@milaboratories/pl-client 3.14.7 → 3.16.0

package/dist/core/unauth_client.cjs

@@ -26,7 +26,9 @@ var UnauthenticatedPlClient = class UnauthenticatedPlClient {
 	}
 	/** Classifies the advertised authentication methods by credential scheme.
 	* On legacy backends (no auth:v2) the typed oneof is empty; callers fall through to {@link login}
-	* which uses the legacy GetJWTToken path. SSO is surfaced via {@link ssoConfig}, not here. */
+	* which uses the legacy GetJWTToken path.
+	* @deprecated collapses every basic-kind method into one boolean; use {@link loginMethods} to
+	* see each advertised method's own id. `login()` still reads this to choose the credential path. */
 	get supportedAuthSchemes() {
 		const result = {
 			basic: false,
@@ -36,46 +38,87 @@ var UnauthenticatedPlClient = class UnauthenticatedPlClient {
 		else if (m.method.oneofKind === "token") result.token = true;
 		return result;
 	}
+	/** Builds the {@link SSOAuthMethod} projection an advertised SSO entry carries, or `undefined`
+	* for a flow no client here can drive. Shared by {@link ssoConfig} and {@link loginMethods},
+	* which each apply their own rule for an unsupported flow. */
+	toSSOAuthMethod(method) {
+		if (method.method.oneofKind !== "sso") return void 0;
+		const sso = method.method.sso;
+		if (sso.flowType !== 0) return void 0;
+		return {
+			id: method.id,
+			title: method.title || method.description || method.id,
+			description: method.description,
+			issuer: sso.issuer,
+			clientId: sso.clientId,
+			scopes: sso.scopes,
+			resource: sso.resource,
+			prompt: sso.prompt,
+			redirectPorts: sso.redirectPorts,
+			subjectTokenSource: sso.subjectTokenSource,
+			userIdClaim: sso.userIdClaim,
+			groupsClaim: sso.groupsClaim,
+			accessType: sso.accessType || void 0,
+			flowType: "public_pkce"
+		};
+	}
 	/** Projection of the first advertised SSO method, derived from {@link authMethodsSync}.
-	* v1: at most one SSO method per deployment, so callers do not need to discriminate. */
+	* v1: at most one SSO method per deployment, so callers do not need to discriminate.
+	* @deprecated surfaces only the first advertised SSO method; use {@link loginMethods} to see
+	* every advertised method, of every kind. */
 	ssoConfig() {
 		for (const method of this.ll.authMethodsSync.methods) {
 			if (method.method.oneofKind !== "sso") continue;
 			const sso = method.method.sso;
 			if (sso.flowType !== 0) throw new Error(`ssoConfig: unsupported SSO flow type ${sso.flowType}`);
-			return {
-				id: method.id,
-				description: method.description,
-				issuer: sso.issuer,
-				clientId: sso.clientId,
-				scopes: sso.scopes,
-				resource: sso.resource,
-				prompt: sso.prompt,
-				redirectPorts: sso.redirectPorts,
-				subjectTokenSource: sso.subjectTokenSource,
-				userIdClaim: sso.userIdClaim,
-				groupsClaim: sso.groupsClaim,
-				accessType: sso.accessType || void 0,
-				flowType: "public_pkce"
-			};
+			return this.toSSOAuthMethod(method);
+		}
+	}
+	/** Every login method the backend advertises, of every kind, in advertised order, each
+	* keeping its own `id`, `title`, `description` and kind. An entry with no usable method arm, or an
+	* SSO entry whose flow no client here can drive, is dropped rather than failing the whole
+	* list, which is why this accessor skips where {@link ssoConfig} throws. */
+	loginMethods() {
+		const picked = [];
+		for (const method of this.ll.authMethodsSync.methods) switch (method.method.oneofKind) {
+			case "basic":
+			case "token":
+				picked.push({
+					kind: method.method.oneofKind,
+					id: method.id,
+					title: method.title || method.description || method.id,
+					description: method.description
+				});
+				break;
+			case "sso": {
+				const sso = this.toSSOAuthMethod(method);
+				if (sso !== void 0) picked.push({
+					kind: "sso",
+					...sso
+				});
+				break;
+			}
+			default: break;
 		}
+		return picked;
 	}
-	/** Login with username+password.
+	/** Login with username and password.
 	*
-	* On auth:v2 backends the client inspects the advertised AuthMethods:
-	*   - if basic auth is offered, sends {@link LLPlClient.loginBasic};
-	*   - if only token auth is offered, treats `password` as an opaque bearer token and
-	*     sends {@link LLPlClient.loginWithToken} (so deployments configured for static-token
-	*     auth still log in without the caller switching methods).
+	* Routes to {@link LLPlClient.loginBasic} or {@link LLPlClient.loginWithToken} based on the
+	* advertised method `idP` names. On legacy backends, uses GetJWTToken with Basic header.
 	*
-	* On legacy backends (no auth:v2) it falls through to GetJWTToken with the Basic header,
-	* preserving original behavior. */
-	async login(user, password) {
+	* `idP` names the advertised method. A named basic-kind method routes to the basic branch;
+	* a named token-kind method routes to the token branch even when the backend also advertises
+	* a basic method — the token wire carries no selector, so the id itself is dropped there and
+	* only the branch choice is kept. Omitted, or naming no advertised method, falls back to
+	* today's first-match behavior: basic wins over token when both are advertised. */
+	async login(user, password, idP) {
 		try {
 			let token;
 			if (this.ll.hasCapability("auth:v2")) {
 				const schemes = this.supportedAuthSchemes;
-				if (schemes.basic) token = await this.ll.loginBasic(user, password);
+				if ((idP === void 0 ? void 0 : this.loginMethods().find((m) => m.id === idP)?.kind) === "token") token = await this.ll.loginWithToken(password);
+				else if (schemes.basic) token = idP === void 0 ? await this.ll.loginBasic(user, password) : await this.ll.loginBasic(user, password, { idP });
 				else if (schemes.token) token = await this.ll.loginWithToken(password);
 				else throw new Error("backend advertises no supported authentication methods");
 			} else token = await this.ll.getJwtToken(BigInt(this.ll.conf.authTTLSeconds), { authorization: "Basic " + Buffer.from(user + ":" + password).toString("base64") });
@@ -88,9 +131,11 @@ var UnauthenticatedPlClient = class UnauthenticatedPlClient {
 		}
 	}
 	/** Request fresh server-issued login material. v1 only emits the public-PKCE flow;
-	* desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. */
-	async beginSSOLogin() {
-		const attempt = await this.ll.beginSSOLogin();
+	* desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. `idP` names
+	* the advertised SSO method to route to; omitted, the backend keeps its current first-match
+	* behaviour. */
+	async beginSSOLogin(idP) {
+		const attempt = idP === void 0 ? await this.ll.beginSSOLogin() : await this.ll.beginSSOLogin(idP);
 		return {
 			flow: "public_pkce",
 			nonce: attempt.nonce,
@@ -98,10 +143,12 @@ var UnauthenticatedPlClient = class UnauthenticatedPlClient {
 			clientSecret: attempt.clientSecret
 		};
 	}
-	/** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. */
+	/** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. `idP` names
+	* the advertised SSO method to route to; omitted, the backend keeps its current first-match
+	* behaviour. */
 	async loginSSO(payload) {
 		try {
-			const jwtToken = await this.ll.loginSSO(payload.tokenResponse);
+			const jwtToken = payload.idP === void 0 ? await this.ll.loginSSO(payload.tokenResponse) : await this.ll.loginSSO(payload.tokenResponse, payload.idP);
 			if (jwtToken === "") throw new Error("empty token");
 			return { jwtToken };
 		} catch (e) {

package/dist/core/unauth_client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"unauth_client.cjs","names":["LLPlClient","UnauthenticatedError"],"sources":["../../src/core/unauth_client.ts"],"sourcesContent":["import type { AuthInformation, PlClientConfig } from \"./config\";\nimport {\n  type AuthAPI_ListMethods_Response,\n  type MaintenanceAPI_Ping_Response,\n  AuthAPI_ListMethods_SSOAuthMethod_FlowType,\n} from \"../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api\";\nimport { LLPlClient } from \"./ll_client\";\nimport { type MiLogger, notEmpty } from \"@milaboratories/ts-helpers\";\nimport { UnauthenticatedError } from \"./errors\";\nimport type { BackendCapability } from \"./capabilities\";\n\n/** Login-flow shape advertised by the backend for a given SSO method. Extension\n * point: future flow variants (e.g. backend-driven) sit alongside `public_pkce`. */\nexport type SSOFlowType = \"public_pkce\";\n\n/** Typed projection of `AuthAPI.ListMethods.SSOAuthMethod` for desktop consumption.\n * Carries everything needed to drive the PKCE flow + diagnostics fields the renderer\n * may surface (`userIdClaim`, `groupsClaim`). */\nexport type SSOAuthMethod = {\n  id: string;\n  description: string;\n  issuer: string;\n  clientId: string;\n  scopes: string;\n  resource: string;\n  prompt: string;\n  redirectPorts: number[];\n  subjectTokenSource: string;\n  userIdClaim: string;\n  groupsClaim: string;\n  flowType: SSOFlowType;\n  /** OIDC `access_type` auth-request param (\"online\" | \"offline\"). Google-specific:\n   * \"offline\" makes Google issue a refresh token; other IdPs ignore it. Absent when\n   * the server does not set it — never send an empty string to the IdP. */\n  accessType?: string;\n};\n\n/** Server-issued material returned by {@link UnauthenticatedPlClient.beginSSOLogin}.\n * Discriminated on `flow`; future flow variants extend the union. */\nexport type SSOLoginAttempt = {\n  flow: \"public_pkce\";\n  nonce: string;\n  expiresAt: Date;\n  /** Confidential-client secret for the IdP token exchange; absent for public clients.\n   * Google's OIDC has no public-client mode — it requires a client_secret at the token\n   * endpoint even with PKCE — so for Google the backend forwards its secret here and the\n   * desktop exchanges the code as a confidential client. */\n  clientSecret?: string;\n};\n\n/** Primarily used for initial authentication (login) */\nexport class UnauthenticatedPlClient {\n  public readonly ll: LLPlClient;\n\n  private constructor(ll: LLPlClient) {\n    this.ll = ll;\n  }\n\n  public static async build(\n    configOrAddress: PlClientConfig | string,\n    ops?: { logger?: MiLogger },\n  ): Promise<UnauthenticatedPlClient> {\n    const ll = await LLPlClient.build(configOrAddress, ops);\n    return new UnauthenticatedPlClient(ll);\n  }\n\n  public async ping(): Promise<MaintenanceAPI_Ping_Response> {\n    return await this.ll.ping();\n  }\n\n  public async authMethods(): Promise<AuthAPI_ListMethods_Response> {\n    return await this.ll.authMethods();\n  }\n\n  public async requireAuth(): Promise<boolean> {\n    return (await this.authMethods()).methods.length > 0;\n  }\n\n  public hasCapability(capability: BackendCapability): boolean {\n    return this.ll.hasCapability(capability);\n  }\n\n  /** Classifies the advertised authentication methods by credential scheme.\n   * On legacy backends (no auth:v2) the typed oneof is empty; callers fall through to {@link login}\n   * which uses the legacy GetJWTToken path. SSO is surfaced via {@link ssoConfig}, not here. */\n  public get supportedAuthSchemes(): { basic: boolean; token: boolean } {\n    const result = { basic: false, token: false };\n    for (const m of this.ll.authMethodsSync.methods) {\n      if (m.method.oneofKind === \"basic\") result.basic = true;\n      else if (m.method.oneofKind === \"token\") result.token = true;\n    }\n    return result;\n  }\n\n  /** Projection of the first advertised SSO method, derived from {@link authMethodsSync}.\n   * v1: at most one SSO method per deployment, so callers do not need to discriminate. */\n  public ssoConfig(): SSOAuthMethod | undefined {\n    for (const method of this.ll.authMethodsSync.methods) {\n      if (method.method.oneofKind !== \"sso\") continue;\n      const sso = method.method.sso;\n      if (sso.flowType !== AuthAPI_ListMethods_SSOAuthMethod_FlowType.PUBLIC_PKCE) {\n        throw new Error(`ssoConfig: unsupported SSO flow type ${sso.flowType}`);\n      }\n      return {\n        id: method.id,\n        description: method.description,\n        issuer: sso.issuer,\n        clientId: sso.clientId,\n        scopes: sso.scopes,\n        resource: sso.resource,\n        prompt: sso.prompt,\n        redirectPorts: sso.redirectPorts,\n        subjectTokenSource: sso.subjectTokenSource,\n        userIdClaim: sso.userIdClaim,\n        groupsClaim: sso.groupsClaim,\n        accessType: sso.accessType || undefined,\n        flowType: \"public_pkce\",\n      };\n    }\n    return undefined;\n  }\n\n  /** Login with username+password.\n   *\n   * On auth:v2 backends the client inspects the advertised AuthMethods:\n   *   - if basic auth is offered, sends {@link LLPlClient.loginBasic};\n   *   - if only token auth is offered, treats `password` as an opaque bearer token and\n   *     sends {@link LLPlClient.loginWithToken} (so deployments configured for static-token\n   *     auth still log in without the caller switching methods).\n   *\n   * On legacy backends (no auth:v2) it falls through to GetJWTToken with the Basic header,\n   * preserving original behavior. */\n  public async login(user: string, password: string): Promise<AuthInformation> {\n    try {\n      let token: string;\n      if (this.ll.hasCapability(\"auth:v2\")) {\n        const schemes = this.supportedAuthSchemes;\n        if (schemes.basic) {\n          token = await this.ll.loginBasic(user, password);\n        } else if (schemes.token) {\n          token = await this.ll.loginWithToken(password);\n        } else {\n          throw new Error(\"backend advertises no supported authentication methods\");\n        }\n      } else {\n        token = await this.ll.getJwtToken(BigInt(this.ll.conf.authTTLSeconds), {\n          authorization: \"Basic \" + Buffer.from(user + \":\" + password).toString(\"base64\"),\n        });\n      }\n      const jwtToken = notEmpty(token);\n      if (jwtToken === \"\") throw new Error(\"empty token\");\n      return { jwtToken };\n    } catch (e: any) {\n      if (e.code === \"UNAUTHENTICATED\") throw new UnauthenticatedError(e.message);\n      throw new Error(e);\n    }\n  }\n\n  /** Request fresh server-issued login material. v1 only emits the public-PKCE flow;\n   * desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. */\n  public async beginSSOLogin(): Promise<SSOLoginAttempt> {\n    const attempt = await this.ll.beginSSOLogin();\n    return {\n      flow: \"public_pkce\",\n      nonce: attempt.nonce,\n      expiresAt: attempt.expiresAt,\n      clientSecret: attempt.clientSecret,\n    };\n  }\n\n  /** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. */\n  public async loginSSO(payload: { tokenResponse: Uint8Array }): Promise<AuthInformation> {\n    try {\n      const jwtToken = await this.ll.loginSSO(payload.tokenResponse);\n      if (jwtToken === \"\") throw new Error(\"empty token\");\n      return { jwtToken };\n    } catch (e: any) {\n      if (e.code === \"UNAUTHENTICATED\") throw new UnauthenticatedError(e.message);\n      throw new Error(e);\n    }\n  }\n}\n"],"mappings":";;;;;;AAmDA,IAAa,0BAAb,MAAa,wBAAwB;CACnC;CAEA,YAAoB,IAAgB;EAClC,KAAK,KAAK;CACZ;CAEA,aAAoB,MAClB,iBACA,KACkC;EAElC,OAAO,IAAI,wBAAwB,MADlBA,kBAAAA,WAAW,MAAM,iBAAiB,GAAG,CACjB;CACvC;CAEA,MAAa,OAA8C;EACzD,OAAO,MAAM,KAAK,GAAG,KAAK;CAC5B;CAEA,MAAa,cAAqD;EAChE,OAAO,MAAM,KAAK,GAAG,YAAY;CACnC;CAEA,MAAa,cAAgC;EAC3C,QAAQ,MAAM,KAAK,YAAY,EAAA,CAAG,QAAQ,SAAS;CACrD;CAEA,cAAqB,YAAwC;EAC3D,OAAO,KAAK,GAAG,cAAc,UAAU;CACzC;;;;CAKA,IAAW,uBAA2D;EACpE,MAAM,SAAS;GAAE,OAAO;GAAO,OAAO;EAAM;EAC5C,KAAK,MAAM,KAAK,KAAK,GAAG,gBAAgB,SACtC,IAAI,EAAE,OAAO,cAAc,SAAS,OAAO,QAAQ;OAC9C,IAAI,EAAE,OAAO,cAAc,SAAS,OAAO,QAAQ;EAE1D,OAAO;CACT;;;CAIA,YAA8C;EAC5C,KAAK,MAAM,UAAU,KAAK,GAAG,gBAAgB,SAAS;GACpD,IAAI,OAAO,OAAO,cAAc,OAAO;GACvC,MAAM,MAAM,OAAO,OAAO;GAC1B,IAAI,IAAI,aAAA,GACN,MAAM,IAAI,MAAM,wCAAwC,IAAI,UAAU;GAExE,OAAO;IACL,IAAI,OAAO;IACX,aAAa,OAAO;IACpB,QAAQ,IAAI;IACZ,UAAU,IAAI;IACd,QAAQ,IAAI;IACZ,UAAU,IAAI;IACd,QAAQ,IAAI;IACZ,eAAe,IAAI;IACnB,oBAAoB,IAAI;IACxB,aAAa,IAAI;IACjB,aAAa,IAAI;IACjB,YAAY,IAAI,cAAc,KAAA;IAC9B,UAAU;GACZ;EACF;CAEF;;;;;;;;;;;CAYA,MAAa,MAAM,MAAc,UAA4C;EAC3E,IAAI;GACF,IAAI;GACJ,IAAI,KAAK,GAAG,cAAc,SAAS,GAAG;IACpC,MAAM,UAAU,KAAK;IACrB,IAAI,QAAQ,OACV,QAAQ,MAAM,KAAK,GAAG,WAAW,MAAM,QAAQ;SAC1C,IAAI,QAAQ,OACjB,QAAQ,MAAM,KAAK,GAAG,eAAe,QAAQ;SAE7C,MAAM,IAAI,MAAM,wDAAwD;GAE5E,OACE,QAAQ,MAAM,KAAK,GAAG,YAAY,OAAO,KAAK,GAAG,KAAK,cAAc,GAAG,EACrE,eAAe,WAAW,OAAO,KAAK,OAAO,MAAM,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAChF,CAAC;GAEH,MAAM,YAAA,GAAA,2BAAA,SAAA,CAAoB,KAAK;GAC/B,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,aAAa;GAClD,OAAO,EAAE,SAAS;EACpB,SAAS,GAAQ;GACf,IAAI,EAAE,SAAS,mBAAmB,MAAM,IAAIC,eAAAA,qBAAqB,EAAE,OAAO;GAC1E,MAAM,IAAI,MAAM,CAAC;EACnB;CACF;;;CAIA,MAAa,gBAA0C;EACrD,MAAM,UAAU,MAAM,KAAK,GAAG,cAAc;EAC5C,OAAO;GACL,MAAM;GACN,OAAO,QAAQ;GACf,WAAW,QAAQ;GACnB,cAAc,QAAQ;EACxB;CACF;;CAGA,MAAa,SAAS,SAAkE;EACtF,IAAI;GACF,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,QAAQ,aAAa;GAC7D,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,aAAa;GAClD,OAAO,EAAE,SAAS;EACpB,SAAS,GAAQ;GACf,IAAI,EAAE,SAAS,mBAAmB,MAAM,IAAIA,eAAAA,qBAAqB,EAAE,OAAO;GAC1E,MAAM,IAAI,MAAM,CAAC;EACnB;CACF;AACF"}
+{"version":3,"file":"unauth_client.cjs","names":["LLPlClient","UnauthenticatedError"],"sources":["../../src/core/unauth_client.ts"],"sourcesContent":["import type { AuthInformation, PlClientConfig } from \"./config\";\nimport {\n  type AuthAPI_ListMethods_Response,\n  type MaintenanceAPI_Ping_Response,\n  AuthAPI_ListMethods_SSOAuthMethod_FlowType,\n} from \"../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api\";\nimport { LLPlClient } from \"./ll_client\";\nimport { type MiLogger, notEmpty } from \"@milaboratories/ts-helpers\";\nimport { UnauthenticatedError } from \"./errors\";\nimport type { BackendCapability } from \"./capabilities\";\n\n/** Login-flow shape advertised by the backend for a given SSO method. Extension\n * point: future flow variants (e.g. backend-driven) sit alongside `public_pkce`. */\nexport type SSOFlowType = \"public_pkce\";\n\n/** Typed projection of `AuthAPI.ListMethods.SSOAuthMethod` for desktop consumption.\n * Carries everything needed to drive the PKCE flow + diagnostics fields the renderer\n * may surface (`userIdClaim`, `groupsClaim`). */\nexport type SSOAuthMethod = {\n  id: string;\n  title: string;\n  description: string;\n  issuer: string;\n  clientId: string;\n  scopes: string;\n  resource: string;\n  prompt: string;\n  redirectPorts: number[];\n  subjectTokenSource: string;\n  userIdClaim: string;\n  groupsClaim: string;\n  flowType: SSOFlowType;\n  /** OIDC `access_type` auth-request param (\"online\" | \"offline\"). Google-specific:\n   * \"offline\" makes Google issue a refresh token; other IdPs ignore it. Absent when\n   * the server does not set it — never send an empty string to the IdP. */\n  accessType?: string;\n};\n\n/** Server-issued material returned by {@link UnauthenticatedPlClient.beginSSOLogin}.\n * Discriminated on `flow`; future flow variants extend the union. */\nexport type SSOLoginAttempt = {\n  flow: \"public_pkce\";\n  nonce: string;\n  expiresAt: Date;\n  /** Confidential-client secret for the IdP token exchange; absent for public clients.\n   * Google's OIDC has no public-client mode — it requires a client_secret at the token\n   * endpoint even with PKCE — so for Google the backend forwards its secret here and the\n   * desktop exchanges the code as a confidential client. */\n  clientSecret?: string;\n};\n\n/** One login method the backend advertises, of any kind. Every advertised method keeps its own\n * `id`, `title`, `description` and kind. Two same-kind methods, such as two LDAP directories, are\n * two entries a caller can name apart and never collapsed into one. See {@link UnauthenticatedPlClient.loginMethods}. */\nexport type LoginMethod =\n  | { kind: \"basic\"; id: string; title: string; description: string }\n  | { kind: \"token\"; id: string; title: string; description: string }\n  | ({ kind: \"sso\" } & SSOAuthMethod);\n\n/** Primarily used for initial authentication (login) */\nexport class UnauthenticatedPlClient {\n  public readonly ll: LLPlClient;\n\n  private constructor(ll: LLPlClient) {\n    this.ll = ll;\n  }\n\n  public static async build(\n    configOrAddress: PlClientConfig | string,\n    ops?: { logger?: MiLogger },\n  ): Promise<UnauthenticatedPlClient> {\n    const ll = await LLPlClient.build(configOrAddress, ops);\n    return new UnauthenticatedPlClient(ll);\n  }\n\n  public async ping(): Promise<MaintenanceAPI_Ping_Response> {\n    return await this.ll.ping();\n  }\n\n  public async authMethods(): Promise<AuthAPI_ListMethods_Response> {\n    return await this.ll.authMethods();\n  }\n\n  public async requireAuth(): Promise<boolean> {\n    return (await this.authMethods()).methods.length > 0;\n  }\n\n  public hasCapability(capability: BackendCapability): boolean {\n    return this.ll.hasCapability(capability);\n  }\n\n  /** Classifies the advertised authentication methods by credential scheme.\n   * On legacy backends (no auth:v2) the typed oneof is empty; callers fall through to {@link login}\n   * which uses the legacy GetJWTToken path.\n   * @deprecated collapses every basic-kind method into one boolean; use {@link loginMethods} to\n   * see each advertised method's own id. `login()` still reads this to choose the credential path. */\n  public get supportedAuthSchemes(): { basic: boolean; token: boolean } {\n    const result = { basic: false, token: false };\n    for (const m of this.ll.authMethodsSync.methods) {\n      if (m.method.oneofKind === \"basic\") result.basic = true;\n      else if (m.method.oneofKind === \"token\") result.token = true;\n    }\n    return result;\n  }\n\n  /** Builds the {@link SSOAuthMethod} projection an advertised SSO entry carries, or `undefined`\n   * for a flow no client here can drive. Shared by {@link ssoConfig} and {@link loginMethods},\n   * which each apply their own rule for an unsupported flow. */\n  private toSSOAuthMethod(\n    method: AuthAPI_ListMethods_Response[\"methods\"][number],\n  ): SSOAuthMethod | undefined {\n    if (method.method.oneofKind !== \"sso\") return undefined;\n    const sso = method.method.sso;\n    if (sso.flowType !== AuthAPI_ListMethods_SSOAuthMethod_FlowType.PUBLIC_PKCE) return undefined;\n    return {\n      id: method.id,\n      title: method.title || method.description || method.id,\n      description: method.description,\n      issuer: sso.issuer,\n      clientId: sso.clientId,\n      scopes: sso.scopes,\n      resource: sso.resource,\n      prompt: sso.prompt,\n      redirectPorts: sso.redirectPorts,\n      subjectTokenSource: sso.subjectTokenSource,\n      userIdClaim: sso.userIdClaim,\n      groupsClaim: sso.groupsClaim,\n      accessType: sso.accessType || undefined,\n      flowType: \"public_pkce\",\n    };\n  }\n\n  /** Projection of the first advertised SSO method, derived from {@link authMethodsSync}.\n   * v1: at most one SSO method per deployment, so callers do not need to discriminate.\n   * @deprecated surfaces only the first advertised SSO method; use {@link loginMethods} to see\n   * every advertised method, of every kind. */\n  public ssoConfig(): SSOAuthMethod | undefined {\n    for (const method of this.ll.authMethodsSync.methods) {\n      if (method.method.oneofKind !== \"sso\") continue;\n      const sso = method.method.sso;\n      if (sso.flowType !== AuthAPI_ListMethods_SSOAuthMethod_FlowType.PUBLIC_PKCE) {\n        throw new Error(`ssoConfig: unsupported SSO flow type ${sso.flowType}`);\n      }\n      return this.toSSOAuthMethod(method);\n    }\n    return undefined;\n  }\n\n  /** Every login method the backend advertises, of every kind, in advertised order, each\n   * keeping its own `id`, `title`, `description` and kind. An entry with no usable method arm, or an\n   * SSO entry whose flow no client here can drive, is dropped rather than failing the whole\n   * list, which is why this accessor skips where {@link ssoConfig} throws. */\n  public loginMethods(): LoginMethod[] {\n    const picked: LoginMethod[] = [];\n    for (const method of this.ll.authMethodsSync.methods) {\n      switch (method.method.oneofKind) {\n        case \"basic\":\n        case \"token\":\n          picked.push({\n            kind: method.method.oneofKind,\n            id: method.id,\n            title: method.title || method.description || method.id,\n            description: method.description,\n          });\n          break;\n        case \"sso\": {\n          const sso = this.toSSOAuthMethod(method);\n          if (sso !== undefined) picked.push({ kind: \"sso\", ...sso });\n          break;\n        }\n        default:\n          // No arm at all — a legacy backend advertising nothing pickable.\n          break;\n      }\n    }\n    return picked;\n  }\n\n  /** Login with username and password.\n   *\n   * Routes to {@link LLPlClient.loginBasic} or {@link LLPlClient.loginWithToken} based on the\n   * advertised method `idP` names. On legacy backends, uses GetJWTToken with Basic header.\n   *\n   * `idP` names the advertised method. A named basic-kind method routes to the basic branch;\n   * a named token-kind method routes to the token branch even when the backend also advertises\n   * a basic method — the token wire carries no selector, so the id itself is dropped there and\n   * only the branch choice is kept. Omitted, or naming no advertised method, falls back to\n   * today's first-match behavior: basic wins over token when both are advertised. */\n  public async login(user: string, password: string, idP?: string): Promise<AuthInformation> {\n    try {\n      let token: string;\n      if (this.ll.hasCapability(\"auth:v2\")) {\n        const schemes = this.supportedAuthSchemes;\n        const namedKind =\n          idP === undefined ? undefined : this.loginMethods().find((m) => m.id === idP)?.kind;\n        if (namedKind === \"token\") {\n          token = await this.ll.loginWithToken(password);\n        } else if (schemes.basic) {\n          token =\n            idP === undefined\n              ? await this.ll.loginBasic(user, password)\n              : await this.ll.loginBasic(user, password, { idP });\n        } else if (schemes.token) {\n          token = await this.ll.loginWithToken(password);\n        } else {\n          throw new Error(\"backend advertises no supported authentication methods\");\n        }\n      } else {\n        token = await this.ll.getJwtToken(BigInt(this.ll.conf.authTTLSeconds), {\n          authorization: \"Basic \" + Buffer.from(user + \":\" + password).toString(\"base64\"),\n        });\n      }\n      const jwtToken = notEmpty(token);\n      if (jwtToken === \"\") throw new Error(\"empty token\");\n      return { jwtToken };\n    } catch (e: any) {\n      if (e.code === \"UNAUTHENTICATED\") throw new UnauthenticatedError(e.message);\n      throw new Error(e);\n    }\n  }\n\n  /** Request fresh server-issued login material. v1 only emits the public-PKCE flow;\n   * desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. `idP` names\n   * the advertised SSO method to route to; omitted, the backend keeps its current first-match\n   * behaviour. */\n  public async beginSSOLogin(idP?: string): Promise<SSOLoginAttempt> {\n    const attempt =\n      idP === undefined ? await this.ll.beginSSOLogin() : await this.ll.beginSSOLogin(idP);\n    return {\n      flow: \"public_pkce\",\n      nonce: attempt.nonce,\n      expiresAt: attempt.expiresAt,\n      clientSecret: attempt.clientSecret,\n    };\n  }\n\n  /** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. `idP` names\n   * the advertised SSO method to route to; omitted, the backend keeps its current first-match\n   * behaviour. */\n  public async loginSSO(payload: {\n    tokenResponse: Uint8Array;\n    idP?: string;\n  }): Promise<AuthInformation> {\n    try {\n      const jwtToken =\n        payload.idP === undefined\n          ? await this.ll.loginSSO(payload.tokenResponse)\n          : await this.ll.loginSSO(payload.tokenResponse, payload.idP);\n      if (jwtToken === \"\") throw new Error(\"empty token\");\n      return { jwtToken };\n    } catch (e: any) {\n      if (e.code === \"UNAUTHENTICATED\") throw new UnauthenticatedError(e.message);\n      throw new Error(e);\n    }\n  }\n}\n"],"mappings":";;;;;;AA4DA,IAAa,0BAAb,MAAa,wBAAwB;CACnC;CAEA,YAAoB,IAAgB;EAClC,KAAK,KAAK;CACZ;CAEA,aAAoB,MAClB,iBACA,KACkC;EAElC,OAAO,IAAI,wBAAwB,MADlBA,kBAAAA,WAAW,MAAM,iBAAiB,GAAG,CACjB;CACvC;CAEA,MAAa,OAA8C;EACzD,OAAO,MAAM,KAAK,GAAG,KAAK;CAC5B;CAEA,MAAa,cAAqD;EAChE,OAAO,MAAM,KAAK,GAAG,YAAY;CACnC;CAEA,MAAa,cAAgC;EAC3C,QAAQ,MAAM,KAAK,YAAY,EAAA,CAAG,QAAQ,SAAS;CACrD;CAEA,cAAqB,YAAwC;EAC3D,OAAO,KAAK,GAAG,cAAc,UAAU;CACzC;;;;;;CAOA,IAAW,uBAA2D;EACpE,MAAM,SAAS;GAAE,OAAO;GAAO,OAAO;EAAM;EAC5C,KAAK,MAAM,KAAK,KAAK,GAAG,gBAAgB,SACtC,IAAI,EAAE,OAAO,cAAc,SAAS,OAAO,QAAQ;OAC9C,IAAI,EAAE,OAAO,cAAc,SAAS,OAAO,QAAQ;EAE1D,OAAO;CACT;;;;CAKA,gBACE,QAC2B;EAC3B,IAAI,OAAO,OAAO,cAAc,OAAO,OAAO,KAAA;EAC9C,MAAM,MAAM,OAAO,OAAO;EAC1B,IAAI,IAAI,aAAA,GAAqE,OAAO,KAAA;EACpF,OAAO;GACL,IAAI,OAAO;GACX,OAAO,OAAO,SAAS,OAAO,eAAe,OAAO;GACpD,aAAa,OAAO;GACpB,QAAQ,IAAI;GACZ,UAAU,IAAI;GACd,QAAQ,IAAI;GACZ,UAAU,IAAI;GACd,QAAQ,IAAI;GACZ,eAAe,IAAI;GACnB,oBAAoB,IAAI;GACxB,aAAa,IAAI;GACjB,aAAa,IAAI;GACjB,YAAY,IAAI,cAAc,KAAA;GAC9B,UAAU;EACZ;CACF;;;;;CAMA,YAA8C;EAC5C,KAAK,MAAM,UAAU,KAAK,GAAG,gBAAgB,SAAS;GACpD,IAAI,OAAO,OAAO,cAAc,OAAO;GACvC,MAAM,MAAM,OAAO,OAAO;GAC1B,IAAI,IAAI,aAAA,GACN,MAAM,IAAI,MAAM,wCAAwC,IAAI,UAAU;GAExE,OAAO,KAAK,gBAAgB,MAAM;EACpC;CAEF;;;;;CAMA,eAAqC;EACnC,MAAM,SAAwB,CAAC;EAC/B,KAAK,MAAM,UAAU,KAAK,GAAG,gBAAgB,SAC3C,QAAQ,OAAO,OAAO,WAAtB;GACE,KAAK;GACL,KAAK;IACH,OAAO,KAAK;KACV,MAAM,OAAO,OAAO;KACpB,IAAI,OAAO;KACX,OAAO,OAAO,SAAS,OAAO,eAAe,OAAO;KACpD,aAAa,OAAO;IACtB,CAAC;IACD;GACF,KAAK,OAAO;IACV,MAAM,MAAM,KAAK,gBAAgB,MAAM;IACvC,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAK;KAAE,MAAM;KAAO,GAAG;IAAI,CAAC;IAC1D;GACF;GACA,SAEE;EACJ;EAEF,OAAO;CACT;;;;;;;;;;;CAYA,MAAa,MAAM,MAAc,UAAkB,KAAwC;EACzF,IAAI;GACF,IAAI;GACJ,IAAI,KAAK,GAAG,cAAc,SAAS,GAAG;IACpC,MAAM,UAAU,KAAK;IAGrB,KADE,QAAQ,KAAA,IAAY,KAAA,IAAY,KAAK,aAAa,CAAC,CAAC,MAAM,MAAM,EAAE,OAAO,GAAG,CAAC,EAAE,UAC/D,SAChB,QAAQ,MAAM,KAAK,GAAG,eAAe,QAAQ;SACxC,IAAI,QAAQ,OACjB,QACE,QAAQ,KAAA,IACJ,MAAM,KAAK,GAAG,WAAW,MAAM,QAAQ,IACvC,MAAM,KAAK,GAAG,WAAW,MAAM,UAAU,EAAE,IAAI,CAAC;SACjD,IAAI,QAAQ,OACjB,QAAQ,MAAM,KAAK,GAAG,eAAe,QAAQ;SAE7C,MAAM,IAAI,MAAM,wDAAwD;GAE5E,OACE,QAAQ,MAAM,KAAK,GAAG,YAAY,OAAO,KAAK,GAAG,KAAK,cAAc,GAAG,EACrE,eAAe,WAAW,OAAO,KAAK,OAAO,MAAM,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAChF,CAAC;GAEH,MAAM,YAAA,GAAA,2BAAA,SAAA,CAAoB,KAAK;GAC/B,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,aAAa;GAClD,OAAO,EAAE,SAAS;EACpB,SAAS,GAAQ;GACf,IAAI,EAAE,SAAS,mBAAmB,MAAM,IAAIC,eAAAA,qBAAqB,EAAE,OAAO;GAC1E,MAAM,IAAI,MAAM,CAAC;EACnB;CACF;;;;;CAMA,MAAa,cAAc,KAAwC;EACjE,MAAM,UACJ,QAAQ,KAAA,IAAY,MAAM,KAAK,GAAG,cAAc,IAAI,MAAM,KAAK,GAAG,cAAc,GAAG;EACrF,OAAO;GACL,MAAM;GACN,OAAO,QAAQ;GACf,WAAW,QAAQ;GACnB,cAAc,QAAQ;EACxB;CACF;;;;CAKA,MAAa,SAAS,SAGO;EAC3B,IAAI;GACF,MAAM,WACJ,QAAQ,QAAQ,KAAA,IACZ,MAAM,KAAK,GAAG,SAAS,QAAQ,aAAa,IAC5C,MAAM,KAAK,GAAG,SAAS,QAAQ,eAAe,QAAQ,GAAG;GAC/D,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,aAAa;GAClD,OAAO,EAAE,SAAS;EACpB,SAAS,GAAQ;GACf,IAAI,EAAE,SAAS,mBAAmB,MAAM,IAAIA,eAAAA,qBAAqB,EAAE,OAAO;GAC1E,MAAM,IAAI,MAAM,CAAC;EACnB;CACF;AACF"}

package/dist/core/unauth_client.d.ts

@@ -3,16 +3,16 @@ import { AuthInformation, PlClientConfig } from "./config.js";
 import { BackendCapability } from "./capabilities.js";
 import { LLPlClient } from "./ll_client.js";
 import { MiLogger } from "@milaboratories/ts-helpers";
-
 //#region src/core/unauth_client.d.ts
 /** Login-flow shape advertised by the backend for a given SSO method. Extension
  * point: future flow variants (e.g. backend-driven) sit alongside `public_pkce`. */
-type SSOFlowType = "public_pkce";
+export type SSOFlowType = "public_pkce";
 /** Typed projection of `AuthAPI.ListMethods.SSOAuthMethod` for desktop consumption.
  * Carries everything needed to drive the PKCE flow + diagnostics fields the renderer
  * may surface (`userIdClaim`, `groupsClaim`). */
-type SSOAuthMethod = {
+export type SSOAuthMethod = {
   id: string;
+  title: string;
   description: string;
   issuer: string;
   clientId: string;
@@ -31,7 +31,7 @@ type SSOAuthMethod = {
 };
 /** Server-issued material returned by {@link UnauthenticatedPlClient.beginSSOLogin}.
  * Discriminated on `flow`; future flow variants extend the union. */
-type SSOLoginAttempt = {
+export type SSOLoginAttempt = {
   flow: "public_pkce";
   nonce: string;
   expiresAt: Date;
@@ -41,8 +41,24 @@ type SSOLoginAttempt = {
    * desktop exchanges the code as a confidential client. */
   clientSecret?: string;
 };
+/** One login method the backend advertises, of any kind. Every advertised method keeps its own
+ * `id`, `title`, `description` and kind. Two same-kind methods, such as two LDAP directories, are
+ * two entries a caller can name apart and never collapsed into one. See {@link UnauthenticatedPlClient.loginMethods}. */
+export type LoginMethod = {
+  kind: "basic";
+  id: string;
+  title: string;
+  description: string;
+} | {
+  kind: "token";
+  id: string;
+  title: string;
+  description: string;
+} | ({
+  kind: "sso";
+} & SSOAuthMethod);
 /** Primarily used for initial authentication (login) */
-declare class UnauthenticatedPlClient {
+export declare class UnauthenticatedPlClient {
   readonly ll: LLPlClient;
   private constructor();
   static build(configOrAddress: PlClientConfig | string, ops?: {
@@ -54,33 +70,50 @@ declare class UnauthenticatedPlClient {
   hasCapability(capability: BackendCapability): boolean;
   /** Classifies the advertised authentication methods by credential scheme.
    * On legacy backends (no auth:v2) the typed oneof is empty; callers fall through to {@link login}
-   * which uses the legacy GetJWTToken path. SSO is surfaced via {@link ssoConfig}, not here. */
+   * which uses the legacy GetJWTToken path.
+   * @deprecated collapses every basic-kind method into one boolean; use {@link loginMethods} to
+   * see each advertised method's own id. `login()` still reads this to choose the credential path. */
   get supportedAuthSchemes(): {
     basic: boolean;
     token: boolean;
   };
+  /** Builds the {@link SSOAuthMethod} projection an advertised SSO entry carries, or `undefined`
+   * for a flow no client here can drive. Shared by {@link ssoConfig} and {@link loginMethods},
+   * which each apply their own rule for an unsupported flow. */
+  private toSSOAuthMethod;
   /** Projection of the first advertised SSO method, derived from {@link authMethodsSync}.
-   * v1: at most one SSO method per deployment, so callers do not need to discriminate. */
+   * v1: at most one SSO method per deployment, so callers do not need to discriminate.
+   * @deprecated surfaces only the first advertised SSO method; use {@link loginMethods} to see
+   * every advertised method, of every kind. */
   ssoConfig(): SSOAuthMethod | undefined;
-  /** Login with username+password.
+  /** Every login method the backend advertises, of every kind, in advertised order, each
+   * keeping its own `id`, `title`, `description` and kind. An entry with no usable method arm, or an
+   * SSO entry whose flow no client here can drive, is dropped rather than failing the whole
+   * list, which is why this accessor skips where {@link ssoConfig} throws. */
+  loginMethods(): LoginMethod[];
+  /** Login with username and password.
    *
-   * On auth:v2 backends the client inspects the advertised AuthMethods:
-   *   - if basic auth is offered, sends {@link LLPlClient.loginBasic};
-   *   - if only token auth is offered, treats `password` as an opaque bearer token and
-   *     sends {@link LLPlClient.loginWithToken} (so deployments configured for static-token
-   *     auth still log in without the caller switching methods).
+   * Routes to {@link LLPlClient.loginBasic} or {@link LLPlClient.loginWithToken} based on the
+   * advertised method `idP` names. On legacy backends, uses GetJWTToken with Basic header.
    *
-   * On legacy backends (no auth:v2) it falls through to GetJWTToken with the Basic header,
-   * preserving original behavior. */
-  login(user: string, password: string): Promise<AuthInformation>;
+   * `idP` names the advertised method. A named basic-kind method routes to the basic branch;
+   * a named token-kind method routes to the token branch even when the backend also advertises
+   * a basic method — the token wire carries no selector, so the id itself is dropped there and
+   * only the branch choice is kept. Omitted, or naming no advertised method, falls back to
+   * today's first-match behavior: basic wins over token when both are advertised. */
+  login(user: string, password: string, idP?: string): Promise<AuthInformation>;
   /** Request fresh server-issued login material. v1 only emits the public-PKCE flow;
-   * desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. */
-  beginSSOLogin(): Promise<SSOLoginAttempt>;
-  /** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. */
+   * desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. `idP` names
+   * the advertised SSO method to route to; omitted, the backend keeps its current first-match
+   * behaviour. */
+  beginSSOLogin(idP?: string): Promise<SSOLoginAttempt>;
+  /** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. `idP` names
+   * the advertised SSO method to route to; omitted, the backend keeps its current first-match
+   * behaviour. */
   loginSSO(payload: {
     tokenResponse: Uint8Array;
+    idP?: string;
   }): Promise<AuthInformation>;
 }
 //#endregion
-export { SSOAuthMethod, SSOFlowType, SSOLoginAttempt, UnauthenticatedPlClient };
 //# sourceMappingURL=unauth_client.d.ts.map

package/dist/core/unauth_client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unauth_client.d.ts","names":[],"sources":["../../src/core/unauth_client.ts"],"mappings":";;;;;;;;;KAaY,WAAA;;;;KAKA,aAAA;EACV,EAAA;EACA,WAAA;EACA,MAAA;EACA,QAAA;EACA,MAAA;EACA,QAAA;EACA,MAAA;EACA,aAAA;EACA,kBAAA;EACA,WAAA;EACA,WAAA;EACA,QAAA,EAAU,WAAW;EAHrB;;;EAOA,UAAA;AAAA;;;KAKU,eAAA;EACV,IAAA;EACA,KAAA;EACA,SAAA,EAAW,IAAI;EAAA;;;;EAKf,YAAA;AAAA;;cAIW,uBAAA;EAAA,SACK,EAAA,EAAI,UAAA;EAAA,QAEb,WAAA;EAAA,OAIa,KAAA,CAClB,eAAA,EAAiB,cAAA,WACjB,GAAA;IAAQ,MAAA,GAAS,QAAA;EAAA,IAChB,OAAA,CAAQ,uBAAA;EAKE,IAAA,IAAQ,OAAA,CAAQ,4BAAA;EAIhB,WAAA,IAAe,OAAA,CAAQ,4BAAA;EAIvB,WAAA,IAAe,OAAA;EAIrB,aAAA,CAAc,UAAA,EAAY,iBAAA;EAZZ;;;EAAA,IAmBV,oBAAA;IAA0B,KAAA;IAAgB,KAAA;EAAA;EA+CD;;EApC7C,SAAA,IAAa,aAAA;EA2E4B;;;;;;;;;;EAvCnC,KAAA,CAAM,IAAA,UAAc,QAAA,WAAmB,OAAA,CAAQ,eAAA;EAxElD;;EAoGG,aAAA,IAAiB,OAAA,CAAQ,eAAA;EAnGnC;EA8GU,QAAA,CAAS,OAAA;IAAW,aAAA,EAAe,UAAA;EAAA,IAAe,OAAA,CAAQ,eAAA;AAAA"}
+{"version":3,"file":"unauth_client.d.ts","names":[],"sources":["../../src/core/unauth_client.ts"],"mappings":";;;;;;;;YAaY;;;;YAKA;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,UAAU;;;;EAIV;;;;YAKU;EACV;EACA;EACA,WAAW;;;;;EAKX;;;;;YAMU;EACN;EAAe;EAAY;EAAe;;EAC1C;EAAe;EAAY;EAAe;;EACzC;IAAgB;;qBAGV;WACK,IAAI;UAEb;SAIa,MAClB,iBAAiB,yBACjB;IAAQ,SAAS;MAChB,QAAQ;EAKE,QAAQ,QAAQ;EAIhB,eAAe,QAAQ;EAIvB,eAAe;EAIrB,cAAc,YAAY;;;;;;MAStB;IAA0B;IAAgB;;;;;UAY7C;;;;;EA4BD,aAAa;;;;;EAgBb,gBAAgB;;;;;;;;;;;EAoCV,MAAM,cAAc,kBAAkB,eAAe,QAAQ;;;;;EAqC7D,cAAc,eAAe,QAAQ;;;;EAcrC,SAAS;IACpB,eAAe;IACf;MACE,QAAQ"}

package/dist/core/unauth_client.js

@@ -26,7 +26,9 @@ var UnauthenticatedPlClient = class UnauthenticatedPlClient {
 	}
 	/** Classifies the advertised authentication methods by credential scheme.
 	* On legacy backends (no auth:v2) the typed oneof is empty; callers fall through to {@link login}
-	* which uses the legacy GetJWTToken path. SSO is surfaced via {@link ssoConfig}, not here. */
+	* which uses the legacy GetJWTToken path.
+	* @deprecated collapses every basic-kind method into one boolean; use {@link loginMethods} to
+	* see each advertised method's own id. `login()` still reads this to choose the credential path. */
 	get supportedAuthSchemes() {
 		const result = {
 			basic: false,
@@ -36,46 +38,87 @@ var UnauthenticatedPlClient = class UnauthenticatedPlClient {
 		else if (m.method.oneofKind === "token") result.token = true;
 		return result;
 	}
+	/** Builds the {@link SSOAuthMethod} projection an advertised SSO entry carries, or `undefined`
+	* for a flow no client here can drive. Shared by {@link ssoConfig} and {@link loginMethods},
+	* which each apply their own rule for an unsupported flow. */
+	toSSOAuthMethod(method) {
+		if (method.method.oneofKind !== "sso") return void 0;
+		const sso = method.method.sso;
+		if (sso.flowType !== 0) return void 0;
+		return {
+			id: method.id,
+			title: method.title || method.description || method.id,
+			description: method.description,
+			issuer: sso.issuer,
+			clientId: sso.clientId,
+			scopes: sso.scopes,
+			resource: sso.resource,
+			prompt: sso.prompt,
+			redirectPorts: sso.redirectPorts,
+			subjectTokenSource: sso.subjectTokenSource,
+			userIdClaim: sso.userIdClaim,
+			groupsClaim: sso.groupsClaim,
+			accessType: sso.accessType || void 0,
+			flowType: "public_pkce"
+		};
+	}
 	/** Projection of the first advertised SSO method, derived from {@link authMethodsSync}.
-	* v1: at most one SSO method per deployment, so callers do not need to discriminate. */
+	* v1: at most one SSO method per deployment, so callers do not need to discriminate.
+	* @deprecated surfaces only the first advertised SSO method; use {@link loginMethods} to see
+	* every advertised method, of every kind. */
 	ssoConfig() {
 		for (const method of this.ll.authMethodsSync.methods) {
 			if (method.method.oneofKind !== "sso") continue;
 			const sso = method.method.sso;
 			if (sso.flowType !== 0) throw new Error(`ssoConfig: unsupported SSO flow type ${sso.flowType}`);
-			return {
-				id: method.id,
-				description: method.description,
-				issuer: sso.issuer,
-				clientId: sso.clientId,
-				scopes: sso.scopes,
-				resource: sso.resource,
-				prompt: sso.prompt,
-				redirectPorts: sso.redirectPorts,
-				subjectTokenSource: sso.subjectTokenSource,
-				userIdClaim: sso.userIdClaim,
-				groupsClaim: sso.groupsClaim,
-				accessType: sso.accessType || void 0,
-				flowType: "public_pkce"
-			};
+			return this.toSSOAuthMethod(method);
+		}
+	}
+	/** Every login method the backend advertises, of every kind, in advertised order, each
+	* keeping its own `id`, `title`, `description` and kind. An entry with no usable method arm, or an
+	* SSO entry whose flow no client here can drive, is dropped rather than failing the whole
+	* list, which is why this accessor skips where {@link ssoConfig} throws. */
+	loginMethods() {
+		const picked = [];
+		for (const method of this.ll.authMethodsSync.methods) switch (method.method.oneofKind) {
+			case "basic":
+			case "token":
+				picked.push({
+					kind: method.method.oneofKind,
+					id: method.id,
+					title: method.title || method.description || method.id,
+					description: method.description
+				});
+				break;
+			case "sso": {
+				const sso = this.toSSOAuthMethod(method);
+				if (sso !== void 0) picked.push({
+					kind: "sso",
+					...sso
+				});
+				break;
+			}
+			default: break;
 		}
+		return picked;
 	}
-	/** Login with username+password.
+	/** Login with username and password.
 	*
-	* On auth:v2 backends the client inspects the advertised AuthMethods:
-	*   - if basic auth is offered, sends {@link LLPlClient.loginBasic};
-	*   - if only token auth is offered, treats `password` as an opaque bearer token and
-	*     sends {@link LLPlClient.loginWithToken} (so deployments configured for static-token
-	*     auth still log in without the caller switching methods).
+	* Routes to {@link LLPlClient.loginBasic} or {@link LLPlClient.loginWithToken} based on the
+	* advertised method `idP` names. On legacy backends, uses GetJWTToken with Basic header.
 	*
-	* On legacy backends (no auth:v2) it falls through to GetJWTToken with the Basic header,
-	* preserving original behavior. */
-	async login(user, password) {
+	* `idP` names the advertised method. A named basic-kind method routes to the basic branch;
+	* a named token-kind method routes to the token branch even when the backend also advertises
+	* a basic method — the token wire carries no selector, so the id itself is dropped there and
+	* only the branch choice is kept. Omitted, or naming no advertised method, falls back to
+	* today's first-match behavior: basic wins over token when both are advertised. */
+	async login(user, password, idP) {
 		try {
 			let token;
 			if (this.ll.hasCapability("auth:v2")) {
 				const schemes = this.supportedAuthSchemes;
-				if (schemes.basic) token = await this.ll.loginBasic(user, password);
+				if ((idP === void 0 ? void 0 : this.loginMethods().find((m) => m.id === idP)?.kind) === "token") token = await this.ll.loginWithToken(password);
+				else if (schemes.basic) token = idP === void 0 ? await this.ll.loginBasic(user, password) : await this.ll.loginBasic(user, password, { idP });
 				else if (schemes.token) token = await this.ll.loginWithToken(password);
 				else throw new Error("backend advertises no supported authentication methods");
 			} else token = await this.ll.getJwtToken(BigInt(this.ll.conf.authTTLSeconds), { authorization: "Basic " + Buffer.from(user + ":" + password).toString("base64") });
@@ -88,9 +131,11 @@ var UnauthenticatedPlClient = class UnauthenticatedPlClient {
 		}
 	}
 	/** Request fresh server-issued login material. v1 only emits the public-PKCE flow;
-	* desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. */
-	async beginSSOLogin() {
-		const attempt = await this.ll.beginSSOLogin();
+	* desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. `idP` names
+	* the advertised SSO method to route to; omitted, the backend keeps its current first-match
+	* behaviour. */
+	async beginSSOLogin(idP) {
+		const attempt = idP === void 0 ? await this.ll.beginSSOLogin() : await this.ll.beginSSOLogin(idP);
 		return {
 			flow: "public_pkce",
 			nonce: attempt.nonce,
@@ -98,10 +143,12 @@ var UnauthenticatedPlClient = class UnauthenticatedPlClient {
 			clientSecret: attempt.clientSecret
 		};
 	}
-	/** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. */
+	/** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. `idP` names
+	* the advertised SSO method to route to; omitted, the backend keeps its current first-match
+	* behaviour. */
 	async loginSSO(payload) {
 		try {
-			const jwtToken = await this.ll.loginSSO(payload.tokenResponse);
+			const jwtToken = payload.idP === void 0 ? await this.ll.loginSSO(payload.tokenResponse) : await this.ll.loginSSO(payload.tokenResponse, payload.idP);
 			if (jwtToken === "") throw new Error("empty token");
 			return { jwtToken };
 		} catch (e) {

package/dist/core/unauth_client.js.map

@@ -1 +1 @@
-{"version":3,"file":"unauth_client.js","names":[],"sources":["../../src/core/unauth_client.ts"],"sourcesContent":["import type { AuthInformation, PlClientConfig } from \"./config\";\nimport {\n  type AuthAPI_ListMethods_Response,\n  type MaintenanceAPI_Ping_Response,\n  AuthAPI_ListMethods_SSOAuthMethod_FlowType,\n} from \"../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api\";\nimport { LLPlClient } from \"./ll_client\";\nimport { type MiLogger, notEmpty } from \"@milaboratories/ts-helpers\";\nimport { UnauthenticatedError } from \"./errors\";\nimport type { BackendCapability } from \"./capabilities\";\n\n/** Login-flow shape advertised by the backend for a given SSO method. Extension\n * point: future flow variants (e.g. backend-driven) sit alongside `public_pkce`. */\nexport type SSOFlowType = \"public_pkce\";\n\n/** Typed projection of `AuthAPI.ListMethods.SSOAuthMethod` for desktop consumption.\n * Carries everything needed to drive the PKCE flow + diagnostics fields the renderer\n * may surface (`userIdClaim`, `groupsClaim`). */\nexport type SSOAuthMethod = {\n  id: string;\n  description: string;\n  issuer: string;\n  clientId: string;\n  scopes: string;\n  resource: string;\n  prompt: string;\n  redirectPorts: number[];\n  subjectTokenSource: string;\n  userIdClaim: string;\n  groupsClaim: string;\n  flowType: SSOFlowType;\n  /** OIDC `access_type` auth-request param (\"online\" | \"offline\"). Google-specific:\n   * \"offline\" makes Google issue a refresh token; other IdPs ignore it. Absent when\n   * the server does not set it — never send an empty string to the IdP. */\n  accessType?: string;\n};\n\n/** Server-issued material returned by {@link UnauthenticatedPlClient.beginSSOLogin}.\n * Discriminated on `flow`; future flow variants extend the union. */\nexport type SSOLoginAttempt = {\n  flow: \"public_pkce\";\n  nonce: string;\n  expiresAt: Date;\n  /** Confidential-client secret for the IdP token exchange; absent for public clients.\n   * Google's OIDC has no public-client mode — it requires a client_secret at the token\n   * endpoint even with PKCE — so for Google the backend forwards its secret here and the\n   * desktop exchanges the code as a confidential client. */\n  clientSecret?: string;\n};\n\n/** Primarily used for initial authentication (login) */\nexport class UnauthenticatedPlClient {\n  public readonly ll: LLPlClient;\n\n  private constructor(ll: LLPlClient) {\n    this.ll = ll;\n  }\n\n  public static async build(\n    configOrAddress: PlClientConfig | string,\n    ops?: { logger?: MiLogger },\n  ): Promise<UnauthenticatedPlClient> {\n    const ll = await LLPlClient.build(configOrAddress, ops);\n    return new UnauthenticatedPlClient(ll);\n  }\n\n  public async ping(): Promise<MaintenanceAPI_Ping_Response> {\n    return await this.ll.ping();\n  }\n\n  public async authMethods(): Promise<AuthAPI_ListMethods_Response> {\n    return await this.ll.authMethods();\n  }\n\n  public async requireAuth(): Promise<boolean> {\n    return (await this.authMethods()).methods.length > 0;\n  }\n\n  public hasCapability(capability: BackendCapability): boolean {\n    return this.ll.hasCapability(capability);\n  }\n\n  /** Classifies the advertised authentication methods by credential scheme.\n   * On legacy backends (no auth:v2) the typed oneof is empty; callers fall through to {@link login}\n   * which uses the legacy GetJWTToken path. SSO is surfaced via {@link ssoConfig}, not here. */\n  public get supportedAuthSchemes(): { basic: boolean; token: boolean } {\n    const result = { basic: false, token: false };\n    for (const m of this.ll.authMethodsSync.methods) {\n      if (m.method.oneofKind === \"basic\") result.basic = true;\n      else if (m.method.oneofKind === \"token\") result.token = true;\n    }\n    return result;\n  }\n\n  /** Projection of the first advertised SSO method, derived from {@link authMethodsSync}.\n   * v1: at most one SSO method per deployment, so callers do not need to discriminate. */\n  public ssoConfig(): SSOAuthMethod | undefined {\n    for (const method of this.ll.authMethodsSync.methods) {\n      if (method.method.oneofKind !== \"sso\") continue;\n      const sso = method.method.sso;\n      if (sso.flowType !== AuthAPI_ListMethods_SSOAuthMethod_FlowType.PUBLIC_PKCE) {\n        throw new Error(`ssoConfig: unsupported SSO flow type ${sso.flowType}`);\n      }\n      return {\n        id: method.id,\n        description: method.description,\n        issuer: sso.issuer,\n        clientId: sso.clientId,\n        scopes: sso.scopes,\n        resource: sso.resource,\n        prompt: sso.prompt,\n        redirectPorts: sso.redirectPorts,\n        subjectTokenSource: sso.subjectTokenSource,\n        userIdClaim: sso.userIdClaim,\n        groupsClaim: sso.groupsClaim,\n        accessType: sso.accessType || undefined,\n        flowType: \"public_pkce\",\n      };\n    }\n    return undefined;\n  }\n\n  /** Login with username+password.\n   *\n   * On auth:v2 backends the client inspects the advertised AuthMethods:\n   *   - if basic auth is offered, sends {@link LLPlClient.loginBasic};\n   *   - if only token auth is offered, treats `password` as an opaque bearer token and\n   *     sends {@link LLPlClient.loginWithToken} (so deployments configured for static-token\n   *     auth still log in without the caller switching methods).\n   *\n   * On legacy backends (no auth:v2) it falls through to GetJWTToken with the Basic header,\n   * preserving original behavior. */\n  public async login(user: string, password: string): Promise<AuthInformation> {\n    try {\n      let token: string;\n      if (this.ll.hasCapability(\"auth:v2\")) {\n        const schemes = this.supportedAuthSchemes;\n        if (schemes.basic) {\n          token = await this.ll.loginBasic(user, password);\n        } else if (schemes.token) {\n          token = await this.ll.loginWithToken(password);\n        } else {\n          throw new Error(\"backend advertises no supported authentication methods\");\n        }\n      } else {\n        token = await this.ll.getJwtToken(BigInt(this.ll.conf.authTTLSeconds), {\n          authorization: \"Basic \" + Buffer.from(user + \":\" + password).toString(\"base64\"),\n        });\n      }\n      const jwtToken = notEmpty(token);\n      if (jwtToken === \"\") throw new Error(\"empty token\");\n      return { jwtToken };\n    } catch (e: any) {\n      if (e.code === \"UNAUTHENTICATED\") throw new UnauthenticatedError(e.message);\n      throw new Error(e);\n    }\n  }\n\n  /** Request fresh server-issued login material. v1 only emits the public-PKCE flow;\n   * desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. */\n  public async beginSSOLogin(): Promise<SSOLoginAttempt> {\n    const attempt = await this.ll.beginSSOLogin();\n    return {\n      flow: \"public_pkce\",\n      nonce: attempt.nonce,\n      expiresAt: attempt.expiresAt,\n      clientSecret: attempt.clientSecret,\n    };\n  }\n\n  /** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. */\n  public async loginSSO(payload: { tokenResponse: Uint8Array }): Promise<AuthInformation> {\n    try {\n      const jwtToken = await this.ll.loginSSO(payload.tokenResponse);\n      if (jwtToken === \"\") throw new Error(\"empty token\");\n      return { jwtToken };\n    } catch (e: any) {\n      if (e.code === \"UNAUTHENTICATED\") throw new UnauthenticatedError(e.message);\n      throw new Error(e);\n    }\n  }\n}\n"],"mappings":";;;;;;AAmDA,IAAa,0BAAb,MAAa,wBAAwB;CACnC;CAEA,YAAoB,IAAgB;EAClC,KAAK,KAAK;CACZ;CAEA,aAAoB,MAClB,iBACA,KACkC;EAElC,OAAO,IAAI,wBAAwB,MADlB,WAAW,MAAM,iBAAiB,GAAG,CACjB;CACvC;CAEA,MAAa,OAA8C;EACzD,OAAO,MAAM,KAAK,GAAG,KAAK;CAC5B;CAEA,MAAa,cAAqD;EAChE,OAAO,MAAM,KAAK,GAAG,YAAY;CACnC;CAEA,MAAa,cAAgC;EAC3C,QAAQ,MAAM,KAAK,YAAY,EAAA,CAAG,QAAQ,SAAS;CACrD;CAEA,cAAqB,YAAwC;EAC3D,OAAO,KAAK,GAAG,cAAc,UAAU;CACzC;;;;CAKA,IAAW,uBAA2D;EACpE,MAAM,SAAS;GAAE,OAAO;GAAO,OAAO;EAAM;EAC5C,KAAK,MAAM,KAAK,KAAK,GAAG,gBAAgB,SACtC,IAAI,EAAE,OAAO,cAAc,SAAS,OAAO,QAAQ;OAC9C,IAAI,EAAE,OAAO,cAAc,SAAS,OAAO,QAAQ;EAE1D,OAAO;CACT;;;CAIA,YAA8C;EAC5C,KAAK,MAAM,UAAU,KAAK,GAAG,gBAAgB,SAAS;GACpD,IAAI,OAAO,OAAO,cAAc,OAAO;GACvC,MAAM,MAAM,OAAO,OAAO;GAC1B,IAAI,IAAI,aAAA,GACN,MAAM,IAAI,MAAM,wCAAwC,IAAI,UAAU;GAExE,OAAO;IACL,IAAI,OAAO;IACX,aAAa,OAAO;IACpB,QAAQ,IAAI;IACZ,UAAU,IAAI;IACd,QAAQ,IAAI;IACZ,UAAU,IAAI;IACd,QAAQ,IAAI;IACZ,eAAe,IAAI;IACnB,oBAAoB,IAAI;IACxB,aAAa,IAAI;IACjB,aAAa,IAAI;IACjB,YAAY,IAAI,cAAc,KAAA;IAC9B,UAAU;GACZ;EACF;CAEF;;;;;;;;;;;CAYA,MAAa,MAAM,MAAc,UAA4C;EAC3E,IAAI;GACF,IAAI;GACJ,IAAI,KAAK,GAAG,cAAc,SAAS,GAAG;IACpC,MAAM,UAAU,KAAK;IACrB,IAAI,QAAQ,OACV,QAAQ,MAAM,KAAK,GAAG,WAAW,MAAM,QAAQ;SAC1C,IAAI,QAAQ,OACjB,QAAQ,MAAM,KAAK,GAAG,eAAe,QAAQ;SAE7C,MAAM,IAAI,MAAM,wDAAwD;GAE5E,OACE,QAAQ,MAAM,KAAK,GAAG,YAAY,OAAO,KAAK,GAAG,KAAK,cAAc,GAAG,EACrE,eAAe,WAAW,OAAO,KAAK,OAAO,MAAM,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAChF,CAAC;GAEH,MAAM,WAAW,SAAS,KAAK;GAC/B,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,aAAa;GAClD,OAAO,EAAE,SAAS;EACpB,SAAS,GAAQ;GACf,IAAI,EAAE,SAAS,mBAAmB,MAAM,IAAI,qBAAqB,EAAE,OAAO;GAC1E,MAAM,IAAI,MAAM,CAAC;EACnB;CACF;;;CAIA,MAAa,gBAA0C;EACrD,MAAM,UAAU,MAAM,KAAK,GAAG,cAAc;EAC5C,OAAO;GACL,MAAM;GACN,OAAO,QAAQ;GACf,WAAW,QAAQ;GACnB,cAAc,QAAQ;EACxB;CACF;;CAGA,MAAa,SAAS,SAAkE;EACtF,IAAI;GACF,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,QAAQ,aAAa;GAC7D,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,aAAa;GAClD,OAAO,EAAE,SAAS;EACpB,SAAS,GAAQ;GACf,IAAI,EAAE,SAAS,mBAAmB,MAAM,IAAI,qBAAqB,EAAE,OAAO;GAC1E,MAAM,IAAI,MAAM,CAAC;EACnB;CACF;AACF"}
+{"version":3,"file":"unauth_client.js","names":[],"sources":["../../src/core/unauth_client.ts"],"sourcesContent":["import type { AuthInformation, PlClientConfig } from \"./config\";\nimport {\n  type AuthAPI_ListMethods_Response,\n  type MaintenanceAPI_Ping_Response,\n  AuthAPI_ListMethods_SSOAuthMethod_FlowType,\n} from \"../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api\";\nimport { LLPlClient } from \"./ll_client\";\nimport { type MiLogger, notEmpty } from \"@milaboratories/ts-helpers\";\nimport { UnauthenticatedError } from \"./errors\";\nimport type { BackendCapability } from \"./capabilities\";\n\n/** Login-flow shape advertised by the backend for a given SSO method. Extension\n * point: future flow variants (e.g. backend-driven) sit alongside `public_pkce`. */\nexport type SSOFlowType = \"public_pkce\";\n\n/** Typed projection of `AuthAPI.ListMethods.SSOAuthMethod` for desktop consumption.\n * Carries everything needed to drive the PKCE flow + diagnostics fields the renderer\n * may surface (`userIdClaim`, `groupsClaim`). */\nexport type SSOAuthMethod = {\n  id: string;\n  title: string;\n  description: string;\n  issuer: string;\n  clientId: string;\n  scopes: string;\n  resource: string;\n  prompt: string;\n  redirectPorts: number[];\n  subjectTokenSource: string;\n  userIdClaim: string;\n  groupsClaim: string;\n  flowType: SSOFlowType;\n  /** OIDC `access_type` auth-request param (\"online\" | \"offline\"). Google-specific:\n   * \"offline\" makes Google issue a refresh token; other IdPs ignore it. Absent when\n   * the server does not set it — never send an empty string to the IdP. */\n  accessType?: string;\n};\n\n/** Server-issued material returned by {@link UnauthenticatedPlClient.beginSSOLogin}.\n * Discriminated on `flow`; future flow variants extend the union. */\nexport type SSOLoginAttempt = {\n  flow: \"public_pkce\";\n  nonce: string;\n  expiresAt: Date;\n  /** Confidential-client secret for the IdP token exchange; absent for public clients.\n   * Google's OIDC has no public-client mode — it requires a client_secret at the token\n   * endpoint even with PKCE — so for Google the backend forwards its secret here and the\n   * desktop exchanges the code as a confidential client. */\n  clientSecret?: string;\n};\n\n/** One login method the backend advertises, of any kind. Every advertised method keeps its own\n * `id`, `title`, `description` and kind. Two same-kind methods, such as two LDAP directories, are\n * two entries a caller can name apart and never collapsed into one. See {@link UnauthenticatedPlClient.loginMethods}. */\nexport type LoginMethod =\n  | { kind: \"basic\"; id: string; title: string; description: string }\n  | { kind: \"token\"; id: string; title: string; description: string }\n  | ({ kind: \"sso\" } & SSOAuthMethod);\n\n/** Primarily used for initial authentication (login) */\nexport class UnauthenticatedPlClient {\n  public readonly ll: LLPlClient;\n\n  private constructor(ll: LLPlClient) {\n    this.ll = ll;\n  }\n\n  public static async build(\n    configOrAddress: PlClientConfig | string,\n    ops?: { logger?: MiLogger },\n  ): Promise<UnauthenticatedPlClient> {\n    const ll = await LLPlClient.build(configOrAddress, ops);\n    return new UnauthenticatedPlClient(ll);\n  }\n\n  public async ping(): Promise<MaintenanceAPI_Ping_Response> {\n    return await this.ll.ping();\n  }\n\n  public async authMethods(): Promise<AuthAPI_ListMethods_Response> {\n    return await this.ll.authMethods();\n  }\n\n  public async requireAuth(): Promise<boolean> {\n    return (await this.authMethods()).methods.length > 0;\n  }\n\n  public hasCapability(capability: BackendCapability): boolean {\n    return this.ll.hasCapability(capability);\n  }\n\n  /** Classifies the advertised authentication methods by credential scheme.\n   * On legacy backends (no auth:v2) the typed oneof is empty; callers fall through to {@link login}\n   * which uses the legacy GetJWTToken path.\n   * @deprecated collapses every basic-kind method into one boolean; use {@link loginMethods} to\n   * see each advertised method's own id. `login()` still reads this to choose the credential path. */\n  public get supportedAuthSchemes(): { basic: boolean; token: boolean } {\n    const result = { basic: false, token: false };\n    for (const m of this.ll.authMethodsSync.methods) {\n      if (m.method.oneofKind === \"basic\") result.basic = true;\n      else if (m.method.oneofKind === \"token\") result.token = true;\n    }\n    return result;\n  }\n\n  /** Builds the {@link SSOAuthMethod} projection an advertised SSO entry carries, or `undefined`\n   * for a flow no client here can drive. Shared by {@link ssoConfig} and {@link loginMethods},\n   * which each apply their own rule for an unsupported flow. */\n  private toSSOAuthMethod(\n    method: AuthAPI_ListMethods_Response[\"methods\"][number],\n  ): SSOAuthMethod | undefined {\n    if (method.method.oneofKind !== \"sso\") return undefined;\n    const sso = method.method.sso;\n    if (sso.flowType !== AuthAPI_ListMethods_SSOAuthMethod_FlowType.PUBLIC_PKCE) return undefined;\n    return {\n      id: method.id,\n      title: method.title || method.description || method.id,\n      description: method.description,\n      issuer: sso.issuer,\n      clientId: sso.clientId,\n      scopes: sso.scopes,\n      resource: sso.resource,\n      prompt: sso.prompt,\n      redirectPorts: sso.redirectPorts,\n      subjectTokenSource: sso.subjectTokenSource,\n      userIdClaim: sso.userIdClaim,\n      groupsClaim: sso.groupsClaim,\n      accessType: sso.accessType || undefined,\n      flowType: \"public_pkce\",\n    };\n  }\n\n  /** Projection of the first advertised SSO method, derived from {@link authMethodsSync}.\n   * v1: at most one SSO method per deployment, so callers do not need to discriminate.\n   * @deprecated surfaces only the first advertised SSO method; use {@link loginMethods} to see\n   * every advertised method, of every kind. */\n  public ssoConfig(): SSOAuthMethod | undefined {\n    for (const method of this.ll.authMethodsSync.methods) {\n      if (method.method.oneofKind !== \"sso\") continue;\n      const sso = method.method.sso;\n      if (sso.flowType !== AuthAPI_ListMethods_SSOAuthMethod_FlowType.PUBLIC_PKCE) {\n        throw new Error(`ssoConfig: unsupported SSO flow type ${sso.flowType}`);\n      }\n      return this.toSSOAuthMethod(method);\n    }\n    return undefined;\n  }\n\n  /** Every login method the backend advertises, of every kind, in advertised order, each\n   * keeping its own `id`, `title`, `description` and kind. An entry with no usable method arm, or an\n   * SSO entry whose flow no client here can drive, is dropped rather than failing the whole\n   * list, which is why this accessor skips where {@link ssoConfig} throws. */\n  public loginMethods(): LoginMethod[] {\n    const picked: LoginMethod[] = [];\n    for (const method of this.ll.authMethodsSync.methods) {\n      switch (method.method.oneofKind) {\n        case \"basic\":\n        case \"token\":\n          picked.push({\n            kind: method.method.oneofKind,\n            id: method.id,\n            title: method.title || method.description || method.id,\n            description: method.description,\n          });\n          break;\n        case \"sso\": {\n          const sso = this.toSSOAuthMethod(method);\n          if (sso !== undefined) picked.push({ kind: \"sso\", ...sso });\n          break;\n        }\n        default:\n          // No arm at all — a legacy backend advertising nothing pickable.\n          break;\n      }\n    }\n    return picked;\n  }\n\n  /** Login with username and password.\n   *\n   * Routes to {@link LLPlClient.loginBasic} or {@link LLPlClient.loginWithToken} based on the\n   * advertised method `idP` names. On legacy backends, uses GetJWTToken with Basic header.\n   *\n   * `idP` names the advertised method. A named basic-kind method routes to the basic branch;\n   * a named token-kind method routes to the token branch even when the backend also advertises\n   * a basic method — the token wire carries no selector, so the id itself is dropped there and\n   * only the branch choice is kept. Omitted, or naming no advertised method, falls back to\n   * today's first-match behavior: basic wins over token when both are advertised. */\n  public async login(user: string, password: string, idP?: string): Promise<AuthInformation> {\n    try {\n      let token: string;\n      if (this.ll.hasCapability(\"auth:v2\")) {\n        const schemes = this.supportedAuthSchemes;\n        const namedKind =\n          idP === undefined ? undefined : this.loginMethods().find((m) => m.id === idP)?.kind;\n        if (namedKind === \"token\") {\n          token = await this.ll.loginWithToken(password);\n        } else if (schemes.basic) {\n          token =\n            idP === undefined\n              ? await this.ll.loginBasic(user, password)\n              : await this.ll.loginBasic(user, password, { idP });\n        } else if (schemes.token) {\n          token = await this.ll.loginWithToken(password);\n        } else {\n          throw new Error(\"backend advertises no supported authentication methods\");\n        }\n      } else {\n        token = await this.ll.getJwtToken(BigInt(this.ll.conf.authTTLSeconds), {\n          authorization: \"Basic \" + Buffer.from(user + \":\" + password).toString(\"base64\"),\n        });\n      }\n      const jwtToken = notEmpty(token);\n      if (jwtToken === \"\") throw new Error(\"empty token\");\n      return { jwtToken };\n    } catch (e: any) {\n      if (e.code === \"UNAUTHENTICATED\") throw new UnauthenticatedError(e.message);\n      throw new Error(e);\n    }\n  }\n\n  /** Request fresh server-issued login material. v1 only emits the public-PKCE flow;\n   * desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. `idP` names\n   * the advertised SSO method to route to; omitted, the backend keeps its current first-match\n   * behaviour. */\n  public async beginSSOLogin(idP?: string): Promise<SSOLoginAttempt> {\n    const attempt =\n      idP === undefined ? await this.ll.beginSSOLogin() : await this.ll.beginSSOLogin(idP);\n    return {\n      flow: \"public_pkce\",\n      nonce: attempt.nonce,\n      expiresAt: attempt.expiresAt,\n      clientSecret: attempt.clientSecret,\n    };\n  }\n\n  /** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. `idP` names\n   * the advertised SSO method to route to; omitted, the backend keeps its current first-match\n   * behaviour. */\n  public async loginSSO(payload: {\n    tokenResponse: Uint8Array;\n    idP?: string;\n  }): Promise<AuthInformation> {\n    try {\n      const jwtToken =\n        payload.idP === undefined\n          ? await this.ll.loginSSO(payload.tokenResponse)\n          : await this.ll.loginSSO(payload.tokenResponse, payload.idP);\n      if (jwtToken === \"\") throw new Error(\"empty token\");\n      return { jwtToken };\n    } catch (e: any) {\n      if (e.code === \"UNAUTHENTICATED\") throw new UnauthenticatedError(e.message);\n      throw new Error(e);\n    }\n  }\n}\n"],"mappings":";;;;;;AA4DA,IAAa,0BAAb,MAAa,wBAAwB;CACnC;CAEA,YAAoB,IAAgB;EAClC,KAAK,KAAK;CACZ;CAEA,aAAoB,MAClB,iBACA,KACkC;EAElC,OAAO,IAAI,wBAAwB,MADlB,WAAW,MAAM,iBAAiB,GAAG,CACjB;CACvC;CAEA,MAAa,OAA8C;EACzD,OAAO,MAAM,KAAK,GAAG,KAAK;CAC5B;CAEA,MAAa,cAAqD;EAChE,OAAO,MAAM,KAAK,GAAG,YAAY;CACnC;CAEA,MAAa,cAAgC;EAC3C,QAAQ,MAAM,KAAK,YAAY,EAAA,CAAG,QAAQ,SAAS;CACrD;CAEA,cAAqB,YAAwC;EAC3D,OAAO,KAAK,GAAG,cAAc,UAAU;CACzC;;;;;;CAOA,IAAW,uBAA2D;EACpE,MAAM,SAAS;GAAE,OAAO;GAAO,OAAO;EAAM;EAC5C,KAAK,MAAM,KAAK,KAAK,GAAG,gBAAgB,SACtC,IAAI,EAAE,OAAO,cAAc,SAAS,OAAO,QAAQ;OAC9C,IAAI,EAAE,OAAO,cAAc,SAAS,OAAO,QAAQ;EAE1D,OAAO;CACT;;;;CAKA,gBACE,QAC2B;EAC3B,IAAI,OAAO,OAAO,cAAc,OAAO,OAAO,KAAA;EAC9C,MAAM,MAAM,OAAO,OAAO;EAC1B,IAAI,IAAI,aAAA,GAAqE,OAAO,KAAA;EACpF,OAAO;GACL,IAAI,OAAO;GACX,OAAO,OAAO,SAAS,OAAO,eAAe,OAAO;GACpD,aAAa,OAAO;GACpB,QAAQ,IAAI;GACZ,UAAU,IAAI;GACd,QAAQ,IAAI;GACZ,UAAU,IAAI;GACd,QAAQ,IAAI;GACZ,eAAe,IAAI;GACnB,oBAAoB,IAAI;GACxB,aAAa,IAAI;GACjB,aAAa,IAAI;GACjB,YAAY,IAAI,cAAc,KAAA;GAC9B,UAAU;EACZ;CACF;;;;;CAMA,YAA8C;EAC5C,KAAK,MAAM,UAAU,KAAK,GAAG,gBAAgB,SAAS;GACpD,IAAI,OAAO,OAAO,cAAc,OAAO;GACvC,MAAM,MAAM,OAAO,OAAO;GAC1B,IAAI,IAAI,aAAA,GACN,MAAM,IAAI,MAAM,wCAAwC,IAAI,UAAU;GAExE,OAAO,KAAK,gBAAgB,MAAM;EACpC;CAEF;;;;;CAMA,eAAqC;EACnC,MAAM,SAAwB,CAAC;EAC/B,KAAK,MAAM,UAAU,KAAK,GAAG,gBAAgB,SAC3C,QAAQ,OAAO,OAAO,WAAtB;GACE,KAAK;GACL,KAAK;IACH,OAAO,KAAK;KACV,MAAM,OAAO,OAAO;KACpB,IAAI,OAAO;KACX,OAAO,OAAO,SAAS,OAAO,eAAe,OAAO;KACpD,aAAa,OAAO;IACtB,CAAC;IACD;GACF,KAAK,OAAO;IACV,MAAM,MAAM,KAAK,gBAAgB,MAAM;IACvC,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAK;KAAE,MAAM;KAAO,GAAG;IAAI,CAAC;IAC1D;GACF;GACA,SAEE;EACJ;EAEF,OAAO;CACT;;;;;;;;;;;CAYA,MAAa,MAAM,MAAc,UAAkB,KAAwC;EACzF,IAAI;GACF,IAAI;GACJ,IAAI,KAAK,GAAG,cAAc,SAAS,GAAG;IACpC,MAAM,UAAU,KAAK;IAGrB,KADE,QAAQ,KAAA,IAAY,KAAA,IAAY,KAAK,aAAa,CAAC,CAAC,MAAM,MAAM,EAAE,OAAO,GAAG,CAAC,EAAE,UAC/D,SAChB,QAAQ,MAAM,KAAK,GAAG,eAAe,QAAQ;SACxC,IAAI,QAAQ,OACjB,QACE,QAAQ,KAAA,IACJ,MAAM,KAAK,GAAG,WAAW,MAAM,QAAQ,IACvC,MAAM,KAAK,GAAG,WAAW,MAAM,UAAU,EAAE,IAAI,CAAC;SACjD,IAAI,QAAQ,OACjB,QAAQ,MAAM,KAAK,GAAG,eAAe,QAAQ;SAE7C,MAAM,IAAI,MAAM,wDAAwD;GAE5E,OACE,QAAQ,MAAM,KAAK,GAAG,YAAY,OAAO,KAAK,GAAG,KAAK,cAAc,GAAG,EACrE,eAAe,WAAW,OAAO,KAAK,OAAO,MAAM,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAChF,CAAC;GAEH,MAAM,WAAW,SAAS,KAAK;GAC/B,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,aAAa;GAClD,OAAO,EAAE,SAAS;EACpB,SAAS,GAAQ;GACf,IAAI,EAAE,SAAS,mBAAmB,MAAM,IAAI,qBAAqB,EAAE,OAAO;GAC1E,MAAM,IAAI,MAAM,CAAC;EACnB;CACF;;;;;CAMA,MAAa,cAAc,KAAwC;EACjE,MAAM,UACJ,QAAQ,KAAA,IAAY,MAAM,KAAK,GAAG,cAAc,IAAI,MAAM,KAAK,GAAG,cAAc,GAAG;EACrF,OAAO;GACL,MAAM;GACN,OAAO,QAAQ;GACf,WAAW,QAAQ;GACnB,cAAc,QAAQ;EACxB;CACF;;;;CAKA,MAAa,SAAS,SAGO;EAC3B,IAAI;GACF,MAAM,WACJ,QAAQ,QAAQ,KAAA,IACZ,MAAM,KAAK,GAAG,SAAS,QAAQ,aAAa,IAC5C,MAAM,KAAK,GAAG,SAAS,QAAQ,eAAe,QAAQ,GAAG;GAC/D,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,aAAa;GAClD,OAAO,EAAE,SAAS;EACpB,SAAS,GAAQ;GACf,IAAI,EAAE,SAAS,mBAAmB,MAAM,IAAI,qBAAqB,EAAE,OAAO;GAC1E,MAAM,IAAI,MAAM,CAAC;EACnB;CACF;AACF"}

package/dist/core/user_resources.cjs

@@ -126,6 +126,29 @@ var UserResources = class {
 	async listUsers() {
 		return (await this.ll.listUsers()).map((user) => ({ login: user.login }));
 	}
+	/**
+	* Deletes a user account: the record, every identity-index entry that resolves to it (its login,
+	* its email, and any alternative of either), every grant it holds, and its root resource — and
+	* with the root, everything still attached under it.
+	*
+	* Exists for the duplicate account one person can end up with — an identity that could not be
+	* matched across a provider cutover, or one minted before the backend started refusing two
+	* records for one identity. The spare record shows up wherever users are listed and its projects
+	* keep taking part in deduplication.
+	*
+	* Destructive and irreversible. Re-attach anything worth keeping to another user's root before
+	* calling — `pl-cli admin delete-user` does both steps in order. Requires admin/controller
+	* credentials; gRPC-only, like {@link listUsers}.
+	*/
+	async deleteUser(login) {
+		const resp = await this.ll.deleteUser(login);
+		return {
+			userRootId: resp.userRootId === 0n ? void 0 : resp.userRootId,
+			userRootDeleted: resp.userRootDeleted,
+			revokedGrants: resp.revokedGrants,
+			removedIdentityIndexEntries: resp.removedIdentityIndexEntries
+		};
+	}
 	async getUserRootViaRpc(opts = {}) {
 		const resp = await this.ll.getUserRoot({
 			login: opts.login,