Merge branch 'main' into changeset-release/main

Author: wobsoriano

.changeset/empty-lights-dress.md

@@ -0,0 +1,15 @@
+---
+'@clerk/nuxt': minor
+---
+
+API keys is now generally available.
+
+```vue
+<script setup>
+// Components are automatically imported
+</script>
+
+<template>
+  <APIKeys />
+</template>
+```

.changeset/fifty-paths-tie.md

@@ -0,0 +1,5 @@
+---
+'@clerk/ui': patch
+---
+
+Adjust padding and display logo on `OrganizationList` header

.changeset/five-poems-drum.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/fix-org-invitation-accepted-export.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Export `OrganizationInvitationAcceptedWebhookEvent` type.

.changeset/fix-testing-concurrent-workers.md

@@ -0,0 +1,5 @@
+---
+"@clerk/testing": patch
+---
+
+Fix `signIn()` timing out with concurrent Playwright workers by de-duplicating route handler registration and adding retry with exponential backoff for transient FAPI errors (429, 502, 503, 504).

.changeset/skip-permissions-dispatch.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/stable-api-keys.md

@@ -0,0 +1,41 @@
+---
+"@clerk/shared": minor
+"@clerk/react": minor
+"@clerk/clerk-js": minor
+"@clerk/ui": minor
+---
+
+API keys is now generally available.
+
+### `<APIKeys />` component
+
+```tsx
+import { APIKeys } from '@clerk/react';
+
+export default function Page() {
+  return <APIKeys />;
+}
+```
+
+### `useAPIKeys()` hook
+
+```tsx
+import { useAPIKeys } from '@clerk/react';
+
+export default function CustomAPIKeys() {
+  const { data, isLoading, page, pageCount, fetchNext, fetchPrevious } = useAPIKeys({
+    pageSize: 10,
+    initialPage: 1,
+  });
+
+  if (isLoading) return <div>Loading...</div>;
+
+  return (
+    <ul>
+      {data?.map((key) => (
+        <li key={key.id}>{key.name}</li>
+      ))}
+    </ul>
+  );
+}
+```

.github/workflows/e2e-staging.yml

@@ -39,6 +39,7 @@ concurrency:
 jobs:
   permissions-check:
     name: Check Permissions
+    if: ${{ github.event_name != 'repository_dispatch' }}
     runs-on: 'blacksmith-8vcpu-ubuntu-2204'
     steps:
       - name: Check org membership
@@ -70,12 +71,35 @@ jobs:
   validate-instances:
     name: Validate Staging Instances
     needs: [permissions-check]
+    if: ${{ always() && (needs.permissions-check.result == 'success' || needs.permissions-check.result == 'skipped') }}
     runs-on: 'blacksmith-8vcpu-ubuntu-2204'
     steps:
+      - name: Normalize inputs
+        id: inputs
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_REF: ${{ github.event.inputs.ref }}
+          PAYLOAD_REF: ${{ github.event.client_payload.ref }}
+        run: |
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            echo "ref=${INPUT_REF:-main}" >> $GITHUB_OUTPUT
+          else
+            echo "ref=${PAYLOAD_REF:-main}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Validate ref
+        env:
+          REF: ${{ steps.inputs.outputs.ref }}
+        run: |
+          if [[ ! "$REF" =~ ^(main|release/.*)$ ]]; then
+            echo "::error::Ref '$REF' is not allowed. Only 'main' and 'release/*' branches are permitted."
+            exit 1
+          fi
+
       - name: Checkout Repo
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.inputs.ref || github.event.client_payload.ref || 'main' }}
+          ref: ${{ steps.inputs.outputs.ref }}
           sparse-checkout: scripts/validate-staging-instances.mjs
           fetch-depth: 1
 
@@ -88,6 +112,7 @@ jobs:
   integration-tests:
     name: Integration Tests (${{ matrix.test-name }}, ${{ matrix.test-project }})
     needs: [permissions-check]
+    if: ${{ always() && (needs.permissions-check.result == 'success' || needs.permissions-check.result == 'skipped') }}
     runs-on: 'blacksmith-8vcpu-ubuntu-2204'
     defaults:
       run:

integration/testUtils/__tests__/retryableClerkClient.test.ts

@@ -135,6 +135,29 @@ describe('withRetry', () => {
       expect(mock).toHaveBeenCalledTimes(2);
     });
 
+    it('uses exponential backoff as floor when retryAfter is 0', async () => {
+      vi.spyOn(Math, 'random').mockReturnValue(0);
+      const error = makeClerkAPIError(429, { retryAfter: 0 });
+      const mock = vi
+        .fn()
+        .mockImplementationOnce(() => Promise.resolve().then(() => Promise.reject(error)))
+        .mockResolvedValueOnce({ id: 'user_123' });
+      const client = makeMockClient({ getUser: mock });
+      const wrapped = withRetry(client);
+
+      const promise = (wrapped.users as any).getUser('user_123');
+
+      // retryAfter=0 should NOT cause a 0ms delay; exponential backoff (1000ms for attempt 0) is used as floor
+      await vi.advanceTimersByTimeAsync(999);
+      expect(mock).toHaveBeenCalledTimes(1);
+
+      await vi.advanceTimersByTimeAsync(1);
+      await vi.advanceTimersByTimeAsync(0);
+
+      await expect(promise).resolves.toEqual({ id: 'user_123' });
+      expect(mock).toHaveBeenCalledTimes(2);
+    });
+
     it('caps retryAfter delay at MAX_RETRY_DELAY_MS (30s)', async () => {
       const error = makeClerkAPIError(429, { retryAfter: 60 });
       const mock = vi

integration/testUtils/retryableClerkClient.ts

@@ -14,10 +14,11 @@ function sleep(ms: number): Promise<void> {
 }
 
 function getRetryDelay(error: unknown, attempt: number): number {
+  const exponentialDelay = BASE_DELAY_MS * Math.pow(2, attempt) + Math.random() * JITTER_MAX_MS;
   if (isClerkAPIResponseError(error) && typeof error.retryAfter === 'number') {
-    return Math.min(error.retryAfter * 1000, MAX_RETRY_DELAY_MS);
+    return Math.min(Math.max(error.retryAfter * 1000, exponentialDelay), MAX_RETRY_DELAY_MS);
   }
-  return BASE_DELAY_MS * Math.pow(2, attempt) + Math.random() * JITTER_MAX_MS;
+  return exponentialDelay;
 }
 
 function recordRetry(path: string): void {