@workos-inc/node 10.7.0 → 10.9.0

package/lib/{factory-BjWO1KkE.mjs → factory-BdXIrbcU.mjs}

@@ -49,7 +49,7 @@ var SubtleCryptoProvider = class extends CryptoProvider {
 		return await crypto.subtle.verify(algorithm, key, hmac, bufferB);
 	}
 	async encrypt(plaintext, key, iv, aad) {
-		const actualIv = iv || crypto.getRandomValues(new Uint8Array(32));
+		const actualIv = iv || crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
 		const cryptoKey = await this.subtleCrypto.importKey("raw", key, { name: "AES-GCM" }, false, ["encrypt"]);
 		const encryptParams = {
 			name: "AES-GCM",
@@ -95,23 +95,31 @@ var SubtleCryptoProvider = class extends CryptoProvider {
 };
 const byteHexMapping = new Array(256);
 for (let i = 0; i < byteHexMapping.length; i++) byteHexMapping[i] = i.toString(16).padStart(2, "0");
-//#endregion
-//#region src/common/net/http-client.ts
+/**
+* Upper bound on a server-provided `Retry-After` delay. Caps how long a
+* single retry can sleep so an aggressive proxy or an HTTP-date far in the
+* future can't hang the caller indefinitely.
+*/
+const MAXIMUM_RETRY_AFTER_TIME_IN_MILLISECONDS = 6e4;
 var HttpClient = class HttpClient {
 	baseURL;
 	options;
-	MAX_RETRY_ATTEMPTS = 3;
+	MAX_RETRY_ATTEMPTS;
 	BACKOFF_MULTIPLIER = 1.5;
 	MINIMUM_SLEEP_TIME_IN_MILLISECONDS = 500;
+	MAXIMUM_SLEEP_TIME_IN_MILLISECONDS = 8e3;
 	RETRY_STATUS_CODES = [
 		408,
+		429,
 		500,
 		502,
+		503,
 		504
 	];
 	constructor(baseURL, options) {
 		this.baseURL = baseURL;
 		this.options = options;
+		this.MAX_RETRY_ATTEMPTS = options?.maxRetries ?? 3;
 	}
 	static getResourceURL(baseURL, path, params) {
 		const queryString = HttpClient.getQueryString(params);
@@ -132,13 +140,38 @@ var HttpClient = class HttpClient {
 		if (entity === null || entity instanceof URLSearchParams) return entity;
 		return JSON.stringify(entity);
 	}
-	static isPathRetryable(path) {
-		return path.startsWith("/vault/") || path.startsWith("/audit_logs/events");
+	/**
+	* Generate a random idempotency key used to make retried write requests
+	* safe. Mirrors the behavior of the other WorkOS SDKs (Kotlin, Go), which
+	* attach an `Idempotency-Key` header to POST requests that did not already
+	* specify one, so a retried request is not applied more than once.
+	*/
+	static generateIdempotencyKey() {
+		return `retry-${globalThis.crypto.randomUUID()}`;
+	}
+	/**
+	* Parse a `Retry-After` header value into milliseconds. Supports both the
+	* delay-seconds form (e.g. `120`) and the HTTP-date form. The result is
+	* capped at {@link MAXIMUM_RETRY_AFTER_TIME_IN_MILLISECONDS}. Returns
+	* `null` when the value is absent or unparseable so the caller falls back
+	* to the computed exponential backoff.
+	*/
+	static parseRetryAfter(headerValue) {
+		if (headerValue == null) return null;
+		const trimmed = headerValue.trim();
+		if (trimmed === "") return null;
+		if (/^\d+$/.test(trimmed)) return Math.min(Number(trimmed) * 1e3, MAXIMUM_RETRY_AFTER_TIME_IN_MILLISECONDS);
+		const asDate = Date.parse(trimmed);
+		if (!Number.isNaN(asDate)) {
+			const delta = asDate - Date.now();
+			return delta < 0 ? 0 : Math.min(delta, MAXIMUM_RETRY_AFTER_TIME_IN_MILLISECONDS);
+		}
+		return null;
 	}
 	getSleepTimeInMilliseconds(retryAttempt) {
-		return this.MINIMUM_SLEEP_TIME_IN_MILLISECONDS * Math.pow(this.BACKOFF_MULTIPLIER, retryAttempt) * (Math.random() + .5);
+		return Math.min(this.MINIMUM_SLEEP_TIME_IN_MILLISECONDS * Math.pow(this.BACKOFF_MULTIPLIER, retryAttempt), this.MAXIMUM_SLEEP_TIME_IN_MILLISECONDS) * (Math.random() + .5);
 	}
-	sleep = (retryAttempt) => new Promise((resolve) => setTimeout(resolve, this.getSleepTimeInMilliseconds(retryAttempt)));
+	sleep = (retryAttempt, retryAfterMs) => new Promise((resolve) => setTimeout(resolve, retryAfterMs != null ? retryAfterMs : this.getSleepTimeInMilliseconds(retryAttempt)));
 };
 var HttpClientResponse = class {
 	_statusCode;
@@ -172,17 +205,19 @@ var ParseError = class extends Error {
 	rawBody;
 	rawStatus;
 	requestID;
-	constructor({ message, rawBody, rawStatus, requestID }) {
+	rawHeaders;
+	constructor({ message, rawBody, rawStatus, requestID, rawHeaders }) {
 		super(message);
 		this.rawBody = rawBody;
 		this.rawStatus = rawStatus;
 		this.requestID = requestID;
+		this.rawHeaders = rawHeaders;
 	}
 };
 //#endregion
 //#region src/common/net/fetch-client.ts
 const DEFAULT_FETCH_TIMEOUT = 6e4;
-var FetchHttpClient = class extends HttpClient {
+var FetchHttpClient = class FetchHttpClient extends HttpClient {
 	baseURL;
 	options;
 	_fetchFn;
@@ -198,57 +233,39 @@ var FetchHttpClient = class extends HttpClient {
 	}
 	async get(path, options) {
 		const resourceURL = HttpClient.getResourceURL(this.baseURL, path, options.params);
-		if (HttpClient.isPathRetryable(path)) return await this.fetchRequestWithRetry(resourceURL, "GET", null, options.headers);
-		else return await this.fetchRequest(resourceURL, "GET", null, options.headers);
+		return await this.fetchRequestWithRetry(resourceURL, "GET", null, options.headers, options.maxRetries);
 	}
 	async post(path, entity, options) {
 		const resourceURL = HttpClient.getResourceURL(this.baseURL, path, options.params);
-		if (HttpClient.isPathRetryable(path)) return await this.fetchRequestWithRetry(resourceURL, "POST", HttpClient.getBody(entity), {
-			...HttpClient.getContentTypeHeader(entity),
-			...options.headers
-		});
-		else return await this.fetchRequest(resourceURL, "POST", HttpClient.getBody(entity), {
+		return await this.fetchRequestWithRetry(resourceURL, "POST", HttpClient.getBody(entity), {
 			...HttpClient.getContentTypeHeader(entity),
 			...options.headers
-		});
+		}, options.maxRetries);
 	}
 	async put(path, entity, options) {
 		const resourceURL = HttpClient.getResourceURL(this.baseURL, path, options.params);
-		if (HttpClient.isPathRetryable(path)) return await this.fetchRequestWithRetry(resourceURL, "PUT", HttpClient.getBody(entity), {
-			...HttpClient.getContentTypeHeader(entity),
-			...options.headers
-		});
-		else return await this.fetchRequest(resourceURL, "PUT", HttpClient.getBody(entity), {
+		return await this.fetchRequestWithRetry(resourceURL, "PUT", HttpClient.getBody(entity), {
 			...HttpClient.getContentTypeHeader(entity),
 			...options.headers
-		});
+		}, options.maxRetries);
 	}
 	async patch(path, entity, options) {
 		const resourceURL = HttpClient.getResourceURL(this.baseURL, path, options.params);
-		if (HttpClient.isPathRetryable(path)) return await this.fetchRequestWithRetry(resourceURL, "PATCH", HttpClient.getBody(entity), {
-			...HttpClient.getContentTypeHeader(entity),
-			...options.headers
-		});
-		else return await this.fetchRequest(resourceURL, "PATCH", HttpClient.getBody(entity), {
+		return await this.fetchRequestWithRetry(resourceURL, "PATCH", HttpClient.getBody(entity), {
 			...HttpClient.getContentTypeHeader(entity),
 			...options.headers
-		});
+		}, options.maxRetries);
 	}
 	async delete(path, options) {
 		const resourceURL = HttpClient.getResourceURL(this.baseURL, path, options.params);
-		if (HttpClient.isPathRetryable(path)) return await this.fetchRequestWithRetry(resourceURL, "DELETE", null, options.headers);
-		else return await this.fetchRequest(resourceURL, "DELETE", null, options.headers);
+		return await this.fetchRequestWithRetry(resourceURL, "DELETE", null, options.headers, options.maxRetries);
 	}
 	async deleteWithBody(path, entity, options) {
 		const resourceURL = HttpClient.getResourceURL(this.baseURL, path, options.params);
-		if (HttpClient.isPathRetryable(path)) return await this.fetchRequestWithRetry(resourceURL, "DELETE", HttpClient.getBody(entity), {
-			...HttpClient.getContentTypeHeader(entity),
-			...options.headers
-		});
-		else return await this.fetchRequest(resourceURL, "DELETE", HttpClient.getBody(entity), {
+		return await this.fetchRequestWithRetry(resourceURL, "DELETE", HttpClient.getBody(entity), {
 			...HttpClient.getContentTypeHeader(entity),
 			...options.headers
-		});
+		}, options.maxRetries);
 	}
 	async fetchRequest(url, method, body, headers) {
 		const requestBody = body || (method === "POST" || method === "PUT" || method === "PATCH" ? "" : void 0);
@@ -283,7 +300,8 @@ var FetchHttpClient = class extends HttpClient {
 						message: error.message,
 						rawBody,
 						requestID,
-						rawStatus: res.status
+						rawStatus: res.status,
+						rawHeaders: res.headers
 					});
 					throw error;
 				}
@@ -310,19 +328,21 @@ var FetchHttpClient = class extends HttpClient {
 			throw error;
 		}
 	}
-	async fetchRequestWithRetry(url, method, body, headers) {
+	async fetchRequestWithRetry(url, method, body, headers, maxRetries) {
+		const maxRetryAttempts = maxRetries ?? this.MAX_RETRY_ATTEMPTS;
+		const requestHeaders = FetchHttpClient.withIdempotencyKey(method, headers, maxRetryAttempts);
 		let response;
 		let retryAttempts = 1;
 		const makeRequest = async () => {
 			let requestError = null;
 			try {
-				response = await this.fetchRequest(url, method, body, headers);
+				response = await this.fetchRequest(url, method, body, requestHeaders);
 			} catch (e) {
 				requestError = e;
 			}
-			if (this.shouldRetryRequest(requestError, retryAttempts)) {
+			if (this.shouldRetryRequest(requestError, retryAttempts, maxRetryAttempts)) {
 				retryAttempts++;
-				await this.sleep(retryAttempts);
+				await this.sleep(retryAttempts, FetchHttpClient.getRetryAfterMs(requestError));
 				return makeRequest();
 			}
 			if (requestError != null) throw requestError;
@@ -330,14 +350,37 @@ var FetchHttpClient = class extends HttpClient {
 		};
 		return makeRequest();
 	}
-	shouldRetryRequest(requestError, retryAttempt) {
-		if (retryAttempt > this.MAX_RETRY_ATTEMPTS) return false;
+	shouldRetryRequest(requestError, retryAttempt, maxRetryAttempts) {
+		if (retryAttempt > maxRetryAttempts) return false;
 		if (requestError != null) {
 			if (requestError instanceof TypeError) return true;
 			if (requestError instanceof HttpClientError && this.RETRY_STATUS_CODES.includes(requestError.response.status)) return true;
+			if (requestError instanceof ParseError && this.RETRY_STATUS_CODES.includes(requestError.rawStatus)) return true;
 		}
 		return false;
 	}
+	static withIdempotencyKey(method, headers, maxRetryAttempts) {
+		if (method !== "POST" || maxRetryAttempts <= 0 || FetchHttpClient.hasHeader(headers, "Idempotency-Key")) return headers;
+		return {
+			...headers,
+			"Idempotency-Key": HttpClient.generateIdempotencyKey()
+		};
+	}
+	static hasHeader(headers, name) {
+		if (!headers) return false;
+		const target = name.toLowerCase();
+		return Object.keys(headers).some((key) => key.toLowerCase() === target);
+	}
+	static getRetryAfterMs(requestError) {
+		let headers;
+		if (requestError instanceof HttpClientError) headers = requestError.response?.headers;
+		else if (requestError instanceof ParseError) headers = requestError.rawHeaders;
+		else return null;
+		let value;
+		if (headers && typeof headers.get === "function") value = headers.get("Retry-After");
+		else if (headers && typeof headers === "object") value = headers["Retry-After"] ?? headers["retry-after"];
+		return HttpClient.parseRetryAfter(value);
+	}
 };
 var FetchHttpClientResponse = class FetchHttpClientResponse extends HttpClientResponse {
 	_res;
@@ -416,7 +459,7 @@ var GenericServerException = class extends Error {
 };
 //#endregion
 //#region src/common/exceptions/authentication.exception.ts
-const AUTHENTICATION_ERROR_CODES = new Set([
+const AUTHENTICATION_ERROR_CODES = /* @__PURE__ */ new Set([
 	"email_verification_required",
 	"organization_selection_required",
 	"mfa_enrollment",
@@ -778,6 +821,9 @@ const deserializeAuthenticationEvent = (authenticationEvent) => ({
 	userId: authenticationEvent.user_id
 });
 //#endregion
+//#region src/multi-factor-auth/serializers/sms.serializer.ts
+const deserializeSms = (sms) => ({ phoneNumber: sms.phone_number });
+//#endregion
 //#region src/multi-factor-auth/serializers/totp.serializer.ts
 const deserializeTotp = (totp) => {
 	return {
@@ -802,7 +848,8 @@ const deserializeFactor$1 = (factor) => ({
 	createdAt: factor.created_at,
 	updatedAt: factor.updated_at,
 	type: factor.type,
-	totp: deserializeTotp(factor.totp),
+	...factor.sms ? { sms: deserializeSms(factor.sms) } : {},
+	...factor.totp ? { totp: deserializeTotp(factor.totp) } : {},
 	userId: factor.user_id
 });
 const deserializeFactorWithSecrets$1 = (factor) => ({
@@ -869,6 +916,16 @@ const serializeCreateMagicAuthOptions = (options) => ({
 //#region src/user-management/serializers/create-password-reset-options.serializer.ts
 const serializeCreatePasswordResetOptions = (options) => ({ email: options.email });
 //#endregion
+//#region src/user-management/serializers/create-user-api-key-options.serializer.ts
+function serializeCreateUserApiKeyOptions(options) {
+	return {
+		name: options.name,
+		organization_id: options.organizationId,
+		permissions: options.permissions,
+		expires_at: options.expiresAt?.toISOString()
+	};
+}
+//#endregion
 //#region src/user-management/serializers/email-verification.serializer.ts
 const deserializeEmailVerification = (emailVerification) => ({
 	object: emailVerification.object,
@@ -935,6 +992,17 @@ const deserializeInvitationEvent = (invitation) => ({
 //#region src/user-management/serializers/list-sessions-options.serializer.ts
 const serializeListSessionsOptions = (options) => ({ ...options });
 //#endregion
+//#region src/user-management/serializers/list-user-api-keys-options.serializer.ts
+function serializeListUserApiKeysOptions(options) {
+	return {
+		limit: options.limit,
+		before: options.before,
+		after: options.after,
+		order: options.order,
+		organization_id: options.organizationId
+	};
+}
+//#endregion
 //#region src/user-management/serializers/magic-auth.serializer.ts
 const deserializeMagicAuth = (magicAuth) => ({
 	object: magicAuth.object,
@@ -1040,6 +1108,34 @@ const serializeUpdateUserOptions = (options) => ({
 	metadata: options.metadata
 });
 //#endregion
+//#region src/user-management/serializers/user-api-key.serializer.ts
+function deserializeUserApiKey(apiKey) {
+	return {
+		object: apiKey.object,
+		id: apiKey.id,
+		owner: {
+			type: "user",
+			id: apiKey.owner.id,
+			organizationId: apiKey.owner.organization_id
+		},
+		name: apiKey.name,
+		obfuscatedValue: apiKey.obfuscated_value,
+		lastUsedAt: apiKey.last_used_at,
+		expiresAt: apiKey.expires_at,
+		permissions: apiKey.permissions,
+		createdAt: apiKey.created_at,
+		updatedAt: apiKey.updated_at
+	};
+}
+//#endregion
+//#region src/user-management/serializers/user-api-key-with-value.serializer.ts
+function deserializeUserApiKeyWithValue(apiKey) {
+	return {
+		...deserializeUserApiKey(apiKey),
+		value: apiKey.value
+	};
+}
+//#endregion
 //#region src/user-management/serializers/organization-membership.serializer.ts
 const deserializeOrganizationMembership = (organizationMembership) => ({
 	object: organizationMembership.object,
@@ -1397,7 +1493,11 @@ function deserializeApiKey(apiKey) {
 	return {
 		object: apiKey.object,
 		id: apiKey.id,
-		owner: apiKey.owner,
+		owner: apiKey.owner.type === "user" ? {
+			type: "user",
+			id: apiKey.owner.id,
+			organizationId: apiKey.owner.organization_id
+		} : apiKey.owner,
 		name: apiKey.name,
 		obfuscatedValue: apiKey.obfuscated_value,
 		lastUsedAt: apiKey.last_used_at,
@@ -2013,6 +2113,244 @@ var PKCE = class {
 	}
 };
 //#endregion
+//#region src/utils/jose.ts
+let _josePromise;
+/**
+* Dynamically imports the jose library using import() to support Node.js 20.0-20.18.
+*
+* The jose library is ESM-only and cannot be loaded via require() in Node.js versions
+* before 20.19.0. This wrapper uses dynamic import() which works in both ESM and CJS
+* across all Node.js 20+ versions.
+*
+* This workaround can be removed when Node.js 20 reaches end-of-life (April 2026),
+* at which point we can bump to Node.js 22+ and use direct imports.
+*
+* @returns Promise that resolves to the jose module
+*/
+function getJose() {
+	return _josePromise ??= import("./webapi-BgpV54gi.mjs");
+}
+//#endregion
+//#region src/agents/serializers/agent-registration.serializer.ts
+function deserializeAgentRegistration(registration) {
+	return {
+		id: registration.id,
+		agentIdentity: {
+			id: registration.agent_identity.id,
+			userlandUserId: registration.agent_identity.userland_user_id,
+			createdAt: registration.agent_identity.created_at,
+			updatedAt: registration.agent_identity.updated_at
+		},
+		organizationId: registration.organization_id,
+		status: registration.status,
+		kind: registration.kind,
+		claim: registration.claim ? {
+			id: registration.claim.id,
+			claimCompletion: registration.claim.claim_completion ? {
+				id: registration.claim.claim_completion.id,
+				createdAt: registration.claim.claim_completion.created_at,
+				updatedAt: registration.claim.claim_completion.updated_at,
+				expiresAt: registration.claim.claim_completion.expires_at,
+				claimedAt: registration.claim.claim_completion.claimed_at
+			} : null,
+			createdAt: registration.claim.created_at,
+			updatedAt: registration.claim.updated_at,
+			expiresAt: registration.claim.expires_at
+		} : null,
+		createdAt: registration.created_at,
+		updatedAt: registration.updated_at
+	};
+}
+//#endregion
+//#region src/agents/serializers/claim-attempt.serializer.ts
+function serializeLinkClaimAttemptToExternalUserOptions(options) {
+	return {
+		type: "link_external_user",
+		claim_attempt_token: options.claimAttemptToken,
+		user: {
+			email: options.user.email,
+			external_id: options.user.externalId
+		},
+		...options.organizationId !== void 0 && { organization_id: options.organizationId }
+	};
+}
+function deserializeClaimAttemptResponse(response) {
+	return {
+		id: response.id,
+		status: response.status,
+		userCode: response.user_code,
+		organizations: response.organizations
+	};
+}
+//#endregion
+//#region src/agents/serializers/validate-agent-credential.serializer.ts
+function serializeValidateAgentCredentialOptions(options) {
+	return {
+		type: options.type,
+		credential: options.credential,
+		...options.type === "access_token" && options.audience !== void 0 && { audience: options.audience }
+	};
+}
+function deserializeAgentCredentialValidation(validation) {
+	if (!validation.valid || validation.registration_id == null) return {
+		valid: false,
+		registrationId: null,
+		expiresAt: null,
+		claims: null
+	};
+	return {
+		valid: true,
+		registrationId: validation.registration_id,
+		expiresAt: validation.expires_at,
+		claims: null
+	};
+}
+function deserializeAgentAccessTokenClaims(payload) {
+	return {
+		issuer: payload.iss,
+		audience: payload.aud,
+		registrationId: payload.sub,
+		jti: payload.jti,
+		organizationId: payload.org_id,
+		scope: payload.scope,
+		actor: payload.act,
+		expiresAt: payload.exp,
+		issuedAt: payload.iat
+	};
+}
+//#endregion
+//#region src/agents/agents.ts
+/**
+* A decoded JWT payload is only an agent credential if it carries every claim
+* the SDK guarantees. A token signed by the same JWKS for another purpose
+* (e.g. a user session) lacks these and is rejected rather than reported valid
+* with empty identifiers.
+*/
+function hasRequiredAgentClaims(payload) {
+	return typeof payload.iss === "string" && (typeof payload.aud === "string" || Array.isArray(payload.aud)) && typeof payload.sub === "string" && typeof payload.jti === "string" && typeof payload.org_id === "string" && typeof payload.exp === "number" && typeof payload.iat === "number";
+}
+var Agents = class {
+	workos;
+	_jwks;
+	constructor(workos) {
+		this.workos = workos;
+	}
+	/**
+	* Link a claim attempt to an external user
+	*
+	* Link an external user to a claim attempt and retrieve the code needed
+	* for the agent to complete the claim. The user is looked up by external
+	* ID; if no user exists, one is created. When the user belongs to multiple
+	* organizations, an explicit organization must be provided.
+	*
+	* @param options - Object containing the claim attempt token, user details, and optional organization ID.
+	* @returns {Promise<ClaimAttemptResponse>}
+	* @throws {BadRequestException} 400 - Invalid request, email mismatch, or wrong account.
+	* @throws {ForbiddenException} 403 - Claim denied or auth method disabled.
+	* @throws {ConflictException} 409 - Organization selection required, external ID conflict, or already claimed.
+	* @throws {GoneException} 410 - Claim or user code expired.
+	*/
+	async linkClaimAttemptToExternalUser(options) {
+		const { data } = await this.workos.patch("/agents/claims/attempts", serializeLinkClaimAttemptToExternalUserOptions(options));
+		return deserializeClaimAttemptResponse(data);
+	}
+	/**
+	* Get an agent registration
+	*
+	* Retrieve a single agent registration scoped to the API key's environment.
+	* @param id - Unique identifier of the agent registration.
+	*
+	* @example
+	* "agent_reg_01EHZNVPK3SFK441A1RGBFSHRT"
+	*
+	* @returns {Promise<AgentRegistration>}
+	* @throws {NotFoundException} 404
+	*/
+	async getRegistration(id) {
+		const { data } = await this.workos.get(`/agents/registrations/${encodeURIComponent(id)}`);
+		return deserializeAgentRegistration(data);
+	}
+	/**
+	* Validate an agent credential
+	*
+	* For `access_token` credentials, the token is decoded and verified locally
+	* against the environment's JWKS and its claims are returned — no network
+	* request is made unless `checkForRevoked` is set, in which case the WorkOS
+	* API is also called to confirm the token has not been revoked.
+	*
+	* For `api_key` credentials, the WorkOS API is always called to validate the
+	* key against the environment.
+	*
+	* @param options - Object containing the credential type and value.
+	* @returns {Promise<AgentCredentialValidation>}
+	*/
+	async validateCredential(options) {
+		if (options.type === "access_token") return this.validateAccessToken(options);
+		return this.validateCredentialRemotely(options);
+	}
+	async validateAccessToken(options) {
+		const claims = await this.verifyAccessTokenClaims(options.credential, options.audience);
+		if (!claims) return {
+			valid: false,
+			registrationId: null,
+			expiresAt: null,
+			claims: null
+		};
+		if (!options.checkForRevoked) return {
+			valid: true,
+			registrationId: claims.registrationId,
+			expiresAt: (/* @__PURE__ */ new Date(claims.expiresAt * 1e3)).toISOString(),
+			claims
+		};
+		const remote = await this.validateCredentialRemotely(options);
+		if (!remote.valid) return remote;
+		if (remote.registrationId !== claims.registrationId) return {
+			valid: false,
+			registrationId: null,
+			expiresAt: null,
+			claims: null
+		};
+		return {
+			...remote,
+			claims
+		};
+	}
+	async validateCredentialRemotely(options) {
+		const { data } = await this.workos.post("/agents/credentials/validate", serializeValidateAgentCredentialOptions(options));
+		return deserializeAgentCredentialValidation(data);
+	}
+	/**
+	* Verifies an access token's signature, audience, and time claims against the
+	* environment's JWKS and returns its decoded claims, or `null` when the token
+	* is invalid (bad signature, wrong audience, expired, malformed, or missing
+	* the agent identity claims). Errors that are not JWT validation failures
+	* (e.g. network errors fetching the JWKS) propagate.
+	*
+	* The audience defaults to the client ID; resource-scoped tokens carry the
+	* resource as their audience and require it to be passed explicitly.
+	*/
+	async verifyAccessTokenClaims(credential, audience) {
+		const { jwtVerify } = await getJose();
+		const jwks = await this.getJWKS();
+		try {
+			const { payload } = await jwtVerify(credential, jwks, { audience: audience ?? this.workos.clientId });
+			if (!hasRequiredAgentClaims(payload)) return null;
+			if (payload.exp * 1e3 <= Date.now()) return null;
+			return deserializeAgentAccessTokenClaims(payload);
+		} catch (e) {
+			if (e instanceof Error && "code" in e && typeof e.code === "string" && (e.code.startsWith("ERR_JWT_") || e.code.startsWith("ERR_JWS_"))) return null;
+			throw e;
+		}
+	}
+	async getJWKS() {
+		const { clientId } = this.workos;
+		if (!clientId) throw new Error("Missing client ID. Did you provide it when initializing WorkOS?");
+		const { createRemoteJWKSet } = await getJose();
+		this._jwks ??= createRemoteJWKSet(new URL(`${this.workos.baseURL}/sso/jwks/${clientId}`), { cooldownDuration: 1e3 * 60 * 5 });
+		return this._jwks;
+	}
+};
+//#endregion
 //#region src/api-keys/serializers/create-organization-api-key-options.serializer.ts
 function serializeCreateOrganizationApiKeyOptions(options) {
 	return {
@@ -2039,7 +2377,10 @@ function deserializeCreatedApiKey(apiKey) {
 //#endregion
 //#region src/api-keys/serializers/validate-api-key.serializer.ts
 function deserializeValidateApiKeyResponse(response) {
-	return { apiKey: response.api_key ? deserializeApiKey(response.api_key) : null };
+	return {
+		apiKey: response.api_key ? deserializeApiKey(response.api_key) : null,
+		...typeof response.agent_registration_id === "undefined" ? void 0 : { agentRegistrationId: response.agent_registration_id }
+	};
 }
 //#endregion
 //#region src/api-keys/api-keys.ts
@@ -2808,34 +3149,231 @@ var Passwordless = class {
 	}
 };
 //#endregion
-//#region src/pipes/serializers/access-token.serializer.ts
-function deserializeAccessToken(serialized) {
-	return {
-		object: "access_token",
-		accessToken: serialized.access_token,
-		expiresAt: serialized.expires_at ? new Date(Date.parse(serialized.expires_at)) : null,
-		scopes: serialized.scopes,
-		missingScopes: serialized.missing_scopes
-	};
-}
+//#region src/pipes/serializers/data-integration-credential.serializer.ts
+const deserializeDataIntegrationCredential = (response) => ({
+	type: response.type,
+	clientId: response.client_id ?? null,
+	redactedClientSecret: response.redacted_client_secret ?? null
+});
 //#endregion
-//#region src/pipes/serializers/get-access-token.serializer.ts
-function serializeGetAccessTokenOptions(options) {
-	return {
-		user_id: options.userId,
-		organization_id: options.organizationId
-	};
-}
-function deserializeGetAccessTokenResponse(response) {
-	if (response.active) return {
-		active: true,
-		accessToken: deserializeAccessToken(response.access_token)
-	};
-	return {
-		active: false,
-		error: response.error
-	};
-}
+//#region src/pipes/serializers/data-integration-custom-provider.serializer.ts
+const deserializeDataIntegrationCustomProvider = (response) => ({
+	name: response.name,
+	authorizationUrl: response.authorization_url ?? null,
+	tokenUrl: response.token_url ?? null,
+	refreshTokenUrl: response.refresh_token_url ?? null,
+	pkceEnabled: response.pkce_enabled,
+	requestScopeSeparator: response.request_scope_separator,
+	scopesRequired: response.scopes_required,
+	clientSecretRequired: response.client_secret_required,
+	additionalAuthorizationParameters: response.additional_authorization_parameters,
+	tokenBodyContentType: response.token_body_content_type,
+	authenticateVia: response.authenticate_via
+});
+//#endregion
+//#region src/pipes/serializers/data-integration.serializer.ts
+const deserializeDataIntegration = (response) => ({
+	object: response.object,
+	id: response.id,
+	slug: response.slug,
+	integrationType: response.integration_type,
+	description: response.description ?? null,
+	enabled: response.enabled,
+	state: response.state,
+	scopes: response.scopes ?? null,
+	redirectUri: response.redirect_uri,
+	credentials: deserializeDataIntegrationCredential(response.credentials),
+	customProvider: response.custom_provider != null ? deserializeDataIntegrationCustomProvider(response.custom_provider) : null,
+	createdAt: new Date(response.created_at),
+	updatedAt: new Date(response.updated_at)
+});
+//#endregion
+//#region src/pipes/serializers/connected-account.serializer.ts
+const deserializeConnectedAccount = (response) => ({
+	object: response.object,
+	id: response.id,
+	userId: response.user_id ?? null,
+	organizationId: response.organization_id ?? null,
+	scopes: response.scopes,
+	authMethod: response.auth_method,
+	apiKeyLast4: response.api_key_last_4 ?? null,
+	state: response.state,
+	createdAt: response.created_at,
+	updatedAt: response.updated_at
+});
+//#endregion
+//#region src/pipes/serializers/data-integration-authorize-url-response.serializer.ts
+const deserializeDataIntegrationAuthorizeUrlResponse = (response) => ({ url: response.url });
+//#endregion
+//#region src/pipes/serializers/data-integration-credentials-response-credential.serializer.ts
+const deserializeDataIntegrationCredentialsResponseCredential = (response) => ({
+	object: response.object,
+	authMethod: response.auth_method,
+	value: response.value,
+	expiresAt: response.expires_at ?? null,
+	scopes: response.scopes,
+	missingScopes: response.missing_scopes
+});
+//#endregion
+//#region src/pipes/serializers/data-integration-credentials-response.serializer.ts
+const deserializeDataIntegrationCredentialsResponse = (response) => ({
+	active: response.active,
+	credential: response.credential != null ? deserializeDataIntegrationCredentialsResponseCredential(response.credential) : void 0,
+	error: response.error
+});
+//#endregion
+//#region src/pipes/serializers/data-integration-access-token-response-access-token.serializer.ts
+const deserializeDataIntegrationAccessTokenResponseAccessToken = (response) => ({
+	object: response.object,
+	accessToken: response.access_token,
+	expiresAt: response.expires_at != null ? new Date(response.expires_at) : null,
+	scopes: response.scopes,
+	missingScopes: response.missing_scopes
+});
+//#endregion
+//#region src/pipes/serializers/data-integration-access-token-response.serializer.ts
+const deserializeDataIntegrationAccessTokenResponse = (response) => {
+	switch (response.active) {
+		case true: return {
+			active: true,
+			accessToken: deserializeDataIntegrationAccessTokenResponseAccessToken(response.access_token)
+		};
+		case false: return {
+			active: false,
+			error: response.error
+		};
+		default: throw new Error(`Unknown active: ${String(response.active)}`);
+	}
+};
+//#endregion
+//#region src/pipes/serializers/data-integrations-list-response-data-connected-account.serializer.ts
+const deserializeDataIntegrationsListResponseDataConnectedAccount = (response) => ({
+	object: response.object,
+	id: response.id,
+	userId: response.user_id ?? null,
+	organizationId: response.organization_id ?? null,
+	scopes: response.scopes,
+	authMethod: response.auth_method,
+	apiKeyLast4: response.api_key_last_4 ?? null,
+	state: response.state,
+	createdAt: response.created_at,
+	updatedAt: response.updated_at,
+	userlandUserId: response.userland_user_id ?? null
+});
+//#endregion
+//#region src/pipes/serializers/data-integrations-list-response-data.serializer.ts
+const deserializeDataIntegrationsListResponseData = (response) => ({
+	object: response.object,
+	id: response.id,
+	name: response.name,
+	description: response.description ?? null,
+	slug: response.slug,
+	integrationType: response.integration_type,
+	credentialsType: response.credentials_type,
+	scopes: response.scopes ?? null,
+	authMethods: response.auth_methods,
+	ownership: response.ownership,
+	createdAt: response.created_at,
+	updatedAt: response.updated_at,
+	connectedAccount: response.connected_account != null ? deserializeDataIntegrationsListResponseDataConnectedAccount(response.connected_account) : null
+});
+//#endregion
+//#region src/pipes/serializers/data-integrations-list-response.serializer.ts
+const deserializeDataIntegrationsListResponse = (response) => ({
+	object: response.object,
+	data: response.data.map(deserializeDataIntegrationsListResponseData)
+});
+//#endregion
+//#region src/pipes/serializers/data-integration-credentials-dto.serializer.ts
+const serializeDataIntegrationCredentialsDto = (model) => ({
+	type: model.type,
+	client_id: model.clientId,
+	client_secret: model.clientSecret
+});
+//#endregion
+//#region src/pipes/serializers/custom-provider-definition.serializer.ts
+const serializeCustomProviderDefinition = (model) => ({
+	name: model.name,
+	authorization_url: model.authorizationUrl,
+	token_url: model.tokenUrl,
+	refresh_token_url: model.refreshTokenUrl,
+	pkce_enabled: model.pkceEnabled,
+	request_scope_separator: model.requestScopeSeparator,
+	scopes_required: model.scopesRequired,
+	client_secret_required: model.clientSecretRequired,
+	additional_authorization_parameters: model.additionalAuthorizationParameters,
+	token_body_content_type: model.tokenBodyContentType,
+	authenticate_via: model.authenticateVia
+});
+//#endregion
+//#region src/pipes/serializers/create-data-integration.serializer.ts
+const serializeCreateDataIntegration = (model) => ({
+	provider: model.provider,
+	description: model.description,
+	enabled: model.enabled,
+	scopes: model.scopes,
+	credentials: model.credentials != null ? serializeDataIntegrationCredentialsDto(model.credentials) : void 0,
+	custom_provider: model.customProvider != null ? serializeCustomProviderDefinition(model.customProvider) : void 0
+});
+//#endregion
+//#region src/pipes/serializers/update-custom-provider-definition.serializer.ts
+const serializeUpdateCustomProviderDefinition = (model) => ({
+	name: model.name,
+	authorization_url: model.authorizationUrl,
+	token_url: model.tokenUrl,
+	refresh_token_url: model.refreshTokenUrl,
+	pkce_enabled: model.pkceEnabled,
+	request_scope_separator: model.requestScopeSeparator,
+	scopes_required: model.scopesRequired,
+	client_secret_required: model.clientSecretRequired,
+	additional_authorization_parameters: model.additionalAuthorizationParameters,
+	token_body_content_type: model.tokenBodyContentType,
+	authenticate_via: model.authenticateVia
+});
+//#endregion
+//#region src/pipes/serializers/update-data-integration.serializer.ts
+const serializeUpdateDataIntegration = (model) => ({
+	description: model.description,
+	enabled: model.enabled,
+	scopes: model.scopes,
+	credentials: model.credentials != null ? serializeDataIntegrationCredentialsDto(model.credentials) : void 0,
+	custom_provider: model.customProvider != null ? serializeUpdateCustomProviderDefinition(model.customProvider) : void 0
+});
+//#endregion
+//#region src/pipes/serializers/data-integrations-upsert-api-key-request.serializer.ts
+const serializeDataIntegrationsUpsertApiKeyRequest = (model) => ({
+	user_id: model.userId,
+	organization_id: model.organizationId,
+	secret: model.secret
+});
+//#endregion
+//#region src/pipes/serializers/data-integrations-get-data-integration-authorize-url-request.serializer.ts
+const serializeDataIntegrationsGetDataIntegrationAuthorizeUrlRequest = (model) => ({
+	user_id: model.userId,
+	organization_id: model.organizationId,
+	return_to: model.returnTo
+});
+//#endregion
+//#region src/pipes/serializers/data-integrations-vend-credentials-request.serializer.ts
+const serializeDataIntegrationsVendCredentialsRequest = (model) => ({
+	user_id: model.userId,
+	organization_id: model.organizationId
+});
+//#endregion
+//#region src/pipes/serializers/data-integrations-get-user-token-request.serializer.ts
+const serializeDataIntegrationsGetUserTokenRequest = (model) => ({
+	user_id: model.userId,
+	organization_id: model.organizationId
+});
+//#endregion
+//#region src/pipes/serializers/connected-account-dto.serializer.ts
+const serializeConnectedAccountDto = (model) => ({
+	access_token: model.accessToken,
+	refresh_token: model.refreshToken,
+	expires_at: model.expiresAt != null ? model.expiresAt.toISOString() : void 0,
+	scopes: model.scopes,
+	state: model.state
+});
 //#endregion
 //#region src/pipes/pipes.ts
 var Pipes = class {
@@ -2843,9 +3381,311 @@ var Pipes = class {
 	constructor(workos) {
 		this.workos = workos;
 	}
-	async getAccessToken({ provider, ...options }) {
-		const { data } = await this.workos.post(`data-integrations/${provider}/token`, serializeGetAccessTokenOptions(options));
-		return deserializeGetAccessTokenResponse(data);
+	/**
+	* List data integrations
+	*
+	* Lists the environment's data integrations configured with `custom` or `organization` credentials, including custom providers.
+	* @param options - Pagination and filter options.
+	* @returns {Promise<AutoPaginatable<DataIntegration, PaginationOptions>>}
+	* @throws {UnauthorizedException} 401
+	*/
+	async listDataIntegrations(options) {
+		const paginationOptions = options;
+		return new AutoPaginatable(await fetchAndDeserialize(this.workos, "/data-integrations", deserializeDataIntegration, paginationOptions), (params) => fetchAndDeserialize(this.workos, "/data-integrations", deserializeDataIntegration, params), paginationOptions);
+	}
+	/**
+	* Create a data integration
+	*
+	* Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials, or `organization` to have each organization supply its own. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition.
+	* @param options - Object containing provider.
+	* @param options.provider - The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug.
+	* @example "github"
+	* @param options.description - An optional description of the Data Integration.
+	* @example "Production GitHub app"
+	* @param options.enabled - Whether the Data Integration is enabled. Defaults to `false`.
+	* @example true
+	* @param options.scopes - The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted.
+	* @example ["repo","read:org"]
+	* @param options.credentials - The credentials to configure for the Data Integration. Required for both built-in and custom providers.
+	* @param options.customProvider - The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider.
+	* @returns {Promise<DataIntegration>}
+	* @throws {BadRequestException} 400
+	* @throws {UnauthorizedException} 401
+	* @throws {NotFoundException} 404
+	* @throws {UnprocessableEntityException} 422
+	*/
+	async createDataIntegration(options) {
+		const payload = options;
+		const { data } = await this.workos.post("/data-integrations", serializeCreateDataIntegration(payload));
+		return deserializeDataIntegration(data);
+	}
+	/**
+	* Get a data integration
+	*
+	* Retrieves a data integration by its slug.
+	* @param options - The request options.
+	* @param options.slug - The slug identifier of the data integration.
+	* @example "github"
+	* @returns {Promise<DataIntegration>}
+	* @throws {UnauthorizedException} 401
+	* @throws {NotFoundException} 404
+	*/
+	async getDataIntegration(options) {
+		const { slug } = options;
+		const { data } = await this.workos.get(`/data-integrations/${encodeURIComponent(slug)}`);
+		return deserializeDataIntegration(data);
+	}
+	/**
+	* Update a data integration
+	*
+	* Updates the description, enabled state, or custom credentials of a data integration. For custom providers, `custom_provider` updates the OAuth definition.
+	* @param options - The request body.
+	* @param options.slug - The slug identifier of the data integration.
+	* @example "github"
+	* @param options.description - An optional description of the Data Integration.
+	* @example "Production GitHub app"
+	* @param options.enabled - Whether the Data Integration is enabled.
+	* @example true
+	* @param options.scopes - The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes.
+	* @example ["repo","read:org"]
+	* @param options.credentials - New credentials for the Data Integration. When provided, rotates the stored client secret.
+	* @param options.customProvider - Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations.
+	* @returns {Promise<DataIntegration>}
+	* @throws {BadRequestException} 400
+	* @throws {UnauthorizedException} 401
+	* @throws {NotFoundException} 404
+	* @throws {UnprocessableEntityException} 422
+	*/
+	async updateDataIntegration(options) {
+		const { slug, ...payload } = options;
+		const { data } = await this.workos.put(`/data-integrations/${encodeURIComponent(slug)}`, serializeUpdateDataIntegration(payload));
+		return deserializeDataIntegration(data);
+	}
+	/**
+	* Delete a data integration
+	*
+	* Deletes a data integration and all of its connected installations. For a custom provider, also deletes the custom provider definition.
+	* @param options - The request options.
+	* @param options.slug - The slug identifier of the data integration.
+	* @example "github"
+	* @returns {Promise<void>}
+	* @throws {UnauthorizedException} 401
+	* @throws {NotFoundException} 404
+	*/
+	async deleteDataIntegration(options) {
+		const { slug } = options;
+		await this.workos.delete(`/data-integrations/${encodeURIComponent(slug)}`);
+	}
+	/**
+	* Upsert an API key for a connected account
+	*
+	* Creates or updates an API-key-based installation for the specified integration and user. If an installation already exists, the stored API key is rotated to the new value.
+	* @param options - Object containing userId, secret.
+	* @param options.slug - The identifier of the integration.
+	* @example "github"
+	* @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+	* @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+	* @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.secret - The API key secret to store for this integration.
+	* @example "sk-1234567890abcdef"
+	* @returns {Promise<ConnectedAccount>}
+	* @throws {BadRequestException} 400
+	* @throws {UnauthorizedException} 401
+	* @throws {AuthorizationException} 403
+	* @throws {NotFoundException} 404
+	* @throws {UnprocessableEntityException} 422
+	*/
+	async updateDataIntegrationApiKey(options) {
+		const { slug, ...payload } = options;
+		const { data } = await this.workos.put(`/data-integrations/${encodeURIComponent(slug)}/api-key`, serializeDataIntegrationsUpsertApiKeyRequest(payload));
+		return deserializeConnectedAccount(data);
+	}
+	/**
+	* Get authorization URL
+	*
+	* Generates an OAuth authorization URL to initiate the connection flow for a user. Redirect the user to the returned URL to begin the OAuth flow with the third-party provider.
+	* @param options - Object containing userId.
+	* @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+	* @example "github"
+	* @param options.userId - The ID of the user to authorize.
+	* @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.organizationId - An organization ID to scope the authorization to a specific organization.
+	* @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.returnTo - The URL to redirect the user to after authorization.
+	* @example "https://example.com/callback"
+	* @returns {Promise<DataIntegrationAuthorizeUrlResponse>}
+	* @throws {BadRequestException} 400
+	* @throws {UnauthorizedException} 401
+	* @throws {AuthorizationException} 403
+	* @throws {NotFoundException} 404
+	*/
+	async authorizeDataIntegration(options) {
+		const { slug, ...payload } = options;
+		const { data } = await this.workos.post(`/data-integrations/${encodeURIComponent(slug)}/authorize`, serializeDataIntegrationsGetDataIntegrationAuthorizeUrlRequest(payload));
+		return deserializeDataIntegrationAuthorizeUrlResponse(data);
+	}
+	/**
+	* Vend credentials for a connected account
+	*
+	* Returns credentials for a user's connected account. Branches on the installation's `auth_method`: OAuth installations return an access token (refreshed if needed); API-key installations return the stored secret.
+	* @param options - Object containing userId.
+	* @param options.slug - The identifier of the integration.
+	* @example "github"
+	* @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+	* @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+	* @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @returns {Promise<DataIntegrationCredentialsResponse>}
+	* @throws {BadRequestException} 400
+	* @throws {UnauthorizedException} 401
+	* @throws {NotFoundException} 404
+	*/
+	async createDataIntegrationCredential(options) {
+		const { slug, ...payload } = options;
+		const { data } = await this.workos.post(`/data-integrations/${encodeURIComponent(slug)}/credentials`, serializeDataIntegrationsVendCredentialsRequest(payload));
+		return deserializeDataIntegrationCredentialsResponse(data);
+	}
+	/**
+	* Get an access token for a connected account
+	*
+	* Fetches a valid OAuth access token for a user's connected account. WorkOS automatically handles token refresh, ensuring you always receive a valid, non-expired token.
+	* @param options - Object containing userId.
+	* @param options.provider - The identifier of the integration.
+	* @example "github"
+	* @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+	* @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+	* @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @returns {Promise<DataIntegrationAccessTokenResponse>}
+	* @throws {BadRequestException} 400
+	* @throws {UnauthorizedException} 401
+	* @throws {NotFoundException} 404
+	* @throws {UnprocessableEntityException} 422
+	*/
+	async getAccessToken(options) {
+		const { provider, ...payload } = options;
+		const { data } = await this.workos.post(`/data-integrations/${encodeURIComponent(provider)}/token`, serializeDataIntegrationsGetUserTokenRequest(payload));
+		return deserializeDataIntegrationAccessTokenResponse(data);
+	}
+	/**
+	* Get a connected account
+	*
+	* Retrieves a user's [connected account](https://workos.com/docs/reference/pipes/connected-account) for a specific provider.
+	* @param options - Additional query options.
+	* @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+	* @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+	* @example "github"
+	* @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+	* @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @returns {Promise<ConnectedAccount>}
+	* @throws {UnauthorizedException} 401
+	* @throws {NotFoundException} 404
+	*/
+	async getUserConnectedAccount(options) {
+		const { userId, slug } = options;
+		const { data } = await this.workos.get(`/user_management/users/${encodeURIComponent(userId)}/connected_accounts/${encodeURIComponent(slug)}`, { query: { ...options.organizationId !== void 0 && { organization_id: options.organizationId } } });
+		return deserializeConnectedAccount(data);
+	}
+	/**
+	* Import a connected account
+	*
+	* Imports a [connected account](https://workos.com/docs/reference/pipes/connected-account) for a user by providing OAuth tokens directly. Use this to migrate existing connections or set up connections without going through the OAuth flow.
+	* @param options - The request body.
+	* @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+	* @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+	* @example "github"
+	* @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+	* @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.accessToken - The OAuth access token for the connected account.
+	* @example "gho_16C7e42F292c6912E7710c838347Ae178B4a"
+	* @param options.refreshToken - The OAuth refresh token for the connected account.
+	* @example "ghr_xxxxxxxxxxxxxxxxxxxx"
+	* @param options.expiresAt - The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
+	* @example "2025-12-31T23:59:59.000Z"
+	* @param options.scopes - The OAuth scopes granted for this connection.
+	* @example ["repo","user:email"]
+	* @param options.state - Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+	* @example "connected"
+	* @returns {Promise<ConnectedAccount>}
+	* @throws {UnauthorizedException} 401
+	* @throws {NotFoundException} 404
+	* @throws {ConflictException} 409
+	* @throws {UnprocessableEntityException} 422
+	*/
+	async createUserConnectedAccount(options) {
+		const { userId, slug, organizationId, ...payload } = options;
+		const { data } = await this.workos.post(`/user_management/users/${encodeURIComponent(userId)}/connected_accounts/${encodeURIComponent(slug)}`, serializeConnectedAccountDto(payload), { query: { ...options.organizationId !== void 0 && { organization_id: options.organizationId } } });
+		return deserializeConnectedAccount(data);
+	}
+	/**
+	* Update a connected account
+	*
+	* Updates a user's [connected account](https://workos.com/docs/reference/pipes/connected-account) tokens, scopes, or state for a specific provider.
+	* @param options - The request body.
+	* @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+	* @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+	* @example "github"
+	* @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+	* @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.accessToken - The OAuth access token for the connected account.
+	* @example "gho_16C7e42F292c6912E7710c838347Ae178B4a"
+	* @param options.refreshToken - The OAuth refresh token for the connected account.
+	* @example "ghr_xxxxxxxxxxxxxxxxxxxx"
+	* @param options.expiresAt - The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
+	* @example "2025-12-31T23:59:59.000Z"
+	* @param options.scopes - The OAuth scopes granted for this connection.
+	* @example ["repo","user:email"]
+	* @param options.state - Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+	* @example "connected"
+	* @returns {Promise<ConnectedAccount>}
+	* @throws {UnauthorizedException} 401
+	* @throws {NotFoundException} 404
+	*/
+	async updateUserConnectedAccount(options) {
+		const { userId, slug, organizationId, ...payload } = options;
+		const { data } = await this.workos.put(`/user_management/users/${encodeURIComponent(userId)}/connected_accounts/${encodeURIComponent(slug)}`, serializeConnectedAccountDto(payload), { query: { ...options.organizationId !== void 0 && { organization_id: options.organizationId } } });
+		return deserializeConnectedAccount(data);
+	}
+	/**
+	* Delete a connected account
+	*
+	* Disconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. This does not revoke access on the provider side.
+	* @param options - Additional query options.
+	* @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+	* @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+	* @example "github"
+	* @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+	* @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @returns {Promise<void>}
+	* @throws {UnauthorizedException} 401
+	* @throws {NotFoundException} 404
+	*/
+	async deleteUserConnectedAccount(options) {
+		const { userId, slug } = options;
+		await this.workos.delete(`/user_management/users/${encodeURIComponent(userId)}/connected_accounts/${encodeURIComponent(slug)}`, { ...options.organizationId !== void 0 && { organization_id: options.organizationId } });
+	}
+	/**
+	* List providers for a user
+	*
+	* Retrieves a list of available providers and the user's connection status for each. Returns all providers configured for your environment, along with the user's [connected account](https://workos.com/docs/reference/pipes/connected-account) information where applicable.
+	* @param options - Additional query options.
+	* @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier to list providers and connected accounts for.
+	* @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to filter connections for a specific organization.
+	* @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+	* @returns {Promise<DataIntegrationsListResponse>}
+	* @throws {UnauthorizedException} 401
+	* @throws {NotFoundException} 404
+	*/
+	async listUserDataProviders(options) {
+		const { userId } = options;
+		const { data } = await this.workos.get(`/user_management/users/${encodeURIComponent(userId)}/data_providers`, { query: { ...options.organizationId !== void 0 && { organization_id: options.organizationId } } });
+		return deserializeDataIntegrationsListResponse(data);
 	}
 };
 //#endregion
@@ -3208,9 +4048,6 @@ const deserializeChallenge = (challenge) => ({
 	authenticationFactorId: challenge.authentication_factor_id
 });
 //#endregion
-//#region src/multi-factor-auth/serializers/sms.serializer.ts
-const deserializeSms = (sms) => ({ phoneNumber: sms.phone_number });
-//#endregion
 //#region src/multi-factor-auth/serializers/factor.serializer.ts
 const deserializeFactor = (factor) => ({
 	object: factor.object,
@@ -3606,7 +4443,9 @@ function isJson(val) {
 	}
 	return !0;
 }
-const enc = /* @__PURE__ */ new TextEncoder(), dec = /* @__PURE__ */ new TextDecoder(), jsBase64Enabled = /* @__PURE__ */ (() => typeof Uint8Array.fromBase64 == "function" && typeof Uint8Array.prototype.toBase64 == "function" && typeof Uint8Array.prototype.toHex == "function")();
+const enc = /* @__PURE__ */ new TextEncoder();
+const dec = /* @__PURE__ */ new TextDecoder();
+const jsBase64Enabled = /* @__PURE__ */ (() => typeof Uint8Array.fromBase64 == "function" && typeof Uint8Array.prototype.toBase64 == "function" && typeof Uint8Array.prototype.toHex == "function")();
 function b64ToU8(str) {
 	return jsBase64Enabled ? Uint8Array.fromBase64(str, { alphabet: "base64url" }) : base64ToUint8Array$1(str);
 }
@@ -3635,7 +4474,8 @@ const defaults = /* @__PURE__ */ Object.freeze({
 	ttl: 0,
 	timestampSkewSec: 60,
 	localtimeOffsetMsec: 0
-}), algorithms = /* @__PURE__ */ Object.freeze({
+});
+const algorithms = /* @__PURE__ */ Object.freeze({
 	"aes-128-ctr": /* @__PURE__ */ Object.freeze({
 		keyBits: 128,
 		ivBits: 128,
@@ -3959,6 +4799,10 @@ let RefreshSessionFailureReason = /* @__PURE__ */ function(RefreshSessionFailure
 	RefreshSessionFailureReason["INVALID_GRANT"] = "invalid_grant";
 	RefreshSessionFailureReason["MFA_ENROLLMENT"] = "mfa_enrollment";
 	RefreshSessionFailureReason["SSO_REQUIRED"] = "sso_required";
+	RefreshSessionFailureReason["RATE_LIMIT_EXCEEDED"] = "rate_limit_exceeded";
+	RefreshSessionFailureReason["TIMEOUT"] = "timeout";
+	RefreshSessionFailureReason["SERVER_ERROR"] = "server_error";
+	RefreshSessionFailureReason["NETWORK_ERROR"] = "network_error";
 	return RefreshSessionFailureReason;
 }({});
 //#endregion
@@ -3978,24 +4822,6 @@ const serializeUpdateOrganizationMembershipOptions = (options) => ({
 	role_slugs: options.roleSlugs
 });
 //#endregion
-//#region src/utils/jose.ts
-let _josePromise;
-/**
-* Dynamically imports the jose library using import() to support Node.js 20.0-20.18.
-*
-* The jose library is ESM-only and cannot be loaded via require() in Node.js versions
-* before 20.19.0. This wrapper uses dynamic import() which works in both ESM and CJS
-* across all Node.js 20+ versions.
-*
-* This workaround can be removed when Node.js 20 reaches end-of-life (April 2026),
-* at which point we can bump to Node.js 22+ and use direct imports.
-*
-* @returns Promise that resolves to the jose module
-*/
-function getJose() {
-	return _josePromise ??= import("./webapi-S8D5YgJz.mjs");
-}
-//#endregion
 //#region src/user-management/session.ts
 var CookieSession = class {
 	userManagement;
@@ -4056,7 +4882,8 @@ var CookieSession = class {
 		const session = await unsealData(this.sessionData, { password: this.cookiePassword });
 		if (!session.refreshToken || !session.user) return {
 			authenticated: false,
-			reason: "invalid_session_cookie"
+			reason: "invalid_session_cookie",
+			retryable: false
 		};
 		const { org_id: organizationIdFromUserManagementAccessToken } = decodeJwt(session.accessToken);
 		try {
@@ -4089,10 +4916,14 @@ var CookieSession = class {
 				impersonator: session.impersonator
 			};
 		} catch (error) {
-			if (error instanceof OauthException && (error.error === "invalid_grant" || error.error === "mfa_enrollment" || error.error === "sso_required")) return {
+			const terminalReason = classifyTerminalRefreshError(error);
+			if (terminalReason) return {
 				authenticated: false,
-				reason: error.error
+				reason: terminalReason,
+				retryable: false
 			};
+			const retryableFailure = classifyRetryableRefreshError(error);
+			if (retryableFailure) return retryableFailure;
 			throw error;
 		}
 	}
@@ -4125,6 +4956,62 @@ var CookieSession = class {
 		}
 	}
 };
+/**
+* Classifies an error thrown while refreshing as a terminal authentication
+* failure — the session is over and the user must re-authenticate — returning
+* the matching failure reason, or `null` when the error is not a recognized
+* terminal failure (and may still be retryable or should be rethrown).
+*/
+function classifyTerminalRefreshError(error) {
+	if (error instanceof OauthException && error.error === "invalid_grant") return "invalid_grant";
+	if (error instanceof AuthenticationException) {
+		const code = error.code;
+		if (code === "mfa_enrollment") return "mfa_enrollment";
+		if (code === "sso_required") return "sso_required";
+	}
+	return null;
+}
+function classifyRetryableRefreshError(error) {
+	if (error instanceof RateLimitExceededException) return {
+		authenticated: false,
+		reason: "rate_limit_exceeded",
+		retryable: true,
+		retryAfter: error.retryAfter ?? void 0,
+		error
+	};
+	const status = getErrorStatus(error);
+	if (status === 429) return {
+		authenticated: false,
+		reason: "rate_limit_exceeded",
+		retryable: true,
+		error
+	};
+	if (status === 408) return {
+		authenticated: false,
+		reason: "timeout",
+		retryable: true,
+		error
+	};
+	if (status !== void 0 && status >= 500) return {
+		authenticated: false,
+		reason: "server_error",
+		retryable: true,
+		error
+	};
+	if (isNetworkError(error)) return {
+		authenticated: false,
+		reason: "network_error",
+		retryable: true,
+		error
+	};
+	return null;
+}
+function getErrorStatus(error) {
+	if (error instanceof OauthException || error instanceof GenericServerException) return error.status;
+}
+function isNetworkError(error) {
+	return error instanceof TypeError || error instanceof Error && error.cause instanceof TypeError;
+}
 //#endregion
 //#region src/user-management/user-management.ts
 var UserManagement = class {
@@ -4608,6 +5495,34 @@ var UserManagement = class {
 		await this.workos.delete(`/user_management/users/${userId}`);
 	}
 	/**
+	* List API keys for a user
+	*
+	* Get a list of API keys owned by a specific user.
+	* @param userId - Unique identifier of the user.
+	* @param options - Pagination and filter options.
+	* @returns {Promise<AutoPaginatable<UserApiKey, SerializedListUserApiKeysOptions>>}
+	* @throws {NotFoundException} 404
+	*/
+	async listUserApiKeys(userId, options) {
+		const serializedOptions = options ? serializeListUserApiKeysOptions(options) : void 0;
+		return new AutoPaginatable(await fetchAndDeserialize(this.workos, `/user_management/users/${userId}/api_keys`, deserializeUserApiKey, serializedOptions), (params) => fetchAndDeserialize(this.workos, `/user_management/users/${userId}/api_keys`, deserializeUserApiKey, params), serializedOptions);
+	}
+	/**
+	* Create an API key for a user
+	*
+	* Create a new API key owned by a user. The user must have an active membership in the specified organization.
+	* @param userId - Unique identifier of the user.
+	* @param options - Object containing the API key properties.
+	* @returns {Promise<UserApiKeyWithValue>}
+	* @throws {BadRequestException} 400
+	* @throws {NotFoundException} 404
+	* @throws {UnprocessableEntityException} 422
+	*/
+	async createUserApiKey(userId, options, requestOptions = {}) {
+		const { data } = await this.workos.post(`/user_management/users/${userId}/api_keys`, serializeCreateUserApiKeyOptions(options), requestOptions);
+		return deserializeUserApiKeyWithValue(data);
+	}
+	/**
 	* Get user identities
 	*
 	* Get a list of identities associated with the user. A user can have multiple associated identities after going through [identity linking](https://workos.com/docs/authkit/identity-linking). Currently only OAuth identities are supported. More provider types may be added in the future.
@@ -5222,7 +6137,7 @@ var FeatureFlagsRuntimeClient = class extends EventEmitter {
 	}
 	emitChanges(previous, current) {
 		if (!previous || !current) return;
-		const allKeys = new Set([...Object.keys(previous), ...Object.keys(current)]);
+		const allKeys = /* @__PURE__ */ new Set([...Object.keys(previous), ...Object.keys(current)]);
 		for (const key of allKeys) {
 			const prev = previous[key];
 			const curr = current[key];
@@ -7072,7 +7987,7 @@ var Vault = class {
 	*/
 	async deleteObject(options) {
 		const { id } = options;
-		await this.workos.delete(`/vault/v1/kv/${encodeURIComponent(id)}`, { query: { ...options.versionCheck !== void 0 && { version_check: options.versionCheck } } });
+		await this.workos.delete(`/vault/v1/kv/${encodeURIComponent(id)}`, { ...options.versionCheck !== void 0 && { version_check: options.versionCheck } });
 	}
 	/**
 	* Describe an object
@@ -7154,7 +8069,7 @@ var Vault = class {
 };
 //#endregion
 //#region package.json
-var version = "10.7.0";
+var version = "10.9.0";
 //#endregion
 //#region src/workos.ts
 const DEFAULT_HOSTNAME = "api.workos.com";
@@ -7171,6 +8086,7 @@ var WorkOS = class {
 	pkce;
 	hasApiKey;
 	actions;
+	agents = new Agents(this);
 	apiKeys = new ApiKeys(this);
 	auditLogs = new AuditLogs(this);
 	authorization = new Authorization(this);
@@ -7255,6 +8171,7 @@ var WorkOS = class {
 		return new FetchHttpClient(this.baseURL, {
 			...options.config,
 			timeout: options.timeout,
+			maxRetries: options.maxRetries,
 			headers
 		});
 	}
@@ -7278,7 +8195,8 @@ var WorkOS = class {
 		try {
 			res = await this.client.post(path, entity, {
 				params: options.query,
-				headers: requestHeaders
+				headers: requestHeaders,
+				maxRetries: options.maxRetries
 			});
 		} catch (error) {
 			this.handleHttpError({
@@ -7298,7 +8216,8 @@ var WorkOS = class {
 		try {
 			res = await this.client.get(path, {
 				params: options.query,
-				headers: requestHeaders
+				headers: requestHeaders,
+				maxRetries: options.maxRetries
 			});
 		} catch (error) {
 			this.handleHttpError({
@@ -7317,7 +8236,8 @@ var WorkOS = class {
 		try {
 			res = await this.client.put(path, entity, {
 				params: options.query,
-				headers: requestHeaders
+				headers: requestHeaders,
+				maxRetries: options.maxRetries
 			});
 		} catch (error) {
 			this.handleHttpError({
@@ -7336,7 +8256,8 @@ var WorkOS = class {
 		try {
 			res = await this.client.patch(path, entity, {
 				params: options.query,
-				headers: requestHeaders
+				headers: requestHeaders,
+				maxRetries: options.maxRetries
 			});
 		} catch (error) {
 			this.handleHttpError({
@@ -7500,4 +8421,4 @@ function createWorkOS(options) {
 //#endregion
 export { FetchHttpClient as A, NoApiKeyProvidedException as C, isAuthenticationErrorData as D, AuthenticationException as E, GenericServerException as O, NotFoundException as S, BadRequestException as T, UnprocessableEntityException as _, DomainDataState as a, RateLimitExceededException as b, FeatureFlagsRuntimeClient as c, serializeRevokeSessionOptions as d, AuthenticateWithSessionCookieFailureReason as f, Actions as g, AutoPaginatable as h, OrganizationDomainVerificationStrategy as i, SubtleCryptoProvider as j, ApiKeyRequiredException as k, CookieSession as l, Webhooks as m, ConnectionType as n, GenerateLinkIntent as o, PKCE as p, OrganizationDomainState as r, WorkOS as s, createWorkOS as t, RefreshSessionFailureReason as u, UnauthorizedException as v, ConflictException as w, OauthException as x, SignatureVerificationException as y };
 
-//# sourceMappingURL=factory-BjWO1KkE.mjs.map
+//# sourceMappingURL=factory-BdXIrbcU.mjs.map