List WorkOS directories, directory users, and directory groups via Directory Sync with correct pagination and deactivation handling

Documented steps

1. Authenticate every call with header 'Authorization: Bearer sk_...'.
2. List directories: GET https://api.workos.com/directories with optional organization_id, search, limit (1-100, default 10), before, after, and order.
3. Take a directory id from the results, or filter directory users and groups by organization_id directly if you prefer org-scoped reads.
4. List directory users: GET https://api.workos.com/directory_users with optional filters directory, group, idp_id, email, plus limit/before/after/order.
5. Paginate forward by passing the last returned object's id as `after` on the next request (or the first id as `before` to page backward). Stop when a page returns fewer results than `limit`.
6. Drive application logic off the normalized top-level fields (email, first_name, last_name, username, role, roles). Treat raw_attributes as diagnostic only, since its shape varies per IdP.
7. Check each directory user's `state` on every sync: 'active' means provisioned, while 'suspended' or 'inactive' means the IdP deprovisioned or disabled them — revoke app access on those rather than waiting for a delete.
8. List directory groups: GET https://api.workos.com/directory_groups with optional directory filter, or the `user` filter to get a specific user's groups.
9. For near-real-time provisioning, react to Directory Sync events (dsync.user.created, dsync.user.updated, dsync.user.deleted, dsync.group.*) via webhooks or the Events API instead of polling these list endpoints on a timer.
10. Use the list endpoints for reconciliation sweeps — a periodic full read that repairs drift missed by webhook outages.
11. Reference: https://workos.com/docs/reference/directory-sync/directory-user/list