@noodleseed/one 0.63.1 → 0.65.0

package/node_modules/@noodle-borg/service/dist/workos-directory.js

@@ -0,0 +1,175 @@
+import { createWorkOS } from '@workos-inc/node';
+import { normalizePlatformIdentityEmail } from './platform-identity.js';
+export class WorkOSDirectoryAdapter {
+    #client;
+    constructor(client) {
+        this.#client = client;
+    }
+    static fromApiKey(apiKey, clientId) {
+        return new WorkOSDirectoryAdapter(createWorkOS({ apiKey, clientId }).userManagement);
+    }
+    async findUserByExternalId(externalId) {
+        try {
+            return toUser(await this.#client.getUserByExternalId(externalId));
+        }
+        catch (error) {
+            if (statusOf(error) === 404)
+                return undefined;
+            throw directoryError(error);
+        }
+    }
+    async listUsersByNormalizedEmail(email) {
+        try {
+            const response = await this.#client.listUsers({
+                email: normalizePlatformIdentityEmail(email),
+                limit: 2,
+            });
+            const normalized = normalizePlatformIdentityEmail(email);
+            return response.data
+                .filter((user) => normalizePlatformIdentityEmail(user.email) === normalized)
+                .slice(0, 2)
+                .map(toUser);
+        }
+        catch (error) {
+            throw directoryError(error);
+        }
+    }
+    async listInventoryPage(input) {
+        if (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 100)
+            throw snapshotFailure('permanent');
+        try {
+            const response = await this.#client.listUsers({
+                limit: input.limit,
+                ...(input.after === undefined ? {} : { after: input.after }),
+            });
+            const nextAfter = response.listMetadata?.after ?? undefined;
+            return {
+                users: response.data.map(toUser),
+                ...(nextAfter === undefined ? {} : { nextAfter }),
+            };
+        }
+        catch (error) {
+            throw directoryError(error);
+        }
+    }
+    async snapshotUsers() {
+        const users = [];
+        const userIds = new Set();
+        const cursors = new Set();
+        let after;
+        for (;;) {
+            const page = await this.listInventoryPage({
+                limit: WORKOS_SNAPSHOT_PAGE_SIZE,
+                ...(after === undefined ? {} : { after }),
+            });
+            const response = {
+                data: page.users.map((user) => ({
+                    id: user.id,
+                    ...(user.externalId === undefined ? {} : { externalId: user.externalId }),
+                    email: user.normalizedEmail,
+                    emailVerified: user.verified,
+                })),
+                ...(page.nextAfter === undefined ? {} : { listMetadata: { after: page.nextAfter } }),
+            };
+            for (const remote of response.data) {
+                if (userIds.has(remote.id))
+                    throw snapshotFailure('transient');
+                userIds.add(remote.id);
+                users.push(toUser(remote));
+                if (users.length > WORKOS_SNAPSHOT_USER_LIMIT)
+                    throw snapshotFailure('permanent');
+            }
+            const next = response.listMetadata?.after ?? undefined;
+            if (next === undefined)
+                return users;
+            if (response.data.length === 0 ||
+                next === after ||
+                cursors.has(next) ||
+                users.length >= WORKOS_SNAPSHOT_USER_LIMIT) {
+                throw snapshotFailure('transient');
+            }
+            cursors.add(next);
+            after = next;
+        }
+    }
+    async createVerifiedUser(input) {
+        try {
+            return toUser(await this.#client.createUser({
+                externalId: input.externalId,
+                email: input.normalizedEmail,
+                emailVerified: true,
+            }));
+        }
+        catch (error) {
+            throw directoryError(error);
+        }
+    }
+    async updateVerifiedUser(input) {
+        try {
+            return toUser(await this.#client.updateUser({
+                userId: input.userId,
+                externalId: input.externalId,
+                email: normalizePlatformIdentityEmail(input.normalizedEmail),
+                emailVerified: true,
+            }));
+        }
+        catch (error) {
+            throw directoryError(error);
+        }
+    }
+}
+const WORKOS_SNAPSHOT_PAGE_SIZE = 100;
+const WORKOS_SNAPSHOT_USER_LIMIT = 200_000;
+function toUser(user) {
+    return {
+        id: user.id,
+        externalId: user.externalId ?? undefined,
+        normalizedEmail: normalizePlatformIdentityEmail(user.email),
+        verified: user.emailVerified,
+    };
+}
+function directoryError(error) {
+    const status = statusOf(error);
+    if (status === 401 || status === 403)
+        return { kind: 'unauthorized' };
+    if (status === 409)
+        return { kind: 'conflict' };
+    if (status === 429) {
+        const retryAt = retryAtOf(error);
+        return { kind: 'rate_limited', ...(retryAt === undefined ? {} : { retryAt }) };
+    }
+    if (status === undefined || status === 408 || status >= 500)
+        return { kind: 'transient' };
+    return { kind: 'permanent' };
+}
+function snapshotFailure(kind) {
+    return { kind };
+}
+function retryAtOf(error) {
+    if (typeof error !== 'object' || error === null)
+        return undefined;
+    if ('retryAt' in error) {
+        const value = error.retryAt;
+        if (typeof value === 'string' && Number.isFinite(Date.parse(value)))
+            return value;
+    }
+    const headers = 'headers' in error ? error.headers : undefined;
+    let value;
+    if (headers instanceof Headers)
+        value = headers.get('retry-after');
+    else if (typeof headers === 'object' && headers !== null && 'retry-after' in headers)
+        value = headers['retry-after'];
+    if (typeof value !== 'string')
+        return undefined;
+    const seconds = Number(value);
+    if (Number.isFinite(seconds) && seconds >= 0)
+        return new Date(Date.now() + seconds * 1_000).toISOString();
+    return Number.isFinite(Date.parse(value)) ? new Date(value).toISOString() : undefined;
+}
+function statusOf(error) {
+    if (typeof error !== 'object' || error === null || !('status' in error))
+        return undefined;
+    const status = error.status;
+    return typeof status === 'number' && Number.isInteger(status) ? status : undefined;
+}
+//# sourceMappingURL=workos-directory.js.map

package/node_modules/@noodle-borg/service/dist/workos-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-directory.js","sourceRoot":"","sources":["../src/workos-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMhD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AA8CxE,MAAM,OAAO,sBAAsB;IACxB,OAAO,CAAwB;IAExC,YAAY,MAA6B;QACvC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAAc,EAAE,QAAgB;QAChD,OAAO,IAAI,sBAAsB,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,UAAkB;QAC3C,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC9C,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,KAAa;QAC5C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC5C,KAAK,EAAE,8BAA8B,CAAC,KAAK,CAAC;gBAC5C,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;YACzD,OAAO,QAAQ,CAAC,IAAI;iBACjB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC;iBAC3E,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAA0D;QAIhF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,GAAG;YACxE,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;aAC7D,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,IAAI,SAAS,CAAC;YAC5D,OAAO;gBACL,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAChC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;aAClD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,KAAK,GAAgC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,KAAyB,CAAC;QAC9B,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC;gBACxC,KAAK,EAAE,yBAAyB;gBAChC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C,CAAC,CAAC;YACH,MAAM,QAAQ,GAA4D;gBACxE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC9B,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;oBACzE,KAAK,EAAE,IAAI,CAAC,eAAe;oBAC3B,aAAa,EAAE,IAAI,CAAC,QAAQ;iBAC7B,CAAC,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;aACrF,CAAC;YACF,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAE,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3B,IAAI,KAAK,CAAC,MAAM,GAAG,0BAA0B;oBAAE,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,IAAI,SAAS,CAAC;YACvD,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACrC,IACE,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAC1B,IAAI,KAAK,KAAK;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBACjB,KAAK,CAAC,MAAM,IAAI,0BAA0B,EAC1C,CAAC;gBACD,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAGxB;QACC,IAAI,CAAC;YACH,OAAO,MAAM,CACX,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,KAAK,CAAC,eAAe;gBAC5B,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAIxB;QACC,IAAI,CAAC;YACH,OAAO,MAAM,CACX,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,8BAA8B,CAAC,KAAK,CAAC,eAAe,CAAC;gBAC5D,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;CACF;AAED,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAQ3C,SAAS,MAAM,CAAC,IAAmB;IACjC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;QACxC,eAAe,EAAE,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3D,QAAQ,EAAE,IAAI,CAAC,aAAa;KAC7B,CAAC;AACJ,CAAC;AACD,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACtE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAChD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC/B,CAAC;AACD,SAAS,eAAe,CAAC,IAA+B;IACtD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AACD,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,KAAK,GAAI,KAAwC,CAAC,OAAO,CAAC;QAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACpF,CAAC;IACD,MAAM,OAAO,GACX,SAAS,IAAI,KAAK,CAAC,CAAC,CAAE,KAAwC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,KAAc,CAAC;IACnB,IAAI,OAAO,YAAY,OAAO;QAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;SAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,aAAa,IAAI,OAAO;QAClF,KAAK,GAAI,OAAgD,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAC1C,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxF,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,MAAM,GAAI,KAAuC,CAAC,MAAM,CAAC;IAC/D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC"}

package/node_modules/@noodle-borg/service/package.json

@@ -40,6 +40,7 @@
     "@noodle-borg/runtime": "0.0.0",
     "@noodle-borg/transport-http": "0.0.0",
     "@noodle-borg/wire-contracts": "0.0.0",
+    "@workos-inc/node": "10.8.0",
     "jose": "^6.2.3",
     "stripe": "^22.3.2",
     "yaml": "^2.9.0",

package/node_modules/@workos-inc/node/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 WorkOS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@workos-inc/node/README.md

@@ -0,0 +1,140 @@
+# WorkOS Node.js Library
+
+![npm](https://img.shields.io/npm/v/@workos-inc/node)
+[![Build Status](https://github.com/workos/workos-node/actions/workflows/ci.yml/badge.svg)](https://github.com/workos/workos-node/actions/workflows/ci.yml)
+
+The WorkOS library for Node.js provides convenient access to the WorkOS API from applications written in server-side JavaScript.
+
+## Documentation
+
+See the [API Reference](https://workos.com/docs/reference/client-libraries) for Node.js usage examples.
+
+## Requirements
+
+Node 22.11 or higher.
+
+## Installation
+
+Install the package with:
+
+```
+npm install @workos-inc/node
+```
+
+## Configuration
+
+To use the library you must provide an API key, located in the WorkOS dashboard, as an environment variable `WORKOS_API_KEY`:
+
+```sh
+WORKOS_API_KEY="sk_1234"
+```
+
+Or, you can set it on your own before your application starts:
+
+```ts
+import { WorkOS } from '@workos-inc/node';
+
+const workos = new WorkOS('sk_1234');
+```
+
+### Automatic retries
+
+The SDK automatically retries requests that fail with a transient error — a
+network error, a request timeout (408), a rate limit (429), or a server error
+(500, 502, 503, 504) — using exponential backoff with jitter. When the API
+responds with a `Retry-After` header, the SDK waits for that duration instead
+(capped at 60 seconds). Retried `POST` requests are automatically assigned an
+`Idempotency-Key` header (unless one is already set) so a retried write is not
+applied twice.
+
+The default is 3 retries. Configure it client-wide, or per request on the
+low-level HTTP methods:
+
+```ts
+// Client-wide: up to 5 retries per request
+const workos = new WorkOS('sk_1234', { maxRetries: 5 });
+
+// Per-request override: disable retries for this call only
+await workos.get('/organizations', { maxRetries: 0 });
+```
+
+Set `maxRetries: 0` to disable automatic retries entirely.
+
+## Public Client Mode (Browser/Mobile/CLI)
+
+For apps that can't securely store secrets, initialize with just a client ID:
+
+```ts
+import { WorkOS } from '@workos-inc/node';
+
+const workos = new WorkOS({ clientId: 'client_...' }); // No API key needed
+
+// Generate auth URL with automatic PKCE
+const { url, codeVerifier } =
+  await workos.userManagement.getAuthorizationUrlWithPKCE({
+    provider: 'authkit',
+    redirectUri: 'myapp://callback',
+    clientId: 'client_...',
+  });
+
+// After user authenticates, exchange code for tokens
+const { accessToken, refreshToken } =
+  await workos.userManagement.authenticateWithCode({
+    code: authorizationCode,
+    codeVerifier,
+    clientId: 'client_...',
+  });
+```
+
+> [!IMPORTANT]
+> Store `codeVerifier` securely on-device between generating the auth URL and handling the callback. For mobile apps, use platform secure storage (iOS Keychain, Android Keystore). For CLI apps, consider OS credential storage. The verifier must survive app restarts during the auth flow.
+
+See the [AuthKit documentation](https://workos.com/docs/authkit) for details on PKCE authentication.
+
+### PKCE with Confidential Clients
+
+Server-side apps can also use PKCE alongside the client secret for defense in depth (recommended by OAuth 2.1):
+
+```ts
+const workos = new WorkOS('sk_...'); // With API key
+
+// Use PKCE even with API key for additional security
+const { url, codeVerifier } =
+  await workos.userManagement.getAuthorizationUrlWithPKCE({
+    provider: 'authkit',
+    redirectUri: 'https://example.com/callback',
+    clientId: 'client_...',
+  });
+
+// Both client_secret AND code_verifier will be sent
+const { accessToken } = await workos.userManagement.authenticateWithCode({
+  code: authorizationCode,
+  codeVerifier,
+  clientId: 'client_...',
+});
+```
+
+## SDK Versioning
+
+For our SDKs WorkOS follows a Semantic Versioning ([SemVer](https://semver.org/)) process where all releases will have a version X.Y.Z (like 1.0.0) pattern wherein Z would be a bug fix (e.g., 1.0.1), Y would be a minor release (1.1.0) and X would be a major release (2.0.0). We permit any breaking changes to only be released in major versions and strongly recommend reading changelogs before making any major version upgrades.
+
+## Beta Releases
+
+WorkOS has features in Beta that can be accessed via Beta releases. We would love for you to try these
+and share feedback with us before these features reach general availability (GA). To install a Beta version,
+please follow the [installation steps](#installation) above using the Beta release version.
+
+> Note: there can be breaking changes between Beta versions. Therefore, we recommend pinning the package version to a
+> specific version. This way you can install the same version each time without breaking changes unless you are
+> intentionally looking for the latest Beta version.
+
+We highly recommend keeping an eye on when the Beta feature you are interested in goes from Beta to stable so that you
+can move to using the stable version.
+
+## More Information
+
+- [Single Sign-On Guide](https://workos.com/docs/sso/guide)
+- [Directory Sync Guide](https://workos.com/docs/directory-sync/guide)
+- [Admin Portal Guide](https://workos.com/docs/admin-portal/guide)
+- [Magic Link Guide](https://workos.com/docs/magic-link/guide)
+- [Domain Verification Guide](https://workos.com/docs/domain-verification/guide)