@better-auth/sso 1.5.6 → 1.6.0-beta.0

package/dist/{index-DoxMd-mL.d.mts → index-eQBsdtYB.d.mts}

@@ -1,5 +1,4 @@
 import { APIError } from "better-auth/api";
-import * as z from "zod";
 import { Awaitable, BetterAuthPlugin, OAuth2Tokens, User } from "better-auth";
 import * as better_call0 from "better-call";
 
@@ -157,6 +156,16 @@ interface SSOOptions {
      */
     provider: SSOProvider<SSOOptions>;
   }) => Awaitable<void>) | undefined;
+  /**
+   * If true, the `provisionUser` callback will be called on every login,
+   * not just when a new user is registered. This is useful when you need
+   * to sync upstream identity provider profile changes on each sign-in.
+   *
+   * The `provisionUser` callback should be idempotent when this is enabled.
+   *
+   * @default false
+   */
+  provisionUserOnEveryLogin?: boolean;
   /**
    * Organization provisioning options
    */
@@ -311,7 +320,7 @@ interface SSOOptions {
      *
      * This works correctly in serverless environments without any additional configuration.
      *
-     * @default false
+     * @default true
      */
     enableInResponseToValidation?: boolean;
     /**
@@ -415,143 +424,118 @@ interface SSOOptions {
 }
 //#endregion
 //#region src/routes/domain-verification.d.ts
-declare const requestDomainVerification: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/request-domain-verification", {
-  method: "POST";
-  body: z.ZodObject<{
-    providerId: z.ZodString;
-  }, z.core.$strip>;
-  metadata: {
-    openapi: {
-      summary: string;
-      description: string;
-      responses: {
-        "404": {
-          description: string;
-        };
-        "409": {
-          description: string;
-        };
-        "201": {
-          description: string;
-        };
-      };
+declare const requestDomainVerification: (options: SSOOptions) => better_call0.Endpoint<"/sso/request-domain-verification", "POST", {
+  providerId: string;
+}, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
+  session: {
+    session: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
     };
   };
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
-    session: {
-      session: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        userId: string;
-        expiresAt: Date;
-        token: string;
-        ipAddress?: string | null | undefined;
-        userAgent?: string | null | undefined;
+}>>], {
+  domainVerificationToken: string;
+}, {
+  openapi: {
+    summary: string;
+    description: string;
+    responses: {
+      "404": {
+        description: string;
       };
-      user: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        email: string;
-        emailVerified: boolean;
-        name: string;
-        image?: string | null | undefined;
+      "409": {
+        description: string;
       };
-    };
-  }>)[];
-}, {
-  domainVerificationToken: string;
-}>;
-declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/verify-domain", {
-  method: "POST";
-  body: z.ZodObject<{
-    providerId: z.ZodString;
-  }, z.core.$strip>;
-  metadata: {
-    openapi: {
-      summary: string;
-      description: string;
-      responses: {
-        "404": {
-          description: string;
-        };
-        "409": {
-          description: string;
-        };
-        "502": {
-          description: string;
-        };
-        "204": {
-          description: string;
-        };
+      "201": {
+        description: string;
       };
     };
   };
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
-    session: {
-      session: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        userId: string;
-        expiresAt: Date;
-        token: string;
-        ipAddress?: string | null | undefined;
-        userAgent?: string | null | undefined;
+}, undefined>;
+declare const verifyDomain: (options: SSOOptions) => better_call0.Endpoint<"/sso/verify-domain", "POST", {
+  providerId: string;
+}, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
+  session: {
+    session: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
+    };
+  };
+}>>], void, {
+  openapi: {
+    summary: string;
+    description: string;
+    responses: {
+      "404": {
+        description: string;
+      };
+      "409": {
+        description: string;
       };
-      user: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        email: string;
-        emailVerified: boolean;
-        name: string;
-        image?: string | null | undefined;
+      "502": {
+        description: string;
+      };
+      "204": {
+        description: string;
       };
     };
-  }>)[];
-}, void>;
+  };
+}, undefined>;
 //#endregion
 //#region src/routes/providers.d.ts
-declare const listSSOProviders: () => better_call0.StrictEndpoint<"/sso/providers", {
-  method: "GET";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
-    session: {
-      session: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        userId: string;
-        expiresAt: Date;
-        token: string;
-        ipAddress?: string | null | undefined;
-        userAgent?: string | null | undefined;
-      };
-      user: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        email: string;
-        emailVerified: boolean;
-        name: string;
-        image?: string | null | undefined;
-      };
+declare const listSSOProviders: () => better_call0.Endpoint<"/sso/providers", "GET", undefined, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
+  session: {
+    session: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
     };
-  }>)[];
-  metadata: {
-    openapi: {
-      operationId: string;
-      summary: string;
-      description: string;
-      responses: {
-        "200": {
-          description: string;
-        };
-      };
+    user: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
     };
   };
-}, {
+}>>], {
   providers: {
     providerId: string;
     type: string;
@@ -590,54 +574,43 @@ declare const listSSOProviders: () => better_call0.StrictEndpoint<"/sso/provider
     } | undefined;
     spMetadataUrl: string;
   }[];
-}>;
-declare const getSSOProvider: () => better_call0.StrictEndpoint<"/sso/get-provider", {
-  method: "GET";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
-    session: {
-      session: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        userId: string;
-        expiresAt: Date;
-        token: string;
-        ipAddress?: string | null | undefined;
-        userAgent?: string | null | undefined;
-      };
-      user: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        email: string;
-        emailVerified: boolean;
-        name: string;
-        image?: string | null | undefined;
+}, {
+  openapi: {
+    operationId: string;
+    summary: string;
+    description: string;
+    responses: {
+      "200": {
+        description: string;
       };
     };
-  }>)[];
-  query: z.ZodObject<{
-    providerId: z.ZodString;
-  }, z.core.$strip>;
-  metadata: {
-    openapi: {
-      operationId: string;
-      summary: string;
-      description: string;
-      responses: {
-        "200": {
-          description: string;
-        };
-        "404": {
-          description: string;
-        };
-        "403": {
-          description: string;
-        };
-      };
+  };
+}, undefined>;
+declare const getSSOProvider: () => better_call0.Endpoint<"/sso/get-provider", "GET", undefined, {
+  providerId: string;
+}, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
+  session: {
+    session: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
     };
   };
-}, {
+}>>], {
   providerId: string;
   type: string;
   issuer: string;
@@ -674,127 +647,119 @@ declare const getSSOProvider: () => better_call0.StrictEndpoint<"/sso/get-provid
     };
   } | undefined;
   spMetadataUrl: string;
-}>;
-declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/update-provider", {
-  method: "POST";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
-    session: {
-      session: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        userId: string;
-        expiresAt: Date;
-        token: string;
-        ipAddress?: string | null | undefined;
-        userAgent?: string | null | undefined;
+}, {
+  openapi: {
+    operationId: string;
+    summary: string;
+    description: string;
+    responses: {
+      "200": {
+        description: string;
       };
-      user: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        email: string;
-        emailVerified: boolean;
-        name: string;
-        image?: string | null | undefined;
+      "404": {
+        description: string;
       };
-    };
-  }>)[];
-  body: z.ZodObject<{
-    issuer: z.ZodOptional<z.ZodString>;
-    domain: z.ZodOptional<z.ZodString>;
-    oidcConfig: z.ZodOptional<z.ZodObject<{
-      clientId: z.ZodOptional<z.ZodString>;
-      clientSecret: z.ZodOptional<z.ZodString>;
-      authorizationEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpoint: z.ZodOptional<z.ZodString>;
-      userInfoEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
-        client_secret_post: "client_secret_post";
-        client_secret_basic: "client_secret_basic";
-      }>>;
-      jwksEndpoint: z.ZodOptional<z.ZodString>;
-      discoveryEndpoint: z.ZodOptional<z.ZodString>;
-      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-      pkce: z.ZodOptional<z.ZodBoolean>;
-      overrideUserInfo: z.ZodOptional<z.ZodBoolean>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodString>;
-        emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodOptional<z.ZodString>;
-        image: z.ZodOptional<z.ZodString>;
-        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    samlConfig: z.ZodOptional<z.ZodObject<{
-      entryPoint: z.ZodOptional<z.ZodString>;
-      cert: z.ZodOptional<z.ZodString>;
-      callbackUrl: z.ZodOptional<z.ZodString>;
-      audience: z.ZodOptional<z.ZodString>;
-      idpMetadata: z.ZodOptional<z.ZodObject<{
-        metadata: z.ZodOptional<z.ZodString>;
-        entityID: z.ZodOptional<z.ZodString>;
-        cert: z.ZodOptional<z.ZodString>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        privateKeyPass: z.ZodOptional<z.ZodString>;
-        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-        encPrivateKey: z.ZodOptional<z.ZodString>;
-        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-        singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
-          Binding: z.ZodString;
-          Location: z.ZodString;
-        }, z.core.$strip>>>;
-      }, z.core.$strip>>;
-      spMetadata: z.ZodOptional<z.ZodObject<{
-        metadata: z.ZodOptional<z.ZodString>;
-        entityID: z.ZodOptional<z.ZodString>;
-        binding: z.ZodOptional<z.ZodString>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        privateKeyPass: z.ZodOptional<z.ZodString>;
-        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-        encPrivateKey: z.ZodOptional<z.ZodString>;
-        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>>;
-      wantAssertionsSigned: z.ZodOptional<z.ZodBoolean>;
-      authnRequestsSigned: z.ZodOptional<z.ZodBoolean>;
-      signatureAlgorithm: z.ZodOptional<z.ZodString>;
-      digestAlgorithm: z.ZodOptional<z.ZodString>;
-      identifierFormat: z.ZodOptional<z.ZodString>;
-      privateKey: z.ZodOptional<z.ZodString>;
-      decryptionPvk: z.ZodOptional<z.ZodString>;
-      additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodString>;
-        emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodOptional<z.ZodString>;
-        firstName: z.ZodOptional<z.ZodString>;
-        lastName: z.ZodOptional<z.ZodString>;
-        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    providerId: z.ZodString;
-  }, z.core.$strip>;
-  metadata: {
-    openapi: {
-      operationId: string;
-      summary: string;
-      description: string;
-      responses: {
-        "200": {
-          description: string;
-        };
-        "404": {
-          description: string;
-        };
-        "403": {
-          description: string;
-        };
+      "403": {
+        description: string;
       };
     };
   };
-}, {
+}, undefined>;
+declare const updateSSOProvider: (options: SSOOptions) => better_call0.Endpoint<"/sso/update-provider", "POST", {
+  providerId: string;
+  issuer?: string | undefined;
+  domain?: string | undefined;
+  oidcConfig?: {
+    clientId?: string | undefined;
+    clientSecret?: string | undefined;
+    authorizationEndpoint?: string | undefined;
+    tokenEndpoint?: string | undefined;
+    userInfoEndpoint?: string | undefined;
+    tokenEndpointAuthentication?: "client_secret_post" | "client_secret_basic" | undefined;
+    jwksEndpoint?: string | undefined;
+    discoveryEndpoint?: string | undefined;
+    scopes?: string[] | undefined;
+    pkce?: boolean | undefined;
+    overrideUserInfo?: boolean | undefined;
+    mapping?: {
+      id?: string | undefined;
+      email?: string | undefined;
+      emailVerified?: string | undefined;
+      name?: string | undefined;
+      image?: string | undefined;
+      extraFields?: Record<string, any> | undefined;
+    } | undefined;
+  } | undefined;
+  samlConfig?: {
+    entryPoint?: string | undefined;
+    cert?: string | undefined;
+    callbackUrl?: string | undefined;
+    audience?: string | undefined;
+    idpMetadata?: {
+      metadata?: string | undefined;
+      entityID?: string | undefined;
+      cert?: string | undefined;
+      privateKey?: string | undefined;
+      privateKeyPass?: string | undefined;
+      isAssertionEncrypted?: boolean | undefined;
+      encPrivateKey?: string | undefined;
+      encPrivateKeyPass?: string | undefined;
+      singleSignOnService?: {
+        Binding: string;
+        Location: string;
+      }[] | undefined;
+    } | undefined;
+    spMetadata?: {
+      metadata?: string | undefined;
+      entityID?: string | undefined;
+      binding?: string | undefined;
+      privateKey?: string | undefined;
+      privateKeyPass?: string | undefined;
+      isAssertionEncrypted?: boolean | undefined;
+      encPrivateKey?: string | undefined;
+      encPrivateKeyPass?: string | undefined;
+    } | undefined;
+    wantAssertionsSigned?: boolean | undefined;
+    authnRequestsSigned?: boolean | undefined;
+    signatureAlgorithm?: string | undefined;
+    digestAlgorithm?: string | undefined;
+    identifierFormat?: string | undefined;
+    privateKey?: string | undefined;
+    decryptionPvk?: string | undefined;
+    additionalParams?: Record<string, any> | undefined;
+    mapping?: {
+      id?: string | undefined;
+      email?: string | undefined;
+      emailVerified?: string | undefined;
+      name?: string | undefined;
+      firstName?: string | undefined;
+      lastName?: string | undefined;
+      extraFields?: Record<string, any> | undefined;
+    } | undefined;
+  } | undefined;
+}, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
+  session: {
+    session: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
+    };
+  };
+}>>], {
   providerId: string;
   type: string;
   issuer: string;
@@ -831,56 +796,68 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
     };
   } | undefined;
   spMetadataUrl: string;
-}>;
-declare const deleteSSOProvider: () => better_call0.StrictEndpoint<"/sso/delete-provider", {
-  method: "POST";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
-    session: {
-      session: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        userId: string;
-        expiresAt: Date;
-        token: string;
-        ipAddress?: string | null | undefined;
-        userAgent?: string | null | undefined;
+}, {
+  openapi: {
+    operationId: string;
+    summary: string;
+    description: string;
+    responses: {
+      "200": {
+        description: string;
       };
-      user: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        email: string;
-        emailVerified: boolean;
-        name: string;
-        image?: string | null | undefined;
+      "404": {
+        description: string;
       };
-    };
-  }>)[];
-  body: z.ZodObject<{
-    providerId: z.ZodString;
-  }, z.core.$strip>;
-  metadata: {
-    openapi: {
-      operationId: string;
-      summary: string;
-      description: string;
-      responses: {
-        "200": {
-          description: string;
-        };
-        "404": {
-          description: string;
-        };
-        "403": {
-          description: string;
-        };
+      "403": {
+        description: string;
       };
     };
   };
-}, {
+}, undefined>;
+declare const deleteSSOProvider: () => better_call0.Endpoint<"/sso/delete-provider", "POST", {
+  providerId: string;
+}, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
+  session: {
+    session: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
+    };
+  };
+}>>], {
   success: boolean;
-}>;
+}, {
+  openapi: {
+    operationId: string;
+    summary: string;
+    description: string;
+    responses: {
+      "200": {
+        description: string;
+      };
+      "404": {
+        description: string;
+      };
+      "403": {
+        description: string;
+      };
+    };
+  };
+}, undefined>;
 //#endregion
 //#region src/routes/sso.d.ts
 interface TimestampValidationOptions {
@@ -901,293 +878,118 @@ interface SAMLConditions {
  * @throws {APIError} If timestamps are invalid, expired, or not yet valid
  */
 declare function validateSAMLTimestamp(conditions: SAMLConditions | undefined, options?: TimestampValidationOptions): void;
-declare const spMetadata: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/metadata", {
-  method: "GET";
-  query: z.ZodObject<{
-    providerId: z.ZodString;
-    format: z.ZodDefault<z.ZodEnum<{
-      json: "json";
-      xml: "xml";
-    }>>;
-  }, z.core.$strip>;
-  metadata: {
-    openapi: {
-      operationId: string;
-      summary: string;
-      description: string;
-      responses: {
-        "200": {
-          description: string;
-        };
+declare const spMetadata: (options?: SSOOptions) => better_call0.Endpoint<"/sso/saml2/sp/metadata", "GET", undefined, {
+  providerId: string;
+  format?: "json" | "xml" | undefined;
+}, [], Response, {
+  openapi: {
+    operationId: string;
+    summary: string;
+    description: string;
+    responses: {
+      "200": {
+        description: string;
       };
     };
   };
-}, Response>;
-declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call0.StrictEndpoint<"/sso/register", {
-  method: "POST";
-  body: z.ZodObject<{
-    providerId: z.ZodString;
-    issuer: z.ZodString;
-    domain: z.ZodString;
-    oidcConfig: z.ZodOptional<z.ZodObject<{
-      clientId: z.ZodString;
-      clientSecret: z.ZodString;
-      authorizationEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpoint: z.ZodOptional<z.ZodString>;
-      userInfoEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
-        client_secret_post: "client_secret_post";
-        client_secret_basic: "client_secret_basic";
-      }>>;
-      jwksEndpoint: z.ZodOptional<z.ZodString>;
-      discoveryEndpoint: z.ZodOptional<z.ZodString>;
-      skipDiscovery: z.ZodOptional<z.ZodBoolean>;
-      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-      pkce: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodString;
-        email: z.ZodString;
-        emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        image: z.ZodOptional<z.ZodString>;
-        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    samlConfig: z.ZodOptional<z.ZodObject<{
-      entryPoint: z.ZodString;
-      cert: z.ZodString;
-      callbackUrl: z.ZodString;
-      audience: z.ZodOptional<z.ZodString>;
-      idpMetadata: z.ZodOptional<z.ZodObject<{
-        metadata: z.ZodOptional<z.ZodString>;
-        entityID: z.ZodOptional<z.ZodString>;
-        cert: z.ZodOptional<z.ZodString>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        privateKeyPass: z.ZodOptional<z.ZodString>;
-        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-        encPrivateKey: z.ZodOptional<z.ZodString>;
-        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-        singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
-          Binding: z.ZodString;
-          Location: z.ZodString;
-        }, z.core.$strip>>>;
-      }, z.core.$strip>>;
-      spMetadata: z.ZodObject<{
-        metadata: z.ZodOptional<z.ZodString>;
-        entityID: z.ZodOptional<z.ZodString>;
-        binding: z.ZodOptional<z.ZodString>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        privateKeyPass: z.ZodOptional<z.ZodString>;
-        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-        encPrivateKey: z.ZodOptional<z.ZodString>;
-        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>;
-      wantAssertionsSigned: z.ZodOptional<z.ZodBoolean>;
-      authnRequestsSigned: z.ZodOptional<z.ZodBoolean>;
-      signatureAlgorithm: z.ZodOptional<z.ZodString>;
-      digestAlgorithm: z.ZodOptional<z.ZodString>;
-      identifierFormat: z.ZodOptional<z.ZodString>;
-      privateKey: z.ZodOptional<z.ZodString>;
-      decryptionPvk: z.ZodOptional<z.ZodString>;
-      additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodString;
-        email: z.ZodString;
-        emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        firstName: z.ZodOptional<z.ZodString>;
-        lastName: z.ZodOptional<z.ZodString>;
-        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    organizationId: z.ZodOptional<z.ZodString>;
-    overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-  }, z.core.$strip>;
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
-    session: {
-      session: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        userId: string;
-        expiresAt: Date;
-        token: string;
-        ipAddress?: string | null | undefined;
-        userAgent?: string | null | undefined;
-      };
-      user: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        email: string;
-        emailVerified: boolean;
-        name: string;
-        image?: string | null | undefined;
-      };
+}, undefined>;
+declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call0.Endpoint<"/sso/register", "POST", {
+  providerId: string;
+  issuer: string;
+  domain: string;
+  oidcConfig?: {
+    clientId: string;
+    clientSecret: string;
+    authorizationEndpoint?: string | undefined;
+    tokenEndpoint?: string | undefined;
+    userInfoEndpoint?: string | undefined;
+    tokenEndpointAuthentication?: "client_secret_post" | "client_secret_basic" | undefined;
+    jwksEndpoint?: string | undefined;
+    discoveryEndpoint?: string | undefined;
+    skipDiscovery?: boolean | undefined;
+    scopes?: string[] | undefined;
+    pkce?: boolean | undefined;
+    mapping?: {
+      id: string;
+      email: string;
+      name: string;
+      emailVerified?: string | undefined;
+      image?: string | undefined;
+      extraFields?: Record<string, any> | undefined;
+    } | undefined;
+  } | undefined;
+  samlConfig?: {
+    entryPoint: string;
+    cert: string;
+    callbackUrl: string;
+    spMetadata: {
+      metadata?: string | undefined;
+      entityID?: string | undefined;
+      binding?: string | undefined;
+      privateKey?: string | undefined;
+      privateKeyPass?: string | undefined;
+      isAssertionEncrypted?: boolean | undefined;
+      encPrivateKey?: string | undefined;
+      encPrivateKeyPass?: string | undefined;
     };
-  }>)[];
-  metadata: {
-    openapi: {
-      operationId: string;
-      summary: string;
-      description: string;
-      responses: {
-        "200": {
-          description: string;
-          content: {
-            "application/json": {
-              schema: {
-                type: "object";
-                properties: {
-                  issuer: {
-                    type: string;
-                    format: string;
-                    description: string;
-                  };
-                  domain: {
-                    type: string;
-                    description: string;
-                  };
-                  domainVerified: {
-                    type: string;
-                    description: string;
-                  };
-                  domainVerificationToken: {
-                    type: string;
-                    description: string;
-                  };
-                  oidcConfig: {
-                    type: string;
-                    properties: {
-                      issuer: {
-                        type: string;
-                        format: string;
-                        description: string;
-                      };
-                      pkce: {
-                        type: string;
-                        description: string;
-                      };
-                      clientId: {
-                        type: string;
-                        description: string;
-                      };
-                      clientSecret: {
-                        type: string;
-                        description: string;
-                      };
-                      authorizationEndpoint: {
-                        type: string;
-                        format: string;
-                        nullable: boolean;
-                        description: string;
-                      };
-                      discoveryEndpoint: {
-                        type: string;
-                        format: string;
-                        description: string;
-                      };
-                      userInfoEndpoint: {
-                        type: string;
-                        format: string;
-                        nullable: boolean;
-                        description: string;
-                      };
-                      scopes: {
-                        type: string;
-                        items: {
-                          type: string;
-                        };
-                        nullable: boolean;
-                        description: string;
-                      };
-                      tokenEndpoint: {
-                        type: string;
-                        format: string;
-                        nullable: boolean;
-                        description: string;
-                      };
-                      tokenEndpointAuthentication: {
-                        type: string;
-                        enum: string[];
-                        nullable: boolean;
-                        description: string;
-                      };
-                      jwksEndpoint: {
-                        type: string;
-                        format: string;
-                        nullable: boolean;
-                        description: string;
-                      };
-                      mapping: {
-                        type: string;
-                        nullable: boolean;
-                        properties: {
-                          id: {
-                            type: string;
-                            description: string;
-                          };
-                          email: {
-                            type: string;
-                            description: string;
-                          };
-                          emailVerified: {
-                            type: string;
-                            nullable: boolean;
-                            description: string;
-                          };
-                          name: {
-                            type: string;
-                            description: string;
-                          };
-                          image: {
-                            type: string;
-                            nullable: boolean;
-                            description: string;
-                          };
-                          extraFields: {
-                            type: string;
-                            additionalProperties: {
-                              type: string;
-                            };
-                            nullable: boolean;
-                            description: string;
-                          };
-                        };
-                        required: string[];
-                      };
-                    };
-                    required: string[];
-                    description: string;
-                  };
-                  organizationId: {
-                    type: string;
-                    nullable: boolean;
-                    description: string;
-                  };
-                  userId: {
-                    type: string;
-                    description: string;
-                  };
-                  providerId: {
-                    type: string;
-                    description: string;
-                  };
-                  redirectURI: {
-                    type: string;
-                    format: string;
-                    description: string;
-                  };
-                };
-                required: string[];
-              };
-            };
-          };
-        };
-      };
+    audience?: string | undefined;
+    idpMetadata?: {
+      metadata?: string | undefined;
+      entityID?: string | undefined;
+      cert?: string | undefined;
+      privateKey?: string | undefined;
+      privateKeyPass?: string | undefined;
+      isAssertionEncrypted?: boolean | undefined;
+      encPrivateKey?: string | undefined;
+      encPrivateKeyPass?: string | undefined;
+      singleSignOnService?: {
+        Binding: string;
+        Location: string;
+      }[] | undefined;
+    } | undefined;
+    wantAssertionsSigned?: boolean | undefined;
+    authnRequestsSigned?: boolean | undefined;
+    signatureAlgorithm?: string | undefined;
+    digestAlgorithm?: string | undefined;
+    identifierFormat?: string | undefined;
+    privateKey?: string | undefined;
+    decryptionPvk?: string | undefined;
+    additionalParams?: Record<string, any> | undefined;
+    mapping?: {
+      id: string;
+      email: string;
+      name: string;
+      emailVerified?: string | undefined;
+      firstName?: string | undefined;
+      lastName?: string | undefined;
+      extraFields?: Record<string, any> | undefined;
+    } | undefined;
+  } | undefined;
+  organizationId?: string | undefined;
+  overrideUserInfo?: boolean | undefined;
+}, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
+  session: {
+    session: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
     };
   };
-}, O["domainVerification"] extends {
+}>>], O["domainVerification"] extends {
   enabled: true;
 } ? {
   redirectURI: string;
@@ -1200,62 +1002,156 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
   redirectURI: string;
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
-} & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig">>;
-declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sign-in/sso", {
-  method: "POST";
-  body: z.ZodObject<{
-    email: z.ZodOptional<z.ZodString>;
-    organizationSlug: z.ZodOptional<z.ZodString>;
-    providerId: z.ZodOptional<z.ZodString>;
-    domain: z.ZodOptional<z.ZodString>;
-    callbackURL: z.ZodString;
-    errorCallbackURL: z.ZodOptional<z.ZodString>;
-    newUserCallbackURL: z.ZodOptional<z.ZodString>;
-    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    loginHint: z.ZodOptional<z.ZodString>;
-    requestSignUp: z.ZodOptional<z.ZodBoolean>;
-    providerType: z.ZodOptional<z.ZodEnum<{
-      saml: "saml";
-      oidc: "oidc";
-    }>>;
-  }, z.core.$strip>;
-  metadata: {
-    openapi: {
-      operationId: string;
-      summary: string;
-      description: string;
-      requestBody: {
+} & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig">, {
+  openapi: {
+    operationId: string;
+    summary: string;
+    description: string;
+    responses: {
+      "200": {
+        description: string;
         content: {
           "application/json": {
             schema: {
               type: "object";
               properties: {
-                email: {
+                issuer: {
                   type: string;
+                  format: string;
                   description: string;
                 };
-                issuer: {
+                domain: {
                   type: string;
                   description: string;
                 };
-                providerId: {
+                domainVerified: {
                   type: string;
                   description: string;
                 };
-                callbackURL: {
+                domainVerificationToken: {
+                  type: string;
+                  description: string;
+                };
+                oidcConfig: {
+                  type: string;
+                  properties: {
+                    issuer: {
+                      type: string;
+                      format: string;
+                      description: string;
+                    };
+                    pkce: {
+                      type: string;
+                      description: string;
+                    };
+                    clientId: {
+                      type: string;
+                      description: string;
+                    };
+                    clientSecret: {
+                      type: string;
+                      description: string;
+                    };
+                    authorizationEndpoint: {
+                      type: string;
+                      format: string;
+                      nullable: boolean;
+                      description: string;
+                    };
+                    discoveryEndpoint: {
+                      type: string;
+                      format: string;
+                      description: string;
+                    };
+                    userInfoEndpoint: {
+                      type: string;
+                      format: string;
+                      nullable: boolean;
+                      description: string;
+                    };
+                    scopes: {
+                      type: string;
+                      items: {
+                        type: string;
+                      };
+                      nullable: boolean;
+                      description: string;
+                    };
+                    tokenEndpoint: {
+                      type: string;
+                      format: string;
+                      nullable: boolean;
+                      description: string;
+                    };
+                    tokenEndpointAuthentication: {
+                      type: string;
+                      enum: string[];
+                      nullable: boolean;
+                      description: string;
+                    };
+                    jwksEndpoint: {
+                      type: string;
+                      format: string;
+                      nullable: boolean;
+                      description: string;
+                    };
+                    mapping: {
+                      type: string;
+                      nullable: boolean;
+                      properties: {
+                        id: {
+                          type: string;
+                          description: string;
+                        };
+                        email: {
+                          type: string;
+                          description: string;
+                        };
+                        emailVerified: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        name: {
+                          type: string;
+                          description: string;
+                        };
+                        image: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        extraFields: {
+                          type: string;
+                          additionalProperties: {
+                            type: string;
+                          };
+                          nullable: boolean;
+                          description: string;
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                  required: string[];
+                  description: string;
+                };
+                organizationId: {
                   type: string;
+                  nullable: boolean;
                   description: string;
                 };
-                errorCallbackURL: {
+                userId: {
                   type: string;
                   description: string;
                 };
-                newUserCallbackURL: {
+                providerId: {
                   type: string;
                   description: string;
                 };
-                loginHint: {
+                redirectURI: {
                   type: string;
+                  format: string;
                   description: string;
                 };
               };
@@ -1264,192 +1160,222 @@ declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"
           };
         };
       };
-      responses: {
-        "200": {
-          description: string;
-          content: {
-            "application/json": {
-              schema: {
-                type: "object";
-                properties: {
-                  url: {
-                    type: string;
-                    format: string;
-                    description: string;
-                  };
-                  redirect: {
-                    type: string;
-                    description: string;
-                    enum: boolean[];
-                  };
+    };
+  };
+}, undefined>;
+declare const signInSSO: (options?: SSOOptions) => better_call0.Endpoint<"/sign-in/sso", "POST", {
+  callbackURL: string;
+  email?: string | undefined;
+  organizationSlug?: string | undefined;
+  providerId?: string | undefined;
+  domain?: string | undefined;
+  errorCallbackURL?: string | undefined;
+  newUserCallbackURL?: string | undefined;
+  scopes?: string[] | undefined;
+  loginHint?: string | undefined;
+  requestSignUp?: boolean | undefined;
+  providerType?: "saml" | "oidc" | undefined;
+}, Record<string, any> | undefined, [], {
+  url: string;
+  redirect: boolean;
+}, {
+  openapi: {
+    operationId: string;
+    summary: string;
+    description: string;
+    requestBody: {
+      content: {
+        "application/json": {
+          schema: {
+            type: "object";
+            properties: {
+              email: {
+                type: string;
+                description: string;
+              };
+              issuer: {
+                type: string;
+                description: string;
+              };
+              providerId: {
+                type: string;
+                description: string;
+              };
+              callbackURL: {
+                type: string;
+                description: string;
+              };
+              errorCallbackURL: {
+                type: string;
+                description: string;
+              };
+              newUserCallbackURL: {
+                type: string;
+                description: string;
+              };
+              loginHint: {
+                type: string;
+                description: string;
+              };
+            };
+            required: string[];
+          };
+        };
+      };
+    };
+    responses: {
+      "200": {
+        description: string;
+        content: {
+          "application/json": {
+            schema: {
+              type: "object";
+              properties: {
+                url: {
+                  type: string;
+                  format: string;
+                  description: string;
+                };
+                redirect: {
+                  type: string;
+                  description: string;
+                  enum: boolean[];
                 };
-                required: string[];
               };
+              required: string[];
             };
           };
         };
       };
     };
   };
-}, {
-  url: string;
-  redirect: boolean;
-}>;
-declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback/:providerId", {
-  method: "GET";
-  query: z.ZodObject<{
-    code: z.ZodOptional<z.ZodString>;
-    state: z.ZodString;
-    error: z.ZodOptional<z.ZodString>;
-    error_description: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>;
-  allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
-  metadata: {
-    openapi: {
-      operationId: string;
-      summary: string;
-      description: string;
-      responses: {
-        "302": {
-          description: string;
-        };
+}, undefined>;
+declare const callbackSSO: (options?: SSOOptions) => better_call0.Endpoint<"/sso/callback/:providerId", "GET", undefined, {
+  state: string;
+  code?: string | undefined;
+  error?: string | undefined;
+  error_description?: string | undefined;
+}, [], void, {
+  openapi: {
+    operationId: string;
+    summary: string;
+    description: string;
+    responses: {
+      "302": {
+        description: string;
       };
     };
-    scope: "server";
   };
-}, void>;
+  scope: "server";
+}, undefined>;
 /**
  * Shared OIDC callback endpoint (no `:providerId` in path).
  * Used when `options.redirectURI` is set — the `providerId` is read from
  * the OAuth state instead of the URL path.
  */
-declare const callbackSSOShared: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback", {
-  metadata: {
-    openapi: {
-      operationId: string;
-      summary: string;
-      description: string;
-      responses: {
-        "302": {
-          description: string;
-        };
+declare const callbackSSOShared: (options?: SSOOptions) => better_call0.Endpoint<"/sso/callback", "GET", undefined, {
+  state: string;
+  code?: string | undefined;
+  error?: string | undefined;
+  error_description?: string | undefined;
+}, [], void, {
+  openapi: {
+    operationId: string;
+    summary: string;
+    description: string;
+    responses: {
+      "302": {
+        description: string;
       };
     };
-    scope: "server";
   };
-  method: "GET";
-  query: z.ZodObject<{
-    code: z.ZodOptional<z.ZodString>;
-    state: z.ZodString;
-    error: z.ZodOptional<z.ZodString>;
-    error_description: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>;
-  allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
-}, void>;
-declare const callbackSSOSAML: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/callback/:providerId", {
-  method: ("POST" | "GET")[];
-  body: z.ZodOptional<z.ZodObject<{
-    SAMLResponse: z.ZodString;
-    RelayState: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>>;
-  query: z.ZodOptional<z.ZodObject<{
-    RelayState: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>>;
-  metadata: {
-    allowedMediaTypes: string[];
-    openapi: {
-      operationId: string;
-      summary: string;
-      description: string;
-      responses: {
-        "302": {
-          description: string;
-        };
-        "400": {
-          description: string;
-        };
-        "401": {
-          description: string;
-        };
+  scope: "server";
+}, undefined>;
+declare const callbackSSOSAML: (options?: SSOOptions) => better_call0.Endpoint<"/sso/saml2/callback/:providerId", ("GET" | "POST")[], {
+  SAMLResponse: string;
+  RelayState?: string | undefined;
+} | undefined, {
+  RelayState?: string | undefined;
+} | undefined, [], never, {
+  allowedMediaTypes: string[];
+  openapi: {
+    operationId: string;
+    summary: string;
+    description: string;
+    responses: {
+      "302": {
+        description: string;
+      };
+      "400": {
+        description: string;
+      };
+      "401": {
+        description: string;
       };
     };
-    scope: "server";
   };
-}, never>;
-declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
-  method: "POST";
-  body: z.ZodObject<{
-    SAMLResponse: z.ZodString;
-    RelayState: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>;
-  metadata: {
-    allowedMediaTypes: string[];
-    openapi: {
-      operationId: string;
-      summary: string;
-      description: string;
-      responses: {
-        "302": {
-          description: string;
-        };
+  scope: "server";
+}, undefined>;
+declare const acsEndpoint: (options?: SSOOptions) => better_call0.Endpoint<"/sso/saml2/sp/acs/:providerId", "POST", {
+  SAMLResponse: string;
+  RelayState?: string | undefined;
+}, Record<string, any> | undefined, [], never, {
+  allowedMediaTypes: string[];
+  openapi: {
+    operationId: string;
+    summary: string;
+    description: string;
+    responses: {
+      "302": {
+        description: string;
       };
     };
-    scope: "server";
-  };
-}, never>;
-declare const sloEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
-  method: ("POST" | "GET")[];
-  body: z.ZodOptional<z.ZodObject<{
-    SAMLRequest: z.ZodOptional<z.ZodString>;
-    SAMLResponse: z.ZodOptional<z.ZodString>;
-    RelayState: z.ZodOptional<z.ZodString>;
-    SigAlg: z.ZodOptional<z.ZodString>;
-    Signature: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>>;
-  query: z.ZodOptional<z.ZodObject<{
-    SAMLRequest: z.ZodOptional<z.ZodString>;
-    SAMLResponse: z.ZodOptional<z.ZodString>;
-    RelayState: z.ZodOptional<z.ZodString>;
-    SigAlg: z.ZodOptional<z.ZodString>;
-    Signature: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>>;
-  metadata: {
-    allowedMediaTypes: string[];
-    scope: "server";
   };
-}, void | Response>;
-declare const initiateSLO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/logout/:providerId", {
-  method: "POST";
-  body: z.ZodObject<{
-    callbackURL: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>;
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
-    session: {
-      session: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        userId: string;
-        expiresAt: Date;
-        token: string;
-        ipAddress?: string | null | undefined;
-        userAgent?: string | null | undefined;
-      };
-      user: Record<string, any> & {
-        id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        email: string;
-        emailVerified: boolean;
-        name: string;
-        image?: string | null | undefined;
-      };
+  scope: "server";
+}, undefined>;
+declare const sloEndpoint: (options?: SSOOptions) => better_call0.Endpoint<"/sso/saml2/sp/slo/:providerId", ("GET" | "POST")[], {
+  SAMLRequest?: string | undefined;
+  SAMLResponse?: string | undefined;
+  RelayState?: string | undefined;
+  SigAlg?: string | undefined;
+  Signature?: string | undefined;
+} | undefined, {
+  SAMLRequest?: string | undefined;
+  SAMLResponse?: string | undefined;
+  RelayState?: string | undefined;
+  SigAlg?: string | undefined;
+  Signature?: string | undefined;
+} | undefined, [], void | Response, {
+  allowedMediaTypes: string[];
+  scope: "server";
+}, undefined>;
+declare const initiateSLO: (options?: SSOOptions) => better_call0.Endpoint<"/sso/saml2/logout/:providerId", "POST", {
+  callbackURL?: string | undefined;
+}, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
+  session: {
+    session: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
     };
-  }>)[];
-  metadata: {
-    readonly scope: "server";
   };
-}, never>;
+}>>], never, {
+  readonly scope: "server";
+}, undefined>;
 //#endregion
 //#region src/constants.d.ts
 /**
@@ -1749,6 +1675,7 @@ type SSOEndpoints<O extends SSOOptions> = {
 };
 type SSOPlugin<O extends SSOOptions> = {
   id: "sso";
+  version: string;
   endpoints: SSOEndpoints<O> & (O extends {
     domainVerification: {
       enabled: true;
@@ -1761,15 +1688,16 @@ declare function sso<O extends SSOOptions & {
   };
 }>(options?: O | undefined): {
   id: "sso";
+  version: string;
   endpoints: SSOEndpoints<O> & DomainVerificationEndpoints;
   schema: NonNullable<BetterAuthPlugin["schema"]>;
-  options: O;
+  options: NoInfer<O>;
 };
 declare function sso<O extends SSOOptions>(options?: O | undefined): {
   id: "sso";
+  version: string;
   endpoints: SSOEndpoints<O>;
-  options: O;
+  options: NoInfer<O>;
 };
 //#endregion
-export { DataEncryptionAlgorithm as A, TimestampValidationOptions as C, SSOOptions as D, SAMLConfig as E, DigestAlgorithm as M, KeyEncryptionAlgorithm as N, SSOProvider as O, SignatureAlgorithm as P, SAMLConditions as S, OIDCConfig as T, REQUIRED_DISCOVERY_FIELDS as _, fetchDiscoveryDocument as a, DEFAULT_MAX_SAML_METADATA_SIZE as b, normalizeUrl as c, validateDiscoveryUrl as d, DiscoverOIDCConfigParams as f, OIDCDiscoveryDocument as g, HydratedOIDCConfig as h, discoverOIDCConfig as i, DeprecatedAlgorithmBehavior as j, AlgorithmValidationOptions as k, selectTokenEndpointAuthMethod as l, DiscoveryErrorCode as m, sso as n, needsRuntimeDiscovery as o, DiscoveryError as p, computeDiscoveryUrl as r, normalizeDiscoveryUrls as s, SSOPlugin as t, validateDiscoveryDocument as u, RequiredDiscoveryField as v, validateSAMLTimestamp as w, DEFAULT_MAX_SAML_RESPONSE_SIZE as x, DEFAULT_CLOCK_SKEW_MS as y };
-//# sourceMappingURL=index-DoxMd-mL.d.mts.map
+export { DataEncryptionAlgorithm as A, TimestampValidationOptions as C, SSOOptions as D, SAMLConfig as E, DigestAlgorithm as M, KeyEncryptionAlgorithm as N, SSOProvider as O, SignatureAlgorithm as P, SAMLConditions as S, OIDCConfig as T, REQUIRED_DISCOVERY_FIELDS as _, fetchDiscoveryDocument as a, DEFAULT_MAX_SAML_METADATA_SIZE as b, normalizeUrl as c, validateDiscoveryUrl as d, DiscoverOIDCConfigParams as f, OIDCDiscoveryDocument as g, HydratedOIDCConfig as h, discoverOIDCConfig as i, DeprecatedAlgorithmBehavior as j, AlgorithmValidationOptions as k, selectTokenEndpointAuthMethod as l, DiscoveryErrorCode as m, sso as n, needsRuntimeDiscovery as o, DiscoveryError as p, computeDiscoveryUrl as r, normalizeDiscoveryUrls as s, SSOPlugin as t, validateDiscoveryDocument as u, RequiredDiscoveryField as v, validateSAMLTimestamp as w, DEFAULT_MAX_SAML_RESPONSE_SIZE as x, DEFAULT_CLOCK_SKEW_MS as y };