@workos-inc/node 10.8.0 → 10.9.0

package/lib/{factory-CoKXdPX2.cjs → factory-Bd19upQB.cjs}

@@ -821,6 +821,9 @@ const deserializeAuthenticationEvent = (authenticationEvent) => ({
 	userId: authenticationEvent.user_id
 });
 //#endregion
+//#region src/multi-factor-auth/serializers/sms.serializer.ts
+const deserializeSms = (sms) => ({ phoneNumber: sms.phone_number });
+//#endregion
 //#region src/multi-factor-auth/serializers/totp.serializer.ts
 const deserializeTotp = (totp) => {
 	return {
@@ -845,7 +848,8 @@ const deserializeFactor$1 = (factor) => ({
 	createdAt: factor.created_at,
 	updatedAt: factor.updated_at,
 	type: factor.type,
-	totp: deserializeTotp(factor.totp),
+	...factor.sms ? { sms: deserializeSms(factor.sms) } : {},
+	...factor.totp ? { totp: deserializeTotp(factor.totp) } : {},
 	userId: factor.user_id
 });
 const deserializeFactorWithSecrets$1 = (factor) => ({
@@ -912,6 +916,16 @@ const serializeCreateMagicAuthOptions = (options) => ({
 //#region src/user-management/serializers/create-password-reset-options.serializer.ts
 const serializeCreatePasswordResetOptions = (options) => ({ email: options.email });
 //#endregion
+//#region src/user-management/serializers/create-user-api-key-options.serializer.ts
+function serializeCreateUserApiKeyOptions(options) {
+	return {
+		name: options.name,
+		organization_id: options.organizationId,
+		permissions: options.permissions,
+		expires_at: options.expiresAt?.toISOString()
+	};
+}
+//#endregion
 //#region src/user-management/serializers/email-verification.serializer.ts
 const deserializeEmailVerification = (emailVerification) => ({
 	object: emailVerification.object,
@@ -978,6 +992,17 @@ const deserializeInvitationEvent = (invitation) => ({
 //#region src/user-management/serializers/list-sessions-options.serializer.ts
 const serializeListSessionsOptions = (options) => ({ ...options });
 //#endregion
+//#region src/user-management/serializers/list-user-api-keys-options.serializer.ts
+function serializeListUserApiKeysOptions(options) {
+	return {
+		limit: options.limit,
+		before: options.before,
+		after: options.after,
+		order: options.order,
+		organization_id: options.organizationId
+	};
+}
+//#endregion
 //#region src/user-management/serializers/magic-auth.serializer.ts
 const deserializeMagicAuth = (magicAuth) => ({
 	object: magicAuth.object,
@@ -1083,6 +1108,34 @@ const serializeUpdateUserOptions = (options) => ({
 	metadata: options.metadata
 });
 //#endregion
+//#region src/user-management/serializers/user-api-key.serializer.ts
+function deserializeUserApiKey(apiKey) {
+	return {
+		object: apiKey.object,
+		id: apiKey.id,
+		owner: {
+			type: "user",
+			id: apiKey.owner.id,
+			organizationId: apiKey.owner.organization_id
+		},
+		name: apiKey.name,
+		obfuscatedValue: apiKey.obfuscated_value,
+		lastUsedAt: apiKey.last_used_at,
+		expiresAt: apiKey.expires_at,
+		permissions: apiKey.permissions,
+		createdAt: apiKey.created_at,
+		updatedAt: apiKey.updated_at
+	};
+}
+//#endregion
+//#region src/user-management/serializers/user-api-key-with-value.serializer.ts
+function deserializeUserApiKeyWithValue(apiKey) {
+	return {
+		...deserializeUserApiKey(apiKey),
+		value: apiKey.value
+	};
+}
+//#endregion
 //#region src/user-management/serializers/organization-membership.serializer.ts
 const deserializeOrganizationMembership = (organizationMembership) => ({
 	object: organizationMembership.object,
@@ -2109,6 +2162,27 @@ function deserializeAgentRegistration(registration) {
 	};
 }
 //#endregion
+//#region src/agents/serializers/claim-attempt.serializer.ts
+function serializeLinkClaimAttemptToExternalUserOptions(options) {
+	return {
+		type: "link_external_user",
+		claim_attempt_token: options.claimAttemptToken,
+		user: {
+			email: options.user.email,
+			external_id: options.user.externalId
+		},
+		...options.organizationId !== void 0 && { organization_id: options.organizationId }
+	};
+}
+function deserializeClaimAttemptResponse(response) {
+	return {
+		id: response.id,
+		status: response.status,
+		userCode: response.user_code,
+		organizations: response.organizations
+	};
+}
+//#endregion
 //#region src/agents/serializers/validate-agent-credential.serializer.ts
 function serializeValidateAgentCredentialOptions(options) {
 	return {
@@ -2162,6 +2236,25 @@ var Agents = class {
 		this.workos = workos;
 	}
 	/**
+	* Link a claim attempt to an external user
+	*
+	* Link an external user to a claim attempt and retrieve the code needed
+	* for the agent to complete the claim. The user is looked up by external
+	* ID; if no user exists, one is created. When the user belongs to multiple
+	* organizations, an explicit organization must be provided.
+	*
+	* @param options - Object containing the claim attempt token, user details, and optional organization ID.
+	* @returns {Promise<ClaimAttemptResponse>}
+	* @throws {BadRequestException} 400 - Invalid request, email mismatch, or wrong account.
+	* @throws {ForbiddenException} 403 - Claim denied or auth method disabled.
+	* @throws {ConflictException} 409 - Organization selection required, external ID conflict, or already claimed.
+	* @throws {GoneException} 410 - Claim or user code expired.
+	*/
+	async linkClaimAttemptToExternalUser(options) {
+		const { data } = await this.workos.patch("/agents/claims/attempts", serializeLinkClaimAttemptToExternalUserOptions(options));
+		return deserializeClaimAttemptResponse(data);
+	}
+	/**
 	* Get an agent registration
 	*
 	* Retrieve a single agent registration scoped to the API key's environment.
@@ -3574,7 +3667,7 @@ var Pipes = class {
 	*/
 	async deleteUserConnectedAccount(options) {
 		const { userId, slug } = options;
-		await this.workos.delete(`/user_management/users/${encodeURIComponent(userId)}/connected_accounts/${encodeURIComponent(slug)}`, { query: { ...options.organizationId !== void 0 && { organization_id: options.organizationId } } });
+		await this.workos.delete(`/user_management/users/${encodeURIComponent(userId)}/connected_accounts/${encodeURIComponent(slug)}`, { ...options.organizationId !== void 0 && { organization_id: options.organizationId } });
 	}
 	/**
 	* List providers for a user
@@ -3955,9 +4048,6 @@ const deserializeChallenge = (challenge) => ({
 	authenticationFactorId: challenge.authentication_factor_id
 });
 //#endregion
-//#region src/multi-factor-auth/serializers/sms.serializer.ts
-const deserializeSms = (sms) => ({ phoneNumber: sms.phone_number });
-//#endregion
 //#region src/multi-factor-auth/serializers/factor.serializer.ts
 const deserializeFactor = (factor) => ({
 	object: factor.object,
@@ -4709,6 +4799,10 @@ let RefreshSessionFailureReason = /* @__PURE__ */ function(RefreshSessionFailure
 	RefreshSessionFailureReason["INVALID_GRANT"] = "invalid_grant";
 	RefreshSessionFailureReason["MFA_ENROLLMENT"] = "mfa_enrollment";
 	RefreshSessionFailureReason["SSO_REQUIRED"] = "sso_required";
+	RefreshSessionFailureReason["RATE_LIMIT_EXCEEDED"] = "rate_limit_exceeded";
+	RefreshSessionFailureReason["TIMEOUT"] = "timeout";
+	RefreshSessionFailureReason["SERVER_ERROR"] = "server_error";
+	RefreshSessionFailureReason["NETWORK_ERROR"] = "network_error";
 	return RefreshSessionFailureReason;
 }({});
 //#endregion
@@ -4788,7 +4882,8 @@ var CookieSession = class {
 		const session = await unsealData(this.sessionData, { password: this.cookiePassword });
 		if (!session.refreshToken || !session.user) return {
 			authenticated: false,
-			reason: "invalid_session_cookie"
+			reason: "invalid_session_cookie",
+			retryable: false
 		};
 		const { org_id: organizationIdFromUserManagementAccessToken } = decodeJwt(session.accessToken);
 		try {
@@ -4821,10 +4916,14 @@ var CookieSession = class {
 				impersonator: session.impersonator
 			};
 		} catch (error) {
-			if (error instanceof OauthException && (error.error === "invalid_grant" || error.error === "mfa_enrollment" || error.error === "sso_required")) return {
+			const terminalReason = classifyTerminalRefreshError(error);
+			if (terminalReason) return {
 				authenticated: false,
-				reason: error.error
+				reason: terminalReason,
+				retryable: false
 			};
+			const retryableFailure = classifyRetryableRefreshError(error);
+			if (retryableFailure) return retryableFailure;
 			throw error;
 		}
 	}
@@ -4857,6 +4956,62 @@ var CookieSession = class {
 		}
 	}
 };
+/**
+* Classifies an error thrown while refreshing as a terminal authentication
+* failure — the session is over and the user must re-authenticate — returning
+* the matching failure reason, or `null` when the error is not a recognized
+* terminal failure (and may still be retryable or should be rethrown).
+*/
+function classifyTerminalRefreshError(error) {
+	if (error instanceof OauthException && error.error === "invalid_grant") return "invalid_grant";
+	if (error instanceof AuthenticationException) {
+		const code = error.code;
+		if (code === "mfa_enrollment") return "mfa_enrollment";
+		if (code === "sso_required") return "sso_required";
+	}
+	return null;
+}
+function classifyRetryableRefreshError(error) {
+	if (error instanceof RateLimitExceededException) return {
+		authenticated: false,
+		reason: "rate_limit_exceeded",
+		retryable: true,
+		retryAfter: error.retryAfter ?? void 0,
+		error
+	};
+	const status = getErrorStatus(error);
+	if (status === 429) return {
+		authenticated: false,
+		reason: "rate_limit_exceeded",
+		retryable: true,
+		error
+	};
+	if (status === 408) return {
+		authenticated: false,
+		reason: "timeout",
+		retryable: true,
+		error
+	};
+	if (status !== void 0 && status >= 500) return {
+		authenticated: false,
+		reason: "server_error",
+		retryable: true,
+		error
+	};
+	if (isNetworkError(error)) return {
+		authenticated: false,
+		reason: "network_error",
+		retryable: true,
+		error
+	};
+	return null;
+}
+function getErrorStatus(error) {
+	if (error instanceof OauthException || error instanceof GenericServerException) return error.status;
+}
+function isNetworkError(error) {
+	return error instanceof TypeError || error instanceof Error && error.cause instanceof TypeError;
+}
 //#endregion
 //#region src/user-management/user-management.ts
 var UserManagement = class {
@@ -5340,6 +5495,34 @@ var UserManagement = class {
 		await this.workos.delete(`/user_management/users/${userId}`);
 	}
 	/**
+	* List API keys for a user
+	*
+	* Get a list of API keys owned by a specific user.
+	* @param userId - Unique identifier of the user.
+	* @param options - Pagination and filter options.
+	* @returns {Promise<AutoPaginatable<UserApiKey, SerializedListUserApiKeysOptions>>}
+	* @throws {NotFoundException} 404
+	*/
+	async listUserApiKeys(userId, options) {
+		const serializedOptions = options ? serializeListUserApiKeysOptions(options) : void 0;
+		return new AutoPaginatable(await fetchAndDeserialize(this.workos, `/user_management/users/${userId}/api_keys`, deserializeUserApiKey, serializedOptions), (params) => fetchAndDeserialize(this.workos, `/user_management/users/${userId}/api_keys`, deserializeUserApiKey, params), serializedOptions);
+	}
+	/**
+	* Create an API key for a user
+	*
+	* Create a new API key owned by a user. The user must have an active membership in the specified organization.
+	* @param userId - Unique identifier of the user.
+	* @param options - Object containing the API key properties.
+	* @returns {Promise<UserApiKeyWithValue>}
+	* @throws {BadRequestException} 400
+	* @throws {NotFoundException} 404
+	* @throws {UnprocessableEntityException} 422
+	*/
+	async createUserApiKey(userId, options, requestOptions = {}) {
+		const { data } = await this.workos.post(`/user_management/users/${userId}/api_keys`, serializeCreateUserApiKeyOptions(options), requestOptions);
+		return deserializeUserApiKeyWithValue(data);
+	}
+	/**
 	* Get user identities
 	*
 	* Get a list of identities associated with the user. A user can have multiple associated identities after going through [identity linking](https://workos.com/docs/authkit/identity-linking). Currently only OAuth identities are supported. More provider types may be added in the future.
@@ -7804,7 +7987,7 @@ var Vault = class {
 	*/
 	async deleteObject(options) {
 		const { id } = options;
-		await this.workos.delete(`/vault/v1/kv/${encodeURIComponent(id)}`, { query: { ...options.versionCheck !== void 0 && { version_check: options.versionCheck } } });
+		await this.workos.delete(`/vault/v1/kv/${encodeURIComponent(id)}`, { ...options.versionCheck !== void 0 && { version_check: options.versionCheck } });
 	}
 	/**
 	* Describe an object
@@ -7886,7 +8069,7 @@ var Vault = class {
 };
 //#endregion
 //#region package.json
-var version = "10.8.0";
+var version = "10.9.0";
 //#endregion
 //#region src/workos.ts
 const DEFAULT_HOSTNAME = "api.workos.com";
@@ -8423,4 +8606,4 @@ Object.defineProperty(exports, "serializeRevokeSessionOptions", {
 	}
 });
 
-//# sourceMappingURL=factory-CoKXdPX2.cjs.map
+//# sourceMappingURL=factory-Bd19upQB.cjs.map