@milaboratories/pl-client 3.15.0 → 3.16.1

package/dist/core/unauth_client.d.ts

@@ -12,6 +12,7 @@ export type SSOFlowType = "public_pkce";
  * may surface (`userIdClaim`, `groupsClaim`). */
 export type SSOAuthMethod = {
   id: string;
+  title: string;
   description: string;
   issuer: string;
   clientId: string;
@@ -40,6 +41,22 @@ export type SSOLoginAttempt = {
    * desktop exchanges the code as a confidential client. */
   clientSecret?: string;
 };
+/** One login method the backend advertises, of any kind. Every advertised method keeps its own
+ * `id`, `title`, `description` and kind. Two same-kind methods, such as two LDAP directories, are
+ * two entries a caller can name apart and never collapsed into one. See {@link UnauthenticatedPlClient.loginMethods}. */
+export type LoginMethod = {
+  kind: "basic";
+  id: string;
+  title: string;
+  description: string;
+} | {
+  kind: "token";
+  id: string;
+  title: string;
+  description: string;
+} | ({
+  kind: "sso";
+} & SSOAuthMethod);
 /** Primarily used for initial authentication (login) */
 export declare class UnauthenticatedPlClient {
   readonly ll: LLPlClient;
@@ -53,31 +70,49 @@ export declare class UnauthenticatedPlClient {
   hasCapability(capability: BackendCapability): boolean;
   /** Classifies the advertised authentication methods by credential scheme.
    * On legacy backends (no auth:v2) the typed oneof is empty; callers fall through to {@link login}
-   * which uses the legacy GetJWTToken path. SSO is surfaced via {@link ssoConfig}, not here. */
+   * which uses the legacy GetJWTToken path.
+   * @deprecated collapses every basic-kind method into one boolean; use {@link loginMethods} to
+   * see each advertised method's own id. `login()` still reads this to choose the credential path. */
   get supportedAuthSchemes(): {
     basic: boolean;
     token: boolean;
   };
+  /** Builds the {@link SSOAuthMethod} projection an advertised SSO entry carries, or `undefined`
+   * for a flow no client here can drive. Shared by {@link ssoConfig} and {@link loginMethods},
+   * which each apply their own rule for an unsupported flow. */
+  private toSSOAuthMethod;
   /** Projection of the first advertised SSO method, derived from {@link authMethodsSync}.
-   * v1: at most one SSO method per deployment, so callers do not need to discriminate. */
+   * v1: at most one SSO method per deployment, so callers do not need to discriminate.
+   * @deprecated surfaces only the first advertised SSO method; use {@link loginMethods} to see
+   * every advertised method, of every kind. */
   ssoConfig(): SSOAuthMethod | undefined;
-  /** Login with username+password.
+  /** Every login method the backend advertises, of every kind, in advertised order, each
+   * keeping its own `id`, `title`, `description` and kind. An entry with no usable method arm, or an
+   * SSO entry whose flow no client here can drive, is dropped rather than failing the whole
+   * list, which is why this accessor skips where {@link ssoConfig} throws. */
+  loginMethods(): LoginMethod[];
+  /** Login with username and password.
    *
-   * On auth:v2 backends the client inspects the advertised AuthMethods:
-   *   - if basic auth is offered, sends {@link LLPlClient.loginBasic};
-   *   - if only token auth is offered, treats `password` as an opaque bearer token and
-   *     sends {@link LLPlClient.loginWithToken} (so deployments configured for static-token
-   *     auth still log in without the caller switching methods).
+   * Routes to {@link LLPlClient.loginBasic} or {@link LLPlClient.loginWithToken} based on the
+   * advertised method `idP` names. On legacy backends, uses GetJWTToken with Basic header.
    *
-   * On legacy backends (no auth:v2) it falls through to GetJWTToken with the Basic header,
-   * preserving original behavior. */
-  login(user: string, password: string): Promise<AuthInformation>;
+   * `idP` names the advertised method. A named basic-kind method routes to the basic branch;
+   * a named token-kind method routes to the token branch even when the backend also advertises
+   * a basic method — the token wire carries no selector, so the id itself is dropped there and
+   * only the branch choice is kept. Omitted, or naming no advertised method, falls back to
+   * today's first-match behavior: basic wins over token when both are advertised. */
+  login(user: string, password: string, idP?: string): Promise<AuthInformation>;
   /** Request fresh server-issued login material. v1 only emits the public-PKCE flow;
-   * desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. */
-  beginSSOLogin(): Promise<SSOLoginAttempt>;
-  /** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. */
+   * desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. `idP` names
+   * the advertised SSO method to route to; omitted, the backend keeps its current first-match
+   * behaviour. */
+  beginSSOLogin(idP?: string): Promise<SSOLoginAttempt>;
+  /** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. `idP` names
+   * the advertised SSO method to route to; omitted, the backend keeps its current first-match
+   * behaviour. */
   loginSSO(payload: {
     tokenResponse: Uint8Array;
+    idP?: string;
   }): Promise<AuthInformation>;
 }
 //#endregion

package/dist/core/unauth_client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unauth_client.d.ts","names":[],"sources":["../../src/core/unauth_client.ts"],"mappings":";;;;;;;;YAaY;;;;YAKA;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,UAAU;;;;EAIV;;;;YAKU;EACV;EACA;EACA,WAAW;;;;;EAKX;;;qBAIW;WACK,IAAI;UAEb;SAIa,MAClB,iBAAiB,yBACjB;IAAQ,SAAS;MAChB,QAAQ;EAKE,QAAQ,QAAQ;EAIhB,eAAe,QAAQ;EAIvB,eAAe;EAIrB,cAAc,YAAY;;;;MAOtB;IAA0B;IAAgB;;;;EAW9C,aAAa;;;;;;;;;;;EAoCP,MAAM,cAAc,mBAAmB,QAAQ;;;EA4B/C,iBAAiB,QAAQ;;EAWzB,SAAS;IAAW,eAAe;MAAe,QAAQ"}
+{"version":3,"file":"unauth_client.d.ts","names":[],"sources":["../../src/core/unauth_client.ts"],"mappings":";;;;;;;;YAaY;;;;YAKA;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,UAAU;;;;EAIV;;;;YAKU;EACV;EACA;EACA,WAAW;;;;;EAKX;;;;;YAMU;EACN;EAAe;EAAY;EAAe;;EAC1C;EAAe;EAAY;EAAe;;EACzC;IAAgB;;qBAGV;WACK,IAAI;UAEb;SAIa,MAClB,iBAAiB,yBACjB;IAAQ,SAAS;MAChB,QAAQ;EAKE,QAAQ,QAAQ;EAIhB,eAAe,QAAQ;EAIvB,eAAe;EAIrB,cAAc,YAAY;;;;;;MAStB;IAA0B;IAAgB;;;;;UAY7C;;;;;EA4BD,aAAa;;;;;EAgBb,gBAAgB;;;;;;;;;;;EAoCV,MAAM,cAAc,kBAAkB,eAAe,QAAQ;;;;;EAqC7D,cAAc,eAAe,QAAQ;;;;EAcrC,SAAS;IACpB,eAAe;IACf;MACE,QAAQ"}

package/dist/core/unauth_client.js

@@ -26,7 +26,9 @@ var UnauthenticatedPlClient = class UnauthenticatedPlClient {
 	}
 	/** Classifies the advertised authentication methods by credential scheme.
 	* On legacy backends (no auth:v2) the typed oneof is empty; callers fall through to {@link login}
-	* which uses the legacy GetJWTToken path. SSO is surfaced via {@link ssoConfig}, not here. */
+	* which uses the legacy GetJWTToken path.
+	* @deprecated collapses every basic-kind method into one boolean; use {@link loginMethods} to
+	* see each advertised method's own id. `login()` still reads this to choose the credential path. */
 	get supportedAuthSchemes() {
 		const result = {
 			basic: false,
@@ -36,46 +38,87 @@ var UnauthenticatedPlClient = class UnauthenticatedPlClient {
 		else if (m.method.oneofKind === "token") result.token = true;
 		return result;
 	}
+	/** Builds the {@link SSOAuthMethod} projection an advertised SSO entry carries, or `undefined`
+	* for a flow no client here can drive. Shared by {@link ssoConfig} and {@link loginMethods},
+	* which each apply their own rule for an unsupported flow. */
+	toSSOAuthMethod(method) {
+		if (method.method.oneofKind !== "sso") return void 0;
+		const sso = method.method.sso;
+		if (sso.flowType !== 0) return void 0;
+		return {
+			id: method.id,
+			title: method.title || method.description || method.id,
+			description: method.description,
+			issuer: sso.issuer,
+			clientId: sso.clientId,
+			scopes: sso.scopes,
+			resource: sso.resource,
+			prompt: sso.prompt,
+			redirectPorts: sso.redirectPorts,
+			subjectTokenSource: sso.subjectTokenSource,
+			userIdClaim: sso.userIdClaim,
+			groupsClaim: sso.groupsClaim,
+			accessType: sso.accessType || void 0,
+			flowType: "public_pkce"
+		};
+	}
 	/** Projection of the first advertised SSO method, derived from {@link authMethodsSync}.
-	* v1: at most one SSO method per deployment, so callers do not need to discriminate. */
+	* v1: at most one SSO method per deployment, so callers do not need to discriminate.
+	* @deprecated surfaces only the first advertised SSO method; use {@link loginMethods} to see
+	* every advertised method, of every kind. */
 	ssoConfig() {
 		for (const method of this.ll.authMethodsSync.methods) {
 			if (method.method.oneofKind !== "sso") continue;
 			const sso = method.method.sso;
 			if (sso.flowType !== 0) throw new Error(`ssoConfig: unsupported SSO flow type ${sso.flowType}`);
-			return {
-				id: method.id,
-				description: method.description,
-				issuer: sso.issuer,
-				clientId: sso.clientId,
-				scopes: sso.scopes,
-				resource: sso.resource,
-				prompt: sso.prompt,
-				redirectPorts: sso.redirectPorts,
-				subjectTokenSource: sso.subjectTokenSource,
-				userIdClaim: sso.userIdClaim,
-				groupsClaim: sso.groupsClaim,
-				accessType: sso.accessType || void 0,
-				flowType: "public_pkce"
-			};
+			return this.toSSOAuthMethod(method);
+		}
+	}
+	/** Every login method the backend advertises, of every kind, in advertised order, each
+	* keeping its own `id`, `title`, `description` and kind. An entry with no usable method arm, or an
+	* SSO entry whose flow no client here can drive, is dropped rather than failing the whole
+	* list, which is why this accessor skips where {@link ssoConfig} throws. */
+	loginMethods() {
+		const picked = [];
+		for (const method of this.ll.authMethodsSync.methods) switch (method.method.oneofKind) {
+			case "basic":
+			case "token":
+				picked.push({
+					kind: method.method.oneofKind,
+					id: method.id,
+					title: method.title || method.description || method.id,
+					description: method.description
+				});
+				break;
+			case "sso": {
+				const sso = this.toSSOAuthMethod(method);
+				if (sso !== void 0) picked.push({
+					kind: "sso",
+					...sso
+				});
+				break;
+			}
+			default: break;
 		}
+		return picked;
 	}
-	/** Login with username+password.
+	/** Login with username and password.
 	*
-	* On auth:v2 backends the client inspects the advertised AuthMethods:
-	*   - if basic auth is offered, sends {@link LLPlClient.loginBasic};
-	*   - if only token auth is offered, treats `password` as an opaque bearer token and
-	*     sends {@link LLPlClient.loginWithToken} (so deployments configured for static-token
-	*     auth still log in without the caller switching methods).
+	* Routes to {@link LLPlClient.loginBasic} or {@link LLPlClient.loginWithToken} based on the
+	* advertised method `idP` names. On legacy backends, uses GetJWTToken with Basic header.
 	*
-	* On legacy backends (no auth:v2) it falls through to GetJWTToken with the Basic header,
-	* preserving original behavior. */
-	async login(user, password) {
+	* `idP` names the advertised method. A named basic-kind method routes to the basic branch;
+	* a named token-kind method routes to the token branch even when the backend also advertises
+	* a basic method — the token wire carries no selector, so the id itself is dropped there and
+	* only the branch choice is kept. Omitted, or naming no advertised method, falls back to
+	* today's first-match behavior: basic wins over token when both are advertised. */
+	async login(user, password, idP) {
 		try {
 			let token;
 			if (this.ll.hasCapability("auth:v2")) {
 				const schemes = this.supportedAuthSchemes;
-				if (schemes.basic) token = await this.ll.loginBasic(user, password);
+				if ((idP === void 0 ? void 0 : this.loginMethods().find((m) => m.id === idP)?.kind) === "token") token = await this.ll.loginWithToken(password);
+				else if (schemes.basic) token = idP === void 0 ? await this.ll.loginBasic(user, password) : await this.ll.loginBasic(user, password, { idP });
 				else if (schemes.token) token = await this.ll.loginWithToken(password);
 				else throw new Error("backend advertises no supported authentication methods");
 			} else token = await this.ll.getJwtToken(BigInt(this.ll.conf.authTTLSeconds), { authorization: "Basic " + Buffer.from(user + ":" + password).toString("base64") });
@@ -88,9 +131,11 @@ var UnauthenticatedPlClient = class UnauthenticatedPlClient {
 		}
 	}
 	/** Request fresh server-issued login material. v1 only emits the public-PKCE flow;
-	* desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. */
-	async beginSSOLogin() {
-		const attempt = await this.ll.beginSSOLogin();
+	* desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. `idP` names
+	* the advertised SSO method to route to; omitted, the backend keeps its current first-match
+	* behaviour. */
+	async beginSSOLogin(idP) {
+		const attempt = idP === void 0 ? await this.ll.beginSSOLogin() : await this.ll.beginSSOLogin(idP);
 		return {
 			flow: "public_pkce",
 			nonce: attempt.nonce,
@@ -98,10 +143,12 @@ var UnauthenticatedPlClient = class UnauthenticatedPlClient {
 			clientSecret: attempt.clientSecret
 		};
 	}
-	/** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. */
+	/** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. `idP` names
+	* the advertised SSO method to route to; omitted, the backend keeps its current first-match
+	* behaviour. */
 	async loginSSO(payload) {
 		try {
-			const jwtToken = await this.ll.loginSSO(payload.tokenResponse);
+			const jwtToken = payload.idP === void 0 ? await this.ll.loginSSO(payload.tokenResponse) : await this.ll.loginSSO(payload.tokenResponse, payload.idP);
 			if (jwtToken === "") throw new Error("empty token");
 			return { jwtToken };
 		} catch (e) {

package/dist/core/unauth_client.js.map

@@ -1 +1 @@
-{"version":3,"file":"unauth_client.js","names":[],"sources":["../../src/core/unauth_client.ts"],"sourcesContent":["import type { AuthInformation, PlClientConfig } from \"./config\";\nimport {\n  type AuthAPI_ListMethods_Response,\n  type MaintenanceAPI_Ping_Response,\n  AuthAPI_ListMethods_SSOAuthMethod_FlowType,\n} from \"../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api\";\nimport { LLPlClient } from \"./ll_client\";\nimport { type MiLogger, notEmpty } from \"@milaboratories/ts-helpers\";\nimport { UnauthenticatedError } from \"./errors\";\nimport type { BackendCapability } from \"./capabilities\";\n\n/** Login-flow shape advertised by the backend for a given SSO method. Extension\n * point: future flow variants (e.g. backend-driven) sit alongside `public_pkce`. */\nexport type SSOFlowType = \"public_pkce\";\n\n/** Typed projection of `AuthAPI.ListMethods.SSOAuthMethod` for desktop consumption.\n * Carries everything needed to drive the PKCE flow + diagnostics fields the renderer\n * may surface (`userIdClaim`, `groupsClaim`). */\nexport type SSOAuthMethod = {\n  id: string;\n  description: string;\n  issuer: string;\n  clientId: string;\n  scopes: string;\n  resource: string;\n  prompt: string;\n  redirectPorts: number[];\n  subjectTokenSource: string;\n  userIdClaim: string;\n  groupsClaim: string;\n  flowType: SSOFlowType;\n  /** OIDC `access_type` auth-request param (\"online\" | \"offline\"). Google-specific:\n   * \"offline\" makes Google issue a refresh token; other IdPs ignore it. Absent when\n   * the server does not set it — never send an empty string to the IdP. */\n  accessType?: string;\n};\n\n/** Server-issued material returned by {@link UnauthenticatedPlClient.beginSSOLogin}.\n * Discriminated on `flow`; future flow variants extend the union. */\nexport type SSOLoginAttempt = {\n  flow: \"public_pkce\";\n  nonce: string;\n  expiresAt: Date;\n  /** Confidential-client secret for the IdP token exchange; absent for public clients.\n   * Google's OIDC has no public-client mode — it requires a client_secret at the token\n   * endpoint even with PKCE — so for Google the backend forwards its secret here and the\n   * desktop exchanges the code as a confidential client. */\n  clientSecret?: string;\n};\n\n/** Primarily used for initial authentication (login) */\nexport class UnauthenticatedPlClient {\n  public readonly ll: LLPlClient;\n\n  private constructor(ll: LLPlClient) {\n    this.ll = ll;\n  }\n\n  public static async build(\n    configOrAddress: PlClientConfig | string,\n    ops?: { logger?: MiLogger },\n  ): Promise<UnauthenticatedPlClient> {\n    const ll = await LLPlClient.build(configOrAddress, ops);\n    return new UnauthenticatedPlClient(ll);\n  }\n\n  public async ping(): Promise<MaintenanceAPI_Ping_Response> {\n    return await this.ll.ping();\n  }\n\n  public async authMethods(): Promise<AuthAPI_ListMethods_Response> {\n    return await this.ll.authMethods();\n  }\n\n  public async requireAuth(): Promise<boolean> {\n    return (await this.authMethods()).methods.length > 0;\n  }\n\n  public hasCapability(capability: BackendCapability): boolean {\n    return this.ll.hasCapability(capability);\n  }\n\n  /** Classifies the advertised authentication methods by credential scheme.\n   * On legacy backends (no auth:v2) the typed oneof is empty; callers fall through to {@link login}\n   * which uses the legacy GetJWTToken path. SSO is surfaced via {@link ssoConfig}, not here. */\n  public get supportedAuthSchemes(): { basic: boolean; token: boolean } {\n    const result = { basic: false, token: false };\n    for (const m of this.ll.authMethodsSync.methods) {\n      if (m.method.oneofKind === \"basic\") result.basic = true;\n      else if (m.method.oneofKind === \"token\") result.token = true;\n    }\n    return result;\n  }\n\n  /** Projection of the first advertised SSO method, derived from {@link authMethodsSync}.\n   * v1: at most one SSO method per deployment, so callers do not need to discriminate. */\n  public ssoConfig(): SSOAuthMethod | undefined {\n    for (const method of this.ll.authMethodsSync.methods) {\n      if (method.method.oneofKind !== \"sso\") continue;\n      const sso = method.method.sso;\n      if (sso.flowType !== AuthAPI_ListMethods_SSOAuthMethod_FlowType.PUBLIC_PKCE) {\n        throw new Error(`ssoConfig: unsupported SSO flow type ${sso.flowType}`);\n      }\n      return {\n        id: method.id,\n        description: method.description,\n        issuer: sso.issuer,\n        clientId: sso.clientId,\n        scopes: sso.scopes,\n        resource: sso.resource,\n        prompt: sso.prompt,\n        redirectPorts: sso.redirectPorts,\n        subjectTokenSource: sso.subjectTokenSource,\n        userIdClaim: sso.userIdClaim,\n        groupsClaim: sso.groupsClaim,\n        accessType: sso.accessType || undefined,\n        flowType: \"public_pkce\",\n      };\n    }\n    return undefined;\n  }\n\n  /** Login with username+password.\n   *\n   * On auth:v2 backends the client inspects the advertised AuthMethods:\n   *   - if basic auth is offered, sends {@link LLPlClient.loginBasic};\n   *   - if only token auth is offered, treats `password` as an opaque bearer token and\n   *     sends {@link LLPlClient.loginWithToken} (so deployments configured for static-token\n   *     auth still log in without the caller switching methods).\n   *\n   * On legacy backends (no auth:v2) it falls through to GetJWTToken with the Basic header,\n   * preserving original behavior. */\n  public async login(user: string, password: string): Promise<AuthInformation> {\n    try {\n      let token: string;\n      if (this.ll.hasCapability(\"auth:v2\")) {\n        const schemes = this.supportedAuthSchemes;\n        if (schemes.basic) {\n          token = await this.ll.loginBasic(user, password);\n        } else if (schemes.token) {\n          token = await this.ll.loginWithToken(password);\n        } else {\n          throw new Error(\"backend advertises no supported authentication methods\");\n        }\n      } else {\n        token = await this.ll.getJwtToken(BigInt(this.ll.conf.authTTLSeconds), {\n          authorization: \"Basic \" + Buffer.from(user + \":\" + password).toString(\"base64\"),\n        });\n      }\n      const jwtToken = notEmpty(token);\n      if (jwtToken === \"\") throw new Error(\"empty token\");\n      return { jwtToken };\n    } catch (e: any) {\n      if (e.code === \"UNAUTHENTICATED\") throw new UnauthenticatedError(e.message);\n      throw new Error(e);\n    }\n  }\n\n  /** Request fresh server-issued login material. v1 only emits the public-PKCE flow;\n   * desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. */\n  public async beginSSOLogin(): Promise<SSOLoginAttempt> {\n    const attempt = await this.ll.beginSSOLogin();\n    return {\n      flow: \"public_pkce\",\n      nonce: attempt.nonce,\n      expiresAt: attempt.expiresAt,\n      clientSecret: attempt.clientSecret,\n    };\n  }\n\n  /** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. */\n  public async loginSSO(payload: { tokenResponse: Uint8Array }): Promise<AuthInformation> {\n    try {\n      const jwtToken = await this.ll.loginSSO(payload.tokenResponse);\n      if (jwtToken === \"\") throw new Error(\"empty token\");\n      return { jwtToken };\n    } catch (e: any) {\n      if (e.code === \"UNAUTHENTICATED\") throw new UnauthenticatedError(e.message);\n      throw new Error(e);\n    }\n  }\n}\n"],"mappings":";;;;;;AAmDA,IAAa,0BAAb,MAAa,wBAAwB;CACnC;CAEA,YAAoB,IAAgB;EAClC,KAAK,KAAK;CACZ;CAEA,aAAoB,MAClB,iBACA,KACkC;EAElC,OAAO,IAAI,wBAAwB,MADlB,WAAW,MAAM,iBAAiB,GAAG,CACjB;CACvC;CAEA,MAAa,OAA8C;EACzD,OAAO,MAAM,KAAK,GAAG,KAAK;CAC5B;CAEA,MAAa,cAAqD;EAChE,OAAO,MAAM,KAAK,GAAG,YAAY;CACnC;CAEA,MAAa,cAAgC;EAC3C,QAAQ,MAAM,KAAK,YAAY,EAAA,CAAG,QAAQ,SAAS;CACrD;CAEA,cAAqB,YAAwC;EAC3D,OAAO,KAAK,GAAG,cAAc,UAAU;CACzC;;;;CAKA,IAAW,uBAA2D;EACpE,MAAM,SAAS;GAAE,OAAO;GAAO,OAAO;EAAM;EAC5C,KAAK,MAAM,KAAK,KAAK,GAAG,gBAAgB,SACtC,IAAI,EAAE,OAAO,cAAc,SAAS,OAAO,QAAQ;OAC9C,IAAI,EAAE,OAAO,cAAc,SAAS,OAAO,QAAQ;EAE1D,OAAO;CACT;;;CAIA,YAA8C;EAC5C,KAAK,MAAM,UAAU,KAAK,GAAG,gBAAgB,SAAS;GACpD,IAAI,OAAO,OAAO,cAAc,OAAO;GACvC,MAAM,MAAM,OAAO,OAAO;GAC1B,IAAI,IAAI,aAAA,GACN,MAAM,IAAI,MAAM,wCAAwC,IAAI,UAAU;GAExE,OAAO;IACL,IAAI,OAAO;IACX,aAAa,OAAO;IACpB,QAAQ,IAAI;IACZ,UAAU,IAAI;IACd,QAAQ,IAAI;IACZ,UAAU,IAAI;IACd,QAAQ,IAAI;IACZ,eAAe,IAAI;IACnB,oBAAoB,IAAI;IACxB,aAAa,IAAI;IACjB,aAAa,IAAI;IACjB,YAAY,IAAI,cAAc,KAAA;IAC9B,UAAU;GACZ;EACF;CAEF;;;;;;;;;;;CAYA,MAAa,MAAM,MAAc,UAA4C;EAC3E,IAAI;GACF,IAAI;GACJ,IAAI,KAAK,GAAG,cAAc,SAAS,GAAG;IACpC,MAAM,UAAU,KAAK;IACrB,IAAI,QAAQ,OACV,QAAQ,MAAM,KAAK,GAAG,WAAW,MAAM,QAAQ;SAC1C,IAAI,QAAQ,OACjB,QAAQ,MAAM,KAAK,GAAG,eAAe,QAAQ;SAE7C,MAAM,IAAI,MAAM,wDAAwD;GAE5E,OACE,QAAQ,MAAM,KAAK,GAAG,YAAY,OAAO,KAAK,GAAG,KAAK,cAAc,GAAG,EACrE,eAAe,WAAW,OAAO,KAAK,OAAO,MAAM,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAChF,CAAC;GAEH,MAAM,WAAW,SAAS,KAAK;GAC/B,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,aAAa;GAClD,OAAO,EAAE,SAAS;EACpB,SAAS,GAAQ;GACf,IAAI,EAAE,SAAS,mBAAmB,MAAM,IAAI,qBAAqB,EAAE,OAAO;GAC1E,MAAM,IAAI,MAAM,CAAC;EACnB;CACF;;;CAIA,MAAa,gBAA0C;EACrD,MAAM,UAAU,MAAM,KAAK,GAAG,cAAc;EAC5C,OAAO;GACL,MAAM;GACN,OAAO,QAAQ;GACf,WAAW,QAAQ;GACnB,cAAc,QAAQ;EACxB;CACF;;CAGA,MAAa,SAAS,SAAkE;EACtF,IAAI;GACF,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,QAAQ,aAAa;GAC7D,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,aAAa;GAClD,OAAO,EAAE,SAAS;EACpB,SAAS,GAAQ;GACf,IAAI,EAAE,SAAS,mBAAmB,MAAM,IAAI,qBAAqB,EAAE,OAAO;GAC1E,MAAM,IAAI,MAAM,CAAC;EACnB;CACF;AACF"}
+{"version":3,"file":"unauth_client.js","names":[],"sources":["../../src/core/unauth_client.ts"],"sourcesContent":["import type { AuthInformation, PlClientConfig } from \"./config\";\nimport {\n  type AuthAPI_ListMethods_Response,\n  type MaintenanceAPI_Ping_Response,\n  AuthAPI_ListMethods_SSOAuthMethod_FlowType,\n} from \"../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api\";\nimport { LLPlClient } from \"./ll_client\";\nimport { type MiLogger, notEmpty } from \"@milaboratories/ts-helpers\";\nimport { UnauthenticatedError } from \"./errors\";\nimport type { BackendCapability } from \"./capabilities\";\n\n/** Login-flow shape advertised by the backend for a given SSO method. Extension\n * point: future flow variants (e.g. backend-driven) sit alongside `public_pkce`. */\nexport type SSOFlowType = \"public_pkce\";\n\n/** Typed projection of `AuthAPI.ListMethods.SSOAuthMethod` for desktop consumption.\n * Carries everything needed to drive the PKCE flow + diagnostics fields the renderer\n * may surface (`userIdClaim`, `groupsClaim`). */\nexport type SSOAuthMethod = {\n  id: string;\n  title: string;\n  description: string;\n  issuer: string;\n  clientId: string;\n  scopes: string;\n  resource: string;\n  prompt: string;\n  redirectPorts: number[];\n  subjectTokenSource: string;\n  userIdClaim: string;\n  groupsClaim: string;\n  flowType: SSOFlowType;\n  /** OIDC `access_type` auth-request param (\"online\" | \"offline\"). Google-specific:\n   * \"offline\" makes Google issue a refresh token; other IdPs ignore it. Absent when\n   * the server does not set it — never send an empty string to the IdP. */\n  accessType?: string;\n};\n\n/** Server-issued material returned by {@link UnauthenticatedPlClient.beginSSOLogin}.\n * Discriminated on `flow`; future flow variants extend the union. */\nexport type SSOLoginAttempt = {\n  flow: \"public_pkce\";\n  nonce: string;\n  expiresAt: Date;\n  /** Confidential-client secret for the IdP token exchange; absent for public clients.\n   * Google's OIDC has no public-client mode — it requires a client_secret at the token\n   * endpoint even with PKCE — so for Google the backend forwards its secret here and the\n   * desktop exchanges the code as a confidential client. */\n  clientSecret?: string;\n};\n\n/** One login method the backend advertises, of any kind. Every advertised method keeps its own\n * `id`, `title`, `description` and kind. Two same-kind methods, such as two LDAP directories, are\n * two entries a caller can name apart and never collapsed into one. See {@link UnauthenticatedPlClient.loginMethods}. */\nexport type LoginMethod =\n  | { kind: \"basic\"; id: string; title: string; description: string }\n  | { kind: \"token\"; id: string; title: string; description: string }\n  | ({ kind: \"sso\" } & SSOAuthMethod);\n\n/** Primarily used for initial authentication (login) */\nexport class UnauthenticatedPlClient {\n  public readonly ll: LLPlClient;\n\n  private constructor(ll: LLPlClient) {\n    this.ll = ll;\n  }\n\n  public static async build(\n    configOrAddress: PlClientConfig | string,\n    ops?: { logger?: MiLogger },\n  ): Promise<UnauthenticatedPlClient> {\n    const ll = await LLPlClient.build(configOrAddress, ops);\n    return new UnauthenticatedPlClient(ll);\n  }\n\n  public async ping(): Promise<MaintenanceAPI_Ping_Response> {\n    return await this.ll.ping();\n  }\n\n  public async authMethods(): Promise<AuthAPI_ListMethods_Response> {\n    return await this.ll.authMethods();\n  }\n\n  public async requireAuth(): Promise<boolean> {\n    return (await this.authMethods()).methods.length > 0;\n  }\n\n  public hasCapability(capability: BackendCapability): boolean {\n    return this.ll.hasCapability(capability);\n  }\n\n  /** Classifies the advertised authentication methods by credential scheme.\n   * On legacy backends (no auth:v2) the typed oneof is empty; callers fall through to {@link login}\n   * which uses the legacy GetJWTToken path.\n   * @deprecated collapses every basic-kind method into one boolean; use {@link loginMethods} to\n   * see each advertised method's own id. `login()` still reads this to choose the credential path. */\n  public get supportedAuthSchemes(): { basic: boolean; token: boolean } {\n    const result = { basic: false, token: false };\n    for (const m of this.ll.authMethodsSync.methods) {\n      if (m.method.oneofKind === \"basic\") result.basic = true;\n      else if (m.method.oneofKind === \"token\") result.token = true;\n    }\n    return result;\n  }\n\n  /** Builds the {@link SSOAuthMethod} projection an advertised SSO entry carries, or `undefined`\n   * for a flow no client here can drive. Shared by {@link ssoConfig} and {@link loginMethods},\n   * which each apply their own rule for an unsupported flow. */\n  private toSSOAuthMethod(\n    method: AuthAPI_ListMethods_Response[\"methods\"][number],\n  ): SSOAuthMethod | undefined {\n    if (method.method.oneofKind !== \"sso\") return undefined;\n    const sso = method.method.sso;\n    if (sso.flowType !== AuthAPI_ListMethods_SSOAuthMethod_FlowType.PUBLIC_PKCE) return undefined;\n    return {\n      id: method.id,\n      title: method.title || method.description || method.id,\n      description: method.description,\n      issuer: sso.issuer,\n      clientId: sso.clientId,\n      scopes: sso.scopes,\n      resource: sso.resource,\n      prompt: sso.prompt,\n      redirectPorts: sso.redirectPorts,\n      subjectTokenSource: sso.subjectTokenSource,\n      userIdClaim: sso.userIdClaim,\n      groupsClaim: sso.groupsClaim,\n      accessType: sso.accessType || undefined,\n      flowType: \"public_pkce\",\n    };\n  }\n\n  /** Projection of the first advertised SSO method, derived from {@link authMethodsSync}.\n   * v1: at most one SSO method per deployment, so callers do not need to discriminate.\n   * @deprecated surfaces only the first advertised SSO method; use {@link loginMethods} to see\n   * every advertised method, of every kind. */\n  public ssoConfig(): SSOAuthMethod | undefined {\n    for (const method of this.ll.authMethodsSync.methods) {\n      if (method.method.oneofKind !== \"sso\") continue;\n      const sso = method.method.sso;\n      if (sso.flowType !== AuthAPI_ListMethods_SSOAuthMethod_FlowType.PUBLIC_PKCE) {\n        throw new Error(`ssoConfig: unsupported SSO flow type ${sso.flowType}`);\n      }\n      return this.toSSOAuthMethod(method);\n    }\n    return undefined;\n  }\n\n  /** Every login method the backend advertises, of every kind, in advertised order, each\n   * keeping its own `id`, `title`, `description` and kind. An entry with no usable method arm, or an\n   * SSO entry whose flow no client here can drive, is dropped rather than failing the whole\n   * list, which is why this accessor skips where {@link ssoConfig} throws. */\n  public loginMethods(): LoginMethod[] {\n    const picked: LoginMethod[] = [];\n    for (const method of this.ll.authMethodsSync.methods) {\n      switch (method.method.oneofKind) {\n        case \"basic\":\n        case \"token\":\n          picked.push({\n            kind: method.method.oneofKind,\n            id: method.id,\n            title: method.title || method.description || method.id,\n            description: method.description,\n          });\n          break;\n        case \"sso\": {\n          const sso = this.toSSOAuthMethod(method);\n          if (sso !== undefined) picked.push({ kind: \"sso\", ...sso });\n          break;\n        }\n        default:\n          // No arm at all — a legacy backend advertising nothing pickable.\n          break;\n      }\n    }\n    return picked;\n  }\n\n  /** Login with username and password.\n   *\n   * Routes to {@link LLPlClient.loginBasic} or {@link LLPlClient.loginWithToken} based on the\n   * advertised method `idP` names. On legacy backends, uses GetJWTToken with Basic header.\n   *\n   * `idP` names the advertised method. A named basic-kind method routes to the basic branch;\n   * a named token-kind method routes to the token branch even when the backend also advertises\n   * a basic method — the token wire carries no selector, so the id itself is dropped there and\n   * only the branch choice is kept. Omitted, or naming no advertised method, falls back to\n   * today's first-match behavior: basic wins over token when both are advertised. */\n  public async login(user: string, password: string, idP?: string): Promise<AuthInformation> {\n    try {\n      let token: string;\n      if (this.ll.hasCapability(\"auth:v2\")) {\n        const schemes = this.supportedAuthSchemes;\n        const namedKind =\n          idP === undefined ? undefined : this.loginMethods().find((m) => m.id === idP)?.kind;\n        if (namedKind === \"token\") {\n          token = await this.ll.loginWithToken(password);\n        } else if (schemes.basic) {\n          token =\n            idP === undefined\n              ? await this.ll.loginBasic(user, password)\n              : await this.ll.loginBasic(user, password, { idP });\n        } else if (schemes.token) {\n          token = await this.ll.loginWithToken(password);\n        } else {\n          throw new Error(\"backend advertises no supported authentication methods\");\n        }\n      } else {\n        token = await this.ll.getJwtToken(BigInt(this.ll.conf.authTTLSeconds), {\n          authorization: \"Basic \" + Buffer.from(user + \":\" + password).toString(\"base64\"),\n        });\n      }\n      const jwtToken = notEmpty(token);\n      if (jwtToken === \"\") throw new Error(\"empty token\");\n      return { jwtToken };\n    } catch (e: any) {\n      if (e.code === \"UNAUTHENTICATED\") throw new UnauthenticatedError(e.message);\n      throw new Error(e);\n    }\n  }\n\n  /** Request fresh server-issued login material. v1 only emits the public-PKCE flow;\n   * desktop MUST place the returned `nonce` verbatim into the OIDC auth-request. `idP` names\n   * the advertised SSO method to route to; omitted, the backend keeps its current first-match\n   * behaviour. */\n  public async beginSSOLogin(idP?: string): Promise<SSOLoginAttempt> {\n    const attempt =\n      idP === undefined ? await this.ll.beginSSOLogin() : await this.ll.beginSSOLogin(idP);\n    return {\n      flow: \"public_pkce\",\n      nonce: attempt.nonce,\n      expiresAt: attempt.expiresAt,\n      clientSecret: attempt.clientSecret,\n    };\n  }\n\n  /** Forward the verbatim IdP `/token` response body and receive a Platforma JWT. `idP` names\n   * the advertised SSO method to route to; omitted, the backend keeps its current first-match\n   * behaviour. */\n  public async loginSSO(payload: {\n    tokenResponse: Uint8Array;\n    idP?: string;\n  }): Promise<AuthInformation> {\n    try {\n      const jwtToken =\n        payload.idP === undefined\n          ? await this.ll.loginSSO(payload.tokenResponse)\n          : await this.ll.loginSSO(payload.tokenResponse, payload.idP);\n      if (jwtToken === \"\") throw new Error(\"empty token\");\n      return { jwtToken };\n    } catch (e: any) {\n      if (e.code === \"UNAUTHENTICATED\") throw new UnauthenticatedError(e.message);\n      throw new Error(e);\n    }\n  }\n}\n"],"mappings":";;;;;;AA4DA,IAAa,0BAAb,MAAa,wBAAwB;CACnC;CAEA,YAAoB,IAAgB;EAClC,KAAK,KAAK;CACZ;CAEA,aAAoB,MAClB,iBACA,KACkC;EAElC,OAAO,IAAI,wBAAwB,MADlB,WAAW,MAAM,iBAAiB,GAAG,CACjB;CACvC;CAEA,MAAa,OAA8C;EACzD,OAAO,MAAM,KAAK,GAAG,KAAK;CAC5B;CAEA,MAAa,cAAqD;EAChE,OAAO,MAAM,KAAK,GAAG,YAAY;CACnC;CAEA,MAAa,cAAgC;EAC3C,QAAQ,MAAM,KAAK,YAAY,EAAA,CAAG,QAAQ,SAAS;CACrD;CAEA,cAAqB,YAAwC;EAC3D,OAAO,KAAK,GAAG,cAAc,UAAU;CACzC;;;;;;CAOA,IAAW,uBAA2D;EACpE,MAAM,SAAS;GAAE,OAAO;GAAO,OAAO;EAAM;EAC5C,KAAK,MAAM,KAAK,KAAK,GAAG,gBAAgB,SACtC,IAAI,EAAE,OAAO,cAAc,SAAS,OAAO,QAAQ;OAC9C,IAAI,EAAE,OAAO,cAAc,SAAS,OAAO,QAAQ;EAE1D,OAAO;CACT;;;;CAKA,gBACE,QAC2B;EAC3B,IAAI,OAAO,OAAO,cAAc,OAAO,OAAO,KAAA;EAC9C,MAAM,MAAM,OAAO,OAAO;EAC1B,IAAI,IAAI,aAAA,GAAqE,OAAO,KAAA;EACpF,OAAO;GACL,IAAI,OAAO;GACX,OAAO,OAAO,SAAS,OAAO,eAAe,OAAO;GACpD,aAAa,OAAO;GACpB,QAAQ,IAAI;GACZ,UAAU,IAAI;GACd,QAAQ,IAAI;GACZ,UAAU,IAAI;GACd,QAAQ,IAAI;GACZ,eAAe,IAAI;GACnB,oBAAoB,IAAI;GACxB,aAAa,IAAI;GACjB,aAAa,IAAI;GACjB,YAAY,IAAI,cAAc,KAAA;GAC9B,UAAU;EACZ;CACF;;;;;CAMA,YAA8C;EAC5C,KAAK,MAAM,UAAU,KAAK,GAAG,gBAAgB,SAAS;GACpD,IAAI,OAAO,OAAO,cAAc,OAAO;GACvC,MAAM,MAAM,OAAO,OAAO;GAC1B,IAAI,IAAI,aAAA,GACN,MAAM,IAAI,MAAM,wCAAwC,IAAI,UAAU;GAExE,OAAO,KAAK,gBAAgB,MAAM;EACpC;CAEF;;;;;CAMA,eAAqC;EACnC,MAAM,SAAwB,CAAC;EAC/B,KAAK,MAAM,UAAU,KAAK,GAAG,gBAAgB,SAC3C,QAAQ,OAAO,OAAO,WAAtB;GACE,KAAK;GACL,KAAK;IACH,OAAO,KAAK;KACV,MAAM,OAAO,OAAO;KACpB,IAAI,OAAO;KACX,OAAO,OAAO,SAAS,OAAO,eAAe,OAAO;KACpD,aAAa,OAAO;IACtB,CAAC;IACD;GACF,KAAK,OAAO;IACV,MAAM,MAAM,KAAK,gBAAgB,MAAM;IACvC,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAK;KAAE,MAAM;KAAO,GAAG;IAAI,CAAC;IAC1D;GACF;GACA,SAEE;EACJ;EAEF,OAAO;CACT;;;;;;;;;;;CAYA,MAAa,MAAM,MAAc,UAAkB,KAAwC;EACzF,IAAI;GACF,IAAI;GACJ,IAAI,KAAK,GAAG,cAAc,SAAS,GAAG;IACpC,MAAM,UAAU,KAAK;IAGrB,KADE,QAAQ,KAAA,IAAY,KAAA,IAAY,KAAK,aAAa,CAAC,CAAC,MAAM,MAAM,EAAE,OAAO,GAAG,CAAC,EAAE,UAC/D,SAChB,QAAQ,MAAM,KAAK,GAAG,eAAe,QAAQ;SACxC,IAAI,QAAQ,OACjB,QACE,QAAQ,KAAA,IACJ,MAAM,KAAK,GAAG,WAAW,MAAM,QAAQ,IACvC,MAAM,KAAK,GAAG,WAAW,MAAM,UAAU,EAAE,IAAI,CAAC;SACjD,IAAI,QAAQ,OACjB,QAAQ,MAAM,KAAK,GAAG,eAAe,QAAQ;SAE7C,MAAM,IAAI,MAAM,wDAAwD;GAE5E,OACE,QAAQ,MAAM,KAAK,GAAG,YAAY,OAAO,KAAK,GAAG,KAAK,cAAc,GAAG,EACrE,eAAe,WAAW,OAAO,KAAK,OAAO,MAAM,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAChF,CAAC;GAEH,MAAM,WAAW,SAAS,KAAK;GAC/B,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,aAAa;GAClD,OAAO,EAAE,SAAS;EACpB,SAAS,GAAQ;GACf,IAAI,EAAE,SAAS,mBAAmB,MAAM,IAAI,qBAAqB,EAAE,OAAO;GAC1E,MAAM,IAAI,MAAM,CAAC;EACnB;CACF;;;;;CAMA,MAAa,cAAc,KAAwC;EACjE,MAAM,UACJ,QAAQ,KAAA,IAAY,MAAM,KAAK,GAAG,cAAc,IAAI,MAAM,KAAK,GAAG,cAAc,GAAG;EACrF,OAAO;GACL,MAAM;GACN,OAAO,QAAQ;GACf,WAAW,QAAQ;GACnB,cAAc,QAAQ;EACxB;CACF;;;;CAKA,MAAa,SAAS,SAGO;EAC3B,IAAI;GACF,MAAM,WACJ,QAAQ,QAAQ,KAAA,IACZ,MAAM,KAAK,GAAG,SAAS,QAAQ,aAAa,IAC5C,MAAM,KAAK,GAAG,SAAS,QAAQ,eAAe,QAAQ,GAAG;GAC/D,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,aAAa;GAClD,OAAO,EAAE,SAAS;EACpB,SAAS,GAAQ;GACf,IAAI,EAAE,SAAS,mBAAmB,MAAM,IAAI,qBAAqB,EAAE,OAAO;GAC1E,MAAM,IAAI,MAAM,CAAC;EACnB;CACF;AACF"}

package/dist/index.d.ts

@@ -12,10 +12,10 @@ import { GrantEntry, StorageInfo, TxRunner, UserDeletionReport, UserEntry, UserR
 import { PlClient, TxOps } from "./core/client.js";
 import { DisconnectedError, PermissionDeniedError, PlError, PlErrorCodeNotFound, RESTError, RecoverablePlError, UnauthenticatedError, UnrecoverablePlError, isAbortedError, isCancelError, isConnectionProblem, isNotFoundError, isPermissionDenied, isTimeoutError, isTimeoutOrCancelError, isTransientCallFailure, isUnauthenticated, isUnimplementedError, rethrowMeaningfulError, throwPlNotFoundError } from "./core/errors.js";
 import { defaultPlClient, tryGetFileConfig } from "./core/default_client.js";
-import { SSOAuthMethod, SSOFlowType, SSOLoginAttempt, UnauthenticatedPlClient } from "./core/unauth_client.js";
+import { LoginMethod, SSOAuthMethod, SSOFlowType, SSOLoginAttempt, UnauthenticatedPlClient } from "./core/unauth_client.js";
 import { expirationFromAuthInformation, inferAuthRefreshTime } from "./core/auth.js";
 import { Filter, Property, treeFilter } from "./core/tree_filter.js";
 import { ValErr, valErr } from "./helpers/tx_helpers.js";
 import { ContinuePolling, DefaultPollingRetryOptions, PollFieldTraverseOps, PollResourceAccessor, PollTxAccessor, poll } from "./helpers/poll.js";
 import { test_config_d_exports } from "./test/test_config.js";
-export { AnonymousAuthInformation, AnyFieldId, AnyFieldRef, AnyRef, AnyResourceId, AnyResourceRef, AuthInformation, AuthOps, BackendCapability, BasicResourceData, ColorProof, ContinuePolling, DEFAULT_AUTH_MAX_REFRESH, DEFAULT_LOGIN_TIMEOUT, DEFAULT_MAX_CACHE_BYTES, DEFAULT_REQUEST_TIMEOUT, DEFAULT_RETRY_BACKOFF_ALGORITHM, DEFAULT_RETRY_EXPONENTIAL_BACKOFF_MULTIPLIER, DEFAULT_RETRY_INITIAL_DELAY, DEFAULT_RETRY_JITTER, DEFAULT_RETRY_LINEAR_BACKOFF_STEP, DEFAULT_RETRY_MAX_ATTEMPTS, DEFAULT_RETRY_MAX_DELAY, DEFAULT_RO_TX_TIMEOUT, DEFAULT_RW_TX_TIMEOUT, DEFAULT_TOKEN_TTL_SECONDS, DefaultFinalResourceDataPredicate, DefaultPollingRetryOptions, DefaultRetryOptions, DisconnectedError, FieldData, FieldId, FieldRef, FieldStatus, FieldType, Filter, ResourceAPI_Tree_Filter_OperatorType as FilterOperatorType, ResourceAPI_Tree_Filter_Property as FilterProperty, FinalResourceDataPredicate, FutureFieldType, GlobalResourceId, GrantEntry, GrantPermissions, GrantType, GrpcConnection, KeyValue, KeyValueString, LocalFieldId, LocalResourceId, MAX_ADAPTIVE_REQUEST_TIMEOUT, MaxLocalId, MaxTxId, NullResourceId, NullSignedResourceId, OptionalAnyResourceId, OptionalSignedResourceId, PermissionDeniedError, pl_d_exports as Pl, PlClient, PlClientConfig, PlConnectionStatus, PlConnectionStatusListener, PlDriver, PlDriverDefinition, PlError, PlErrorCodeNotFound, PlTransaction, PollFieldTraverseOps, PollResourceAccessor, PollTxAccessor, Property, RESTError, RTT_DEADLINE_MULTIPLIER, RTT_SMOOTHING_ALPHA, RecoverablePlError, type ResourceAPI_Tree_Filter, ResourceData, ResourceIdWithSignature, ResourceKind, ResourceRef, ResourceSignature, ResourceTreeFrame, ResourceTreeItem, ResourceType, ResourceTypeName, ResourceTypePrefix, index_d_exports as RestAPI, RestConnection, Role, SSOAuthMethod, SSOFlowType, SSOLoginAttempt, SUPPORTED_WIRE_PROTOCOLS, SignedResourceId, StorageInfo, test_config_d_exports as TestHelpers, TxCommitConflict, TxOps, TxRunner, UnauthenticatedError, UnauthenticatedPlClient, UnrecoverablePlError, UserDeletionReport, UserEntry, UserResources, ValErr, WireClientProvider, WireClientProviderFactory, WireConnection, addRTypeToMetadata, anyResourceIdToBigint, asSignedResourceId, base64UrlToSignature, checkLocalityOfResourceId, createGlobalResourceId, createLocalResourceId, createRTypeRoutingHeader, createSignedResourceId, defaultPlClient, deriveUnaryDeadline, ensureSignedResourceIdNotNull, expirationFromAuthInformation, extractBasicResourceData, extractTxId, field, getField, hasCapability, inferAuthRefreshTime, isAbortedError, isAnyResourceId, isCancelError, isConnectionProblem, isEveryoneUserLogin, isField, isFieldRef, isLocalResourceId, isNotFoundError, isNotNullSignedResourceId, isNullSignedResourceId, isPermissionDenied, isResource, isResourceId, isResourceRef, isRootResourceId, isSignedResourceId, isTimeoutError, isTimeoutOrCancelError, isTransientCallFailure, isUnauthenticated, isUnimplementedError, jsonToData, parseResourceType, parseSignedResourceId, plAddressToConfig, poll, readyOrDuplicateOrError, resDataToJson, resourceIdFromString, resourceIdToString, resourceType, resourceTypeToString, resourceTypesEqual, rethrowMeaningfulError, setResourceSignaturesRequired, signatureToBase64Url, smoothRtt, stringifyWithResourceId, throwPlNotFoundError, toFieldId, toGlobalFieldId, toGlobalResourceId, toResourceSignature, treeFilter, tryGetFileConfig, valErr, wireProtocol };
+export { AnonymousAuthInformation, AnyFieldId, AnyFieldRef, AnyRef, AnyResourceId, AnyResourceRef, AuthInformation, AuthOps, BackendCapability, BasicResourceData, ColorProof, ContinuePolling, DEFAULT_AUTH_MAX_REFRESH, DEFAULT_LOGIN_TIMEOUT, DEFAULT_MAX_CACHE_BYTES, DEFAULT_REQUEST_TIMEOUT, DEFAULT_RETRY_BACKOFF_ALGORITHM, DEFAULT_RETRY_EXPONENTIAL_BACKOFF_MULTIPLIER, DEFAULT_RETRY_INITIAL_DELAY, DEFAULT_RETRY_JITTER, DEFAULT_RETRY_LINEAR_BACKOFF_STEP, DEFAULT_RETRY_MAX_ATTEMPTS, DEFAULT_RETRY_MAX_DELAY, DEFAULT_RO_TX_TIMEOUT, DEFAULT_RW_TX_TIMEOUT, DEFAULT_TOKEN_TTL_SECONDS, DefaultFinalResourceDataPredicate, DefaultPollingRetryOptions, DefaultRetryOptions, DisconnectedError, FieldData, FieldId, FieldRef, FieldStatus, FieldType, Filter, ResourceAPI_Tree_Filter_OperatorType as FilterOperatorType, ResourceAPI_Tree_Filter_Property as FilterProperty, FinalResourceDataPredicate, FutureFieldType, GlobalResourceId, GrantEntry, GrantPermissions, GrantType, GrpcConnection, KeyValue, KeyValueString, LocalFieldId, LocalResourceId, LoginMethod, MAX_ADAPTIVE_REQUEST_TIMEOUT, MaxLocalId, MaxTxId, NullResourceId, NullSignedResourceId, OptionalAnyResourceId, OptionalSignedResourceId, PermissionDeniedError, pl_d_exports as Pl, PlClient, PlClientConfig, PlConnectionStatus, PlConnectionStatusListener, PlDriver, PlDriverDefinition, PlError, PlErrorCodeNotFound, PlTransaction, PollFieldTraverseOps, PollResourceAccessor, PollTxAccessor, Property, RESTError, RTT_DEADLINE_MULTIPLIER, RTT_SMOOTHING_ALPHA, RecoverablePlError, type ResourceAPI_Tree_Filter, ResourceData, ResourceIdWithSignature, ResourceKind, ResourceRef, ResourceSignature, ResourceTreeFrame, ResourceTreeItem, ResourceType, ResourceTypeName, ResourceTypePrefix, index_d_exports as RestAPI, RestConnection, Role, SSOAuthMethod, SSOFlowType, SSOLoginAttempt, SUPPORTED_WIRE_PROTOCOLS, SignedResourceId, StorageInfo, test_config_d_exports as TestHelpers, TxCommitConflict, TxOps, TxRunner, UnauthenticatedError, UnauthenticatedPlClient, UnrecoverablePlError, UserDeletionReport, UserEntry, UserResources, ValErr, WireClientProvider, WireClientProviderFactory, WireConnection, addRTypeToMetadata, anyResourceIdToBigint, asSignedResourceId, base64UrlToSignature, checkLocalityOfResourceId, createGlobalResourceId, createLocalResourceId, createRTypeRoutingHeader, createSignedResourceId, defaultPlClient, deriveUnaryDeadline, ensureSignedResourceIdNotNull, expirationFromAuthInformation, extractBasicResourceData, extractTxId, field, getField, hasCapability, inferAuthRefreshTime, isAbortedError, isAnyResourceId, isCancelError, isConnectionProblem, isEveryoneUserLogin, isField, isFieldRef, isLocalResourceId, isNotFoundError, isNotNullSignedResourceId, isNullSignedResourceId, isPermissionDenied, isResource, isResourceId, isResourceRef, isRootResourceId, isSignedResourceId, isTimeoutError, isTimeoutOrCancelError, isTransientCallFailure, isUnauthenticated, isUnimplementedError, jsonToData, parseResourceType, parseSignedResourceId, plAddressToConfig, poll, readyOrDuplicateOrError, resDataToJson, resourceIdFromString, resourceIdToString, resourceType, resourceTypeToString, resourceTypesEqual, rethrowMeaningfulError, setResourceSignaturesRequired, signatureToBase64Url, smoothRtt, stringifyWithResourceId, throwPlNotFoundError, toFieldId, toGlobalFieldId, toGlobalResourceId, toResourceSignature, treeFilter, tryGetFileConfig, valErr, wireProtocol };