@better-auth/sso 1.7.0-beta.0 → 1.7.0-beta.10

package/dist/{index-DVg_iWRX.d.mts → index-A_DJ_AqL.d.mts}

@@ -1,6 +1,7 @@
 import { APIError } from "better-auth/api";
 import * as z from "zod";
-import { Awaitable, BetterAuthPlugin, OAuth2Tokens, User } from "better-auth";
+import { DBFieldAttribute, FieldAttributeToObject, InferAdditionalFieldsFromPluginOptions, RemoveFieldsWithReturnedFalse } from "better-auth/db";
+import { Awaitable, OAuth2Tokens, User } from "better-auth";
 import * as better_call0 from "better-call";
 
 //#region src/saml/algorithms.d.ts
@@ -79,19 +80,53 @@ interface OIDCConfig {
   privateKeyAlgorithm?: string | undefined;
   jwksEndpoint?: string | undefined;
   mapping?: OIDCMapping | undefined;
+  /**
+   * Accept callbacks from OIDC providers that initiate the OAuth flow
+   * without sending a `state` parameter. When enabled, stateless callbacks
+   * restart the OAuth flow server-side with a fresh `state` and PKCE
+   * verifier. See the SSO docs for details.
+   *
+   * @default false
+   */
+  allowIdpInitiated?: boolean | undefined;
 }
 interface SAMLConfig {
+  /**
+   * SP Entity ID. Used as the `entityID` in SP metadata when
+   * `spMetadata.entityID` is not set. Also used as the expected
+   * audience for SAML assertion validation when `audience` is not set.
+   */
   issuer: string;
+  /**
+   * IdP SSO URL. Used as the redirect destination when
+   * `idpMetadata.metadata` is not provided. Ignored when
+   * IdP metadata XML is set (the SSO URL is extracted from the XML).
+   */
   entryPoint: string;
-  cert: string;
-  callbackUrl: string;
+  /**
+   * IdP signing certificate(s). Used to verify SAML response signatures when
+   * `idpMetadata.metadata` is not provided. Ignored when IdP metadata XML is
+   * set (the certificate is extracted from the XML). When both this and
+   * `idpMetadata.cert` are set, `idpMetadata.cert` takes precedence. Pass an
+   * array of PEM strings for rolling rotation; responses signed by any
+   * listed cert are accepted.
+   */
+  cert?: string | string[];
   audience?: string | undefined;
+  /**
+   * Provider-level post-auth redirect URL for IdP-initiated or fallback SAML
+   * flows when no RelayState callback URL is available.
+   */
+  callbackUrl?: string | undefined;
   idpMetadata?: {
     metadata?: string;
     entityID?: string;
-    entityURL?: string;
-    redirectURL?: string;
-    cert?: string;
+    /**
+     * IdP signing certificate(s). Pass a single PEM string or an array
+     * for rolling rotation. Takes precedence over the top-level `cert`
+     * when both are set. Omit when `metadata` XML is supplied.
+     */
+    cert?: string | string[];
     privateKey?: string;
     privateKeyPass?: string;
     isAssertionEncrypted?: boolean;
@@ -106,7 +141,12 @@ interface SAMLConfig {
       Location: string;
     }>;
   } | undefined;
-  spMetadata: {
+  /**
+   * SP metadata configuration. All fields are optional; when omitted,
+   * SP metadata is auto-generated from `issuer`, `wantAssertionsSigned`,
+   * `authnRequestsSigned`, and `identifierFormat`.
+   */
+  spMetadata?: {
     metadata?: string | undefined;
     entityID?: string | undefined;
     binding?: string | undefined;
@@ -116,14 +156,17 @@ interface SAMLConfig {
     encPrivateKey?: string | undefined;
     encPrivateKeyPass?: string | undefined;
   };
+  /**
+   * Request signed assertions from the IdP. When true, the SP metadata
+   * advertises `WantAssertionsSigned="true"` and samlify will reject
+   * unsigned assertions.
+   */
   wantAssertionsSigned?: boolean | undefined;
   authnRequestsSigned?: boolean | undefined;
   signatureAlgorithm?: string | undefined;
   digestAlgorithm?: string | undefined;
   identifierFormat?: string | undefined;
   privateKey?: string | undefined;
-  decryptionPvk?: string | undefined;
-  additionalParams?: Record<string, any> | undefined;
   mapping?: SAMLMapping | undefined;
 }
 type BaseSSOProvider = {
@@ -135,11 +178,32 @@ type BaseSSOProvider = {
   organizationId?: string | undefined;
   domain: string;
 };
+type SSOProviderAdditionalFields<O extends SSOOptions, IsClientSide extends boolean> = O["schema"] extends {
+  ssoProvider?: {
+    additionalFields: infer Field extends Record<string, DBFieldAttribute>;
+  };
+} ? IsClientSide extends true ? FieldAttributeToObject<RemoveFieldsWithReturnedFalse<Field>> : FieldAttributeToObject<Field> : {};
+type SSOProviderAdditionalFieldsInput<O extends SSOOptions, IsClientSide extends boolean = true> = InferAdditionalFieldsFromPluginOptions<"ssoProvider", O, IsClientSide>;
+type InferSSOProvider<O extends SSOOptions, IsClientSide extends boolean = true> = (O["domainVerification"] extends {
+  enabled: true;
+} ? {
+  domainVerified: boolean;
+} & BaseSSOProvider : BaseSSOProvider) & SSOProviderAdditionalFields<O, IsClientSide>;
 type SSOProvider<O extends SSOOptions> = O["domainVerification"] extends {
   enabled: true;
 } ? {
   domainVerified: boolean;
-} & BaseSSOProvider : BaseSSOProvider;
+} & BaseSSOProvider & SSOProviderAdditionalFields<O, false> : BaseSSOProvider & SSOProviderAdditionalFields<O, false>;
+type SSOProviderSchema<O extends SSOOptions> = {
+  ssoProvider: {
+    modelName: string;
+    fields: Record<string, DBFieldAttribute> & (O["schema"] extends {
+      ssoProvider?: {
+        additionalFields: infer Field extends Record<string, DBFieldAttribute>;
+      };
+    } ? Field : {});
+  };
+};
 interface SSOOptions {
   /**
    * custom function to provision a user when they sign in with an SSO provider.
@@ -261,6 +325,25 @@ interface SSOOptions {
     organizationId?: string | undefined;
     domain?: string | undefined;
   };
+  /**
+   * The schema for the SSO plugin.
+   */
+  schema?: {
+    ssoProvider?: {
+      modelName?: string | undefined;
+      fields?: {
+        issuer?: string | undefined;
+        oidcConfig?: string | undefined;
+        samlConfig?: string | undefined;
+        userId?: string | undefined;
+        providerId?: string | undefined;
+        organizationId?: string | undefined;
+        domain?: string | undefined;
+        domainVerified?: string | undefined;
+      };
+      additionalFields?: { [key in string]: DBFieldAttribute };
+    };
+  } | undefined;
   /**
    * Configure the maximum number of SSO providers a user can register.
    * You can also pass a function that returns a number.
@@ -555,8 +638,20 @@ declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint
   }>)[];
 }, void>;
 //#endregion
+//#region src/utils.d.ts
+declare function parseCertificate(certPem: string): {
+  fingerprintSha256: string;
+  notBefore: string;
+  notAfter: string;
+  publicKeyAlgorithm: string;
+};
+//#endregion
 //#region src/routes/providers.d.ts
-declare const listSSOProviders: () => better_call0.StrictEndpoint<"/sso/providers", {
+type ParsedCert = ReturnType<typeof parseCertificate>;
+type SanitizedCert = ParsedCert | {
+  error: string;
+};
+declare const listSSOProviders: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/providers", {
   method: "GET";
   use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
     session: {
@@ -614,26 +709,18 @@ declare const listSSOProviders: () => better_call0.StrictEndpoint<"/sso/provider
     } | undefined;
     samlConfig: {
       entryPoint: string;
-      callbackUrl: string;
       audience: string | undefined;
       wantAssertionsSigned: boolean | undefined;
       authnRequestsSigned: boolean | undefined;
       identifierFormat: string | undefined;
       signatureAlgorithm: string | undefined;
       digestAlgorithm: string | undefined;
-      certificate: {
-        fingerprintSha256: string;
-        notBefore: string;
-        notAfter: string;
-        publicKeyAlgorithm: string;
-      } | {
-        error: string;
-      };
+      certificate: SanitizedCert[] | undefined;
     } | undefined;
     spMetadataUrl: string;
   }[];
 }>;
-declare const getSSOProvider: () => better_call0.StrictEndpoint<"/sso/get-provider", {
+declare const getSSOProvider: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/get-provider", {
   method: "GET";
   use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
     session: {
@@ -699,21 +786,13 @@ declare const getSSOProvider: () => better_call0.StrictEndpoint<"/sso/get-provid
   } | undefined;
   samlConfig: {
     entryPoint: string;
-    callbackUrl: string;
     audience: string | undefined;
     wantAssertionsSigned: boolean | undefined;
     authnRequestsSigned: boolean | undefined;
     identifierFormat: string | undefined;
     signatureAlgorithm: string | undefined;
     digestAlgorithm: string | undefined;
-    certificate: {
-      fingerprintSha256: string;
-      notBefore: string;
-      notAfter: string;
-      publicKeyAlgorithm: string;
-    } | {
-      error: string;
-    };
+    certificate: SanitizedCert[] | undefined;
   } | undefined;
   spMetadataUrl: string;
 }>;
@@ -747,40 +826,41 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
     domain: z.ZodOptional<z.ZodString>;
     oidcConfig: z.ZodOptional<z.ZodObject<{
       clientId: z.ZodOptional<z.ZodString>;
-      clientSecret: z.ZodOptional<z.ZodString>;
-      authorizationEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpoint: z.ZodOptional<z.ZodString>;
-      userInfoEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
+      clientSecret: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      authorizationEndpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      tokenEndpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      userInfoEndpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      tokenEndpointAuthentication: z.ZodOptional<z.ZodOptional<z.ZodEnum<{
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
         private_key_jwt: "private_key_jwt";
-      }>>;
-      privateKeyId: z.ZodOptional<z.ZodString>;
-      privateKeyAlgorithm: z.ZodOptional<z.ZodString>;
-      jwksEndpoint: z.ZodOptional<z.ZodString>;
-      discoveryEndpoint: z.ZodOptional<z.ZodString>;
-      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-      pkce: z.ZodOptional<z.ZodBoolean>;
-      overrideUserInfo: z.ZodOptional<z.ZodBoolean>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodString>;
+      }>>>;
+      privateKeyId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      privateKeyAlgorithm: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      jwksEndpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      discoveryEndpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      skipDiscovery: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+      scopes: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+      pkce: z.ZodOptional<z.ZodOptional<z.ZodDefault<z.ZodBoolean>>>;
+      overrideUserInfo: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+      mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
         emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
         image: z.ZodOptional<z.ZodString>;
         extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
+      }, z.core.$strip>>>;
     }, z.core.$strip>>;
     samlConfig: z.ZodOptional<z.ZodObject<{
       entryPoint: z.ZodOptional<z.ZodString>;
-      cert: z.ZodOptional<z.ZodString>;
-      callbackUrl: z.ZodOptional<z.ZodString>;
-      audience: z.ZodOptional<z.ZodString>;
-      idpMetadata: z.ZodOptional<z.ZodObject<{
+      cert: z.ZodOptional<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+      audience: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      callbackUrl: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      idpMetadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
         metadata: z.ZodOptional<z.ZodString>;
         entityID: z.ZodOptional<z.ZodString>;
-        cert: z.ZodOptional<z.ZodString>;
+        cert: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
         privateKey: z.ZodOptional<z.ZodString>;
         privateKeyPass: z.ZodOptional<z.ZodString>;
         isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
@@ -790,8 +870,12 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
           Binding: z.ZodString;
           Location: z.ZodString;
         }, z.core.$strip>>>;
-      }, z.core.$strip>>;
-      spMetadata: z.ZodOptional<z.ZodObject<{
+        singleLogoutService: z.ZodOptional<z.ZodArray<z.ZodObject<{
+          Binding: z.ZodString;
+          Location: z.ZodString;
+        }, z.core.$strip>>>;
+      }, z.core.$strip>>>;
+      spMetadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
         metadata: z.ZodOptional<z.ZodString>;
         entityID: z.ZodOptional<z.ZodString>;
         binding: z.ZodOptional<z.ZodString>;
@@ -800,24 +884,22 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
         isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
         encPrivateKey: z.ZodOptional<z.ZodString>;
         encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>>;
-      wantAssertionsSigned: z.ZodOptional<z.ZodBoolean>;
-      authnRequestsSigned: z.ZodOptional<z.ZodBoolean>;
-      signatureAlgorithm: z.ZodOptional<z.ZodString>;
-      digestAlgorithm: z.ZodOptional<z.ZodString>;
-      identifierFormat: z.ZodOptional<z.ZodString>;
-      privateKey: z.ZodOptional<z.ZodString>;
-      decryptionPvk: z.ZodOptional<z.ZodString>;
-      additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>>;
+      wantAssertionsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+      authnRequestsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+      signatureAlgorithm: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      digestAlgorithm: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      identifierFormat: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      privateKey: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
         emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
         firstName: z.ZodOptional<z.ZodString>;
         lastName: z.ZodOptional<z.ZodString>;
         extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
+      }, z.core.$strip>>>;
     }, z.core.$strip>>;
     providerId: z.ZodString;
   }, z.core.$strip>;
@@ -859,21 +941,13 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
   } | undefined;
   samlConfig: {
     entryPoint: string;
-    callbackUrl: string;
     audience: string | undefined;
     wantAssertionsSigned: boolean | undefined;
     authnRequestsSigned: boolean | undefined;
     identifierFormat: string | undefined;
     signatureAlgorithm: string | undefined;
     digestAlgorithm: string | undefined;
-    certificate: {
-      fingerprintSha256: string;
-      notBefore: string;
-      notAfter: string;
-      publicKeyAlgorithm: string;
-    } | {
-      error: string;
-    };
+    certificate: SanitizedCert[] | undefined;
   } | undefined;
   spMetadataUrl: string;
 }>;
@@ -932,10 +1006,6 @@ declare const spMetadata: (options?: SSOOptions) => better_call0.StrictEndpoint<
   method: "GET";
   query: z.ZodObject<{
     providerId: z.ZodString;
-    format: z.ZodDefault<z.ZodEnum<{
-      json: "json";
-      xml: "xml";
-    }>>;
   }, z.core.$strip>;
   metadata: {
     openapi: {
@@ -953,85 +1023,7 @@ declare const spMetadata: (options?: SSOOptions) => better_call0.StrictEndpoint<
 declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call0.StrictEndpoint<"/sso/register", {
   method: "POST";
   body: z.ZodObject<{
-    providerId: z.ZodString;
-    issuer: z.ZodString;
-    domain: z.ZodString;
-    oidcConfig: z.ZodOptional<z.ZodObject<{
-      clientId: z.ZodString;
-      clientSecret: z.ZodOptional<z.ZodString>;
-      authorizationEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpoint: z.ZodOptional<z.ZodString>;
-      userInfoEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
-        client_secret_post: "client_secret_post";
-        client_secret_basic: "client_secret_basic";
-        private_key_jwt: "private_key_jwt";
-      }>>;
-      privateKeyId: z.ZodOptional<z.ZodString>;
-      privateKeyAlgorithm: z.ZodOptional<z.ZodString>;
-      jwksEndpoint: z.ZodOptional<z.ZodString>;
-      discoveryEndpoint: z.ZodOptional<z.ZodString>;
-      skipDiscovery: z.ZodOptional<z.ZodBoolean>;
-      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-      pkce: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodString;
-        email: z.ZodString;
-        emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        image: z.ZodOptional<z.ZodString>;
-        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    samlConfig: z.ZodOptional<z.ZodObject<{
-      entryPoint: z.ZodString;
-      cert: z.ZodString;
-      callbackUrl: z.ZodString;
-      audience: z.ZodOptional<z.ZodString>;
-      idpMetadata: z.ZodOptional<z.ZodObject<{
-        metadata: z.ZodOptional<z.ZodString>;
-        entityID: z.ZodOptional<z.ZodString>;
-        cert: z.ZodOptional<z.ZodString>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        privateKeyPass: z.ZodOptional<z.ZodString>;
-        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-        encPrivateKey: z.ZodOptional<z.ZodString>;
-        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-        singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
-          Binding: z.ZodString;
-          Location: z.ZodString;
-        }, z.core.$strip>>>;
-      }, z.core.$strip>>;
-      spMetadata: z.ZodObject<{
-        metadata: z.ZodOptional<z.ZodString>;
-        entityID: z.ZodOptional<z.ZodString>;
-        binding: z.ZodOptional<z.ZodString>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        privateKeyPass: z.ZodOptional<z.ZodString>;
-        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-        encPrivateKey: z.ZodOptional<z.ZodString>;
-        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>;
-      wantAssertionsSigned: z.ZodOptional<z.ZodBoolean>;
-      authnRequestsSigned: z.ZodOptional<z.ZodBoolean>;
-      signatureAlgorithm: z.ZodOptional<z.ZodString>;
-      digestAlgorithm: z.ZodOptional<z.ZodString>;
-      identifierFormat: z.ZodOptional<z.ZodString>;
-      privateKey: z.ZodOptional<z.ZodString>;
-      decryptionPvk: z.ZodOptional<z.ZodString>;
-      additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodString;
-        email: z.ZodString;
-        emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        firstName: z.ZodOptional<z.ZodString>;
-        lastName: z.ZodOptional<z.ZodString>;
-        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    organizationId: z.ZodOptional<z.ZodString>;
-    overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    [x: string]: z.ZodOptional<z.ZodAny>;
   }, z.core.$strip>;
   use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
     session: {
@@ -1057,6 +1049,9 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
     };
   }>)[];
   metadata: {
+    $Infer: {
+      body: Record<string, any> & SSOProviderAdditionalFieldsInput<O>;
+    };
     openapi: {
       operationId: string;
       summary: string;
@@ -1223,14 +1218,14 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
   redirectURI: string;
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
-} & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig"> & {
+} & Omit<InferSSOProvider<O>, "oidcConfig" | "samlConfig"> & {
   domainVerified: boolean;
   domainVerificationToken: string;
 } : {
   redirectURI: string;
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
-} & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig">>;
+} & Omit<InferSSOProvider<O>, "oidcConfig" | "samlConfig">>;
 declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sign-in/sso", {
   method: "POST";
   body: z.ZodObject<{
@@ -1243,6 +1238,7 @@ declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"
     newUserCallbackURL: z.ZodOptional<z.ZodString>;
     scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     loginHint: z.ZodOptional<z.ZodString>;
+    additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     requestSignUp: z.ZodOptional<z.ZodBoolean>;
     providerType: z.ZodOptional<z.ZodEnum<{
       saml: "saml";
@@ -1264,7 +1260,7 @@ declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"
                   type: string;
                   description: string;
                 };
-                issuer: {
+                organizationSlug: {
                   type: string;
                   description: string;
                 };
@@ -1272,6 +1268,10 @@ declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"
                   type: string;
                   description: string;
                 };
+                domain: {
+                  type: string;
+                  description: string;
+                };
                 callbackURL: {
                   type: string;
                   description: string;
@@ -1284,10 +1284,33 @@ declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"
                   type: string;
                   description: string;
                 };
+                scopes: {
+                  type: string;
+                  items: {
+                    type: string;
+                  };
+                  description: string;
+                };
                 loginHint: {
                   type: string;
                   description: string;
                 };
+                additionalParams: {
+                  type: string;
+                  additionalProperties: {
+                    type: string;
+                  };
+                  description: string;
+                };
+                requestSignUp: {
+                  type: string;
+                  description: string;
+                };
+                providerType: {
+                  type: string;
+                  enum: string[];
+                  description: string;
+                };
               };
               required: string[];
             };
@@ -1329,7 +1352,7 @@ declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint
   method: "GET";
   query: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
-    state: z.ZodString;
+    state: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
     error_description: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
@@ -1370,14 +1393,14 @@ declare const callbackSSOShared: (options?: SSOOptions) => better_call0.StrictEn
   method: "GET";
   query: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
-    state: z.ZodString;
+    state: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
     error_description: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
   allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
 }, void>;
-declare const callbackSSOSAML: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/callback/:providerId", {
-  method: ("POST" | "GET")[];
+declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+  method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLResponse: z.ZodString;
     RelayState: z.ZodOptional<z.ZodString>;
@@ -1398,28 +1421,7 @@ declare const callbackSSOSAML: (options?: SSOOptions) => better_call0.StrictEndp
         "400": {
           description: string;
         };
-        "401": {
-          description: string;
-        };
-      };
-    };
-    scope: "server";
-  };
-}, never>;
-declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
-  method: "POST";
-  body: z.ZodObject<{
-    SAMLResponse: z.ZodString;
-    RelayState: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>;
-  metadata: {
-    allowedMediaTypes: string[];
-    openapi: {
-      operationId: string;
-      summary: string;
-      description: string;
-      responses: {
-        "302": {
+        "404": {
           description: string;
         };
       };
@@ -1428,7 +1430,7 @@ declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint
   };
 }, never>;
 declare const sloEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
-  method: ("POST" | "GET")[];
+  method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLRequest: z.ZodOptional<z.ZodString>;
     SAMLResponse: z.ZodOptional<z.ZodString>;
@@ -1598,7 +1600,7 @@ interface OIDCDiscoveryDocument {
 /**
  * Error codes for OIDC discovery operations.
  */
-type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** Discovery URL is invalid or malformed */ | "discovery_invalid_url" /** Discovery URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
+type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */ | "discovery_invalid_url" /** OIDC endpoint URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */ | "discovery_private_host" /** Server-side OIDC endpoint fetch received an HTTP redirect response */ | "oidc_endpoint_redirect" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
 /**
  * Custom error class for OIDC discovery failures.
  * Can be caught and mapped to APIError at the edge.
@@ -1713,7 +1715,7 @@ declare function validateDiscoveryUrl(url: string, isTrustedOrigin: DiscoverOIDC
  * @returns The parsed discovery document
  * @throws DiscoveryError on network errors, timeouts, or invalid responses
  */
-declare function fetchDiscoveryDocument(url: string, timeout?: number): Promise<OIDCDiscoveryDocument>;
+declare function fetchDiscoveryDocument(url: string, timeout?: number, isTrustedOrigin?: (url: string) => boolean): Promise<OIDCDiscoveryDocument>;
 /**
  * Validate a discovery document.
  *
@@ -1788,7 +1790,6 @@ type SSOEndpoints<O extends SSOOptions> = {
   signInSSO: ReturnType<typeof signInSSO>;
   callbackSSO: ReturnType<typeof callbackSSO>;
   callbackSSOShared: ReturnType<typeof callbackSSOShared>;
-  callbackSSOSAML: ReturnType<typeof callbackSSOSAML>;
   acsEndpoint: ReturnType<typeof acsEndpoint>;
   sloEndpoint: ReturnType<typeof sloEndpoint>;
   initiateSLO: ReturnType<typeof initiateSLO>;
@@ -1805,6 +1806,11 @@ type SSOPlugin<O extends SSOOptions> = {
       enabled: true;
     };
   } ? DomainVerificationEndpoints : {});
+  schema: SSOProviderSchema<O>;
+  $Infer: {
+    SSOProvider: InferSSOProvider<O>;
+  };
+  options: NoInfer<O>;
 };
 declare function sso<O extends SSOOptions & {
   domainVerification?: {
@@ -1814,13 +1820,20 @@ declare function sso<O extends SSOOptions & {
   id: "sso";
   version: string;
   endpoints: SSOEndpoints<O> & DomainVerificationEndpoints;
-  schema: NonNullable<BetterAuthPlugin["schema"]>;
+  schema: SSOProviderSchema<O>;
+  $Infer: {
+    SSOProvider: InferSSOProvider<O>;
+  };
   options: NoInfer<O>;
 };
 declare function sso<O extends SSOOptions>(options?: O | undefined): {
   id: "sso";
   version: string;
   endpoints: SSOEndpoints<O>;
+  schema: SSOProviderSchema<O>;
+  $Infer: {
+    SSOProvider: InferSSOProvider<O>;
+  };
   options: NoInfer<O>;
 };
 //#endregion