@meistrari/auth-core 1.41.2 → 1.43.0

package/dist/index.d.mts

@@ -520,6 +520,56 @@ declare class SessionAssuranceService {
     completeOAuthStepUp(stepUpToken: string): Promise<OAuthCompleteStepUpResponse>;
 }
 
+/**
+ * Options for signing in with a social provider (Google or Microsoft).
+ */
+type SocialSignInOptions = {
+    /** The social identity provider to authenticate with. */
+    provider: 'google' | 'microsoft';
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
+    errorCallbackURL?: string;
+    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
+    loginHint?: string;
+};
+/**
+ * Options for signing in via SAML Single Sign-On.
+ */
+type SignInWithSamlOptions = {
+    /** The user's email address, used to resolve the correct SAML identity provider. */
+    email: string;
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
+    errorCallbackURL?: string;
+};
+/**
+ * Options for signing in with email and password credentials.
+ */
+type SignInWithEmailAndPasswordOptions = {
+    /** The user's email address. */
+    email: string;
+    /** The user's password. */
+    password: string;
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+};
+/**
+ * Interactive login methods an environment can enable (`AUTH_LOGIN_METHODS`).
+ * Session-carrying mechanisms (JWT, API keys, application tokens) are not
+ * login methods.
+ */
+declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "saml", "otp"];
+type LoginMethod = typeof LOGIN_METHODS[number];
+/**
+ * Response of the public `GET /login-methods` endpoint.
+ */
+type LoginMethodsResponse = {
+    /** Login methods enabled in the environment, regardless of application. */
+    loginMethods: LoginMethod[];
+};
+
 declare const DEFAULT_SESSION_ASSURANCE_CONFIG: ApplicationSessionAssuranceConfig;
 declare const DEFAULT_APPLICATION_CONFIG: {
     version: 1;
@@ -565,6 +615,11 @@ type ListCandidateOrganizationsResponse = FullOrganization[];
 type ApplicationAuthContextResponse = {
     /** Minimal application identity shown in the hosted auth flow. */
     application: Pick<Application, 'id' | 'name' | 'config'>;
+    /**
+     * Login methods usable for this application: the environment allowlist
+     * intersected with the application's accepted AMRs.
+     */
+    loginMethods: LoginMethod[];
 };
 /**
  * Response returned when starting an authorization flow.
@@ -3552,6 +3607,23 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                 }>;
             };
         };
+    } | {
+        id: "login-methods";
+        getActions: ($fetch: better_auth_client.BetterFetch) => {
+            loginMethods: {
+                get: () => Promise<{
+                    data: null;
+                    error: {
+                        message?: string | undefined;
+                        status: number;
+                        statusText: string;
+                    };
+                } | {
+                    data: LoginMethodsResponse;
+                    error: null;
+                }>;
+            };
+        };
     } | {
         id: "email-otp";
         version: string;
@@ -4940,6 +5012,12 @@ type InviteAdminOrganizationUsersOptions = {
      * Defaults to true (send an invitation email).
      */
     sendInvite?: boolean;
+    /**
+     * Initial password for accounts created by a force add (`sendInvite:
+     * false`); rejected otherwise. 8–128 characters. Only applied to users
+     * without a password yet — an existing credential is never overwritten.
+     */
+    password?: string;
 };
 /**
  * Per-email outcome of a batch organization invite.
@@ -5759,42 +5837,6 @@ declare class OrganizationService {
     removeTeamMember(teamId: string, userId: string): Promise<void>;
 }
 
-/**
- * Options for signing in with a social provider (Google or Microsoft).
- */
-type SocialSignInOptions = {
-    /** The social identity provider to authenticate with. */
-    provider: 'google' | 'microsoft';
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
-    errorCallbackURL?: string;
-    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
-    loginHint?: string;
-};
-/**
- * Options for signing in via SAML Single Sign-On.
- */
-type SignInWithSamlOptions = {
-    /** The user's email address, used to resolve the correct SAML identity provider. */
-    email: string;
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
-    errorCallbackURL?: string;
-};
-/**
- * Options for signing in with email and password credentials.
- */
-type SignInWithEmailAndPasswordOptions = {
-    /** The user's email address. */
-    email: string;
-    /** The user's password. */
-    password: string;
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-};
-
 /**
  * Service for managing user authentication sessions.
  *
@@ -5865,6 +5907,13 @@ declare class SessionService {
     getToken(): Promise<{
         token: string;
     }>;
+    /**
+     * Lists the login methods enabled in the environment. Public; safe to call
+     * before authentication to decide which sign-in options to render.
+     *
+     * @returns The enabled login methods
+     */
+    getLoginMethods(): Promise<("google" | "microsoft" | "password" | "saml" | "otp")[]>;
     /**
      * Initiates social authentication flow with Google or Microsoft.
      *
@@ -6375,5 +6424,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -520,6 +520,56 @@ declare class SessionAssuranceService {
     completeOAuthStepUp(stepUpToken: string): Promise<OAuthCompleteStepUpResponse>;
 }
 
+/**
+ * Options for signing in with a social provider (Google or Microsoft).
+ */
+type SocialSignInOptions = {
+    /** The social identity provider to authenticate with. */
+    provider: 'google' | 'microsoft';
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
+    errorCallbackURL?: string;
+    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
+    loginHint?: string;
+};
+/**
+ * Options for signing in via SAML Single Sign-On.
+ */
+type SignInWithSamlOptions = {
+    /** The user's email address, used to resolve the correct SAML identity provider. */
+    email: string;
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
+    errorCallbackURL?: string;
+};
+/**
+ * Options for signing in with email and password credentials.
+ */
+type SignInWithEmailAndPasswordOptions = {
+    /** The user's email address. */
+    email: string;
+    /** The user's password. */
+    password: string;
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+};
+/**
+ * Interactive login methods an environment can enable (`AUTH_LOGIN_METHODS`).
+ * Session-carrying mechanisms (JWT, API keys, application tokens) are not
+ * login methods.
+ */
+declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "saml", "otp"];
+type LoginMethod = typeof LOGIN_METHODS[number];
+/**
+ * Response of the public `GET /login-methods` endpoint.
+ */
+type LoginMethodsResponse = {
+    /** Login methods enabled in the environment, regardless of application. */
+    loginMethods: LoginMethod[];
+};
+
 declare const DEFAULT_SESSION_ASSURANCE_CONFIG: ApplicationSessionAssuranceConfig;
 declare const DEFAULT_APPLICATION_CONFIG: {
     version: 1;
@@ -565,6 +615,11 @@ type ListCandidateOrganizationsResponse = FullOrganization[];
 type ApplicationAuthContextResponse = {
     /** Minimal application identity shown in the hosted auth flow. */
     application: Pick<Application, 'id' | 'name' | 'config'>;
+    /**
+     * Login methods usable for this application: the environment allowlist
+     * intersected with the application's accepted AMRs.
+     */
+    loginMethods: LoginMethod[];
 };
 /**
  * Response returned when starting an authorization flow.
@@ -3552,6 +3607,23 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                 }>;
             };
         };
+    } | {
+        id: "login-methods";
+        getActions: ($fetch: better_auth_client.BetterFetch) => {
+            loginMethods: {
+                get: () => Promise<{
+                    data: null;
+                    error: {
+                        message?: string | undefined;
+                        status: number;
+                        statusText: string;
+                    };
+                } | {
+                    data: LoginMethodsResponse;
+                    error: null;
+                }>;
+            };
+        };
     } | {
         id: "email-otp";
         version: string;
@@ -4940,6 +5012,12 @@ type InviteAdminOrganizationUsersOptions = {
      * Defaults to true (send an invitation email).
      */
     sendInvite?: boolean;
+    /**
+     * Initial password for accounts created by a force add (`sendInvite:
+     * false`); rejected otherwise. 8–128 characters. Only applied to users
+     * without a password yet — an existing credential is never overwritten.
+     */
+    password?: string;
 };
 /**
  * Per-email outcome of a batch organization invite.
@@ -5759,42 +5837,6 @@ declare class OrganizationService {
     removeTeamMember(teamId: string, userId: string): Promise<void>;
 }
 
-/**
- * Options for signing in with a social provider (Google or Microsoft).
- */
-type SocialSignInOptions = {
-    /** The social identity provider to authenticate with. */
-    provider: 'google' | 'microsoft';
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
-    errorCallbackURL?: string;
-    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
-    loginHint?: string;
-};
-/**
- * Options for signing in via SAML Single Sign-On.
- */
-type SignInWithSamlOptions = {
-    /** The user's email address, used to resolve the correct SAML identity provider. */
-    email: string;
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
-    errorCallbackURL?: string;
-};
-/**
- * Options for signing in with email and password credentials.
- */
-type SignInWithEmailAndPasswordOptions = {
-    /** The user's email address. */
-    email: string;
-    /** The user's password. */
-    password: string;
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-};
-
 /**
  * Service for managing user authentication sessions.
  *
@@ -5865,6 +5907,13 @@ declare class SessionService {
     getToken(): Promise<{
         token: string;
     }>;
+    /**
+     * Lists the login methods enabled in the environment. Public; safe to call
+     * before authentication to decide which sign-in options to render.
+     *
+     * @returns The enabled login methods
+     */
+    getLoginMethods(): Promise<("google" | "microsoft" | "password" | "saml" | "otp")[]>;
     /**
      * Initiates social authentication flow with Google or Microsoft.
      *
@@ -6375,5 +6424,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "1.41.2";
+const version = "1.43.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -32,10 +32,10 @@ function parsedEnumValues(schema) {
   );
 }
 
-const AMRBrand = Symbol("amr");
-const AALBrand = Symbol("aal");
-const ACRBrand = Symbol("acr");
-const AuthMethodBrand = Symbol("authMethod");
+const AMRBrand = /* @__PURE__ */ Symbol("amr");
+const AALBrand = /* @__PURE__ */ Symbol("aal");
+const ACRBrand = /* @__PURE__ */ Symbol("acr");
+const AuthMethodBrand = /* @__PURE__ */ Symbol("authMethod");
 const AMR = z.enum({
   Pwd: "pwd",
   Otp: "otp",
@@ -438,6 +438,21 @@ function sessionAssurancePluginClient() {
   };
 }
 
+function loginMethodsPluginClient() {
+  return {
+    id: "login-methods",
+    getActions: ($fetch) => {
+      return {
+        loginMethods: {
+          get: async () => {
+            return await $fetch("/login-methods", { method: "GET" });
+          }
+        }
+      };
+    }
+  };
+}
+
 function createAPIClient(apiUrl, fetchOptions = {}) {
   const serviceName = typeof process !== "undefined" ? process.env.SERVICE_NAME : "";
   const userAgent = `auth-sdk:core:${version}${serviceName ? `@${serviceName}` : ""}`;
@@ -465,6 +480,7 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
       }),
       applicationsPluginClient(),
       sessionAssurancePluginClient(),
+      loginMethodsPluginClient(),
       emailOTPClient()
     ],
     fetchOptions: {
@@ -510,6 +526,8 @@ class AdminService {
     this.client = client;
     this.apiUrl = apiUrl;
   }
+  client;
+  apiUrl;
   /**
    * Requests an application management route.
    *
@@ -1380,6 +1398,7 @@ class ApplicationService {
   constructor(client) {
     this.client = client;
   }
+  client;
   /**
    * Gets public display context for an application auth redirect.
    *
@@ -1643,6 +1662,7 @@ class OrganizationService {
   constructor(client) {
     this.client = client;
   }
+  client;
   /**
    * Retrieves a single organization by ID with optional related data.
    *
@@ -1922,6 +1942,8 @@ class SessionService {
     this.client = client;
     this.apiUrl = apiUrl;
   }
+  client;
+  apiUrl;
   /**
    * Retrieves the current user session.
    *
@@ -1946,6 +1968,19 @@ class SessionService {
   async getToken() {
     return await this.client.token();
   }
+  /**
+   * Lists the login methods enabled in the environment. Public; safe to call
+   * before authentication to decide which sign-in options to render.
+   *
+   * @returns The enabled login methods
+   */
+  async getLoginMethods() {
+    const response = await this.client.loginMethods.get();
+    if (!response.data) {
+      throw new Error("No data returned from the API", { cause: response.error });
+    }
+    return response.data.loginMethods;
+  }
   /**
    * Initiates social authentication flow with Google or Microsoft.
    *
@@ -2089,6 +2124,7 @@ class ApiKeyService {
   constructor(client) {
     this.client = client;
   }
+  client;
   /**
    * Creates a new API key.
    *
@@ -2174,6 +2210,7 @@ class EmailOTPService {
   constructor(client) {
     this.client = client;
   }
+  client;
   /**
    * Sends a sign-in verification OTP to an email address.
    *
@@ -2235,6 +2272,7 @@ class SessionAssuranceService {
   constructor(client) {
     this.client = client;
   }
+  client;
   async get() {
     return parseResponse(SessionAssuranceResponse, await this.client.sessionAssurance.getSessionAssurance());
   }
@@ -2259,6 +2297,7 @@ class UserService {
   constructor(client) {
     this.client = client;
   }
+  client;
   async changePassword(currentPassword, newPassword) {
     return await this.client.changePassword({ currentPassword, newPassword, revokeOtherSessions: true });
   }
@@ -2313,6 +2352,8 @@ const ApiKeyMetadata = z.object({
   }).optional().nullable()
 });
 
+const LOGIN_METHODS = ["password", "google", "microsoft", "saml", "otp"];
+
 class AuthClient {
   /**
    * Configured Better Auth client used by the public service wrappers.
@@ -2514,4 +2555,4 @@ function extractTokenPayload(token) {
   return payload;
 }
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };

package/package.json

@@ -1,34 +1,34 @@
 {
-  "name": "@meistrari/auth-core",
-  "version": "1.41.2",
-  "type": "module",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.mjs"
+    "name": "@meistrari/auth-core",
+    "version": "1.43.0",
+    "type": "module",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.mjs"
+        }
+    },
+    "main": "./dist/index.mjs",
+    "types": "./dist/index.d.ts",
+    "files": [
+        "dist"
+    ],
+    "scripts": {
+        "build": "unbuild",
+        "docs": "typedoc"
+    },
+    "dependencies": {
+        "@better-auth/api-key": "1.6.26",
+        "@better-auth/sso": "1.6.26",
+        "better-auth": "1.6.26",
+        "jose": "6.1.3",
+        "zod": "4.3.6"
+    },
+    "devDependencies": {
+        "@types/node": "latest",
+        "typedoc": "0.28.18",
+        "typedoc-plugin-markdown": "4.11.0",
+        "typescript": "5.9.2",
+        "unbuild": "3.6.1"
     }
-  },
-  "main": "./dist/index.mjs",
-  "types": "./dist/index.d.ts",
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "unbuild",
-    "docs": "typedoc"
-  },
-  "dependencies": {
-    "@better-auth/api-key": "1.6.26",
-    "@better-auth/sso": "1.6.26",
-    "better-auth": "1.6.26",
-    "jose": "6.1.3",
-    "zod": "4.3.6"
-  },
-  "devDependencies": {
-    "@types/node": "latest",
-    "typedoc": "0.28.18",
-    "typedoc-plugin-markdown": "4.11.0",
-    "typescript": "5.9.2",
-    "unbuild": "3.6.1"
-  }
 }