@meistrari/auth-core 1.42.0 → 2.0.0

package/dist/index.d.mts

@@ -32,17 +32,28 @@ declare const ACRs: {
     readonly Unspecified: "urn:tela:auth:unspecified" & zod__default.core.$brand<typeof ACRBrand>;
 };
 declare const AuthMethods: {
-    readonly Password: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly EmailOTP: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly OAuth: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly SAML: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly Unknown: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly Password: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly EmailOTP: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly OAuth: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly SSO: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly SAML: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly Unknown: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
 };
+/**
+ * Reads the legacy `saml` AMR as `sso`, so sessions and application policies
+ * created before SAML and OIDC were unified keep matching each other.
+ */
+declare function normalizeAmr(amr: AMR): AMR;
 declare const AMR: zod__default.core.$ZodBranded<zod__default.ZodEnum<{
     readonly Pwd: "pwd";
     readonly Otp: "otp";
     readonly Oauth: "oauth";
     readonly Sso: "sso";
+    /**
+     * @deprecated Issued to SSO sessions before SAML and OIDC were unified
+     * under `sso`. Still parsed so existing sessions and application policies
+     * remain valid, and read as `sso` (see `normalizeAmr`). Never issued.
+     */
     readonly Saml: "saml";
 }>, typeof AMRBrand, "out">;
 type AMR = zod__default.infer<typeof AMR>;
@@ -60,6 +71,11 @@ declare const AuthMethod: zod__default.core.$ZodBranded<zod__default.ZodEnum<{
     readonly Password: "password";
     readonly EmailOTP: "email_otp";
     readonly OAuth: "oauth";
+    readonly SSO: "sso";
+    /**
+     * @deprecated Recorded on SSO sessions before SAML and OIDC were unified
+     * under `sso`. Kept so existing sessions still parse; never recorded.
+     */
     readonly SAML: "saml";
     readonly Unknown: "unknown";
 }>, typeof AuthMethodBrand, "out">;
@@ -520,6 +536,56 @@ declare class SessionAssuranceService {
     completeOAuthStepUp(stepUpToken: string): Promise<OAuthCompleteStepUpResponse>;
 }
 
+/**
+ * Options for signing in with a social provider (Google or Microsoft).
+ */
+type SocialSignInOptions = {
+    /** The social identity provider to authenticate with. */
+    provider: 'google' | 'microsoft';
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
+    errorCallbackURL?: string;
+    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
+    loginHint?: string;
+};
+/**
+ * Options for signing in via Single Sign-On (SAML or OIDC).
+ */
+type SignInWithSsoOptions = {
+    /** The user's email address, used to resolve the correct SSO identity provider. */
+    email: string;
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
+    errorCallbackURL?: string;
+};
+/**
+ * Options for signing in with email and password credentials.
+ */
+type SignInWithEmailAndPasswordOptions = {
+    /** The user's email address. */
+    email: string;
+    /** The user's password. */
+    password: string;
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+};
+/**
+ * Interactive login methods an environment can enable (`AUTH_LOGIN_METHODS`).
+ * Session-carrying mechanisms (JWT, API keys, application tokens) are not
+ * login methods.
+ */
+declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "sso", "otp"];
+type LoginMethod = typeof LOGIN_METHODS[number];
+/**
+ * Response of the public `GET /login-methods` endpoint.
+ */
+type LoginMethodsResponse = {
+    /** Login methods enabled in the environment, regardless of application. */
+    loginMethods: LoginMethod[];
+};
+
 declare const DEFAULT_SESSION_ASSURANCE_CONFIG: ApplicationSessionAssuranceConfig;
 declare const DEFAULT_APPLICATION_CONFIG: {
     version: 1;
@@ -565,6 +631,11 @@ type ListCandidateOrganizationsResponse = FullOrganization[];
 type ApplicationAuthContextResponse = {
     /** Minimal application identity shown in the hosted auth flow. */
     application: Pick<Application, 'id' | 'name' | 'config'>;
+    /**
+     * Login methods usable for this application: the environment allowlist
+     * intersected with the application's accepted AMRs.
+     */
+    loginMethods: LoginMethod[];
 };
 /**
  * Response returned when starting an authorization flow.
@@ -3552,6 +3623,23 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                 }>;
             };
         };
+    } | {
+        id: "login-methods";
+        getActions: ($fetch: better_auth_client.BetterFetch) => {
+            loginMethods: {
+                get: () => Promise<{
+                    data: null;
+                    error: {
+                        message?: string | undefined;
+                        status: number;
+                        statusText: string;
+                    };
+                } | {
+                    data: LoginMethodsResponse;
+                    error: null;
+                }>;
+            };
+        };
     } | {
         id: "email-otp";
         version: string;
@@ -5765,46 +5853,10 @@ declare class OrganizationService {
     removeTeamMember(teamId: string, userId: string): Promise<void>;
 }
 
-/**
- * Options for signing in with a social provider (Google or Microsoft).
- */
-type SocialSignInOptions = {
-    /** The social identity provider to authenticate with. */
-    provider: 'google' | 'microsoft';
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
-    errorCallbackURL?: string;
-    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
-    loginHint?: string;
-};
-/**
- * Options for signing in via SAML Single Sign-On.
- */
-type SignInWithSamlOptions = {
-    /** The user's email address, used to resolve the correct SAML identity provider. */
-    email: string;
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
-    errorCallbackURL?: string;
-};
-/**
- * Options for signing in with email and password credentials.
- */
-type SignInWithEmailAndPasswordOptions = {
-    /** The user's email address. */
-    email: string;
-    /** The user's password. */
-    password: string;
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-};
-
 /**
  * Service for managing user authentication sessions.
  *
- * Provides methods for signing in with various providers (social, SAML, email/password),
+ * Provides methods for signing in with various providers (social, SSO, email/password),
  * signing out, and password reset functionality.
  */
 declare class SessionService {
@@ -5871,6 +5923,13 @@ declare class SessionService {
     getToken(): Promise<{
         token: string;
     }>;
+    /**
+     * Lists the login methods enabled in the environment. Public; safe to call
+     * before authentication to decide which sign-in options to render.
+     *
+     * @returns The enabled login methods
+     */
+    getLoginMethods(): Promise<("sso" | "google" | "microsoft" | "password" | "otp")[]>;
     /**
      * Initiates social authentication flow with Google or Microsoft.
      *
@@ -5885,17 +5944,18 @@ declare class SessionService {
      */
     signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, loginHint, }: SocialSignInOptions): Promise<void>;
     /**
-     * Initiates SAML-based Single Sign-On authentication flow.
+     * Initiates the Single Sign-On authentication flow. The provider resolved
+     * from the email's domain determines whether SAML or OIDC is used.
      *
-     * @param options - SAML sign-in configuration
-     * @param options.email - User's email to determine the SAML provider
+     * @param options - SSO sign-in configuration
+     * @param options.email - User's email to determine the SSO provider
      * @param options.callbackURL - URL to redirect to after successful authentication
      * @param options.errorCallbackURL - URL to redirect to on error
      *
      * @throws {EmailRequired} When email is not provided
      * @throws {InvalidCallbackURL} When callback URLs are malformed
      */
-    signInWithSaml({ email, callbackURL, errorCallbackURL, }: SignInWithSamlOptions): Promise<void>;
+    signInWithSso({ email, callbackURL, errorCallbackURL, }: SignInWithSsoOptions): Promise<void>;
     /**
      * Authenticates a user with email and password credentials.
      *
@@ -6381,5 +6441,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -32,17 +32,28 @@ declare const ACRs: {
     readonly Unspecified: "urn:tela:auth:unspecified" & zod__default.core.$brand<typeof ACRBrand>;
 };
 declare const AuthMethods: {
-    readonly Password: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly EmailOTP: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly OAuth: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly SAML: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly Unknown: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly Password: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly EmailOTP: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly OAuth: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly SSO: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly SAML: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly Unknown: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
 };
+/**
+ * Reads the legacy `saml` AMR as `sso`, so sessions and application policies
+ * created before SAML and OIDC were unified keep matching each other.
+ */
+declare function normalizeAmr(amr: AMR): AMR;
 declare const AMR: zod__default.core.$ZodBranded<zod__default.ZodEnum<{
     readonly Pwd: "pwd";
     readonly Otp: "otp";
     readonly Oauth: "oauth";
     readonly Sso: "sso";
+    /**
+     * @deprecated Issued to SSO sessions before SAML and OIDC were unified
+     * under `sso`. Still parsed so existing sessions and application policies
+     * remain valid, and read as `sso` (see `normalizeAmr`). Never issued.
+     */
     readonly Saml: "saml";
 }>, typeof AMRBrand, "out">;
 type AMR = zod__default.infer<typeof AMR>;
@@ -60,6 +71,11 @@ declare const AuthMethod: zod__default.core.$ZodBranded<zod__default.ZodEnum<{
     readonly Password: "password";
     readonly EmailOTP: "email_otp";
     readonly OAuth: "oauth";
+    readonly SSO: "sso";
+    /**
+     * @deprecated Recorded on SSO sessions before SAML and OIDC were unified
+     * under `sso`. Kept so existing sessions still parse; never recorded.
+     */
     readonly SAML: "saml";
     readonly Unknown: "unknown";
 }>, typeof AuthMethodBrand, "out">;
@@ -520,6 +536,56 @@ declare class SessionAssuranceService {
     completeOAuthStepUp(stepUpToken: string): Promise<OAuthCompleteStepUpResponse>;
 }
 
+/**
+ * Options for signing in with a social provider (Google or Microsoft).
+ */
+type SocialSignInOptions = {
+    /** The social identity provider to authenticate with. */
+    provider: 'google' | 'microsoft';
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
+    errorCallbackURL?: string;
+    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
+    loginHint?: string;
+};
+/**
+ * Options for signing in via Single Sign-On (SAML or OIDC).
+ */
+type SignInWithSsoOptions = {
+    /** The user's email address, used to resolve the correct SSO identity provider. */
+    email: string;
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
+    errorCallbackURL?: string;
+};
+/**
+ * Options for signing in with email and password credentials.
+ */
+type SignInWithEmailAndPasswordOptions = {
+    /** The user's email address. */
+    email: string;
+    /** The user's password. */
+    password: string;
+    /** URL to redirect to after successful authentication. */
+    callbackURL: string;
+};
+/**
+ * Interactive login methods an environment can enable (`AUTH_LOGIN_METHODS`).
+ * Session-carrying mechanisms (JWT, API keys, application tokens) are not
+ * login methods.
+ */
+declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "sso", "otp"];
+type LoginMethod = typeof LOGIN_METHODS[number];
+/**
+ * Response of the public `GET /login-methods` endpoint.
+ */
+type LoginMethodsResponse = {
+    /** Login methods enabled in the environment, regardless of application. */
+    loginMethods: LoginMethod[];
+};
+
 declare const DEFAULT_SESSION_ASSURANCE_CONFIG: ApplicationSessionAssuranceConfig;
 declare const DEFAULT_APPLICATION_CONFIG: {
     version: 1;
@@ -565,6 +631,11 @@ type ListCandidateOrganizationsResponse = FullOrganization[];
 type ApplicationAuthContextResponse = {
     /** Minimal application identity shown in the hosted auth flow. */
     application: Pick<Application, 'id' | 'name' | 'config'>;
+    /**
+     * Login methods usable for this application: the environment allowlist
+     * intersected with the application's accepted AMRs.
+     */
+    loginMethods: LoginMethod[];
 };
 /**
  * Response returned when starting an authorization flow.
@@ -3552,6 +3623,23 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                 }>;
             };
         };
+    } | {
+        id: "login-methods";
+        getActions: ($fetch: better_auth_client.BetterFetch) => {
+            loginMethods: {
+                get: () => Promise<{
+                    data: null;
+                    error: {
+                        message?: string | undefined;
+                        status: number;
+                        statusText: string;
+                    };
+                } | {
+                    data: LoginMethodsResponse;
+                    error: null;
+                }>;
+            };
+        };
     } | {
         id: "email-otp";
         version: string;
@@ -5765,46 +5853,10 @@ declare class OrganizationService {
     removeTeamMember(teamId: string, userId: string): Promise<void>;
 }
 
-/**
- * Options for signing in with a social provider (Google or Microsoft).
- */
-type SocialSignInOptions = {
-    /** The social identity provider to authenticate with. */
-    provider: 'google' | 'microsoft';
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
-    errorCallbackURL?: string;
-    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
-    loginHint?: string;
-};
-/**
- * Options for signing in via SAML Single Sign-On.
- */
-type SignInWithSamlOptions = {
-    /** The user's email address, used to resolve the correct SAML identity provider. */
-    email: string;
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-    /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
-    errorCallbackURL?: string;
-};
-/**
- * Options for signing in with email and password credentials.
- */
-type SignInWithEmailAndPasswordOptions = {
-    /** The user's email address. */
-    email: string;
-    /** The user's password. */
-    password: string;
-    /** URL to redirect to after successful authentication. */
-    callbackURL: string;
-};
-
 /**
  * Service for managing user authentication sessions.
  *
- * Provides methods for signing in with various providers (social, SAML, email/password),
+ * Provides methods for signing in with various providers (social, SSO, email/password),
  * signing out, and password reset functionality.
  */
 declare class SessionService {
@@ -5871,6 +5923,13 @@ declare class SessionService {
     getToken(): Promise<{
         token: string;
     }>;
+    /**
+     * Lists the login methods enabled in the environment. Public; safe to call
+     * before authentication to decide which sign-in options to render.
+     *
+     * @returns The enabled login methods
+     */
+    getLoginMethods(): Promise<("sso" | "google" | "microsoft" | "password" | "otp")[]>;
     /**
      * Initiates social authentication flow with Google or Microsoft.
      *
@@ -5885,17 +5944,18 @@ declare class SessionService {
      */
     signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, loginHint, }: SocialSignInOptions): Promise<void>;
     /**
-     * Initiates SAML-based Single Sign-On authentication flow.
+     * Initiates the Single Sign-On authentication flow. The provider resolved
+     * from the email's domain determines whether SAML or OIDC is used.
      *
-     * @param options - SAML sign-in configuration
-     * @param options.email - User's email to determine the SAML provider
+     * @param options - SSO sign-in configuration
+     * @param options.email - User's email to determine the SSO provider
      * @param options.callbackURL - URL to redirect to after successful authentication
      * @param options.errorCallbackURL - URL to redirect to on error
      *
      * @throws {EmailRequired} When email is not provided
      * @throws {InvalidCallbackURL} When callback URLs are malformed
      */
-    signInWithSaml({ email, callbackURL, errorCallbackURL, }: SignInWithSamlOptions): Promise<void>;
+    signInWithSso({ email, callbackURL, errorCallbackURL, }: SignInWithSsoOptions): Promise<void>;
     /**
      * Authenticates a user with email and password credentials.
      *
@@ -6381,5 +6441,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "1.42.0";
+const version = "2.0.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -41,6 +41,11 @@ const AMR = z.enum({
   Otp: "otp",
   Oauth: "oauth",
   Sso: "sso",
+  /**
+   * @deprecated Issued to SSO sessions before SAML and OIDC were unified
+   * under `sso`. Still parsed so existing sessions and application policies
+   * remain valid, and read as `sso` (see `normalizeAmr`). Never issued.
+   */
   Saml: "saml"
 }).brand(AMRBrand);
 const AAL = z.enum({
@@ -55,6 +60,11 @@ const AuthMethod = z.enum({
   Password: "password",
   EmailOTP: "email_otp",
   OAuth: "oauth",
+  SSO: "sso",
+  /**
+   * @deprecated Recorded on SSO sessions before SAML and OIDC were unified
+   * under `sso`. Kept so existing sessions still parse; never recorded.
+   */
   SAML: "saml",
   Unknown: "unknown"
 }).brand(AuthMethodBrand);
@@ -62,6 +72,9 @@ const AMRs = parsedEnumValues(AMR);
 const AALs = parsedEnumValues(AAL);
 const ACRs = parsedEnumValues(ACR);
 const AuthMethods = parsedEnumValues(AuthMethod);
+function normalizeAmr(amr) {
+  return amr === AMRs.Saml ? AMRs.Sso : amr;
+}
 const assuranceFields = {
   authMethod: {
     type: "string",
@@ -438,6 +451,21 @@ function sessionAssurancePluginClient() {
   };
 }
 
+function loginMethodsPluginClient() {
+  return {
+    id: "login-methods",
+    getActions: ($fetch) => {
+      return {
+        loginMethods: {
+          get: async () => {
+            return await $fetch("/login-methods", { method: "GET" });
+          }
+        }
+      };
+    }
+  };
+}
+
 function createAPIClient(apiUrl, fetchOptions = {}) {
   const serviceName = typeof process !== "undefined" ? process.env.SERVICE_NAME : "";
   const userAgent = `auth-sdk:core:${version}${serviceName ? `@${serviceName}` : ""}`;
@@ -465,6 +493,7 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
       }),
       applicationsPluginClient(),
       sessionAssurancePluginClient(),
+      loginMethodsPluginClient(),
       emailOTPClient()
     ],
     fetchOptions: {
@@ -1201,7 +1230,8 @@ function isAssuranceSufficientForPolicy(assurance, policy, now = /* @__PURE__ */
   if (!assurance.amr.length) {
     return false;
   }
-  if (!assurance.amr.some((amr) => policy.acceptedAmr.includes(amr))) {
+  const acceptedAmr = new Set(policy.acceptedAmr.map(normalizeAmr));
+  if (!assurance.amr.some((amr) => acceptedAmr.has(normalizeAmr(amr)))) {
     return false;
   }
   if (getAalRank(policy.minAal) >= getAalRank(AALs.Aal2)) {
@@ -1298,7 +1328,7 @@ const DEFAULT_SESSION_ASSURANCE_CONFIG = {
   acceptedAmr: [
     AMRs.Pwd,
     AMRs.Oauth,
-    AMRs.Saml
+    AMRs.Sso
   ],
   minAal: AALs.Aal1
 };
@@ -1307,7 +1337,7 @@ const DEFAULT_APPLICATION_CONFIG = {
   sessionAssurance: DEFAULT_SESSION_ASSURANCE_CONFIG
 };
 const ApplicationSessionAssuranceConfig = z.object({
-  acceptedAmr: AMR.array().optional().default(DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr),
+  acceptedAmr: AMR.array().overwrite((amrs) => [...new Set(amrs.map(normalizeAmr))]).optional().default(DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr),
   minAal: AAL.refine(
     (aal) => aal !== AALs.Aal3,
     "Application session assurance currently supports aal1 and aal2 policies"
@@ -1319,7 +1349,7 @@ const ApplicationConfig = z.object({
 });
 
 function allowsDefaultAmrPolicy(config) {
-  const acceptedAmr = new Set(config.sessionAssurance.acceptedAmr);
+  const acceptedAmr = new Set(config.sessionAssurance.acceptedAmr.map(normalizeAmr));
   const defaultAcceptedAmr = DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr;
   return config.sessionAssurance.minAal === DEFAULT_SESSION_ASSURANCE_CONFIG.minAal && defaultAcceptedAmr.every((amr) => acceptedAmr.has(amr));
 }
@@ -1952,6 +1982,19 @@ class SessionService {
   async getToken() {
     return await this.client.token();
   }
+  /**
+   * Lists the login methods enabled in the environment. Public; safe to call
+   * before authentication to decide which sign-in options to render.
+   *
+   * @returns The enabled login methods
+   */
+  async getLoginMethods() {
+    const response = await this.client.loginMethods.get();
+    if (!response.data) {
+      throw new Error("No data returned from the API", { cause: response.error });
+    }
+    return response.data.loginMethods;
+  }
   /**
    * Initiates social authentication flow with Google or Microsoft.
    *
@@ -1988,17 +2031,18 @@ class SessionService {
     });
   }
   /**
-   * Initiates SAML-based Single Sign-On authentication flow.
+   * Initiates the Single Sign-On authentication flow. The provider resolved
+   * from the email's domain determines whether SAML or OIDC is used.
    *
-   * @param options - SAML sign-in configuration
-   * @param options.email - User's email to determine the SAML provider
+   * @param options - SSO sign-in configuration
+   * @param options.email - User's email to determine the SSO provider
    * @param options.callbackURL - URL to redirect to after successful authentication
    * @param options.errorCallbackURL - URL to redirect to on error
    *
    * @throws {EmailRequired} When email is not provided
    * @throws {InvalidCallbackURL} When callback URLs are malformed
    */
-  async signInWithSaml({
+  async signInWithSso({
     email,
     callbackURL,
     errorCallbackURL
@@ -2016,8 +2060,7 @@ class SessionService {
     await this.client.signIn.sso({
       email,
       callbackURL,
-      errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`,
-      providerType: "saml"
+      errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`
     });
   }
   /**
@@ -2323,6 +2366,8 @@ const ApiKeyMetadata = z.object({
   }).optional().nullable()
 });
 
+const LOGIN_METHODS = ["password", "google", "microsoft", "sso", "otp"];
+
 class AuthClient {
   /**
    * Configured Better Auth client used by the public service wrappers.
@@ -2524,4 +2569,4 @@ function extractTokenPayload(token) {
   return payload;
 }
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "1.42.0",
+    "version": "2.0.0",
     "type": "module",
     "exports": {
         ".": {