@meistrari/auth-core 1.43.0 → 2.1.0

package/dist/index.d.mts

@@ -32,17 +32,28 @@ declare const ACRs: {
     readonly Unspecified: "urn:tela:auth:unspecified" & zod__default.core.$brand<typeof ACRBrand>;
 };
 declare const AuthMethods: {
-    readonly Password: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly EmailOTP: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly OAuth: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly SAML: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly Unknown: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly Password: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly EmailOTP: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly OAuth: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly SSO: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly SAML: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly Unknown: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
 };
+/**
+ * Reads the legacy `saml` AMR as `sso`, so sessions and application policies
+ * created before SAML and OIDC were unified keep matching each other.
+ */
+declare function normalizeAmr(amr: AMR): AMR;
 declare const AMR: zod__default.core.$ZodBranded<zod__default.ZodEnum<{
     readonly Pwd: "pwd";
     readonly Otp: "otp";
     readonly Oauth: "oauth";
     readonly Sso: "sso";
+    /**
+     * @deprecated Issued to SSO sessions before SAML and OIDC were unified
+     * under `sso`. Still parsed so existing sessions and application policies
+     * remain valid, and read as `sso` (see `normalizeAmr`). Never issued.
+     */
     readonly Saml: "saml";
 }>, typeof AMRBrand, "out">;
 type AMR = zod__default.infer<typeof AMR>;
@@ -60,6 +71,11 @@ declare const AuthMethod: zod__default.core.$ZodBranded<zod__default.ZodEnum<{
     readonly Password: "password";
     readonly EmailOTP: "email_otp";
     readonly OAuth: "oauth";
+    readonly SSO: "sso";
+    /**
+     * @deprecated Recorded on SSO sessions before SAML and OIDC were unified
+     * under `sso`. Kept so existing sessions still parse; never recorded.
+     */
     readonly SAML: "saml";
     readonly Unknown: "unknown";
 }>, typeof AuthMethodBrand, "out">;
@@ -534,10 +550,10 @@ type SocialSignInOptions = {
     loginHint?: string;
 };
 /**
- * Options for signing in via SAML Single Sign-On.
+ * Options for signing in via Single Sign-On (SAML or OIDC).
  */
-type SignInWithSamlOptions = {
-    /** The user's email address, used to resolve the correct SAML identity provider. */
+type SignInWithSsoOptions = {
+    /** The user's email address, used to resolve the correct SSO identity provider. */
     email: string;
     /** URL to redirect to after successful authentication. */
     callbackURL: string;
@@ -560,7 +576,7 @@ type SignInWithEmailAndPasswordOptions = {
  * Session-carrying mechanisms (JWT, API keys, application tokens) are not
  * login methods.
  */
-declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "saml", "otp"];
+declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "sso", "otp"];
 type LoginMethod = typeof LOGIN_METHODS[number];
 /**
  * Response of the public `GET /login-methods` endpoint.
@@ -1037,7 +1053,7 @@ type ApiKeyWithoutSecret = Omit<ApiKey, 'key'>;
 type CreateApiKeyPayload = {
     /** Display name for the API key. */
     name: string;
-    /** Time in milliseconds until the key expires. Omit for a non-expiring key. */
+    /** Time in seconds until the key expires. Omit for a non-expiring key. */
     expiresIn?: number;
     /** Optional prefix prepended to the generated key for identification. */
     prefix?: string;
@@ -5840,7 +5856,7 @@ declare class OrganizationService {
 /**
  * Service for managing user authentication sessions.
  *
- * Provides methods for signing in with various providers (social, SAML, email/password),
+ * Provides methods for signing in with various providers (social, SSO, email/password),
  * signing out, and password reset functionality.
  */
 declare class SessionService {
@@ -5913,7 +5929,7 @@ declare class SessionService {
      *
      * @returns The enabled login methods
      */
-    getLoginMethods(): Promise<("google" | "microsoft" | "password" | "saml" | "otp")[]>;
+    getLoginMethods(): Promise<("sso" | "google" | "microsoft" | "password" | "otp")[]>;
     /**
      * Initiates social authentication flow with Google or Microsoft.
      *
@@ -5928,17 +5944,18 @@ declare class SessionService {
      */
     signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, loginHint, }: SocialSignInOptions): Promise<void>;
     /**
-     * Initiates SAML-based Single Sign-On authentication flow.
+     * Initiates the Single Sign-On authentication flow. The provider resolved
+     * from the email's domain determines whether SAML or OIDC is used.
      *
-     * @param options - SAML sign-in configuration
-     * @param options.email - User's email to determine the SAML provider
+     * @param options - SSO sign-in configuration
+     * @param options.email - User's email to determine the SSO provider
      * @param options.callbackURL - URL to redirect to after successful authentication
      * @param options.errorCallbackURL - URL to redirect to on error
      *
      * @throws {EmailRequired} When email is not provided
      * @throws {InvalidCallbackURL} When callback URLs are malformed
      */
-    signInWithSaml({ email, callbackURL, errorCallbackURL, }: SignInWithSamlOptions): Promise<void>;
+    signInWithSso({ email, callbackURL, errorCallbackURL, }: SignInWithSsoOptions): Promise<void>;
     /**
      * Authenticates a user with email and password credentials.
      *
@@ -6424,5 +6441,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -32,17 +32,28 @@ declare const ACRs: {
     readonly Unspecified: "urn:tela:auth:unspecified" & zod__default.core.$brand<typeof ACRBrand>;
 };
 declare const AuthMethods: {
-    readonly Password: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly EmailOTP: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly OAuth: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly SAML: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
-    readonly Unknown: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly Password: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly EmailOTP: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly OAuth: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly SSO: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly SAML: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
+    readonly Unknown: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
 };
+/**
+ * Reads the legacy `saml` AMR as `sso`, so sessions and application policies
+ * created before SAML and OIDC were unified keep matching each other.
+ */
+declare function normalizeAmr(amr: AMR): AMR;
 declare const AMR: zod__default.core.$ZodBranded<zod__default.ZodEnum<{
     readonly Pwd: "pwd";
     readonly Otp: "otp";
     readonly Oauth: "oauth";
     readonly Sso: "sso";
+    /**
+     * @deprecated Issued to SSO sessions before SAML and OIDC were unified
+     * under `sso`. Still parsed so existing sessions and application policies
+     * remain valid, and read as `sso` (see `normalizeAmr`). Never issued.
+     */
     readonly Saml: "saml";
 }>, typeof AMRBrand, "out">;
 type AMR = zod__default.infer<typeof AMR>;
@@ -60,6 +71,11 @@ declare const AuthMethod: zod__default.core.$ZodBranded<zod__default.ZodEnum<{
     readonly Password: "password";
     readonly EmailOTP: "email_otp";
     readonly OAuth: "oauth";
+    readonly SSO: "sso";
+    /**
+     * @deprecated Recorded on SSO sessions before SAML and OIDC were unified
+     * under `sso`. Kept so existing sessions still parse; never recorded.
+     */
     readonly SAML: "saml";
     readonly Unknown: "unknown";
 }>, typeof AuthMethodBrand, "out">;
@@ -534,10 +550,10 @@ type SocialSignInOptions = {
     loginHint?: string;
 };
 /**
- * Options for signing in via SAML Single Sign-On.
+ * Options for signing in via Single Sign-On (SAML or OIDC).
  */
-type SignInWithSamlOptions = {
-    /** The user's email address, used to resolve the correct SAML identity provider. */
+type SignInWithSsoOptions = {
+    /** The user's email address, used to resolve the correct SSO identity provider. */
     email: string;
     /** URL to redirect to after successful authentication. */
     callbackURL: string;
@@ -560,7 +576,7 @@ type SignInWithEmailAndPasswordOptions = {
  * Session-carrying mechanisms (JWT, API keys, application tokens) are not
  * login methods.
  */
-declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "saml", "otp"];
+declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "sso", "otp"];
 type LoginMethod = typeof LOGIN_METHODS[number];
 /**
  * Response of the public `GET /login-methods` endpoint.
@@ -1037,7 +1053,7 @@ type ApiKeyWithoutSecret = Omit<ApiKey, 'key'>;
 type CreateApiKeyPayload = {
     /** Display name for the API key. */
     name: string;
-    /** Time in milliseconds until the key expires. Omit for a non-expiring key. */
+    /** Time in seconds until the key expires. Omit for a non-expiring key. */
     expiresIn?: number;
     /** Optional prefix prepended to the generated key for identification. */
     prefix?: string;
@@ -5840,7 +5856,7 @@ declare class OrganizationService {
 /**
  * Service for managing user authentication sessions.
  *
- * Provides methods for signing in with various providers (social, SAML, email/password),
+ * Provides methods for signing in with various providers (social, SSO, email/password),
  * signing out, and password reset functionality.
  */
 declare class SessionService {
@@ -5913,7 +5929,7 @@ declare class SessionService {
      *
      * @returns The enabled login methods
      */
-    getLoginMethods(): Promise<("google" | "microsoft" | "password" | "saml" | "otp")[]>;
+    getLoginMethods(): Promise<("sso" | "google" | "microsoft" | "password" | "otp")[]>;
     /**
      * Initiates social authentication flow with Google or Microsoft.
      *
@@ -5928,17 +5944,18 @@ declare class SessionService {
      */
     signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, loginHint, }: SocialSignInOptions): Promise<void>;
     /**
-     * Initiates SAML-based Single Sign-On authentication flow.
+     * Initiates the Single Sign-On authentication flow. The provider resolved
+     * from the email's domain determines whether SAML or OIDC is used.
      *
-     * @param options - SAML sign-in configuration
-     * @param options.email - User's email to determine the SAML provider
+     * @param options - SSO sign-in configuration
+     * @param options.email - User's email to determine the SSO provider
      * @param options.callbackURL - URL to redirect to after successful authentication
      * @param options.errorCallbackURL - URL to redirect to on error
      *
      * @throws {EmailRequired} When email is not provided
      * @throws {InvalidCallbackURL} When callback URLs are malformed
      */
-    signInWithSaml({ email, callbackURL, errorCallbackURL, }: SignInWithSamlOptions): Promise<void>;
+    signInWithSso({ email, callbackURL, errorCallbackURL, }: SignInWithSsoOptions): Promise<void>;
     /**
      * Authenticates a user with email and password credentials.
      *
@@ -6424,5 +6441,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "1.43.0";
+const version = "2.1.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -41,6 +41,11 @@ const AMR = z.enum({
   Otp: "otp",
   Oauth: "oauth",
   Sso: "sso",
+  /**
+   * @deprecated Issued to SSO sessions before SAML and OIDC were unified
+   * under `sso`. Still parsed so existing sessions and application policies
+   * remain valid, and read as `sso` (see `normalizeAmr`). Never issued.
+   */
   Saml: "saml"
 }).brand(AMRBrand);
 const AAL = z.enum({
@@ -55,6 +60,11 @@ const AuthMethod = z.enum({
   Password: "password",
   EmailOTP: "email_otp",
   OAuth: "oauth",
+  SSO: "sso",
+  /**
+   * @deprecated Recorded on SSO sessions before SAML and OIDC were unified
+   * under `sso`. Kept so existing sessions still parse; never recorded.
+   */
   SAML: "saml",
   Unknown: "unknown"
 }).brand(AuthMethodBrand);
@@ -62,6 +72,9 @@ const AMRs = parsedEnumValues(AMR);
 const AALs = parsedEnumValues(AAL);
 const ACRs = parsedEnumValues(ACR);
 const AuthMethods = parsedEnumValues(AuthMethod);
+function normalizeAmr(amr) {
+  return amr === AMRs.Saml ? AMRs.Sso : amr;
+}
 const assuranceFields = {
   authMethod: {
     type: "string",
@@ -1217,7 +1230,8 @@ function isAssuranceSufficientForPolicy(assurance, policy, now = /* @__PURE__ */
   if (!assurance.amr.length) {
     return false;
   }
-  if (!assurance.amr.some((amr) => policy.acceptedAmr.includes(amr))) {
+  const acceptedAmr = new Set(policy.acceptedAmr.map(normalizeAmr));
+  if (!assurance.amr.some((amr) => acceptedAmr.has(normalizeAmr(amr)))) {
     return false;
   }
   if (getAalRank(policy.minAal) >= getAalRank(AALs.Aal2)) {
@@ -1314,7 +1328,7 @@ const DEFAULT_SESSION_ASSURANCE_CONFIG = {
   acceptedAmr: [
     AMRs.Pwd,
     AMRs.Oauth,
-    AMRs.Saml
+    AMRs.Sso
   ],
   minAal: AALs.Aal1
 };
@@ -1323,7 +1337,7 @@ const DEFAULT_APPLICATION_CONFIG = {
   sessionAssurance: DEFAULT_SESSION_ASSURANCE_CONFIG
 };
 const ApplicationSessionAssuranceConfig = z.object({
-  acceptedAmr: AMR.array().optional().default(DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr),
+  acceptedAmr: AMR.array().overwrite((amrs) => [...new Set(amrs.map(normalizeAmr))]).optional().default(DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr),
   minAal: AAL.refine(
     (aal) => aal !== AALs.Aal3,
     "Application session assurance currently supports aal1 and aal2 policies"
@@ -1335,7 +1349,7 @@ const ApplicationConfig = z.object({
 });
 
 function allowsDefaultAmrPolicy(config) {
-  const acceptedAmr = new Set(config.sessionAssurance.acceptedAmr);
+  const acceptedAmr = new Set(config.sessionAssurance.acceptedAmr.map(normalizeAmr));
   const defaultAcceptedAmr = DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr;
   return config.sessionAssurance.minAal === DEFAULT_SESSION_ASSURANCE_CONFIG.minAal && defaultAcceptedAmr.every((amr) => acceptedAmr.has(amr));
 }
@@ -2017,17 +2031,18 @@ class SessionService {
     });
   }
   /**
-   * Initiates SAML-based Single Sign-On authentication flow.
+   * Initiates the Single Sign-On authentication flow. The provider resolved
+   * from the email's domain determines whether SAML or OIDC is used.
    *
-   * @param options - SAML sign-in configuration
-   * @param options.email - User's email to determine the SAML provider
+   * @param options - SSO sign-in configuration
+   * @param options.email - User's email to determine the SSO provider
    * @param options.callbackURL - URL to redirect to after successful authentication
    * @param options.errorCallbackURL - URL to redirect to on error
    *
    * @throws {EmailRequired} When email is not provided
    * @throws {InvalidCallbackURL} When callback URLs are malformed
    */
-  async signInWithSaml({
+  async signInWithSso({
     email,
     callbackURL,
     errorCallbackURL
@@ -2045,8 +2060,7 @@ class SessionService {
     await this.client.signIn.sso({
       email,
       callbackURL,
-      errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`,
-      providerType: "saml"
+      errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`
     });
   }
   /**
@@ -2352,7 +2366,7 @@ const ApiKeyMetadata = z.object({
   }).optional().nullable()
 });
 
-const LOGIN_METHODS = ["password", "google", "microsoft", "saml", "otp"];
+const LOGIN_METHODS = ["password", "google", "microsoft", "sso", "otp"];
 
 class AuthClient {
   /**
@@ -2555,4 +2569,4 @@ function extractTokenPayload(token) {
   return payload;
 }
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "1.43.0",
+    "version": "2.1.0",
     "type": "module",
     "exports": {
         ".": {