthorizationResourceIdentifierById {}
interface AssignRoleOptionsWithResourceExternalId extends BaseAssignRoleOptions, AuthorizationResourceIdentifierByExternalId {}
type AssignRoleOptions = AssignRoleOptionsWithResourceId | AssignRoleOptionsWithResourceExternalId;
interface SerializedAssignRoleOptions {
  role_slug: string;
  resource_id?: string;
  resource_external_id?: string;
  resource_type_slug?: string;
}
//#endregion
//#region src/authorization/interfaces/remove-role-options.interface.d.ts
interface BaseRemoveRoleOptions {
  organizationMembershipId: string;
  roleSlug: string;
}
interface RemoveRoleOptionsWithResourceId extends BaseRemoveRoleOptions, AuthorizationResourceIdentifierById {}
interface RemoveRoleOptionsWithResourceExternalId extends BaseRemoveRoleOptions, AuthorizationResourceIdentifierByExternalId {}
type RemoveRoleOptions = RemoveRoleOptionsWithResourceId | RemoveRoleOptionsWithResourceExternalId;
interface SerializedRemoveRoleOptions {
  role_slug: string;
  resource_id?: string;
  resource_external_id?: string;
  resource_type_slug?: string;
}
//#endregion
//#region src/authorization/interfaces/remove-role-assignment-options.interface.d.ts
interface RemoveRoleAssignmentOptions {
  organizationMembershipId: string;
  roleAssignmentId: string;
}
//#endregion
//#region src/authorization/interfaces/group-role-assignment.interface.d.ts
interface GroupRoleAssignment {
  /** Distinguishes the group role assignment object. */
  object: 'group_role_assignment';
  /** Unique identifier of the group role assignment. */
  id: string;
  /** The ID of the group the role is assigned to. */
  groupId: string;
  /** The role included in the assignment. */
  role: RoleAssignmentRole;
  /** The resource the role is assigned on. */
  resource: RoleAssignmentResource;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface GroupRoleAssignmentResponse {
  object: 'group_role_assignment';
  id: string;
  group_id: string;
  role: RoleAssignmentRole;
  resource: RoleAssignmentResourceResponse;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/authorization/interfaces/list-group-role-assignments-options.interface.d.ts
interface ListGroupRoleAssignmentsOptions extends PaginationOptions {
  /** The ID of the group. */
  groupId: string;
}
//#endregion
//#region src/authorization/interfaces/get-group-role-assignment-options.interface.d.ts
interface GetGroupRoleAssignmentOptions {
  /** The ID of the group. */
  groupId: string;
  /** The ID of the group role assignment. */
  roleAssignmentId: string;
}
//#endregion
//#region src/authorization/interfaces/create-group-role-assignment-options.interface.d.ts
interface BaseCreateGroupRoleAssignmentOptions {
  groupId: string;
  roleSlug: string;
}
type CreateGroupRoleAssignmentOptionsForOrganization = BaseCreateGroupRoleAssignmentOptions;
interface CreateGroupRoleAssignmentOptionsWithResourceId extends BaseCreateGroupRoleAssignmentOptions, AuthorizationResourceIdentifierById {}
interface CreateGroupRoleAssignmentOptionsWithResourceExternalId extends BaseCreateGroupRoleAssignmentOptions, AuthorizationResourceIdentifierByExternalId {}
/**
 * Omit the resource fields entirely to assign the role on the organization
 * itself. Otherwise provide either `resourceId` or both `resourceExternalId`
 * and `resourceTypeSlug`.
 */
type CreateGroupRoleAssignmentOptions = CreateGroupRoleAssignmentOptionsForOrganization | CreateGroupRoleAssignmentOptionsWithResourceId | CreateGroupRoleAssignmentOptionsWithResourceExternalId;
interface SerializedCreateGroupRoleAssignmentOptions {
  role_slug: string;
  resource_id?: string;
  resource_external_id?: string;
  resource_type_slug?: string;
}
//#endregion
//#region src/authorization/interfaces/remove-group-role-assignment-options.interface.d.ts
interface RemoveGroupRoleAssignmentOptions {
  /** The ID of the group. */
  groupId: string;
  /** The ID of the group role assignment to remove. */
  roleAssignmentId: string;
}
//#endregion
//#region src/authorization/interfaces/remove-group-role-assignments-options.interface.d.ts
interface BaseRemoveGroupRoleAssignmentsOptions {
  groupId: string;
  roleSlug: string;
}
type RemoveGroupRoleAssignmentsOptionsForOrganization = BaseRemoveGroupRoleAssignmentsOptions;
interface RemoveGroupRoleAssignmentsOptionsWithResourceId extends BaseRemoveGroupRoleAssignmentsOptions, AuthorizationResourceIdentifierById {}
interface RemoveGroupRoleAssignmentsOptionsWithResourceExternalId extends BaseRemoveGroupRoleAssignmentsOptions, AuthorizationResourceIdentifierByExternalId {}
/**
 * Omit the resource fields entirely to remove the role assignment on the
 * organization itself. Otherwise provide either `resourceId` or both
 * `resourceExternalId` and `resourceTypeSlug`.
 */
type RemoveGroupRoleAssignmentsOptions = RemoveGroupRoleAssignmentsOptionsForOrganization | RemoveGroupRoleAssignmentsOptionsWithResourceId | RemoveGroupRoleAssignmentsOptionsWithResourceExternalId;
interface SerializedRemoveGroupRoleAssignmentsOptions {
  role_slug: string;
  resource_id?: string;
  resource_external_id?: string;
  resource_type_slug?: string;
}
//#endregion
//#region src/authorization/interfaces/replace-group-role-assignments-options.interface.d.ts
interface BaseGroupRoleAssignmentEntry {
  roleSlug: string;
}
type GroupRoleAssignmentEntryForOrganization = BaseGroupRoleAssignmentEntry;
interface GroupRoleAssignmentEntryWithResourceId extends BaseGroupRoleAssignmentEntry, AuthorizationResourceIdentifierById {}
interface GroupRoleAssignmentEntryWithResourceExternalId extends BaseGroupRoleAssignmentEntry, AuthorizationResourceIdentifierByExternalId {}
/**
 * Omit the resource fields entirely to assign the role on the organization
 * itself. Otherwise provide either `resourceId` or both `resourceExternalId`
 * and `resourceTypeSlug`.
 */
type GroupRoleAssignmentEntry = GroupRoleAssignmentEntryForOrganization | GroupRoleAssignmentEntryWithResourceId | GroupRoleAssignmentEntryWithResourceExternalId;
interface ReplaceGroupRoleAssignmentsOptions {
  groupId: string;
  /**
   * The complete list of role assignments that should exist for the group.
   * Existing assignments absent from this list are removed; pass an empty
   * array to clear all assignments. At most 100 entries.
   */
  roleAssignments: GroupRoleAssignmentEntry[];
}
interface SerializedGroupRoleAssignmentEntry {
  role_slug: string;
  resource_id?: string;
  resource_external_id?: string;
  resource_type_slug?: string;
}
interface SerializedReplaceGroupRoleAssignmentsOptions {
  role_assignments: SerializedGroupRoleAssignmentEntry[];
}
//#endregion
//#region src/authorization/interfaces/list-effective-permissions-options.interface.d.ts
interface ListEffectivePermissionsOptions extends PaginationOptions {
  organizationMembershipId: string;
  resourceId: string;
}
//#endregion
//#region src/authorization/interfaces/list-effective-permissions-by-external-id-options.interface.d.ts
interface ListEffectivePermissionsByExternalIdOptions extends PaginationOptions {
  organizationMembershipId: string;
  resourceTypeSlug: string;
  externalId: string;
}
//#endregion
//#region src/roles/interfaces/role.interface.d.ts
interface RoleResponse {
  slug: string;
}
interface RoleEvent {
  object: 'role';
  slug: string;
  resourceTypeSlug: string;
  permissions: string[];
  createdAt: string;
  updatedAt: string;
}
interface RoleEventResponse {
  object: 'role';
  slug: string;
  resource_type_slug: string;
  permissions: string[];
  created_at: string;
  updated_at: string;
}
interface OrganizationRoleEventResponse {
  object: 'organization_role';
  organization_id: string;
  slug: string;
  name: string;
  description: string | null;
  resource_type_slug: string;
  permissions: string[];
  created_at: string;
  updated_at: string;
}
interface OrganizationRoleEvent {
  object: 'organization_role';
  organizationId: string;
  slug: string;
  name: string;
  description: string | null;
  resourceTypeSlug: string;
  permissions: string[];
  createdAt: string;
  updatedAt: string;
}
interface ListOrganizationRolesResponse {
  object: 'list';
  data: OrganizationRoleResponse[];
}
interface OrganizationRoleResponse {
  object: 'role';
  id: string;
  name: string;
  slug: string;
  description: string | null;
  permissions: string[];
  resource_type_slug: string;
  type: 'EnvironmentRole' | 'OrganizationRole';
  created_at: string;
  updated_at: string;
}
type Role = EnvironmentRole | OrganizationRole;
interface RoleList {
  object: 'list';
  data: Role[];
}
//#endregion
//#region src/directory-sync/interfaces/directory-user.interface.d.ts
type DefaultCustomAttributes = Record<string, unknown>;
interface DirectoryUser<TCustomAttributes extends object = DefaultCustomAttributes, TRawAttributes = any> {
  object: 'directory_user';
  id: string;
  directoryId: string;
  organizationId: string | null;
  rawAttributes: TRawAttributes;
  customAttributes: TCustomAttributes;
  idpId: string;
  firstName: string | null;
  email: string | null;
  lastName: string | null;
  state: 'active' | 'inactive';
  role?: RoleResponse;
  roles?: RoleResponse[];
  createdAt: string;
  updatedAt: string;
}
interface DirectoryUserResponse<TCustomAttributes extends object = DefaultCustomAttributes, TRawAttributes = any> {
  object: 'directory_user';
  id: string;
  directory_id: string;
  organization_id: string | null;
  raw_attributes: TRawAttributes;
  custom_attributes: TCustomAttributes;
  idp_id: string;
  first_name: string | null;
  email: string | null;
  last_name: string | null;
  state: 'active' | 'inactive';
  role?: RoleResponse;
  roles?: RoleResponse[];
  created_at: string;
  updated_at: string;
}
interface DirectoryUserWithGroups<TCustomAttributes extends object = DefaultCustomAttributes> extends DirectoryUser<TCustomAttributes> {
  groups: DirectoryGroup[];
}
interface DirectoryUserWithGroupsResponse<TCustomAttributes extends object = DefaultCustomAttributes> extends DirectoryUserResponse<TCustomAttributes> {
  groups: DirectoryGroupResponse[];
}
//#endregion
//#region src/sso/interfaces/authorization-url-options.interface.d.ts
/**
 * PKCE fields must be provided together or not at all.
 * Use workos.pkce.generate() to create a valid pair.
 */
type PKCEFields$1 = {
  codeChallenge?: never;
  codeChallengeMethod?: never;
} | {
  codeChallenge: string;
  codeChallengeMethod: 'S256';
};
interface SSOAuthorizationURLBaseFields {
  clientId: string;
  domainHint?: string;
  loginHint?: string;
  providerQueryParams?: Record<string, string | boolean | number>;
  providerScopes?: string[];
  redirectUri: string;
  state?: string;
}
/**
 * Result of getAuthorizationUrlWithPKCE() containing the URL,
 * state, and PKCE code verifier.
 *
 * The codeVerifier must be stored securely and passed to
 * getProfileAndToken() during token exchange.
 */
interface SSOPKCEAuthorizationURLResult {
  /** The complete authorization URL to redirect the user to */
  url: string;
  /** The state parameter (auto-generated) */
  state: string;
  /** The PKCE code verifier. Store securely and pass to getProfileAndToken(). */
  codeVerifier: string;
}
type SSOWithConnection = SSOAuthorizationURLBaseFields & PKCEFields$1 & {
  connection: string;
  organization?: never;
  provider?: never;
};
type SSOWithOrganization = SSOAuthorizationURLBaseFields & PKCEFields$1 & {
  organization: string;
  connection?: never;
  provider?: never;
};
type SSOWithProvider = SSOAuthorizationURLBaseFields & PKCEFields$1 & {
  provider: string;
  connection?: never;
  organization?: never;
};
type SSOAuthorizationURLOptions = SSOWithConnection | SSOWithOrganization | SSOWithProvider;
//#endregion
//#region src/sso/interfaces/connection-type.enum.d.ts
declare enum ConnectionType {
  ADFSSAML = "ADFSSAML",
  AdpOidc = "AdpOidc",
  AppleOAuth = "AppleOAuth",
  Auth0SAML = "Auth0SAML",
  AzureSAML = "AzureSAML",
  CasSAML = "CasSAML",
  CleverOIDC = "CleverOIDC",
  ClassLinkSAML = "ClassLinkSAML",
  CloudflareSAML = "CloudflareSAML",
  CyberArkSAML = "CyberArkSAML",
  DuoSAML = "DuoSAML",
  EntraIdOIDC = "EntraIdOIDC",
  GenericOIDC = "GenericOIDC",
  GenericSAML = "GenericSAML",
  GitHubOAuth = "GitHubOAuth",
  GoogleOAuth = "GoogleOAuth",
  GoogleSAML = "GoogleSAML",
  JumpCloudSAML = "JumpCloudSAML",
  KeycloakSAML = "KeycloakSAML",
  LastPassSAML = "LastPassSAML",
  LoginGovOidc = "LoginGovOidc",
  MagicLink = "MagicLink",
  MicrosoftOAuth = "MicrosoftOAuth",
  MiniOrangeSAML = "MiniOrangeSAML",
  NetIqSAML = "NetIqSAML",
  OktaOIDC = "OktaOIDC",
  OktaSAML = "OktaSAML",
  OneLoginSAML = "OneLoginSAML",
  OracleSAML = "OracleSAML",
  PingFederateSAML = "PingFederateSAML",
  PingOneSAML = "PingOneSAML",
  RipplingSAML = "RipplingSAML",
  SalesforceOAuth = "SalesforceOAuth",
  SalesforceSAML = "SalesforceSAML",
  ShibbolethGenericSAML = "ShibbolethGenericSAML",
  ShibbolethSAML = "ShibbolethSAML",
  SimpleSamlPhpSAML = "SimpleSamlPhpSAML",
  VMwareSAML = "VMwareSAML"
}
//#endregion
//#region src/sso/interfaces/connection.interface.d.ts
interface ConnectionDomain {
  object: 'connection_domain';
  id: string;
  domain: string;
}
interface Connection {
  /** Distinguishes the Connection object. */
  object: 'connection';
  /** Unique identifier for the Connection. */
  id: string;
  /** Unique identifier for the Organization in which the Connection resides. */
  organizationId?: string;
  /** A human-readable name for the Connection. This will most commonly be the organization's name. */
  name: string;
  /** Indicates whether a Connection is able to authenticate users. */
  state: 'draft' | 'active' | 'inactive' | 'validating';
  /** List of Organization Domains. */
  domains: ConnectionDomain[];
  type: ConnectionType;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface ConnectionResponse {
  object: 'connection';
  id: string;
  organization_id?: string;
  name: string;
  connection_type: ConnectionType;
  state: 'draft' | 'active' | 'inactive' | 'validating';
  domains: ConnectionDomain[];
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/sso/interfaces/get-profile-options.interface.d.ts
interface GetProfileOptions {
  accessToken: string;
}
//#endregion
//#region src/sso/interfaces/get-profile-and-token-options.interface.d.ts
interface GetProfileAndTokenOptions {
  clientId: string;
  code: string;
  /**
   * PKCE code verifier for public clients.
   * Pass the codeVerifier that was generated with getAuthorizationUrlWithPKCE().
   * When provided, client_secret is not sent (public client mode).
   */
  codeVerifier?: string;
}
//#endregion
//#region src/sso/interfaces/list-connections-options.interface.d.ts
interface ListConnectionsOptions extends PaginationOptions {
  /** Filter Connections by their type. */
  connectionType?: ConnectionType;
  /** Filter Connections by their associated domain. */
  domain?: string;
  /** Filter Connections by their associated organization. */
  organizationId?: string;
}
interface SerializedListConnectionsOptions extends PaginationOptions {
  connection_type?: ConnectionType;
  domain?: string;
  organization_id?: string;
}
//#endregion
//#region src/common/interfaces/unknown-record.interface.d.ts
type UnknownRecord = Record<string, unknown>;
//#endregion
//#region src/user-management/interfaces/oauth-tokens.interface.d.ts
interface OauthTokens {
  accessToken: string;
  refreshToken: string;
  expiresAt: number;
  scopes: string[];
}
interface OauthTokensResponse {
  access_token: string;
  refresh_token: string;
  expires_at: number;
  scopes: string[];
}
//#endregion
//#region src/sso/interfaces/profile.interface.d.ts
interface Profile<CustomAttributesType extends UnknownRecord> {
  /** Unique identifier of the profile. */
  id: string;
  /** The user's unique identifier from the identity provider. */
  idpId: string;
  /** The ID of the organization the user belongs to. */
  organizationId?: string;
  /** The ID of the SSO connection used for authentication. */
  connectionId: string;
  /** The type of SSO connection. */
  connectionType: ConnectionType;
  /** The user's email address. */
  email: string;
  /** The user's full name. */
  name?: string;
  /** The user's first name. */
  firstName?: string;
  /** The user's last name. */
  lastName?: string;
  /** The role assigned to the user within the organization, if applicable. */
  role?: RoleResponse;
  /** The roles assigned to the user within the organization, if applicable. */
  roles?: RoleResponse[];
  /** The groups the user belongs to, as returned by the identity provider. */
  groups?: string[];
  /** Custom attribute mappings defined for the connection, returned as key-value pairs. */
  customAttributes?: CustomAttributesType;
  /** The complete set of raw attributes returned by the identity provider. */
  rawAttributes?: {
    [key: string]: any;
  };
}
interface ProfileResponse<CustomAttributesType extends UnknownRecord> {
  id: string;
  idp_id: string;
  organization_id?: string;
  connection_id: string;
  connection_type: ConnectionType;
  email: string;
  name?: string;
  first_name?: string;
  last_name?: string;
  role?: RoleResponse;
  roles?: RoleResponse[];
  groups?: string[];
  custom_attributes?: CustomAttributesType;
  raw_attributes?: {
    [key: string]: any;
  };
}
//#endregion
//#region src/sso/interfaces/profile-and-token.interface.d.ts
interface ProfileAndToken<CustomAttributesType extends UnknownRecord> {
  accessToken: string;
  profile: Profile<CustomAttributesType>;
  oauthTokens?: OauthTokens;
}
interface ProfileAndTokenResponse<CustomAttributesType extends UnknownRecord> {
  access_token: string;
  profile: ProfileResponse<CustomAttributesType>;
  oauth_tokens?: OauthTokensResponse;
}
//#endregion
//#region src/user-management/interfaces/authenticate-with-options-base.interface.d.ts
interface AuthenticateWithSessionOptions {
  cookiePassword?: string;
  sealSession: boolean;
}
interface AuthenticateWithOptionsBase {
  clientId?: string;
  ipAddress?: string;
  userAgent?: string;
  session?: AuthenticateWithSessionOptions;
}
interface SerializedAuthenticateWithOptionsBase {
  client_id: string;
  client_secret: string | undefined;
  ip_address?: string;
  user_agent?: string;
}
/** Base for serialized auth options that don't require client_secret (public clients) */
interface SerializedAuthenticatePublicClientBase {
  client_id: string;
  ip_address?: string;
  user_agent?: string;
}
/**
 * Utility type for serializer input signatures.
 *
 * Since `clientId` is optional in user-facing interfaces (allowing fallback to
 * the constructor-provided value), but serializers require a resolved string,
 * this type overrides the optional `clientId` with a required one.
 *
 * Usage in serializers:
 * ```
 * const serialize = (options: WithResolvedClientId<SomeOptions>) => ...
 * ```
 */
type WithResolvedClientId<T> = Omit<T, 'clientId'> & {
  clientId: string;
};
//#endregion
//#region src/user-management/interfaces/authenticate-with-code-options.interface.d.ts
interface AuthenticateWithCodeOptions extends AuthenticateWithOptionsBase {
  codeVerifier?: string;
  code: string;
  invitationToken?: string;
  signalsId?: string;
}
interface AuthenticateUserWithCodeCredentials {
  clientSecret: string | undefined;
}
interface SerializedAuthenticateWithCodeOptions extends SerializedAuthenticateWithOptionsBase {
  grant_type: 'authorization_code';
  code_verifier?: string;
  code: string;
  invitation_token?: string;
  signals_id?: string;
}
//#endregion
//#region src/user-management/interfaces/authenticate-with-code-and-verifier-options.interface.d.ts
interface AuthenticateWithCodeAndVerifierOptions extends AuthenticateWithOptionsBase {
  codeVerifier: string;
  code: string;
  invitationToken?: string;
  signalsId?: string;
}
interface SerializedAuthenticateWithCodeAndVerifierOptions extends SerializedAuthenticatePublicClientBase {
  grant_type: 'authorization_code';
  code_verifier: string;
  code: string;
  invitation_token?: string;
  signals_id?: string;
}
//#endregion
//#region src/user-management/interfaces/authenticate-with-email-verification-options.interface.d.ts
interface AuthenticateWithEmailVerificationOptions extends AuthenticateWithOptionsBase {
  code: string;
  pendingAuthenticationToken: string;
}
interface AuthenticateUserWithEmailVerificationCredentials {
  clientSecret: string | undefined;
}
interface SerializedAuthenticateWithEmailVerificationOptions extends SerializedAuthenticateWithOptionsBase {
  grant_type: 'urn:workos:oauth:grant-type:email-verification:code';
  code: string;
  pending_authentication_token: string;
}
//#endregion
//#region src/user-management/interfaces/authenticate-with-magic-auth-options.interface.d.ts
interface AuthenticateWithMagicAuthOptions extends AuthenticateWithOptionsBase {
  code: string;
  email: string;
  invitationToken?: string;
  linkAuthorizationCode?: string;
  radarAuthAttemptId?: string;
  signalsId?: string;
}
interface AuthenticateUserWithMagicAuthCredentials {
  clientSecret: string | undefined;
}
interface SerializedAuthenticateWithMagicAuthOptions extends SerializedAuthenticateWithOptionsBase {
  grant_type: 'urn:workos:oauth:grant-type:magic-auth:code';
  code: string;
  email: string;
  invitation_token?: string;
  link_authorization_code?: string;
  radar_auth_attempt_id?: string;
  signals_id?: string;
}
//#endregion
//#region src/user-management/interfaces/authenticate-with-radar-email-challenge-options.interface.d.ts
interface AuthenticateWithRadarEmailChallengeOptions extends AuthenticateWithOptionsBase {
  code: string;
  radarChallengeId: string;
  pendingAuthenticationToken: string;
}
interface AuthenticateUserWithRadarEmailChallengeCredentials {
  clientSecret: string | undefined;
}
interface SerializedAuthenticateWithRadarEmailChallengeOptions extends SerializedAuthenticateWithOptionsBase {
  grant_type: 'urn:workos:oauth:grant-type:radar-email-challenge:code';
  code: string;
  radar_challenge_id: string;
  pending_authentication_token: string;
}
//#endregion
//#region src/user-management/interfaces/authenticate-with-radar-sms-challenge-options.interface.d.ts
interface AuthenticateWithRadarSmsChallengeOptions extends AuthenticateWithOptionsBase {
  code: string;
  verificationId: string;
  phoneNumber: string;
  pendingAuthenticationToken: string;
}
interface AuthenticateUserWithRadarSmsChallengeCredentials {
  clientSecret: string | undefined;
}
interface SerializedAuthenticateWithRadarSmsChallengeOptions extends SerializedAuthenticateWithOptionsBase {
  grant_type: 'urn:workos:oauth:grant-type:radar-sms-challenge:code';
  code: string;
  verification_id: string;
  phone_number: string;
  pending_authentication_token: string;
}
//#endregion
//#region src/user-management/interfaces/authenticate-with-organization-selection.interface.d.ts
interface AuthenticateWithOrganizationSelectionOptions extends AuthenticateWithOptionsBase {
  organizationId: string;
  pendingAuthenticationToken: string;
}
interface AuthenticateUserWithOrganizationSelectionCredentials {
  clientSecret: string | undefined;
}
interface SerializedAuthenticateWithOrganizationSelectionOptions extends SerializedAuthenticateWithOptionsBase {
  grant_type: 'urn:workos:oauth:grant-type:organization-selection';
  organization_id: string;
  pending_authentication_token: string;
}
//#endregion
//#region src/user-management/interfaces/authenticate-with-password-options.interface.d.ts
interface AuthenticateWithPasswordOptions extends AuthenticateWithOptionsBase {
  email: string;
  password: string;
  invitationToken?: string;
  radarAuthAttemptId?: string;
  signalsId?: string;
}
interface AuthenticateUserWithPasswordCredentials {
  clientSecret: string | undefined;
}
interface SerializedAuthenticateWithPasswordOptions extends SerializedAuthenticateWithOptionsBase {
  grant_type: 'password';
  email: string;
  password: string;
  invitation_token?: string;
  radar_auth_attempt_id?: string;
  signals_id?: string;
}
//#endregion
//#region src/user-management/interfaces/authenticate-with-refresh-token-options.interface.d.ts
interface AuthenticateWithRefreshTokenOptions extends AuthenticateWithOptionsBase {
  refreshToken: string;
  organizationId?: string;
}
interface AuthenticateUserWithRefreshTokenCredentials {
  clientSecret: string | undefined;
}
interface SerializedAuthenticateWithRefreshTokenOptions extends SerializedAuthenticateWithOptionsBase {
  grant_type: 'refresh_token';
  refresh_token: string;
  organization_id: string | undefined;
}
//#endregion
//#region src/user-management/interfaces/authenticate-with-refresh-token-public-client-options.interface.d.ts
/** Options for refreshing tokens as a public client (no client_secret required) */
interface AuthenticateWithRefreshTokenPublicClientOptions extends AuthenticateWithOptionsBase {
  refreshToken: string;
  organizationId?: string;
}
interface SerializedAuthenticateWithRefreshTokenPublicClientOptions extends SerializedAuthenticatePublicClientBase {
  grant_type: 'refresh_token';
  refresh_token: string;
  organization_id: string | undefined;
}
//#endregion
//#region src/user-management/interfaces/impersonator.interface.d.ts
interface Impersonator {
  email: string;
  reason: string | null;
}
interface ImpersonatorResponse {
  email: string;
  reason: string | null;
}
//#endregion
//#region src/user-management/interfaces/user.interface.d.ts
/** The user object. */
interface User {
  /** Distinguishes the user object. */
  object: 'user';
  /** The unique ID of the user. */
  id: string;
  /** The email address of the user. */
  email: string;
  /** Whether the user's email has been verified. */
  emailVerified: boolean;
  /** A URL reference to an image representing the user. */
  profilePictureUrl: string | null;
  /** The full name of the user. */
  name: string | null;
  /** The first name of the user. */
  firstName: string | null;
  /** The last name of the user. */
  lastName: string | null;
  /** The timestamp when the user last signed in. */
  lastSignInAt: string | null;
  /** The user's preferred locale. */
  locale: string | null;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
  /** The external ID of the user. */
  externalId: string | null;
  /** Object containing metadata key/value pairs associated with the user. */
  metadata: Record<string, string>;
}
interface UserResponse {
  object: 'user';
  id: string;
  email: string;
  email_verified: boolean;
  profile_picture_url: string | null;
  name: string | null;
  first_name: string | null;
  last_name: string | null;
  last_sign_in_at: string | null;
  locale: string | null;
  created_at: string;
  updated_at: string;
  external_id?: string;
  metadata?: Record<string, string>;
}
interface CreateUserResponse extends User {
  radarAuthAttemptId?: string;
}
interface CreateUserResponseResponse extends UserResponse {
  radar_auth_attempt_id?: string;
}
//#endregion
//#region src/user-management/interfaces/authentication-response.interface.d.ts
type AuthenticationMethod = 'SSO' | 'Password' | 'Passkey' | 'AppleOAuth' | 'BitbucketOAuth' | 'DiscordOAuth' | 'GitHubOAuth' | 'GitLabOAuth' | 'GoogleOAuth' | 'IntuitOAuth' | 'LinkedInOAuth' | 'MicrosoftOAuth' | 'SalesforceOAuth' | 'SlackOAuth' | 'VercelMarketplaceOAuth' | 'VercelOAuth' | 'XeroOAuth' | 'MagicAuth' | 'CrossAppAuth' | 'ExternalAuth' | 'MigratedSession' | 'Impersonation';
interface AuthenticationResponse {
  user: User;
  organizationId?: string;
  accessToken: string;
  refreshToken: string;
  impersonator?: Impersonator;
  authenticationMethod?: AuthenticationMethod;
  sealedSession?: string;
  oauthTokens?: OauthTokens;
}
interface AuthenticationResponseResponse {
  user: UserResponse;
  organization_id?: string;
  access_token: string;
  refresh_token: string;
  impersonator?: ImpersonatorResponse;
  authentication_method?: AuthenticationMethod;
  oauth_tokens?: OauthTokensResponse;
}
//#endregion
//#region src/user-management/interfaces/authenticate-with-session-cookie.interface.d.ts
interface AuthenticateWithSessionCookieOptions {
  sessionData: string;
  cookiePassword?: string;
}
interface UserManagementAccessToken {
  sid: string;
  org_id?: string;
  role?: string;
  roles?: string[];
  permissions?: string[];
  entitlements?: string[];
  feature_flags?: string[];
}
type SessionCookieData = Pick<AuthenticationResponse, 'accessToken' | 'authenticationMethod' | 'impersonator' | 'organizationId' | 'refreshToken' | 'user'>;
declare enum AuthenticateWithSessionCookieFailureReason {
  INVALID_JWT = "invalid_jwt",
  INVALID_SESSION_COOKIE = "invalid_session_cookie",
  NO_SESSION_COOKIE_PROVIDED = "no_session_cookie_provided"
}
type AuthenticateWithSessionCookieFailedResponse = {
  authenticated: false;
  reason: AuthenticateWithSessionCookieFailureReason;
};
type AuthenticateWithSessionCookieSuccessResponse = {
  authenticated: true;
  accessToken: string;
  authenticationMethod: AuthenticationResponse['authenticationMethod'];
  sessionId: string;
  organizationId?: string;
  role?: string;
  roles?: string[];
  permissions?: string[];
  entitlements?: string[];
  featureFlags?: string[];
  user: User;
  impersonator?: Impersonator;
};
//#endregion
//#region src/user-management/interfaces/authenticate-with-totp-options.interface.d.ts
interface AuthenticateWithTotpOptions extends AuthenticateWithOptionsBase {
  code: string;
  pendingAuthenticationToken: string;
  authenticationChallengeId: string;
}
interface AuthenticateUserWithTotpCredentials {
  clientSecret: string | undefined;
}
interface SerializedAuthenticateWithTotpOptions extends SerializedAuthenticateWithOptionsBase {
  grant_type: 'urn:workos:oauth:grant-type:mfa-totp';
  code: string;
  pending_authentication_token: string;
  authentication_challenge_id: string;
}
//#endregion
//#region src/user-management/interfaces/authentication-event.interface.d.ts
interface AuthenticationEventError {
  code: string;
  message: string;
}
interface AuthenticationEventSso {
  connectionId: string;
  organizationId: string;
  sessionId?: string;
}
interface AuthenticationEventSsoResponse {
  connection_id: string;
  organization_id: string;
  session_id?: string;
}
type AuthenticationEventType = 'sso' | 'password' | 'oauth' | 'mfa' | 'magic_auth' | 'email_verification';
type AuthenticationEventStatus = 'failed' | 'succeeded';
type AuthenticationEvent = {
  email: string | null;
  error?: AuthenticationEventError;
  ipAddress: string | null;
  sso?: AuthenticationEventSso;
  status: AuthenticationEventStatus;
  type: AuthenticationEventType;
  userAgent: string | null;
  userId: string | null;
};
interface AuthenticationEventResponse {
  email: string | null;
  error?: AuthenticationEventError;
  ip_address: string | null;
  sso?: AuthenticationEventSsoResponse;
  status: AuthenticationEventStatus;
  type: AuthenticationEventType;
  user_agent: string | null;
  user_id: string | null;
}
//#endregion
//#region src/multi-factor-auth/interfaces/sms.interface.d.ts
interface Sms {
  phoneNumber: string;
}
interface SmsResponse {
  phone_number: string;
}
//#endregion
//#region src/multi-factor-auth/interfaces/totp.interface.d.ts
interface Totp {
  issuer: string;
  user: string;
}
interface TotpWithSecrets extends Totp {
  qrCode: string;
  secret: string;
  uri: string;
}
interface TotpResponse {
  issuer: string;
  user: string;
}
interface TotpWithSecretsResponse extends TotpResponse {
  qr_code: string;
  secret: string;
  uri: string;
}
//#endregion
//#region src/multi-factor-auth/interfaces/factor.interface.d.ts
type FactorType = 'sms' | 'totp' | 'generic_otp';
interface Factor {
  object: 'authentication_factor';
  id: string;
  createdAt: string;
  updatedAt: string;
  type: FactorType;
  sms?: Sms;
  totp?: Totp;
}
interface FactorWithSecrets {
  object: 'authentication_factor';
  id: string;
  createdAt: string;
  updatedAt: string;
  type: FactorType;
  sms?: Sms;
  totp?: TotpWithSecrets;
}
interface FactorResponse {
  object: 'authentication_factor';
  id: string;
  created_at: string;
  updated_at: string;
  type: FactorType;
  sms?: SmsResponse;
  totp?: TotpResponse;
}
interface FactorWithSecretsResponse {
  object: 'authentication_factor';
  id: string;
  created_at: string;
  updated_at: string;
  type: FactorType;
  sms?: SmsResponse;
  totp?: TotpWithSecretsResponse;
}
//#endregion
//#region src/user-management/interfaces/authentication-factor.interface.d.ts
type AuthenticationFactorType = FactorType;
interface AuthenticationFactor {
  object: 'authentication_factor';
  id: string;
  createdAt: string;
  updatedAt: string;
  type: AuthenticationFactorType;
  sms?: Sms;
  totp?: Totp;
  userId: string;
}
interface AuthenticationFactorWithSecrets {
  object: 'authentication_factor';
  id: string;
  createdAt: string;
  updatedAt: string;
  type: 'totp';
  totp: TotpWithSecrets;
  userId: string;
}
interface AuthenticationFactorResponse {
  object: 'authentication_factor';
  id: string;
  created_at: string;
  updated_at: string;
  type: AuthenticationFactorType;
  sms?: SmsResponse;
  totp?: TotpResponse;
  user_id: string;
}
interface AuthenticationFactorWithSecretsResponse {
  object: 'authentication_factor';
  id: string;
  created_at: string;
  updated_at: string;
  type: 'totp';
  totp: TotpWithSecretsResponse;
  user_id: string;
}
//#endregion
//#region src/user-management/interfaces/authentication-radar-risk-detected-event.interface.d.ts
type AuthenticationRadarRiskDetectedEventData = {
  authMethod: string;
  action: 'signup' | 'login';
  control: string | null;
  blocklistType: string | null;
  ipAddress: string | null;
  userAgent: string | null;
  userId: string;
  email: string;
};
interface AuthenticationRadarRiskDetectedEventResponseData {
  auth_method: string;
  action: 'signup' | 'login';
  control: string | null;
  blocklist_type: string | null;
  ip_address: string | null;
  user_agent: string | null;
  user_id: string;
  email: string;
}
//#endregion
//#region src/user-management/interfaces/authorization-url-options.interface.d.ts
/**
 * PKCE fields must be provided together or not at all.
 * Use workos.pkce.generate() to create a valid pair.
 */
type PKCEFields = {
  codeChallenge?: never;
  codeChallengeMethod?: never;
} | {
  codeChallenge: string;
  codeChallengeMethod: 'S256';
};
interface UserManagementAuthorizationURLBaseOptions {
  claimNonce?: string;
  clientId?: string;
  connectionId?: string;
  organizationId?: string;
  domainHint?: string;
  invitationToken?: string;
  loginHint?: string;
  /**
   * Maximum allowable elapsed time, in seconds, since the user last actively authenticated.
   */
  maxAge?: number;
  provider?: string;
  providerQueryParams?: Record<string, string | boolean | number>;
  providerScopes?: string[];
  prompt?: string;
  redirectUri: string;
  state?: string;
  screenHint?: 'sign-up' | 'sign-in';
}
type UserManagementAuthorizationURLOptions = UserManagementAuthorizationURLBaseOptions & PKCEFields;
/**
 * Result of getAuthorizationUrlWithPKCE() containing the URL,
 * state, and PKCE code verifier.
 *
 * The codeVerifier must be stored securely and passed to
 * authenticateWithCode() during token exchange.
 */
interface PKCEAuthorizationURLResult {
  /** The complete authorization URL to redirect the user to */
  url: string;
  /** The state parameter (auto-generated) */
  state: string;
  /** The PKCE code verifier. Store securely and pass to authenticateWithCode(). */
  codeVerifier: string;
}
//#endregion
//#region src/user-management/interfaces/create-magic-auth-options.interface.d.ts
interface CreateMagicAuthOptions {
  email: string;
  invitationToken?: string;
  ipAddress?: string;
  userAgent?: string;
  radarAuthAttemptId?: string;
  signalsId?: string;
}
interface SerializedCreateMagicAuthOptions {
  email: string;
  invitation_token?: string;
  ip_address?: string;
  user_agent?: string;
  radar_auth_attempt_id?: string;
  signals_id?: string;
}
//#endregion
//#region src/user-management/interfaces/create-organization-membership-options.interface.d.ts
interface CreateOrganizationMembershipOptions {
  organizationId: string;
  userId: string;
  roleSlug?: string;
  roleSlugs?: string[];
}
interface SerializedCreateOrganizationMembershipOptions {
  organization_id: string;
  user_id: string;
  role_slug?: string;
  role_slugs?: string[];
}
//#endregion
//#region src/user-management/interfaces/create-password-reset-options.interface.d.ts
interface CreatePasswordResetOptions {
  email: string;
}
interface SerializedCreatePasswordResetOptions {
  email: string;
}
//#endregion
//#region src/user-management/interfaces/create-user-api-key-options.interface.d.ts
interface CreateUserApiKeyOptions {
  name: string;
  organizationId: string;
  permissions?: string[];
  expiresAt?: Date;
}
interface SerializedCreateUserApiKeyOptions {
  name: string;
  organization_id: string;
  permissions?: string[];
  expires_at?: string;
}
interface CreateUserApiKeyRequestOptions extends Pick<PostOptions, 'idempotencyKey'> {}
//#endregion
//#region src/user-management/interfaces/password-hash-type.interface.d.ts
type PasswordHashType = 'bcrypt' | 'firebase-scrypt' | 'ssha' | 'scrypt' | 'argon2';
//#endregion
//#region src/user-management/interfaces/create-user-options.interface.d.ts
interface CreateUserOptions {
  email: string;
  password?: string;
  passwordHash?: string;
  passwordHashType?: PasswordHashType;
  name?: string;
  firstName?: string;
  lastName?: string;
  emailVerified?: boolean;
  externalId?: string;
  metadata?: Record<string, string>;
  ipAddress?: string;
  userAgent?: string;
  signalsId?: string;
}
interface SerializedCreateUserOptions {
  email: string;
  password?: string;
  password_hash?: string;
  password_hash_type?: PasswordHashType;
  name?: string;
  first_name?: string;
  last_name?: string;
  email_verified?: boolean;
  external_id?: string;
  metadata?: Record<string, string>;
  ip_address?: string;
  user_agent?: string;
  signals_id?: string;
}
//#endregion
//#region src/user-management/interfaces/email-verification.interface.d.ts
interface EmailVerification {
  /** Distinguishes the email verification object. */
  object: 'email_verification';
  /** The unique ID of the email verification code. */
  id: string;
  /** The unique ID of the user. */
  userId: string;
  /** The email address of the user. */
  email: string;
  /** The timestamp when the email verification code expires. */
  expiresAt: string;
  /** The code used to verify the email. */
  code: string;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface EmailVerificationEvent {
  object: 'email_verification';
  id: string;
  userId: string;
  email: string;
  expiresAt: string;
  createdAt: string;
  updatedAt: string;
}
interface EmailVerificationResponse {
  object: 'email_verification';
  id: string;
  user_id: string;
  email: string;
  expires_at: string;
  code: string;
  created_at: string;
  updated_at: string;
}
interface EmailVerificationEventResponse {
  object: 'email_verification';
  id: string;
  user_id: string;
  email: string;
  expires_at: string;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/user-management/interfaces/enroll-auth-factor.interface.d.ts
interface EnrollAuthFactorOptions {
  userId: string;
  type: 'totp';
  totpIssuer?: string;
  totpUser?: string;
  totpSecret?: string;
}
interface SerializedEnrollUserInMfaFactorOptions {
  type: 'totp';
  totp_issuer?: string;
  totp_user?: string;
  totp_secret?: string;
}
//#endregion
//#region src/user-management/interfaces/identity.interface.d.ts
interface Identity {
  idpId: string;
  type: 'OAuth';
  provider: 'AppleOAuth' | 'GoogleOAuth' | 'GitHubOAuth' | 'MicrosoftOAuth' | 'SalesforceOAuth';
}
//#endregion
//#region src/user-management/interfaces/invitation.interface.d.ts
interface Invitation {
  /** Distinguishes the invitation object. */
  object: 'invitation';
  /** The unique ID of the invitation. */
  id: string;
  /** The email address of the recipient. */
  email: string;
  /** The state of the invitation. */
  state: 'pending' | 'accepted' | 'expired' | 'revoked';
  /** The timestamp when the invitation was accepted, or null if not yet accepted. */
  acceptedAt: string | null;
  /** The timestamp when the invitation was revoked, or null if not revoked. */
  revokedAt: string | null;
  /** The timestamp when the invitation expires. */
  expiresAt: string;
  /** The ID of the [organization](https://workos.com/docs/reference/organization) that the recipient will join. */
  organizationId: string | null;
  /** The ID of the user who invited the recipient, if provided. */
  inviterUserId: string | null;
  /** The ID of the user who accepted the invitation, once accepted. */
  acceptedUserId: string | null;
  /** Slug of the role the invitee will be assigned on acceptance. Reflects the current role on the pending organization membership, which may change before acceptance. null when the invitation has no associated organization. */
  roleSlug: string | null;
  /** The token used to accept the invitation. */
  token: string;
  /** The URL where the recipient can accept the invitation. */
  acceptInvitationUrl: string;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface InvitationEvent {
  object: 'invitation';
  id: string;
  email: string;
  state: 'pending' | 'accepted' | 'expired' | 'revoked';
  acceptedAt: string | null;
  revokedAt: string | null;
  expiresAt: string;
  organizationId: string | null;
  inviterUserId: string | null;
  acceptedUserId: string | null;
  roleSlug: string | null;
  createdAt: string;
  updatedAt: string;
}
interface InvitationResponse {
  object: 'invitation';
  id: string;
  email: string;
  state: 'pending' | 'accepted' | 'expired' | 'revoked';
  accepted_at: string | null;
  revoked_at: string | null;
  expires_at: string;
  organization_id: string | null;
  inviter_user_id: string | null;
  accepted_user_id: string | null;
  role_slug: string | null;
  token: string;
  accept_invitation_url: string;
  created_at: string;
  updated_at: string;
}
interface InvitationEventResponse {
  object: 'invitation';
  id: string;
  email: string;
  state: 'pending' | 'accepted' | 'expired' | 'revoked';
  accepted_at: string | null;
  revoked_at: string | null;
  expires_at: string;
  organization_id: string | null;
  inviter_user_id: string | null;
  accepted_user_id: string | null;
  role_slug: string | null;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/user-management/interfaces/list-auth-factors-options.interface.d.ts
interface ListAuthFactorsOptions extends PaginationOptions {
  userId: string;
}
//#endregion
//#region src/user-management/interfaces/list-groups-for-organization-membership-options.interface.d.ts
interface ListGroupsForOrganizationMembershipOptions extends PaginationOptions {
  organizationMembershipId: string;
}
//#endregion
//#region src/user-management/interfaces/list-invitations-options.interface.d.ts
interface ListInvitationsOptions extends PaginationOptions {
  /** The ID of the [organization](https://workos.com/docs/reference/organization) that the recipient will join. */
  organizationId?: string;
  /** The email address of the recipient. */
  email?: string;
}
interface SerializedListInvitationsOptions extends PaginationOptions {
  organization_id?: string;
  email?: string;
}
//#endregion
//#region src/user-management/interfaces/organization-membership.interface.d.ts
type OrganizationMembershipStatus = 'active' | 'inactive' | 'pending';
interface BaseOrganizationMembership {
  object: 'organization_membership';
  id: string;
  organizationId: string;
  status: OrganizationMembershipStatus;
  userId: string;
  directoryManaged: boolean;
  createdAt: string;
  updatedAt: string;
  customAttributes: Record<string, unknown>;
}
interface OrganizationMembership extends BaseOrganizationMembership {
  /** The name of the organization which the user belongs to. */
  organizationName: string;
  /** The primary role assigned to the user within the organization. */
  role: RoleResponse;
  roles?: RoleResponse[];
}
type AuthorizationOrganizationMembership = BaseOrganizationMembership;
interface BaseOrganizationMembershipResponse {
  object: 'organization_membership';
  id: string;
  organization_id: string;
  organization_name: string;
  status: OrganizationMembershipStatus;
  user_id: string;
  directory_managed?: boolean;
  created_at: string;
  updated_at: string;
  custom_attributes?: Record<string, unknown>;
}
interface OrganizationMembershipResponse extends BaseOrganizationMembershipResponse {
  role: RoleResponse;
  roles?: RoleResponse[];
}
type AuthorizationOrganizationMembershipResponse = BaseOrganizationMembershipResponse;
//#endregion
//#region src/user-management/interfaces/list-organization-memberships-options.interface.d.ts
type ListOrganizationMembershipsOptions = PaginationOptions & {
  statuses?: OrganizationMembershipStatus[];
} & ({
  organizationId: string;
  userId?: string;
} | {
  organizationId?: string;
  userId: string;
});
interface SerializedListOrganizationMembershipsOptions extends PaginationOptions {
  organization_id?: string;
  user_id?: string;
  statuses?: string;
}
//#endregion
//#region src/user-management/interfaces/list-sessions-options.interface.d.ts
interface ListSessionsOptions extends PaginationOptions {}
interface SerializedListSessionsOptions extends PaginationOptions {}
//#endregion
//#region src/user-management/interfaces/list-user-feature-flags-options.interface.d.ts
interface ListUserFeatureFlagsOptions extends PaginationOptions {
  userId: string;
}
//#endregion
//#region src/user-management/interfaces/list-user-api-keys-options.interface.d.ts
interface ListUserApiKeysOptions extends PaginationOptions {
  organizationId?: string;
}
interface SerializedListUserApiKeysOptions extends PaginationOptions {
  organization_id?: string;
}
//#endregion
//#region src/user-management/interfaces/list-users-options.interface.d.ts
interface ListUsersOptions extends PaginationOptions {
  /** Filter users by their email address. */
  email?: string;
  /** Filter users by the organization they are a member of. */
  organizationId?: string;
}
interface SerializedListUsersOptions extends PaginationOptions {
  email?: string;
  organization_id?: string;
}
//#endregion
//#region src/user-management/interfaces/locale.interface.d.ts
type Locale = 'af' | 'am' | 'ar' | 'bg' | 'bn' | 'bs' | 'ca' | 'cs' | 'da' | 'de' | 'de-DE' | 'el' | 'en' | 'en-AU' | 'en-CA' | 'en-GB' | 'en-US' | 'es' | 'es-419' | 'es-ES' | 'es-US' | 'et' | 'fa' | 'fi' | 'fil' | 'fr' | 'fr-BE' | 'fr-CA' | 'fr-FR' | 'fy' | 'gl' | 'gu' | 'ha' | 'he' | 'hi' | 'hr' | 'hu' | 'hy' | 'id' | 'is' | 'it' | 'it-IT' | 'ja' | 'jv' | 'ka' | 'kk' | 'km' | 'kn' | 'ko' | 'lt' | 'lv' | 'mk' | 'ml' | 'mn' | 'mr' | 'ms' | 'my' | 'nb' | 'ne' | 'nl' | 'nl-BE' | 'nl-NL' | 'nn' | 'no' | 'pa' | 'pl' | 'pt' | 'pt-BR' | 'pt-PT' | 'ro' | 'ru' | 'sk' | 'sl' | 'sq' | 'sr' | 'sv' | 'sw' | 'ta' | 'te' | 'th' | 'tr' | 'uk' | 'ur' | 'uz' | 'vi' | 'zh' | 'zh-CN' | 'zh-HK' | 'zh-TW' | 'zu';
//#endregion
//#region src/user-management/interfaces/logout-url-options.interface.d.ts
interface LogoutURLOptions {
  sessionId: string;
  returnTo?: string;
}
//#endregion
//#region src/user-management/interfaces/magic-auth.interface.d.ts
interface MagicAuth {
  /** Distinguishes the Magic Auth object. */
  object: 'magic_auth';
  /** The unique ID of the Magic Auth code. */
  id: string;
  /** The unique ID of the user. */
  userId: string;
  /** The email address of the user. */
  email: string;
  /** The timestamp when the Magic Auth code expires. */
  expiresAt: string;
  /** The code used to verify the Magic Auth code. */
  code: string;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface MagicAuthEvent {
  object: 'magic_auth';
  id: string;
  userId: string;
  email: string;
  expiresAt: string;
  createdAt: string;
  updatedAt: string;
}
interface MagicAuthResponse {
  object: 'magic_auth';
  id: string;
  user_id: string;
  email: string;
  expires_at: string;
  code: string;
  created_at: string;
  updated_at: string;
}
interface CreateMagicAuthResponse extends MagicAuth {
  radarAuthAttemptId?: string;
}
interface CreateMagicAuthResponseResponse extends MagicAuthResponse {
  radar_auth_attempt_id?: string;
}
interface MagicAuthEventResponse {
  object: 'magic_auth';
  id: string;
  user_id: string;
  email: string;
  expires_at: string;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/user-management/interfaces/password-reset.interface.d.ts
interface PasswordReset {
  /** Distinguishes the password reset object. */
  object: 'password_reset';
  /** The unique ID of the password reset object. */
  id: string;
  /** The unique ID of the user. */
  userId: string;
  /** The email address of the user. */
  email: string;
  /** The token used to reset the password. */
  passwordResetToken: string;
  /** The URL where the user can reset their password. */
  passwordResetUrl: string;
  /** The timestamp when the password reset token expires. */
  expiresAt: string;
  /** The timestamp when the password reset token was created. */
  createdAt: string;
}
interface PasswordResetEvent {
  object: 'password_reset';
  id: string;
  userId: string;
  email: string;
  expiresAt: string;
  createdAt: string;
}
interface PasswordResetResponse {
  object: 'password_reset';
  id: string;
  user_id: string;
  email: string;
  password_reset_token: string;
  password_reset_url: string;
  expires_at: string;
  created_at: string;
}
interface PasswordResetEventResponse {
  object: 'password_reset';
  id: string;
  user_id: string;
  email: string;
  expires_at: string;
  created_at: string;
}
//#endregion
//#region src/user-management/interfaces/refresh-and-seal-session-data.interface.d.ts
declare enum RefreshSessionFailureReason {
  INVALID_SESSION_COOKIE = "invalid_session_cookie",
  NO_SESSION_COOKIE_PROVIDED = "no_session_cookie_provided",
  INVALID_GRANT = "invalid_grant",
  MFA_ENROLLMENT = "mfa_enrollment",
  SSO_REQUIRED = "sso_required",
  RATE_LIMIT_EXCEEDED = "rate_limit_exceeded",
  TIMEOUT = "timeout",
  SERVER_ERROR = "server_error",
  NETWORK_ERROR = "network_error"
}
type TerminalRefreshSessionFailureReason = RefreshSessionFailureReason.INVALID_SESSION_COOKIE | RefreshSessionFailureReason.NO_SESSION_COOKIE_PROVIDED | RefreshSessionFailureReason.INVALID_GRANT | RefreshSessionFailureReason.MFA_ENROLLMENT | RefreshSessionFailureReason.SSO_REQUIRED;
type RetryableRefreshSessionFailureReason = RefreshSessionFailureReason.RATE_LIMIT_EXCEEDED | RefreshSessionFailureReason.TIMEOUT | RefreshSessionFailureReason.SERVER_ERROR | RefreshSessionFailureReason.NETWORK_ERROR;
/**
 * A terminal refresh failure: the session is over (e.g. `invalid_grant`) and
 * the user should be redirected to sign in.
 */
type RefreshSessionTerminalFailedResponse = {
  authenticated: false;
  reason: TerminalRefreshSessionFailureReason;
  retryable: false;
};
/**
 * A transient refresh failure: the refresh token is likely still valid (e.g. a
 * timeout, `5xx`, or `429`), so keep the existing session and retry later.
 */
type RefreshSessionRetryableFailedResponse = {
  authenticated: false;
  reason: RetryableRefreshSessionFailureReason;
  retryable: true;
  /**
   * Seconds the server asked the client to wait before retrying, parsed from
   * the `Retry-After` response header. Only present for some retryable
   * failures (e.g. a `429`).
   */
  retryAfter?: number;
  /**
   * The underlying error, exposed for logging.
   */
  error?: unknown;
};
type RefreshSessionFailedResponse = RefreshSessionTerminalFailedResponse | RefreshSessionRetryableFailedResponse;
type RefreshSessionSuccessResponse = Omit<AuthenticateWithSessionCookieSuccessResponse, 'accessToken'> & {
  authenticated: true;
  session?: AuthenticationResponse;
  sealedSession?: string;
};
type RefreshSessionResponse = RefreshSessionFailedResponse | RefreshSessionSuccessResponse;
//#endregion
//#region src/user-management/interfaces/resend-invitation-options.interface.d.ts
interface ResendInvitationOptions {
  locale?: Locale;
}
interface SerializedResendInvitationOptions {
  locale?: Locale;
}
//#endregion
//#region src/user-management/interfaces/reset-password-options.interface.d.ts
interface ResetPasswordOptions {
  token: string;
  newPassword: string;
}
interface SerializedResetPasswordOptions {
  token: string;
  new_password: string;
}
//#endregion
//#region src/user-management/interfaces/revoke-session-options.interface.d.ts
interface RevokeSessionOptions {
  sessionId: string;
}
interface SerializedRevokeSessionOptions {
  session_id: string;
}
declare const serializeRevokeSessionOptions: (options: RevokeSessionOptions) => SerializedRevokeSessionOptions;
//#endregion
//#region src/user-management/interfaces/send-invitation-options.interface.d.ts
interface SendInvitationOptions {
  email: string;
  organizationId?: string;
  expiresInDays?: number;
  inviterUserId?: string;
  roleSlug?: string;
  locale?: Locale;
}
interface SerializedSendInvitationOptions {
  email: string;
  organization_id?: string;
  expires_in_days?: number;
  inviter_user_id?: string;
  role_slug?: string;
  locale?: Locale;
}
//#endregion
//#region src/user-management/interfaces/send-radar-sms-challenge-options.interface.d.ts
interface SendRadarSmsChallengeOptions {
  userId: string;
  pendingAuthenticationToken: string;
  phoneNumber: string;
  ipAddress?: string;
  userAgent?: string;
}
interface SerializedSendRadarSmsChallengeOptions {
  user_id: string;
  pending_authentication_token: string;
  phone_number: string;
  ip_address?: string;
  user_agent?: string;
}
interface SendRadarSmsChallengeResponse {
  verificationId: string;
  phoneNumber: string;
}
interface SendRadarSmsChallengeResponseResponse {
  verification_id: string;
  phone_number: string;
}
//#endregion
//#region src/user-management/interfaces/send-verification-email-options.interface.d.ts
interface SendVerificationEmailOptions {
  userId: string;
}
//#endregion
//#region src/user-management/interfaces/session.interface.d.ts
type AuthMethod = 'cross_app_auth' | 'external_auth' | 'impersonation' | 'magic_code' | 'migrated_session' | 'oauth' | 'passkey' | 'password' | 'sso' | 'unknown';
type SessionStatus = 'active' | 'expired' | 'revoked';
interface Session {
  object: 'session';
  id: string;
  userId: string;
  ipAddress: string | null;
  userAgent: string | null;
  organizationId?: string;
  impersonator?: Impersonator;
  authMethod: AuthMethod;
  status: SessionStatus;
  expiresAt: string;
  endedAt: string | null;
  createdAt: string;
  updatedAt: string;
}
interface SessionResponse {
  object: 'session';
  id: string;
  user_id: string;
  ip_address: string | null;
  user_agent: string | null;
  organization_id?: string;
  impersonator?: Impersonator;
  auth_method: AuthMethod;
  status: SessionStatus;
  expires_at: string;
  ended_at: string | null;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/user-management/interfaces/update-organization-membership-options.interface.d.ts
interface UpdateOrganizationMembershipOptions {
  roleSlug?: string;
  roleSlugs?: string[];
}
interface SerializedUpdateOrganizationMembershipOptions {
  role_slug?: string;
  role_slugs?: string[];
}
//#endregion
//#region src/user-management/interfaces/update-user-options.interface.d.ts
interface UpdateUserOptions {
  userId: string;
  email?: string;
  name?: string;
  firstName?: string;
  lastName?: string;
  emailVerified?: boolean;
  password?: string;
  passwordHash?: string;
  passwordHashType?: PasswordHashType;
  externalId?: string;
  locale?: string;
  metadata?: Record<string, string | null>;
}
interface SerializedUpdateUserOptions {
  email?: string;
  name?: string;
  first_name?: string;
  last_name?: string;
  email_verified?: boolean;
  password?: string;
  password_hash?: string;
  password_hash_type?: PasswordHashType;
  external_id?: string;
  locale?: string;
  metadata?: Record<string, string | null>;
}
//#endregion
//#region src/user-management/interfaces/update-user-password-options.interface.d.ts
interface UpdateUserPasswordOptions {
  userId: string;
  password: string;
}
interface SerializedUpdateUserPasswordOptions {
  password: string;
}
//#endregion
//#region src/user-management/interfaces/user-api-key.interface.d.ts
interface UserApiKey {
  object: 'api_key';
  id: string;
  owner: {
    type: 'user';
    id: string;
    organizationId: string;
  };
  name: string;
  obfuscatedValue: string;
  lastUsedAt: string | null;
  expiresAt: string | null;
  permissions: string[];
  createdAt: string;
  updatedAt: string;
}
interface SerializedUserApiKey {
  object: 'api_key';
  id: string;
  owner: {
    type: 'user';
    id: string;
    organization_id: string;
  };
  name: string;
  obfuscated_value: string;
  last_used_at: string | null;
  expires_at: string | null;
  permissions: string[];
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/user-management/interfaces/user-api-key-with-value.interface.d.ts
interface UserApiKeyWithValue extends UserApiKey {
  value: string;
}
interface SerializedUserApiKeyWithValue extends SerializedUserApiKey {
  value: string;
}
//#endregion
//#region src/user-management/interfaces/verify-email-options.interface.d.ts
interface VerifyEmailOptions {
  code: string;
  userId: string;
}
interface SerializedVerifyEmailOptions {
  code: string;
}
//#endregion
//#region src/organization-domains/interfaces/create-organization-domain-options.interface.d.ts
interface CreateOrganizationDomainOptions {
  domain: string;
  organizationId: string;
}
interface SerializedCreateOrganizationDomainOptions {
  domain: string;
  organization_id: string;
}
//#endregion
//#region src/organization-domains/interfaces/organization-domain.interface.d.ts
declare enum OrganizationDomainState {
  Verified = "verified",
  Pending = "pending",
  Failed = "failed"
}
declare enum OrganizationDomainVerificationStrategy {
  Dns = "dns",
  Manual = "manual"
}
interface OrganizationDomain {
  /** Distinguishes the organization domain object. */
  object: 'organization_domain';
  /** Unique identifier of the organization domain. */
  id: string;
  /** Domain for the organization domain. */
  domain: string;
  /** ID of the parent Organization. */
  organizationId: string;
  /** Verification state of the domain. */
  state: OrganizationDomainState;
  /** Validation token to be used in DNS TXT record. */
  verificationToken?: string;
  /** Strategy used to verify the domain. */
  verificationStrategy: OrganizationDomainVerificationStrategy;
  /** The prefix used in DNS verification. */
  verificationPrefix?: string;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface OrganizationDomainResponse {
  object: 'organization_domain';
  id: string;
  domain: string;
  organization_id: string;
  state: OrganizationDomainState;
  verification_token?: string;
  verification_strategy: OrganizationDomainVerificationStrategy;
  verification_prefix?: string;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/organization-domains/interfaces/organization-domain-verification-failed.interface.d.ts
interface OrganizationDomainVerificationFailed {
  reason: string;
  organizationDomain: OrganizationDomain;
}
interface OrganizationDomainVerificationFailedResponse {
  reason: string;
  organization_domain: OrganizationDomainResponse;
}
//#endregion
//#region src/api-keys/interfaces/api-key.interface.d.ts
/** The API Key object if the value is valid, or `null` if invalid. */
interface ApiKey {
  /** Distinguishes the API Key object. */
  object: 'api_key';
  /** Unique identifier of the API Key. */
  id: string;
  /** The entity that owns the API Key. */
  owner: {
    type: 'organization';
    id: string;
  } | {
    type: 'user';
    id: string;
    organizationId: string;
  };
  /** A descriptive name for the API Key. */
  name: string;
  /** An obfuscated representation of the API Key value. */
  obfuscatedValue: string;
  /** Timestamp of when the API Key was last used. */
  lastUsedAt: string | null;
  /** The permission slugs assigned to the API Key. */
  permissions: string[];
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface SerializedApiKey {
  object: 'api_key';
  id: string;
  owner: {
    type: 'organization';
    id: string;
  } | {
    type: 'user';
    id: string;
    organization_id: string;
  };
  name: string;
  obfuscated_value: string;
  last_used_at: string | null;
  permissions: string[];
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/api-keys/interfaces/create-organization-api-key-options.interface.d.ts
interface CreateOrganizationApiKeyOptions {
  organizationId: string;
  name: string;
  permissions?: string[];
}
interface SerializedCreateOrganizationApiKeyOptions {
  name: string;
  permissions?: string[];
}
interface CreateOrganizationApiKeyRequestOptions extends Pick<PostOptions, 'idempotencyKey'> {}
//#endregion
//#region src/api-keys/interfaces/created-api-key.interface.d.ts
interface CreatedApiKey {
  object: 'api_key';
  id: string;
  owner: {
    type: 'organization';
    id: string;
  };
  name: string;
  obfuscatedValue: string;
  value: string;
  lastUsedAt: string | null;
  permissions: string[];
  createdAt: string;
  updatedAt: string;
}
interface SerializedCreatedApiKey {
  object: 'api_key';
  id: string;
  owner: {
    type: 'organization';
    id: string;
  };
  name: string;
  obfuscated_value: string;
  value: string;
  last_used_at: string | null;
  permissions: string[];
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/api-keys/interfaces/list-organization-api-keys-options.interface.d.ts
interface ListOrganizationApiKeysOptions extends PaginationOptions {
  organizationId: string;
}
//#endregion
//#region src/api-keys/interfaces/validate-api-key.interface.d.ts
interface ValidateApiKeyOptions {
  value: string;
}
interface ValidateApiKeyResponse {
  apiKey: ApiKey | null;
  /**
   * The ID of the agent registration this API key was issued for. Present only
   * when the API key is assigned to an agent registration.
   */
  agentRegistrationId?: string;
}
interface SerializedValidateApiKeyResponse {
  api_key: SerializedApiKey | null;
  agent_registration_id?: string;
}
//#endregion
//#region src/feature-flags/interfaces/add-flag-target-options.interface.d.ts
interface AddFlagTargetOptions {
  slug: string;
  targetId: string;
}
//#endregion
//#region src/feature-flags/interfaces/evaluation-context.interface.d.ts
interface EvaluationContext {
  userId?: string;
  organizationId?: string;
}
//#endregion
//#region src/feature-flags/interfaces/feature-flag.interface.d.ts
interface FeatureFlag {
  /** Distinguishes the Feature Flag object. */
  object: 'feature_flag';
  /** Unique identifier of the Feature Flag. */
  id: string;
  /** A descriptive name for the Feature Flag. This field does not need to be unique. */
  name: string;
  /** A unique key to reference the Feature Flag. */
  slug: string;
  /** A description for the Feature Flag. */
  description: string;
  /** Labels assigned to the Feature Flag for categorizing and filtering. */
  tags: string[];
  /** Specifies whether the Feature Flag is active for the current environment. */
  enabled: boolean;
  /** The value returned for users and organizations who don't match any configured targeting rules. */
  defaultValue: boolean;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface FeatureFlagResponse {
  object: 'feature_flag';
  id: string;
  name: string;
  slug: string;
  description: string;
  tags: string[];
  enabled: boolean;
  default_value: boolean;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/feature-flags/interfaces/flag-poll-response.interface.d.ts
interface FlagTarget {
  id: string;
  enabled: boolean;
}
interface FlagPollEntry {
  slug: string;
  enabled: boolean;
  default_value: boolean;
  targets: {
    users: FlagTarget[];
    organizations: FlagTarget[];
  };
}
type FlagPollResponse = Record<string, FlagPollEntry>;
//#endregion
//#region src/feature-flags/interfaces/flag-change.interface.d.ts
interface FlagChange {
  key: string;
  previous: FlagPollEntry | null;
  current: FlagPollEntry | null;
}
//#endregion
//#region src/feature-flags/interfaces/list-feature-flags-options.interface.d.ts
type ListFeatureFlagsOptions = PaginationOptions;
//#endregion
//#region src/feature-flags/interfaces/remove-flag-target-options.interface.d.ts
interface RemoveFlagTargetOptions {
  slug: string;
  targetId: string;
}
//#endregion
//#region src/feature-flags/interfaces/runtime-client-options.interface.d.ts
interface RuntimeClientLogger {
  debug(...args: unknown[]): void;
  info(...args: unknown[]): void;
  warn(...args: unknown[]): void;
  error(...args: unknown[]): void;
}
interface RuntimeClientOptions {
  pollingIntervalMs?: number;
  bootstrapFlags?: Record<string, FlagPollEntry>;
  requestTimeoutMs?: number;
  logger?: RuntimeClientLogger;
}
//#endregion
//#region src/feature-flags/interfaces/runtime-client-stats.interface.d.ts
interface RuntimeClientStats {
  pollCount: number;
  pollErrorCount: number;
  lastPollAt: Date | null;
  lastSuccessfulPollAt: Date | null;
  cacheAge: number | null;
  flagCount: number;
}
//#endregion
//#region src/groups/interfaces/add-group-organization-membership-options.interface.d.ts
interface AddGroupOrganizationMembershipOptions {
  organizationId: string;
  groupId: string;
  organizationMembershipId: string;
}
interface SerializedAddGroupOrganizationMembershipOptions {
  organization_membership_id: string;
}
//#endregion
//#region src/groups/interfaces/create-group-options.interface.d.ts
interface CreateGroupOptions {
  organizationId: string;
  name: string;
  description?: string | null;
}
interface SerializedCreateGroupOptions {
  name: string;
  description?: string | null;
}
//#endregion
//#region src/groups/interfaces/delete-group-options.interface.d.ts
interface DeleteGroupOptions {
  organizationId: string;
  groupId: string;
}
//#endregion
//#region src/groups/interfaces/get-group-options.interface.d.ts
interface GetGroupOptions {
  organizationId: string;
  groupId: string;
}
//#endregion
//#region src/groups/interfaces/group.interface.d.ts
interface Group {
  /** The Group object. */
  object: 'group';
  /** The unique ID of the Group. */
  id: string;
  /** The ID of the Organization the Group belongs to. */
  organizationId: string;
  /** The name of the Group. */
  name: string;
  /** An optional description of the Group. */
  description: string | null;
  /** An ISO 8601 timestamp. */
  createdAt: Date;
  /** An ISO 8601 timestamp. */
  updatedAt: Date;
}
interface GroupResponse {
  object: 'group';
  id: string;
  organization_id: string;
  name: string;
  description: string | null;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/groups/interfaces/list-group-organization-memberships-options.interface.d.ts
interface ListGroupOrganizationMembershipsOptions extends PaginationOptions {
  organizationId: string;
  groupId: string;
}
//#endregion
//#region src/groups/interfaces/list-groups-options.interface.d.ts
interface ListGroupsOptions extends PaginationOptions {
  organizationId: string;
}
//#endregion
//#region src/groups/interfaces/remove-group-organization-membership-options.interface.d.ts
interface RemoveGroupOrganizationMembershipOptions {
  organizationId: string;
  groupId: string;
  organizationMembershipId: string;
}
//#endregion
//#region src/groups/interfaces/update-group-options.interface.d.ts
interface UpdateGroupOptions {
  organizationId: string;
  groupId: string;
  name?: string;
  description?: string | null;
}
interface SerializedUpdateGroupOptions {
  name?: string;
  description?: string | null;
}
//#endregion
//#region src/vault/interfaces/key.interface.d.ts
interface KeyContext {
  [key: string]: any;
}
interface DataKeyPair {
  context: KeyContext;
  dataKey: DataKey;
  encryptedKeys: string;
}
interface DataKey {
  key: string;
  id: string;
}
//#endregion
//#region src/vault/interfaces/vault-event.interface.d.ts
type VaultActorSource = 'api' | 'dashboard';
interface VaultActor {
  actorId: string;
  actorSource: VaultActorSource;
  actorName: string;
}
interface VaultActorResponse {
  actor_id: string;
  actor_source: VaultActorSource;
  actor_name: string;
}
interface VaultDataMutatedEventData extends VaultActor {
  kvName: string;
  keyId: string;
  keyContext: KeyContext;
}
interface VaultDataMutatedEventResponseData extends VaultActorResponse {
  kv_name: string;
  key_id: string;
  key_context: KeyContext;
}
type VaultDataCreatedEventData = VaultDataMutatedEventData;
type VaultDataUpdatedEventData = VaultDataMutatedEventData;
type VaultDataCreatedEventResponseData = VaultDataMutatedEventResponseData;
type VaultDataUpdatedEventResponseData = VaultDataMutatedEventResponseData;
interface VaultDataReadEventData extends VaultActor {
  kvName: string;
  keyId: string;
}
interface VaultDataReadEventResponseData extends VaultActorResponse {
  kv_name: string;
  key_id: string;
}
interface VaultDataDeletedEventData extends VaultActor {
  kvName: string;
}
interface VaultDataDeletedEventResponseData extends VaultActorResponse {
  kv_name: string;
}
interface VaultMetadataReadEventData extends VaultActor {
  kvName: string;
}
interface VaultMetadataReadEventResponseData extends VaultActorResponse {
  kv_name: string;
}
type VaultNamesListedEventData = VaultActor;
type VaultNamesListedEventResponseData = VaultActorResponse;
interface VaultKekCreatedEventData extends VaultActor {
  keyName: string;
  keyId: string;
}
interface VaultKekCreatedEventResponseData extends VaultActorResponse {
  key_name: string;
  key_id: string;
}
interface VaultDekReadEventData extends VaultActor {
  keyIds: string[];
  keyContext: KeyContext;
}
interface VaultDekReadEventResponseData extends VaultActorResponse {
  key_ids: string[];
  key_context: KeyContext;
}
interface VaultDekDecryptedEventData extends VaultActor {
  keyId: string;
}
interface VaultDekDecryptedEventResponseData extends VaultActorResponse {
  key_id: string;
}
type VaultByokKeyProvider = 'AWS_KMS' | 'GCP_KMS' | 'AZURE_KEY_VAULT';
interface VaultByokKeyVerificationCompletedEventData {
  organizationId: string;
  keyProvider: VaultByokKeyProvider;
  verified: boolean;
}
interface VaultByokKeyVerificationCompletedEventResponseData {
  organization_id: string;
  key_provider: VaultByokKeyProvider;
  verified: boolean;
}
//#endregion
//#region src/common/interfaces/event.interface.d.ts
interface EventBase {
  id: string;
  createdAt: string;
  context: Record<string, unknown> | undefined;
}
interface EventResponseBase {
  id: string;
  created_at: string;
  context?: Record<string, unknown>;
}
interface AuthenticationEmailVerificationSucceededEvent extends EventBase {
  event: 'authentication.email_verification_succeeded';
  data: AuthenticationEvent;
}
interface AuthenticationEmailVerificationSucceededEventResponse extends EventResponseBase {
  event: 'authentication.email_verification_succeeded';
  data: AuthenticationEventResponse;
}
interface AuthenticationMagicAuthFailedEvent extends EventBase {
  event: 'authentication.magic_auth_failed';
  data: AuthenticationEvent;
}
interface AuthenticationMagicAuthFailedEventResponse extends EventResponseBase {
  event: 'authentication.magic_auth_failed';
  data: AuthenticationEventResponse;
}
interface AuthenticationMagicAuthSucceededEvent extends EventBase {
  event: 'authentication.magic_auth_succeeded';
  data: AuthenticationEvent;
}
interface AuthenticationMagicAuthSucceededEventResponse extends EventResponseBase {
  event: 'authentication.magic_auth_succeeded';
  data: AuthenticationEventResponse;
}
interface AuthenticationMfaSucceededEvent extends EventBase {
  event: 'authentication.mfa_succeeded';
  data: AuthenticationEvent;
}
interface AuthenticationMfaSucceededEventResponse extends EventResponseBase {
  event: 'authentication.mfa_succeeded';
  data: AuthenticationEventResponse;
}
interface AuthenticationOAuthFailedEvent extends EventBase {
  event: 'authentication.oauth_failed';
  data: AuthenticationEvent;
}
interface AuthenticationOAuthFailedEventResponse extends EventResponseBase {
  event: 'authentication.oauth_failed';
  data: AuthenticationEventResponse;
}
interface AuthenticationOAuthSucceededEvent extends EventBase {
  event: 'authentication.oauth_succeeded';
  data: AuthenticationEvent;
}
interface AuthenticationOAuthSucceededEventResponse extends EventResponseBase {
  event: 'authentication.oauth_succeeded';
  data: AuthenticationEventResponse;
}
interface AuthenticationPasskeyFailedEvent extends EventBase {
  event: 'authentication.passkey_failed';
  data: AuthenticationEvent;
}
interface AuthenticationPasskeyFailedEventResponse extends EventResponseBase {
  event: 'authentication.passkey_failed';
  data: AuthenticationEventResponse;
}
interface AuthenticationPasskeySucceededEvent extends EventBase {
  event: 'authentication.passkey_succeeded';
  data: AuthenticationEvent;
}
interface AuthenticationPasskeySucceededEventResponse extends EventResponseBase {
  event: 'authentication.passkey_succeeded';
  data: AuthenticationEventResponse;
}
interface AuthenticationPasswordFailedEvent extends EventBase {
  event: 'authentication.password_failed';
  data: AuthenticationEvent;
}
interface AuthenticationPasswordFailedEventResponse extends EventResponseBase {
  event: 'authentication.password_failed';
  data: AuthenticationEventResponse;
}
interface AuthenticationPasswordSucceededEvent extends EventBase {
  event: 'authentication.password_succeeded';
  data: AuthenticationEvent;
}
interface AuthenticationPasswordSucceededEventResponse extends EventResponseBase {
  event: 'authentication.password_succeeded';
  data: AuthenticationEventResponse;
}
interface AuthenticationRadarRiskDetectedEvent extends EventBase {
  event: 'authentication.radar_risk_detected';
  data: AuthenticationRadarRiskDetectedEventData;
}
interface AuthenticationRadarRiskDetectedEventResponse extends EventResponseBase {
  event: 'authentication.radar_risk_detected';
  data: AuthenticationRadarRiskDetectedEventResponseData;
}
interface AuthenticationSSOFailedEvent extends EventBase {
  event: 'authentication.sso_failed';
  data: AuthenticationEvent;
}
interface AuthenticationSSOFailedEventResponse extends EventResponseBase {
  event: 'authentication.sso_failed';
  data: AuthenticationEventResponse;
}
interface AuthenticationSSOSucceededEvent extends EventBase {
  event: 'authentication.sso_succeeded';
  data: AuthenticationEvent;
}
interface AuthenticationSSOSucceededEventResponse extends EventResponseBase {
  event: 'authentication.sso_succeeded';
  data: AuthenticationEventResponse;
}
interface ConnectionActivatedEvent extends EventBase {
  event: 'connection.activated';
  data: Connection;
}
interface ConnectionActivatedEventResponse extends EventResponseBase {
  event: 'connection.activated';
  data: ConnectionResponse;
}
interface ConnectionDeactivatedEvent extends EventBase {
  event: 'connection.deactivated';
  data: Connection;
}
interface ConnectionDeactivatedEventResponse extends EventResponseBase {
  event: 'connection.deactivated';
  data: ConnectionResponse;
}
interface ConnectionDeletedEvent extends EventBase {
  event: 'connection.deleted';
  data: Connection;
}
interface ConnectionDeletedEventResponse extends EventResponseBase {
  event: 'connection.deleted';
  data: ConnectionResponse;
}
interface DsyncActivatedEvent extends EventBase {
  event: 'dsync.activated';
  data: EventDirectory;
}
interface DsyncActivatedEventResponse extends EventResponseBase {
  event: 'dsync.activated';
  data: EventDirectoryResponse;
}
interface DsyncDeletedEvent extends EventBase {
  event: 'dsync.deleted';
  data: Omit<EventDirectory, 'domains' | 'externalKey'>;
}
interface DsyncDeletedEventResponse extends EventResponseBase {
  event: 'dsync.deleted';
  data: Omit<EventDirectoryResponse, 'domains' | 'external_key'>;
}
interface DsyncGroupCreatedEvent extends EventBase {
  event: 'dsync.group.created';
  data: DirectoryGroup;
}
interface DsyncGroupCreatedEventResponse extends EventResponseBase {
  event: 'dsync.group.created';
  data: DirectoryGroupResponse;
}
interface DsyncGroupDeletedEvent extends EventBase {
  event: 'dsync.group.deleted';
  data: DirectoryGroup;
}
interface DsyncGroupDeletedEventResponse extends EventResponseBase {
  event: 'dsync.group.deleted';
  data: DirectoryGroupResponse;
}
interface DsyncGroupUpdatedEvent extends EventBase {
  event: 'dsync.group.updated';
  data: DirectoryGroup & Record<'previousAttributes', any>;
}
interface DsyncGroupUpdatedEventResponse extends EventResponseBase {
  event: 'dsync.group.updated';
  data: DirectoryGroupResponse & Record<'previous_attributes', any>;
}
interface DsyncGroupUserAddedEvent extends EventBase {
  event: 'dsync.group.user_added';
  data: {
    directoryId: string;
    user: DirectoryUser;
    group: DirectoryGroup;
  };
}
interface DsyncGroupUserAddedEventResponse extends EventResponseBase {
  event: 'dsync.group.user_added';
  data: {
    directory_id: string;
    user: DirectoryUserResponse;
    group: DirectoryGroupResponse;
  };
}
interface DsyncGroupUserRemovedEvent extends EventBase {
  event: 'dsync.group.user_removed';
  data: {
    directoryId: string;
    user: DirectoryUser;
    group: DirectoryGroup;
  };
}
interface DsyncGroupUserRemovedEventResponse extends EventResponseBase {
  event: 'dsync.group.user_removed';
  data: {
    directory_id: string;
    user: DirectoryUserResponse;
    group: DirectoryGroupResponse;
  };
}
interface DsyncUserCreatedEvent extends EventBase {
  event: 'dsync.user.created';
  data: DirectoryUser;
}
interface DsyncUserCreatedEventResponse extends EventResponseBase {
  event: 'dsync.user.created';
  data: DirectoryUserResponse;
}
interface DsyncUserDeletedEvent extends EventBase {
  event: 'dsync.user.deleted';
  data: DirectoryUser;
}
interface DsyncUserDeletedEventResponse extends EventResponseBase {
  event: 'dsync.user.deleted';
  data: DirectoryUserResponse;
}
interface DsyncUserUpdatedEvent extends EventBase {
  event: 'dsync.user.updated';
  data: DirectoryUser & Record<'previousAttributes', any>;
}
interface DsyncUserUpdatedEventResponse extends EventResponseBase {
  event: 'dsync.user.updated';
  data: DirectoryUserResponse & Record<'previous_attributes', any>;
}
interface EmailVerificationCreatedEvent extends EventBase {
  event: 'email_verification.created';
  data: EmailVerificationEvent;
}
interface EmailVerificationCreatedEventResponse extends EventResponseBase {
  event: 'email_verification.created';
  data: EmailVerificationEventResponse;
}
interface InvitationAcceptedEvent extends EventBase {
  event: 'invitation.accepted';
  data: InvitationEvent;
}
interface InvitationCreatedEvent extends EventBase {
  event: 'invitation.created';
  data: InvitationEvent;
}
interface InvitationRevokedEvent extends EventBase {
  event: 'invitation.revoked';
  data: InvitationEvent;
}
interface InvitationResentEvent extends EventBase {
  event: 'invitation.resent';
  data: InvitationEvent;
}
interface InvitationAcceptedEventResponse extends EventResponseBase {
  event: 'invitation.accepted';
  data: InvitationEventResponse;
}
interface InvitationCreatedEventResponse extends EventResponseBase {
  event: 'invitation.created';
  data: InvitationEventResponse;
}
interface InvitationRevokedEventResponse extends EventResponseBase {
  event: 'invitation.revoked';
  data: InvitationEventResponse;
}
interface InvitationResentEventResponse extends EventResponseBase {
  event: 'invitation.resent';
  data: InvitationEventResponse;
}
interface MagicAuthCreatedEvent extends EventBase {
  event: 'magic_auth.created';
  data: MagicAuthEvent;
}
interface MagicAuthCreatedEventResponse extends EventResponseBase {
  event: 'magic_auth.created';
  data: MagicAuthEventResponse;
}
interface PasswordResetCreatedEvent extends EventBase {
  event: 'password_reset.created';
  data: PasswordResetEvent;
}
interface PasswordResetCreatedEventResponse extends EventResponseBase {
  event: 'password_reset.created';
  data: PasswordResetEventResponse;
}
interface PasswordResetSucceededEvent extends EventBase {
  event: 'password_reset.succeeded';
  data: PasswordResetEvent;
}
interface PasswordResetSucceededEventResponse extends EventResponseBase {
  event: 'password_reset.succeeded';
  data: PasswordResetEventResponse;
}
interface UserCreatedEvent extends EventBase {
  event: 'user.created';
  data: User;
}
interface UserCreatedEventResponse extends EventResponseBase {
  event: 'user.created';
  data: UserResponse;
}
interface UserUpdatedEvent extends EventBase {
  event: 'user.updated';
  data: User;
}
interface UserUpdatedEventResponse extends EventResponseBase {
  event: 'user.updated';
  data: UserResponse;
}
interface UserDeletedEvent extends EventBase {
  event: 'user.deleted';
  data: User;
}
interface UserDeletedEventResponse extends EventResponseBase {
  event: 'user.deleted';
  data: UserResponse;
}
interface OrganizationMembershipCreated extends EventBase {
  event: 'organization_membership.created';
  data: OrganizationMembership;
}
interface OrganizationMembershipCreatedResponse extends EventResponseBase {
  event: 'organization_membership.created';
  data: OrganizationMembershipResponse;
}
interface OrganizationMembershipDeleted extends EventBase {
  event: 'organization_membership.deleted';
  data: OrganizationMembership;
}
interface OrganizationMembershipDeletedResponse extends EventResponseBase {
  event: 'organization_membership.deleted';
  data: OrganizationMembershipResponse;
}
interface OrganizationMembershipUpdated extends EventBase {
  event: 'organization_membership.updated';
  data: OrganizationMembership;
}
interface OrganizationMembershipUpdatedResponse extends EventResponseBase {
  event: 'organization_membership.updated';
  data: OrganizationMembershipResponse;
}
interface OrganizationCreatedEvent extends EventBase {
  event: 'organization.created';
  data: Organization;
}
interface OrganizationCreatedResponse extends EventResponseBase {
  event: 'organization.created';
  data: OrganizationResponse;
}
interface OrganizationUpdatedEvent extends EventBase {
  event: 'organization.updated';
  data: Organization;
}
interface OrganizationUpdatedResponse extends EventResponseBase {
  event: 'organization.updated';
  data: OrganizationResponse;
}
interface OrganizationDeletedEvent extends EventBase {
  event: 'organization.deleted';
  data: Organization;
}
interface OrganizationDeletedResponse extends EventResponseBase {
  event: 'organization.deleted';
  data: OrganizationResponse;
}
interface RoleCreatedEvent extends EventBase {
  event: 'role.created';
  data: RoleEvent;
}
interface RoleCreatedEventResponse extends EventResponseBase {
  event: 'role.created';
  data: RoleEventResponse;
}
interface RoleDeletedEvent extends EventBase {
  event: 'role.deleted';
  data: RoleEvent;
}
interface RoleDeletedEventResponse extends EventResponseBase {
  event: 'role.deleted';
  data: RoleEventResponse;
}
interface RoleUpdatedEvent extends EventBase {
  event: 'role.updated';
  data: RoleEvent;
}
interface RoleUpdatedEventResponse extends EventResponseBase {
  event: 'role.updated';
  data: RoleEventResponse;
}
interface OrganizationRoleCreatedEvent extends EventBase {
  event: 'organization_role.created';
  data: OrganizationRoleEvent;
}
interface OrganizationRoleCreatedEventResponse extends EventResponseBase {
  event: 'organization_role.created';
  data: OrganizationRoleEventResponse;
}
interface OrganizationRoleUpdatedEvent extends EventBase {
  event: 'organization_role.updated';
  data: OrganizationRoleEvent;
}
interface OrganizationRoleUpdatedEventResponse extends EventResponseBase {
  event: 'organization_role.updated';
  data: OrganizationRoleEventResponse;
}
interface OrganizationRoleDeletedEvent extends EventBase {
  event: 'organization_role.deleted';
  data: OrganizationRoleEvent;
}
interface OrganizationRoleDeletedEventResponse extends EventResponseBase {
  event: 'organization_role.deleted';
  data: OrganizationRoleEventResponse;
}
interface PermissionCreatedEvent extends EventBase {
  event: 'permission.created';
  data: Permission;
}
interface PermissionCreatedEventResponse extends EventResponseBase {
  event: 'permission.created';
  data: PermissionResponse;
}
interface PermissionUpdatedEvent extends EventBase {
  event: 'permission.updated';
  data: Permission;
}
interface PermissionUpdatedEventResponse extends EventResponseBase {
  event: 'permission.updated';
  data: PermissionResponse;
}
interface PermissionDeletedEvent extends EventBase {
  event: 'permission.deleted';
  data: Permission;
}
interface PermissionDeletedEventResponse extends EventResponseBase {
  event: 'permission.deleted';
  data: PermissionResponse;
}
interface SessionCreatedEvent extends EventBase {
  event: 'session.created';
  data: Session;
}
interface SessionCreatedEventResponse extends EventResponseBase {
  event: 'session.created';
  data: SessionResponse;
}
interface SessionRevokedEvent extends EventBase {
  event: 'session.revoked';
  data: Session;
}
interface SessionRevokedEventResponse extends EventResponseBase {
  event: 'session.revoked';
  data: SessionResponse;
}
interface OrganizationDomainVerifiedEvent extends EventBase {
  event: 'organization_domain.verified';
  data: OrganizationDomain;
}
interface OrganizationDomainVerifiedEventResponse extends EventResponseBase {
  event: 'organization_domain.verified';
  data: OrganizationDomainResponse;
}
interface OrganizationDomainVerificationFailedEvent extends EventBase {
  event: 'organization_domain.verification_failed';
  data: OrganizationDomainVerificationFailed;
}
interface OrganizationDomainVerificationFailedEventResponse extends EventResponseBase {
  event: 'organization_domain.verification_failed';
  data: OrganizationDomainVerificationFailedResponse;
}
interface OrganizationDomainCreatedEvent extends EventBase {
  event: 'organization_domain.created';
  data: OrganizationDomain;
}
interface OrganizationDomainCreatedEventResponse extends EventResponseBase {
  event: 'organization_domain.created';
  data: OrganizationDomainResponse;
}
interface OrganizationDomainUpdatedEvent extends EventBase {
  event: 'organization_domain.updated';
  data: OrganizationDomain;
}
interface OrganizationDomainUpdatedEventResponse extends EventResponseBase {
  event: 'organization_domain.updated';
  data: OrganizationDomainResponse;
}
interface OrganizationDomainDeletedEvent extends EventBase {
  event: 'organization_domain.deleted';
  data: OrganizationDomain;
}
interface OrganizationDomainDeletedEventResponse extends EventResponseBase {
  event: 'organization_domain.deleted';
  data: OrganizationDomainResponse;
}
interface ApiKeyCreatedEvent extends EventBase {
  event: 'api_key.created';
  data: ApiKey;
}
interface ApiKeyCreatedEventResponse extends EventResponseBase {
  event: 'api_key.created';
  data: SerializedApiKey;
}
interface ApiKeyRevokedEvent extends EventBase {
  event: 'api_key.revoked';
  data: ApiKey;
}
interface ApiKeyRevokedEventResponse extends EventResponseBase {
  event: 'api_key.revoked';
  data: SerializedApiKey;
}
interface FlagCreatedEvent extends EventBase {
  event: 'flag.created';
  data: FeatureFlag;
}
interface FlagCreatedEventResponse extends EventResponseBase {
  event: 'flag.created';
  data: FeatureFlagResponse;
}
interface FlagUpdatedEvent extends EventBase {
  event: 'flag.updated';
  data: FeatureFlag;
}
interface FlagUpdatedEventResponse extends EventResponseBase {
  event: 'flag.updated';
  data: FeatureFlagResponse;
}
interface FlagDeletedEvent extends EventBase {
  event: 'flag.deleted';
  data: FeatureFlag;
}
interface FlagDeletedEventResponse extends EventResponseBase {
  event: 'flag.deleted';
  data: FeatureFlagResponse;
}
interface FlagRuleUpdatedEvent extends EventBase {
  event: 'flag.rule_updated';
  data: FeatureFlag;
}
interface FlagRuleUpdatedEventResponse extends EventResponseBase {
  event: 'flag.rule_updated';
  data: FeatureFlagResponse;
}
interface GroupCreatedEvent extends EventBase {
  event: 'group.created';
  data: Group;
}
interface GroupCreatedEventResponse extends EventResponseBase {
  event: 'group.created';
  data: GroupResponse;
}
interface GroupUpdatedEvent extends EventBase {
  event: 'group.updated';
  data: Group;
}
interface GroupUpdatedEventResponse extends EventResponseBase {
  event: 'group.updated';
  data: GroupResponse;
}
interface GroupDeletedEvent extends EventBase {
  event: 'group.deleted';
  data: Group;
}
interface GroupDeletedEventResponse extends EventResponseBase {
  event: 'group.deleted';
  data: GroupResponse;
}
interface GroupMemberEventData {
  groupId: string;
  organizationMembershipId: string;
}
interface GroupMemberEventResponseData {
  group_id: string;
  organization_membership_id: string;
}
interface GroupMemberAddedEvent extends EventBase {
  event: 'group.member_added';
  data: GroupMemberEventData;
}
interface GroupMemberAddedEventResponse extends EventResponseBase {
  event: 'group.member_added';
  data: GroupMemberEventResponseData;
}
interface GroupMemberRemovedEvent extends EventBase {
  event: 'group.member_removed';
  data: GroupMemberEventData;
}
interface GroupMemberRemovedEventResponse extends EventResponseBase {
  event: 'group.member_removed';
  data: GroupMemberEventResponseData;
}
interface VaultDataCreatedEvent extends EventBase {
  event: 'vault.data.created';
  data: VaultDataCreatedEventData;
}
interface VaultDataCreatedEventResponse extends EventResponseBase {
  event: 'vault.data.created';
  data: VaultDataCreatedEventResponseData;
}
interface VaultDataUpdatedEvent extends EventBase {
  event: 'vault.data.updated';
  data: VaultDataUpdatedEventData;
}
interface VaultDataUpdatedEventResponse extends EventResponseBase {
  event: 'vault.data.updated';
  data: VaultDataUpdatedEventResponseData;
}
interface VaultDataReadEvent extends EventBase {
  event: 'vault.data.read';
  data: VaultDataReadEventData;
}
interface VaultDataReadEventResponse extends EventResponseBase {
  event: 'vault.data.read';
  data: VaultDataReadEventResponseData;
}
interface VaultDataDeletedEvent extends EventBase {
  event: 'vault.data.deleted';
  data: VaultDataDeletedEventData;
}
interface VaultDataDeletedEventResponse extends EventResponseBase {
  event: 'vault.data.deleted';
  data: VaultDataDeletedEventResponseData;
}
interface VaultNamesListedEvent extends EventBase {
  event: 'vault.names.listed';
  data: VaultNamesListedEventData;
}
interface VaultNamesListedEventResponse extends EventResponseBase {
  event: 'vault.names.listed';
  data: VaultNamesListedEventResponseData;
}
interface VaultMetadataReadEvent extends EventBase {
  event: 'vault.metadata.read';
  data: VaultMetadataReadEventData;
}
interface VaultMetadataReadEventResponse extends EventResponseBase {
  event: 'vault.metadata.read';
  data: VaultMetadataReadEventResponseData;
}
interface VaultKekCreatedEvent extends EventBase {
  event: 'vault.kek.created';
  data: VaultKekCreatedEventData;
}
interface VaultKekCreatedEventResponse extends EventResponseBase {
  event: 'vault.kek.created';
  data: VaultKekCreatedEventResponseData;
}
interface VaultDekReadEvent extends EventBase {
  event: 'vault.dek.read';
  data: VaultDekReadEventData;
}
interface VaultDekReadEventResponse extends EventResponseBase {
  event: 'vault.dek.read';
  data: VaultDekReadEventResponseData;
}
interface VaultDekDecryptedEvent extends EventBase {
  event: 'vault.dek.decrypted';
  data: VaultDekDecryptedEventData;
}
interface VaultDekDecryptedEventResponse extends EventResponseBase {
  event: 'vault.dek.decrypted';
  data: VaultDekDecryptedEventResponseData;
}
interface VaultByokKeyVerificationCompletedEvent extends EventBase {
  event: 'vault.byok_key.verification_completed';
  data: VaultByokKeyVerificationCompletedEventData;
}
interface VaultByokKeyVerificationCompletedEventResponse extends EventResponseBase {
  event: 'vault.byok_key.verification_completed';
  data: VaultByokKeyVerificationCompletedEventResponseData;
}
interface UnknownEvent extends EventBase {
  event: string;
  data: Record<string, unknown>;
}
type Event = AuthenticationEmailVerificationSucceededEvent | AuthenticationMfaSucceededEvent | AuthenticationOAuthFailedEvent | AuthenticationOAuthSucceededEvent | AuthenticationSSOFailedEvent | AuthenticationSSOSucceededEvent | AuthenticationPasskeyFailedEvent | AuthenticationPasskeySucceededEvent | AuthenticationPasswordFailedEvent | AuthenticationPasswordSucceededEvent | AuthenticationMagicAuthFailedEvent | AuthenticationMagicAuthSucceededEvent | AuthenticationRadarRiskDetectedEvent | ConnectionActivatedEvent | ConnectionDeactivatedEvent | ConnectionDeletedEvent | DsyncActivatedEvent | DsyncDeletedEvent | DsyncGroupCreatedEvent | DsyncGroupUpdatedEvent | DsyncGroupDeletedEvent | DsyncGroupUserAddedEvent | DsyncGroupUserRemovedEvent | DsyncUserCreatedEvent | DsyncUserUpdatedEvent | DsyncUserDeletedEvent | EmailVerificationCreatedEvent | InvitationAcceptedEvent | InvitationCreatedEvent | InvitationRevokedEvent | InvitationResentEvent | MagicAuthCreatedEvent | PasswordResetCreatedEvent | PasswordResetSucceededEvent | UserCreatedEvent | UserUpdatedEvent | UserDeletedEvent | OrganizationMembershipCreated | OrganizationMembershipDeleted | OrganizationMembershipUpdated | RoleCreatedEvent | RoleDeletedEvent | RoleUpdatedEvent | OrganizationRoleCreatedEvent | OrganizationRoleUpdatedEvent | OrganizationRoleDeletedEvent | PermissionCreatedEvent | PermissionUpdatedEvent | PermissionDeletedEvent | SessionCreatedEvent | SessionRevokedEvent | OrganizationCreatedEvent | OrganizationUpdatedEvent | OrganizationDeletedEvent | OrganizationDomainVerifiedEvent | OrganizationDomainVerificationFailedEvent | OrganizationDomainCreatedEvent | OrganizationDomainUpdatedEvent | OrganizationDomainDeletedEvent | ApiKeyCreatedEvent | ApiKeyRevokedEvent | FlagCreatedEvent | FlagUpdatedEvent | FlagDeletedEvent | FlagRuleUpdatedEvent | GroupCreatedEvent | GroupUpdatedEvent | GroupDeletedEvent | GroupMemberAddedEvent | GroupMemberRemovedEvent | VaultDataCreatedEvent | VaultDataUpdatedEvent | VaultDataReadEvent | VaultDataDeletedEvent | VaultNamesListedEvent | VaultMetadataReadEvent | VaultKekCreatedEvent | VaultDekReadEvent | VaultDekDecryptedEvent | VaultByokKeyVerificationCompletedEvent;
type EventResponse = AuthenticationEmailVerificationSucceededEventResponse | AuthenticationMagicAuthFailedEventResponse | AuthenticationMagicAuthSucceededEventResponse | AuthenticationMfaSucceededEventResponse | AuthenticationOAuthFailedEventResponse | AuthenticationOAuthSucceededEventResponse | AuthenticationPasskeyFailedEventResponse | AuthenticationPasskeySucceededEventResponse | AuthenticationPasswordFailedEventResponse | AuthenticationPasswordSucceededEventResponse | AuthenticationSSOFailedEventResponse | AuthenticationSSOSucceededEventResponse | AuthenticationRadarRiskDetectedEventResponse | ConnectionActivatedEventResponse | ConnectionDeactivatedEventResponse | ConnectionDeletedEventResponse | DsyncActivatedEventResponse | DsyncDeletedEventResponse | DsyncGroupCreatedEventResponse | DsyncGroupUpdatedEventResponse | DsyncGroupDeletedEventResponse | DsyncGroupUserAddedEventResponse | DsyncGroupUserRemovedEventResponse | DsyncUserCreatedEventResponse | DsyncUserUpdatedEventResponse | DsyncUserDeletedEventResponse | EmailVerificationCreatedEventResponse | InvitationAcceptedEventResponse | InvitationCreatedEventResponse | InvitationRevokedEventResponse | InvitationResentEventResponse | MagicAuthCreatedEventResponse | PasswordResetCreatedEventResponse | PasswordResetSucceededEventResponse | UserCreatedEventResponse | UserUpdatedEventResponse | UserDeletedEventResponse | OrganizationMembershipCreatedResponse | OrganizationMembershipDeletedResponse | OrganizationMembershipUpdatedResponse | RoleCreatedEventResponse | RoleDeletedEventResponse | RoleUpdatedEventResponse | OrganizationRoleCreatedEventResponse | OrganizationRoleUpdatedEventResponse | OrganizationRoleDeletedEventResponse | PermissionCreatedEventResponse | PermissionUpdatedEventResponse | PermissionDeletedEventResponse | SessionCreatedEventResponse | SessionRevokedEventResponse | OrganizationCreatedResponse | OrganizationUpdatedResponse | OrganizationDeletedResponse | OrganizationDomainVerifiedEventResponse | OrganizationDomainVerificationFailedEventResponse | OrganizationDomainCreatedEventResponse | OrganizationDomainUpdatedEventResponse | OrganizationDomainDeletedEventResponse | ApiKeyCreatedEventResponse | ApiKeyRevokedEventResponse | FlagCreatedEventResponse | FlagUpdatedEventResponse | FlagDeletedEventResponse | FlagRuleUpdatedEventResponse | GroupCreatedEventResponse | GroupUpdatedEventResponse | GroupDeletedEventResponse | GroupMemberAddedEventResponse | GroupMemberRemovedEventResponse | VaultDataCreatedEventResponse | VaultDataUpdatedEventResponse | VaultDataReadEventResponse | VaultDataDeletedEventResponse | VaultNamesListedEventResponse | VaultMetadataReadEventResponse | VaultKekCreatedEventResponse | VaultDekReadEventResponse | VaultDekDecryptedEventResponse | VaultByokKeyVerificationCompletedEventResponse;
type EventName = Event['event'];
//#endregion
//#region src/common/interfaces/generate-link-intent.interface.d.ts
declare const GenerateLinkIntent: {
  readonly SSO: "sso";
  readonly DSync: "dsync";
  readonly AuditLogs: "audit_logs";
  readonly LogStreams: "log_streams";
  readonly DomainVerification: "domain_verification";
  readonly CertificateRenewal: "certificate_renewal";
  readonly BringYourOwnKey: "bring_your_own_key";
};
type GenerateLinkIntent = (typeof GenerateLinkIntent)[keyof typeof GenerateLinkIntent];
//#endregion
//#region src/common/interfaces/get-options.interface.d.ts
interface GetOptions {
  query?: Record<string, any>;
  accessToken?: string;
  warrantToken?: string;
  /** Skip API key requirement check (for PKCE-safe methods) */
  skipApiKeyCheck?: boolean;
  /** Maximum number of retries for this request, overriding the client-wide `maxRetries`. */
  maxRetries?: number;
}
//#endregion
//#region src/common/interfaces/list.interface.d.ts
interface ListResponse<T> {
  readonly object: 'list';
  data: T[];
  list_metadata: {
    before?: string | null;
    after?: string | null;
  };
}
interface List<T> {
  readonly object: 'list';
  data: T[];
  listMetadata: {
    before?: string | null;
    after?: string | null;
  };
}
//#endregion
//#region src/common/interfaces/patch-options.interface.d.ts
interface PatchOptions {
  query?: {
    [key: string]: any;
  };
  idempotencyKey?: string;
  /** Skip API key requirement check (for PKCE-safe methods) */
  skipApiKeyCheck?: boolean;
  /** Maximum number of retries for this request, overriding the client-wide `maxRetries`. */
  maxRetries?: number;
}
//#endregion
//#region src/common/interfaces/post-options.interface.d.ts
interface PostOptions {
  query?: {
    [key: string]: any;
  };
  idempotencyKey?: string;
  warrantToken?: string;
  /** Skip API key requirement check (for PKCE-safe methods) */
  skipApiKeyCheck?: boolean;
  /** Maximum number of retries for this request, overriding the client-wide `maxRetries`. */
  maxRetries?: number;
}
//#endregion
//#region src/common/interfaces/put-options.interface.d.ts
interface PutOptions {
  query?: {
    [key: string]: any;
  };
  idempotencyKey?: string;
  /** Skip API key requirement check (for PKCE-safe methods) */
  skipApiKeyCheck?: boolean;
  /** Maximum number of retries for this request, overriding the client-wide `maxRetries`. */
  maxRetries?: number;
}
//#endregion
//#region src/common/interfaces/unprocessable-entity-error.interface.d.ts
interface UnprocessableEntityError {
  field: string;
  code: string;
}
//#endregion
//#region src/common/interfaces/app-info.interface.d.ts
interface AppInfo {
  name: string;
  version: string;
}
//#endregion
//#region src/common/interfaces/workos-options.interface.d.ts
interface WorkOSOptions {
  apiKey?: string;
  apiHostname?: string;
  https?: boolean;
  port?: number;
  config?: RequestInit;
  appInfo?: AppInfo;
  fetchFn?: typeof fetch;
  clientId?: string;
  timeout?: number;
  /**
   * Maximum number of automatic retries for transient failures (network
   * errors and 408/429/5xx responses). Retries use exponential backoff with
   * jitter and honor the `Retry-After` header (capped at 60 seconds).
   * Defaults to 3. Set to `0` to disable automatic retries.
   */
  maxRetries?: number;
}
//#endregion
//#region src/common/interfaces/workos-response-error.interface.d.ts
interface WorkOSResponseError {
  code?: string;
  error_description?: string;
  error?: string;
  errors?: UnprocessableEntityError[];
  message: string;
  [key: string]: unknown;
}
//#endregion
//#region src/organizations/interfaces/domain-data.interface.d.ts
declare enum DomainDataState {
  Verified = "verified",
  Pending = "pending"
}
interface DomainData {
  domain: string;
  state: DomainDataState;
}
//#endregion
//#region src/organizations/interfaces/create-organization-options.interface.d.ts
interface CreateOrganizationOptions {
  name: string;
  domainData?: DomainData[];
  externalId?: string | null;
  metadata?: Record<string, string>;
}
interface SerializedCreateOrganizationOptions {
  name: string;
  domain_data?: DomainData[];
  external_id?: string | null;
  metadata?: Record<string, string>;
}
type CreateOrganizationRequestOptions = Pick<PostOptions, 'idempotencyKey'>;
//#endregion
//#region src/organizations/interfaces/list-organization-feature-flags-options.interface.d.ts
interface ListOrganizationFeatureFlagsOptions extends PaginationOptions {
  organizationId: string;
}
//#endregion
//#region src/organizations/interfaces/list-organizations-options.interface.d.ts
interface ListOrganizationsOptions extends PaginationOptions {
  /** The domains of an Organization. Any Organization with a matching domain will be returned. */
  domains?: string[];
}
//#endregion
//#region src/organizations/interfaces/organization.interface.d.ts
interface Organization {
  /** Distinguishes the Organization object. */
  object: 'organization';
  /** Unique identifier of the Organization. */
  id: string;
  /** A descriptive name for the Organization. This field does not need to be unique. */
  name: string;
  /**
   * Whether the Organization allows profiles outside of its managed domains.
   * @deprecated
   */
  allowProfilesOutsideOrganization: boolean;
  /** List of Organization Domains. */
  domains: OrganizationDomain[];
  /** The Stripe customer ID of the Organization. */
  stripeCustomerId?: string;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
  /** The external ID of the Organization. */
  externalId: string | null;
  /** Object containing [metadata](https://workos.com/docs/authkit/metadata) key/value pairs associated with the Organization. */
  metadata: Record<string, string>;
}
interface OrganizationResponse {
  object: 'organization';
  id: string;
  name: string;
  allow_profiles_outside_organization: boolean;
  domains: OrganizationDomainResponse[];
  stripe_customer_id?: string;
  created_at: string;
  updated_at: string;
  external_id?: string | null;
  metadata?: Record<string, string>;
}
//#endregion
//#region src/organizations/interfaces/update-organization-options.interface.d.ts
interface UpdateOrganizationOptions {
  organization: string;
  name?: string;
  domainData?: DomainData[];
  stripeCustomerId?: string | null;
  externalId?: string | null;
  metadata?: Record<string, string>;
}
interface SerializedUpdateOrganizationOptions {
  name?: string;
  domain_data?: DomainData[];
  stripe_customer_id?: string | null;
  external_id?: string | null;
  metadata?: Record<string, string>;
}
//#endregion
//#region src/actions/interfaces/action.interface.d.ts
interface AuthenticationActionContext {
  id: string;
  object: 'authentication_action_context';
  user: User;
  organization?: Organization;
  organizationMembership?: OrganizationMembership;
  ipAddress?: string;
  userAgent?: string;
  deviceFingerprint?: string;
  issuer?: string;
}
interface UserData {
  object: 'user_data';
  email: string;
  name: string | null;
  firstName: string;
  lastName: string;
}
interface UserRegistrationActionContext {
  id: string;
  object: 'user_registration_action_context';
  userData: UserData;
  invitation?: Invitation;
  ipAddress?: string;
  userAgent?: string;
  deviceFingerprint?: string;
}
type ActionContext = AuthenticationActionContext | UserRegistrationActionContext;
interface AuthenticationActionPayload {
  id: string;
  object: 'authentication_action_context';
  user: UserResponse;
  organization?: OrganizationResponse;
  organization_membership?: OrganizationMembershipResponse;
  ip_address?: string;
  user_agent?: string;
  device_fingerprint?: string;
  issuer?: string;
}
interface UserDataPayload {
  object: 'user_data';
  email: string;
  name: string | null;
  first_name: string;
  last_name: string;
}
interface UserRegistrationActionPayload {
  id: string;
  object: 'user_registration_action_context';
  user_data: UserDataPayload;
  invitation?: InvitationResponse;
  ip_address?: string;
  user_agent?: string;
  device_fingerprint?: string;
}
type ActionPayload = AuthenticationActionPayload | UserRegistrationActionPayload;
//#endregion
//#region src/actions/interfaces/response-payload.interface.d.ts
interface ResponsePayload {
  timestamp: number;
  verdict?: 'Allow' | 'Deny';
  errorMessage?: string;
}
interface AllowResponseData {
  verdict: 'Allow';
}
interface DenyResponseData {
  verdict: 'Deny';
  errorMessage?: string;
}
type AuthenticationActionResponseData = (AllowResponseData & {
  type: 'authentication';
}) | (DenyResponseData & {
  type: 'authentication';
});
type UserRegistrationActionResponseData = (AllowResponseData & {
  type: 'user_registration';
}) | (DenyResponseData & {
  type: 'user_registration';
});
//#endregion
//#region src/actions/actions.d.ts
declare class Actions {
  private signatureProvider;
  constructor(cryptoProvider: CryptoProvider);
  private get computeSignature();
  get verifyHeader(): ({ payload, sigHeader, secret, tolerance }: {
    payload: WebhookPayload;
    sigHeader: string;
    secret: string;
    tolerance?: number;
  }) => Promise<boolean>;
  serializeType(type: AuthenticationActionResponseData['type'] | UserRegistrationActionResponseData['type']): "authentication_action_response" | "user_registration_action_response";
  signResponse(data: AuthenticationActionResponseData | UserRegistrationActionResponseData, secret: string): Promise<{
    object: string;
    payload: ResponsePayload;
    signature: string;
  }>;
  constructAction({ payload, sigHeader, secret, tolerance }: {
    payload: WebhookPayload;
    sigHeader: string;
    secret: string;
    tolerance?: number;
  }): Promise<ActionContext>;
}
//#endregion
//#region src/pkce/pkce.d.ts
interface PKCEPair {
  codeVerifier: string;
  codeChallenge: string;
  codeChallengeMethod: 'S256';
}
/**
 * PKCE (Proof Key for Code Exchange) utilities for OAuth 2.0 public clients.
 *
 * Implements RFC 7636 for secure authorization code exchange without a client secret.
 * Used by Electron apps, React Native/mobile apps, CLI tools, and other public clients.
 */
declare class PKCE {
  /**
   * Generate a cryptographically random code verifier.
   *
   * @param length - Length of verifier (43-128, default 43)
   * @returns RFC 7636 compliant code verifier
   */
  generateCodeVerifier(length?: number): string;
  /**
   * Generate S256 code challenge from a verifier.
   *
   * @param verifier - The code verifier
   * @returns Base64URL-encoded SHA256 hash
   */
  generateCodeChallenge(verifier: string): Promise<string>;
  /**
   * Generate a complete PKCE pair (verifier + challenge).
   *
   * @returns Code verifier, challenge, and method ('S256')
   */
  generate(): Promise<PKCEPair>;
  private base64UrlEncode;
}
//#endregion
//#region src/agents/interfaces/agent-registration.interface.d.ts
/** The lifecycle status of an agent registration. */
type AgentRegistrationStatus = 'unverified' | 'verified' | 'expired' | 'revoked';
/** The kind of agent registration, derived from its authentication method. */
type AgentRegistrationKind = 'anonymous' | 'service_auth' | 'identity_assertion';
/** The agent identity an agent registration belongs to. */
interface AgentIdentity {
  /** Unique identifier of the agent identity. */
  id: string;
  /** The Userland user the agent identity is associated with, if any. */
  userlandUserId: string | null;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface SerializedAgentIdentity {
  id: string;
  userland_user_id: string | null;
  created_at: string;
  updated_at: string;
}
/** The completion of an agent registration claim. */
interface AgentRegistrationClaimCompletion {
  /** Unique identifier of the claim completion. */
  id: string;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
  /** An ISO 8601 timestamp. */
  expiresAt: string;
  /** An ISO 8601 timestamp of when the registration was claimed. */
  claimedAt: string;
}
interface SerializedAgentRegistrationClaimCompletion {
  id: string;
  created_at: string;
  updated_at: string;
  expires_at: string;
  claimed_at: string;
}
/** The claim state of an agent registration. */
interface AgentRegistrationClaim {
  /** Unique identifier of the claim. */
  id: string;
  /** The completion of the claim, or `null` if it has not been claimed. */
  claimCompletion: AgentRegistrationClaimCompletion | null;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
  /** An ISO 8601 timestamp. */
  expiresAt: string;
}
interface SerializedAgentRegistrationClaim {
  id: string;
  claim_completion: SerializedAgentRegistrationClaimCompletion | null;
  created_at: string;
  updated_at: string;
  expires_at: string;
}
/** A single agent registration. */
interface AgentRegistration {
  /** Unique identifier of the agent registration. */
  id: string;
  /** The agent identity the registration belongs to. */
  agentIdentity: AgentIdentity;
  /** Unique identifier of the Organization the registration belongs to. */
  organizationId: string;
  /** The lifecycle status of the registration. */
  status: AgentRegistrationStatus;
  /** The kind of registration. */
  kind: AgentRegistrationKind;
  /** The claim state of the registration, or `null` if it has none. */
  claim: AgentRegistrationClaim | null;
  /** An ISO 8601 timestamp. */
  createdAt: string;
  /** An ISO 8601 timestamp. */
  updatedAt: string;
}
interface SerializedAgentRegistration {
  id: string;
  agent_identity: SerializedAgentIdentity;
  organization_id: string;
  status: AgentRegistrationStatus;
  kind: AgentRegistrationKind;
  claim: SerializedAgentRegistrationClaim | null;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/agents/interfaces/claim-attempt.interface.d.ts
/** Options for linking an external user to a claim attempt via the admin API. */
interface LinkClaimAttemptToExternalUserOptions {
  /** The claim attempt token identifying the pending claim. */
  claimAttemptToken: string;
  /** The user to attach to the claim attempt. */
  user: {
    /** The email address of the user. */
    email: string;
    /** The external ID of the user. */
    externalId: string;
  };
  /** The organization to place the agent in. Required when the user belongs to multiple organizations. */
  organizationId?: string;
}
interface SerializedLinkClaimAttemptToExternalUserOptions {
  type: 'link_external_user';
  claim_attempt_token: string;
  user: {
    email: string;
    external_id: string;
  };
  organization_id?: string;
}
/** An organization the confirming user belongs to, offered as a placement choice. */
interface ClaimAttemptOrganization {
  /** The organization ID. */
  id: string;
  /** The organization name. */
  name: string;
}
/** The result of linking an external user to a claim attempt. */
interface ClaimAttemptResponse {
  /** The agent registration ID. */
  id: string;
  /** Current status of the agent registration. */
  status: AgentRegistrationStatus;
  /** The user code the agent needs to complete the claim. */
  userCode: string;
  /** Organizations the user belongs to, offered as placement choices. */
  organizations: ClaimAttemptOrganization[];
}
interface SerializedClaimAttemptResponse {
  id: string;
  status: AgentRegistrationStatus;
  user_code: string;
  organizations: ClaimAttemptOrganization[];
}
//#endregion
//#region src/agents/interfaces/validate-agent-credential.interface.d.ts
/** The type of agent credential to validate. */
type AgentCredentialType = 'api_key' | 'access_token';
interface ValidateAgentApiKeyOptions {
  type: 'api_key';
  /** The opaque API key value to validate. */
  credential: string;
}
interface ValidateAgentAccessTokenOptions {
  type: 'access_token';
  /** The access token (JWT) to validate. */
  credential: string;
  /**
   * When `true`, additionally calls the WorkOS API to check whether the token
   * has been revoked. When `false` or omitted, the token is only decoded and
   * verified locally against the environment's JWKS — a revoked but
   * not-yet-expired token will still report as valid.
   */
  checkForRevoked?: boolean;
  /**
   * The expected token audience (`aud`). Defaults to the client ID the WorkOS
   * client was initialized with. Pass the resource indicator for
   * resource-scoped tokens, whose audience is the resource rather than the
   * client ID. When `checkForRevoked` is set, this is also forwarded to the
   * WorkOS API so the server verifies the `aud` claim against the same value.
   */
  audience?: string;
}
/**
 * Options for validating an agent credential. `checkForRevoked` and `audience`
 * are only available for `access_token` credentials.
 */
type ValidateAgentCredentialOptions = ValidateAgentApiKeyOptions | ValidateAgentAccessTokenOptions;
interface SerializedValidateAgentCredentialOptions {
  type: AgentCredentialType;
  credential: string;
  audience?: string;
}
/**
 * The decoded claims of an agent access token. The required fields are
 * guaranteed present: the SDK rejects a token that is missing any of them
 * rather than returning a partial result.
 */
interface AgentAccessTokenClaims {
  /** The token issuer (`iss`). */
  issuer: string;
  /** The token audience (`aud`). */
  audience: string | string[];
  /** Unique identifier of the agent registration the token was issued for (`sub`). */
  registrationId: string;
  /** The token's unique identifier (`jti`). */
  jti: string;
  /** Unique identifier of the Organization the registration belongs to. */
  organizationId: string;
  /** The space-separated scopes granted to the token, if any (`scope`). */
  scope?: string;
  /** The actor the token acts on behalf of, if any (`act`). */
  actor?: {
    sub: string;
  };
  /** The time the token expires, in seconds since the epoch (`exp`). */
  expiresAt: number;
  /** The time the token was issued, in seconds since the epoch (`iat`). */
  issuedAt: number;
}
/**
 * A verified agent access token payload. The required claims are the ones the
 * SDK guarantees on a valid agent credential; `scope` and `act` are genuinely
 * optional on the token. A decoded payload missing any required claim is
 * rejected as invalid before it reaches this shape.
 */
interface SerializedAgentAccessTokenClaims {
  iss: string;
  aud: string | string[];
  sub: string;
  jti: string;
  org_id: string;
  exp: number;
  iat: number;
  scope?: string;
  act?: {
    sub: string;
  };
  [claim: string]: unknown;
}
/** A valid agent credential. */
interface ValidAgentCredential {
  valid: true;
  /** Unique identifier of the agent registration the credential was issued for. */
  registrationId: string;
  /**
   * An ISO 8601 timestamp of when the credential expires, or `null` when it
   * does not expire.
   */
  expiresAt: string | null;
  /**
   * The decoded claims of the access token. Populated for `access_token`
   * credentials; `null` for API keys.
   */
  claims: AgentAccessTokenClaims | null;
}
/** An invalid agent credential. */
interface InvalidAgentCredential {
  valid: false;
  registrationId: null;
  expiresAt: null;
  claims: null;
}
/** The result of validating an agent credential. */
type AgentCredentialValidation = ValidAgentCredential | InvalidAgentCredential;
interface SerializedAgentCredentialValidation {
  valid: boolean;
  registration_id: string | null;
  expires_at: string | null;
}
//#endregion
//#region src/agents/agents.d.ts
declare class Agents {
  private readonly workos;
  private _jwks?;
  constructor(workos: WorkOS);
  /**
   * Link a claim attempt to an external user
   *
   * Link an external user to a claim attempt and retrieve the code needed
   * for the agent to complete the claim. The user is looked up by external
   * ID; if no user exists, one is created. When the user belongs to multiple
   * organizations, an explicit organization must be provided.
   *
   * @param options - Object containing the claim attempt token, user details, and optional organization ID.
   * @returns {Promise<ClaimAttemptResponse>}
   * @throws {BadRequestException} 400 - Invalid request, email mismatch, or wrong account.
   * @throws {ForbiddenException} 403 - Claim denied or auth method disabled.
   * @throws {ConflictException} 409 - Organization selection required, external ID conflict, or already claimed.
   * @throws {GoneException} 410 - Claim or user code expired.
   */
  linkClaimAttemptToExternalUser(options: LinkClaimAttemptToExternalUserOptions): Promise<ClaimAttemptResponse>;
  /**
   * Get an agent registration
   *
   * Retrieve a single agent registration scoped to the API key's environment.
   * @param id - Unique identifier of the agent registration.
   *
   * @example
   * "agent_reg_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @returns {Promise<AgentRegistration>}
   * @throws {NotFoundException} 404
   */
  getRegistration(id: string): Promise<AgentRegistration>;
  /**
   * Validate an agent credential
   *
   * For `access_token` credentials, the token is decoded and verified locally
   * against the environment's JWKS and its claims are returned — no network
   * request is made unless `checkForRevoked` is set, in which case the WorkOS
   * API is also called to confirm the token has not been revoked.
   *
   * For `api_key` credentials, the WorkOS API is always called to validate the
   * key against the environment.
   *
   * @param options - Object containing the credential type and value.
   * @returns {Promise<AgentCredentialValidation>}
   */
  validateCredential(options: ValidateAgentCredentialOptions): Promise<AgentCredentialValidation>;
  private validateAccessToken;
  private validateCredentialRemotely;
  /**
   * Verifies an access token's signature, audience, and time claims against the
   * environment's JWKS and returns its decoded claims, or `null` when the token
   * is invalid (bad signature, wrong audience, expired, malformed, or missing
   * the agent identity claims). Errors that are not JWT validation failures
   * (e.g. network errors fetching the JWKS) propagate.
   *
   * The audience defaults to the client ID; resource-scoped tokens carry the
   * resource as their audience and require it to be passed explicitly.
   */
  private verifyAccessTokenClaims;
  private getJWKS;
}
//#endregion
//#region src/common/utils/pagination.d.ts
declare class AutoPaginatable<ResourceType, ParametersType extends PaginationOptions = PaginationOptions> {
  protected list: List<ResourceType>;
  private apiCall;
  readonly object: "list";
  readonly options: ParametersType;
  constructor(list: List<ResourceType>, apiCall: (params: PaginationOptions) => Promise<List<ResourceType>>, options?: ParametersType);
  get data(): ResourceType[];
  get listMetadata(): {
    before?: string | null;
    after?: string | null;
  };
  private generatePages;
  /**
   * Automatically paginates over the list of results, returning the complete data set.
   * Returns the first result if `options.limit` is passed to the first request.
   */
  autoPagination(): Promise<ResourceType[]>;
}
//#endregion
//#region src/api-keys/api-keys.d.ts
declare class ApiKeys {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * Validate API key
   *
   * Validate an API key value and return the API key object if valid.
   * @param payload - Object containing value.
   * @returns {Promise<ApiKeyValidationResponse>}
   * @throws {UnauthorizedException} 401
   * @throws {UnprocessableEntityException} 422
   */
  createValidation(payload: ValidateApiKeyOptions): Promise<ValidateApiKeyResponse>;
  /**
   * Delete an API key
   *
   * Permanently deletes an API key. This action cannot be undone. Once deleted, any requests using this API key will fail authentication.
   * @param id - The unique ID of the API key.
   *
   * @example
   * "api_key_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @returns {Promise<void>}
   * @throws {NotFoundException} 404
   */
  deleteApiKey(id: string): Promise<void>;
  /**
   * List API keys for an organization
   *
   * Get a list of all API keys for an organization.
   * @param organizationId - Unique identifier of the Organization.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<ApiKey>>}
   * @throws {NotFoundException} 404
   */
  listOrganizationApiKeys(options: ListOrganizationApiKeysOptions): Promise<AutoPaginatable<ApiKey>>;
  /**
   * Create an API key for an organization
   *
   * Create a new API key for an organization.
   * @param organizationId - Unique identifier of the Organization.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param options - Object containing name.
   * @returns {Promise<ApiKeyWithValue>}
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  createOrganizationApiKey(options: CreateOrganizationApiKeyOptions, requestOptions?: CreateOrganizationApiKeyRequestOptions): Promise<CreatedApiKey>;
}
//#endregion
//#region src/connect/interfaces/user-object.interface.d.ts
interface UserObject {
  /** Your application's user identifier, which will be stored as an [`external_id`](https://workos.com/docs/authkit/metadata/external-identifiers). Used for upserting and deduplication. */
  id: string;
  /** The user's email address. */
  email: string;
  /** The user's first name. */
  firstName?: string;
  /** The user's last name. */
  lastName?: string;
  /** A set of key-value pairs to attach to the user. */
  metadata?: Record<string, string>;
}
interface UserObjectResponse {
  id: string;
  email: string;
  first_name?: string;
  last_name?: string;
  metadata?: Record<string, string>;
}
//#endregion
//#region src/connect/interfaces/user-consent-option-choice.interface.d.ts
interface UserConsentOptionChoice {
  /** The value of this choice. */
  value?: string;
  /** A human-readable label for this choice. */
  label?: string;
}
interface UserConsentOptionChoiceResponse {
  value?: string;
  label?: string;
}
//#endregion
//#region src/connect/interfaces/user-consent-option.interface.d.ts
interface UserConsentOption {
  /** The claim name for this consent option. */
  claim: string;
  /** The type of consent option. */
  type: 'enum';
  /** A human-readable label for this consent option. */
  label: string;
  /** The available choices for this consent option. */
  choices: UserConsentOptionChoice[];
}
interface UserConsentOptionResponse {
  claim: string;
  type: 'enum';
  label: string;
  choices: UserConsentOptionChoiceResponse[];
}
//#endregion
//#region src/connect/interfaces/complete-oauth-2-options.interface.d.ts
interface CompleteOAuth2Options {
  /** Identifier provided when AuthKit redirected to your login page. */
  externalAuthId: string;
  /** The user to create or update in AuthKit. */
  user: UserObject;
  /** Array of [User Consent Options](https://workos.com/docs/reference/workos-connect/standalone/user-consent-options) to store with the session. */
  userConsentOptions?: UserConsentOption[];
}
//#endregion
//#region src/connect/interfaces/list-applications-options.interface.d.ts
interface ListApplicationsOptions extends PaginationOptions {
  /** Filter Connect Applications by organization ID. */
  organizationId?: string;
}
//#endregion
//#region src/connect/interfaces/redirect-uri-input.interface.d.ts
interface RedirectUriInput {
  /** The redirect URI. */
  uri: string;
  /** Whether this is the default redirect URI. */
  default?: boolean | null;
}
interface RedirectUriInputResponse {
  uri: string;
  default?: boolean | null;
}
//#endregion
//#region src/connect/interfaces/create-oauth-application.interface.d.ts
interface CreateOAuthApplication {
  /** The name of the application. */
  name: string;
  /** The type of application to create. */
  applicationType: 'oauth';
  /** A description for the application. */
  description?: string | null;
  /** The OAuth scopes granted to the application. */
  scopes?: string[] | null;
  /** Redirect URIs for the application. */
  redirectUris?: RedirectUriInput[] | null;
  /** Whether the application uses PKCE (Proof Key for Code Exchange). */
  usesPkce?: boolean | null;
  /** Whether this is a first-party application. Third-party applications require an organization_id. */
  isFirstParty: boolean;
  /** The organization ID this application belongs to. Required when is_first_party is false. */
  organizationId?: string | null;
}
interface CreateOAuthApplicationResponse {
  name: string;
  application_type: 'oauth';
  description?: string | null;
  scopes?: string[] | null;
  redirect_uris?: RedirectUriInputResponse[] | null;
  uses_pkce?: boolean | null;
  is_first_party: boolean;
  organization_id?: string | null;
}
//#endregion
//#region src/connect/interfaces/create-m2m-application.interface.d.ts
interface CreateM2MApplication {
  /** The name of the application. */
  name: string;
  /** The type of application to create. */
  applicationType: 'm2m';
  /** A description for the application. */
  description?: string | null;
  /** The OAuth scopes granted to the application. */
  scopes?: string[] | null;
  /** The organization ID this application belongs to. */
  organizationId: string;
}
interface CreateM2MApplicationResponse {
  name: string;
  application_type: 'm2m';
  description?: string | null;
  scopes?: string[] | null;
  organization_id: string;
}
//#endregion
//#region src/connect/interfaces/create-application-options.interface.d.ts
type CreateApplicationOptions = {} & (CreateOAuthApplication | CreateM2MApplication);
//#endregion
//#region src/connect/interfaces/get-application-options.interface.d.ts
interface GetApplicationOptions {
  /** The application ID or client ID of the Connect Application. */
  id: string;
}
//#endregion
//#region src/connect/interfaces/update-application-options.interface.d.ts
interface UpdateApplicationOptions {
  /** The application ID or client ID of the Connect Application. */
  id: string;
  /** The name of the application. */
  name?: string;
  /** A description for the application. */
  description?: string | null;
  /** The OAuth scopes granted to the application. */
  scopes?: string[] | null;
  /** Updated redirect URIs for the application. OAuth applications only. */
  redirectUris?: RedirectUriInput[] | null;
}
//#endregion
//#region src/connect/interfaces/delete-application-options.interface.d.ts
interface DeleteApplicationOptions {
  /** The application ID or client ID of the Connect Application. */
  id: string;
}
//#endregion
//#region src/connect/interfaces/list-application-client-secrets-options.interface.d.ts
interface ListApplicationClientSecretsOptions {
  /** The application ID or client ID of the Connect Application. */
  id: string;
}
//#endregion
//#region src/connect/interfaces/create-application-client-secret-options.interface.d.ts
interface CreateApplicationClientSecretOptions {
  /** The application ID or client ID of the Connect Application. */
  id: string;
}
//#endregion
//#region src/connect/interfaces/delete-client-secret-options.interface.d.ts
interface DeleteClientSecretOptions {
  /** The unique ID of the client secret. */
  id: string;
}
//#endregion
//#region src/connect/interfaces/external-auth-complete-response.interface.d.ts
interface ExternalAuthCompleteResponse {
  /** URI to redirect the user back to AuthKit to complete the OAuth flow. */
  redirectUri: string;
}
interface ExternalAuthCompleteResponseWire {
  redirect_uri: string;
}
//#endregion
//#region src/connect/interfaces/connect-application-redirect-uri.interface.d.ts
interface ConnectApplicationRedirectUri {
  /** The redirect URI for the application. */
  uri: string;
  /** Whether this is the default redirect URI. */
  default: boolean;
}
interface ConnectApplicationRedirectUriResponse {
  uri: string;
  default: boolean;
}
//#endregion
//#region src/connect/interfaces/connect-application.interface.d.ts
interface ConnectApplicationOAuth {
  /** Distinguishes the connect application object. */
  object: 'connect_application';
  /** The unique ID of the connect application. */
  id: string;
  /** The client ID of the connect application. */
  clientId: string;
  /** A description of the connect application. */
  description: string | null;
  /** The name of the connect application. */
  name: string;
  /** The scopes available for this application. */
  scopes: string[];
  /** An ISO 8601 timestamp. */
  createdAt: Date;
  /** An ISO 8601 timestamp. */
  updatedAt: Date;
  /** The type of the application. */
  applicationType: 'oauth';
  /** The redirect URIs configured for this application. */
  redirectUris: ConnectApplicationRedirectUri[];
  /** Whether the application uses PKCE for authorization. */
  usesPkce: boolean;
  /** Whether the application is a first-party application. */
  isFirstParty: boolean;
  /** Whether the application was dynamically registered. */
  wasDynamicallyRegistered?: boolean;
  /** The ID of the organization the application belongs to. */
  organizationId?: string;
}
interface ConnectApplicationOAuthResponse {
  /** Distinguishes the connect application object. */
  object: 'connect_application';
  /** The unique ID of the connect application. */
  id: string;
  /** The client ID of the connect application. */
  client_id: string;
  /** A description of the connect application. */
  description: string | null;
  /** The name of the connect application. */
  name: string;
  /** The scopes available for this application. */
  scopes: string[];
  /** An ISO 8601 timestamp. */
  created_at: string;
  /** An ISO 8601 timestamp. */
  updated_at: string;
  /** The type of the application. */
  application_type: 'oauth';
  /** The redirect URIs configured for this application. */
  redirect_uris: ConnectApplicationRedirectUriResponse[];
  /** Whether the application uses PKCE for authorization. */
  uses_pkce: boolean;
  /** Whether the application is a first-party application. */
  is_first_party: boolean;
  /** Whether the application was dynamically registered. */
  was_dynamically_registered?: boolean;
  /** The ID of the organization the application belongs to. */
  organization_id?: string;
}
interface ConnectApplicationM2M {
  /** Distinguishes the connect application object. */
  object: 'connect_application';
  /** The unique ID of the connect application. */
  id: string;
  /** The client ID of the connect application. */
  clientId: string;
  /** A description of the connect application. */
  description: string | null;
  /** The name of the connect application. */
  name: string;
  /** The scopes available for this application. */
  scopes: string[];
  /** An ISO 8601 timestamp. */
  createdAt: Date;
  /** An ISO 8601 timestamp. */
  updatedAt: Date;
  /** The type of the application. */
  applicationType: 'm2m';
  /** The ID of the organization the application belongs to. */
  organizationId: string;
}
interface ConnectApplicationM2MResponse {
  /** Distinguishes the connect application object. */
  object: 'connect_application';
  /** The unique ID of the connect application. */
  id: string;
  /** The client ID of the connect application. */
  client_id: string;
  /** A description of the connect application. */
  description: string | null;
  /** The name of the connect application. */
  name: string;
  /** The scopes available for this application. */
  scopes: string[];
  /** An ISO 8601 timestamp. */
  created_at: string;
  /** An ISO 8601 timestamp. */
  updated_at: string;
  /** The type of the application. */
  application_type: 'm2m';
  /** The ID of the organization the application belongs to. */
  organization_id: string;
}
type ConnectApplication = ConnectApplicationOAuth | ConnectApplicationM2M;
type ConnectApplicationResponse = ConnectApplicationOAuthResponse | ConnectApplicationM2MResponse;
//#endregion
//#region src/connect/interfaces/application-credentials-list-item.interface.d.ts
interface ApplicationCredentialsListItem {
  /** Distinguishes the connect application secret object. */
  object: 'connect_application_secret';
  /** The unique ID of the client secret. */
  id: string;
  /** A hint showing the last few characters of the secret value. */
  secretHint: string;
  /** The timestamp when the client secret was last used, or null if never used. */
  lastUsedAt: Date | null;
  /** An ISO 8601 timestamp. */
  createdAt: Date;
  /** An ISO 8601 timestamp. */
  updatedAt: Date;
}
interface ApplicationCredentialsListItemResponse {
  object: 'connect_application_secret';
  id: string;
  secret_hint: string;
  last_used_at: string | null;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/connect/interfaces/new-connect-application-secret.interface.d.ts
interface NewConnectApplicationSecret {
  /** Distinguishes the connect application secret object. */
  object: 'connect_application_secret';
  /** The unique ID of the client secret. */
  id: string;
  /** A hint showing the last few characters of the secret value. */
  secretHint: string;
  /** The timestamp when the client secret was last used, or null if never used. */
  lastUsedAt: Date | null;
  /** An ISO 8601 timestamp. */
  createdAt: Date;
  /** An ISO 8601 timestamp. */
  updatedAt: Date;
  /** The plaintext secret value. Only returned at creation time and cannot be retrieved later. */
  secret: string;
}
interface NewConnectApplicationSecretResponse {
  object: 'connect_application_secret';
  id: string;
  secret_hint: string;
  last_used_at: string | null;
  created_at: string;
  updated_at: string;
  secret: string;
}
//#endregion
//#region src/connect/connect.d.ts
declare class Connect {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * Complete external authentication
   *
   * Completes an external authentication flow and returns control to AuthKit. This endpoint is used with [Standalone Connect](https://workos.com/docs/authkit/connect/standalone) to bridge your existing authentication system with the Connect OAuth API infrastructure.
   *
   * After successfully authenticating a user in your application, calling this endpoint will:
   *
   * - Create or update the user in AuthKit, using the given `id` as its `external_id`.
   * - Return a `redirect_uri` your application should redirect to in order for AuthKit to complete the flow
   *
   * Users are automatically created or updated based on the `id` and `email` provided. If a user with the same `id` exists, their information is updated. Otherwise, a new user is created.
   *
   * If you provide a new `id` with an `email` that already belongs to an existing user, the request will fail with an error as email addresses are unique to a user.
   * @param options - Object containing externalAuthId, user.
   * @param options.externalAuthId - Identifier provided when AuthKit redirected to your login page.
   * @example "ext_auth_01HXYZ123456789ABCDEFGHIJ"
   * @param options.user - The user to create or update in AuthKit.
   * @param options.userConsentOptions - Array of [User Consent Options](https://workos.com/docs/reference/workos-connect/standalone/user-consent-options) to store with the session.
   * @returns {Promise<ExternalAuthCompleteResponse>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  completeOAuth2(options: CompleteOAuth2Options): Promise<ExternalAuthCompleteResponse>;
  /**
   * List Connect Applications
   *
   * List all Connect Applications in the current environment with optional filtering.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<ConnectApplication, ListApplicationsOptions>>}
   * @throws {UnprocessableEntityException} 422
   */
  listApplications(options?: ListApplicationsOptions): Promise<AutoPaginatable<ConnectApplication, PaginationOptions>>;
  /**
   * Create a Connect Application
   *
   * Create a new Connect Application. Supports both OAuth and Machine-to-Machine (M2M) application types.
   * @param options - The request body.
   * @returns {Promise<ConnectApplication>}
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  createApplication(options: CreateApplicationOptions): Promise<ConnectApplication>;
  /**
   * Create oauth application.
   * @param name - The name of the application.
   * @param isFirstParty - Whether this is a first-party application. Third-party applications require an organization_id.
   * @param description - A description for the application.
   * @param scopes - The OAuth scopes granted to the application.
   * @param redirectUris - Redirect URIs for the application.
   * @param usesPkce - Whether the application uses PKCE (Proof Key for Code Exchange).
   * @param organizationId - The organization ID this application belongs to. Required when is_first_party is false.
   * @returns {Promise<ConnectApplication>}
   */
  createOAuthApplication(name: string, isFirstParty: boolean, description?: string | null, scopes?: string[] | null, redirectUris?: RedirectUriInput[] | null, usesPkce?: boolean | null, organizationId?: string | null): Promise<ConnectApplication>;
  /**
   * Create m2m application.
   * @param name - The name of the application.
   * @param organizationId - The organization ID this application belongs to.
   * @param description - A description for the application.
   * @param scopes - The OAuth scopes granted to the application.
   * @returns {Promise<ConnectApplication>}
   */
  createM2MApplication(name: string, organizationId: string, description?: string | null, scopes?: string[] | null): Promise<ConnectApplication>;
  /**
   * Get a Connect Application
   *
   * Retrieve details for a specific Connect Application by ID or client ID.
   * @param options - The request options.
   * @param options.id - The application ID or client ID of the Connect Application.
   * @example "conn_app_01HXYZ123456789ABCDEFGHIJ"
   * @returns {Promise<ConnectApplication>}
   * @throws {NotFoundException} 404
   */
  getApplication(options: GetApplicationOptions): Promise<ConnectApplication>;
  /**
   * Update a Connect Application
   *
   * Update an existing Connect Application. For OAuth applications, you can update redirect URIs. For all applications, you can update the name, description, and scopes.
   * @param options - The request body.
   * @param options.id - The application ID or client ID of the Connect Application.
   * @example "conn_app_01HXYZ123456789ABCDEFGHIJ"
   * @param options.name - The name of the application.
   * @example "My Application"
   * @param options.description - A description for the application.
   * @example "An application for managing user access"
   * @param options.scopes - The OAuth scopes granted to the application.
   * @example ["openid","profile","email"]
   * @param options.redirectUris - Updated redirect URIs for the application. OAuth applications only.
   * @example [{"uri":"https://example.com/callback","default":true}]
   * @returns {Promise<ConnectApplication>}
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  updateApplication(options: UpdateApplicationOptions): Promise<ConnectApplication>;
  /**
   * Delete a Connect Application
   *
   * Delete an existing Connect Application.
   * @param options - The request options.
   * @param options.id - The application ID or client ID of the Connect Application.
   * @example "conn_app_01HXYZ123456789ABCDEFGHIJ"
   * @returns {Promise<void>}
   * @throws {NotFoundException} 404
   */
  deleteApplication(options: DeleteApplicationOptions): Promise<void>;
  /**
   * List Client Secrets for a Connect Application
   *
   * List all client secrets associated with a Connect Application.
   * @param options - The request options.
   * @param options.id - The application ID or client ID of the Connect Application.
   * @example "conn_app_01HXYZ123456789ABCDEFGHIJ"
   * @returns {Promise<ApplicationCredentialsListItem[]>}
   * @throws {NotFoundException} 404
   */
  listApplicationClientSecrets(options: ListApplicationClientSecretsOptions): Promise<ApplicationCredentialsListItem[]>;
  /**
   * Create a new client secret for a Connect Application
   *
   * Create new secrets for a Connect Application.
   * @param options - The request body.
   * @param options.id - The application ID or client ID of the Connect Application.
   * @example "conn_app_01HXYZ123456789ABCDEFGHIJ"
   * @returns {Promise<NewConnectApplicationSecret>}
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  createApplicationClientSecret(options: CreateApplicationClientSecretOptions): Promise<NewConnectApplicationSecret>;
  /**
   * Delete a Client Secret
   *
   * Delete (revoke) an existing client secret.
   * @param options - The request options.
   * @param options.id - The unique ID of the client secret.
   * @example "secret_01J9Q2Z3X4Y5W6V7U8T9S0R1Q"
   * @returns {Promise<void>}
   * @throws {NotFoundException} 404
   */
  deleteClientSecret(options: DeleteClientSecretOptions): Promise<void>;
}
//#endregion
//#region src/directory-sync/directory-sync.d.ts
declare class DirectorySync {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * List Directories
   *
   * Get a list of all of your existing directories matching the criteria specified.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<Directory, SerializedListDirectoriesOptions>>}
   * @throws 403 response from the API.
   * @throws {UnprocessableEntityException} 422
   */
  listDirectories(options?: ListDirectoriesOptions): Promise<AutoPaginatable<Directory, SerializedListDirectoriesOptions>>;
  /**
   * Get a Directory
   *
   * Get the details of an existing directory.
   * @param id - Unique identifier for the Directory.
   *
   * @example
   * "directory_01ECAZ4NV9QMV47GW873HDCX74"
   *
   * @returns {Promise<Directory>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  getDirectory(id: string): Promise<Directory>;
  /**
   * Delete a Directory
   *
   * Permanently deletes an existing directory. It cannot be undone.
   * @param id - Unique identifier for the Directory.
   *
   * @example
   * "directory_01ECAZ4NV9QMV47GW873HDCX74"
   *
   * @returns {Promise<void>}
   * @throws 403 response from the API.
   */
  deleteDirectory(id: string): Promise<void>;
  /**
   * List Directory Groups
   *
   * Get a list of all of existing directory groups matching the criteria specified.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<DirectoryGroup, ListDirectoryGroupsOptions>>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  listGroups(options: ListDirectoryGroupsOptions): Promise<AutoPaginatable<DirectoryGroup, ListDirectoryGroupsOptions>>;
  /**
   * List Directory Users
   *
   * Get a list of all of existing Directory Users matching the criteria specified.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<DirectoryUserWithGroups<TCustomAttributes>, ListDirectoryUsersOptions>>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   * @throws {RateLimitExceededException} 429
   */
  listUsers<TCustomAttributes extends object = DefaultCustomAttributes>(options: ListDirectoryUsersOptions): Promise<AutoPaginatable<DirectoryUserWithGroups<TCustomAttributes>, ListDirectoryUsersOptions>>;
  /**
   * Get a Directory User
   *
   * Get the details of an existing Directory User.
   * @param user - Unique identifier for the Directory User.
   *
   * @example
   * "directory_user_01E1JG7J09H96KYP8HM9B0G5SJ"
   * @returns {Promise<DirectoryUserWithGroups<TCustomAttributes>>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  getUser<TCustomAttributes extends object = DefaultCustomAttributes>(user: string): Promise<DirectoryUserWithGroups<TCustomAttributes>>;
  /**
   * Get a Directory Group
   *
   * Get the details of an existing Directory Group.
   * @param group - Unique identifier for the Directory Group.
   *
   * @example
   * "directory_group_01E1JJS84MFPPQ3G655FHTKX6Z"
   * @returns {Promise<DirectoryGroup>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  getGroup(group: string): Promise<DirectoryGroup>;
}
//#endregion
//#region src/events/interfaces/list-events-options.interface.d.ts
interface ListEventOptions {
  events: EventName[];
  rangeStart?: string;
  rangeEnd?: string;
  limit?: number;
  after?: string;
  organizationId?: string;
  order?: 'asc' | 'desc';
}
interface SerializedListEventOptions {
  events: EventName[];
  range_start?: string;
  range_end?: string;
  limit?: number;
  after?: string;
  organization_id?: string;
  order?: 'asc' | 'desc';
}
//#endregion
//#region src/events/events.d.ts
declare class Events {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * List events
   *
   * List events for the current environment.
   * @param options - Pagination and filter options.
   * @returns {Promise<List<Event>>}
   * @throws {BadRequestException} 400
   * @throws {UnprocessableEntityException} 422
   */
  listEvents(options: ListEventOptions): Promise<List<Event>>;
}
//#endregion
//#region src/organizations/organizations.d.ts
declare class Organizations {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * List Organizations
   *
   * Get a list of all of your existing organizations matching the criteria specified.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<Organization, ListOrganizationsOptions>>}
   * @throws {UnprocessableEntityException} 422
   */
  listOrganizations(options?: ListOrganizationsOptions): Promise<AutoPaginatable<Organization, ListOrganizationsOptions>>;
  /**
   * Create an Organization
   *
   * Creates a new organization in the current environment.
   * @param payload - Object containing name.
   * @returns {Promise<Organization>}
   * @throws {BadRequestException} 400
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  createOrganization(payload: CreateOrganizationOptions, requestOptions?: CreateOrganizationRequestOptions): Promise<Organization>;
  /**
   * Delete an Organization
   *
   * Permanently deletes an organization in the current environment. It cannot be undone.
   * @param id - Unique identifier of the Organization.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @returns {Promise<void>}
   * @throws 403 response from the API.
   */
  deleteOrganization(id: string): Promise<void>;
  /**
   * Get an Organization
   *
   * Get the details of an existing organization.
   * @param id - Unique identifier of the Organization.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @returns {Promise<Organization>}
   * @throws {NotFoundException} 404
   */
  getOrganization(id: string): Promise<Organization>;
  /**
   * Get an Organization by External ID
   *
   * Get the details of an existing organization by an [external identifier](https://workos.com/docs/authkit/metadata/external-identifiers).
   * @param externalId - The external ID of the Organization.
   *
   * @example
   * "2fe01467-f7ea-4dd2-8b79-c2b4f56d0191"
   *
   * @returns {Promise<Organization>}
   * @throws {NotFoundException} 404
   */
  getOrganizationByExternalId(externalId: string): Promise<Organization>;
  /**
   * Update an Organization
   *
   * Updates an organization in the current environment.
   * @param payload - The request body.
   * @returns {Promise<Organization>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  updateOrganization(options: UpdateOrganizationOptions): Promise<Organization>;
}
//#endregion
//#region src/organization-domains/organization-domains.d.ts
declare class OrganizationDomains {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * Get an Organization Domain
   *
   * Get the details of an existing organization domain.
   * @param id - Unique identifier of the organization domain.
   *
   * @example
   * "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A"
   *
   * @returns {Promise<OrganizationDomain>}
   * @throws {NotFoundException} 404
   */
  getOrganizationDomain(id: string): Promise<OrganizationDomain>;
  /**
   * Verify an Organization Domain
   *
   * Initiates verification process for an Organization Domain.
   * @param id - Unique identifier of the organization domain.
   *
   * @example
   * "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A"
   *
   * @returns {Promise<OrganizationDomain>}
   * @throws {BadRequestException} 400
   */
  verifyOrganizationDomain(id: string): Promise<OrganizationDomain>;
  /**
   * Create an Organization Domain
   *
   * Creates a new Organization Domain.
   * @param payload - Object containing domain, organizationId.
   * @returns {Promise<OrganizationDomain>}
   * @throws {ConflictException} 409
   */
  createOrganizationDomain(payload: CreateOrganizationDomainOptions): Promise<OrganizationDomain>;
  /**
   * Delete an Organization Domain
   *
   * Permanently deletes an organization domain. It cannot be undone.
   * @param id - Unique identifier of the organization domain.
   *
   * @example
   * "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A"
   *
   * @returns {Promise<void>}
   * @throws {NotFoundException} 404
   */
  deleteOrganizationDomain(id: string): Promise<void>;
}
//#endregion
//#region src/passwordless/interfaces/passwordless-session.interface.d.ts
interface PasswordlessSession {
  id: string;
  email: string;
  expiresAt: Date;
  link: string;
  object: 'passwordless_session';
}
interface PasswordlessSessionResponse {
  id: string;
  email: string;
  expires_at: Date;
  link: string;
  object: 'passwordless_session';
}
//#endregion
//#region src/passwordless/interfaces/create-passwordless-session-options.interface.d.ts
interface CreatePasswordlessSessionOptions {
  type: 'MagicLink';
  email: string;
  redirectURI?: string;
  state?: string;
  connection?: string;
  expiresIn?: number;
}
interface SerializedCreatePasswordlessSessionOptions {
  type: 'MagicLink';
  email: string;
  redirect_uri?: string;
  state?: string;
  connection?: string;
  expires_in?: number;
}
//#endregion
//#region src/passwordless/interfaces/send-session-response.interface.d.ts
interface SendSessionResponse {
  message?: string;
  success?: boolean;
}
//#endregion
//#region src/passwordless/passwordless.d.ts
declare class Passwordless {
  private readonly workos;
  constructor(workos: WorkOS);
  createSession({ redirectURI, expiresIn, ...options }: CreatePasswordlessSessionOptions): Promise<PasswordlessSession>;
  sendSession(sessionId: string): Promise<SendSessionResponse>;
}
//#endregion
//#region src/pipes/interfaces/data-integration-credentials-type.interface.d.ts
declare const DataIntegrationCredentialsType: {
  readonly Custom: "custom";
  readonly Organization: "organization";
};
type DataIntegrationCredentialsType = (typeof DataIntegrationCredentialsType)[keyof typeof DataIntegrationCredentialsType];
//#endregion
//#region src/pipes/interfaces/data-integration-credentials-dto.interface.d.ts
interface DataIntegrationCredentialsDto {
  /** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (configured per-organization). */
  type: DataIntegrationCredentialsType;
  /** OAuth client ID for the provider app. Required when `type` is `custom`; omit for `organization`. */
  clientId?: string;
  /** OAuth client secret for the provider app. Required when `type` is `custom`; omit for `organization`. */
  clientSecret?: string;
}
interface DataIntegrationCredentialsDtoResponse {
  type: DataIntegrationCredentialsType;
  client_id?: string;
  client_secret?: string;
}
//#endregion
//#region src/pipes/interfaces/custom-provider-definition-authenticate-via.interface.d.ts
declare const CustomProviderDefinitionAuthenticateVia: {
  readonly RequestBody: "request_body";
  readonly BasicAuthHeader: "basic_auth_header";
};
type CustomProviderDefinitionAuthenticateVia = (typeof CustomProviderDefinitionAuthenticateVia)[keyof typeof CustomProviderDefinitionAuthenticateVia];
//#endregion
//#region src/pipes/interfaces/custom-provider-definition.interface.d.ts
interface CustomProviderDefinition {
  /** A descriptive name for the custom provider. */
  name: string;
  /** The provider's OAuth authorization endpoint. */
  authorizationUrl: string;
  /** The provider's OAuth token endpoint. */
  tokenUrl: string;
  /** The endpoint used to refresh tokens, if different from the token endpoint. */
  refreshTokenUrl?: string | null;
  /** Whether PKCE is used during the authorization code flow. Defaults to `true`. */
  pkceEnabled?: boolean;
  /** The separator used to join requested scopes. Defaults to a space. */
  requestScopeSeparator?: string;
  /** Whether at least one scope must be selected when connecting an account. Defaults to `false`. */
  scopesRequired?: boolean;
  /** Whether a client secret is required for this provider. Defaults to `true`. */
  clientSecretRequired?: boolean;
  /** Additional static query parameters appended to the authorization request. */
  additionalAuthorizationParameters?: Record<string, string>;
  /** The Content-Type used when exchanging the token request. */
  tokenBodyContentType?: string;
  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
  authenticateVia?: CustomProviderDefinitionAuthenticateVia;
}
interface CustomProviderDefinitionResponse {
  name: string;
  authorization_url: string;
  token_url: string;
  refresh_token_url?: string | null;
  pkce_enabled?: boolean;
  request_scope_separator?: string;
  scopes_required?: boolean;
  client_secret_required?: boolean;
  additional_authorization_parameters?: Record<string, string>;
  token_body_content_type?: string;
  authenticate_via?: CustomProviderDefinitionAuthenticateVia;
}
//#endregion
//#region src/pipes/interfaces/create-data-integration-options.interface.d.ts
interface CreateDataIntegrationOptions {
  /** The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug. */
  provider: string;
  /** An optional description of the Data Integration. */
  description?: string | null;
  /** Whether the Data Integration is enabled. Defaults to `false`. */
  enabled?: boolean;
  /** The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted. */
  scopes?: string[] | null;
  /** The credentials to configure for the Data Integration. Required for both built-in and custom providers. */
  credentials?: DataIntegrationCredentialsDto;
  /** The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider. */
  customProvider?: CustomProviderDefinition;
}
//#endregion
//#region src/pipes/interfaces/get-data-integration-options.interface.d.ts
interface GetDataIntegrationOptions {
  /** The slug identifier of the data integration. */
  slug: string;
}
//#endregion
//#region src/pipes/interfaces/update-custom-provider-definition-authenticate-via.interface.d.ts
declare const UpdateCustomProviderDefinitionAuthenticateVia: {
  readonly RequestBody: "request_body";
  readonly BasicAuthHeader: "basic_auth_header";
};
type UpdateCustomProviderDefinitionAuthenticateVia = (typeof UpdateCustomProviderDefinitionAuthenticateVia)[keyof typeof UpdateCustomProviderDefinitionAuthenticateVia];
//#endregion
//#region src/pipes/interfaces/update-custom-provider-definition.interface.d.ts
interface UpdateCustomProviderDefinition {
  /** A descriptive name for the custom provider. */
  name?: string;
  /** The provider's OAuth authorization endpoint. */
  authorizationUrl?: string;
  /** The provider's OAuth token endpoint. */
  tokenUrl?: string;
  /** The endpoint used to refresh tokens, if different from the token endpoint. */
  refreshTokenUrl?: string | null;
  /** Whether PKCE is used during the authorization code flow. */
  pkceEnabled?: boolean;
  /** The separator used to join requested scopes. */
  requestScopeSeparator?: string;
  /** Whether at least one scope must be selected when connecting an account. */
  scopesRequired?: boolean;
  /** Whether a client secret is required for this provider. */
  clientSecretRequired?: boolean;
  /** Additional static query parameters appended to the authorization request. */
  additionalAuthorizationParameters?: Record<string, string>;
  /** The Content-Type used when exchanging the token request. */
  tokenBodyContentType?: string;
  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
  authenticateVia?: UpdateCustomProviderDefinitionAuthenticateVia;
}
interface UpdateCustomProviderDefinitionResponse {
  name?: string;
  authorization_url?: string;
  token_url?: string;
  refresh_token_url?: string | null;
  pkce_enabled?: boolean;
  request_scope_separator?: string;
  scopes_required?: boolean;
  client_secret_required?: boolean;
  additional_authorization_parameters?: Record<string, string>;
  token_body_content_type?: string;
  authenticate_via?: UpdateCustomProviderDefinitionAuthenticateVia;
}
//#endregion
//#region src/pipes/interfaces/update-data-integration-options.interface.d.ts
interface UpdateDataIntegrationOptions {
  /** The slug identifier of the data integration. */
  slug: string;
  /** An optional description of the Data Integration. */
  description?: string | null;
  /** Whether the Data Integration is enabled. */
  enabled?: boolean;
  /** The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes. */
  scopes?: string[] | null;
  /** New credentials for the Data Integration. When provided, rotates the stored client secret. */
  credentials?: DataIntegrationCredentialsDto;
  /** Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations. */
  customProvider?: UpdateCustomProviderDefinition;
}
//#endregion
//#region src/pipes/interfaces/delete-data-integration-options.interface.d.ts
interface DeleteDataIntegrationOptions {
  /** The slug identifier of the data integration. */
  slug: string;
}
//#endregion
//#region src/pipes/interfaces/update-data-integration-api-key-options.interface.d.ts
interface UpdateDataIntegrationApiKeyOptions {
  /** The identifier of the integration. */
  slug: string;
  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
  userId: string;
  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
  organizationId?: string;
  /** The API key secret to store for this integration. */
  secret: string;
}
//#endregion
//#region src/pipes/interfaces/authorize-data-integration-options.interface.d.ts
interface AuthorizeDataIntegrationOptions {
  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
  slug: string;
  /** The ID of the user to authorize. */
  userId: string;
  /** An organization ID to scope the authorization to a specific organization. */
  organizationId?: string;
  /** The URL to redirect the user to after authorization. */
  returnTo?: string;
}
//#endregion
//#region src/pipes/interfaces/create-data-integration-credential-options.interface.d.ts
interface CreateDataIntegrationCredentialOptions {
  /** The identifier of the integration. */
  slug: string;
  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
  userId: string;
  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
  organizationId?: string;
}
//#endregion
//#region src/pipes/interfaces/get-access-token-options.interface.d.ts
interface GetAccessTokenOptions {
  /** The identifier of the integration. */
  provider: string;
  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
  userId: string;
  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
  organizationId?: string | null;
}
//#endregion
//#region src/pipes/interfaces/get-user-connected-account-options.interface.d.ts
interface GetUserConnectedAccountOptions {
  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
  userId: string;
  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
  slug: string;
  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
  organizationId?: string;
}
//#endregion
//#region src/pipes/interfaces/connected-account-state.interface.d.ts
declare const ConnectedAccountState: {
  readonly Connected: "connected";
  readonly NeedsReauthorization: "needs_reauthorization";
};
type ConnectedAccountState = (typeof ConnectedAccountState)[keyof typeof ConnectedAccountState];
//#endregion
//#region src/pipes/interfaces/create-user-connected-account-options.interface.d.ts
interface CreateUserConnectedAccountOptions {
  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
  userId: string;
  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
  slug: string;
  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
  organizationId?: string;
  /** The OAuth access token for the connected account. */
  accessToken?: string;
  /** The OAuth refresh token for the connected account. */
  refreshToken?: string;
  /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
  expiresAt?: Date;
  /** The OAuth scopes granted for this connection. */
  scopes?: string[];
  /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
  state?: ConnectedAccountState;
}
//#endregion
//#region src/pipes/interfaces/update-user-connected-account-options.interface.d.ts
interface UpdateUserConnectedAccountOptions {
  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
  userId: string;
  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
  slug: string;
  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
  organizationId?: string;
  /** The OAuth access token for the connected account. */
  accessToken?: string;
  /** The OAuth refresh token for the connected account. */
  refreshToken?: string;
  /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
  expiresAt?: Date;
  /** The OAuth scopes granted for this connection. */
  scopes?: string[];
  /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
  state?: ConnectedAccountState;
}
//#endregion
//#region src/pipes/interfaces/delete-user-connected-account-options.interface.d.ts
interface DeleteUserConnectedAccountOptions {
  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
  userId: string;
  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
  slug: string;
  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
  organizationId?: string;
}
//#endregion
//#region src/pipes/interfaces/list-user-data-providers-options.interface.d.ts
interface ListUserDataProvidersOptions {
  /** A [User](https://workos.com/docs/reference/authkit/user) identifier to list providers and connected accounts for. */
  userId: string;
  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to filter connections for a specific organization. */
  organizationId?: string;
}
//#endregion
//#region src/pipes/interfaces/data-integration-credential-type.interface.d.ts
declare const DataIntegrationCredentialType: {
  readonly Custom: "custom";
  readonly Organization: "organization";
};
type DataIntegrationCredentialType = (typeof DataIntegrationCredentialType)[keyof typeof DataIntegrationCredentialType];
//#endregion
//#region src/pipes/interfaces/data-integration-credential.interface.d.ts
/** The credentials configured for the Data Integration. */
interface DataIntegrationCredential {
  /** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (so `client_id`/`redacted_client_secret` are null on the integration itself). */
  type: DataIntegrationCredentialType;
  /** The OAuth client ID configured for the provider app. Null for `organization` credentials. */
  clientId: string | null;
  /** The last four characters of the OAuth client secret. The full secret is never returned. Null for `organization` credentials. */
  redactedClientSecret: string | null;
}
interface DataIntegrationCredentialResponse {
  type: DataIntegrationCredentialType;
  client_id: string | null;
  redacted_client_secret: string | null;
}
//#endregion
//#region src/pipes/interfaces/data-integration-custom-provider-authenticate-via.interface.d.ts
declare const DataIntegrationCustomProviderAuthenticateVia: {
  readonly RequestBody: "request_body";
  readonly BasicAuthHeader: "basic_auth_header";
};
type DataIntegrationCustomProviderAuthenticateVia = (typeof DataIntegrationCustomProviderAuthenticateVia)[keyof typeof DataIntegrationCustomProviderAuthenticateVia];
//#endregion
//#region src/pipes/interfaces/data-integration-custom-provider.interface.d.ts
interface DataIntegrationCustomProvider {
  /** A descriptive name for the custom provider. */
  name: string;
  /** The provider's OAuth authorization endpoint. */
  authorizationUrl: string | null;
  /** The provider's OAuth token endpoint. */
  tokenUrl: string | null;
  /** The endpoint used to refresh tokens, if different from the token endpoint. */
  refreshTokenUrl: string | null;
  /** Whether PKCE is used during the authorization code flow. */
  pkceEnabled: boolean;
  /** The separator used to join requested scopes. */
  requestScopeSeparator: string;
  /** Whether at least one scope must be selected when connecting an account. */
  scopesRequired: boolean;
  /** Whether a client secret is required for this provider. */
  clientSecretRequired: boolean;
  /** Additional static query parameters appended to the authorization request. */
  additionalAuthorizationParameters: Record<string, string>;
  /** The Content-Type used when exchanging the token request. */
  tokenBodyContentType: string;
  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
  authenticateVia: DataIntegrationCustomProviderAuthenticateVia;
}
interface DataIntegrationCustomProviderResponse {
  name: string;
  authorization_url: string | null;
  token_url: string | null;
  refresh_token_url: string | null;
  pkce_enabled: boolean;
  request_scope_separator: string;
  scopes_required: boolean;
  client_secret_required: boolean;
  additional_authorization_parameters: Record<string, string>;
  token_body_content_type: string;
  authenticate_via: DataIntegrationCustomProviderAuthenticateVia;
}
//#endregion
//#region src/pipes/interfaces/data-integration-state.interface.d.ts
declare const DataIntegrationState: {
  readonly Valid: "valid";
  readonly Invalid: "invalid";
  readonly Requested: "requested";
};
type DataIntegrationState = (typeof DataIntegrationState)[keyof typeof DataIntegrationState];
//#endregion
//#region src/pipes/interfaces/data-integration.interface.d.ts
interface DataIntegration {
  /** Distinguishes the Data Integration object. */
  object: 'data_integration';
  /** Unique identifier of the Data Integration. */
  id: string;
  /** The provider slug for this Data Integration. */
  slug: string;
  /** The integration type derived from the provider. */
  integrationType: string;
  /** An optional description of the Data Integration. */
  description: string | null;
  /** Whether the Data Integration is enabled. */
  enabled: boolean;
  /** The state of the Data Integration. */
  state: DataIntegrationState;
  /** The OAuth scopes configured for the Data Integration. `null` when the provider's configured scopes are used. */
  scopes: string[] | null;
  /** The OAuth redirect URI to register with the provider when configuring the custom application. */
  redirectUri: string;
  /** The credentials configured for the Data Integration. */
  credentials: DataIntegrationCredential;
  /** The OAuth definition when this is a custom provider; `null` for built-in providers. */
  customProvider: DataIntegrationCustomProvider | null;
  /** An ISO 8601 timestamp. */
  createdAt: Date;
  /** An ISO 8601 timestamp. */
  updatedAt: Date;
}
interface DataIntegrationResponse {
  object: 'data_integration';
  id: string;
  slug: string;
  integration_type: string;
  description: string | null;
  enabled: boolean;
  state: DataIntegrationState;
  scopes: string[] | null;
  redirect_uri: string;
  credentials: DataIntegrationCredentialResponse;
  custom_provider: DataIntegrationCustomProviderResponse | null;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/pipes/interfaces/connected-account-auth-method.interface.d.ts
declare const ConnectedAccountAuthMethod: {
  readonly OAuth: "oauth";
  readonly ApiKey: "api_key";
};
type ConnectedAccountAuthMethod = (typeof ConnectedAccountAuthMethod)[keyof typeof ConnectedAccountAuthMethod];
//#endregion
//#region src/pipes/interfaces/connected-account.interface.d.ts
interface ConnectedAccount {
  /** Distinguishes the connected account object. */
  object: 'connected_account';
  /** The unique identifier of the connected account. */
  id: string;
  /** The [User](https://workos.com/docs/reference/authkit/user) identifier associated with this connection. */
  userId: string | null;
  /** The [Organization](https://workos.com/docs/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
  organizationId: string | null;
  /** The OAuth scopes granted for this connection. */
  scopes: string[];
  /** The authentication method used for this connection (`oauth` or `api_key`). Defaults to `oauth` if absent. */
  authMethod?: ConnectedAccountAuthMethod;
  /** The last four characters of the API key, or `null` for OAuth connections. */
  apiKeyLast4?: string | null;
  /**
   * The state of the connected account:
   * - `connected`: The connection is active and tokens are valid.
   * - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed.
   * - `disconnected`: The connection has been disconnected.
   */
  state: ConnectedAccountState;
  /** The timestamp when the connection was created. */
  createdAt: string;
  /** The timestamp when the connection was last updated. */
  updatedAt: string;
}
interface ConnectedAccountResponse {
  object: 'connected_account';
  id: string;
  user_id: string | null;
  organization_id: string | null;
  scopes: string[];
  auth_method?: ConnectedAccountAuthMethod;
  api_key_last_4?: string | null;
  state: ConnectedAccountState;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/pipes/interfaces/data-integration-authorize-url-response.interface.d.ts
interface DataIntegrationAuthorizeUrlResponse {
  /** The OAuth authorization URL to redirect the user to. */
  url: string;
}
interface DataIntegrationAuthorizeUrlResponseWire {
  url: string;
}
//#endregion
//#region src/pipes/interfaces/data-integration-credentials-response-credential.interface.d.ts
/** The credential object containing the vended secret. */
interface DataIntegrationCredentialsResponseCredential {
  /** Distinguishes the credential object. */
  object: 'credential';
  /** The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully. */
  authMethod: 'oauth';
  /** The OAuth access token. */
  value: string;
  /** The ISO-8601 formatted timestamp indicating when the credential expires. */
  expiresAt: string | null;
  /** The scopes granted to the access token. */
  scopes: string[];
  /** If the integration has requested scopes that aren't present on the access token, they're listed here. */
  missingScopes: string[];
}
interface DataIntegrationCredentialsResponseCredentialResponse {
  object: 'credential';
  auth_method: 'oauth';
  value: string;
  expires_at: string | null;
  scopes: string[];
  missing_scopes: string[];
}
//#endregion
//#region src/pipes/interfaces/data-integration-credentials-response-error.interface.d.ts
declare const DataIntegrationCredentialsResponseError: {
  readonly NotInstalled: "not_installed";
  readonly NeedsReauthorization: "needs_reauthorization";
};
type DataIntegrationCredentialsResponseError = (typeof DataIntegrationCredentialsResponseError)[keyof typeof DataIntegrationCredentialsResponseError];
//#endregion
//#region src/pipes/interfaces/data-integration-credentials-response.interface.d.ts
interface DataIntegrationCredentialsResponse {
  /** Indicates credentials are available. */
  active?: true;
  /** The credential object containing the vended secret. */
  credential?: DataIntegrationCredentialsResponseCredential;
  /**
   * The reason credentials are unavailable. Additional values may be added in the future; handle unknown values gracefully.
   * - `"not_installed"`: The user does not have the integration installed.
   * - `"needs_reauthorization"`: The user needs to reauthorize the integration.
   */
  error?: DataIntegrationCredentialsResponseError;
}
//#endregion
//#region src/pipes/interfaces/data-integration-access-token-response-access-token.interface.d.ts
/** The [access token](https://workos.com/docs/reference/pipes/access-token) object, present when `active` is `true`. */
interface DataIntegrationAccessTokenResponseAccessToken {
  /** Distinguishes the access token object. */
  object: 'access_token';
  /** The OAuth access token for the connected integration. */
  accessToken: string;
  /** The ISO-8601 formatted timestamp indicating when the access token expires. */
  expiresAt: Date | null;
  /** The scopes granted to the access token. */
  scopes: string[];
  /** If the integration has requested scopes that aren't present on the access token, they're listed here. */
  missingScopes: string[];
}
interface DataIntegrationAccessTokenResponseAccessTokenResponse {
  object: 'access_token';
  access_token: string;
  expires_at: string | null;
  scopes: string[];
  missing_scopes: string[];
}
//#endregion
//#region src/pipes/interfaces/data-integration-access-token-response.interface.d.ts
type DataIntegrationAccessTokenResponse = {
  active: true;
  accessToken: DataIntegrationAccessTokenResponseAccessToken;
} | {
  active: false;
  error: 'needs_reauthorization' | 'not_installed';
};
type DataIntegrationAccessTokenResponseWire = {
  active: true;
  access_token: DataIntegrationAccessTokenResponseAccessTokenResponse;
} | {
  active: false;
  error: 'needs_reauthorization' | 'not_installed';
};
//#endregion
//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account-auth-method.interface.d.ts
declare const DataIntegrationsListResponseDataConnectedAccountAuthMethod: {
  readonly OAuth: "oauth";
  readonly ApiKey: "api_key";
};
type DataIntegrationsListResponseDataConnectedAccountAuthMethod = (typeof DataIntegrationsListResponseDataConnectedAccountAuthMethod)[keyof typeof DataIntegrationsListResponseDataConnectedAccountAuthMethod];
//#endregion
//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account-state.interface.d.ts
declare const DataIntegrationsListResponseDataConnectedAccountState: {
  readonly Connected: "connected";
  readonly NeedsReauthorization: "needs_reauthorization";
  readonly Disconnected: "disconnected";
};
type DataIntegrationsListResponseDataConnectedAccountState = (typeof DataIntegrationsListResponseDataConnectedAccountState)[keyof typeof DataIntegrationsListResponseDataConnectedAccountState];
//#endregion
//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account.interface.d.ts
interface DataIntegrationsListResponseDataConnectedAccount {
  /** Distinguishes the connected account object. */
  object: 'connected_account';
  /** The unique identifier of the connected account. */
  id: string;
  /** The [User](https://workos.com/docs/reference/authkit/user) identifier associated with this connection. */
  userId: string | null;
  /** The [Organization](https://workos.com/docs/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
  organizationId: string | null;
  /** The OAuth scopes granted for this connection. */
  scopes: string[];
  /** The authentication method used for this connection (`oauth` or `api_key`). Defaults to `oauth` if absent. */
  authMethod?: DataIntegrationsListResponseDataConnectedAccountAuthMethod;
  /** The last four characters of the API key, or `null` for OAuth connections. */
  apiKeyLast4?: string | null;
  /**
   * The state of the connected account:
   * - `connected`: The connection is active and tokens are valid.
   * - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed.
   * - `disconnected`: The connection has been disconnected.
   */
  state: DataIntegrationsListResponseDataConnectedAccountState;
  /** The timestamp when the connection was created. */
  createdAt: string;
  /** The timestamp when the connection was last updated. */
  updatedAt: string;
  /**
   * Use `user_id` instead.
   * @deprecated
   */
  userlandUserId: string | null;
}
interface DataIntegrationsListResponseDataConnectedAccountResponse {
  object: 'connected_account';
  id: string;
  user_id: string | null;
  organization_id: string | null;
  scopes: string[];
  auth_method?: DataIntegrationsListResponseDataConnectedAccountAuthMethod;
  api_key_last_4?: string | null;
  state: DataIntegrationsListResponseDataConnectedAccountState;
  created_at: string;
  updated_at: string;
  userland_user_id: string | null;
}
//#endregion
//#region src/pipes/interfaces/data-integrations-list-response-data-auth-methods.interface.d.ts
declare const DataIntegrationsListResponseDataAuthMethods: {
  readonly OAuth: "oauth";
  readonly ApiKey: "api_key";
};
type DataIntegrationsListResponseDataAuthMethods = (typeof DataIntegrationsListResponseDataAuthMethods)[keyof typeof DataIntegrationsListResponseDataAuthMethods];
//#endregion
//#region src/pipes/interfaces/data-integrations-list-response-data-ownership.interface.d.ts
declare const DataIntegrationsListResponseDataOwnership: {
  readonly UserlandUser: "userland_user";
  readonly Organization: "organization";
};
type DataIntegrationsListResponseDataOwnership = (typeof DataIntegrationsListResponseDataOwnership)[keyof typeof DataIntegrationsListResponseDataOwnership];
//#endregion
//#region src/pipes/interfaces/data-integrations-list-response-data.interface.d.ts
interface DataIntegrationsListResponseData {
  /** Distinguishes the data provider object. */
  object: 'data_provider';
  /** The unique identifier of the provider. */
  id: string;
  /** The display name of the provider (e.g., "GitHub", "Slack"). */
  name: string;
  /** A description of the provider explaining how it will be used, if configured. */
  description: string | null;
  /** The slug identifier used in API calls (e.g., `github`, `slack`, `notion`). */
  slug: string;
  /** The type of integration (e.g., `github`, `slack`). */
  integrationType: string;
  /** The type of credentials used by the provider (e.g., `oauth2`). */
  credentialsType: string;
  /** The OAuth scopes configured for this provider, or `null` if none are configured. */
  scopes: string[] | null;
  /** The authentication methods supported by this provider (`oauth`, `api_key`, or both). Defaults to `["oauth"]` if absent. */
  authMethods?: DataIntegrationsListResponseDataAuthMethods[];
  /** Whether the provider is owned by a user or organization. */
  ownership: DataIntegrationsListResponseDataOwnership;
  /** The timestamp when the provider was created. */
  createdAt: string;
  /** The timestamp when the provider was last updated. */
  updatedAt: string;
  /** The user's [connected account](https://workos.com/docs/reference/pipes/connected-account) for this provider, or `null` if the user has not connected. */
  connectedAccount: DataIntegrationsListResponseDataConnectedAccount | null;
}
interface DataIntegrationsListResponseDataResponse {
  object: 'data_provider';
  id: string;
  name: string;
  description: string | null;
  slug: string;
  integration_type: string;
  credentials_type: string;
  scopes: string[] | null;
  auth_methods?: DataIntegrationsListResponseDataAuthMethods[];
  ownership: DataIntegrationsListResponseDataOwnership;
  created_at: string;
  updated_at: string;
  connected_account: DataIntegrationsListResponseDataConnectedAccountResponse | null;
}
//#endregion
//#region src/pipes/interfaces/data-integrations-list-response.interface.d.ts
interface DataIntegrationsListResponse {
  /** Indicates this is a list response. */
  object: 'list';
  /** A list of [providers](https://workos.com/docs/reference/pipes/provider), each including a [`connected_account`](https://workos.com/docs/reference/pipes/connected-account) field with the user's connection status. */
  data: DataIntegrationsListResponseData[];
}
interface DataIntegrationsListResponseWire {
  object: 'list';
  data: DataIntegrationsListResponseDataResponse[];
}
//#endregion
//#region src/pipes/pipes.d.ts
declare class Pipes {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * List data integrations
   *
   * Lists the environment's data integrations configured with `custom` or `organization` credentials, including custom providers.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<DataIntegration, PaginationOptions>>}
   * @throws {UnauthorizedException} 401
   */
  listDataIntegrations(options?: PaginationOptions): Promise<AutoPaginatable<DataIntegration, PaginationOptions>>;
  /**
   * Create a data integration
   *
   * Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials, or `organization` to have each organization supply its own. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition.
   * @param options - Object containing provider.
   * @param options.provider - The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug.
   * @example "github"
   * @param options.description - An optional description of the Data Integration.
   * @example "Production GitHub app"
   * @param options.enabled - Whether the Data Integration is enabled. Defaults to `false`.
   * @example true
   * @param options.scopes - The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted.
   * @example ["repo","read:org"]
   * @param options.credentials - The credentials to configure for the Data Integration. Required for both built-in and custom providers.
   * @param options.customProvider - The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider.
   * @returns {Promise<DataIntegration>}
   * @throws {BadRequestException} 400
   * @throws {UnauthorizedException} 401
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  createDataIntegration(options: CreateDataIntegrationOptions): Promise<DataIntegration>;
  /**
   * Get a data integration
   *
   * Retrieves a data integration by its slug.
   * @param options - The request options.
   * @param options.slug - The slug identifier of the data integration.
   * @example "github"
   * @returns {Promise<DataIntegration>}
   * @throws {UnauthorizedException} 401
   * @throws {NotFoundException} 404
   */
  getDataIntegration(options: GetDataIntegrationOptions): Promise<DataIntegration>;
  /**
   * Update a data integration
   *
   * Updates the description, enabled state, or custom credentials of a data integration. For custom providers, `custom_provider` updates the OAuth definition.
   * @param options - The request body.
   * @param options.slug - The slug identifier of the data integration.
   * @example "github"
   * @param options.description - An optional description of the Data Integration.
   * @example "Production GitHub app"
   * @param options.enabled - Whether the Data Integration is enabled.
   * @example true
   * @param options.scopes - The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes.
   * @example ["repo","read:org"]
   * @param options.credentials - New credentials for the Data Integration. When provided, rotates the stored client secret.
   * @param options.customProvider - Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations.
   * @returns {Promise<DataIntegration>}
   * @throws {BadRequestException} 400
   * @throws {UnauthorizedException} 401
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  updateDataIntegration(options: UpdateDataIntegrationOptions): Promise<DataIntegration>;
  /**
   * Delete a data integration
   *
   * Deletes a data integration and all of its connected installations. For a custom provider, also deletes the custom provider definition.
   * @param options - The request options.
   * @param options.slug - The slug identifier of the data integration.
   * @example "github"
   * @returns {Promise<void>}
   * @throws {UnauthorizedException} 401
   * @throws {NotFoundException} 404
   */
  deleteDataIntegration(options: DeleteDataIntegrationOptions): Promise<void>;
  /**
   * Upsert an API key for a connected account
   *
   * Creates or updates an API-key-based installation for the specified integration and user. If an installation already exists, the stored API key is rotated to the new value.
   * @param options - Object containing userId, secret.
   * @param options.slug - The identifier of the integration.
   * @example "github"
   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.secret - The API key secret to store for this integration.
   * @example "sk-1234567890abcdef"
   * @returns {Promise<ConnectedAccount>}
   * @throws {BadRequestException} 400
   * @throws {UnauthorizedException} 401
   * @throws {AuthorizationException} 403
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  updateDataIntegrationApiKey(options: UpdateDataIntegrationApiKeyOptions): Promise<ConnectedAccount>;
  /**
   * Get authorization URL
   *
   * Generates an OAuth authorization URL to initiate the connection flow for a user. Redirect the user to the returned URL to begin the OAuth flow with the third-party provider.
   * @param options - Object containing userId.
   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
   * @example "github"
   * @param options.userId - The ID of the user to authorize.
   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.organizationId - An organization ID to scope the authorization to a specific organization.
   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.returnTo - The URL to redirect the user to after authorization.
   * @example "https://example.com/callback"
   * @returns {Promise<DataIntegrationAuthorizeUrlResponse>}
   * @throws {BadRequestException} 400
   * @throws {UnauthorizedException} 401
   * @throws {AuthorizationException} 403
   * @throws {NotFoundException} 404
   */
  authorizeDataIntegration(options: AuthorizeDataIntegrationOptions): Promise<DataIntegrationAuthorizeUrlResponse>;
  /**
   * Vend credentials for a connected account
   *
   * Returns credentials for a user's connected account. Branches on the installation's `auth_method`: OAuth installations return an access token (refreshed if needed); API-key installations return the stored secret.
   * @param options - Object containing userId.
   * @param options.slug - The identifier of the integration.
   * @example "github"
   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
   * @returns {Promise<DataIntegrationCredentialsResponse>}
   * @throws {BadRequestException} 400
   * @throws {UnauthorizedException} 401
   * @throws {NotFoundException} 404
   */
  createDataIntegrationCredential(options: CreateDataIntegrationCredentialOptions): Promise<DataIntegrationCredentialsResponse>;
  /**
   * Get an access token for a connected account
   *
   * Fetches a valid OAuth access token for a user's connected account. WorkOS automatically handles token refresh, ensuring you always receive a valid, non-expired token.
   * @param options - Object containing userId.
   * @param options.provider - The identifier of the integration.
   * @example "github"
   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
   * @returns {Promise<DataIntegrationAccessTokenResponse>}
   * @throws {BadRequestException} 400
   * @throws {UnauthorizedException} 401
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  getAccessToken(options: GetAccessTokenOptions): Promise<DataIntegrationAccessTokenResponse>;
  /**
   * Get a connected account
   *
   * Retrieves a user's [connected account](https://workos.com/docs/reference/pipes/connected-account) for a specific provider.
   * @param options - Additional query options.
   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
   * @example "github"
   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
   * @returns {Promise<ConnectedAccount>}
   * @throws {UnauthorizedException} 401
   * @throws {NotFoundException} 404
   */
  getUserConnectedAccount(options: GetUserConnectedAccountOptions): Promise<ConnectedAccount>;
  /**
   * Import a connected account
   *
   * Imports a [connected account](https://workos.com/docs/reference/pipes/connected-account) for a user by providing OAuth tokens directly. Use this to migrate existing connections or set up connections without going through the OAuth flow.
   * @param options - The request body.
   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
   * @example "github"
   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.accessToken - The OAuth access token for the connected account.
   * @example "gho_16C7e42F292c6912E7710c838347Ae178B4a"
   * @param options.refreshToken - The OAuth refresh token for the connected account.
   * @example "ghr_xxxxxxxxxxxxxxxxxxxx"
   * @param options.expiresAt - The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
   * @example "2025-12-31T23:59:59.000Z"
   * @param options.scopes - The OAuth scopes granted for this connection.
   * @example ["repo","user:email"]
   * @param options.state - Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
   * @example "connected"
   * @returns {Promise<ConnectedAccount>}
   * @throws {UnauthorizedException} 401
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  createUserConnectedAccount(options: CreateUserConnectedAccountOptions): Promise<ConnectedAccount>;
  /**
   * Update a connected account
   *
   * Updates a user's [connected account](https://workos.com/docs/reference/pipes/connected-account) tokens, scopes, or state for a specific provider.
   * @param options - The request body.
   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
   * @example "github"
   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.accessToken - The OAuth access token for the connected account.
   * @example "gho_16C7e42F292c6912E7710c838347Ae178B4a"
   * @param options.refreshToken - The OAuth refresh token for the connected account.
   * @example "ghr_xxxxxxxxxxxxxxxxxxxx"
   * @param options.expiresAt - The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
   * @example "2025-12-31T23:59:59.000Z"
   * @param options.scopes - The OAuth scopes granted for this connection.
   * @example ["repo","user:email"]
   * @param options.state - Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
   * @example "connected"
   * @returns {Promise<ConnectedAccount>}
   * @throws {UnauthorizedException} 401
   * @throws {NotFoundException} 404
   */
  updateUserConnectedAccount(options: UpdateUserConnectedAccountOptions): Promise<ConnectedAccount>;
  /**
   * Delete a connected account
   *
   * Disconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. This does not revoke access on the provider side.
   * @param options - Additional query options.
   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
   * @example "github"
   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
   * @returns {Promise<void>}
   * @throws {UnauthorizedException} 401
   * @throws {NotFoundException} 404
   */
  deleteUserConnectedAccount(options: DeleteUserConnectedAccountOptions): Promise<void>;
  /**
   * List providers for a user
   *
   * Retrieves a list of available providers and the user's connection status for each. Returns all providers configured for your environment, along with the user's [connected account](https://workos.com/docs/reference/pipes/connected-account) information where applicable.
   * @param options - Additional query options.
   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier to list providers and connected accounts for.
   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to filter connections for a specific organization.
   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
   * @returns {Promise<DataIntegrationsListResponse>}
   * @throws {UnauthorizedException} 401
   * @throws {NotFoundException} 404
   */
  listUserDataProviders(options: ListUserDataProvidersOptions): Promise<DataIntegrationsListResponse>;
}
//#endregion
//#region src/radar/interfaces/radar-standalone-assess-request-auth-method.interface.d.ts
declare const RadarStandaloneAssessRequestAuthMethod: {
  readonly Password: "Password";
  readonly Passkey: "Passkey";
  readonly Authenticator: "Authenticator";
  readonly SmsOtp: "SMS_OTP";
  readonly EmailOtp: "Email_OTP";
  readonly Social: "Social";
  readonly SSO: "SSO";
  readonly Other: "Other";
};
type RadarStandaloneAssessRequestAuthMethod = (typeof RadarStandaloneAssessRequestAuthMethod)[keyof typeof RadarStandaloneAssessRequestAuthMethod];
//#endregion
//#region src/radar/interfaces/radar-standalone-assess-request-action.interface.d.ts
declare const RadarStandaloneAssessRequestAction: {
  readonly SignUp: "sign-up";
  readonly SignIn: "sign-in";
};
type RadarStandaloneAssessRequestAction = (typeof RadarStandaloneAssessRequestAction)[keyof typeof RadarStandaloneAssessRequestAction];
//#endregion
//#region src/radar/interfaces/create-attempt-options.interface.d.ts
interface CreateAttemptOptions {
  /** The IP address of the request to assess. */
  ipAddress: string;
  /** The user agent string of the request to assess. */
  userAgent: string;
  /** The email address of the user making the request. */
  email: string;
  /** The authentication method being used. */
  authMethod: RadarStandaloneAssessRequestAuthMethod;
  /** The action being performed. */
  action: RadarStandaloneAssessRequestAction;
}
//#endregion
//#region src/radar/interfaces/update-attempt-options.interface.d.ts
interface UpdateAttemptOptions {
  /** The unique identifier of the Radar attempt to update. */
  id: string;
  /** Set to `"success"` to mark the challenge as completed. */
  challengeStatus?: 'success';
  /** Set to `"success"` to mark the authentication attempt as successful. */
  attemptStatus?: 'success';
}
//#endregion
//#region src/radar/interfaces/radar-list-type.interface.d.ts
declare const RadarListType: {
  readonly IpAddress: "ip_address";
  readonly Domain: "domain";
  readonly Email: "email";
  readonly Device: "device";
  readonly UserAgent: "user_agent";
  readonly DeviceFingerprint: "device_fingerprint";
  readonly Country: "country";
};
type RadarListType = (typeof RadarListType)[keyof typeof RadarListType];
//#endregion
//#region src/radar/interfaces/radar-list-action.interface.d.ts
declare const RadarListAction: {
  readonly Block: "block";
  readonly Allow: "allow";
};
type RadarListAction = (typeof RadarListAction)[keyof typeof RadarListAction];
//#endregion
//#region src/radar/interfaces/add-list-entry-options.interface.d.ts
interface AddListEntryOptions {
  /** The type of the Radar list (e.g. ip_address, domain, email). */
  type: RadarListType;
  /** The list action indicating whether to add the entry to the allow or block list. */
  action: RadarListAction;
  /** The value to add to the list. Must match the format of the list type (e.g. a valid IP address for `ip_address`, a valid email for `email`). */
  entry: string;
}
//#endregion
//#region src/radar/interfaces/remove-list-entry-options.interface.d.ts
interface RemoveListEntryOptions {
  /** The type of the Radar list (e.g. ip_address, domain, email). */
  type: RadarListType;
  /** The list action indicating whether to remove the entry from the allow or block list. */
  action: RadarListAction;
  /** The value to remove from the list. Must match an existing entry. */
  entry: string;
}
//#endregion
//#region src/radar/interfaces/radar-standalone-response-verdict.interface.d.ts
declare const RadarStandaloneResponseVerdict: {
  readonly Allow: "allow";
  readonly Block: "block";
  readonly Challenge: "challenge";
};
type RadarStandaloneResponseVerdict = (typeof RadarStandaloneResponseVerdict)[keyof typeof RadarStandaloneResponseVerdict];
//#endregion
//#region src/radar/interfaces/radar-standalone-response-control.interface.d.ts
declare const RadarStandaloneResponseControl: {
  readonly BotDetection: "bot_detection";
  readonly BruteForceAttack: "brute_force_attack";
  readonly DomainSignUpRateLimit: "domain_sign_up_rate_limit";
  readonly ImpossibleTravel: "impossible_travel";
  readonly RepeatSignUp: "repeat_sign_up";
  readonly StaleAccount: "stale_account";
  readonly UnrecognizedDevice: "unrecognized_device";
  readonly Restriction: "restriction";
};
type RadarStandaloneResponseControl = (typeof RadarStandaloneResponseControl)[keyof typeof RadarStandaloneResponseControl];
//#endregion
//#region src/radar/interfaces/radar-standalone-response-blocklist-type.interface.d.ts
declare const RadarStandaloneResponseBlocklistType: {
  readonly IpAddress: "ip_address";
  readonly Domain: "domain";
  readonly Email: "email";
  readonly Device: "device";
  readonly UserAgent: "user_agent";
  readonly DeviceFingerprint: "device_fingerprint";
  readonly Country: "country";
};
type RadarStandaloneResponseBlocklistType = (typeof RadarStandaloneResponseBlocklistType)[keyof typeof RadarStandaloneResponseBlocklistType];
//#endregion
//#region src/radar/interfaces/radar-standalone-response.interface.d.ts
interface RadarStandaloneResponse {
  /** The verdict of the risk assessment. */
  verdict: RadarStandaloneResponseVerdict;
  /** A human-readable reason for the verdict. */
  reason: string;
  /** Unique identifier of the authentication attempt. */
  attemptId: string;
  /** The Radar control that triggered the verdict. Only present if the verdict is `block` or `challenge`. */
  control?: RadarStandaloneResponseControl;
  /** The type of blocklist entry that triggered the verdict. Only present if the control is `restriction`. */
  blocklistType?: RadarStandaloneResponseBlocklistType;
}
interface RadarStandaloneResponseWire {
  verdict: RadarStandaloneResponseVerdict;
  reason: string;
  attempt_id: string;
  control?: RadarStandaloneResponseControl;
  blocklist_type?: RadarStandaloneResponseBlocklistType;
}
//#endregion
//#region src/radar/interfaces/radar-list-entry-already-present-response.interface.d.ts
interface RadarListEntryAlreadyPresentResponse {
  /** A message indicating the entry already exists. */
  message: string;
}
interface RadarListEntryAlreadyPresentResponseWire {
  message: string;
}
//#endregion
//#region src/radar/radar.d.ts
declare class Radar {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * Create an attempt
   *
   * Assess a request for risk using the Radar engine and receive a verdict.
   * @param options - Object containing ipAddress, userAgent, email, authMethod, action.
   * @param options.ipAddress - The IP address of the request to assess.
   * @example "49.78.240.97"
   * @param options.userAgent - The user agent string of the request to assess.
   * @example "Mozilla/5.0"
   * @param options.email - The email address of the user making the request.
   * @example "user@example.com"
   * @param options.authMethod - The authentication method being used.
   * @example "Password"
   * @param options.action - The action being performed.
   * @example "sign-in"
   * @returns {Promise<RadarStandaloneResponse>}
   * @throws {BadRequestException} 400
   */
  createAttempt(options: CreateAttemptOptions): Promise<RadarStandaloneResponse>;
  /**
   * Update a Radar attempt
   *
   * You may optionally inform Radar that an authentication attempt or challenge was successful using this endpoint. Some Radar controls depend on tracking recent successful attempts, such as impossible travel.
   * @param options - The request body.
   * @param options.id - The unique identifier of the Radar attempt to update.
   * @example "radar_att_01HZBC6N1EB1ZY7KG32X"
   * @param options.challengeStatus - Set to `"success"` to mark the challenge as completed.
   * @example "success"
   * @param options.attemptStatus - Set to `"success"` to mark the authentication attempt as successful.
   * @example "success"
   * @returns {Promise<void>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   */
  updateAttempt(options: UpdateAttemptOptions): Promise<void>;
  /**
   * Add an entry to a Radar list
   *
   * Add an entry to a Radar list.
   * @param options - Object containing entry.
   * @param options.type - The type of the Radar list (e.g. ip_address, domain, email).
   * @example "ip_address"
   * @param options.action - The list action indicating whether to add the entry to the allow or block list.
   * @example "block"
   * @param options.entry - The value to add to the list. Must match the format of the list type (e.g. a valid IP address for `ip_address`, a valid email for `email`).
   * @example "198.51.100.42"
   * @returns {Promise<RadarListEntryAlreadyPresentResponse>}
   * @throws {BadRequestException} 400
   */
  addListEntry(options: AddListEntryOptions): Promise<RadarListEntryAlreadyPresentResponse>;
  /**
   * Remove an entry from a Radar list
   *
   * Remove an entry from a Radar list.
   * @param options - Object containing entry.
   * @param options.type - The type of the Radar list (e.g. ip_address, domain, email).
   * @example "ip_address"
   * @param options.action - The list action indicating whether to remove the entry from the allow or block list.
   * @example "block"
   * @param options.entry - The value to remove from the list. Must match an existing entry.
   * @example "198.51.100.42"
   * @returns {Promise<void>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   */
  removeListEntry(options: RemoveListEntryOptions): Promise<void>;
}
//#endregion
//#region src/admin-portal/admin-portal.d.ts
declare class AdminPortal {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * Generate a Portal Link
   *
   * Generate a Portal Link scoped to an Organization.
   * @param payload - Object containing organization.
   * @returns {Promise<{ link: string; }>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  generateLink({ intent, organization, returnUrl, successUrl, intentOptions, adminEmails }: {
    intent?: GenerateLinkIntent;
    organization: string;
    returnUrl?: string;
    successUrl?: string;
    intentOptions?: {
      sso: {
        bookmarkSlug?: string;
        providerType?: string;
      };
    };
    adminEmails?: string[];
  }): Promise<{
    link: string;
  }>;
}
//#endregion
//#region src/sso/sso.d.ts
declare class SSO {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * List Connections
   *
   * Get a list of all of your existing connections matching the criteria specified.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<Connection, SerializedListConnectionsOptions>>}
   * @throws 403 response from the API.
   * @throws {UnprocessableEntityException} 422
   */
  listConnections(options?: ListConnectionsOptions): Promise<AutoPaginatable<Connection, SerializedListConnectionsOptions>>;
  /**
   * Delete a Connection
   *
   * Permanently deletes an existing connection. It cannot be undone.
   * @param id - Unique identifier for the Connection.
   *
   * @example
   * "conn_01E4ZCR3C56J083X43JQXF3JK5"
   *
   * @returns {Promise<void>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  deleteConnection(id: string): Promise<void>;
  getAuthorizationUrl(options: SSOAuthorizationURLOptions): string;
  /**
   * Generates an authorization URL with PKCE parameters automatically generated.
   * Use this for public clients (CLI apps, Electron, mobile) that cannot
   * securely store a client secret.
   *
   * @returns Object containing url, state, and codeVerifier
   *
   * @example
   * ```typescript
   * const { url, state, codeVerifier } = await workos.sso.getAuthorizationUrlWithPKCE({
   *   connection: 'conn_123',
   *   clientId: 'client_123',
   *   redirectUri: 'myapp://callback',
   * });
   *
   * // Store state and codeVerifier securely, then redirect user to url
   * // After callback, exchange the code:
   * const { profile, accessToken } = await workos.sso.getProfileAndToken({
   *   code: authorizationCode,
   *   codeVerifier,
   *   clientId: 'client_123',
   * });
   * ```
   */
  getAuthorizationUrlWithPKCE(options: Omit<SSOAuthorizationURLOptions, 'codeChallenge' | 'codeChallengeMethod' | 'state'>): Promise<SSOPKCEAuthorizationURLResult>;
  /**
   * Get a Connection
   *
   * Get the details of an existing connection.
   * @param id - Unique identifier for the Connection.
   *
   * @example
   * "conn_01E4ZCR3C56J083X43JQXF3JK5"
   *
   * @returns {Promise<Connection>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  getConnection(id: string): Promise<Connection>;
  /**
   * Exchange an authorization code for a profile and access token.
   *
   * Auto-detects public vs confidential client mode:
   * - If codeVerifier is provided: Uses PKCE flow (public client)
   * - If no codeVerifier: Uses client_secret from API key (confidential client)
   * - If both: Uses both client_secret AND codeVerifier (confidential client with PKCE)
   *
   * Using PKCE with confidential clients is recommended by OAuth 2.1 for defense
   * in depth and provides additional CSRF protection on the authorization flow.
   *
   * @throws Error if neither codeVerifier nor API key is available
   */
  getProfileAndToken<CustomAttributesType extends UnknownRecord = UnknownRecord>({ code, clientId, codeVerifier }: GetProfileAndTokenOptions): Promise<ProfileAndToken<CustomAttributesType>>;
  /**
   * Get a User Profile
   *
   * Exchange an access token for a user's [Profile](https://workos.com/docs/reference/sso/profile). Because this profile is returned in the [Get a Profile and Token endpoint](https://workos.com/docs/reference/sso/profile/get-profile-and-token) your application usually does not need to call this endpoint. It is available for any authentication flows that require an additional endpoint to retrieve a user's profile.
   * @returns {Promise<Profile<CustomAttributesType>>}
   * @throws {UnauthorizedException} 401
   * @throws {NotFoundException} 404
   */
  getProfile<CustomAttributesType extends UnknownRecord = UnknownRecord>({ accessToken }: GetProfileOptions): Promise<Profile<CustomAttributesType>>;
}
//#endregion
//#region src/multi-factor-auth/interfaces/challenge-factor-options.d.ts
type ChallengeFactorOptions = {
  authenticationFactorId: string;
} | {
  authenticationFactorId: string;
  smsTemplate: string;
};
//#endregion
//#region src/multi-factor-auth/interfaces/challenge.interface.d.ts
interface Challenge {
  object: 'authentication_challenge';
  id: string;
  createdAt: string;
  updatedAt: string;
  expiresAt?: string;
  code?: string;
  authenticationFactorId: string;
}
interface ChallengeResponse {
  object: 'authentication_challenge';
  id: string;
  created_at: string;
  updated_at: string;
  expires_at?: string;
  code?: string;
  authentication_factor_id: string;
}
//#endregion
//#region src/multi-factor-auth/interfaces/enroll-factor-options.d.ts
type EnrollFactorOptions = {
  type: 'sms';
  phoneNumber: string;
} | {
  type: 'totp';
  issuer: string;
  user: string;
} | {
  type: 'generic_otp';
};
//#endregion
//#region src/multi-factor-auth/interfaces/verify-challenge-options.d.ts
interface VerifyChallengeOptions {
  authenticationChallengeId: string;
  code: string;
}
//#endregion
//#region src/multi-factor-auth/interfaces/verify-challenge-response.d.ts
interface VerifyResponse {
  challenge: Challenge;
  valid: boolean;
}
interface VerifyResponseResponse {
  challenge: ChallengeResponse;
  valid: boolean;
}
//#endregion
//#region src/multi-factor-auth/multi-factor-auth.d.ts
declare class MultiFactorAuth {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * Delete Factor
   *
   * Permanently deletes an Authentication Factor. It cannot be undone.
   * @param id - The unique ID of the Factor.
   *
   * @example
   * "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ"
   *
   * @returns {Promise<void>}
   * @throws {NotFoundException} 404
   */
  deleteFactor(id: string): Promise<void>;
  /**
   * Get Factor
   *
   * Gets an Authentication Factor.
   * @param id - The unique ID of the Factor.
   *
   * @example
   * "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ"
   *
   * @returns {Promise<Factor>}
   * @throws {NotFoundException} 404
   */
  getFactor(id: string): Promise<Factor>;
  /**
   * Enroll Factor
   *
   * Enrolls an Authentication Factor to be used as an additional factor of authentication. The returned ID should be used to create an authentication Challenge.
   * @param options - Object containing type.
   * @returns {Promise<FactorWithSecrets>}
   * @throws {UnprocessableEntityException} 422
   */
  enrollFactor(options: EnrollFactorOptions): Promise<FactorWithSecrets>;
  /**
   * Challenge Factor
   *
   * Creates a Challenge for an Authentication Factor.
   * @param options - The request body.
   * @returns {Promise<Challenge>}
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  challengeFactor(options: ChallengeFactorOptions): Promise<Challenge>;
  /**
   * Verify Challenge
   *
   * Verifies an Authentication Challenge.
   * @param options - Object containing code.
   * @returns {Promise<VerifyResponse>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  verifyChallenge(options: VerifyChallengeOptions): Promise<VerifyResponse>;
  /**
   * Enroll an authentication factor
   *
   * Enrolls a user in a new [authentication factor](https://workos.com/docs/reference/authkit/mfa/authentication-factor).
   * @param payload - Object containing type.
   * @returns {Promise<{authenticationFactor: UMFactorWithSecrets; authenticationChallenge: Challenge}>}
   * @throws {UnprocessableEntityException} 422
   */
  createUserAuthFactor(payload: EnrollAuthFactorOptions): Promise<{
    authenticationFactor: AuthenticationFactorWithSecrets;
    authenticationChallenge: Challenge;
  }>;
  /**
   * List authentication factors
   *
   * Lists the [authentication factors](https://workos.com/docs/reference/authkit/mfa/authentication-factor) for a user.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<UMFactor, PaginationOptions>>}
   * @throws {UnprocessableEntityException} 422
   */
  listUserAuthFactors(options: ListAuthFactorsOptions): Promise<AutoPaginatable<AuthenticationFactor, PaginationOptions>>;
}
//#endregion
//#region src/audit-logs/interfaces/audit-log-export-options.interface.d.ts
interface AuditLogExportOptions {
  actions?: string[];
  actorNames?: string[];
  actorIds?: string[];
  organizationId: string;
  rangeEnd: Date;
  rangeStart: Date;
  targets?: string[];
}
interface SerializedAuditLogExportOptions {
  actions?: string[];
  actor_names?: string[];
  actor_ids?: string[];
  organization_id: string;
  range_end: string;
  range_start: string;
  targets?: string[];
}
//#endregion
//#region src/audit-logs/interfaces/audit-log-export.interface.d.ts
interface AuditLogExport {
  object: 'audit_log_export';
  id: string;
  state: 'pending' | 'ready' | 'error';
  url?: string;
  createdAt: string;
  updatedAt: string;
}
interface AuditLogExportResponse {
  object: 'audit_log_export';
  id: string;
  state: 'pending' | 'ready' | 'error';
  url?: string;
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/audit-logs/interfaces/audit-log-schema.interface.d.ts
type AuditLogSchemaMetadata = Record<string, {
  type: 'string' | 'boolean' | 'number';
}> | undefined;
interface AuditLogActorSchema {
  metadata: Record<string, string | boolean | number>;
}
interface AuditLogTargetSchema {
  type: string;
  metadata?: Record<string, string | boolean | number>;
}
interface AuditLogSchema {
  object: 'audit_log_schema';
  version: number;
  targets: AuditLogTargetSchema[];
  actor: AuditLogActorSchema | undefined;
  metadata: Record<string, string | boolean | number> | undefined;
  createdAt: string;
}
interface SerializedAuditLogTargetSchema$1 {
  type: string;
  metadata?: {
    type: 'object';
    properties: AuditLogSchemaMetadata;
  };
}
interface AuditLogSchemaResponse {
  object: 'audit_log_schema';
  version: number;
  targets: SerializedAuditLogTargetSchema$1[];
  actor?: {
    metadata: {
      type: 'object';
      properties: AuditLogSchemaMetadata;
    };
  };
  metadata?: {
    type: 'object';
    properties: AuditLogSchemaMetadata;
  };
  created_at: string;
}
//#endregion
//#region src/audit-logs/interfaces/create-audit-log-event-options.interface.d.ts
interface AuditLogActor {
  id: string;
  name?: string;
  type: string;
  metadata?: Record<string, string | number | boolean>;
}
interface AuditLogTarget {
  id: string;
  name?: string;
  type: string;
  metadata?: Record<string, string | number | boolean>;
}
interface CreateAuditLogEventOptions {
  action: string;
  version?: number;
  occurredAt: Date;
  actor: AuditLogActor;
  targets: AuditLogTarget[];
  context: {
    location: string;
    userAgent?: string;
  };
  metadata?: Record<string, string | number | boolean>;
}
interface SerializedCreateAuditLogEventOptions {
  action: string;
  version?: number;
  occurred_at: string;
  actor: AuditLogActor;
  targets: AuditLogTarget[];
  context: {
    location: string;
    user_agent?: string;
  };
  metadata?: Record<string, string | number | boolean>;
}
type CreateAuditLogEventRequestOptions = Pick<PostOptions, 'idempotencyKey'>;
//#endregion
//#region src/audit-logs/interfaces/create-audit-log-schema-options.interface.d.ts
interface CreateAuditLogSchemaOptions {
  action: string;
  targets: AuditLogTargetSchema[];
  actor?: AuditLogActorSchema;
  metadata?: Record<string, string | boolean | number>;
}
interface SerializedAuditLogTargetSchema {
  type: string;
  metadata?: {
    type: 'object';
    properties: AuditLogSchemaMetadata;
  };
}
interface SerializedCreateAuditLogSchemaOptions {
  targets: SerializedAuditLogTargetSchema[];
  actor?: {
    metadata: {
      type: 'object';
      properties: AuditLogSchemaMetadata;
    };
  };
  metadata?: {
    type: 'object';
    properties: AuditLogSchemaMetadata;
  };
}
/** @deprecated Use AuditLogSchemaResponse instead */
type CreateAuditLogSchemaResponse = AuditLogSchemaResponse;
type CreateAuditLogSchemaRequestOptions = Pick<PostOptions, 'idempotencyKey'>;
//#endregion
//#region src/audit-logs/audit-logs.d.ts
declare class AuditLogs {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * Create Event
   *
   * Create an Audit Log Event.
   *
   * This API supports idempotency which guarantees that performing the same operation multiple times will have the same result as if the operation were performed only once. This is handy in situations where you may need to retry a request due to a failure or prevent accidental duplicate requests from creating more than one resource.
   *
   * To achieve idempotency, you can add `Idempotency-Key` request header to a Create Event request with a unique string as the value. Each subsequent request matching this unique string will return the same response. We suggest using [v4 UUIDs](https://en.wikipedia.org/wiki/Universally_unique_identifier) for idempotency keys to avoid collisions.
   *
   * Idempotency keys expire after 24 hours. The API will generate a new response if you submit a request with an expired key.
   * @param payload - Object containing organizationId, event.
   * @returns {Promise<void>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   * @throws {RateLimitExceededException} 429
   */
  createEvent(organization: string, event: CreateAuditLogEventOptions, options?: CreateAuditLogEventRequestOptions): Promise<void>;
  /**
   * Create Export
   *
   * Create an Audit Log Export. Exports are scoped to a single organization within a specified date range.
   * @param payload - Object containing organizationId, rangeStart, rangeEnd.
   * @returns {Promise<AuditLogExport>}
   * @throws {BadRequestException} 400
   */
  createExport(options: AuditLogExportOptions): Promise<AuditLogExport>;
  /**
   * Get Export
   *
   * Get an Audit Log Export. The URL will expire after 10 minutes. If the export is needed again at a later time, refetching the export will regenerate the URL.
   * @param auditLogExportId - The unique ID of the Audit Log Export.
   *
   * @example
   * "audit_log_export_01GBZK5MP7TD1YCFQHFR22180V"
   *
   * @returns {Promise<AuditLogExport>}
   * @throws {NotFoundException} 404
   */
  getExport(auditLogExportId: string): Promise<AuditLogExport>;
  /**
   * Create Schema
   *
   * Creates a new Audit Log schema used to validate the payload of incoming Audit Log Events. If the `action` does not exist, it will also be created.
   * @param payload - Object containing targets.
   * @returns {Promise<AuditLogSchema>}
   * @throws {UnprocessableEntityException} 422
   */
  createSchema(schema: CreateAuditLogSchemaOptions, options?: CreateAuditLogSchemaRequestOptions): Promise<AuditLogSchema>;
  listSchemas(action: string, options?: PaginationOptions): Promise<AutoPaginatable<AuditLogSchema, PaginationOptions>>;
}
//#endregion
//#region node_modules/jose/dist/types/types.d.ts
/** Generic JSON Web Key Parameters. */
interface JWKParameters {
  /** JWK "kty" (Key Type) Parameter */
  kty?: string;
  /**
   * JWK "alg" (Algorithm) Parameter
   *
   * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
   */
  alg?: string;
  /** JWK "key_ops" (Key Operations) Parameter */
  key_ops?: string[];
  /** JWK "ext" (Extractable) Parameter */
  ext?: boolean;
  /** JWK "use" (Public Key Use) Parameter */
  use?: string;
  /** JWK "x5c" (X.509 Certificate Chain) Parameter */
  x5c?: string[];
  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter */
  x5t?: string;
  /** JWK "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter */
  'x5t#S256'?: string;
  /** JWK "x5u" (X.509 URL) Parameter */
  x5u?: string;
  /** JWK "kid" (Key ID) Parameter */
  kid?: string;
}
/**
 * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", "AKP", and
 * "oct" key types are supported.
 *
 * @see {@link JWK_AKP_Public}
 * @see {@link JWK_AKP_Private}
 * @see {@link JWK_OKP_Public}
 * @see {@link JWK_OKP_Private}
 * @see {@link JWK_EC_Public}
 * @see {@link JWK_EC_Private}
 * @see {@link JWK_RSA_Public}
 * @see {@link JWK_RSA_Private}
 * @see {@link JWK_oct}
 */
interface JWK extends JWKParameters {
  /**
   * - EC JWK "crv" (Curve) Parameter
   * - OKP JWK "crv" (The Subtype of Key Pair) Parameter
   */
  crv?: string;
  /**
   * - Private RSA JWK "d" (Private Exponent) Parameter
   * - Private EC JWK "d" (ECC Private Key) Parameter
   * - Private OKP JWK "d" (The Private Key) Parameter
   */
  d?: string;
  /** Private RSA JWK "dp" (First Factor CRT Exponent) Parameter */
  dp?: string;
  /** Private RSA JWK "dq" (Second Factor CRT Exponent) Parameter */
  dq?: string;
  /** RSA JWK "e" (Exponent) Parameter */
  e?: string;
  /** Oct JWK "k" (Key Value) Parameter */
  k?: string;
  /** RSA JWK "n" (Modulus) Parameter */
  n?: string;
  /** Private RSA JWK "p" (First Prime Factor) Parameter */
  p?: string;
  /** Private RSA JWK "q" (Second Prime Factor) Parameter */
  q?: string;
  /** Private RSA JWK "qi" (First CRT Coefficient) Parameter */
  qi?: string;
  /**
   * - EC JWK "x" (X Coordinate) Parameter
   * - OKP JWK "x" (The public key) Parameter
   */
  x?: string;
  /** EC JWK "y" (Y Coordinate) Parameter */
  y?: string;
  /** AKP JWK "pub" (Public Key) Parameter */
  pub?: string;
  /** AKP JWK "priv" (Private key) Parameter */
  priv?: string;
}
/**
 * Flattened JWS definition for verify function inputs, allows payload as {@link !Uint8Array} for
 * detached signature validation.
 */
interface FlattenedJWSInput {
  /**
   * The "header" member MUST be present and contain the value JWS Unprotected Header when the JWS
   * Unprotected Header value is non- empty; otherwise, it MUST be absent. This value is represented
   * as an unencoded JSON object, rather than as a string. These Header Parameter values are not
   * integrity protected.
   */
  header?: JWSHeaderParameters;
  /**
   * The "payload" member MUST be present and contain the value BASE64URL(JWS Payload). When RFC7797
   * "b64": false is used the value passed may also be a {@link !Uint8Array}.
   */
  payload: string | Uint8Array;
  /**
   * The "protected" member MUST be present and contain the value BASE64URL(UTF8(JWS Protected
   * Header)) when the JWS Protected Header value is non-empty; otherwise, it MUST be absent. These
   * Header Parameter values are integrity protected.
   */
  protected?: string;
  /** The "signature" member MUST be present and contain the value BASE64URL(JWS Signature). */
  signature: string;
}
/** Header Parameters common to JWE and JWS */
interface JoseHeaderParameters {
  /** "kid" (Key ID) Header Parameter */
  kid?: string;
  /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
  x5t?: string;
  /** "x5c" (X.509 Certificate Chain) Header Parameter */
  x5c?: string[];
  /** "x5u" (X.509 URL) Header Parameter */
  x5u?: string;
  /** "jku" (JWK Set URL) Header Parameter */
  jku?: string;
  /** "jwk" (JSON Web Key) Header Parameter */
  jwk?: Pick<JWK, 'kty' | 'crv' | 'x' | 'y' | 'e' | 'n' | 'alg' | 'pub'>;
  /** "typ" (Type) Header Parameter */
  typ?: string;
  /** "cty" (Content Type) Header Parameter */
  cty?: string;
}
/** Recognized JWS Header Parameters, any other Header Members may also be present. */
interface JWSHeaderParameters extends JoseHeaderParameters {
  /**
   * JWS "alg" (Algorithm) Header Parameter
   *
   * @see {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}
   */
  alg?: string;
  /**
   * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
   * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
   */
  b64?: boolean;
  /** JWS "crit" (Critical) Header Parameter */
  crit?: string[];
  /** Any other JWS Header member. */
  [propName: string]: unknown;
}
/** JSON Web Key Set */
interface JSONWebKeySet {
  keys: JWK[];
}
/**
 * {@link !CryptoKey} is a representation of a key/secret available in all supported runtimes. In
 * addition to the {@link key/import Key Import Functions} you may use the
 * {@link !SubtleCrypto.importKey} API to obtain a {@link !CryptoKey} from your existing key
 * material.
 */
type CryptoKey = Extract<Awaited<ReturnType<typeof crypto.subtle.generateKey>>, {
  type: string;
}>;
//#endregion
//#region node_modules/jose/dist/types/jwks/remote.d.ts
/**
 * When passed to {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} this allows the resolver
 * to make use of advanced fetch configurations, HTTP Proxies, retry on network errors, etc.
 *
 * > [!NOTE]\
 * > Known caveat: Expect Type-related issues when passing the inputs through to fetch-like modules,
 * > they hardly ever get their typings inline with actual fetch, you should `@ts-expect-error` them.
 *
 * import ky from 'ky'
 *
 * let logRequest!: (request: Request) => void
 * let logResponse!: (request: Request, response: Response) => void
 * let logRetry!: (request: Request, error: Error, retryCount: number) => void
 *
 * const JWKS = jose.createRemoteJWKSet(url, {
 *   [jose.customFetch]: (...args) =>
 *     ky(args[0], {
 *       ...args[1],
 *       hooks: {
 *         beforeRequest: [
 *           (request) => {
 *             logRequest(request)
 *           },
 *         ],
 *         beforeRetry: [
 *           ({ request, error, retryCount }) => {
 *             logRetry(request, error, retryCount)
 *           },
 *         ],
 *         afterResponse: [
 *           (request, _, response) => {
 *             logResponse(request, response)
 *           },
 *         ],
 *       },
 *     }),
 * })
 * ```
 *
 * import * as undici from 'undici'
 *
 * // see https://undici.nodejs.org/#/docs/api/EnvHttpProxyAgent
 * let envHttpProxyAgent = new undici.EnvHttpProxyAgent()
 *
 * // @ts-ignore
 * const JWKS = jose.createRemoteJWKSet(url, {
 *   [jose.customFetch]: (...args) => {
 *     // @ts-ignore
 *     return undici.fetch(args[0], { ...args[1], dispatcher: envHttpProxyAgent }) // prettier-ignore
 *   },
 * })
 * ```
 *
 * import * as undici from 'undici'
 *
 * // see https://undici.nodejs.org/#/docs/api/RetryAgent
 * let retryAgent = new undici.RetryAgent(new undici.Agent(), {
 *   statusCodes: [],
 *   errorCodes: [
 *     'ECONNRESET',
 *     'ECONNREFUSED',
 *     'ENOTFOUND',
 *     'ENETDOWN',
 *     'ENETUNREACH',
 *     'EHOSTDOWN',
 *     'UND_ERR_SOCKET',
 *   ],
 * })
 *
 * // @ts-ignore
 * const JWKS = jose.createRemoteJWKSet(url, {
 *   [jose.customFetch]: (...args) => {
 *     // @ts-ignore
 *     return undici.fetch(args[0], { ...args[1], dispatcher: retryAgent }) // prettier-ignore
 *   },
 * })
 * ```
 *
 * import * as undici from 'undici'
 *
 * // see https://undici.nodejs.org/#/docs/api/MockAgent
 * let mockAgent = new undici.MockAgent()
 * mockAgent.disableNetConnect()
 *
 * // @ts-ignore
 * const JWKS = jose.createRemoteJWKSet(url, {
 *   [jose.customFetch]: (...args) => {
 *     // @ts-ignore
 *     return undici.fetch(args[0], { ...args[1], dispatcher: mockAgent }) // prettier-ignore
 *   },
 * })
 * ```
 */
declare const customFetch: unique symbol;
/** See {@link customFetch}. */
type FetchImplementation = (
/** URL the request is being made sent to {@link !fetch} as the `resource` argument */
url: string,
/** Options otherwise sent to {@link !fetch} as the `options` argument */
options: {
  /** HTTP Headers */
  headers: Headers;
  /** The {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods request method} */
  method: 'GET';
  /** See {@link !Request.redirect} */
  redirect: 'manual';
  signal: AbortSignal;
}) => Promise<Response>;
/**
 * > [!WARNING]\
 * > This option has security implications that must be understood, assessed for applicability, and
 * > accepted before use. It is critical that the JSON Web Key Set cache only be writable by your own
 * > code.
 *
 * This option is intended for cloud computing runtimes that cannot keep an in memory cache between
 * their code's invocations. Use in runtimes where an in memory cache between requests is available
 * is not desirable.
 *
 * When passed to {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} this allows the passed in
 * object to:
 *
 * - Serve as an initial value for the JSON Web Key Set that the module would otherwise need to
 *   trigger an HTTP request for
 * - Have the JSON Web Key Set the function optionally ended up triggering an HTTP request for
 *   assigned to it as properties
 *
 * The intended use pattern is:
 *
 * - Before verifying with {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} you pull the
 *   previously cached object from a low-latency key-value store offered by the cloud computing
 *   runtime it is executed on;
 * - Default to an empty object `{}` instead when there's no previously cached value;
 * - Pass it in as {@link RemoteJWKSetOptions[jwksCache]};
 * - Afterwards, update the key-value storage if the {@link ExportedJWKSCache.uat `uat`} property of
 *   the object has changed.
 *
 * // Prerequisites
 * let url!: URL
 * let jwt!: string
 * let getPreviouslyCachedJWKS!: () => Promise<jose.ExportedJWKSCache>
 * let storeNewJWKScache!: (cache: jose.ExportedJWKSCache) => Promise<void>
 *
 * // Load JSON Web Key Set cache
 * const jwksCache: jose.JWKSCacheInput = (await getPreviouslyCachedJWKS()) || {}
 * const { uat } = jwksCache
 *
 * const JWKS = jose.createRemoteJWKSet(url, {
 *   [jose.jwksCache]: jwksCache,
 * })
 *
 * // Use JSON Web Key Set cache
 * await jose.jwtVerify(jwt, JWKS)
 *
 * if (uat !== jwksCache.uat) {
 *   // Update JSON Web Key Set cache
 *   await storeNewJWKScache(jwksCache)
 * }
 * ```
 */
declare const jwksCache: unique symbol;
/** Options for the remote JSON Web Key Set. */
interface RemoteJWKSetOptions {
  /**
   * Timeout (in milliseconds) for the HTTP request. When reached the request will be aborted and
   * the verification will fail. Default is 5000 (5 seconds).
   */
  timeoutDuration?: number;
  /**
   * Duration (in milliseconds) for which no more HTTP requests will be triggered after a previous
   * successful fetch. Default is 30000 (30 seconds).
   */
  cooldownDuration?: number;
  /**
   * Maximum time (in milliseconds) between successful HTTP requests. Default is 600000 (10
   * minutes).
   */
  cacheMaxAge?: number | typeof Infinity;
  /** Headers to be sent with the HTTP request. */
  headers?: Record<string, string>;
  /** See {@link jwksCache}. */
  [jwksCache]?: JWKSCacheInput;
  /** See {@link customFetch}. */
  [customFetch]?: FetchImplementation;
}
/** See {@link jwksCache}. */
interface ExportedJWKSCache {
  /** Current cached JSON Web Key Set */
  jwks: JSONWebKeySet;
  /** Last updated at timestamp (seconds since epoch) */
  uat: number;
}
/** See {@link jwksCache}. */
type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
/**
 * Returns a function that resolves a JWS JOSE Header to a public key object downloaded from a
 * remote endpoint returning a JSON Web Key Set, that is, for example, an OAuth 2.0 or OIDC
 * jwks_uri. The JSON Web Key Set is fetched when no key matches the selection process but only as
 * frequently as the `cooldownDuration` option allows to prevent abuse.
 *
 * It uses the "alg" (JWS Algorithm) Header Parameter to determine the right JWK "kty" (Key Type),
 * then proceeds to match the JWK "kid" (Key ID) with one found in the JWS Header Parameters (if
 * there is one) while also respecting the JWK "use" (Public Key Use) and JWK "key_ops" (Key
 * Operations) Parameters (if they are present on the JWK).
 *
 * Only a single public key must match the selection process. As shown in the example below when
 * multiple keys get matched it is possible to opt-in to iterate over the matched keys and attempt
 * verification in an iterative manner.
 *
 * > [!NOTE]\
 * > The function's purpose is to resolve public keys used for verifying signatures and will not work
 * > for public encryption keys.
 *
 * This function is exported (as a named export) from the main `'jose'` module entry point as well
 * as from its subpath export `'jose/jwks/remote'`.
 *
 * @param url URL to fetch the JSON Web Key Set from.
 * @param options Options for the remote JSON Web Key Set.
 */
declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): {
  (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<CryptoKey>;
  /** @ignore */
  coolingDown: boolean;
  /** @ignore */
  fresh: boolean;
  /** @ignore */
  reloading: boolean;
  /** @ignore */
  reload: () => Promise<void>;
  /** @ignore */
  jwks: () => JSONWebKeySet | undefined;
};
//#endregion
//#region src/user-management/interfaces/session-handler-options.interface.d.ts
interface SessionHandlerOptions {
  sessionData: string;
  cookiePassword?: string;
  organizationId?: string;
}
//#endregion
//#region src/user-management/session.d.ts
type RefreshOptions = {
  cookiePassword?: string;
  organizationId?: string;
};
declare class CookieSession {
  private userManagement;
  private cookiePassword;
  private sessionData;
  constructor(userManagement: UserManagement, sessionData: string, cookiePassword: string);
  /**
   * Authenticates a user with a session cookie.
   *
   * @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.
   */
  authenticate(): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
  /**
   * Refreshes the user's session.
   *
   * @param options - Optional options for refreshing the session.
   * @param options.cookiePassword - The password to use for the new session cookie.
   * @param options.organizationId - The organization ID to use for the new session cookie.
   * @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.
   */
  refresh(options?: RefreshOptions): Promise<RefreshSessionResponse>;
  /**
   * Gets the URL to redirect the user to for logging out.
   *
   * @returns The URL to redirect the user to for logging out.
   */
  getLogoutUrl({ returnTo }?: {
    returnTo?: string;
  }): Promise<string>;
  private isValidJwt;
}
//#endregion
//#region src/user-management/user-management.d.ts
declare class UserManagement {
  private readonly workos;
  private _jwks;
  clientId: string | undefined;
  constructor(workos: WorkOS);
  /**
   * Resolve clientId from method options or fall back to constructor-provided value.
   * @throws TypeError if clientId is not available from either source
   */
  private resolveClientId;
  getJWKS(): Promise<ReturnType<typeof createRemoteJWKSet> | undefined>;
  /**
   * Loads a sealed session using the provided session data and cookie password.
   *
   * @param options - The options for loading the sealed session.
   * @param options.sessionData - The sealed session data.
   * @param options.cookiePassword - The password used to encrypt the session data.
   * @returns The session class.
   */
  loadSealedSession(options: {
    sessionData: string;
    cookiePassword: string;
  }): CookieSession;
  /**
   * Get a user
   *
   * Get the details of an existing user.
   * @param userId - The unique ID of the user.
   * @returns {Promise<User>}
   * @throws {NotFoundException} 404
   */
  getUser(userId: string): Promise<User>;
  /**
   * Get a user by external ID
   *
   * Get the details of an existing user by an [external identifier](https://workos.com/docs/authkit/metadata/external-identifiers).
   * @param externalId - The external ID of the user.
   *
   * @example
   * "f1ffa2b2-c20b-4d39-be5c-212726e11222"
   *
   * @returns {Promise<User>}
   * @throws {NotFoundException} 404
   */
  getUserByExternalId(externalId: string): Promise<User>;
  /**
   * List users
   *
   * Get a list of all of your existing users matching the criteria specified.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<User, SerializedListUsersOptions>>}
   * @throws {UnprocessableEntityException} 422
   */
  listUsers(options?: ListUsersOptions): Promise<AutoPaginatable<User, SerializedListUsersOptions>>;
  /**
   * Create a user
   *
   * Create a new user in the current environment.
   * @param payload - Object containing email.
   * @returns {Promise<CreateUserResponse>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  createUser(payload: CreateUserOptions): Promise<CreateUserResponse>;
  /** Authenticate with magic auth. */
  authenticateWithMagicAuth(payload: AuthenticateWithMagicAuthOptions): Promise<AuthenticationResponse>;
  /** Authenticate with password. */
  authenticateWithPassword(payload: AuthenticateWithPasswordOptions): Promise<AuthenticationResponse>;
  /**
   * Exchange an authorization code for tokens.
   *
   * Auto-detects public vs confidential client mode:
   * - If codeVerifier is provided: Uses PKCE flow (public client)
   * - If no codeVerifier: Uses client_secret from API key (confidential client)
   * - If both: Uses both client_secret AND codeVerifier (confidential client with PKCE)
   *
   * Using PKCE with confidential clients is recommended by OAuth 2.1 for defense
   * in depth and provides additional CSRF protection on the authorization flow.
   *
   * @throws Error if neither codeVerifier nor API key is available
   */
  authenticateWithCode(payload: AuthenticateWithCodeOptions): Promise<AuthenticationResponse>;
  /**
   * Exchange an authorization code for tokens using PKCE (public client flow).
   * Use this instead of authenticateWithCode() when the client cannot securely
   * store a client_secret (browser, mobile, CLI, desktop apps).
   *
   * @param payload.clientId - Your WorkOS client ID
   * @param payload.code - The authorization code from the OAuth callback
   * @param payload.codeVerifier - The PKCE code verifier used to generate the code challenge
   */
  authenticateWithCodeAndVerifier(payload: AuthenticateWithCodeAndVerifierOptions): Promise<AuthenticationResponse>;
  /**
   * Refresh an access token using a refresh token.
   * Automatically detects public client mode - if no API key is configured,
   * omits client_secret from the request.
   */
  authenticateWithRefreshToken(payload: AuthenticateWithRefreshTokenOptions): Promise<AuthenticationResponse>;
  /** Authenticate with totp. */
  authenticateWithTotp(payload: AuthenticateWithTotpOptions): Promise<AuthenticationResponse>;
  /** Authenticate with email verification. */
  authenticateWithEmailVerification(payload: AuthenticateWithEmailVerificationOptions): Promise<AuthenticationResponse>;
  /** Authenticate with organization selection. */
  authenticateWithOrganizationSelection(payload: AuthenticateWithOrganizationSelectionOptions): Promise<AuthenticationResponse>;
  /** Send a Radar SMS challenge. */
  sendRadarSmsChallenge(payload: SendRadarSmsChallengeOptions): Promise<SendRadarSmsChallengeResponse>;
  /** Authenticate with Radar SMS challenge. */
  authenticateWithRadarSmsChallenge(payload: AuthenticateWithRadarSmsChallengeOptions): Promise<AuthenticationResponse>;
  /** Authenticate with Radar email challenge. */
  authenticateWithRadarEmailChallenge(payload: AuthenticateWithRadarEmailChallengeOptions): Promise<AuthenticationResponse>;
  authenticateWithSessionCookie({ sessionData, cookiePassword }: AuthenticateWithSessionCookieOptions): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
  private isValidJwt;
  private prepareAuthenticationResponse;
  private sealSessionDataFromAuthenticationResponse;
  getSessionFromCookie({ sessionData, cookiePassword }: SessionHandlerOptions): Promise<SessionCookieData | undefined>;
  /**
   * Get an email verification code
   *
   * Get the details of an existing email verification code that can be used to send an email to a user for verification.
   * @returns {Promise<EmailVerification>}
   * @throws {NotFoundException} 404
   */
  getEmailVerification(emailVerificationId: string): Promise<EmailVerification>;
  /**
   * Send verification email
   *
   * Sends an email that contains a one-time code used to verify a user’s email address.
   * @returns {Promise<{ user: User; }>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {RateLimitExceededException} 429
   */
  sendVerificationEmail({ userId }: SendVerificationEmailOptions): Promise<{
    user: User;
  }>;
  /**
   * Get Magic Auth code details
   *
   * Get the details of an existing [Magic Auth](https://workos.com/docs/reference/authkit/magic-auth) code that can be used to send an email to a user for authentication.
   * @returns {Promise<MagicAuth>}
   * @throws {NotFoundException} 404
   */
  getMagicAuth(magicAuthId: string): Promise<MagicAuth>;
  /**
   * Create a Magic Auth code
   *
   * Creates a one-time authentication code that can be sent to the user's email address. The code expires in 10 minutes. To verify the code, [authenticate the user with Magic Auth](https://workos.com/docs/reference/authkit/authentication/magic-auth).
   * @param options - Object containing email.
   * @returns {Promise<CreateMagicAuthResponse>}
   * @throws {BadRequestException} 400
   * @throws {UnprocessableEntityException} 422
   * @throws {RateLimitExceededException} 429
   */
  createMagicAuth(options: CreateMagicAuthOptions): Promise<CreateMagicAuthResponse>;
  /**
   * Verify email
   *
   * Verifies an email address using the one-time code received by the user.
   * @param options - Object containing code.
   * @returns {Promise<{ user: User; }>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  verifyEmail({ code, userId }: VerifyEmailOptions): Promise<{
    user: User;
  }>;
  /**
   * Get a password reset token
   *
   * Get the details of an existing password reset token that can be used to reset a user's password.
   * @returns {Promise<PasswordReset>}
   * @throws {NotFoundException} 404
   */
  getPasswordReset(passwordResetId: string): Promise<PasswordReset>;
  createPasswordReset(options: CreatePasswordResetOptions): Promise<PasswordReset>;
  /**
   * Reset the password
   *
   * Sets a new password using the `token` query parameter from the link that
   * the user received. Successfully resetting the password will verify a
   * user's email, if it hasn't been verified yet.
   * @param payload - Object containing the reset token and new password.
   * @returns {Promise<{ user: User; }>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   * @throws {RateLimitExceededException} 429
   */
  resetPassword(payload: ResetPasswordOptions): Promise<{
    user: User;
  }>;
  /**
   * Update a user
   *
   * Updates properties of a user. The omitted properties will be left unchanged.
   * @param payload - The request body.
   * @returns {Promise<User>}
   * @throws {BadRequestException} 400
   * @throws {UnprocessableEntityException} 422
   */
  updateUser(payload: UpdateUserOptions): Promise<User>;
  /**
   * List sessions
   *
   * Get a list of all active sessions for a specific user.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<Session, SerializedListSessionsOptions>>}
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  listSessions(userId: string, options?: ListSessionsOptions): Promise<AutoPaginatable<Session, SerializedListSessionsOptions>>;
  /**
   * Delete a user
   *
   * Permanently deletes a user in the current environment. It cannot be undone.
   * @returns {Promise<void>}
   * @throws {NotFoundException} 404
   */
  deleteUser(userId: string): Promise<void>;
  /**
   * List API keys for a user
   *
   * Get a list of API keys owned by a specific user.
   * @param userId - Unique identifier of the user.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<UserApiKey, SerializedListUserApiKeysOptions>>}
   * @throws {NotFoundException} 404
   */
  listUserApiKeys(userId: string, options?: ListUserApiKeysOptions): Promise<AutoPaginatable<UserApiKey, SerializedListUserApiKeysOptions>>;
  /**
   * Create an API key for a user
   *
   * Create a new API key owned by a user. The user must have an active membership in the specified organization.
   * @param userId - Unique identifier of the user.
   * @param options - Object containing the API key properties.
   * @returns {Promise<UserApiKeyWithValue>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  createUserApiKey(userId: string, options: CreateUserApiKeyOptions, requestOptions?: CreateUserApiKeyRequestOptions): Promise<UserApiKeyWithValue>;
  /**
   * Get user identities
   *
   * Get a list of identities associated with the user. A user can have multiple associated identities after going through [identity linking](https://workos.com/docs/authkit/identity-linking). Currently only OAuth identities are supported. More provider types may be added in the future.
   * @returns {Promise<Identity[]>}
   * @throws {NotFoundException} 404
   */
  getUserIdentities(userId: string): Promise<Identity[]>;
  /**
   * Get an organization membership
   *
   * Get the details of an existing organization membership.
   * @returns {Promise<OrganizationMembership>}
   * @throws {NotFoundException} 404
   */
  getOrganizationMembership(organizationMembershipId: string): Promise<OrganizationMembership>;
  /**
   * List organization memberships
   *
   * Get a list of all organization memberships matching the criteria specified. At least one of `user_id` or `organization_id` must be provided. By default only active memberships are returned. Use the `statuses` parameter to filter by other statuses.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<OrganizationMembership, SerializedListOrganizationMembershipsOptions>>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  listOrganizationMemberships(options: ListOrganizationMembershipsOptions): Promise<AutoPaginatable<OrganizationMembership, SerializedListOrganizationMembershipsOptions>>;
  /**
   * Create an organization membership
   *
   * Creates a new `active` organization membership for the given organization and user.
   *
   * Calling this API with an organization and user that match an `inactive` organization membership will activate the membership with the specified role(s).
   * @param options - Object containing userId, organizationId.
   * @returns {Promise<OrganizationMembership>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  createOrganizationMembership(options: CreateOrganizationMembershipOptions): Promise<OrganizationMembership>;
  /**
   * Update an organization membership
   *
   * Update the details of an existing organization membership.
   * @param options - The request body.
   * @returns {Promise<OrganizationMembership>}
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  updateOrganizationMembership(organizationMembershipId: string, options: UpdateOrganizationMembershipOptions): Promise<OrganizationMembership>;
  /**
   * Delete an organization membership
   *
   * Permanently deletes an existing organization membership. It cannot be undone.
   * @returns {Promise<void>}
   * @throws {NotFoundException} 404
   */
  deleteOrganizationMembership(organizationMembershipId: string): Promise<void>;
  /**
   * Deactivate an organization membership
   *
   * Deactivates an `active` organization membership. Emits an [organization_membership.updated](https://workos.com/docs/events/organization-membership) event upon successful deactivation.
   *
   * - Deactivating an `inactive` membership is a no-op and does not emit an event.
   * - Deactivating a `pending` membership returns an error. This membership should be [deleted](https://workos.com/docs/reference/authkit/organization-membership/delete) instead.
   *
   * See the [membership management documentation](https://workos.com/docs/authkit/users-organizations/organizations/membership-management) for additional details.
   * @returns {Promise<OrganizationMembership>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  deactivateOrganizationMembership(organizationMembershipId: string): Promise<OrganizationMembership>;
  /**
   * Reactivate an organization membership
   *
   * Reactivates an `inactive` organization membership, retaining the pre-existing role(s). Emits an [organization_membership.updated](https://workos.com/docs/events/organization-membership) event upon successful reactivation.
   *
   * - Reactivating an `active` membership is a no-op and does not emit an event.
   * - Reactivating a `pending` membership returns an error. The user needs to [accept the invitation](https://workos.com/docs/authkit/invitations) instead.
   *
   * See the [membership management documentation](https://workos.com/docs/authkit/users-organizations/organizations/membership-management) for additional details.
   * @returns {Promise<OrganizationMembership>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  reactivateOrganizationMembership(organizationMembershipId: string): Promise<OrganizationMembership>;
  listGroupsForOrganizationMembership(options: ListGroupsForOrganizationMembershipOptions): Promise<AutoPaginatable<Group>>;
  getInvitation(invitationId: string): Promise<Invitation>;
  /**
   * Find an invitation by token
   *
   * Retrieve an existing invitation using the token.
   * @returns {Promise<Invitation>}
   * @throws {NotFoundException} 404
   */
  findInvitationByToken(invitationToken: string): Promise<Invitation>;
  /**
   * List invitations
   *
   * Get a list of all of invitations matching the criteria specified.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<Invitation, SerializedListInvitationsOptions>>}
   * @throws {UnprocessableEntityException} 422
   */
  listInvitations(options: ListInvitationsOptions): Promise<AutoPaginatable<Invitation, SerializedListInvitationsOptions>>;
  /**
   * Send an invitation
   *
   * Sends an invitation email to the recipient.
   * @param payload - Object containing email.
   * @returns {Promise<Invitation>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  sendInvitation(payload: SendInvitationOptions): Promise<Invitation>;
  /**
   * Accept an invitation
   *
   * Accepts an invitation and, if linked to an organization, activates the user's membership in that organization.
   * @returns {Promise<Invitation>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   */
  acceptInvitation(invitationId: string): Promise<Invitation>;
  /**
   * Revoke an invitation
   *
   * Revokes an existing invitation.
   * @returns {Promise<Invitation>}
   * @throws {BadRequestException} 400
   */
  revokeInvitation(invitationId: string): Promise<Invitation>;
  /**
   * Resend an invitation
   *
   * Resends an invitation email to the recipient. The invitation must be in a pending state.
   * @param options - The request body.
   * @returns {Promise<Invitation>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  resendInvitation(invitationId: string, options?: ResendInvitationOptions): Promise<Invitation>;
  /**
   * Revoke Session
   *
   * Revoke a [user session](https://workos.com/docs/reference/authkit/session).
   * @param payload - Object containing sessionId.
   * @returns {Promise<void>}
   * @throws {BadRequestException} 400
   */
  revokeSession(payload: RevokeSessionOptions): Promise<void>;
  /**
   * Generate an OAuth 2.0 authorization URL.
   *
   * For public clients (browser, mobile, CLI), include PKCE parameters:
   * - Generate PKCE using workos.pkce.generate()
   * - Pass codeChallenge and codeChallengeMethod here
   * - Store codeVerifier and pass to authenticateWithCode() later
   *
   * Or use getAuthorizationUrlWithPKCE() which handles PKCE automatically.
   */
  getAuthorizationUrl(options: UserManagementAuthorizationURLOptions): string;
  /**
   * Generate an OAuth 2.0 authorization URL with automatic PKCE.
   *
   * This method generates PKCE parameters internally and returns them along with
   * the authorization URL. Use this for public clients (CLI apps, Electron, mobile)
   * that cannot securely store a client secret.
   *
   * @returns Object containing url, state, and codeVerifier
   *
   * @example
   * ```typescript
   * const { url, state, codeVerifier } = await workos.userManagement.getAuthorizationUrlWithPKCE({
   *   provider: 'authkit',
   *   clientId: 'client_123',
   *   redirectUri: 'myapp://callback',
   * });
   *
   * // Store state and codeVerifier securely, then redirect user to url
   * // After callback, exchange the code:
   * const response = await workos.userManagement.authenticateWithCode({
   *   code: authorizationCode,
   *   codeVerifier,
   *   clientId: 'client_123',
   * });
   * ```
   */
  getAuthorizationUrlWithPKCE(options: Omit<UserManagementAuthorizationURLOptions, 'codeChallenge' | 'codeChallengeMethod' | 'state'>): Promise<PKCEAuthorizationURLResult>;
  /**
   * Logout
   *
   * Logout a user from the current [session](https://workos.com/docs/reference/authkit/session).
   * @param options.sessionId - The ID of the session to revoke. This can be extracted from the `sid` claim of the access token.
   *
   * @example
   * "session_01H93ZY4F80QPBEZ1R5B2SHQG8"
   *
   * @param options.returnTo - The URL to redirect the user to after session revocation.
   *
   * @example
   * "https://example.com"
   *
   * @returns {string}
   * @throws {UnprocessableEntityException} 422
   */
  getLogoutUrl(options: LogoutURLOptions): string;
  getJwksUrl(clientId: string): string;
}
//#endregion
//#region src/feature-flags/event-emitter.d.ts
type Listener<Args extends unknown[]> = (...args: Args) => void;
/**
 * Minimal, runtime-agnostic, typed event emitter.
 *
 * Replaces eventemitter3 so the SDK carries no event dependency and works in
 * edge runtimes where `node:events` is not available. Generic over an event
 * map (`{ eventName: [arg1, arg2, ...] }`) for compile-time-checked event
 * names and payloads.
 *
 * Unlike eventemitter3, an unhandled `'error'` event throws instead of being
 * silently dropped — matching Node's `EventEmitter` so failures are never
 * swallowed.
 */
declare class EventEmitter<Events extends Record<keyof Events, unknown[]>> {
  private handlers;
  on<E extends keyof Events>(event: E, fn: Listener<Events[E]>): this;
  once<E extends keyof Events>(event: E, fn: Listener<Events[E]>): this;
  off<E extends keyof Events>(event: E, fn: Listener<Events[E]>): this;
  emit<E extends keyof Events>(event: E, ...args: Events[E]): boolean;
  listenerCount(event: keyof Events): number;
  removeAllListeners(event?: keyof Events): this;
  addListener<E extends keyof Events>(event: E, fn: Listener<Events[E]>): this;
  removeListener<E extends keyof Events>(event: E, fn: Listener<Events[E]>): this;
  listeners<E extends keyof Events>(event: E): Array<Listener<Events[E]>>;
  eventNames(): Array<keyof Events>;
  private add;
  private remove;
}
//#endregion
//#region src/feature-flags/runtime-client.d.ts
interface RuntimeClientEvents {
  change: [FlagChange];
  error: [Error];
  failed: [Error];
}
declare class FeatureFlagsRuntimeClient extends EventEmitter<RuntimeClientEvents> {
  private readonly workos;
  private readonly store;
  private readonly evaluator;
  private readonly pollingIntervalMs;
  private readonly requestTimeoutMs;
  private readonly logger?;
  private closed;
  private initialized;
  private consecutiveErrors;
  private pollTimer;
  private pollAbortController;
  private readyResolve;
  private readyReject;
  private readyPromise;
  private stats;
  constructor(workos: WorkOS, options?: RuntimeClientOptions);
  waitUntilReady(options?: {
    timeoutMs?: number;
  }): Promise<void>;
  close(): void;
  isEnabled(flagKey: string, context?: EvaluationContext, defaultValue?: boolean): boolean;
  getAllFlags(context?: EvaluationContext): Record<string, boolean>;
  getFlag(flagKey: string): FlagPollEntry | undefined;
  getStats(): RuntimeClientStats;
  private resolveReady;
  private poll;
  private fetchWithTimeout;
  private scheduleNextPoll;
  private emitChanges;
  private hasEntryChanged;
}
//#endregion
//#region src/feature-flags/feature-flags.d.ts
declare class FeatureFlags {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * List feature flags
   *
   * Get a list of all of your existing feature flags matching the criteria specified.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<FeatureFlag>>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  listFeatureFlags(options?: ListFeatureFlagsOptions): Promise<AutoPaginatable<FeatureFlag>>;
  /**
   * Get a feature flag
   *
   * Get the details of an existing feature flag by its slug.
   * @param slug - A unique key to reference the Feature Flag.
   *
   * @example
   * "advanced-analytics"
   *
   * @returns {Promise<FeatureFlag>}
   * @throws {NotFoundException} 404
   */
  getFeatureFlag(slug: string): Promise<FeatureFlag>;
  /**
   * Enable a feature flag
   *
   * Enables a feature flag in the current environment.
   * @param slug - A unique key to reference the Feature Flag.
   *
   * @example
   * "advanced-analytics"
   *
   * @returns {Promise<FeatureFlag>}
   * @throws {NotFoundException} 404
   */
  enableFeatureFlag(slug: string): Promise<FeatureFlag>;
  /**
   * Disable a feature flag
   *
   * Disables a feature flag in the current environment.
   * @param slug - A unique key to reference the Feature Flag.
   *
   * @example
   * "advanced-analytics"
   *
   * @returns {Promise<FeatureFlag>}
   * @throws {NotFoundException} 404
   */
  disableFeatureFlag(slug: string): Promise<FeatureFlag>;
  /**
   * Add a feature flag target
   *
   * Enables a feature flag for a specific target in the current environment. Currently, supported targets include users and organizations.
   * @params options - Object containing slug and targetId.
   * @returns {Promise<void>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  addFlagTarget(options: AddFlagTargetOptions): Promise<void>;
  /**
   * Remove a feature flag target
   *
   * Removes a target from the feature flag's target list in the current environment. Currently, supported targets include users and organizations.
   * @params options - Object containing slug and targetId.
   * @returns {Promise<void>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  removeFlagTarget(options: RemoveFlagTargetOptions): Promise<void>;
  /**
   * List enabled feature flags for an organization
   *
   * Get a list of all enabled feature flags for an organization.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<FeatureFlag>>}
   * @throws {NotFoundException} 404
   */
  listOrganizationFeatureFlags(options: ListOrganizationFeatureFlagsOptions): Promise<AutoPaginatable<FeatureFlag>>;
  /**
   * List enabled feature flags for a user
   *
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<Flag>>}
   * @throws {NotFoundException} 404
   */
  listUserFeatureFlags(options: ListUserFeatureFlagsOptions): Promise<AutoPaginatable<FeatureFlag>>;
  createRuntimeClient(options?: RuntimeClientOptions): FeatureFlagsRuntimeClient;
}
//#endregion
//#region src/groups/groups.d.ts
declare class Groups {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * List Group members
   *
   * Get a list of organization memberships in a group.
   * @param options - Pagination and filter options.
   * @param options.organizationId - Unique identifier of the Organization.
   * @example "org_01EHWNCE74X7JSDV0X3SZ3KJNY"
   * @param options.groupId - Unique identifier of the Group.
   * @example "group_01HXYZ123456789ABCDEFGHIJ"
   * @returns {Promise<AutoPaginatable<AuthorizationOrganizationMembership>>}
   * @throws {AuthorizationException} 403
   * @throws {NotFoundException} 404
   */
  listOrganizationMemberships(options: ListGroupOrganizationMembershipsOptions): Promise<AutoPaginatable<AuthorizationOrganizationMembership>>;
  /**
   * List groups
   *
   * Get a paginated list of groups within an organization.
   * @param options - Pagination and filter options.
   * @param options.organizationId - The ID of the organization.
   * @example "org_01EHWNCE74X7JSDV0X3SZ3KJNY"
   * @returns {Promise<AutoPaginatable<Group, PaginationOptions>>}
   * @throws {AuthorizationException} 403
   * @throws {NotFoundException} 404
   */
  listGroups(options: ListGroupsOptions): Promise<AutoPaginatable<Group, PaginationOptions>>;
  /**
   * Create a group
   *
   * Create a new group within an organization.
   * @param options - Object containing name.
   * @param options.organizationId - The ID of the organization.
   * @example "org_01EHWNCE74X7JSDV0X3SZ3KJNY"
   * @param options.name - The name of the Group.
   * @example "Engineering"
   * @param options.description - An optional description of the Group.
   * @example "The engineering team"
   * @returns {Promise<Group>}
   * @throws {BadRequestException} 400
   * @throws {AuthorizationException} 403
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  createGroup(options: CreateGroupOptions): Promise<Group>;
  /**
   * Get a group
   *
   * Retrieve a group by its ID within an organization.
   * @param options - The request options.
   * @param options.organizationId - The ID of the organization.
   * @example "org_01EHWNCE74X7JSDV0X3SZ3KJNY"
   * @param options.groupId - The ID of the group.
   * @example "group_01HXYZ123456789ABCDEFGHIJ"
   * @returns {Promise<Group>}
   * @throws {AuthorizationException} 403
   * @throws {NotFoundException} 404
   */
  getGroup(options: GetGroupOptions): Promise<Group>;
  /**
   * Update a group
   *
   * Update an existing group. Only the fields provided in the request body will be updated.
   * @param options - The request body.
   * @param options.organizationId - The ID of the organization.
   * @example "org_01EHWNCE74X7JSDV0X3SZ3KJNY"
   * @param options.groupId - The ID of the group.
   * @example "group_01HXYZ123456789ABCDEFGHIJ"
   * @param options.name - The name of the Group.
   * @example "Engineering"
   * @param options.description - An optional description of the Group.
   * @example "The engineering team"
   * @returns {Promise<Group>}
   * @throws {BadRequestException} 400
   * @throws {AuthorizationException} 403
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  updateGroup(options: UpdateGroupOptions): Promise<Group>;
  /**
   * Delete a group
   *
   * Delete a group from an organization.
   * @param options - The request options.
   * @param options.organizationId - The ID of the organization.
   * @example "org_01EHWNCE74X7JSDV0X3SZ3KJNY"
   * @param options.groupId - The ID of the group.
   * @example "group_01HXYZ123456789ABCDEFGHIJ"
   * @returns {Promise<void>}
   * @throws {AuthorizationException} 403
   * @throws {NotFoundException} 404
   */
  deleteGroup(options: DeleteGroupOptions): Promise<void>;
  /**
   * Add a member to a Group
   *
   * Add an organization membership to a group.
   * @param options - Object containing organizationMembershipId.
   * @param options.organizationId - Unique identifier of the Organization.
   * @example "org_01EHWNCE74X7JSDV0X3SZ3KJNY"
   * @param options.groupId - Unique identifier of the Group.
   * @example "group_01HXYZ123456789ABCDEFGHIJ"
   * @param options.organizationMembershipId - The ID of the Organization Membership to add to the group.
   * @example "om_01HXYZ123456789ABCDEFGHIJ"
   * @returns {Promise<Group>}
   * @throws {BadRequestException} 400
   * @throws {AuthorizationException} 403
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  addOrganizationMembership(options: AddGroupOrganizationMembershipOptions): Promise<Group>;
  /**
   * Remove a member from a Group
   *
   * Remove an organization membership from a group.
   * @param options - The request options.
   * @param options.organizationId - Unique identifier of the Organization.
   * @example "org_01EHWNCE74X7JSDV0X3SZ3KJNY"
   * @param options.groupId - Unique identifier of the Group.
   * @example "group_01HXYZ123456789ABCDEFGHIJ"
   * @param options.omId - Unique identifier of the Organization Membership.
   * @example "om_01HXYZ123456789ABCDEFGHIJ"
   * @returns {Promise<void>}
   * @throws {AuthorizationException} 403
   * @throws {NotFoundException} 404
   */
  removeOrganizationMembership(options: RemoveGroupOrganizationMembershipOptions): Promise<void>;
}
//#endregion
//#region src/widgets/interfaces/widget-session-token-scopes.interface.d.ts
declare const WidgetSessionTokenScopes: {
  readonly WidgetsUsersTableManage: "widgets:users-table:manage";
  readonly WidgetsDomainVerificationManage: "widgets:domain-verification:manage";
  readonly WidgetsSSOManage: "widgets:sso:manage";
  readonly WidgetsApiKeysManage: "widgets:api-keys:manage";
  readonly WidgetsDsyncManage: "widgets:dsync:manage";
  readonly WidgetsAuditLogStreamingManage: "widgets:audit-log-streaming:manage";
};
type WidgetSessionTokenScopes = (typeof WidgetSessionTokenScopes)[keyof typeof WidgetSessionTokenScopes];
//#endregion
//#region src/widgets/interfaces/create-token-options.interface.d.ts
interface CreateTokenOptions {
  /** The ID of the organization to scope the widget session to. */
  organizationId: string;
  /** The ID of the user to issue the widget session token for. */
  userId?: string;
  /** The scopes to grant the widget session. */
  scopes?: WidgetSessionTokenScopes[];
}
//#endregion
//#region src/widgets/interfaces/widget-session-token-response.interface.d.ts
interface WidgetSessionTokenResponse {
  /** The widget session token. */
  token: string;
}
interface WidgetSessionTokenResponseWire {
  token: string;
}
//#endregion
//#region src/widgets/widgets.d.ts
declare class Widgets {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * Generate a widget token
   *
   * Generate a widget token scoped to an organization and user with the specified scopes.
   * @param options - The request options.
   * @returns {Promise<WidgetSessionTokenResponse>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  createToken(options: CreateTokenOptions): Promise<WidgetSessionTokenResponse>;
}
//#endregion
//#region src/authorization/authorization.d.ts
declare class Authorization {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * Create an environment role
   *
   * Create a new environment role.
   * @param options - Object containing slug, name.
   * @returns {Promise<EnvironmentRole>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  createEnvironmentRole(options: CreateEnvironmentRoleOptions): Promise<EnvironmentRole>;
  /**
   * List environment roles
   *
   * List all environment roles in priority order.
   * @returns {Promise<EnvironmentRoleList>}
   * @throws 403 response from the API.
   */
  listEnvironmentRoles(): Promise<EnvironmentRoleList>;
  /**
   * Get an environment role
   *
   * Get an environment role by its slug.
   * @param slug - The slug of the environment role.
   *
   * @example
   * "admin"
   *
   * @returns {Promise<EnvironmentRole>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  getEnvironmentRole(slug: string): Promise<EnvironmentRole>;
  /**
   * Update an environment role
   *
   * Update an existing environment role.
   * @param slug - The slug of the environment role.
   *
   * @example
   * "admin"
   *
   * @param options - The request body.
   * @returns {Promise<EnvironmentRole>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  updateEnvironmentRole(slug: string, options: UpdateEnvironmentRoleOptions): Promise<EnvironmentRole>;
  /**
   * Set permissions for an environment role
   *
   * Replace all permissions on an environment role with the provided list.
   * @param slug - The slug of the environment role.
   *
   * @example
   * "admin"
   *
   * @param options - Object containing permissions.
   * @returns {Promise<EnvironmentRole>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  setEnvironmentRolePermissions(slug: string, options: SetEnvironmentRolePermissionsOptions): Promise<EnvironmentRole>;
  /**
   * Add a permission to an environment role
   *
   * Add a single permission to an environment role. If the permission is already assigned to the role, this operation has no effect.
   * @param slug - The slug of the environment role.
   *
   * @example
   * "admin"
   *
   * @param options - Object containing slug.
   * @returns {Promise<EnvironmentRole>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  addEnvironmentRolePermission(slug: string, options: AddEnvironmentRolePermissionOptions): Promise<EnvironmentRole>;
  /**
   * Create a custom role
   *
   * Create a new custom role for this organization.
   * @param organizationId - The ID of the organization.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param options - Object containing name.
   * @returns {Promise<OrganizationRole>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  createOrganizationRole(organizationId: string, options: CreateOrganizationRoleOptions): Promise<OrganizationRole>;
  /**
   * List custom roles
   *
   * Get a list of all roles that apply to an organization. This includes both environment roles and custom roles, returned in priority order.
   * @param organizationId - The ID of the organization.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @returns {Promise<RoleList>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  listOrganizationRoles(organizationId: string): Promise<RoleList>;
  /**
   * Get a custom role
   *
   * Retrieve a role that applies to an organization by its slug. This can return either an environment role or a custom role.
   * @param organizationId - The ID of the organization.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param slug - The slug of the role.
   *
   * @example
   * "org-billing-admin"
   *
   * @returns {Promise<Role>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  getOrganizationRole(organizationId: string, slug: string): Promise<Role>;
  /**
   * Update a custom role
   *
   * Update an existing custom role. Only the fields provided in the request body will be updated.
   * @param organizationId - The ID of the organization.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param slug - The slug of the role.
   *
   * @example
   * "org-billing-admin"
   *
   * @param options - The request body.
   * @returns {Promise<OrganizationRole>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  updateOrganizationRole(organizationId: string, slug: string, options: UpdateOrganizationRoleOptions): Promise<OrganizationRole>;
  /**
   * Delete a custom role
   *
   * Delete an existing custom role.
   * @param organizationId - The ID of the organization.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param slug - The slug of the role.
   *
   * @example
   * "org-admin"
   *
   * @returns {Promise<void>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   */
  deleteOrganizationRole(organizationId: string, slug: string): Promise<void>;
  /**
   * Set permissions for a custom role
   *
   * Replace all permissions on a custom role with the provided list.
   * @param organizationId - The ID of the organization.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param slug - The slug of the role.
   *
   * @example
   * "org-admin"
   *
   * @param options - Object containing permissions.
   * @returns {Promise<Role>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  setOrganizationRolePermissions(organizationId: string, slug: string, options: SetOrganizationRolePermissionsOptions): Promise<OrganizationRole>;
  /**
   * Add a permission to a custom role
   *
   * Add a single permission to a custom role. If the permission is already assigned to the role, this operation has no effect.
   * @param organizationId - The ID of the organization.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param slug - The slug of the role.
   *
   * @example
   * "org-admin"
   *
   * @param options - Object containing slug.
   * @returns {Promise<Role>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  addOrganizationRolePermission(organizationId: string, slug: string, options: AddOrganizationRolePermissionOptions): Promise<OrganizationRole>;
  /**
   * Remove a permission from a custom role
   *
   * Remove a single permission from a custom role by its slug.
   * @param organizationId - The ID of the organization.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param slug - The slug of the role.
   *
   * @example
   * "org-admin"
   *
   * @param permissionSlug - The slug of the permission to remove.
   *
   * @example
   * "documents:read"
   *
   * @returns {Promise<void>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  removeOrganizationRolePermission(organizationId: string, slug: string, options: RemoveOrganizationRolePermissionOptions): Promise<void>;
  /**
   * Create a permission
   *
   * Create a new permission in your WorkOS environment. The permission can then be assigned to environment roles and custom roles.
   * @param options - Object containing slug, name.
   * @returns {Promise<Permission>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  createPermission(options: CreatePermissionOptions): Promise<Permission>;
  /**
   * List permissions
   *
   * Get a list of all permissions in your WorkOS environment.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<Permission, PaginationOptions>>}
   * @throws {NotFoundException} 404
   */
  listPermissions(options?: ListPermissionsOptions): Promise<AutoPaginatable<Permission>>;
  /**
   * Get a permission
   *
   * Retrieve a permission by its unique slug.
   * @param slug - A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks.
   *
   * @example
   * "documents:read"
   *
   * @returns {Promise<Permission>}
   * @throws {NotFoundException} 404
   */
  getPermission(slug: string): Promise<Permission>;
  /**
   * Update a permission
   *
   * Update an existing permission. Only the fields provided in the request body will be updated.
   * @param slug - A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks.
   *
   * @example
   * "documents:read"
   *
   * @param options - The request body.
   * @returns {Promise<Permission>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  updatePermission(slug: string, options: UpdatePermissionOptions): Promise<Permission>;
  /**
   * Delete a permission
   *
   * Delete an existing permission. System permissions cannot be deleted.
   * @param slug - A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks.
   *
   * @example
   * "documents:read"
   *
   * @returns {Promise<void>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  deletePermission(slug: string): Promise<void>;
  /**
   * Get a resource
   *
   * Retrieve the details of an authorization resource by its ID.
   * @param resourceId - The ID of the authorization resource.
   *
   * @example
   * "authz_resource_01HXYZ123456789ABCDEFGHIJ"
   *
   * @returns {Promise<AuthorizationResource>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  getResource(resourceId: string): Promise<AuthorizationResource>;
  /**
   * Create an authorization resource
   *
   * Create a new authorization resource.
   * @param options - Object containing externalId, name, resourceTypeSlug, organizationId.
   * @returns {Promise<AuthorizationResource>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  createResource(options: CreateAuthorizationResourceOptions): Promise<AuthorizationResource>;
  /**
   * Update a resource
   *
   * Update an existing authorization resource.
   * @param options - The request body.
   * @returns {Promise<AuthorizationResource>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  updateResource(options: UpdateAuthorizationResourceOptions): Promise<AuthorizationResource>;
  /**
   * Delete an authorization resource
   *
   * Delete an authorization resource and all its descendants.
   * @param options.cascadeDelete - If true, deletes all descendant resources and role assignments. If not set and the resource has children or assignments, the request will fail.
   * @default false
   * @param options - Additional query options.
   * @returns {Promise<void>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   */
  deleteResource(options: DeleteAuthorizationResourceOptions): Promise<void>;
  /**
   * List resources
   *
   * Get a paginated list of authorization resources.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<AuthorizationResource, PaginationOptions>>}
   * @throws 403 response from the API.
   * @throws {UnprocessableEntityException} 422
   */
  listResources(options?: ListAuthorizationResourcesOptions): Promise<AutoPaginatable<AuthorizationResource>>;
  /**
   * Get a resource by external ID
   *
   * Retrieve the details of an authorization resource by its external ID, organization, and resource type. This is useful when you only have the external ID from your system and need to fetch the full resource details.
   * @param organizationId - The ID of the organization that owns the resource.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param resourceTypeSlug - The slug of the resource type.
   *
   * @example
   * "project"
   *
   * @param externalId - An identifier you provide to reference the resource in your system.
   *
   * @example
   * "proj-456"
   *
   * @returns {Promise<AuthorizationResource>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  getResourceByExternalId(options: GetAuthorizationResourceByExternalIdOptions): Promise<AuthorizationResource>;
  /**
   * Update a resource by external ID
   *
   * Update an existing authorization resource using its external ID.
   * @param organizationId - The ID of the organization that owns the resource.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param resourceTypeSlug - The slug of the resource type.
   *
   * @example
   * "project"
   *
   * @param externalId - An identifier you provide to reference the resource in your system.
   *
   * @example
   * "proj-456"
   *
   * @param options - The request body.
   * @returns {Promise<AuthorizationResource>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  updateResourceByExternalId(options: UpdateAuthorizationResourceByExternalIdOptions): Promise<AuthorizationResource>;
  /**
   * Delete an authorization resource by external ID
   *
   * Delete an authorization resource by organization, resource type, and external ID. This also deletes all descendant resources.
   * @param organizationId - The ID of the organization that owns the resource.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param resourceTypeSlug - The slug of the resource type.
   *
   * @example
   * "project"
   *
   * @param externalId - An identifier you provide to reference the resource in your system.
   *
   * @example
   * "proj-456"
   *
   * @param options - Additional query options.
   * @returns {Promise<void>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   */
  deleteResourceByExternalId(options: DeleteAuthorizationResourceByExternalIdOptions): Promise<void>;
  /**
   * Check authorization
   *
   * Check if an organization membership has a specific permission on a resource. Supports identification by resource_id OR by resource_external_id + resource_type_slug.
   * @param options - Object containing permissionSlug.
   * @returns {Promise<AuthorizationCheckResult>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  check(options: AuthorizationCheckOptions): Promise<AuthorizationCheckResult>;
  /**
   * List role assignments
   *
   * List all role assignments for an organization membership. This returns all roles that have been assigned to the user on resources, including organization-level and sub-resource roles.
   * @param organizationMembershipId - The ID of the organization membership.
   *
   * @example
   * "om_01HXYZ123456789ABCDEFGHIJ"
   *
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<RoleAssignment>>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  listRoleAssignments(options: ListRoleAssignmentsOptions): Promise<AutoPaginatable<RoleAssignment>>;
  /**
   * List role assignments for a resource
   *
   * List all role assignments granted on a resource. This returns every role assignment scoped to the resource, regardless of which organization membership received it.
   * @param resourceId - The ID of the authorization resource.
   *
   * @example
   * "authz_resource_01HXYZ123456789ABCDEFGHIJ"
   *
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<RoleAssignment>>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  listRoleAssignmentsForResource(options: ListRoleAssignmentsForResourceOptions): Promise<AutoPaginatable<RoleAssignment>>;
  /**
   * List role assignments for a resource by external ID
   *
   * List all role assignments granted on a resource identified by its external ID, organization, and resource type. This returns every role assignment scoped to the resource, regardless of which organization membership received it.
   * @param organizationId - The ID of the organization that owns the resource.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param resourceTypeSlug - The slug of the resource type this resource belongs to.
   *
   * @example
   * "project"
   *
   * @param externalId - An identifier you provide to reference the resource in your system.
   *
   * @example
   * "proj-456"
   *
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<RoleAssignment>>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  listResourceRoleAssignments(options: ListRoleAssignmentsForResourceByExternalIdOptions): Promise<AutoPaginatable<RoleAssignment>>;
  /**
   * Assign a role
   *
   * Assign a role to an organization membership on a specific resource.
   * @param options - Object containing roleSlug.
   * @returns {Promise<RoleAssignment>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  assignRole(options: AssignRoleOptions): Promise<RoleAssignment>;
  /**
   * Remove a role assignment
   *
   * Remove a role assignment by role slug and resource.
   * @param options - Object containing roleSlug.
   * @returns {Promise<void>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  removeRole(options: RemoveRoleOptions): Promise<void>;
  /**
   * Remove a role assignment by ID
   *
   * Remove a role assignment using its ID.
   * @param organizationMembershipId - The ID of the organization membership.
   *
   * @example
   * "om_01HXYZ123456789ABCDEFGHIJ"
   *
   * @param roleAssignmentId - The ID of the role assignment to remove.
   *
   * @example
   * "role_assignment_01HXYZ123456789ABCDEFGH"
   *
   * @returns {Promise<void>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  removeRoleAssignment(options: RemoveRoleAssignmentOptions): Promise<void>;
  /**
   * List role assignments for a group
   *
   * List all role assignments granted to a group. Each assignment represents a role granted to the group on a resource.
   * @param options - Pagination options.
   * @param options.groupId - The ID of the group.
   *
   * @example
   * "group_01HXYZ123456789ABCDEFGHIJ"
   *
   * @returns {Promise<AutoPaginatable<GroupRoleAssignment>>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  listGroupRoleAssignments(options: ListGroupRoleAssignmentsOptions): Promise<AutoPaginatable<GroupRoleAssignment>>;
  /**
   * Get a group role assignment
   *
   * Get a specific role assignment for a group by its ID.
   * @param options - Object containing groupId and roleAssignmentId.
   * @param options.groupId - The ID of the group.
   *
   * @example
   * "group_01HXYZ123456789ABCDEFGHIJ"
   *
   * @param options.roleAssignmentId - The ID of the group role assignment.
   *
   * @example
   * "gra_01HXYZ123456789ABCDEFGH"
   *
   * @returns {Promise<GroupRoleAssignment>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  getGroupRoleAssignment(options: GetGroupRoleAssignmentOptions): Promise<GroupRoleAssignment>;
  /**
   * Assign a role to a group
   *
   * Assign a role to a group on a specific resource. Omit the resource fields to assign the role on the organization itself.
   * @param options - Object containing groupId and roleSlug.
   * @returns {Promise<GroupRoleAssignment>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  createGroupRoleAssignment(options: CreateGroupRoleAssignmentOptions): Promise<GroupRoleAssignment>;
  /**
   * Remove a group role assignment
   *
   * Remove a specific role assignment from a group by its ID.
   * @param options - Object containing groupId and roleAssignmentId.
   * @param options.groupId - The ID of the group.
   *
   * @example
   * "group_01HXYZ123456789ABCDEFGHIJ"
   *
   * @param options.roleAssignmentId - The ID of the group role assignment to remove.
   *
   * @example
   * "gra_01HXYZ123456789ABCDEFGH"
   *
   * @returns {Promise<void>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   */
  removeGroupRoleAssignment(options: RemoveGroupRoleAssignmentOptions): Promise<void>;
  /**
   * Remove group role assignments by criteria
   *
   * Remove role assignments from a group that match the provided role and resource. Omit the resource fields to target the organization itself.
   * @param options - Object containing groupId and roleSlug.
   * @returns {Promise<void>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  removeGroupRoleAssignments(options: RemoveGroupRoleAssignmentsOptions): Promise<void>;
  /**
   * Replace role assignments for a group
   *
   * Replace all of a group's role assignments with the provided list. Assignments not present in the list are removed and new ones are created. Pass an empty `roleAssignments` array to clear all assignments. Returns the resulting set of assignments.
   * @param options - Object containing groupId and roleAssignments.
   * @returns {Promise<List<GroupRoleAssignment>>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  replaceGroupRoleAssignments(options: ReplaceGroupRoleAssignmentsOptions): Promise<List<GroupRoleAssignment>>;
  /**
   * List resources for organization membership
   *
   * Returns all child resources of a parent resource where the organization membership has a specific permission. This is useful for resource discovery—answering "What projects can this user access in this workspace?"
   *
   * You must provide either `parent_resource_id` or both `parent_resource_external_id` and `parent_resource_type_slug` to identify the parent resource.
   * @param organizationMembershipId - The ID of the organization membership.
   *
   * @example
   * "om_01HXYZ123456789ABCDEFGHIJ"
   *
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<AuthorizationResource>>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  listResourcesForMembership(options: ListResourcesForMembershipOptions): Promise<AutoPaginatable<AuthorizationResource>>;
  /**
   * List organization memberships for resource
   *
   * Returns all organization memberships that have a specific permission on a resource instance. This is useful for answering "Who can access this resource?".
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<BaseOrganizationMembership, PaginationOptions>>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  listMembershipsForResource(options: ListMembershipsForResourceOptions): Promise<AutoPaginatable<AuthorizationOrganizationMembership>>;
  /**
   * List memberships for a resource by external ID
   *
   * Returns all organization memberships that have a specific permission on a resource, using the resource's external ID. This is useful for answering "Who can access this resource?" when you only have the external ID.
   * @param organizationId - The ID of the organization that owns the resource.
   *
   * @example
   * "org_01EHZNVPK3SFK441A1RGBFSHRT"
   *
   * @param resourceTypeSlug - The slug of the resource type this resource belongs to.
   *
   * @example
   * "project"
   *
   * @param externalId - An identifier you provide to reference the resource in your system.
   *
   * @example
   * "proj-456"
   *
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<UserOrganizationMembershipBaseListData>>}
   * @throws {BadRequestException} 400
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  listMembershipsForResourceByExternalId(options: ListMembershipsForResourceByExternalIdOptions): Promise<AutoPaginatable<AuthorizationOrganizationMembership>>;
  /**
   * List effective permissions for an organization membership on a resource
   *
   * Returns all permissions the organization membership effectively has on a resource, including permissions inherited through roles assigned to ancestor resources.
   * @param organizationMembershipId - The ID of the organization membership.
   *
   * @example
   * "om_01HXYZ123456789ABCDEFGHIJ"
   *
   * @param resourceId - The ID of the authorization resource.
   *
   * @example
   * "authz_resource_01HXYZ123456789ABCDEFGHIJ"
   *
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<AuthorizationPermission>>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  listEffectivePermissions(options: ListEffectivePermissionsOptions): Promise<AutoPaginatable<Permission>>;
  /**
   * List effective permissions for an organization membership on a resource by external ID
   *
   * Returns all permissions the organization membership effectively has on a resource identified by its external ID, including permissions inherited through roles assigned to ancestor resources.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<Permission, PaginationOptions>>}
   * @throws 403 response from the API.
   * @throws {NotFoundException} 404
   * @throws {UnprocessableEntityException} 422
   */
  listEffectivePermissionsByExternalId(options: ListEffectivePermissionsByExternalIdOptions): Promise<AutoPaginatable<Permission>>;
}
//#endregion
//#region src/vault/interfaces/key/create-data-key.interface.d.ts
interface CreateDataKeyOptions {
  context: KeyContext;
}
//#endregion
//#region src/vault/interfaces/key/decrypt-data-key.interface.d.ts
interface DecryptDataKeyOptions {
  keys: string;
}
interface DecryptDataKeyResponse {
  data_key: string;
  id: string;
}
//#endregion
//#region src/vault/interfaces/create-rekey-options.interface.d.ts
interface CreateRekeyOptions {
  /** Map of values used to determine the new encryption key. */
  context: Record<string, string>;
  /** Base64-encoded encrypted data key blob to re-encrypt. */
  encryptedKeys: string;
}
//#endregion
//#region src/vault/interfaces/list-objects-options.interface.d.ts
interface ListObjectsOptions extends PaginationOptions {
  /** Filter results by name or structured search JSON. */
  search?: string;
  /** ISO 8601 timestamp to filter by last modified time. */
  updatedAfter?: Date;
}
//#endregion
//#region src/vault/interfaces/object/create-object.interface.d.ts
interface CreateObjectEntity {
  name: string;
  value: string;
  key_context: KeyContext;
}
interface CreateObjectOptions {
  name: string;
  value: string;
  context: KeyContext;
}
//#endregion
//#region src/vault/interfaces/object.interface.d.ts
interface ObjectUpdateBy {
  id: string;
  name: string;
}
//#endregion
//#region src/vault/interfaces/object/read-object.interface.d.ts
interface ReadObjectOptions {
  id: string;
}
interface ReadObjectMetadataResponse {
  context: KeyContext;
  environment_id: string;
  id: string;
  key_id: string;
  updated_at: string;
  updated_by: ObjectUpdateBy;
  version_id: string;
}
interface ReadObjectResponse {
  id: string;
  metadata: ReadObjectMetadataResponse;
  name: string;
  value?: string;
}
//#endregion
//#region src/vault/interfaces/object/update-object.interface.d.ts
interface UpdateObjectEntity {
  value: string;
  version_check?: string;
}
interface UpdateObjectOptions {
  id: string;
  value: string;
  versionCheck?: string;
}
//#endregion
//#region src/vault/interfaces/delete-vault-object-options.interface.d.ts
interface DeleteVaultObjectOptions {
  /** Unique identifier of the object. */
  id: string;
  /** Expected current version for optimistic locking. */
  versionCheck?: string;
}
//#endregion
//#region src/vault/interfaces/create-data-key-response.interface.d.ts
interface CreateDataKeyResponse {
  /** Map of values used to determine the encryption key. */
  context: Record<string, string>;
  /** Base64-encoded data encryption key. */
  dataKey?: string;
  /** Base64-encoded encrypted data key blob. */
  encryptedKeys?: string;
  /** Unique identifier for the generated data key. */
  id: string;
}
interface CreateDataKeyResponseWire {
  context: Record<string, string>;
  data_key: string;
  encrypted_keys: string;
  id: string;
}
//#endregion
//#region src/vault/interfaces/actor.interface.d.ts
/** The user or API key that performed an action. */
interface Actor {
  /** Unique identifier of the actor. */
  id: string;
  /** Display name of the actor. */
  name: string;
}
interface ActorResponse {
  id: string;
  name: string;
}
//#endregion
//#region src/vault/interfaces/object-metadata.interface.d.ts
/** Metadata for a stored encrypted object. */
interface ObjectMetadata {
  /** Map of values used to determine the encryption key. */
  context: Record<string, string>;
  /** Environment the object belongs to. */
  environmentId: string;
  /** Unique identifier of the object. */
  id: string;
  /** Encryption key identifier. */
  keyId: string;
  /** Timestamp of the last update. */
  updatedAt: Date;
  updatedBy: Actor;
  /** Current version identifier of the object. */
  versionId?: string | null;
}
interface ObjectMetadataResponse {
  context: Record<string, string>;
  environment_id: string;
  id: string;
  key_id: string;
  updated_at: string;
  updated_by: ActorResponse;
  version_id?: string | null;
}
//#endregion
//#region src/vault/interfaces/vault-object.interface.d.ts
/** An encrypted object with its decrypted value and metadata. */
interface VaultObject {
  /** Unique identifier of the object. */
  id: string;
  metadata: ObjectMetadata;
  /** Unique name of the object. */
  name: string;
  /** Decrypted plaintext value. */
  value?: string;
}
interface VaultObjectResponse {
  id: string;
  metadata: ObjectMetadataResponse;
  name: string;
  value: string;
}
//#endregion
//#region src/vault/interfaces/object-version.interface.d.ts
/** A static snapshot of an encrypted object. */
interface ObjectVersion {
  /** Timestamp when the version was created. */
  createdAt: Date;
  /** Whether this is the active version. */
  currentVersion: boolean;
  /** Hash of the object value. */
  etag?: string;
  /** Unique identifier of the version. */
  id: string;
  /** Number of bytes of stored data. */
  size?: number;
}
interface ObjectVersionResponse {
  created_at: string;
  current_version: boolean;
  etag?: string;
  id: string;
  size?: number;
}
//#endregion
//#region src/vault/interfaces/list-metadata.interface.d.ts
/** Cursor-based pagination metadata. */
interface ListMetadata {
  /** Cursor for the next page of results. */
  after?: string | null;
  /** Cursor for the previous page of results. */
  before?: string | null;
}
//#endregion
//#region src/vault/interfaces/version-list-response.interface.d.ts
interface VersionListResponse {
  /** List of object versions. */
  data: ObjectVersion[];
  listMetadata: ListMetadata;
}
//#endregion
//#region src/vault/interfaces/object-summary.interface.d.ts
/** Summary of an encrypted object returned in list responses. */
interface ObjectSummary {
  /** Unique identifier of the object. */
  id: string;
  /** Unique name of the object. */
  name: string;
  /** Timestamp of the last update. */
  updatedAt?: Date | null;
}
interface ObjectSummaryResponse {
  id: string;
  name: string;
  updated_at?: string | null;
}
//#endregion
//#region src/vault/interfaces/read-object-by-name-options.interface.d.ts
interface ReadObjectByNameOptions {
  /** Unique name of the object. */
  name: string;
}
//#endregion
//#region src/vault/vault.d.ts
declare class Vault {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * Read an object by name
   *
   * Fetch and decrypt an object by its unique name.
   * @param options - The object name string or request options.
   * @param options.name - Unique name of the object.
   * @example "my-secret"
   * @returns {Promise<VaultObject>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   */
  readObjectByName(name: string): Promise<VaultObject>;
  readObjectByName(options: ReadObjectByNameOptions): Promise<VaultObject>;
  /**
   * Create a data key
   *
   * Generate an isolated encryption key for local encryption operations.
   * @param options - Object containing context.
   * @param options.context - Map of values used to determine the encryption key.
   * @example {"organization_id":"org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"}
   * @returns {Promise<DataKeyPair>}
   * @throws {BadRequestException} 400
   * @throws {UnprocessableEntityException} 422
   */
  createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair>;
  /**
   * Decrypt a data key
   *
   * Decrypt a previously encrypted data key from WorkOS Vault.
   * @param options - Object containing keys.
   * @param options.keys - Base64-encoded encrypted data key to decrypt.
   * @example "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj"
   * @returns {Promise<DataKey>}
   * @throws {BadRequestException} 400
   */
  decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey>;
  /**
   * Re-encrypt a data key
   *
   * Decrypt an existing data key and re-encrypt it under a new key context.
   * @param options - Object containing context, encryptedKeys.
   * @param options.context - Map of values used to determine the new encryption key.
   * @example {"organization_id":"org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"}
   * @param options.encryptedKeys - Base64-encoded encrypted data key blob to re-encrypt.
   * @example "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJGJmNjVlMzI2LTQzYTAtNGIyMC04OGM0LTA3ZmYzZGU1NDM0YwF0YmY2NWUzMjYtNDNhMC00YjIwLTg4YzQtMDdmZjNkZTU0MzRj"
   * @returns {Promise<CreateDataKeyResponse>}
   * @throws {BadRequestException} 400
   * @throws {UnprocessableEntityException} 422
   */
  createRekey(options: CreateRekeyOptions): Promise<CreateDataKeyResponse>;
  /**
   * List objects
   *
   * List all encrypted objects with cursor-based pagination.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<ObjectSummary, PaginationOptions>>}
   * @throws {BadRequestException} 400
   */
  listObjects(options?: ListObjectsOptions): Promise<AutoPaginatable<ObjectSummary, PaginationOptions>>;
  /**
   * Create an object
   *
   * Encrypt and store a new key-value object.
   * @param options - Object containing keyContext, name, value.
   * @param options.keyContext - Map of values used to determine the encryption key.
   * @example {"organization_id":"org_01K8ZYT4AWJ6XP0E0S8CTBHE3P"}
   * @param options.name - Unique name for the object.
   * @example "my-secret"
   * @param options.value - Plaintext data to encrypt and store.
   * @example "s3cr3t-v4lu3"
   * @returns {Promise<ObjectMetadata>}
   * @throws {BadRequestException} 400
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  createObject(options: CreateObjectOptions): Promise<ObjectMetadata>;
  /**
   * Read an object by ID
   *
   * Fetch and decrypt an object by its unique identifier.
   * @param options - The request options.
   * @param options.id - Unique identifier of the object.
   * @example "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
   * @returns {Promise<VaultObject>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   */
  readObject(options: ReadObjectOptions): Promise<VaultObject>;
  /**
   * Update an object
   *
   * Update the value of an existing encrypted object.
   * @param options - Object containing value.
   * @param options.id - Unique identifier of the object.
   * @example "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
   * @param options.value - New plaintext value.
   * @example "upd4t3d-v4lu3"
   * @param options.versionCheck - ID of the expected current version for optimistic locking.
   * @example "c3d4e5f6-7890-abcd-ef12-34567890abcd"
   * @returns {Promise<VaultObject>}
   * @throws {BadRequestException} 400
   * @throws {ConflictException} 409
   */
  updateObject(options: UpdateObjectOptions): Promise<VaultObject>;
  /**
   * Delete an object
   *
   * Delete an encrypted object.
   * @param options - Additional query options.
   * @param options.id - Unique identifier of the object.
   * @example "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
   * @param options.versionCheck - Expected current version for optimistic locking.
   * @example "c3d4e5f6-7890-abcd-ef12-34567890abcd"
   * @returns {Promise<void>}
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   */
  deleteObject(options: DeleteVaultObjectOptions): Promise<void>;
  /**
   * Describe an object
   *
   * Fetch metadata for an object without decrypting it.
   * @param options - The request options.
   * @param options.id - Unique identifier of the object.
   * @example "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
   * @returns {Promise<VaultObject>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   */
  describeObject(options: ReadObjectOptions): Promise<VaultObject>;
  /**
   * List object versions
   *
   * Retrieve all versions for a specific object.
   * @param options - The request options.
   * @param options.id - Unique identifier of the object.
   * @example "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
   * @returns {Promise<ObjectVersion[]>}
   * @throws {BadRequestException} 400
   * @throws {NotFoundException} 404
   */
  listObjectVersions(options: ReadObjectOptions): Promise<VersionListResponse['data']>;
  private decode;
  decrypt(encryptedData: string, associatedData?: string): Promise<string>;
  encrypt(data: string, context: KeyContext, associatedData?: string): Promise<string>;
}
//#endregion
//#region src/workos.d.ts
/** WorkOS REST API */
declare class WorkOS {
  readonly baseURL: string;
  readonly client: HttpClient;
  readonly clientId?: string;
  readonly key?: string;
  readonly options: WorkOSOptions;
  readonly pkce: PKCE;
  private readonly hasApiKey;
  readonly actions: Actions;
  readonly agents: Agents;
  readonly apiKeys: ApiKeys;
  readonly auditLogs: AuditLogs;
  readonly authorization: Authorization;
  readonly directorySync: DirectorySync;
  readonly connect: Connect;
  readonly events: Events;
  readonly featureFlags: FeatureFlags;
  readonly groups: Groups;
  readonly multiFactorAuth: MultiFactorAuth;
  readonly organizations: Organizations;
  readonly organizationDomains: OrganizationDomains;
  readonly passwordless: Passwordless;
  readonly pipes: Pipes;
  readonly radar: Radar;
  readonly adminPortal: AdminPortal;
  readonly sso: SSO;
  readonly userManagement: UserManagement;
  readonly vault: Vault;
  readonly webhooks: Webhooks;
  readonly widgets: Widgets;
  /**
   * Create a new WorkOS client.
   *
   * @param keyOrOptions - API key string, or options object
   * @param maybeOptions - Options when first argument is API key
   *
   * @example
   * // Server-side with API key (string)
   * const workos = new WorkOS('sk_...');
   *
   * @example
   * // Server-side with API key (object)
   * const workos = new WorkOS({ apiKey: 'sk_...', clientId: 'client_...' });
   *
   * @example
   * // PKCE/public client (no API key)
   * const workos = new WorkOS({ clientId: 'client_...' });
   */
  constructor(keyOrOptions?: string | WorkOSOptions, maybeOptions?: WorkOSOptions);
  private createUserAgent;
  createWebhookClient(): Webhooks;
  createActionsClient(): Actions;
  getCryptoProvider(): CryptoProvider;
  createHttpClient(options: WorkOSOptions, userAgent: string): HttpClient;
  get version(): string;
  /**
   * Require API key for methods that need it.
   * @param methodName - Name of the method requiring API key (for error message)
   * @throws ApiKeyRequiredException if no API key was provided
   */
  requireApiKey(methodName: string): void;
  post<Result = any, Entity = any>(path: string, entity: Entity, options?: PostOptions): Promise<{
    data: Result;
  }>;
  get<Result = any>(path: string, options?: GetOptions): Promise<{
    data: Result;
  }>;
  put<Result = any, Entity = any>(path: string, entity: Entity, options?: PutOptions): Promise<{
    data: Result;
  }>;
  patch<Result = any, Entity = any>(path: string, entity: Entity, options?: PatchOptions): Promise<{
    data: Result;
  }>;
  delete(path: string, query?: Record<string, string | number | boolean | undefined>): Promise<void>;
  deleteWithBody<Entity = any>(path: string, entity: Entity): Promise<void>;
  emitWarning(warning: string): void;
  private handleHttpError;
}
//#endregion
//#region src/webhooks/interfaces/list-webhook-endpoints-options.interface.d.ts
type ListWebhookEndpointsOptions = PaginationOptions;
//#endregion
//#region src/webhooks/interfaces/create-webhook-endpoint-events.interface.d.ts
declare const CreateWebhookEndpointEvents: {
  readonly AuthenticationEmailVerificationSucceeded: "authentication.email_verification_succeeded";
  readonly AuthenticationMagicAuthFailed: "authentication.magic_auth_failed";
  readonly AuthenticationMagicAuthSucceeded: "authentication.magic_auth_succeeded";
  readonly AuthenticationMfaSucceeded: "authentication.mfa_succeeded";
  readonly AuthenticationOAuthFailed: "authentication.oauth_failed";
  readonly AuthenticationOAuthSucceeded: "authentication.oauth_succeeded";
  readonly AuthenticationPasswordFailed: "authentication.password_failed";
  readonly AuthenticationPasswordSucceeded: "authentication.password_succeeded";
  readonly AuthenticationPasskeyFailed: "authentication.passkey_failed";
  readonly AuthenticationPasskeySucceeded: "authentication.passkey_succeeded";
  readonly AuthenticationSSOFailed: "authentication.sso_failed";
  readonly AuthenticationSSOStarted: "authentication.sso_started";
  readonly AuthenticationSSOSucceeded: "authentication.sso_succeeded";
  readonly AuthenticationSSOTimedOut: "authentication.sso_timed_out";
  readonly AuthenticationRadarRiskDetected: "authentication.radar_risk_detected";
  readonly ApiKeyCreated: "api_key.created";
  readonly ApiKeyRevoked: "api_key.revoked";
  readonly ConnectionActivated: "connection.activated";
  readonly ConnectionDeactivated: "connection.deactivated";
  readonly ConnectionSAMLCertificateRenewalRequired: "connection.saml_certificate_renewal_required";
  readonly ConnectionSAMLCertificateRenewed: "connection.saml_certificate_renewed";
  readonly ConnectionDeleted: "connection.deleted";
  readonly DsyncActivated: "dsync.activated";
  readonly DsyncDeleted: "dsync.deleted";
  readonly DsyncGroupCreated: "dsync.group.created";
  readonly DsyncGroupDeleted: "dsync.group.deleted";
  readonly DsyncGroupUpdated: "dsync.group.updated";
  readonly DsyncGroupUserAdded: "dsync.group.user_added";
  readonly DsyncGroupUserRemoved: "dsync.group.user_removed";
  readonly DsyncUserCreated: "dsync.user.created";
  readonly DsyncUserDeleted: "dsync.user.deleted";
  readonly DsyncUserUpdated: "dsync.user.updated";
  readonly EmailVerificationCreated: "email_verification.created";
  readonly GroupCreated: "group.created";
  readonly GroupDeleted: "group.deleted";
  readonly GroupMemberAdded: "group.member_added";
  readonly GroupMemberRemoved: "group.member_removed";
  readonly GroupUpdated: "group.updated";
  readonly FlagCreated: "flag.created";
  readonly FlagDeleted: "flag.deleted";
  readonly FlagUpdated: "flag.updated";
  readonly FlagRuleUpdated: "flag.rule_updated";
  readonly InvitationAccepted: "invitation.accepted";
  readonly InvitationCreated: "invitation.created";
  readonly InvitationResent: "invitation.resent";
  readonly InvitationRevoked: "invitation.revoked";
  readonly MagicAuthCreated: "magic_auth.created";
  readonly OrganizationCreated: "organization.created";
  readonly OrganizationDeleted: "organization.deleted";
  readonly OrganizationUpdated: "organization.updated";
  readonly OrganizationDomainCreated: "organization_domain.created";
  readonly OrganizationDomainDeleted: "organization_domain.deleted";
  readonly OrganizationDomainUpdated: "organization_domain.updated";
  readonly OrganizationDomainVerified: "organization_domain.verified";
  readonly OrganizationDomainVerificationFailed: "organization_domain.verification_failed";
  readonly PasswordResetCreated: "password_reset.created";
  readonly PasswordResetSucceeded: "password_reset.succeeded";
  readonly UserCreated: "user.created";
  readonly UserUpdated: "user.updated";
  readonly UserDeleted: "user.deleted";
  readonly OrganizationMembershipCreated: "organization_membership.created";
  readonly OrganizationMembershipDeleted: "organization_membership.deleted";
  readonly OrganizationMembershipUpdated: "organization_membership.updated";
  readonly RoleCreated: "role.created";
  readonly RoleDeleted: "role.deleted";
  readonly RoleUpdated: "role.updated";
  readonly OrganizationRoleCreated: "organization_role.created";
  readonly OrganizationRoleDeleted: "organization_role.deleted";
  readonly OrganizationRoleUpdated: "organization_role.updated";
  readonly PermissionCreated: "permission.created";
  readonly PermissionDeleted: "permission.deleted";
  readonly PermissionUpdated: "permission.updated";
  readonly PipesConnectedAccountConnected: "pipes.connected_account.connected";
  readonly PipesConnectedAccountDisconnected: "pipes.connected_account.disconnected";
  readonly PipesConnectedAccountReauthorizationNeeded: "pipes.connected_account.reauthorization_needed";
  readonly SessionCreated: "session.created";
  readonly SessionRevoked: "session.revoked";
  readonly WaitlistUserApproved: "waitlist_user.approved";
  readonly WaitlistUserCreated: "waitlist_user.created";
  readonly WaitlistUserDenied: "waitlist_user.denied";
};
type CreateWebhookEndpointEvents = (typeof CreateWebhookEndpointEvents)[keyof typeof CreateWebhookEndpointEvents];
//#endregion
//#region src/webhooks/interfaces/create-webhook-endpoint-options.interface.d.ts
interface CreateWebhookEndpointOptions {
  /** The HTTPS URL where webhooks will be sent. */
  endpointUrl: string;
  /** The events that the Webhook Endpoint is subscribed to. */
  events: CreateWebhookEndpointEvents[];
}
//#endregion
//#region src/webhooks/interfaces/update-webhook-endpoint-status.interface.d.ts
declare const UpdateWebhookEndpointStatus: {
  readonly Enabled: "enabled";
  readonly Disabled: "disabled";
};
type UpdateWebhookEndpointStatus = (typeof UpdateWebhookEndpointStatus)[keyof typeof UpdateWebhookEndpointStatus];
//#endregion
//#region src/webhooks/interfaces/update-webhook-endpoint-events.interface.d.ts
declare const UpdateWebhookEndpointEvents: {
  readonly AuthenticationEmailVerificationSucceeded: "authentication.email_verification_succeeded";
  readonly AuthenticationMagicAuthFailed: "authentication.magic_auth_failed";
  readonly AuthenticationMagicAuthSucceeded: "authentication.magic_auth_succeeded";
  readonly AuthenticationMfaSucceeded: "authentication.mfa_succeeded";
  readonly AuthenticationOAuthFailed: "authentication.oauth_failed";
  readonly AuthenticationOAuthSucceeded: "authentication.oauth_succeeded";
  readonly AuthenticationPasswordFailed: "authentication.password_failed";
  readonly AuthenticationPasswordSucceeded: "authentication.password_succeeded";
  readonly AuthenticationPasskeyFailed: "authentication.passkey_failed";
  readonly AuthenticationPasskeySucceeded: "authentication.passkey_succeeded";
  readonly AuthenticationSSOFailed: "authentication.sso_failed";
  readonly AuthenticationSSOStarted: "authentication.sso_started";
  readonly AuthenticationSSOSucceeded: "authentication.sso_succeeded";
  readonly AuthenticationSSOTimedOut: "authentication.sso_timed_out";
  readonly AuthenticationRadarRiskDetected: "authentication.radar_risk_detected";
  readonly ApiKeyCreated: "api_key.created";
  readonly ApiKeyRevoked: "api_key.revoked";
  readonly ConnectionActivated: "connection.activated";
  readonly ConnectionDeactivated: "connection.deactivated";
  readonly ConnectionSAMLCertificateRenewalRequired: "connection.saml_certificate_renewal_required";
  readonly ConnectionSAMLCertificateRenewed: "connection.saml_certificate_renewed";
  readonly ConnectionDeleted: "connection.deleted";
  readonly DsyncActivated: "dsync.activated";
  readonly DsyncDeleted: "dsync.deleted";
  readonly DsyncGroupCreated: "dsync.group.created";
  readonly DsyncGroupDeleted: "dsync.group.deleted";
  readonly DsyncGroupUpdated: "dsync.group.updated";
  readonly DsyncGroupUserAdded: "dsync.group.user_added";
  readonly DsyncGroupUserRemoved: "dsync.group.user_removed";
  readonly DsyncUserCreated: "dsync.user.created";
  readonly DsyncUserDeleted: "dsync.user.deleted";
  readonly DsyncUserUpdated: "dsync.user.updated";
  readonly EmailVerificationCreated: "email_verification.created";
  readonly GroupCreated: "group.created";
  readonly GroupDeleted: "group.deleted";
  readonly GroupMemberAdded: "group.member_added";
  readonly GroupMemberRemoved: "group.member_removed";
  readonly GroupUpdated: "group.updated";
  readonly FlagCreated: "flag.created";
  readonly FlagDeleted: "flag.deleted";
  readonly FlagUpdated: "flag.updated";
  readonly FlagRuleUpdated: "flag.rule_updated";
  readonly InvitationAccepted: "invitation.accepted";
  readonly InvitationCreated: "invitation.created";
  readonly InvitationResent: "invitation.resent";
  readonly InvitationRevoked: "invitation.revoked";
  readonly MagicAuthCreated: "magic_auth.created";
  readonly OrganizationCreated: "organization.created";
  readonly OrganizationDeleted: "organization.deleted";
  readonly OrganizationUpdated: "organization.updated";
  readonly OrganizationDomainCreated: "organization_domain.created";
  readonly OrganizationDomainDeleted: "organization_domain.deleted";
  readonly OrganizationDomainUpdated: "organization_domain.updated";
  readonly OrganizationDomainVerified: "organization_domain.verified";
  readonly OrganizationDomainVerificationFailed: "organization_domain.verification_failed";
  readonly PasswordResetCreated: "password_reset.created";
  readonly PasswordResetSucceeded: "password_reset.succeeded";
  readonly UserCreated: "user.created";
  readonly UserUpdated: "user.updated";
  readonly UserDeleted: "user.deleted";
  readonly OrganizationMembershipCreated: "organization_membership.created";
  readonly OrganizationMembershipDeleted: "organization_membership.deleted";
  readonly OrganizationMembershipUpdated: "organization_membership.updated";
  readonly RoleCreated: "role.created";
  readonly RoleDeleted: "role.deleted";
  readonly RoleUpdated: "role.updated";
  readonly OrganizationRoleCreated: "organization_role.created";
  readonly OrganizationRoleDeleted: "organization_role.deleted";
  readonly OrganizationRoleUpdated: "organization_role.updated";
  readonly PermissionCreated: "permission.created";
  readonly PermissionDeleted: "permission.deleted";
  readonly PermissionUpdated: "permission.updated";
  readonly PipesConnectedAccountConnected: "pipes.connected_account.connected";
  readonly PipesConnectedAccountDisconnected: "pipes.connected_account.disconnected";
  readonly PipesConnectedAccountReauthorizationNeeded: "pipes.connected_account.reauthorization_needed";
  readonly SessionCreated: "session.created";
  readonly SessionRevoked: "session.revoked";
  readonly WaitlistUserApproved: "waitlist_user.approved";
  readonly WaitlistUserCreated: "waitlist_user.created";
  readonly WaitlistUserDenied: "waitlist_user.denied";
};
type UpdateWebhookEndpointEvents = (typeof UpdateWebhookEndpointEvents)[keyof typeof UpdateWebhookEndpointEvents];
//#endregion
//#region src/webhooks/interfaces/update-webhook-endpoint-options.interface.d.ts
interface UpdateWebhookEndpointOptions {
  /** Unique identifier of the Webhook Endpoint. */
  id: string;
  /** The HTTPS URL where webhooks will be sent. */
  endpointUrl?: string;
  /** Whether the Webhook Endpoint is enabled or disabled. */
  status?: UpdateWebhookEndpointStatus;
  /** The events that the Webhook Endpoint is subscribed to. */
  events?: UpdateWebhookEndpointEvents[];
}
//#endregion
//#region src/webhooks/interfaces/delete-webhook-endpoint-options.interface.d.ts
interface DeleteWebhookEndpointOptions {
  /** Unique identifier of the Webhook Endpoint. */
  id: string;
}
//#endregion
//#region src/webhooks/interfaces/webhook-endpoint-status.interface.d.ts
declare const WebhookEndpointStatus: {
  readonly Enabled: "enabled";
  readonly Disabled: "disabled";
};
type WebhookEndpointStatus = (typeof WebhookEndpointStatus)[keyof typeof WebhookEndpointStatus];
//#endregion
//#region src/webhooks/interfaces/webhook-endpoint.interface.d.ts
interface WebhookEndpoint {
  /** Distinguishes the Webhook Endpoint object. */
  object: 'webhook_endpoint';
  /** Unique identifier of the Webhook Endpoint. */
  id: string;
  /** The URL to which webhooks are sent. */
  endpointUrl: string;
  /** The secret used to sign webhook payloads. */
  secret: string;
  /** Whether the Webhook Endpoint is enabled or disabled. */
  status: WebhookEndpointStatus;
  /** The events that the Webhook Endpoint is subscribed to. */
  events: string[];
  /** An ISO 8601 timestamp. */
  createdAt: Date;
  /** An ISO 8601 timestamp. */
  updatedAt: Date;
}
interface WebhookEndpointResponse {
  object: 'webhook_endpoint';
  id: string;
  endpoint_url: string;
  secret: string;
  status: WebhookEndpointStatus;
  events: string[];
  created_at: string;
  updated_at: string;
}
//#endregion
//#region src/webhooks/webhooks.d.ts
declare class Webhooks {
  private readonly workos;
  constructor(workos: WorkOS);
  /**
   * List Webhook Endpoints
   *
   * Get a list of all of your existing webhook endpoints.
   * @param options - Pagination and filter options.
   * @returns {Promise<AutoPaginatable<WebhookEndpoint, PaginationOptions>>}
   */
  listWebhookEndpoints(options?: ListWebhookEndpointsOptions): Promise<AutoPaginatable<WebhookEndpoint, PaginationOptions>>;
  /**
   * Create a Webhook Endpoint
   *
   * Create a new webhook endpoint to receive event notifications.
   * @param options - Object containing endpointUrl, events.
   * @param options.endpointUrl - The HTTPS URL where webhooks will be sent.
   * @example "https://example.com/webhooks"
   * @param options.events - The events that the Webhook Endpoint is subscribed to.
   * @example ["user.created","dsync.user.created"]
   * @returns {Promise<WebhookEndpoint>}
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  createWebhookEndpoint(options: CreateWebhookEndpointOptions): Promise<WebhookEndpoint>;
  /**
   * Update a Webhook Endpoint
   *
   * Update the properties of an existing webhook endpoint.
   * @param options - The request body.
   * @param options.id - Unique identifier of the Webhook Endpoint.
   * @example "we_0123456789"
   * @param options.endpointUrl - The HTTPS URL where webhooks will be sent.
   * @example "https://example.com/webhooks"
   * @param options.status - Whether the Webhook Endpoint is enabled or disabled.
   * @example "enabled"
   * @param options.events - The events that the Webhook Endpoint is subscribed to.
   * @example ["user.created","dsync.user.created"]
   * @returns {Promise<WebhookEndpoint>}
   * @throws {NotFoundException} 404
   * @throws {ConflictException} 409
   * @throws {UnprocessableEntityException} 422
   */
  updateWebhookEndpoint(options: UpdateWebhookEndpointOptions): Promise<WebhookEndpoint>;
  /**
   * Delete a Webhook Endpoint
   *
   * Delete an existing webhook endpoint.
   * @param options - The request options.
   * @param options.id - Unique identifier of the Webhook Endpoint.
   * @example "we_0123456789"
   * @returns {Promise<void>}
   * @throws {NotFoundException} 404
   */
  deleteWebhookEndpoint(options: DeleteWebhookEndpointOptions): Promise<void>;
  private _signatureProvider?;
  private get signatureProvider();
  get verifyHeader(): ({ payload, sigHeader, secret, tolerance }: {
    payload: WebhookPayload;
    sigHeader: string;
    secret: string;
    tolerance?: number;
  }) => Promise<boolean>;
  get computeSignature(): (timestamp: any, payload: WebhookPayload, secret: string) => Promise<string>;
  get getTimestampAndSignatureHash(): (sigHeader: string) => [string, string];
  constructEvent({ payload, sigHeader, secret, tolerance }: {
    payload: WebhookPayload;
    sigHeader: string;
    secret: string;
    tolerance?: number;
  }): Promise<Event>;
  private parseVerifiedPayload;
}
//#endregion
//#region src/common/exceptions/api-key-required.exception.d.ts
declare class ApiKeyRequiredException extends Error {
  readonly status = 403;
  readonly name = "ApiKeyRequiredException";
  readonly path: string;
  constructor(path: string);
}
//#endregion
//#region src/common/interfaces/request-exception.interface.d.ts
interface RequestException {
  readonly status: number;
  readonly message: string;
  readonly requestID: string;
}
//#endregion
//#region src/common/exceptions/generic-server.exception.d.ts
interface WorkOSErrorData {
  code?: string;
  message?: string;
  [key: string]: unknown;
}
declare class GenericServerException extends Error implements RequestException {
  readonly status: number;
  readonly rawData: WorkOSErrorData;
  readonly requestID: string;
  readonly name: string;
  readonly message: string;
  readonly code: string | undefined;
  constructor(status: number, message: string | undefined, rawData: WorkOSErrorData, requestID: string);
}
//#endregion
//#region src/common/exceptions/authentication.exception.d.ts
type AuthenticationErrorCode = 'email_verification_required' | 'organization_selection_required' | 'mfa_enrollment' | 'mfa_challenge' | 'mfa_verification' | 'radar_email_challenge' | 'radar_sms_challenge' | 'sso_required';
interface BaseAuthenticationErrorData extends WorkOSErrorData {
  pending_authentication_token?: string;
  radar_challenge_id?: string;
  user?: UserResponse;
  organizations?: Array<{
    id: string;
    name: string;
  }>;
  connection_ids?: string[];
}
type AuthenticationErrorData = (BaseAuthenticationErrorData & {
  code: Exclude<AuthenticationErrorCode, 'sso_required'>;
}) | (BaseAuthenticationErrorData & {
  error: 'sso_required';
  error_description: string;
});
declare function isAuthenticationErrorData(data: WorkOSErrorData): data is AuthenticationErrorData;
declare class AuthenticationException extends GenericServerException {
  readonly rawData: AuthenticationErrorData;
  readonly name = "AuthenticationException";
  readonly code: AuthenticationErrorCode;
  readonly pendingAuthenticationToken: string | undefined;
  readonly radarChallengeId: string | undefined;
  constructor(status: number, rawData: AuthenticationErrorData, requestID: string);
}
//#endregion
//#region src/common/exceptions/bad-request.exception.d.ts
declare class BadRequestException extends Error implements RequestException {
  readonly status = 400;
  readonly name = "BadRequestException";
  readonly message: string;
  readonly code?: string;
  readonly errors?: unknown[];
  readonly requestID: string;
  constructor({ code, errors, message, requestID }: {
    code?: string;
    errors?: unknown[];
    message?: string;
    requestID: string;
  });
}
//#endregion
//#region src/common/exceptions/conflict.exception.d.ts
declare class ConflictException extends Error implements RequestException {
  readonly status = 409;
  readonly name = "ConflictException";
  readonly requestID: string;
  readonly code?: string;
  constructor({ error, message, requestID, code }: {
    error?: string;
    message?: string;
    requestID: string;
    code?: string;
  });
}
//#endregion
//#region src/common/exceptions/no-api-key-provided.exception.d.ts
declare class NoApiKeyProvidedException extends Error {
  readonly status = 500;
  readonly name = "NoApiKeyProvidedException";
  readonly message: string;
}
//#endregion
//#region src/common/exceptions/not-found.exception.d.ts
declare class NotFoundException extends Error implements RequestException {
  readonly status = 404;
  readonly name = "NotFoundException";
  readonly message: string;
  readonly code?: string;
  readonly requestID: string;
  constructor({ code, message, path, requestID }: {
    code?: string;
    message?: string;
    path: string;
    requestID: string;
  });
}
//#endregion
//#region src/common/exceptions/oauth.exception.d.ts
declare class OauthException extends Error implements RequestException {
  readonly status: number;
  readonly requestID: string;
  readonly error: string | undefined;
  readonly errorDescription: string | undefined;
  readonly rawData: unknown;
  readonly name = "OauthException";
  constructor(status: number, requestID: string, error: string | undefined, errorDescription: string | undefined, rawData: unknown);
}
//#endregion
//#region src/common/exceptions/rate-limit-exceeded.exception.d.ts
declare class RateLimitExceededException extends GenericServerException {
  /**
   * The number of seconds to wait before retrying the request.
   */
  readonly retryAfter: number | null;
  readonly name = "RateLimitExceededException";
  constructor(message: string, requestID: string,
  /**
   * The number of seconds to wait before retrying the request.
   */
  retryAfter: number | null);
}
//#endregion
//#region src/common/exceptions/signature-verification.exception.d.ts
declare class SignatureVerificationException extends Error {
  readonly name = "SignatureVerificationException";
  constructor(message: string);
}
//#endregion
//#region src/common/exceptions/unauthorized.exception.d.ts
declare class UnauthorizedException extends Error implements RequestException {
  readonly requestID: string;
  readonly status = 401;
  readonly name = "UnauthorizedException";
  readonly message: string;
  constructor(requestID: string);
}
//#endregion
//#region src/common/exceptions/unprocessable-entity.exception.d.ts
declare class UnprocessableEntityException extends Error implements RequestException {
  readonly status = 422;
  readonly name = "UnprocessableEntityException";
  readonly message: string;
  readonly code?: string;
  readonly requestID: string;
  constructor({ code, errors, message, requestID }: {
    code?: string;
    errors?: UnprocessableEntityError[];
    message?: string;
    requestID: string;
  });
}
//#endregion
//#region src/admin-portal/interfaces/sso-intent-options.interface.d.ts
interface SSOIntentOptions {
  /** The bookmark slug to use for SSO. */
  bookmarkSlug?: string;
  /** The SSO provider type to configure. */
  providerType?: 'GoogleSAML';
}
interface SSOIntentOptionsResponse {
  bookmark_slug?: string;
  provider_type?: 'GoogleSAML';
}
//#endregion
//#region src/admin-portal/interfaces/intent-options.interface.d.ts
interface IntentOptions {
  /** SSO-specific options for the Admin Portal. */
  sso: SSOIntentOptions;
}
interface IntentOptionsResponse {
  sso: SSOIntentOptionsResponse;
}
//#endregion
//#region src/admin-portal/interfaces/generate-link.interface.d.ts
interface GenerateLink {
  /** The URL to go to when an admin clicks on your logo in the Admin Portal. If not specified, the return URL configured on the [Redirects](https://dashboard.workos.com/redirects) page will be used. */
  returnUrl?: string;
  /** The URL to redirect the admin to when they finish setup. If not specified, the success URL configured on the [Redirects](https://dashboard.workos.com/redirects) page will be used. */
  successUrl?: string;
  /** An [Organization](https://workos.com/docs/reference/organization) identifier. */
  organization: string;
  /**
   *
   *       The intent of the Admin Portal.
   *         - `sso` - Launch Admin Portal for creating SSO connections
   *         - `dsync` - Launch Admin Portal for creating Directory Sync connections
   *         - `audit_logs` - Launch Admin Portal for viewing Audit Logs
   *         - `log_streams` - Launch Admin Portal for creating Log Streams
   *         - `domain_verification` - Launch Admin Portal for Domain Verification
   *         - `certificate_renewal` - Launch Admin Portal for renewing SAML Certificates
   *         - `bring_your_own_key` - Launch Admin Portal for configuring Bring Your Own Key
   */
  intent?: GenerateLinkIntent;
  /** Options to configure the Admin Portal based on the intent. */
  intentOptions?: IntentOptions;
  /** The email addresses of the IT admins to grant access to the Admin Portal for the given organization. Accepts up to 20 emails. */
  adminEmails?: string[];
}
interface GenerateLinkResponse {
  return_url?: string;
  success_url?: string;
  organization: string;
  intent?: GenerateLinkIntent;
  intent_options?: IntentOptionsResponse;
  admin_emails?: string[];
}
//#endregion
//#region src/admin-portal/interfaces/portal-link-response.interface.d.ts
interface PortalLinkResponse {
  /** An ephemeral link to initiate the Admin Portal. */
  link: string;
}
interface PortalLinkResponseWire {
  link: string;
}
//#endregion
//#region src/factory.d.ts
/**
 * Method names available without API key - single source of truth.
 * Add new public methods here to expose them on PublicUserManagement.
 */
type PublicUserManagementMethods = 'getAuthorizationUrl' | 'getAuthorizationUrlWithPKCE' | 'authenticateWithCode' | 'authenticateWithCodeAndVerifier' | 'authenticateWithRefreshToken' | 'getLogoutUrl' | 'getJwksUrl';
/**
 * SSO method names available without API key.
 */
type PublicSSOMethods = 'getAuthorizationUrl' | 'getAuthorizationUrlWithPKCE' | 'getProfileAndToken';
/**
 * Subset of UserManagement methods available without an API key.
 * Used by public clients (browser, mobile, CLI, desktop apps).
 */
type PublicUserManagement = Pick<UserManagement, PublicUserManagementMethods>;
/**
 * Subset of SSO methods available without an API key.
 */
type PublicSSO = Pick<SSO, PublicSSOMethods>;
/**
 * WorkOS client for public/PKCE-only usage.
 * Returned when initialized with only clientId (no API key).
 *
 * For browser, mobile, CLI, and desktop applications that cannot
 * securely store an API key.
 */
interface PublicWorkOS {
  readonly baseURL: string;
  readonly clientId: string;
  readonly pkce: PKCE;
  readonly userManagement: PublicUserManagement;
  readonly sso: PublicSSO;
}
/**
 * Options for creating a public client (PKCE-only, no API key).
 */
interface PublicClientOptions extends Omit<WorkOSOptions, 'apiKey'> {
  clientId: string;
  /** Discriminant: ensures TypeScript selects PublicWorkOS overload when apiKey is absent */
  apiKey?: never;
}
/**
 * Options for creating a confidential client (with API key).
 */
interface ConfidentialClientOptions extends WorkOSOptions {
  apiKey: string;
}
/**
 * Create a type-safe WorkOS client.
 *
 * Returns a narrowed `PublicWorkOS` type when only `clientId` is provided,
 * ensuring compile-time safety for public client usage. Returns the full
 * `WorkOS` type when an API key is provided.
 *
 * Unlike the `WorkOS` constructor, this factory does NOT read from
 * environment variables. Pass credentials explicitly for predictable types.
 *
 * @example
 * // Public client (browser, mobile, CLI) - returns PublicWorkOS
 * const workos = createWorkOS({ clientId: 'client_123' });
 * await workos.userManagement.getAuthorizationUrlWithPKCE({...}); // OK
 * workos.userManagement.listUsers(); // TypeScript error!
 *
 * @example
 * // Confidential client (server) - returns full WorkOS
 * const workos = createWorkOS({
 *   apiKey: process.env.WORKOS_API_KEY!,
 *   clientId: 'client_123'
 * });
 * await workos.userManagement.listUsers(); // OK
 */
declare function createWorkOS(options: PublicClientOptions): PublicWorkOS;
declare function createWorkOS(options: ConfidentialClientOptions): WorkOS;
//#endregion
export { ReadObjectMetadataResponse as $, FlagDeletedEventResponse as $a, AuthMethod as $c, ConnectionResponse as $d, BaseAssignRoleOptions as $f, AuthenticationMfaSucceededEventResponse as $i, Invitation as $l, PasswordlessSessionResponse as $n, OrganizationUpdatedResponse as $o, AddEnvironmentRolePermissionOptions as $p, SerializedLinkClaimAttemptToExternalUserOptions as $r, ListGroupsOptions as $s, DataIntegrationsListResponseDataOwnership as $t, UserManagementAccessToken as $u, ApiKeyRequiredException as A, DsyncGroupDeletedEvent as Aa, SerializedCreateOrganizationApiKeyOptions as Ac, SerializedAuthenticateWithEmailVerificationOptions as Ad, RemoveGroupRoleAssignmentsOptionsWithResourceExternalId as Af, DomainData as Ai, MagicAuthResponse as Al, CryptoProvider as Am, ConnectedAccountState as An, OrganizationDomainCreatedEvent as Ao, AuthorizationResource as Ap, CompleteOAuth2Options as Ar, VaultDataCreatedEventResponse as As, SerializedAuditLogExportOptions as At, Factor as Au, ObjectSummaryResponse as B, DsyncUserDeletedEvent as Ba, SerializedCreateOrganizationDomainOptions as Bc, WithResolvedClientId as Bd, GetGroupRoleAssignmentOptions as Bf, GetOptions as Bi, ListOrganizationMembershipsOptions as Bl, UpdateCustomProviderDefinitionAuthenticateVia as Bn, OrganizationMembershipCreated as Bo, UpdatePermissionOptions as Bp, AgentCredentialValidation as Br, VaultDekReadEventResponse as Bs, RadarStandaloneResponse as Bt, SmsResponse as Bu, BadRequestException as C, ConnectionDeletedEventResponse as Ca, ValidateApiKeyOptions as Cc, AuthenticateWithRadarEmailChallengeOptions as Cd, GroupRoleAssignmentEntryWithResourceId as Cf, Organization as Ci, PasswordResetEventResponse as Cl, HttpClient as Cm, DataIntegrationCredential as Cn, InvitationRevokedEventResponse as Co, SerializedAuthorizationCheckOptions as Cp, CreateM2MApplication as Cr, UserDeletedEvent as Cs, AuditLogSchema as Ct, AuthenticationRadarRiskDetectedEventData as Cu, isAuthenticationErrorData as D, DsyncDeletedEventResponse as Da, SerializedCreatedApiKey as Dc, SerializedAuthenticateWithMagicAuthOptions as Dd, BaseRemoveGroupRoleAssignmentsOptions as Df, CreateOrganizationOptions as Di, MagicAuth as Dl, RequestOptions as Dm, DeleteUserConnectedAccountOptions as Dn, OrganizationCreatedResponse as Do, GetAuthorizationResourceByExternalIdOptions as Dp, RedirectUriInput as Dr, VaultByokKeyVerificationCompletedEvent as Ds, AuditLogExport as Dt, AuthenticationFactorType as Du, AuthenticationException as E, DsyncDeletedEvent as Ea, CreatedApiKey as Ec, AuthenticateWithMagicAuthOptions as Ed, SerializedReplaceGroupRoleAssignmentsOptions as Ef, ListOrganizationFeatureFlagsOptions as Ei, CreateMagicAuthResponseResponse as El, RequestHeaders as Em, ListUserDataProvidersOptions as En, OrganizationCreatedEvent as Eo, UpdateAuthorizationResourceByExternalIdOptions as Ep, CreateOAuthApplicationResponse as Er, UserUpdatedEventResponse as Es, AuditLogTargetSchema as Et, AuthenticationFactorResponse as Eu, UpdateWebhookEndpointEvents as F, DsyncGroupUserAddedEventResponse as Fa, OrganizationDomain as Fc, SerializedAuthenticateWithCodeOptions as Fd, CreateGroupRoleAssignmentOptions as Ff, PutOptions as Fi, ListUserApiKeysOptions as Fl, UpdateDataIntegrationApiKeyOptions as Fn, OrganizationDomainUpdatedEventResponse as Fo, SerializedCreateAuthorizationResourceOptions as Fp, UserObject as Fr, VaultDataUpdatedEvent as Fs, Challenge as Ft, Totp as Fu, ObjectMetadata as G, EmailVerificationCreatedEventResponse as Ga, SerializedUserApiKey as Gc, OauthTokens as Gd, BaseRemoveRoleOptions as Gf, ApiKeyRevokedEventResponse as Gi, BaseOrganizationMembershipResponse as Gl, CustomProviderDefinitionAuthenticateVia as Gn, OrganizationMembershipUpdatedResponse as Go, RemoveOrganizationRolePermissionOptions as Gp, ValidAgentCredential as Gr, VaultNamesListedEvent as Gs, RadarListAction as Gt, AuthenticateUserWithTotpCredentials as Gu, ObjectVersionResponse as H, DsyncUserUpdatedEvent as Ha, VerifyEmailOptions as Hc, ProfileAndTokenResponse as Hd, GroupRoleAssignment as Hf, ApiKeyCreatedEvent as Hi, AuthorizationOrganizationMembership as Hl, CreateDataIntegrationOptions as Hn, OrganizationMembershipDeleted as Ho, SerializedCreatePermissionOptions as Hp, SerializedAgentAccessTokenClaims as Hr, VaultKekCreatedEventResponse as Hs, RadarStandaloneResponseBlocklistType as Ht, AuthenticationEventResponse as Hu, UpdateWebhookEndpointStatus as I, DsyncGroupUserRemovedEvent as Ia, OrganizationDomainResponse as Ic, AuthenticateWithOptionsBase as Id, CreateGroupRoleAssignmentOptionsForOrganization as If, PostOptions as Ii, SerializedListUserApiKeysOptions as Il, DeleteDataIntegrationOptions as In, OrganizationDomainVerificationFailedEvent as Io, SerializedUpdateAuthorizationResourceOptions as Ip, UserObjectResponse as Ir, VaultDataUpdatedEventResponse as Is, ChallengeResponse as It, TotpResponse as Iu, ActorResponse as J, EventName as Ja, UpdateUserPasswordOptions as Jc, SerializedListConnectionsOptions as Jd, RemoveRoleOptionsWithResourceId as Jf, AuthenticationMagicAuthFailedEvent as Ji, OrganizationMembershipStatus as Jl, DataIntegrationCredentialsType as Jn, OrganizationRoleDeletedEvent as Jo, SerializedUpdateOrganizationRoleOptions as Jp, ValidateAgentCredentialOptions as Jr, DataKeyPair as Js, RadarStandaloneAssessRequestAuthMethod as Jt, AuthenticateWithSessionCookieFailedResponse as Ju, ObjectMetadataResponse as K, Event as Ka, UserApiKey as Kc, OauthTokensResponse as Kd, RemoveRoleOptions as Kf, AuthenticationEmailVerificationSucceededEvent as Ki, OrganizationMembership as Kl, DataIntegrationCredentialsDto as Kn, OrganizationRoleCreatedEvent as Ko, AddOrganizationRolePermissionOptions as Kp, ValidateAgentAccessTokenOptions as Kr, VaultNamesListedEventResponse as Ks, RadarListType as Kt, AuthenticateWithTotpOptions as Ku, CreateWebhookEndpointEvents as L, DsyncGroupUserRemovedEventResponse as La, OrganizationDomainState as Lc, AuthenticateWithSessionOptions as Ld, CreateGroupRoleAssignmentOptionsWithResourceExternalId as Lf, PatchOptions as Li, ListUserFeatureFlagsOptions as Ll, UpdateDataIntegrationOptions as Ln, OrganizationDomainVerificationFailedEventResponse as Lo, UpdateAuthorizationResourceOptions as Lp, AutoPaginatable as Lr, VaultDekDecryptedEvent as Ls, ChallengeFactorOptions as Lt, TotpWithSecrets as Lu, WebhookEndpoint as M, DsyncGroupUpdatedEvent as Ma, SerializedApiKey as Mc, SerializedAuthenticateWithCodeAndVerifierOptions as Md, SerializedRemoveGroupRoleAssignmentsOptions as Mf, WorkOSResponseError as Mi, Locale as Ml, GetAccessTokenOptions as Mn, OrganizationDomainDeletedEvent as Mo, CreateAuthorizationResourceOptions as Mp, UserConsentOptionResponse as Mr, VaultDataDeletedEventResponse as Ms, VerifyResponseResponse as Mt, FactorType as Mu, WebhookEndpointResponse as N, DsyncGroupUpdatedEventResponse as Na, OrganizationDomainVerificationFailed as Nc, AuthenticateUserWithCodeCredentials as Nd, RemoveGroupRoleAssignmentOptions as Nf, WorkOSOptions as Ni, ListUsersOptions as Nl, CreateDataIntegrationCredentialOptions as Nn, OrganizationDomainDeletedEventResponse as No, CreateOptionsWithParentExternalId as Np, UserConsentOptionChoice as Nr, VaultDataReadEvent as Ns, VerifyChallengeOptions as Nt, FactorWithSecrets as Nu, GenericServerException as O, DsyncGroupCreatedEvent as Oa, CreateOrganizationApiKeyOptions as Oc, AuthenticateUserWithEmailVerificationCredentials as Od, RemoveGroupRoleAssignmentsOptions as Of, CreateOrganizationRequestOptions as Oi, MagicAuthEvent as Ol, ResponseHeaderValue as Om, UpdateUserConnectedAccountOptions as On, OrganizationDeletedEvent as Oo, ListAuthorizationResourcesOptions as Op, RedirectUriInputResponse as Or, VaultByokKeyVerificationCompletedEventResponse as Os, AuditLogExportResponse as Ot, AuthenticationFactorWithSecrets as Ou, WebhookEndpointStatus as P, DsyncGroupUserAddedEvent as Pa, OrganizationDomainVerificationFailedResponse as Pc, AuthenticateWithCodeOptions as Pd, BaseCreateGroupRoleAssignmentOptions as Pf, UnprocessableEntityError as Pi, SerializedListUsersOptions as Pl, AuthorizeDataIntegrationOptions as Pn, OrganizationDomainUpdatedEvent as Po, CreateOptionsWithParentResourceId as Pp, UserConsentOptionChoiceResponse as Pr, VaultDataReadEventResponse as Ps, EnrollFactorOptions as Pt, FactorWithSecretsResponse as Pu, UpdateObjectOptions as Q, FlagDeletedEvent as Qa, UpdateOrganizationMembershipOptions as Qc, ConnectionDomain as Qd, AssignRoleOptionsWithResourceId as Qf, AuthenticationMfaSucceededEvent as Qi, ListAuthFactorsOptions as Ql, PasswordlessSession as Qn, OrganizationUpdatedEvent as Qo, OrganizationRole as Qp, SerializedClaimAttemptResponse as Qr, RemoveGroupOrganizationMembershipOptions as Qs, DataIntegrationsListResponseDataResponse as Qt, SessionCookieData as Qu, WorkOS as R, DsyncUserCreatedEvent as Ra, OrganizationDomainVerificationStrategy as Rc, SerializedAuthenticatePublicClientBase as Rd, CreateGroupRoleAssignmentOptionsWithResourceId as Rf, List as Ri, ListSessionsOptions as Rl, UpdateCustomProviderDefinition as Rn, OrganizationDomainVerifiedEvent as Ro, ListPermissionsOptions as Rp, AgentAccessTokenClaims as Rr, VaultDekDecryptedEventResponse as Rs, RadarListEntryAlreadyPresentResponse as Rt, TotpWithSecretsResponse as Ru, ConflictException as S, ConnectionDeletedEvent as Sa, SerializedValidateApiKeyResponse as Sc, AuthenticateUserWithRadarEmailChallengeCredentials as Sd, GroupRoleAssignmentEntryWithResourceExternalId as Sf, UpdateOrganizationOptions as Si, PasswordResetEvent as Sl, EventDirectoryResponse as Sm, DataIntegrationCustomProviderAuthenticateVia as Sn, InvitationRevokedEvent as So, AuthorizationCheckResult as Sp, CreateApplicationOptions as Sr, UserCreatedEventResponse as Ss, AuditLogActorSchema as St, UserManagementAuthorizationURLOptions as Su, AuthenticationErrorData as T, DsyncActivatedEventResponse as Ta, ListOrganizationApiKeysOptions as Tc, AuthenticateUserWithMagicAuthCredentials as Td, SerializedGroupRoleAssignmentEntry as Tf, ListOrganizationsOptions as Ti, CreateMagicAuthResponse as Tl, HttpClientResponseInterface as Tm, DataIntegrationCredentialType as Tn, MagicAuthCreatedEventResponse as To, DeleteAuthorizationResourceByExternalIdOptions as Tp, CreateOAuthApplication as Tr, UserUpdatedEvent as Ts, AuditLogSchemaResponse as Tt, AuthenticationFactor as Tu, VaultObject as U, DsyncUserUpdatedEventResponse as Ua, SerializedUserApiKeyWithValue as Uc, Profile as Ud, GroupRoleAssignmentResponse as Uf, ApiKeyCreatedEventResponse as Ui, AuthorizationOrganizationMembershipResponse as Ul, CustomProviderDefinition as Un, OrganizationMembershipDeletedResponse as Uo, Permission as Up, SerializedAgentCredentialValidation as Ur, VaultMetadataReadEvent as Us, RadarStandaloneResponseControl as Ut, AuthenticationEventSso as Uu, ObjectVersion as V, DsyncUserDeletedEventResponse as Va, SerializedVerifyEmailOptions as Vc, ProfileAndToken as Vd, ListGroupRoleAssignmentsOptions as Vf, GenerateLinkIntent as Vi, SerializedListOrganizationMembershipsOptions as Vl, GetDataIntegrationOptions as Vn, OrganizationMembershipCreatedResponse as Vo, CreatePermissionOptions as Vp, InvalidAgentCredential as Vr, VaultKekCreatedEvent as Vs, RadarStandaloneResponseWire as Vt, AuthenticationEvent as Vu, VaultObjectResponse as W, EmailVerificationCreatedEvent as Wa, UserApiKeyWithValue as Wc, ProfileResponse as Wd, RemoveRoleAssignmentOptions as Wf, ApiKeyRevokedEvent as Wi, BaseOrganizationMembership as Wl, CustomProviderDefinitionResponse as Wn, OrganizationMembershipUpdated as Wo, PermissionResponse as Wp, SerializedValidateAgentCredentialOptions as Wr, VaultMetadataReadEventResponse as Ws, RadarStandaloneResponseVerdict as Wt, AuthenticationEventSsoResponse as Wu, CreateDataKeyResponseWire as X, FlagCreatedEvent as Xa, UpdateUserOptions as Xc, GetProfileOptions as Xd, AssignRoleOptions as Xf, AuthenticationMagicAuthSucceededEvent as Xi, SerializedListInvitationsOptions as Xl, CreatePasswordlessSessionOptions as Xn, OrganizationRoleUpdatedEvent as Xo, CreateOrganizationRoleOptions as Xp, ClaimAttemptResponse as Xr, SerializedUpdateGroupOptions as Xs, DataIntegrationsListResponseWire as Xt, AuthenticateWithSessionCookieOptions as Xu, CreateDataKeyResponse as Y, EventResponse as Ya, SerializedUpdateUserOptions as Yc, GetProfileAndTokenOptions as Yd, SerializedRemoveRoleOptions as Yf, AuthenticationMagicAuthFailedEventResponse as Yi, ListInvitationsOptions as Yl, SendSessionResponse as Yn, OrganizationRoleDeletedEventResponse as Yo, UpdateOrganizationRoleOptions as Yp, ClaimAttemptOrganization as Yr, KeyContext as Ys, DataIntegrationsListResponse as Yt, AuthenticateWithSessionCookieFailureReason as Yu, UpdateObjectEntity as Z, FlagCreatedEventResponse as Za, SerializedUpdateOrganizationMembershipOptions as Zc, Connection as Zd, AssignRoleOptionsWithResourceExternalId as Zf, AuthenticationMagicAuthSucceededEventResponse as Zi, ListGroupsForOrganizationMembershipOptions as Zl, SerializedCreatePasswordlessSessionOptions as Zn, OrganizationRoleUpdatedEventResponse as Zo, SerializedCreateOrganizationRoleOptions as Zp, LinkClaimAttemptToExternalUserOptions as Zr, UpdateGroupOptions as Zs, DataIntegrationsListResponseData as Zt, AuthenticateWithSessionCookieSuccessResponse as Zu, SignatureVerificationException as _, AuthenticationSSOSucceededEventResponse as _a, FlagTarget as _c, AuthenticateWithOrganizationSelectionOptions as _d, ListEffectivePermissionsByExternalIdOptions as _f, ActionPayload as _i, RefreshSessionFailureReason as _l, DirectoryResponse as _m, DataIntegration as _n, InvitationAcceptedEventResponse as _o, ListResourcesForMembershipOptionsWithParentId as _p, CreateApplicationClientSecretOptions as _r, SessionCreatedEventResponse as _s, AuditLogActor as _t, CreateOrganizationMembershipOptions as _u, PublicWorkOS as a, AuthenticationPasskeyFailedEventResponse as aa, CreateGroupOptions as ac, UserResponse as ad, DirectoryUserResponse as af, AgentRegistrationStatus as ai, SendRadarSmsChallengeResponse as al, EnvironmentRole as am, DataIntegrationAccessTokenResponse as an, GroupCreatedEventResponse as ao, SerializedListRoleAssignmentsOptions as ap, ApplicationCredentialsListItemResponse as ar, PermissionCreatedEventResponse as as, DecryptDataKeyResponse as at, SerializedEnrollUserInMfaFactorOptions as au, NotFoundException as b, ConnectionDeactivatedEvent as ba, EvaluationContext as bc, AuthenticateWithRadarSmsChallengeOptions as bd, GroupRoleAssignmentEntry as bf, UserRegistrationActionPayload as bi, TerminalRefreshSessionFailureReason as bl, DirectoryType as bm, DataIntegrationCustomProvider as bn, InvitationResentEvent as bo, AuthorizationCheckOptionsWithResourceExternalId as bp, UpdateApplicationOptions as br, UnknownEvent as bs, CreateAuditLogEventRequestOptions as bt, SerializedCreateMagicAuthOptions as bu, PortalLinkResponseWire as c, AuthenticationPasswordFailedEvent as ca, SerializedAddGroupOrganizationMembershipOptions as cc, AuthenticateWithRefreshTokenPublicClientOptions as cd, ListOrganizationRolesResponse as cf, SerializedAgentRegistrationClaim as ci, SendInvitationOptions as cl, EnvironmentRoleResponse as cm, DataIntegrationAccessTokenResponseAccessTokenResponse as cn, GroupMemberAddedEvent as co, RoleAssignmentResourceResponse as cp, ConnectApplicationM2MResponse as cr, PermissionUpdatedEvent as cs, WidgetSessionTokenResponseWire as ct, EmailVerificationEventResponse as cu, IntentOptions as d, AuthenticationPasswordSucceededEventResponse as da, RuntimeClientOptions as dc, AuthenticateWithRefreshTokenOptions as dd, OrganizationRoleResponse as df, PKCEPair as di, SerializedRevokeSessionOptions as dl, ListDirectoriesOptions as dm, DataIntegrationCredentialsResponseCredentialResponse as dn, GroupMemberEventResponseData as do, RoleAssignmentSource as dp, ConnectApplicationResponse as dr, RoleCreatedEventResponse as ds, FeatureFlagsRuntimeClient as dt, SerializedCreateUserOptions as du, AuthenticationOAuthFailedEvent as ea, ListGroupOrganizationMembershipsOptions as ec, AuthenticationResponse as ed, ConnectionType as ef, AgentIdentity as ei, Session as el, SetEnvironmentRolePermissionsOptions as em, DataIntegrationsListResponseDataAuthMethods as en, FlagRuleUpdatedEvent as eo, SerializedAssignRoleOptions as ep, ListEventOptions as er, PasswordResetCreatedEvent as es, ReadObjectOptions as et, InvitationEvent as eu, IntentOptionsResponse as f, AuthenticationRadarRiskDetectedEvent as fa, RemoveFlagTargetOptions as fc, SerializedAuthenticateWithRefreshTokenOptions as fd, Role as ff, Actions as fi, serializeRevokeSessionOptions as fl, SerializedListDirectoriesOptions as fm, DataIntegrationAuthorizeUrlResponse as fn, GroupMemberRemovedEvent as fo, RoleAssignmentSourceResponse as fp, ConnectApplicationRedirectUri as fr, RoleDeletedEvent as fs, CookieSession as ft, CreateUserApiKeyOptions as fu, UnauthorizedException as g, AuthenticationSSOSucceededEvent as ga, FlagPollResponse as gc, AuthenticateUserWithOrganizationSelectionCredentials as gd, RoleResponse as gf, ActionContext as gi, SerializedResendInvitationOptions as gl, Directory as gm, ConnectedAccountAuthMethod as gn, InvitationAcceptedEvent as go, ListResourcesForMembershipOptionsWithParentExternalId as gp, DeleteClientSecretOptions as gr, SessionCreatedEvent as gs, SerializedCreateAuditLogSchemaOptions as gt, SerializedCreatePasswordResetOptions as gu, UnprocessableEntityException as h, AuthenticationSSOFailedEventResponse as ha, FlagPollEntry as hc, SerializedAuthenticateWithPasswordOptions as hd, RoleList as hf, UserRegistrationActionResponseData as hi, ResendInvitationOptions as hl, DirectoryGroupResponse as hm, ConnectedAccountResponse as hn, GroupUpdatedEventResponse as ho, ListResourcesForMembershipOptions as hp, ExternalAuthCompleteResponseWire as hr, RoleUpdatedEventResponse as hs, CreateAuditLogSchemaResponse as ht, CreatePasswordResetOptions as hu, PublicUserManagement as i, AuthenticationPasskeyFailedEvent as ia, DeleteGroupOptions as ic, User as id, DirectoryUser as if, AgentRegistrationKind as ii, SendRadarSmsChallengeOptions as il, SerializedCreateEnvironmentRoleOptions as im, DataIntegrationsListResponseDataConnectedAccountAuthMethod as in, GroupCreatedEvent as io, ListRoleAssignmentsOptions as ip, ApplicationCredentialsListItem as ir, PermissionCreatedEvent as is, DecryptDataKeyOptions as it, EnrollAuthFactorOptions as iu, Webhooks as j, DsyncGroupDeletedEventResponse as ja, ApiKey as jc, AuthenticateWithCodeAndVerifierOptions as jd, RemoveGroupRoleAssignmentsOptionsWithResourceId as jf, DomainDataState as ji, LogoutURLOptions as jl, GetUserConnectedAccountOptions as jn, OrganizationDomainCreatedEventResponse as jo, AuthorizationResourceResponse as jp, UserConsentOption as jr, VaultDataDeletedEvent as js, VerifyResponse as jt, FactorResponse as ju, WorkOSErrorData as k, DsyncGroupCreatedEventResponse as ka, CreateOrganizationApiKeyRequestOptions as kc, AuthenticateWithEmailVerificationOptions as kd, RemoveGroupRoleAssignmentsOptionsForOrganization as kf, SerializedCreateOrganizationOptions as ki, MagicAuthEventResponse as kl, ResponseHeaders as km, CreateUserConnectedAccountOptions as kn, OrganizationDeletedResponse as ko, SerializedListAuthorizationResourcesOptions as kp, ListApplicationsOptions as kr, VaultDataCreatedEvent as ks, AuditLogExportOptions as kt, AuthenticationFactorWithSecretsResponse as ku, GenerateLink as l, AuthenticationPasswordFailedEventResponse as la, RuntimeClientStats as lc, SerializedAuthenticateWithRefreshTokenPublicClientOptions as ld, OrganizationRoleEvent as lf, SerializedAgentRegistrationClaimCompletion as li, SerializedSendInvitationOptions as ll, ListDirectoryUsersOptions as lm, DataIntegrationCredentialsResponseError as ln, GroupMemberAddedEventResponse as lo, RoleAssignmentResponse as lp, ConnectApplicationOAuth as lr, PermissionUpdatedEventResponse as ls, CreateTokenOptions as lt, EmailVerificationResponse as lu, SSOIntentOptionsResponse as m, AuthenticationSSOFailedEvent as ma, FlagChange as mc, AuthenticateWithPasswordOptions as md, RoleEventResponse as mf, ResponsePayload as mi, SerializedResetPasswordOptions as ml, DirectoryGroup as mm, ConnectedAccount as mn, GroupUpdatedEvent as mo, ListMembershipsForResourceOptions as mp, ExternalAuthCompleteResponse as mr, RoleUpdatedEvent as ms, CreateAuditLogSchemaRequestOptions as mt, SerializedCreateUserApiKeyOptions as mu, PublicClientOptions as n, AuthenticationOAuthSucceededEvent as na, GroupResponse as nc, CreateUserResponse as nd, SSOPKCEAuthorizationURLResult as nf, AgentRegistrationClaim as ni, SessionStatus as nl, UpdateEnvironmentRoleOptions as nm, DataIntegrationsListResponseDataConnectedAccountResponse as nn, FlagUpdatedEvent as no, ListRoleAssignmentsForResourceOptions as np, NewConnectApplicationSecret as nr, PasswordResetSucceededEvent as ns, CreateObjectEntity as nt, InvitationResponse as nu, createWorkOS as o, AuthenticationPasskeySucceededEvent as oa, SerializedCreateGroupOptions as oc, Impersonator as od, DirectoryUserWithGroups as of, SerializedAgentIdentity as oi, SendRadarSmsChallengeResponseResponse as ol, EnvironmentRoleList as om, DataIntegrationAccessTokenResponseWire as on, GroupDeletedEvent as oo, RoleAssignment as op, ConnectApplication as or, PermissionDeletedEvent as os, CreateDataKeyOptions as ot, EmailVerification as ou, SSOIntentOptions as p, AuthenticationRadarRiskDetectedEventResponse as pa, ListFeatureFlagsOptions as pc, AuthenticateUserWithPasswordCredentials as pd, RoleEvent as pf, AuthenticationActionResponseData as pi, ResetPasswordOptions as pl, PaginationOptions as pm, DataIntegrationAuthorizeUrlResponseWire as pn, GroupMemberRemovedEventResponse as po, ListMembershipsForResourceByExternalIdOptions as pp, ConnectApplicationRedirectUriResponse as pr, RoleDeletedEventResponse as ps, CreateAuditLogSchemaOptions as pt, CreateUserApiKeyRequestOptions as pu, Actor as q, EventBase as qa, SerializedUpdateUserPasswordOptions as qc, ListConnectionsOptions as qd, RemoveRoleOptionsWithResourceExternalId as qf, AuthenticationEmailVerificationSucceededEventResponse as qi, OrganizationMembershipResponse as ql, DataIntegrationCredentialsDtoResponse as qn, OrganizationRoleCreatedEventResponse as qo, SetOrganizationRolePermissionsOptions as qp, ValidateAgentApiKeyOptions as qr, DataKey as qs, RadarStandaloneAssessRequestAction as qt, SerializedAuthenticateWithTotpOptions as qu, PublicSSO as r, AuthenticationOAuthSucceededEventResponse as ra, GetGroupOptions as rc, CreateUserResponseResponse as rd, DefaultCustomAttributes as rf, AgentRegistrationClaimCompletion as ri, SendVerificationEmailOptions as rl, CreateEnvironmentRoleOptions as rm, DataIntegrationsListResponseDataConnectedAccountState as rn, FlagUpdatedEventResponse as ro, SerializedListRoleAssignmentsForResourceOptions as rp, NewConnectApplicationSecretResponse as rr, PasswordResetSucceededEventResponse as rs, CreateObjectOptions as rt, Identity as ru, PortalLinkResponse as s, AuthenticationPasskeySucceededEventResponse as sa, AddGroupOrganizationMembershipOptions as sc, ImpersonatorResponse as sd, DirectoryUserWithGroupsResponse as sf, SerializedAgentRegistration as si, SerializedSendRadarSmsChallengeOptions as sl, EnvironmentRoleListResponse as sm, DataIntegrationAccessTokenResponseAccessToken as sn, GroupDeletedEventResponse as so, RoleAssignmentResource as sp, ConnectApplicationM2M as sr, PermissionDeletedEventResponse as ss, WidgetSessionTokenResponse as st, EmailVerificationEvent as su, ConfidentialClientOptions as t, AuthenticationOAuthFailedEventResponse as ta, Group as tc, AuthenticationResponseResponse as td, SSOAuthorizationURLOptions as tf, AgentRegistration as ti, SessionResponse as tl, SerializedUpdateEnvironmentRoleOptions as tm, DataIntegrationsListResponseDataConnectedAccount as tn, FlagRuleUpdatedEventResponse as to, ListRoleAssignmentsForResourceByExternalIdOptions as tp, SerializedListEventOptions as tr, PasswordResetCreatedEventResponse as ts, ReadObjectResponse as tt, InvitationEventResponse as tu, GenerateLinkResponse as u, AuthenticationPasswordSucceededEvent as ua, RuntimeClientLogger as uc, AuthenticateUserWithRefreshTokenCredentials as ud, OrganizationRoleEventResponse as uf, PKCE as ui, RevokeSessionOptions as ul, ListDirectoryGroupsOptions as um, DataIntegrationCredentialsResponseCredential as un, GroupMemberEventData as uo, RoleAssignmentRole as up, ConnectApplicationOAuthResponse as ur, RoleCreatedEvent as us, WidgetSessionTokenScopes as ut, CreateUserOptions as uu, RateLimitExceededException as v, ConnectionActivatedEvent as va, FeatureFlag as vc, SerializedAuthenticateWithOrganizationSelectionOptions as vd, ListEffectivePermissionsOptions as vf, UserData as vi, RefreshSessionResponse as vl, DirectoryState as vm, DataIntegrationResponse as vn, InvitationCreatedEvent as vo, SerializedListResourcesForMembershipOptions as vp, ListApplicationClientSecretsOptions as vr, SessionRevokedEvent as vs, AuditLogTarget as vt, SerializedCreateOrganizationMembershipOptions as vu, AuthenticationErrorCode as w, DsyncActivatedEvent as wa, ValidateApiKeyResponse as wc, SerializedAuthenticateWithRadarEmailChallengeOptions as wd, ReplaceGroupRoleAssignmentsOptions as wf, OrganizationResponse as wi, PasswordResetResponse as wl, HttpClientInterface as wm, DataIntegrationCredentialResponse as wn, MagicAuthCreatedEvent as wo, DeleteAuthorizationResourceOptions as wp, CreateM2MApplicationResponse as wr, UserDeletedEventResponse as ws, AuditLogSchemaMetadata as wt, AuthenticationRadarRiskDetectedEventResponseData as wu, NoApiKeyProvidedException as x, ConnectionDeactivatedEventResponse as xa, AddFlagTargetOptions as xc, SerializedAuthenticateWithRadarSmsChallengeOptions as xd, GroupRoleAssignmentEntryForOrganization as xf, SerializedUpdateOrganizationOptions as xi, PasswordReset as xl, EventDirectory as xm, DataIntegrationCustomProviderResponse as xn, InvitationResentEventResponse as xo, AuthorizationCheckOptionsWithResourceId as xp, GetApplicationOptions as xr, UserCreatedEvent as xs, SerializedCreateAuditLogEventOptions as xt, PKCEAuthorizationURLResult as xu, OauthException as y, ConnectionActivatedEventResponse as ya, FeatureFlagResponse as yc, AuthenticateUserWithRadarSmsChallengeCredentials as yd, BaseGroupRoleAssignmentEntry as yf, UserDataPayload as yi, RetryableRefreshSessionFailureReason as yl, DirectoryStateResponse as ym, DataIntegrationState as yn, InvitationCreatedEventResponse as yo, AuthorizationCheckOptions as yp, DeleteApplicationOptions as yr, SessionRevokedEventResponse as ys, CreateAuditLogEventOptions as yt, CreateMagicAuthOptions as yu, ObjectSummary as z, DsyncUserCreatedEventResponse as za, CreateOrganizationDomainOptions as zc, SerializedAuthenticateWithOptionsBase as zd, SerializedCreateGroupRoleAssignmentOptions as zf, ListResponse as zi, SerializedListSessionsOptions as zl, UpdateCustomProviderDefinitionResponse as zn, OrganizationDomainVerifiedEventResponse as zo, SerializedUpdatePermissionOptions as zp, AgentCredentialType as zr, VaultDekReadEvent as zs, RadarListEntryAlreadyPresentResponseWire as zt, Sms as zu };
//# sourceMappingURL=factory-DmBBe791.d.mts.map