@meistrari/auth-core 1.42.0 → 1.43.0

package/dist/index.d.mts

@@ -520,6 +520,56 @@ declare class SessionAssuranceService {
     completeOAuthStepUp(stepUpToken: string): Promise<OAuthCompleteStepUpResponse>;
 }
 
+/**
+ * Options for signing in with a social provider (Google or Microsoft).
+ */
+type SocialSignInOptions = {
+    /** The social identity provider to authenticate with. */
+    provider: 'google' | 'microsoft';
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
+    errorCallbackURL?: string;
+    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
+    loginHint?: string;
+};
+/**
+ * Options for signing in via SAML Single Sign-On.
+ */
+type SignInWithSamlOptions = {
+    /** The user's email address, used to resolve the correct SAML identity provider. */
+    email: string;
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
+    errorCallbackURL?: string;
+};
+/**
+ * Options for signing in with email and password credentials.
+ */
+type SignInWithEmailAndPasswordOptions = {
+    /** The user's email address. */
+    email: string;
+    /** The user's password. */
+    password: string;
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+};
+/**
+ * Interactive login methods an environment can enable (`AUTH_LOGIN_METHODS`).
+ * Session-carrying mechanisms (JWT, API keys, application tokens) are not
+ * login methods.
+ */
+declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "saml", "otp"];
+type LoginMethod = typeof LOGIN_METHODS[number];
+/**
+ * Response of the public `GET /login-methods` endpoint.
+ */
+type LoginMethodsResponse = {
+    /** Login methods enabled in the environment, regardless of application. */
+    loginMethods: LoginMethod[];
+};
+
 declare const DEFAULT_SESSION_ASSURANCE_CONFIG: ApplicationSessionAssuranceConfig;
 declare const DEFAULT_APPLICATION_CONFIG: {
     version: 1;
@@ -565,6 +615,11 @@ type ListCandidateOrganizationsResponse = FullOrganization[];
 type ApplicationAuthContextResponse = {
     /** Minimal application identity shown in the hosted auth flow. */
     application: Pick<Application, 'id' | 'name' | 'config'>;
+    /**
+     * Login methods usable for this application: the environment allowlist
+     * intersected with the application's accepted AMRs.
+     */
+    loginMethods: LoginMethod[];
 };
 /**
  * Response returned when starting an authorization flow.
@@ -3552,6 +3607,23 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                 }>;
             };
         };
+    } | {
+        id: "login-methods";
+        getActions: ($fetch: better_auth_client.BetterFetch) => {
+            loginMethods: {
+                get: () => Promise<{
+                    data: null;
+                    error: {
+                        message?: string | undefined;
+                        status: number;
+                        statusText: string;
+                    };
+                } | {
+                    data: LoginMethodsResponse;
+                    error: null;
+                }>;
+            };
+        };
     } | {
         id: "email-otp";
         version: string;
@@ -5765,42 +5837,6 @@ declare class OrganizationService {
     removeTeamMember(teamId: string, userId: string): Promise<void>;
 }
 
-/**
- * Options for signing in with a social provider (Google or Microsoft).
- */
-type SocialSignInOptions = {
-    /** The social identity provider to authenticate with. */
-    provider: 'google' | 'microsoft';
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
-    errorCallbackURL?: string;
-    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
-    loginHint?: string;
-};
-/**
- * Options for signing in via SAML Single Sign-On.
- */
-type SignInWithSamlOptions = {
-    /** The user's email address, used to resolve the correct SAML identity provider. */
-    email: string;
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
-    errorCallbackURL?: string;
-};
-/**
- * Options for signing in with email and password credentials.
- */
-type SignInWithEmailAndPasswordOptions = {
-    /** The user's email address. */
-    email: string;
-    /** The user's password. */
-    password: string;
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-};
-
 /**
  * Service for managing user authentication sessions.
  *
@@ -5871,6 +5907,13 @@ declare class SessionService {
     getToken(): Promise<{
         token: string;
     }>;
+    /**
+     * Lists the login methods enabled in the environment. Public; safe to call
+     * before authentication to decide which sign-in options to render.
+     *
+     * @returns The enabled login methods
+     */
+    getLoginMethods(): Promise<("google" | "microsoft" | "password" | "saml" | "otp")[]>;
     /**
      * Initiates social authentication flow with Google or Microsoft.
      *
@@ -6381,5 +6424,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -520,6 +520,56 @@ declare class SessionAssuranceService {
     completeOAuthStepUp(stepUpToken: string): Promise<OAuthCompleteStepUpResponse>;
 }
 
+/**
+ * Options for signing in with a social provider (Google or Microsoft).
+ */
+type SocialSignInOptions = {
+    /** The social identity provider to authenticate with. */
+    provider: 'google' | 'microsoft';
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
+    errorCallbackURL?: string;
+    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
+    loginHint?: string;
+};
+/**
+ * Options for signing in via SAML Single Sign-On.
+ */
+type SignInWithSamlOptions = {
+    /** The user's email address, used to resolve the correct SAML identity provider. */
+    email: string;
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
+    errorCallbackURL?: string;
+};
+/**
+ * Options for signing in with email and password credentials.
+ */
+type SignInWithEmailAndPasswordOptions = {
+    /** The user's email address. */
+    email: string;
+    /** The user's password. */
+    password: string;
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+};
+/**
+ * Interactive login methods an environment can enable (`AUTH_LOGIN_METHODS`).
+ * Session-carrying mechanisms (JWT, API keys, application tokens) are not
+ * login methods.
+ */
+declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "saml", "otp"];
+type LoginMethod = typeof LOGIN_METHODS[number];
+/**
+ * Response of the public `GET /login-methods` endpoint.
+ */
+type LoginMethodsResponse = {
+    /** Login methods enabled in the environment, regardless of application. */
+    loginMethods: LoginMethod[];
+};
+
 declare const DEFAULT_SESSION_ASSURANCE_CONFIG: ApplicationSessionAssuranceConfig;
 declare const DEFAULT_APPLICATION_CONFIG: {
     version: 1;
@@ -565,6 +615,11 @@ type ListCandidateOrganizationsResponse = FullOrganization[];
 type ApplicationAuthContextResponse = {
     /** Minimal application identity shown in the hosted auth flow. */
     application: Pick<Application, 'id' | 'name' | 'config'>;
+    /**
+     * Login methods usable for this application: the environment allowlist
+     * intersected with the application's accepted AMRs.
+     */
+    loginMethods: LoginMethod[];
 };
 /**
  * Response returned when starting an authorization flow.
@@ -3552,6 +3607,23 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                 }>;
             };
         };
+    } | {
+        id: "login-methods";
+        getActions: ($fetch: better_auth_client.BetterFetch) => {
+            loginMethods: {
+                get: () => Promise<{
+                    data: null;
+                    error: {
+                        message?: string | undefined;
+                        status: number;
+                        statusText: string;
+                    };
+                } | {
+                    data: LoginMethodsResponse;
+                    error: null;
+                }>;
+            };
+        };
     } | {
         id: "email-otp";
         version: string;
@@ -5765,42 +5837,6 @@ declare class OrganizationService {
     removeTeamMember(teamId: string, userId: string): Promise<void>;
 }
 
-/**
- * Options for signing in with a social provider (Google or Microsoft).
- */
-type SocialSignInOptions = {
-    /** The social identity provider to authenticate with. */
-    provider: 'google' | 'microsoft';
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
-    errorCallbackURL?: string;
-    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
-    loginHint?: string;
-};
-/**
- * Options for signing in via SAML Single Sign-On.
- */
-type SignInWithSamlOptions = {
-    /** The user's email address, used to resolve the correct SAML identity provider. */
-    email: string;
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
-    errorCallbackURL?: string;
-};
-/**
- * Options for signing in with email and password credentials.
- */
-type SignInWithEmailAndPasswordOptions = {
-    /** The user's email address. */
-    email: string;
-    /** The user's password. */
-    password: string;
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-};
-
 /**
  * Service for managing user authentication sessions.
  *
@@ -5871,6 +5907,13 @@ declare class SessionService {
     getToken(): Promise<{
         token: string;
     }>;
+    /**
+     * Lists the login methods enabled in the environment. Public; safe to call
+     * before authentication to decide which sign-in options to render.
+     *
+     * @returns The enabled login methods
+     */
+    getLoginMethods(): Promise<("google" | "microsoft" | "password" | "saml" | "otp")[]>;
     /**
      * Initiates social authentication flow with Google or Microsoft.
      *
@@ -6381,5 +6424,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "1.42.0";
+const version = "1.43.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -438,6 +438,21 @@ function sessionAssurancePluginClient() {
   };
 }
 
+function loginMethodsPluginClient() {
+  return {
+    id: "login-methods",
+    getActions: ($fetch) => {
+      return {
+        loginMethods: {
+          get: async () => {
+            return await $fetch("/login-methods", { method: "GET" });
+          }
+        }
+      };
+    }
+  };
+}
+
 function createAPIClient(apiUrl, fetchOptions = {}) {
   const serviceName = typeof process !== "undefined" ? process.env.SERVICE_NAME : "";
   const userAgent = `auth-sdk:core:${version}${serviceName ? `@${serviceName}` : ""}`;
@@ -465,6 +480,7 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
       }),
       applicationsPluginClient(),
       sessionAssurancePluginClient(),
+      loginMethodsPluginClient(),
       emailOTPClient()
     ],
     fetchOptions: {
@@ -1952,6 +1968,19 @@ class SessionService {
   async getToken() {
     return await this.client.token();
   }
+  /**
+   * Lists the login methods enabled in the environment. Public; safe to call
+   * before authentication to decide which sign-in options to render.
+   *
+   * @returns The enabled login methods
+   */
+  async getLoginMethods() {
+    const response = await this.client.loginMethods.get();
+    if (!response.data) {
+      throw new Error("No data returned from the API", { cause: response.error });
+    }
+    return response.data.loginMethods;
+  }
   /**
    * Initiates social authentication flow with Google or Microsoft.
    *
@@ -2323,6 +2352,8 @@ const ApiKeyMetadata = z.object({
   }).optional().nullable()
 });
 
+const LOGIN_METHODS = ["password", "google", "microsoft", "saml", "otp"];
+
 class AuthClient {
   /**
    * Configured Better Auth client used by the public service wrappers.
@@ -2524,4 +2555,4 @@ function extractTokenPayload(token) {
   return payload;
 }
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "1.42.0",
+    "version": "1.43.0",
     "type": "module",
     "exports": {
         ".": {