@better-auth/sso 1.6.9 → 1.6.11

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { t as SSOPlugin } from "./index-DyoL-0jp.mjs";
+import { t as SSOPlugin } from "./index-DbZYHOJt.mjs";
 
 //#region src/client.d.ts
 interface SSOClientOptions {

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BI7AiK6S.mjs";
+import { t as PACKAGE_VERSION } from "./version-D_ggtAOl.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-DyoL-0jp.d.mts → index-DbZYHOJt.d.mts}

@@ -716,15 +716,15 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
     oidcConfig: z.ZodOptional<z.ZodObject<{
       clientId: z.ZodOptional<z.ZodString>;
       clientSecret: z.ZodOptional<z.ZodString>;
-      authorizationEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpoint: z.ZodOptional<z.ZodString>;
-      userInfoEndpoint: z.ZodOptional<z.ZodString>;
+      authorizationEndpoint: z.ZodOptional<z.ZodURL>;
+      tokenEndpoint: z.ZodOptional<z.ZodURL>;
+      userInfoEndpoint: z.ZodOptional<z.ZodURL>;
       tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
       }>>;
-      jwksEndpoint: z.ZodOptional<z.ZodString>;
-      discoveryEndpoint: z.ZodOptional<z.ZodString>;
+      jwksEndpoint: z.ZodOptional<z.ZodURL>;
+      discoveryEndpoint: z.ZodOptional<z.ZodURL>;
       scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
       pkce: z.ZodOptional<z.ZodBoolean>;
       overrideUserInfo: z.ZodOptional<z.ZodBoolean>;
@@ -944,15 +944,15 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
     oidcConfig: z.ZodOptional<z.ZodObject<{
       clientId: z.ZodString;
       clientSecret: z.ZodString;
-      authorizationEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpoint: z.ZodOptional<z.ZodString>;
-      userInfoEndpoint: z.ZodOptional<z.ZodString>;
+      authorizationEndpoint: z.ZodOptional<z.ZodURL>;
+      tokenEndpoint: z.ZodOptional<z.ZodURL>;
+      userInfoEndpoint: z.ZodOptional<z.ZodURL>;
       tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
       }>>;
-      jwksEndpoint: z.ZodOptional<z.ZodString>;
-      discoveryEndpoint: z.ZodOptional<z.ZodString>;
+      jwksEndpoint: z.ZodOptional<z.ZodURL>;
+      discoveryEndpoint: z.ZodOptional<z.ZodURL>;
       skipDiscovery: z.ZodOptional<z.ZodBoolean>;
       scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
       pkce: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
@@ -1560,7 +1560,7 @@ interface OIDCDiscoveryDocument {
 /**
  * Error codes for OIDC discovery operations.
  */
-type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** Discovery URL is invalid or malformed */ | "discovery_invalid_url" /** Discovery URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
+type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */ | "discovery_invalid_url" /** OIDC endpoint URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */ | "discovery_private_host" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
 /**
  * Custom error class for OIDC discovery failures.
  * Can be caught and mapped to APIError at the edge.

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as DataEncryptionAlgorithm, C as TimestampValidationOptions, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as SAMLConditions, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as DEFAULT_MAX_SAML_METADATA_SIZE, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as validateSAMLTimestamp, x as DEFAULT_MAX_SAML_RESPONSE_SIZE, y as DEFAULT_CLOCK_SKEW_MS } from "./index-DyoL-0jp.mjs";
+import { A as DataEncryptionAlgorithm, C as TimestampValidationOptions, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as SAMLConditions, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as DEFAULT_MAX_SAML_METADATA_SIZE, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as validateSAMLTimestamp, x as DEFAULT_MAX_SAML_RESPONSE_SIZE, y as DEFAULT_CLOCK_SKEW_MS } from "./index-DbZYHOJt.mjs";
 export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SSOOptions, SSOPlugin, SSOProvider, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };