@workos-inc/node 10.8.0 → 10.10.0

package/lib/{factory-MKPb5Egh.mjs → factory-2nVUxmEk.mjs}

@@ -821,6 +821,9 @@ const deserializeAuthenticationEvent = (authenticationEvent) => ({
 	userId: authenticationEvent.user_id
 });
 //#endregion
+//#region src/multi-factor-auth/serializers/sms.serializer.ts
+const deserializeSms = (sms) => ({ phoneNumber: sms.phone_number });
+//#endregion
 //#region src/multi-factor-auth/serializers/totp.serializer.ts
 const deserializeTotp = (totp) => {
 	return {
@@ -845,7 +848,8 @@ const deserializeFactor$1 = (factor) => ({
 	createdAt: factor.created_at,
 	updatedAt: factor.updated_at,
 	type: factor.type,
-	totp: deserializeTotp(factor.totp),
+	...factor.sms ? { sms: deserializeSms(factor.sms) } : {},
+	...factor.totp ? { totp: deserializeTotp(factor.totp) } : {},
 	userId: factor.user_id
 });
 const deserializeFactorWithSecrets$1 = (factor) => ({
@@ -912,6 +916,16 @@ const serializeCreateMagicAuthOptions = (options) => ({
 //#region src/user-management/serializers/create-password-reset-options.serializer.ts
 const serializeCreatePasswordResetOptions = (options) => ({ email: options.email });
 //#endregion
+//#region src/user-management/serializers/create-user-api-key-options.serializer.ts
+function serializeCreateUserApiKeyOptions(options) {
+	return {
+		name: options.name,
+		organization_id: options.organizationId,
+		permissions: options.permissions,
+		expires_at: options.expiresAt?.toISOString()
+	};
+}
+//#endregion
 //#region src/user-management/serializers/email-verification.serializer.ts
 const deserializeEmailVerification = (emailVerification) => ({
 	object: emailVerification.object,
@@ -978,6 +992,17 @@ const deserializeInvitationEvent = (invitation) => ({
 //#region src/user-management/serializers/list-sessions-options.serializer.ts
 const serializeListSessionsOptions = (options) => ({ ...options });
 //#endregion
+//#region src/user-management/serializers/list-user-api-keys-options.serializer.ts
+function serializeListUserApiKeysOptions(options) {
+	return {
+		limit: options.limit,
+		before: options.before,
+		after: options.after,
+		order: options.order,
+		organization_id: options.organizationId
+	};
+}
+//#endregion
 //#region src/user-management/serializers/magic-auth.serializer.ts
 const deserializeMagicAuth = (magicAuth) => ({
 	object: magicAuth.object,
@@ -1083,6 +1108,34 @@ const serializeUpdateUserOptions = (options) => ({
 	metadata: options.metadata
 });
 //#endregion
+//#region src/user-management/serializers/user-api-key.serializer.ts
+function deserializeUserApiKey(apiKey) {
+	return {
+		object: apiKey.object,
+		id: apiKey.id,
+		owner: {
+			type: "user",
+			id: apiKey.owner.id,
+			organizationId: apiKey.owner.organization_id
+		},
+		name: apiKey.name,
+		obfuscatedValue: apiKey.obfuscated_value,
+		lastUsedAt: apiKey.last_used_at,
+		expiresAt: apiKey.expires_at,
+		permissions: apiKey.permissions,
+		createdAt: apiKey.created_at,
+		updatedAt: apiKey.updated_at
+	};
+}
+//#endregion
+//#region src/user-management/serializers/user-api-key-with-value.serializer.ts
+function deserializeUserApiKeyWithValue(apiKey) {
+	return {
+		...deserializeUserApiKey(apiKey),
+		value: apiKey.value
+	};
+}
+//#endregion
 //#region src/user-management/serializers/organization-membership.serializer.ts
 const deserializeOrganizationMembership = (organizationMembership) => ({
 	object: organizationMembership.object,
@@ -1127,6 +1180,7 @@ const deserializeAction = (actionPayload) => {
 			object: actionPayload.object,
 			userData: deserializeUserData(actionPayload.user_data),
 			invitation: actionPayload.invitation ? deserializeInvitation(actionPayload.invitation) : void 0,
+			authenticationMethod: actionPayload.authentication_method,
 			ipAddress: actionPayload.ip_address,
 			userAgent: actionPayload.user_agent,
 			deviceFingerprint: actionPayload.device_fingerprint
@@ -1137,6 +1191,7 @@ const deserializeAction = (actionPayload) => {
 			user: deserializeUser(actionPayload.user),
 			organization: actionPayload.organization ? deserializeOrganization(actionPayload.organization) : void 0,
 			organizationMembership: actionPayload.organization_membership ? deserializeOrganizationMembership(actionPayload.organization_membership) : void 0,
+			authenticationMethod: actionPayload.authentication_method,
 			ipAddress: actionPayload.ip_address,
 			userAgent: actionPayload.user_agent,
 			deviceFingerprint: actionPayload.device_fingerprint,
@@ -2109,6 +2164,27 @@ function deserializeAgentRegistration(registration) {
 	};
 }
 //#endregion
+//#region src/agents/serializers/claim-attempt.serializer.ts
+function serializeLinkClaimAttemptToExternalUserOptions(options) {
+	return {
+		type: "link_external_user",
+		claim_attempt_token: options.claimAttemptToken,
+		user: {
+			email: options.user.email,
+			external_id: options.user.externalId
+		},
+		...options.organizationId !== void 0 && { organization_id: options.organizationId }
+	};
+}
+function deserializeClaimAttemptResponse(response) {
+	return {
+		id: response.id,
+		status: response.status,
+		userCode: response.user_code,
+		organizations: response.organizations
+	};
+}
+//#endregion
 //#region src/agents/serializers/validate-agent-credential.serializer.ts
 function serializeValidateAgentCredentialOptions(options) {
 	return {
@@ -2162,6 +2238,25 @@ var Agents = class {
 		this.workos = workos;
 	}
 	/**
+	* Link a claim attempt to an external user
+	*
+	* Link an external user to a claim attempt and retrieve the code needed
+	* for the agent to complete the claim. The user is looked up by external
+	* ID; if no user exists, one is created. When the user belongs to multiple
+	* organizations, an explicit organization must be provided.
+	*
+	* @param options - Object containing the claim attempt token, user details, and optional organization ID.
+	* @returns {Promise<ClaimAttemptResponse>}
+	* @throws {BadRequestException} 400 - Invalid request, email mismatch, or wrong account.
+	* @throws {ForbiddenException} 403 - Claim denied or auth method disabled.
+	* @throws {ConflictException} 409 - Organization selection required, external ID conflict, or already claimed.
+	* @throws {GoneException} 410 - Claim or user code expired.
+	*/
+	async linkClaimAttemptToExternalUser(options) {
+		const { data } = await this.workos.patch("/agents/claims/attempts", serializeLinkClaimAttemptToExternalUserOptions(options));
+		return deserializeClaimAttemptResponse(data);
+	}
+	/**
 	* Get an agent registration
 	*
 	* Retrieve a single agent registration scoped to the API key's environment.
@@ -3574,7 +3669,7 @@ var Pipes = class {
 	*/
 	async deleteUserConnectedAccount(options) {
 		const { userId, slug } = options;
-		await this.workos.delete(`/user_management/users/${encodeURIComponent(userId)}/connected_accounts/${encodeURIComponent(slug)}`, { query: { ...options.organizationId !== void 0 && { organization_id: options.organizationId } } });
+		await this.workos.delete(`/user_management/users/${encodeURIComponent(userId)}/connected_accounts/${encodeURIComponent(slug)}`, { ...options.organizationId !== void 0 && { organization_id: options.organizationId } });
 	}
 	/**
 	* List providers for a user
@@ -3955,9 +4050,6 @@ const deserializeChallenge = (challenge) => ({
 	authenticationFactorId: challenge.authentication_factor_id
 });
 //#endregion
-//#region src/multi-factor-auth/serializers/sms.serializer.ts
-const deserializeSms = (sms) => ({ phoneNumber: sms.phone_number });
-//#endregion
 //#region src/multi-factor-auth/serializers/factor.serializer.ts
 const deserializeFactor = (factor) => ({
 	object: factor.object,
@@ -4709,6 +4801,10 @@ let RefreshSessionFailureReason = /* @__PURE__ */ function(RefreshSessionFailure
 	RefreshSessionFailureReason["INVALID_GRANT"] = "invalid_grant";
 	RefreshSessionFailureReason["MFA_ENROLLMENT"] = "mfa_enrollment";
 	RefreshSessionFailureReason["SSO_REQUIRED"] = "sso_required";
+	RefreshSessionFailureReason["RATE_LIMIT_EXCEEDED"] = "rate_limit_exceeded";
+	RefreshSessionFailureReason["TIMEOUT"] = "timeout";
+	RefreshSessionFailureReason["SERVER_ERROR"] = "server_error";
+	RefreshSessionFailureReason["NETWORK_ERROR"] = "network_error";
 	return RefreshSessionFailureReason;
 }({});
 //#endregion
@@ -4788,7 +4884,8 @@ var CookieSession = class {
 		const session = await unsealData(this.sessionData, { password: this.cookiePassword });
 		if (!session.refreshToken || !session.user) return {
 			authenticated: false,
-			reason: "invalid_session_cookie"
+			reason: "invalid_session_cookie",
+			retryable: false
 		};
 		const { org_id: organizationIdFromUserManagementAccessToken } = decodeJwt(session.accessToken);
 		try {
@@ -4821,10 +4918,14 @@ var CookieSession = class {
 				impersonator: session.impersonator
 			};
 		} catch (error) {
-			if (error instanceof OauthException && (error.error === "invalid_grant" || error.error === "mfa_enrollment" || error.error === "sso_required")) return {
+			const terminalReason = classifyTerminalRefreshError(error);
+			if (terminalReason) return {
 				authenticated: false,
-				reason: error.error
+				reason: terminalReason,
+				retryable: false
 			};
+			const retryableFailure = classifyRetryableRefreshError(error);
+			if (retryableFailure) return retryableFailure;
 			throw error;
 		}
 	}
@@ -4857,6 +4958,62 @@ var CookieSession = class {
 		}
 	}
 };
+/**
+* Classifies an error thrown while refreshing as a terminal authentication
+* failure — the session is over and the user must re-authenticate — returning
+* the matching failure reason, or `null` when the error is not a recognized
+* terminal failure (and may still be retryable or should be rethrown).
+*/
+function classifyTerminalRefreshError(error) {
+	if (error instanceof OauthException && error.error === "invalid_grant") return "invalid_grant";
+	if (error instanceof AuthenticationException) {
+		const code = error.code;
+		if (code === "mfa_enrollment") return "mfa_enrollment";
+		if (code === "sso_required") return "sso_required";
+	}
+	return null;
+}
+function classifyRetryableRefreshError(error) {
+	if (error instanceof RateLimitExceededException) return {
+		authenticated: false,
+		reason: "rate_limit_exceeded",
+		retryable: true,
+		retryAfter: error.retryAfter ?? void 0,
+		error
+	};
+	const status = getErrorStatus(error);
+	if (status === 429) return {
+		authenticated: false,
+		reason: "rate_limit_exceeded",
+		retryable: true,
+		error
+	};
+	if (status === 408) return {
+		authenticated: false,
+		reason: "timeout",
+		retryable: true,
+		error
+	};
+	if (status !== void 0 && status >= 500) return {
+		authenticated: false,
+		reason: "server_error",
+		retryable: true,
+		error
+	};
+	if (isNetworkError(error)) return {
+		authenticated: false,
+		reason: "network_error",
+		retryable: true,
+		error
+	};
+	return null;
+}
+function getErrorStatus(error) {
+	if (error instanceof OauthException || error instanceof GenericServerException) return error.status;
+}
+function isNetworkError(error) {
+	return error instanceof TypeError || error instanceof Error && error.cause instanceof TypeError;
+}
 //#endregion
 //#region src/user-management/user-management.ts
 var UserManagement = class {
@@ -5340,6 +5497,34 @@ var UserManagement = class {
 		await this.workos.delete(`/user_management/users/${userId}`);
 	}
 	/**
+	* List API keys for a user
+	*
+	* Get a list of API keys owned by a specific user.
+	* @param userId - Unique identifier of the user.
+	* @param options - Pagination and filter options.
+	* @returns {Promise<AutoPaginatable<UserApiKey, SerializedListUserApiKeysOptions>>}
+	* @throws {NotFoundException} 404
+	*/
+	async listUserApiKeys(userId, options) {
+		const serializedOptions = options ? serializeListUserApiKeysOptions(options) : void 0;
+		return new AutoPaginatable(await fetchAndDeserialize(this.workos, `/user_management/users/${userId}/api_keys`, deserializeUserApiKey, serializedOptions), (params) => fetchAndDeserialize(this.workos, `/user_management/users/${userId}/api_keys`, deserializeUserApiKey, params), serializedOptions);
+	}
+	/**
+	* Create an API key for a user
+	*
+	* Create a new API key owned by a user. The user must have an active membership in the specified organization.
+	* @param userId - Unique identifier of the user.
+	* @param options - Object containing the API key properties.
+	* @returns {Promise<UserApiKeyWithValue>}
+	* @throws {BadRequestException} 400
+	* @throws {NotFoundException} 404
+	* @throws {UnprocessableEntityException} 422
+	*/
+	async createUserApiKey(userId, options, requestOptions = {}) {
+		const { data } = await this.workos.post(`/user_management/users/${userId}/api_keys`, serializeCreateUserApiKeyOptions(options), requestOptions);
+		return deserializeUserApiKeyWithValue(data);
+	}
+	/**
 	* Get user identities
 	*
 	* Get a list of identities associated with the user. A user can have multiple associated identities after going through [identity linking](https://workos.com/docs/authkit/identity-linking). Currently only OAuth identities are supported. More provider types may be added in the future.
@@ -7804,7 +7989,7 @@ var Vault = class {
 	*/
 	async deleteObject(options) {
 		const { id } = options;
-		await this.workos.delete(`/vault/v1/kv/${encodeURIComponent(id)}`, { query: { ...options.versionCheck !== void 0 && { version_check: options.versionCheck } } });
+		await this.workos.delete(`/vault/v1/kv/${encodeURIComponent(id)}`, { ...options.versionCheck !== void 0 && { version_check: options.versionCheck } });
 	}
 	/**
 	* Describe an object
@@ -7886,7 +8071,7 @@ var Vault = class {
 };
 //#endregion
 //#region package.json
-var version = "10.8.0";
+var version = "10.10.0";
 //#endregion
 //#region src/workos.ts
 const DEFAULT_HOSTNAME = "api.workos.com";
@@ -8238,4 +8423,4 @@ function createWorkOS(options) {
 //#endregion
 export { FetchHttpClient as A, NoApiKeyProvidedException as C, isAuthenticationErrorData as D, AuthenticationException as E, GenericServerException as O, NotFoundException as S, BadRequestException as T, UnprocessableEntityException as _, DomainDataState as a, RateLimitExceededException as b, FeatureFlagsRuntimeClient as c, serializeRevokeSessionOptions as d, AuthenticateWithSessionCookieFailureReason as f, Actions as g, AutoPaginatable as h, OrganizationDomainVerificationStrategy as i, SubtleCryptoProvider as j, ApiKeyRequiredException as k, CookieSession as l, Webhooks as m, ConnectionType as n, GenerateLinkIntent as o, PKCE as p, OrganizationDomainState as r, WorkOS as s, createWorkOS as t, RefreshSessionFailureReason as u, UnauthorizedException as v, ConflictException as w, OauthException as x, SignatureVerificationException as y };
 
-//# sourceMappingURL=factory-MKPb5Egh.mjs.map
+//# sourceMappingURL=factory-2nVUxmEk.mjs.map