@better-auth/sso 1.5.7-beta.1 → 1.6.0

package/dist/{index-N-z2Csye.d.mts → index-iRhhiRKL.d.mts}

@@ -1,4 +1,5 @@
 import { APIError } from "better-auth/api";
+import * as z from "zod";
 import { Awaitable, BetterAuthPlugin, OAuth2Tokens, User } from "better-auth";
 import * as better_call0 from "better-call";
 
@@ -156,6 +157,16 @@ interface SSOOptions {
      */
     provider: SSOProvider<SSOOptions>;
   }) => Awaitable<void>) | undefined;
+  /**
+   * If true, the `provisionUser` callback will be called on every login,
+   * not just when a new user is registered. This is useful when you need
+   * to sync upstream identity provider profile changes on each sign-in.
+   *
+   * The `provisionUser` callback should be idempotent when this is enabled.
+   *
+   * @default false
+   */
+  provisionUserOnEveryLogin?: boolean;
   /**
    * Organization provisioning options
    */
@@ -310,7 +321,7 @@ interface SSOOptions {
      *
      * This works correctly in serverless environments without any additional configuration.
      *
-     * @default false
+     * @default true
      */
     enableInResponseToValidation?: boolean;
     /**
@@ -414,118 +425,143 @@ interface SSOOptions {
 }
 //#endregion
 //#region src/routes/domain-verification.d.ts
-declare const requestDomainVerification: (options: SSOOptions) => better_call0.Endpoint<"/sso/request-domain-verification", "POST", {
-  providerId: string;
-}, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
-  session: {
-    session: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      userId: string;
-      expiresAt: Date;
-      token: string;
-      ipAddress?: string | null | undefined;
-      userAgent?: string | null | undefined;
-    };
-    user: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      email: string;
-      emailVerified: boolean;
-      name: string;
-      image?: string | null | undefined;
+declare const requestDomainVerification: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/request-domain-verification", {
+  method: "POST";
+  body: z.ZodObject<{
+    providerId: z.ZodString;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      summary: string;
+      description: string;
+      responses: {
+        "404": {
+          description: string;
+        };
+        "409": {
+          description: string;
+        };
+        "201": {
+          description: string;
+        };
+      };
     };
   };
-}>>], {
-  domainVerificationToken: string;
-}, {
-  openapi: {
-    summary: string;
-    description: string;
-    responses: {
-      "404": {
-        description: string;
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
       };
-      "409": {
-        description: string;
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
       };
-      "201": {
-        description: string;
-      };
-    };
-  };
-}, undefined>;
-declare const verifyDomain: (options: SSOOptions) => better_call0.Endpoint<"/sso/verify-domain", "POST", {
-  providerId: string;
-}, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
-  session: {
-    session: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      userId: string;
-      expiresAt: Date;
-      token: string;
-      ipAddress?: string | null | undefined;
-      userAgent?: string | null | undefined;
     };
-    user: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      email: string;
-      emailVerified: boolean;
-      name: string;
-      image?: string | null | undefined;
+  }>)[];
+}, {
+  domainVerificationToken: string;
+}>;
+declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/verify-domain", {
+  method: "POST";
+  body: z.ZodObject<{
+    providerId: z.ZodString;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      summary: string;
+      description: string;
+      responses: {
+        "404": {
+          description: string;
+        };
+        "409": {
+          description: string;
+        };
+        "502": {
+          description: string;
+        };
+        "204": {
+          description: string;
+        };
+      };
     };
   };
-}>>], void, {
-  openapi: {
-    summary: string;
-    description: string;
-    responses: {
-      "404": {
-        description: string;
-      };
-      "409": {
-        description: string;
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
       };
-      "502": {
-        description: string;
-      };
-      "204": {
-        description: string;
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
       };
     };
-  };
-}, undefined>;
+  }>)[];
+}, void>;
 //#endregion
 //#region src/routes/providers.d.ts
-declare const listSSOProviders: () => better_call0.Endpoint<"/sso/providers", "GET", undefined, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
-  session: {
-    session: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      userId: string;
-      expiresAt: Date;
-      token: string;
-      ipAddress?: string | null | undefined;
-      userAgent?: string | null | undefined;
+declare const listSSOProviders: () => better_call0.StrictEndpoint<"/sso/providers", {
+  method: "GET";
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
     };
-    user: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      email: string;
-      emailVerified: boolean;
-      name: string;
-      image?: string | null | undefined;
+  }>)[];
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+        };
+      };
     };
   };
-}>>], {
+}, {
   providers: {
     providerId: string;
     type: string;
@@ -564,43 +600,54 @@ declare const listSSOProviders: () => better_call0.Endpoint<"/sso/providers", "G
     } | undefined;
     spMetadataUrl: string;
   }[];
-}, {
-  openapi: {
-    operationId: string;
-    summary: string;
-    description: string;
-    responses: {
-      "200": {
-        description: string;
+}>;
+declare const getSSOProvider: () => better_call0.StrictEndpoint<"/sso/get-provider", {
+  method: "GET";
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
       };
     };
-  };
-}, undefined>;
-declare const getSSOProvider: () => better_call0.Endpoint<"/sso/get-provider", "GET", undefined, {
-  providerId: string;
-}, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
-  session: {
-    session: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      userId: string;
-      expiresAt: Date;
-      token: string;
-      ipAddress?: string | null | undefined;
-      userAgent?: string | null | undefined;
-    };
-    user: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      email: string;
-      emailVerified: boolean;
-      name: string;
-      image?: string | null | undefined;
+  }>)[];
+  query: z.ZodObject<{
+    providerId: z.ZodString;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+        };
+        "404": {
+          description: string;
+        };
+        "403": {
+          description: string;
+        };
+      };
     };
   };
-}>>], {
+}, {
   providerId: string;
   type: string;
   issuer: string;
@@ -637,119 +684,127 @@ declare const getSSOProvider: () => better_call0.Endpoint<"/sso/get-provider", "
     };
   } | undefined;
   spMetadataUrl: string;
-}, {
-  openapi: {
-    operationId: string;
-    summary: string;
-    description: string;
-    responses: {
-      "200": {
-        description: string;
+}>;
+declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/update-provider", {
+  method: "POST";
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
       };
-      "404": {
-        description: string;
-      };
-      "403": {
-        description: string;
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
       };
     };
-  };
-}, undefined>;
-declare const updateSSOProvider: (options: SSOOptions) => better_call0.Endpoint<"/sso/update-provider", "POST", {
-  providerId: string;
-  issuer?: string | undefined;
-  domain?: string | undefined;
-  oidcConfig?: {
-    clientId?: string | undefined;
-    clientSecret?: string | undefined;
-    authorizationEndpoint?: string | undefined;
-    tokenEndpoint?: string | undefined;
-    userInfoEndpoint?: string | undefined;
-    tokenEndpointAuthentication?: "client_secret_post" | "client_secret_basic" | undefined;
-    jwksEndpoint?: string | undefined;
-    discoveryEndpoint?: string | undefined;
-    scopes?: string[] | undefined;
-    pkce?: boolean | undefined;
-    overrideUserInfo?: boolean | undefined;
-    mapping?: {
-      id?: string | undefined;
-      email?: string | undefined;
-      emailVerified?: string | undefined;
-      name?: string | undefined;
-      image?: string | undefined;
-      extraFields?: Record<string, any> | undefined;
-    } | undefined;
-  } | undefined;
-  samlConfig?: {
-    entryPoint?: string | undefined;
-    cert?: string | undefined;
-    callbackUrl?: string | undefined;
-    audience?: string | undefined;
-    idpMetadata?: {
-      metadata?: string | undefined;
-      entityID?: string | undefined;
-      cert?: string | undefined;
-      privateKey?: string | undefined;
-      privateKeyPass?: string | undefined;
-      isAssertionEncrypted?: boolean | undefined;
-      encPrivateKey?: string | undefined;
-      encPrivateKeyPass?: string | undefined;
-      singleSignOnService?: {
-        Binding: string;
-        Location: string;
-      }[] | undefined;
-    } | undefined;
-    spMetadata?: {
-      metadata?: string | undefined;
-      entityID?: string | undefined;
-      binding?: string | undefined;
-      privateKey?: string | undefined;
-      privateKeyPass?: string | undefined;
-      isAssertionEncrypted?: boolean | undefined;
-      encPrivateKey?: string | undefined;
-      encPrivateKeyPass?: string | undefined;
-    } | undefined;
-    wantAssertionsSigned?: boolean | undefined;
-    authnRequestsSigned?: boolean | undefined;
-    signatureAlgorithm?: string | undefined;
-    digestAlgorithm?: string | undefined;
-    identifierFormat?: string | undefined;
-    privateKey?: string | undefined;
-    decryptionPvk?: string | undefined;
-    additionalParams?: Record<string, any> | undefined;
-    mapping?: {
-      id?: string | undefined;
-      email?: string | undefined;
-      emailVerified?: string | undefined;
-      name?: string | undefined;
-      firstName?: string | undefined;
-      lastName?: string | undefined;
-      extraFields?: Record<string, any> | undefined;
-    } | undefined;
-  } | undefined;
-}, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
-  session: {
-    session: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      userId: string;
-      expiresAt: Date;
-      token: string;
-      ipAddress?: string | null | undefined;
-      userAgent?: string | null | undefined;
-    };
-    user: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      email: string;
-      emailVerified: boolean;
-      name: string;
-      image?: string | null | undefined;
+  }>)[];
+  body: z.ZodObject<{
+    issuer: z.ZodOptional<z.ZodString>;
+    domain: z.ZodOptional<z.ZodString>;
+    oidcConfig: z.ZodOptional<z.ZodObject<{
+      clientId: z.ZodOptional<z.ZodString>;
+      clientSecret: z.ZodOptional<z.ZodString>;
+      authorizationEndpoint: z.ZodOptional<z.ZodString>;
+      tokenEndpoint: z.ZodOptional<z.ZodString>;
+      userInfoEndpoint: z.ZodOptional<z.ZodString>;
+      tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
+        client_secret_post: "client_secret_post";
+        client_secret_basic: "client_secret_basic";
+      }>>;
+      jwksEndpoint: z.ZodOptional<z.ZodString>;
+      discoveryEndpoint: z.ZodOptional<z.ZodString>;
+      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      pkce: z.ZodOptional<z.ZodBoolean>;
+      overrideUserInfo: z.ZodOptional<z.ZodBoolean>;
+      mapping: z.ZodOptional<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        emailVerified: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        image: z.ZodOptional<z.ZodString>;
+        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    samlConfig: z.ZodOptional<z.ZodObject<{
+      entryPoint: z.ZodOptional<z.ZodString>;
+      cert: z.ZodOptional<z.ZodString>;
+      callbackUrl: z.ZodOptional<z.ZodString>;
+      audience: z.ZodOptional<z.ZodString>;
+      idpMetadata: z.ZodOptional<z.ZodObject<{
+        metadata: z.ZodOptional<z.ZodString>;
+        entityID: z.ZodOptional<z.ZodString>;
+        cert: z.ZodOptional<z.ZodString>;
+        privateKey: z.ZodOptional<z.ZodString>;
+        privateKeyPass: z.ZodOptional<z.ZodString>;
+        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
+        encPrivateKey: z.ZodOptional<z.ZodString>;
+        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
+        singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
+          Binding: z.ZodString;
+          Location: z.ZodString;
+        }, z.core.$strip>>>;
+      }, z.core.$strip>>;
+      spMetadata: z.ZodOptional<z.ZodObject<{
+        metadata: z.ZodOptional<z.ZodString>;
+        entityID: z.ZodOptional<z.ZodString>;
+        binding: z.ZodOptional<z.ZodString>;
+        privateKey: z.ZodOptional<z.ZodString>;
+        privateKeyPass: z.ZodOptional<z.ZodString>;
+        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
+        encPrivateKey: z.ZodOptional<z.ZodString>;
+        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+      wantAssertionsSigned: z.ZodOptional<z.ZodBoolean>;
+      authnRequestsSigned: z.ZodOptional<z.ZodBoolean>;
+      signatureAlgorithm: z.ZodOptional<z.ZodString>;
+      digestAlgorithm: z.ZodOptional<z.ZodString>;
+      identifierFormat: z.ZodOptional<z.ZodString>;
+      privateKey: z.ZodOptional<z.ZodString>;
+      decryptionPvk: z.ZodOptional<z.ZodString>;
+      additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      mapping: z.ZodOptional<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        emailVerified: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        firstName: z.ZodOptional<z.ZodString>;
+        lastName: z.ZodOptional<z.ZodString>;
+        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    providerId: z.ZodString;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+        };
+        "404": {
+          description: string;
+        };
+        "403": {
+          description: string;
+        };
+      };
     };
   };
-}>>], {
+}, {
   providerId: string;
   type: string;
   issuer: string;
@@ -786,68 +841,56 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.Endpoint<
     };
   } | undefined;
   spMetadataUrl: string;
-}, {
-  openapi: {
-    operationId: string;
-    summary: string;
-    description: string;
-    responses: {
-      "200": {
-        description: string;
+}>;
+declare const deleteSSOProvider: () => better_call0.StrictEndpoint<"/sso/delete-provider", {
+  method: "POST";
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
       };
-      "404": {
-        description: string;
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
       };
-      "403": {
-        description: string;
-      };
-    };
-  };
-}, undefined>;
-declare const deleteSSOProvider: () => better_call0.Endpoint<"/sso/delete-provider", "POST", {
-  providerId: string;
-}, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
-  session: {
-    session: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      userId: string;
-      expiresAt: Date;
-      token: string;
-      ipAddress?: string | null | undefined;
-      userAgent?: string | null | undefined;
     };
-    user: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      email: string;
-      emailVerified: boolean;
-      name: string;
-      image?: string | null | undefined;
-    };
-  };
-}>>], {
-  success: boolean;
-}, {
-  openapi: {
-    operationId: string;
-    summary: string;
-    description: string;
-    responses: {
-      "200": {
-        description: string;
-      };
-      "404": {
-        description: string;
-      };
-      "403": {
-        description: string;
+  }>)[];
+  body: z.ZodObject<{
+    providerId: z.ZodString;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+        };
+        "404": {
+          description: string;
+        };
+        "403": {
+          description: string;
+        };
       };
     };
   };
-}, undefined>;
+}, {
+  success: boolean;
+}>;
 //#endregion
 //#region src/routes/sso.d.ts
 interface TimestampValidationOptions {
@@ -868,118 +911,293 @@ interface SAMLConditions {
  * @throws {APIError} If timestamps are invalid, expired, or not yet valid
  */
 declare function validateSAMLTimestamp(conditions: SAMLConditions | undefined, options?: TimestampValidationOptions): void;
-declare const spMetadata: (options?: SSOOptions) => better_call0.Endpoint<"/sso/saml2/sp/metadata", "GET", undefined, {
-  providerId: string;
-  format?: "json" | "xml" | undefined;
-}, [], Response, {
-  openapi: {
-    operationId: string;
-    summary: string;
-    description: string;
-    responses: {
-      "200": {
-        description: string;
+declare const spMetadata: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/metadata", {
+  method: "GET";
+  query: z.ZodObject<{
+    providerId: z.ZodString;
+    format: z.ZodDefault<z.ZodEnum<{
+      json: "json";
+      xml: "xml";
+    }>>;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+        };
       };
     };
   };
-}, undefined>;
-declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call0.Endpoint<"/sso/register", "POST", {
-  providerId: string;
-  issuer: string;
-  domain: string;
-  oidcConfig?: {
-    clientId: string;
-    clientSecret: string;
-    authorizationEndpoint?: string | undefined;
-    tokenEndpoint?: string | undefined;
-    userInfoEndpoint?: string | undefined;
-    tokenEndpointAuthentication?: "client_secret_post" | "client_secret_basic" | undefined;
-    jwksEndpoint?: string | undefined;
-    discoveryEndpoint?: string | undefined;
-    skipDiscovery?: boolean | undefined;
-    scopes?: string[] | undefined;
-    pkce?: boolean | undefined;
-    mapping?: {
-      id: string;
-      email: string;
-      name: string;
-      emailVerified?: string | undefined;
-      image?: string | undefined;
-      extraFields?: Record<string, any> | undefined;
-    } | undefined;
-  } | undefined;
-  samlConfig?: {
-    entryPoint: string;
-    cert: string;
-    callbackUrl: string;
-    spMetadata: {
-      metadata?: string | undefined;
-      entityID?: string | undefined;
-      binding?: string | undefined;
-      privateKey?: string | undefined;
-      privateKeyPass?: string | undefined;
-      isAssertionEncrypted?: boolean | undefined;
-      encPrivateKey?: string | undefined;
-      encPrivateKeyPass?: string | undefined;
-    };
-    audience?: string | undefined;
-    idpMetadata?: {
-      metadata?: string | undefined;
-      entityID?: string | undefined;
-      cert?: string | undefined;
-      privateKey?: string | undefined;
-      privateKeyPass?: string | undefined;
-      isAssertionEncrypted?: boolean | undefined;
-      encPrivateKey?: string | undefined;
-      encPrivateKeyPass?: string | undefined;
-      singleSignOnService?: {
-        Binding: string;
-        Location: string;
-      }[] | undefined;
-    } | undefined;
-    wantAssertionsSigned?: boolean | undefined;
-    authnRequestsSigned?: boolean | undefined;
-    signatureAlgorithm?: string | undefined;
-    digestAlgorithm?: string | undefined;
-    identifierFormat?: string | undefined;
-    privateKey?: string | undefined;
-    decryptionPvk?: string | undefined;
-    additionalParams?: Record<string, any> | undefined;
-    mapping?: {
-      id: string;
-      email: string;
-      name: string;
-      emailVerified?: string | undefined;
-      firstName?: string | undefined;
-      lastName?: string | undefined;
-      extraFields?: Record<string, any> | undefined;
-    } | undefined;
-  } | undefined;
-  organizationId?: string | undefined;
-  overrideUserInfo?: boolean | undefined;
-}, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
-  session: {
-    session: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      userId: string;
-      expiresAt: Date;
-      token: string;
-      ipAddress?: string | null | undefined;
-      userAgent?: string | null | undefined;
+}, Response>;
+declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call0.StrictEndpoint<"/sso/register", {
+  method: "POST";
+  body: z.ZodObject<{
+    providerId: z.ZodString;
+    issuer: z.ZodString;
+    domain: z.ZodString;
+    oidcConfig: z.ZodOptional<z.ZodObject<{
+      clientId: z.ZodString;
+      clientSecret: z.ZodString;
+      authorizationEndpoint: z.ZodOptional<z.ZodString>;
+      tokenEndpoint: z.ZodOptional<z.ZodString>;
+      userInfoEndpoint: z.ZodOptional<z.ZodString>;
+      tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
+        client_secret_post: "client_secret_post";
+        client_secret_basic: "client_secret_basic";
+      }>>;
+      jwksEndpoint: z.ZodOptional<z.ZodString>;
+      discoveryEndpoint: z.ZodOptional<z.ZodString>;
+      skipDiscovery: z.ZodOptional<z.ZodBoolean>;
+      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      pkce: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+      mapping: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        emailVerified: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        image: z.ZodOptional<z.ZodString>;
+        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    samlConfig: z.ZodOptional<z.ZodObject<{
+      entryPoint: z.ZodString;
+      cert: z.ZodString;
+      callbackUrl: z.ZodString;
+      audience: z.ZodOptional<z.ZodString>;
+      idpMetadata: z.ZodOptional<z.ZodObject<{
+        metadata: z.ZodOptional<z.ZodString>;
+        entityID: z.ZodOptional<z.ZodString>;
+        cert: z.ZodOptional<z.ZodString>;
+        privateKey: z.ZodOptional<z.ZodString>;
+        privateKeyPass: z.ZodOptional<z.ZodString>;
+        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
+        encPrivateKey: z.ZodOptional<z.ZodString>;
+        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
+        singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
+          Binding: z.ZodString;
+          Location: z.ZodString;
+        }, z.core.$strip>>>;
+      }, z.core.$strip>>;
+      spMetadata: z.ZodObject<{
+        metadata: z.ZodOptional<z.ZodString>;
+        entityID: z.ZodOptional<z.ZodString>;
+        binding: z.ZodOptional<z.ZodString>;
+        privateKey: z.ZodOptional<z.ZodString>;
+        privateKeyPass: z.ZodOptional<z.ZodString>;
+        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
+        encPrivateKey: z.ZodOptional<z.ZodString>;
+        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>;
+      wantAssertionsSigned: z.ZodOptional<z.ZodBoolean>;
+      authnRequestsSigned: z.ZodOptional<z.ZodBoolean>;
+      signatureAlgorithm: z.ZodOptional<z.ZodString>;
+      digestAlgorithm: z.ZodOptional<z.ZodString>;
+      identifierFormat: z.ZodOptional<z.ZodString>;
+      privateKey: z.ZodOptional<z.ZodString>;
+      decryptionPvk: z.ZodOptional<z.ZodString>;
+      additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      mapping: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        emailVerified: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        firstName: z.ZodOptional<z.ZodString>;
+        lastName: z.ZodOptional<z.ZodString>;
+        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+  }, z.core.$strip>;
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
     };
-    user: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      email: string;
-      emailVerified: boolean;
-      name: string;
-      image?: string | null | undefined;
+  }>)[];
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  issuer: {
+                    type: string;
+                    format: string;
+                    description: string;
+                  };
+                  domain: {
+                    type: string;
+                    description: string;
+                  };
+                  domainVerified: {
+                    type: string;
+                    description: string;
+                  };
+                  domainVerificationToken: {
+                    type: string;
+                    description: string;
+                  };
+                  oidcConfig: {
+                    type: string;
+                    properties: {
+                      issuer: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      pkce: {
+                        type: string;
+                        description: string;
+                      };
+                      clientId: {
+                        type: string;
+                        description: string;
+                      };
+                      clientSecret: {
+                        type: string;
+                        description: string;
+                      };
+                      authorizationEndpoint: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      discoveryEndpoint: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      userInfoEndpoint: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      scopes: {
+                        type: string;
+                        items: {
+                          type: string;
+                        };
+                        nullable: boolean;
+                        description: string;
+                      };
+                      tokenEndpoint: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      tokenEndpointAuthentication: {
+                        type: string;
+                        enum: string[];
+                        nullable: boolean;
+                        description: string;
+                      };
+                      jwksEndpoint: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      mapping: {
+                        type: string;
+                        nullable: boolean;
+                        properties: {
+                          id: {
+                            type: string;
+                            description: string;
+                          };
+                          email: {
+                            type: string;
+                            description: string;
+                          };
+                          emailVerified: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          name: {
+                            type: string;
+                            description: string;
+                          };
+                          image: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          extraFields: {
+                            type: string;
+                            additionalProperties: {
+                              type: string;
+                            };
+                            nullable: boolean;
+                            description: string;
+                          };
+                        };
+                        required: string[];
+                      };
+                    };
+                    required: string[];
+                    description: string;
+                  };
+                  organizationId: {
+                    type: string;
+                    nullable: boolean;
+                    description: string;
+                  };
+                  userId: {
+                    type: string;
+                    description: string;
+                  };
+                  providerId: {
+                    type: string;
+                    description: string;
+                  };
+                  redirectURI: {
+                    type: string;
+                    format: string;
+                    description: string;
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+      };
     };
   };
-}>>], O["domainVerification"] extends {
+}, O["domainVerification"] extends {
   enabled: true;
 } ? {
   redirectURI: string;
@@ -992,156 +1210,62 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
   redirectURI: string;
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
-} & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig">, {
-  openapi: {
-    operationId: string;
-    summary: string;
-    description: string;
-    responses: {
-      "200": {
-        description: string;
+} & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig">>;
+declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sign-in/sso", {
+  method: "POST";
+  body: z.ZodObject<{
+    email: z.ZodOptional<z.ZodString>;
+    organizationSlug: z.ZodOptional<z.ZodString>;
+    providerId: z.ZodOptional<z.ZodString>;
+    domain: z.ZodOptional<z.ZodString>;
+    callbackURL: z.ZodString;
+    errorCallbackURL: z.ZodOptional<z.ZodString>;
+    newUserCallbackURL: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    loginHint: z.ZodOptional<z.ZodString>;
+    requestSignUp: z.ZodOptional<z.ZodBoolean>;
+    providerType: z.ZodOptional<z.ZodEnum<{
+      saml: "saml";
+      oidc: "oidc";
+    }>>;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      requestBody: {
         content: {
           "application/json": {
             schema: {
               type: "object";
               properties: {
-                issuer: {
-                  type: string;
-                  format: string;
-                  description: string;
-                };
-                domain: {
-                  type: string;
-                  description: string;
-                };
-                domainVerified: {
+                email: {
                   type: string;
                   description: string;
                 };
-                domainVerificationToken: {
+                issuer: {
                   type: string;
                   description: string;
                 };
-                oidcConfig: {
+                providerId: {
                   type: string;
-                  properties: {
-                    issuer: {
-                      type: string;
-                      format: string;
-                      description: string;
-                    };
-                    pkce: {
-                      type: string;
-                      description: string;
-                    };
-                    clientId: {
-                      type: string;
-                      description: string;
-                    };
-                    clientSecret: {
-                      type: string;
-                      description: string;
-                    };
-                    authorizationEndpoint: {
-                      type: string;
-                      format: string;
-                      nullable: boolean;
-                      description: string;
-                    };
-                    discoveryEndpoint: {
-                      type: string;
-                      format: string;
-                      description: string;
-                    };
-                    userInfoEndpoint: {
-                      type: string;
-                      format: string;
-                      nullable: boolean;
-                      description: string;
-                    };
-                    scopes: {
-                      type: string;
-                      items: {
-                        type: string;
-                      };
-                      nullable: boolean;
-                      description: string;
-                    };
-                    tokenEndpoint: {
-                      type: string;
-                      format: string;
-                      nullable: boolean;
-                      description: string;
-                    };
-                    tokenEndpointAuthentication: {
-                      type: string;
-                      enum: string[];
-                      nullable: boolean;
-                      description: string;
-                    };
-                    jwksEndpoint: {
-                      type: string;
-                      format: string;
-                      nullable: boolean;
-                      description: string;
-                    };
-                    mapping: {
-                      type: string;
-                      nullable: boolean;
-                      properties: {
-                        id: {
-                          type: string;
-                          description: string;
-                        };
-                        email: {
-                          type: string;
-                          description: string;
-                        };
-                        emailVerified: {
-                          type: string;
-                          nullable: boolean;
-                          description: string;
-                        };
-                        name: {
-                          type: string;
-                          description: string;
-                        };
-                        image: {
-                          type: string;
-                          nullable: boolean;
-                          description: string;
-                        };
-                        extraFields: {
-                          type: string;
-                          additionalProperties: {
-                            type: string;
-                          };
-                          nullable: boolean;
-                          description: string;
-                        };
-                      };
-                      required: string[];
-                    };
-                  };
-                  required: string[];
                   description: string;
                 };
-                organizationId: {
+                callbackURL: {
                   type: string;
-                  nullable: boolean;
                   description: string;
                 };
-                userId: {
+                errorCallbackURL: {
                   type: string;
                   description: string;
                 };
-                providerId: {
+                newUserCallbackURL: {
                   type: string;
                   description: string;
                 };
-                redirectURI: {
+                loginHint: {
                   type: string;
-                  format: string;
                   description: string;
                 };
               };
@@ -1150,222 +1274,192 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
           };
         };
       };
-    };
-  };
-}, undefined>;
-declare const signInSSO: (options?: SSOOptions) => better_call0.Endpoint<"/sign-in/sso", "POST", {
-  callbackURL: string;
-  email?: string | undefined;
-  organizationSlug?: string | undefined;
-  providerId?: string | undefined;
-  domain?: string | undefined;
-  errorCallbackURL?: string | undefined;
-  newUserCallbackURL?: string | undefined;
-  scopes?: string[] | undefined;
-  loginHint?: string | undefined;
-  requestSignUp?: boolean | undefined;
-  providerType?: "saml" | "oidc" | undefined;
-}, Record<string, any> | undefined, [], {
-  url: string;
-  redirect: boolean;
-}, {
-  openapi: {
-    operationId: string;
-    summary: string;
-    description: string;
-    requestBody: {
-      content: {
-        "application/json": {
-          schema: {
-            type: "object";
-            properties: {
-              email: {
-                type: string;
-                description: string;
-              };
-              issuer: {
-                type: string;
-                description: string;
-              };
-              providerId: {
-                type: string;
-                description: string;
-              };
-              callbackURL: {
-                type: string;
-                description: string;
-              };
-              errorCallbackURL: {
-                type: string;
-                description: string;
-              };
-              newUserCallbackURL: {
-                type: string;
-                description: string;
-              };
-              loginHint: {
-                type: string;
-                description: string;
-              };
-            };
-            required: string[];
-          };
-        };
-      };
-    };
-    responses: {
-      "200": {
-        description: string;
-        content: {
-          "application/json": {
-            schema: {
-              type: "object";
-              properties: {
-                url: {
-                  type: string;
-                  format: string;
-                  description: string;
-                };
-                redirect: {
-                  type: string;
-                  description: string;
-                  enum: boolean[];
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  url: {
+                    type: string;
+                    format: string;
+                    description: string;
+                  };
+                  redirect: {
+                    type: string;
+                    description: string;
+                    enum: boolean[];
+                  };
                 };
+                required: string[];
               };
-              required: string[];
             };
           };
         };
       };
     };
   };
-}, undefined>;
-declare const callbackSSO: (options?: SSOOptions) => better_call0.Endpoint<"/sso/callback/:providerId", "GET", undefined, {
-  state: string;
-  code?: string | undefined;
-  error?: string | undefined;
-  error_description?: string | undefined;
-}, [], void, {
-  openapi: {
-    operationId: string;
-    summary: string;
-    description: string;
-    responses: {
-      "302": {
-        description: string;
+}, {
+  url: string;
+  redirect: boolean;
+}>;
+declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback/:providerId", {
+  method: "GET";
+  query: z.ZodObject<{
+    code: z.ZodOptional<z.ZodString>;
+    state: z.ZodString;
+    error: z.ZodOptional<z.ZodString>;
+    error_description: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "302": {
+          description: string;
+        };
       };
     };
+    scope: "server";
   };
-  scope: "server";
-}, undefined>;
+}, void>;
 /**
  * Shared OIDC callback endpoint (no `:providerId` in path).
  * Used when `options.redirectURI` is set — the `providerId` is read from
  * the OAuth state instead of the URL path.
  */
-declare const callbackSSOShared: (options?: SSOOptions) => better_call0.Endpoint<"/sso/callback", "GET", undefined, {
-  state: string;
-  code?: string | undefined;
-  error?: string | undefined;
-  error_description?: string | undefined;
-}, [], void, {
-  openapi: {
-    operationId: string;
-    summary: string;
-    description: string;
-    responses: {
-      "302": {
-        description: string;
+declare const callbackSSOShared: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback", {
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "302": {
+          description: string;
+        };
       };
     };
+    scope: "server";
   };
-  scope: "server";
-}, undefined>;
-declare const callbackSSOSAML: (options?: SSOOptions) => better_call0.Endpoint<"/sso/saml2/callback/:providerId", ("GET" | "POST")[], {
-  SAMLResponse: string;
-  RelayState?: string | undefined;
-} | undefined, {
-  RelayState?: string | undefined;
-} | undefined, [], never, {
-  allowedMediaTypes: string[];
-  openapi: {
-    operationId: string;
-    summary: string;
-    description: string;
-    responses: {
-      "302": {
-        description: string;
-      };
-      "400": {
-        description: string;
-      };
-      "401": {
-        description: string;
+  method: "GET";
+  query: z.ZodObject<{
+    code: z.ZodOptional<z.ZodString>;
+    state: z.ZodString;
+    error: z.ZodOptional<z.ZodString>;
+    error_description: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
+}, void>;
+declare const callbackSSOSAML: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/callback/:providerId", {
+  method: ("POST" | "GET")[];
+  body: z.ZodOptional<z.ZodObject<{
+    SAMLResponse: z.ZodString;
+    RelayState: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  query: z.ZodOptional<z.ZodObject<{
+    RelayState: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  metadata: {
+    allowedMediaTypes: string[];
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "302": {
+          description: string;
+        };
+        "400": {
+          description: string;
+        };
+        "401": {
+          description: string;
+        };
       };
     };
+    scope: "server";
   };
-  scope: "server";
-}, undefined>;
-declare const acsEndpoint: (options?: SSOOptions) => better_call0.Endpoint<"/sso/saml2/sp/acs/:providerId", "POST", {
-  SAMLResponse: string;
-  RelayState?: string | undefined;
-}, Record<string, any> | undefined, [], never, {
-  allowedMediaTypes: string[];
-  openapi: {
-    operationId: string;
-    summary: string;
-    description: string;
-    responses: {
-      "302": {
-        description: string;
+}, never>;
+declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+  method: "POST";
+  body: z.ZodObject<{
+    SAMLResponse: z.ZodString;
+    RelayState: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  metadata: {
+    allowedMediaTypes: string[];
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "302": {
+          description: string;
+        };
       };
     };
+    scope: "server";
   };
-  scope: "server";
-}, undefined>;
-declare const sloEndpoint: (options?: SSOOptions) => better_call0.Endpoint<"/sso/saml2/sp/slo/:providerId", ("GET" | "POST")[], {
-  SAMLRequest?: string | undefined;
-  SAMLResponse?: string | undefined;
-  RelayState?: string | undefined;
-  SigAlg?: string | undefined;
-  Signature?: string | undefined;
-} | undefined, {
-  SAMLRequest?: string | undefined;
-  SAMLResponse?: string | undefined;
-  RelayState?: string | undefined;
-  SigAlg?: string | undefined;
-  Signature?: string | undefined;
-} | undefined, [], void | Response, {
-  allowedMediaTypes: string[];
-  scope: "server";
-}, undefined>;
-declare const initiateSLO: (options?: SSOOptions) => better_call0.Endpoint<"/sso/saml2/logout/:providerId", "POST", {
-  callbackURL?: string | undefined;
-}, Record<string, any> | undefined, [better_call0.Middleware<(inputContext: Record<string, any>) => Promise<{
-  session: {
-    session: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      userId: string;
-      expiresAt: Date;
-      token: string;
-      ipAddress?: string | null | undefined;
-      userAgent?: string | null | undefined;
-    };
-    user: Record<string, any> & {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      email: string;
-      emailVerified: boolean;
-      name: string;
-      image?: string | null | undefined;
+}, never>;
+declare const sloEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
+  method: ("POST" | "GET")[];
+  body: z.ZodOptional<z.ZodObject<{
+    SAMLRequest: z.ZodOptional<z.ZodString>;
+    SAMLResponse: z.ZodOptional<z.ZodString>;
+    RelayState: z.ZodOptional<z.ZodString>;
+    SigAlg: z.ZodOptional<z.ZodString>;
+    Signature: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  query: z.ZodOptional<z.ZodObject<{
+    SAMLRequest: z.ZodOptional<z.ZodString>;
+    SAMLResponse: z.ZodOptional<z.ZodString>;
+    RelayState: z.ZodOptional<z.ZodString>;
+    SigAlg: z.ZodOptional<z.ZodString>;
+    Signature: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  metadata: {
+    allowedMediaTypes: string[];
+    scope: "server";
+  };
+}, void | Response>;
+declare const initiateSLO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/logout/:providerId", {
+  method: "POST";
+  body: z.ZodObject<{
+    callbackURL: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
     };
+  }>)[];
+  metadata: {
+    readonly scope: "server";
   };
-}>>], never, {
-  readonly scope: "server";
-}, undefined>;
+}, never>;
 //#endregion
 //#region src/constants.d.ts
 /**
@@ -1665,6 +1759,7 @@ type SSOEndpoints<O extends SSOOptions> = {
 };
 type SSOPlugin<O extends SSOOptions> = {
   id: "sso";
+  version: string;
   endpoints: SSOEndpoints<O> & (O extends {
     domainVerification: {
       enabled: true;
@@ -1677,15 +1772,16 @@ declare function sso<O extends SSOOptions & {
   };
 }>(options?: O | undefined): {
   id: "sso";
+  version: string;
   endpoints: SSOEndpoints<O> & DomainVerificationEndpoints;
   schema: NonNullable<BetterAuthPlugin["schema"]>;
-  options: O;
+  options: NoInfer<O>;
 };
 declare function sso<O extends SSOOptions>(options?: O | undefined): {
   id: "sso";
+  version: string;
   endpoints: SSOEndpoints<O>;
-  options: O;
+  options: NoInfer<O>;
 };
 //#endregion
-export { DataEncryptionAlgorithm as A, TimestampValidationOptions as C, SSOOptions as D, SAMLConfig as E, DigestAlgorithm as M, KeyEncryptionAlgorithm as N, SSOProvider as O, SignatureAlgorithm as P, SAMLConditions as S, OIDCConfig as T, REQUIRED_DISCOVERY_FIELDS as _, fetchDiscoveryDocument as a, DEFAULT_MAX_SAML_METADATA_SIZE as b, normalizeUrl as c, validateDiscoveryUrl as d, DiscoverOIDCConfigParams as f, OIDCDiscoveryDocument as g, HydratedOIDCConfig as h, discoverOIDCConfig as i, DeprecatedAlgorithmBehavior as j, AlgorithmValidationOptions as k, selectTokenEndpointAuthMethod as l, DiscoveryErrorCode as m, sso as n, needsRuntimeDiscovery as o, DiscoveryError as p, computeDiscoveryUrl as r, normalizeDiscoveryUrls as s, SSOPlugin as t, validateDiscoveryDocument as u, RequiredDiscoveryField as v, validateSAMLTimestamp as w, DEFAULT_MAX_SAML_RESPONSE_SIZE as x, DEFAULT_CLOCK_SKEW_MS as y };
-//# sourceMappingURL=index-N-z2Csye.d.mts.map
+export { DataEncryptionAlgorithm as A, TimestampValidationOptions as C, SSOOptions as D, SAMLConfig as E, DigestAlgorithm as M, KeyEncryptionAlgorithm as N, SSOProvider as O, SignatureAlgorithm as P, SAMLConditions as S, OIDCConfig as T, REQUIRED_DISCOVERY_FIELDS as _, fetchDiscoveryDocument as a, DEFAULT_MAX_SAML_METADATA_SIZE as b, normalizeUrl as c, validateDiscoveryUrl as d, DiscoverOIDCConfigParams as f, OIDCDiscoveryDocument as g, HydratedOIDCConfig as h, discoverOIDCConfig as i, DeprecatedAlgorithmBehavior as j, AlgorithmValidationOptions as k, selectTokenEndpointAuthMethod as l, DiscoveryErrorCode as m, sso as n, needsRuntimeDiscovery as o, DiscoveryError as p, computeDiscoveryUrl as r, normalizeDiscoveryUrls as s, SSOPlugin as t, validateDiscoveryDocument as u, RequiredDiscoveryField as v, validateSAMLTimestamp as w, DEFAULT_MAX_SAML_RESPONSE_SIZE as x, DEFAULT_CLOCK_SKEW_MS as y };