@auth0/auth0-server-js 1.13.0 → 1.15.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { ActClaim, AuthorizationDetails, ExchangeProfileOptions, DiscoveryCacheOptions, TelemetryConfig, AuthClient, ListAuthenticatorsOptions, RequestOptions, AuthenticatorResponse, EnrollAuthenticatorOptions, EnrollmentResponse, ChallengeOptions, ChallengeResponse, MfaVerifyOptions, PasskeySignupChallengeOptions, PasskeySignupChallengeResponse, PasskeyLoginChallengeOptions, PasskeyLoginChallengeResponse, GetTokenByPasskeyOptions, SignUpOptions, SignUpResult, ChangePasswordOptions, ApiResponse, GetUserInfoOptions, UserInfoResponse, TokenResponse } from '@auth0/auth0-auth-js';
-export { ActClaim, ApiResponse, AuthenticatorResponse, AuthenticatorType, ChallengeOptions, ChallengeResponse, ChangePasswordError, ChangePasswordOptions, DiscoveryCacheOptions, EnrollAuthenticatorOptions, EnrollEmailOptions, EnrollOobOptions, EnrollOtpOptions, EnrollmentResponse, FullResponseOption, GetUserInfoOptions, ListAuthenticatorsOptions, MfaChallengeError, MfaEnrollmentError, MfaFactorType, MfaListAuthenticatorsError, MfaRequirements, MfaVerifyError, MfaVerifyOobOptions, MfaVerifyOptions, MfaVerifyOtpOptions, MfaVerifyRecoveryCodeOptions, MissingClientAuthError, OobChannel, OobEnrollmentResponse, OrganizationValidationError, OtpEnrollmentResponse, PasskeyChallengeError, PasskeyLoginChallengeOptions as PasskeyChallengeOptions, PasskeyLoginChallengeResponse as PasskeyChallengeResponse, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyGetTokenError, GetTokenByPasskeyOptions as PasskeyGetTokenOptions, PasskeyRegisterError, PasskeySignupChallengeOptions as PasskeyRegisterOptions, PasskeySignupChallengeResponse as PasskeyRegisterResponse, PasskeyRequestOptions, PasswordlessStartError, PasswordlessVerifyError, RequestOptions, SignUpError, SignUpOptions, SignUpResult, TelemetryConfig, TokenExchangeError, TokenResponse, TokenRevocationError, UserInfoError, UserInfoResponse, isMfaRequiredError } from '@auth0/auth0-auth-js';
+export { ActClaim, ApiResponse, AuthenticatorResponse, AuthenticatorType, ChallengeOptions, ChallengeResponse, ChangePasswordError, ChangePasswordOptions, DiscoveryCacheOptions, EnrollAuthenticatorOptions, EnrollEmailOptions, EnrollOobOptions, EnrollOtpOptions, EnrollmentResponse, EnterpriseConnectNotSupportedError, FullResponseOption, GetUserInfoOptions, IsFederatedDomainOptions, ListAuthenticatorsOptions, MfaChallengeError, MfaEnrollmentError, MfaFactorType, MfaListAuthenticatorsError, MfaRequirements, MfaVerifyError, MfaVerifyOobOptions, MfaVerifyOptions, MfaVerifyOtpOptions, MfaVerifyRecoveryCodeOptions, MissingClientAuthError, OobChannel, OobEnrollmentResponse, OrganizationValidationError, OtpEnrollmentResponse, PasskeyChallengeError, PasskeyLoginChallengeOptions as PasskeyChallengeOptions, PasskeyLoginChallengeResponse as PasskeyChallengeResponse, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyGetTokenError, GetTokenByPasskeyOptions as PasskeyGetTokenOptions, PasskeyRegisterError, PasskeySignupChallengeOptions as PasskeyRegisterOptions, PasskeySignupChallengeResponse as PasskeyRegisterResponse, PasskeyRequestOptions, PasswordlessStartError, PasswordlessVerifyError, RequestOptions, SignUpError, SignUpOptions, SignUpResult, TelemetryConfig, TokenExchangeError, TokenResponse, TokenRevocationError, UserInfoError, UserInfoResponse, isFederatedDomain, isMfaRequiredError } from '@auth0/auth0-auth-js';
 import { JWTPayload } from 'jose';
 
 /**
@@ -40,7 +40,11 @@ interface ServerClientOptions<TStoreOptions = unknown> {
      */
     customFetch?: typeof fetch;
     transactionStore: TransactionStore<TStoreOptions>;
-    stateStore: StateStore<TStoreOptions>;
+    /**
+     * The state store for persisting session state. Required for non-Enterprise Connect mode.
+     * When `enterpriseConnect: true`, the state store is not needed (Auth0 does not manage a session).
+     */
+    stateStore?: StateStore<TStoreOptions>;
     /**
      * Indicates whether the SDK should use the mTLS endpoints if they are available.
      *
@@ -52,6 +56,15 @@ interface ServerClientOptions<TStoreOptions = unknown> {
      * Telemetry is enabled by default and sends the Auth0-Client header with package name and version.
      */
     telemetry?: TelemetryConfig;
+    /**
+     * Set to true when using Enterprise Connect.
+     *
+     * Auth0 acts as a pure SSO relay — it authenticates the user via the enterprise
+     * IdP and hands back an ID token, but holds no session and issues no refresh
+     * tokens. Any method that depends on an Auth0-managed session or refresh token
+     * throws a clear error instead of returning null silently.
+     */
+    enterpriseConnect?: true;
 }
 interface UserClaims {
     sub: string;
@@ -82,6 +95,28 @@ interface AuthorizationParameters {
      * this is supported for backwards compatibility.
      */
     organization?: string;
+    /**
+     * Selects the Experiment Center experiment to override for this authorization
+     * request, bypassing the server-side deterministic assignment. Use together
+     * with `variation_id` to force a specific variant.
+     *
+     * Pass per-call via `startInteractiveLogin` rather than at client construction
+     * time, so the override does not apply to every login.
+     */
+    experiment_id?: string;
+    /**
+     * The variation to assign the user to within the experiment identified by
+     * `experiment_id`. The override applies to this request only — the next login
+     * without these params reverts to normal server-side assignment.
+     * Requires `experiment_id`.
+     */
+    variation_id?: string;
+    /**
+     * Scopes the experiment override to a specific segment for this authorization
+     * request. Requires `experiment_id`. Only needed when the experiment uses
+     * segment targeting.
+     */
+    segment_id?: string;
     [key: string]: unknown;
 }
 interface TokenSet {
@@ -345,6 +380,22 @@ interface RevokeRefreshTokenOptions {
 }
 interface LogoutOptions {
     returnTo: string;
+    /**
+     * When true, terminates the upstream identity provider session via federated logout.
+     * Required for Enterprise Connect to end the enterprise IdP session.
+     */
+    federated?: boolean;
+}
+interface StartEnterpriseLoginOptions {
+    /**
+     * The user's email address. The domain part is used for WebFinger discovery
+     * and the full email is forwarded as `login_hint` to Auth0's /authorize.
+     */
+    email: string;
+    /**
+     * The URL to redirect to after login completes.
+     */
+    returnTo?: string;
 }
 interface StartLinkUserOptions<TAppState = unknown> {
     connection: string;
@@ -852,6 +903,16 @@ declare class ServerClient<TStoreOptions = unknown> {
      */
     get database(): ServerDatabaseClient<TStoreOptions>;
     constructor(options: ServerClientOptions<TStoreOptions>);
+    /**
+     * Starts the Enterprise Connect login flow. Performs WebFinger domain discovery
+     * and, if the email domain is federated, initiates an interactive login with `login_hint`.
+     *
+     * @param options Options including the user's email and optional returnTo URL.
+     * @param storeOptions Optional options passed to the Transaction Store.
+     *
+     * @returns A URL to redirect to (federated domain) or null (not federated / invalid email).
+     */
+    startEnterpriseLogin(options: StartEnterpriseLoginOptions, storeOptions?: TStoreOptions): Promise<URL | null>;
     /**
      * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
      *
@@ -882,6 +943,7 @@ declare class ServerClient<TStoreOptions = unknown> {
      * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
      *
      * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).
+     * In Enterprise Connect mode, also includes `idTokenClaims` and `user`.
      *
      * @remarks
      * This method does not support the `fullResponse` opt-in in v1. It accepts
@@ -893,6 +955,8 @@ declare class ServerClient<TStoreOptions = unknown> {
     completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions, requestOptions?: RequestOptions): Promise<{
         appState?: TAppState;
         authorizationDetails?: AuthorizationDetails[];
+        idTokenClaims?: Record<string, unknown>;
+        user?: UserClaims;
     }>;
     /**
      * Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
@@ -1481,4 +1545,4 @@ declare class SessionExpiredError extends Error {
     constructor(message?: string);
 }
 
-export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type BuildSessionTransferRedirectOptions, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, type RequestSessionTransferTokenOptions, type RevokeRefreshTokenOptions, ServerClient, type ServerClientOptions, ServerDatabaseClient, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type SessionTransferActor, type SessionTransferTokenResult, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, TokenExchangeErrorCode, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };
+export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type BuildSessionTransferRedirectOptions, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, type RequestSessionTransferTokenOptions, type RevokeRefreshTokenOptions, ServerClient, type ServerClientOptions, ServerDatabaseClient, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type SessionTransferActor, type SessionTransferTokenResult, type StartEnterpriseLoginOptions, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, TokenExchangeErrorCode, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { ActClaim, AuthorizationDetails, ExchangeProfileOptions, DiscoveryCacheOptions, TelemetryConfig, AuthClient, ListAuthenticatorsOptions, RequestOptions, AuthenticatorResponse, EnrollAuthenticatorOptions, EnrollmentResponse, ChallengeOptions, ChallengeResponse, MfaVerifyOptions, PasskeySignupChallengeOptions, PasskeySignupChallengeResponse, PasskeyLoginChallengeOptions, PasskeyLoginChallengeResponse, GetTokenByPasskeyOptions, SignUpOptions, SignUpResult, ChangePasswordOptions, ApiResponse, GetUserInfoOptions, UserInfoResponse, TokenResponse } from '@auth0/auth0-auth-js';
-export { ActClaim, ApiResponse, AuthenticatorResponse, AuthenticatorType, ChallengeOptions, ChallengeResponse, ChangePasswordError, ChangePasswordOptions, DiscoveryCacheOptions, EnrollAuthenticatorOptions, EnrollEmailOptions, EnrollOobOptions, EnrollOtpOptions, EnrollmentResponse, FullResponseOption, GetUserInfoOptions, ListAuthenticatorsOptions, MfaChallengeError, MfaEnrollmentError, MfaFactorType, MfaListAuthenticatorsError, MfaRequirements, MfaVerifyError, MfaVerifyOobOptions, MfaVerifyOptions, MfaVerifyOtpOptions, MfaVerifyRecoveryCodeOptions, MissingClientAuthError, OobChannel, OobEnrollmentResponse, OrganizationValidationError, OtpEnrollmentResponse, PasskeyChallengeError, PasskeyLoginChallengeOptions as PasskeyChallengeOptions, PasskeyLoginChallengeResponse as PasskeyChallengeResponse, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyGetTokenError, GetTokenByPasskeyOptions as PasskeyGetTokenOptions, PasskeyRegisterError, PasskeySignupChallengeOptions as PasskeyRegisterOptions, PasskeySignupChallengeResponse as PasskeyRegisterResponse, PasskeyRequestOptions, PasswordlessStartError, PasswordlessVerifyError, RequestOptions, SignUpError, SignUpOptions, SignUpResult, TelemetryConfig, TokenExchangeError, TokenResponse, TokenRevocationError, UserInfoError, UserInfoResponse, isMfaRequiredError } from '@auth0/auth0-auth-js';
+export { ActClaim, ApiResponse, AuthenticatorResponse, AuthenticatorType, ChallengeOptions, ChallengeResponse, ChangePasswordError, ChangePasswordOptions, DiscoveryCacheOptions, EnrollAuthenticatorOptions, EnrollEmailOptions, EnrollOobOptions, EnrollOtpOptions, EnrollmentResponse, EnterpriseConnectNotSupportedError, FullResponseOption, GetUserInfoOptions, IsFederatedDomainOptions, ListAuthenticatorsOptions, MfaChallengeError, MfaEnrollmentError, MfaFactorType, MfaListAuthenticatorsError, MfaRequirements, MfaVerifyError, MfaVerifyOobOptions, MfaVerifyOptions, MfaVerifyOtpOptions, MfaVerifyRecoveryCodeOptions, MissingClientAuthError, OobChannel, OobEnrollmentResponse, OrganizationValidationError, OtpEnrollmentResponse, PasskeyChallengeError, PasskeyLoginChallengeOptions as PasskeyChallengeOptions, PasskeyLoginChallengeResponse as PasskeyChallengeResponse, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyGetTokenError, GetTokenByPasskeyOptions as PasskeyGetTokenOptions, PasskeyRegisterError, PasskeySignupChallengeOptions as PasskeyRegisterOptions, PasskeySignupChallengeResponse as PasskeyRegisterResponse, PasskeyRequestOptions, PasswordlessStartError, PasswordlessVerifyError, RequestOptions, SignUpError, SignUpOptions, SignUpResult, TelemetryConfig, TokenExchangeError, TokenResponse, TokenRevocationError, UserInfoError, UserInfoResponse, isFederatedDomain, isMfaRequiredError } from '@auth0/auth0-auth-js';
 import { JWTPayload } from 'jose';
 
 /**
@@ -40,7 +40,11 @@ interface ServerClientOptions<TStoreOptions = unknown> {
      */
     customFetch?: typeof fetch;
     transactionStore: TransactionStore<TStoreOptions>;
-    stateStore: StateStore<TStoreOptions>;
+    /**
+     * The state store for persisting session state. Required for non-Enterprise Connect mode.
+     * When `enterpriseConnect: true`, the state store is not needed (Auth0 does not manage a session).
+     */
+    stateStore?: StateStore<TStoreOptions>;
     /**
      * Indicates whether the SDK should use the mTLS endpoints if they are available.
      *
@@ -52,6 +56,15 @@ interface ServerClientOptions<TStoreOptions = unknown> {
      * Telemetry is enabled by default and sends the Auth0-Client header with package name and version.
      */
     telemetry?: TelemetryConfig;
+    /**
+     * Set to true when using Enterprise Connect.
+     *
+     * Auth0 acts as a pure SSO relay — it authenticates the user via the enterprise
+     * IdP and hands back an ID token, but holds no session and issues no refresh
+     * tokens. Any method that depends on an Auth0-managed session or refresh token
+     * throws a clear error instead of returning null silently.
+     */
+    enterpriseConnect?: true;
 }
 interface UserClaims {
     sub: string;
@@ -82,6 +95,28 @@ interface AuthorizationParameters {
      * this is supported for backwards compatibility.
      */
     organization?: string;
+    /**
+     * Selects the Experiment Center experiment to override for this authorization
+     * request, bypassing the server-side deterministic assignment. Use together
+     * with `variation_id` to force a specific variant.
+     *
+     * Pass per-call via `startInteractiveLogin` rather than at client construction
+     * time, so the override does not apply to every login.
+     */
+    experiment_id?: string;
+    /**
+     * The variation to assign the user to within the experiment identified by
+     * `experiment_id`. The override applies to this request only — the next login
+     * without these params reverts to normal server-side assignment.
+     * Requires `experiment_id`.
+     */
+    variation_id?: string;
+    /**
+     * Scopes the experiment override to a specific segment for this authorization
+     * request. Requires `experiment_id`. Only needed when the experiment uses
+     * segment targeting.
+     */
+    segment_id?: string;
     [key: string]: unknown;
 }
 interface TokenSet {
@@ -345,6 +380,22 @@ interface RevokeRefreshTokenOptions {
 }
 interface LogoutOptions {
     returnTo: string;
+    /**
+     * When true, terminates the upstream identity provider session via federated logout.
+     * Required for Enterprise Connect to end the enterprise IdP session.
+     */
+    federated?: boolean;
+}
+interface StartEnterpriseLoginOptions {
+    /**
+     * The user's email address. The domain part is used for WebFinger discovery
+     * and the full email is forwarded as `login_hint` to Auth0's /authorize.
+     */
+    email: string;
+    /**
+     * The URL to redirect to after login completes.
+     */
+    returnTo?: string;
 }
 interface StartLinkUserOptions<TAppState = unknown> {
     connection: string;
@@ -852,6 +903,16 @@ declare class ServerClient<TStoreOptions = unknown> {
      */
     get database(): ServerDatabaseClient<TStoreOptions>;
     constructor(options: ServerClientOptions<TStoreOptions>);
+    /**
+     * Starts the Enterprise Connect login flow. Performs WebFinger domain discovery
+     * and, if the email domain is federated, initiates an interactive login with `login_hint`.
+     *
+     * @param options Options including the user's email and optional returnTo URL.
+     * @param storeOptions Optional options passed to the Transaction Store.
+     *
+     * @returns A URL to redirect to (federated domain) or null (not federated / invalid email).
+     */
+    startEnterpriseLogin(options: StartEnterpriseLoginOptions, storeOptions?: TStoreOptions): Promise<URL | null>;
     /**
      * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
      *
@@ -882,6 +943,7 @@ declare class ServerClient<TStoreOptions = unknown> {
      * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
      *
      * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).
+     * In Enterprise Connect mode, also includes `idTokenClaims` and `user`.
      *
      * @remarks
      * This method does not support the `fullResponse` opt-in in v1. It accepts
@@ -893,6 +955,8 @@ declare class ServerClient<TStoreOptions = unknown> {
     completeInteractiveLogin<TAppState = unknown>(url: URL, storeOptions?: TStoreOptions, requestOptions?: RequestOptions): Promise<{
         appState?: TAppState;
         authorizationDetails?: AuthorizationDetails[];
+        idTokenClaims?: Record<string, unknown>;
+        user?: UserClaims;
     }>;
     /**
      * Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
@@ -1481,4 +1545,4 @@ declare class SessionExpiredError extends Error {
     constructor(message?: string);
 }
 
-export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type BuildSessionTransferRedirectOptions, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, type RequestSessionTransferTokenOptions, type RevokeRefreshTokenOptions, ServerClient, type ServerClientOptions, ServerDatabaseClient, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type SessionTransferActor, type SessionTransferTokenResult, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, TokenExchangeErrorCode, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };
+export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type BuildSessionTransferRedirectOptions, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, type RequestSessionTransferTokenOptions, type RevokeRefreshTokenOptions, ServerClient, type ServerClientOptions, ServerDatabaseClient, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type SessionTransferActor, type SessionTransferTokenResult, type StartEnterpriseLoginOptions, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, TokenExchangeErrorCode, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };

package/dist/index.js

@@ -168,6 +168,7 @@ function updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointR
 import {
   TokenForConnectionError,
   AuthClient,
+  isFederatedDomain,
   MissingCapturedResponseError,
   OrganizationValidationError,
   PasswordlessStartError,
@@ -212,7 +213,7 @@ function getTelemetryConfig(config) {
   return {
     enabled: true,
     name: config?.name ?? "@auth0/auth0-server-js",
-    version: config?.version ?? "1.13.0"
+    version: config?.version ?? "1.15.0"
   };
 }
 
@@ -447,6 +448,47 @@ var ServerDatabaseClient = class {
   }
 };
 
+// src/enterprise-connect.ts
+import { EnterpriseConnectNotSupportedError } from "@auth0/auth0-auth-js";
+var EC_ALLOWED_METHODS = /* @__PURE__ */ new Set([
+  "startInteractiveLogin",
+  "startEnterpriseLogin",
+  "completeInteractiveLogin",
+  "logout",
+  "customTokenExchange",
+  "handleBackchannelLogout"
+]);
+var EC_ALLOWED_GETTERS = /* @__PURE__ */ new Set(["authClient"]);
+var NullStateStore = class {
+  async get() {
+    return void 0;
+  }
+  async set() {
+  }
+  async delete() {
+  }
+  async deleteByLogoutToken() {
+  }
+};
+function applyEnterpriseConnectRestrictions(instance) {
+  const proto = Object.getPrototypeOf(instance);
+  for (const [name, desc] of Object.entries(Object.getOwnPropertyDescriptors(proto))) {
+    if (name === "constructor") continue;
+    if (desc.get && !EC_ALLOWED_GETTERS.has(name)) {
+      Object.defineProperty(instance, name, {
+        get: () => {
+          throw new EnterpriseConnectNotSupportedError(name);
+        },
+        configurable: true
+      });
+    } else if (typeof desc.value === "function" && !EC_ALLOWED_METHODS.has(name)) {
+      instance[name] = () => {
+        throw new EnterpriseConnectNotSupportedError(name);
+      };
+    }
+  }
+}
+
 // src/server-client.ts
 var normalizeDomain = (value) => {
   const trimmed = value.trim();
@@ -485,6 +527,7 @@ var ServerClient = class {
   #transactionStoreIdentifier;
   #stateStore;
   #stateStoreIdentifier;
+  #enterpriseConnect;
   #authClientOptions;
   #staticDomain;
   #authClient;
@@ -555,16 +598,36 @@ var ServerClient = class {
   }
   constructor(options) {
     this.#options = options;
+    this.#enterpriseConnect = !!options.enterpriseConnect;
     this.#stateStoreIdentifier = this.#options.stateIdentifier || "__a0_session";
     this.#transactionStoreIdentifier = this.#options.transactionIdentifier || "__a0_tx";
     this.#transactionStore = options.transactionStore;
-    this.#stateStore = options.stateStore;
-    if (!this.#options.stateStore) {
+    if (!this.#enterpriseConnect && !this.#options.stateStore) {
       throw new MissingRequiredArgumentError("stateStore");
     }
+    this.#stateStore = this.#enterpriseConnect ? new NullStateStore() : this.#options.stateStore;
     if (!this.#options.transactionStore) {
       throw new MissingRequiredArgumentError("transactionStore");
     }
+    if (this.#enterpriseConnect) {
+      if (typeof this.#options.domain === "function") {
+        throw new InvalidConfigurationError(
+          "Enterprise Connect requires a static domain string. DomainResolver is not supported because isFederatedDomain needs a concrete domain."
+        );
+      }
+      const scope = this.#options.authorizationParams?.scope ?? "";
+      if (scope.includes("offline_access")) {
+        console.warn(
+          '[Auth0] Enterprise Connect: "offline_access" in scope has no effect. B2B Integration clients are not issued refresh tokens.'
+        );
+      }
+      if (this.#options.organization || this.#options.authorizationParams?.organization) {
+        console.warn(
+          '[Auth0] Enterprise Connect: static "organization" is set. The organization is resolved per login by HRD from the login_hint email domain. A static value routes all enterprise users to the same organization.'
+        );
+      }
+      applyEnterpriseConnectRestrictions(this);
+    }
     if (typeof this.#options.domain !== "string" && typeof this.#options.domain !== "function") {
       throw new InvalidConfigurationError("domain must be a string or resolver function");
     }
@@ -655,6 +718,33 @@ var ServerClient = class {
     const resolvedDomain = await this.#resolveDomain(storeOptions);
     return sessionDomain === resolvedDomain;
   }
+  /**
+   * Starts the Enterprise Connect login flow. Performs WebFinger domain discovery
+   * and, if the email domain is federated, initiates an interactive login with `login_hint`.
+   *
+   * @param options Options including the user's email and optional returnTo URL.
+   * @param storeOptions Optional options passed to the Transaction Store.
+   *
+   * @returns A URL to redirect to (federated domain) or null (not federated / invalid email).
+   */
+  async startEnterpriseLogin(options, storeOptions) {
+    const parts = options.email.split("@");
+    if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
+    const emailDomain = parts[1].toLowerCase();
+    const domain = await this.#resolveDomain(storeOptions);
+    const isFederated = await isFederatedDomain(domain, emailDomain, {
+      customFetch: this.#options.customFetch,
+      telemetry: getTelemetryConfig(this.#options.telemetry)
+    });
+    if (!isFederated) return null;
+    return this.startInteractiveLogin(
+      {
+        authorizationParams: { login_hint: options.email },
+        appState: options.returnTo ? { returnTo: options.returnTo } : void 0
+      },
+      storeOptions
+    );
+  }
   /**
    * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
    *
@@ -676,7 +766,8 @@ var ServerClient = class {
     if (!redirectUri) {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
-    const scope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
+    const rawScope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
+    const scope = this.#enterpriseConnect ? rawScope.split(" ").filter((s) => s !== "offline_access").join(" ") : rawScope;
     const perLoginAuthParamsOrganization = typeof options?.authorizationParams?.organization === "string" ? options.authorizationParams.organization : void 0;
     const clientAuthParamsOrganization = typeof this.#options.authorizationParams?.organization === "string" ? this.#options.authorizationParams.organization : void 0;
     const resolvedOrganization = options?.organization ?? perLoginAuthParamsOrganization ?? this.#options.organization ?? clientAuthParamsOrganization;
@@ -726,6 +817,7 @@ var ServerClient = class {
    * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
    *
    * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).
+   * In Enterprise Connect mode, also includes `idTokenClaims` and `user`.
    *
    * @remarks
    * This method does not support the `fullResponse` opt-in in v1. It accepts
@@ -747,6 +839,16 @@ var ServerClient = class {
       organization: transactionData.organization
     }, requestOptions);
     await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);
+    if (this.#enterpriseConnect) {
+      const claims = tokenEndpointResponse.claims;
+      const user = claims ? Object.fromEntries(Object.entries(claims).filter(([, v]) => v !== void 0)) : void 0;
+      return {
+        appState: transactionData.appState,
+        authorizationDetails: tokenEndpointResponse.authorizationDetails,
+        idTokenClaims: claims,
+        user
+      };
+    }
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
     const stateData = applySessionExpiryAtLogin(
       updateStateData(transactionData.audience ?? "default", existingStateData, tokenEndpointResponse, {
@@ -755,7 +857,10 @@ var ServerClient = class {
       tokenEndpointResponse.claims
     );
     await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);
-    return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails };
+    return {
+      appState: transactionData.appState,
+      authorizationDetails: tokenEndpointResponse.authorizationDetails
+    };
   }
   /**
    * Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
@@ -1428,6 +1533,14 @@ var ServerClient = class {
    * @returns {URL}
    */
   async logout(options, storeOptions, requestOptions) {
+    if (this.#enterpriseConnect) {
+      if (options.federated === false) {
+        console.warn(
+          "[Auth0] Enterprise Connect: logout() called with federated=false. The enterprise IdP session will remain active; the user may silently re-authenticate on the next login."
+        );
+      }
+      return this.authClient.buildLogoutUrl({ returnTo: options.returnTo, federated: options.federated ?? true });
+    }
     if (!this.#isResolverMode()) {
       try {
         await this.revokeRefreshToken({}, storeOptions, requestOptions);
@@ -1856,7 +1969,9 @@ import {
   OrganizationValidationError as OrganizationValidationError3,
   PasswordlessStartError as PasswordlessStartError2,
   PasswordlessVerifyError as PasswordlessVerifyError2,
+  EnterpriseConnectNotSupportedError as EnterpriseConnectNotSupportedError2,
   isMfaRequiredError as isMfaRequiredError2,
+  isFederatedDomain as isFederatedDomain2,
   UserInfoError
 } from "@auth0/auth0-auth-js";
 
@@ -2079,6 +2194,7 @@ export {
   BackchannelLogoutError,
   ChangePasswordError,
   CookieTransactionStore,
+  EnterpriseConnectNotSupportedError2 as EnterpriseConnectNotSupportedError,
   InvalidConfigurationError,
   IssuerValidationError,
   MfaChallengeError,
@@ -2108,6 +2224,7 @@ export {
   TokenExchangeErrorCode,
   TokenRevocationError,
   UserInfoError,
+  isFederatedDomain2 as isFederatedDomain,
   isMfaRequiredError2 as isMfaRequiredError
 };
 //# sourceMappingURL=index.js.map