@better-auth/sso 1.7.0-beta.0 → 1.7.0-beta.10

package/dist/index.mjs

@@ -1,18 +1,24 @@
-import { t as PACKAGE_VERSION } from "./version-CzfTSPRz.mjs";
-import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
+import { t as PACKAGE_VERSION } from "./version-C-W6yUfI.mjs";
+import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
-import * as saml from "samlify";
 import { X509Certificate } from "node:crypto";
 import { getHostname } from "tldts";
 import { generateRandomString } from "better-auth/crypto";
 import * as z from "zod";
+import { getCurrentAdapter, runWithTransaction } from "@better-auth/core/context";
+import { filterOutputFields } from "@better-auth/core/utils/db";
+import { classifyHost, isPublicRoutableHost } from "@better-auth/core/utils/host";
+import { betterFetch } from "@better-fetch/fetch";
+import { createRemoteJWKSet, customFetch, decodeJwt, jwtVerify } from "jose";
 import { base64 } from "@better-auth/utils/base64";
-import { BetterFetchError, betterFetch } from "@better-fetch/fetch";
-import { ASSERTION_SIGNING_ALGORITHMS, HIDE_METADATA, createAuthorizationURL, generateGenericState, generateState, parseGenericState, parseState, validateAuthorizationCode, validateToken } from "better-auth";
-import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
-import { handleOAuthUserInfo } from "better-auth/oauth2";
-import { decodeJwt } from "jose";
 import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+import { parseInputData, toZodSchema } from "better-auth/db";
+import { isAPIError } from "@better-auth/core/utils/is-api-error";
+import { HIDE_METADATA, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, authorizationCodeRequest, createAuthorizationURL, createPrivateKeyJwtClientAssertionGetter, generateGenericState, generateState, getOAuth2Tokens, parseGenericState, parseState } from "better-auth";
+import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
+import { additionalAuthorizationParamsSchema, handleOAuthUserInfo } from "better-auth/oauth2";
+import * as samlifyNamespace from "samlify";
+import samlifyDefault from "samlify";
 //#region src/constants.ts
 /**
 * SAML Constants
@@ -21,8 +27,6 @@ import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
 */
 /** Prefix for AuthnRequest IDs used in InResponseTo validation */
 const AUTHN_REQUEST_KEY_PREFIX = "saml-authn-request:";
-/** Prefix for used Assertion IDs used in replay protection */
-const USED_ASSERTION_KEY_PREFIX = "saml-used-assertion:";
 /** Prefix for SAML session data (NameID + SessionIndex) for SLO */
 const SAML_SESSION_KEY_PREFIX = "saml-session:";
 /** Prefix for reverse lookup of SAML session by Better Auth session ID */
@@ -54,7 +58,6 @@ const DEFAULT_MAX_SAML_RESPONSE_SIZE = 256 * 1024;
 * Protects against oversized metadata documents.
 */
 const DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024;
-const SAML_STATUS_SUCCESS = "urn:oasis:names:tc:SAML:2.0:status:Success";
 //#endregion
 //#region src/utils.ts
 /**
@@ -80,10 +83,22 @@ function safeJsonParse(value) {
 * Checks if a domain matches any domain in a comma-separated list.
 */
 const domainMatches = (searchDomain, domainList) => {
-	const search = searchDomain.toLowerCase();
-	return domainList.split(",").map((d) => d.trim().toLowerCase()).filter(Boolean).some((d) => search === d || search.endsWith(`.${d}`));
+	const search = searchDomain.trim().toLowerCase();
+	const domains = parseProviderDomains(domainList);
+	if (!search || !domains) return false;
+	return domains.some((domain) => search === domain || search.endsWith(`.${domain}`));
 };
 /**
+* Strictly parse a provider-supplied email-verification claim.
+*
+* OIDC userInfo, OIDC id-token, and SAML attribute values are frequently
+* strings, so a loose `Boolean(value)` or truthy fallback treats the string
+* `"false"` as verified. Only a boolean `true` or the exact string `"true"`
+* count as verified; every other value, including `"false"`, `"0"`, `""`,
+* numbers, arrays, and objects, is unverified.
+*/
+const parseProviderEmailVerified = (value) => value === true || value === "true";
+/**
 * Validates email domain against allowed domain(s).
 * Supports comma-separated domains for multi-domain SSO.
 */
@@ -101,9 +116,31 @@ function parseCertificate(certPem) {
 		publicKeyAlgorithm: cert.publicKey.asymmetricKeyType?.toUpperCase() || "UNKNOWN"
 	};
 }
+function normalizePem(key) {
+	if (!key) return key;
+	return `${key.split("\n").map((line) => line.trim()).join("\n").trim()}\n`;
+}
 function getHostnameFromDomain(domain) {
 	return getHostname(domain) || null;
 }
+/**
+* Normalize a provider `domain` value to the email domains it authorizes.
+*
+* TODO(next): replace the serialized provider.domain string with a canonical
+* domains array and reject URL/path-shaped values at register/update once main
+* and next provider schemas are reconciled.
+*/
+function parseProviderDomains(domain) {
+	const entries = domain.split(",").map((entry) => entry.trim()).filter(Boolean);
+	if (entries.length === 0) return null;
+	const domains = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		const parsedDomain = getHostnameFromDomain(entry)?.toLowerCase();
+		if (!parsedDomain) return null;
+		domains.add(parsedDomain);
+	}
+	return [...domains];
+}
 function maskClientId(clientId) {
 	if (clientId.length <= 4) return "****";
 	return `****${clientId.slice(-4)}`;
@@ -205,1274 +242,1757 @@ async function assignOrganizationByDomain(ctx, options) {
 	});
 }
 //#endregion
-//#region src/routes/domain-verification.ts
-const DNS_LABEL_MAX_LENGTH = 63;
-const DEFAULT_TOKEN_PREFIX = "better-auth-token";
-const domainVerificationBodySchema = z.object({ providerId: z.string() });
-function getVerificationIdentifier(options, providerId) {
-	return `_${options.domainVerification?.tokenPrefix || DEFAULT_TOKEN_PREFIX}-${providerId}`;
-}
-const requestDomainVerification = (options) => {
-	return createAuthEndpoint("/sso/request-domain-verification", {
-		method: "POST",
-		body: domainVerificationBodySchema,
-		metadata: { openapi: {
-			summary: "Request a domain verification",
-			description: "Request a domain verification for the given SSO provider",
-			responses: {
-				"404": { description: "Provider not found" },
-				"409": { description: "Domain has already been verified" },
-				"201": { description: "Domain submitted for verification" }
-			}
-		} },
-		use: [sessionMiddleware]
-	}, async (ctx) => {
-		const body = ctx.body;
-		const provider = await ctx.context.adapter.findOne({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: body.providerId
-			}]
-		});
-		if (!provider) throw new APIError("NOT_FOUND", {
-			message: "Provider not found",
-			code: "PROVIDER_NOT_FOUND"
-		});
-		const userId = ctx.context.session.user.id;
-		let isOrgMember = true;
-		if (provider.organizationId) isOrgMember = await ctx.context.adapter.count({
-			model: "member",
-			where: [{
-				field: "userId",
-				value: userId
-			}, {
-				field: "organizationId",
-				value: provider.organizationId
-			}]
-		}) > 0;
-		if (provider.userId !== userId || !isOrgMember) throw new APIError("FORBIDDEN", {
-			message: "User must be owner of or belong to the SSO provider organization",
-			code: "INSUFICCIENT_ACCESS"
-		});
-		if ("domainVerified" in provider && provider.domainVerified) throw new APIError("CONFLICT", {
-			message: "Domain has already been verified",
-			code: "DOMAIN_VERIFIED"
-		});
-		const identifier = getVerificationIdentifier(options, provider.providerId);
-		const activeVerification = await ctx.context.internalAdapter.findVerificationValue(identifier);
-		if (activeVerification && new Date(activeVerification.expiresAt) > /* @__PURE__ */ new Date()) {
-			ctx.setStatus(201);
-			return ctx.json({ domainVerificationToken: activeVerification.value });
-		}
-		const domainVerificationToken = generateRandomString(24);
-		await ctx.context.internalAdapter.createVerificationValue({
-			identifier,
-			value: domainVerificationToken,
-			expiresAt: new Date(Date.now() + 3600 * 24 * 7 * 1e3)
-		});
-		ctx.setStatus(201);
-		return ctx.json({ domainVerificationToken });
-	});
-};
-const verifyDomain = (options) => {
-	return createAuthEndpoint("/sso/verify-domain", {
-		method: "POST",
-		body: domainVerificationBodySchema,
-		metadata: { openapi: {
-			summary: "Verify the provider domain ownership",
-			description: "Verify the provider domain ownership via DNS records",
-			responses: {
-				"404": { description: "Provider not found" },
-				"409": { description: "Domain has already been verified or no pending verification exists" },
-				"502": { description: "Unable to verify domain ownership due to upstream validator error" },
-				"204": { description: "Domain ownership was verified" }
-			}
-		} },
-		use: [sessionMiddleware]
-	}, async (ctx) => {
-		const body = ctx.body;
-		const provider = await ctx.context.adapter.findOne({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: body.providerId
-			}]
-		});
-		if (!provider) throw new APIError("NOT_FOUND", {
-			message: "Provider not found",
-			code: "PROVIDER_NOT_FOUND"
-		});
-		const userId = ctx.context.session.user.id;
-		let isOrgMember = true;
-		if (provider.organizationId) isOrgMember = await ctx.context.adapter.count({
-			model: "member",
-			where: [{
-				field: "userId",
-				value: userId
-			}, {
-				field: "organizationId",
-				value: provider.organizationId
-			}]
-		}) > 0;
-		if (provider.userId !== userId || !isOrgMember) throw new APIError("FORBIDDEN", {
-			message: "User must be owner of or belong to the SSO provider organization",
-			code: "INSUFICCIENT_ACCESS"
-		});
-		if ("domainVerified" in provider && provider.domainVerified) throw new APIError("CONFLICT", {
-			message: "Domain has already been verified",
-			code: "DOMAIN_VERIFIED"
-		});
-		const identifier = getVerificationIdentifier(options, provider.providerId);
-		if (identifier.length > DNS_LABEL_MAX_LENGTH) throw new APIError("BAD_REQUEST", {
-			message: `Verification identifier exceeds the DNS label limit of ${DNS_LABEL_MAX_LENGTH} characters`,
-			code: "IDENTIFIER_TOO_LONG"
-		});
-		const activeVerification = await ctx.context.internalAdapter.findVerificationValue(identifier);
-		if (!activeVerification || new Date(activeVerification.expiresAt) <= /* @__PURE__ */ new Date()) throw new APIError("NOT_FOUND", {
-			message: "No pending domain verification exists",
-			code: "NO_PENDING_VERIFICATION"
-		});
-		let records = [];
-		let dns;
-		try {
-			dns = await import("node:dns/promises");
-		} catch (error) {
-			ctx.context.logger.error("The core node:dns module is required for the domain verification feature", error);
-			throw new APIError("INTERNAL_SERVER_ERROR", {
-				message: "Unable to verify domain ownership due to server error",
-				code: "DOMAIN_VERIFICATION_FAILED"
-			});
-		}
-		const hostname = getHostnameFromDomain(provider.domain);
-		if (!hostname) throw new APIError("BAD_REQUEST", {
-			message: "Invalid domain",
-			code: "INVALID_DOMAIN"
-		});
-		try {
-			records = (await dns.resolveTxt(`${identifier}.${hostname}`)).flat();
-		} catch (error) {
-			ctx.context.logger.warn("DNS resolution failure while validating domain ownership", error);
-		}
-		if (!records.find((record) => record.includes(`${activeVerification.identifier}=${activeVerification.value}`))) throw new APIError("BAD_GATEWAY", {
-			message: "Unable to verify domain ownership. Try again later",
-			code: "DOMAIN_VERIFICATION_FAILED"
-		});
-		await ctx.context.adapter.update({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: provider.providerId
-			}],
-			update: { domainVerified: true }
-		});
-		ctx.setStatus(204);
-	});
+//#region src/oidc/types.ts
+/**
+* Custom error class for OIDC discovery failures.
+* Can be caught and mapped to APIError at the edge.
+*/
+var DiscoveryError = class DiscoveryError extends Error {
+	code;
+	details;
+	constructor(code, message, details, options) {
+		super(message, options);
+		this.name = "DiscoveryError";
+		this.code = code;
+		this.details = details;
+		if (Error.captureStackTrace) Error.captureStackTrace(this, DiscoveryError);
+	}
 };
+/**
+* Required fields that must be present in a valid discovery document.
+*/
+const REQUIRED_DISCOVERY_FIELDS = [
+	"issuer",
+	"authorization_endpoint",
+	"token_endpoint",
+	"jwks_uri"
+];
 //#endregion
-//#region src/saml/parser.ts
-const xmlParser = new XMLParser({
-	ignoreAttributes: false,
-	attributeNamePrefix: "@_",
-	removeNSPrefix: true,
-	processEntities: false
-});
-function findNode(obj, nodeName) {
-	if (!obj || typeof obj !== "object") return null;
-	const record = obj;
-	if (nodeName in record) return record[nodeName];
-	for (const value of Object.values(record)) if (Array.isArray(value)) for (const item of value) {
-		const found = findNode(item, nodeName);
-		if (found) return found;
-	}
-	else if (typeof value === "object" && value !== null) {
-		const found = findNode(value, nodeName);
-		if (found) return found;
-	}
-	return null;
+//#region src/oidc/discovery.ts
+/**
+* OIDC Discovery Pipeline
+*
+* Implements OIDC discovery document fetching, validation, and hydration.
+* This module is used both at provider registration time (to persist validated config)
+* and at runtime (to hydrate legacy providers that are missing metadata).
+*
+* @see https://openid.net/specs/openid-connect-discovery-1_0.html
+*/
+/** Default timeout for discovery requests (10 seconds) */
+const DEFAULT_DISCOVERY_TIMEOUT = 1e4;
+function isHttpRedirectStatus(status) {
+	return status >= 300 && status < 400;
 }
-function countAllNodes(obj, nodeName) {
-	if (!obj || typeof obj !== "object") return 0;
-	let count = 0;
-	const record = obj;
-	if (nodeName in record) {
-		const node = record[nodeName];
-		count += Array.isArray(node) ? node.length : 1;
-	}
-	for (const value of Object.values(record)) if (Array.isArray(value)) for (const item of value) count += countAllNodes(item, nodeName);
-	else if (typeof value === "object" && value !== null) count += countAllNodes(value, nodeName);
-	return count;
+/**
+* Main entry point: Discover and hydrate OIDC configuration from an issuer.
+*
+* This function:
+* 1. Computes the discovery URL from the issuer
+* 2. Validates the discovery URL
+* 3. Fetches the discovery document
+* 4. Validates the discovery document (issuer match + required fields)
+* 5. Normalizes URLs
+* 6. Selects token endpoint auth method
+* 7. Merges with existing config (existing values take precedence)
+*
+* @param params - Discovery parameters
+* @param isTrustedOrigin - Origin verification tester function
+* @returns Hydrated OIDC configuration ready for persistence
+* @throws DiscoveryError on any failure
+*/
+async function discoverOIDCConfig(params) {
+	const { issuer, existingConfig, timeout = DEFAULT_DISCOVERY_TIMEOUT } = params;
+	const discoveryUrl = params.discoveryEndpoint || existingConfig?.discoveryEndpoint || computeDiscoveryUrl(issuer);
+	validateDiscoveryUrl(discoveryUrl, params.isTrustedOrigin);
+	const discoveryDoc = await fetchDiscoveryDocument(discoveryUrl, timeout, params.isTrustedOrigin);
+	validateDiscoveryDocument(discoveryDoc, issuer);
+	const normalizedDoc = normalizeDiscoveryUrls(discoveryDoc, issuer, params.isTrustedOrigin);
+	const tokenEndpointAuth = selectTokenEndpointAuthMethod(normalizedDoc, existingConfig?.tokenEndpointAuthentication);
+	return {
+		issuer: existingConfig?.issuer ?? normalizedDoc.issuer,
+		discoveryEndpoint: existingConfig?.discoveryEndpoint ?? discoveryUrl,
+		authorizationEndpoint: existingConfig?.authorizationEndpoint ?? normalizedDoc.authorization_endpoint,
+		tokenEndpoint: existingConfig?.tokenEndpoint ?? normalizedDoc.token_endpoint,
+		jwksEndpoint: existingConfig?.jwksEndpoint ?? normalizedDoc.jwks_uri,
+		userInfoEndpoint: existingConfig?.userInfoEndpoint ?? normalizedDoc.userinfo_endpoint,
+		tokenEndpointAuthentication: existingConfig?.tokenEndpointAuthentication ?? tokenEndpointAuth,
+		scopesSupported: existingConfig?.scopesSupported ?? normalizedDoc.scopes_supported
+	};
 }
-//#endregion
-//#region src/saml/algorithms.ts
-const SignatureAlgorithm = {
-	RSA_SHA1: "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
-	RSA_SHA256: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
-	RSA_SHA384: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384",
-	RSA_SHA512: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512",
-	ECDSA_SHA256: "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256",
-	ECDSA_SHA384: "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384",
-	ECDSA_SHA512: "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"
-};
-const DigestAlgorithm = {
-	SHA1: "http://www.w3.org/2000/09/xmldsig#sha1",
-	SHA256: "http://www.w3.org/2001/04/xmlenc#sha256",
-	SHA384: "http://www.w3.org/2001/04/xmldsig-more#sha384",
-	SHA512: "http://www.w3.org/2001/04/xmlenc#sha512"
-};
-const KeyEncryptionAlgorithm = {
-	RSA_1_5: "http://www.w3.org/2001/04/xmlenc#rsa-1_5",
-	RSA_OAEP: "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p",
-	RSA_OAEP_SHA256: "http://www.w3.org/2009/xmlenc11#rsa-oaep"
-};
-const DataEncryptionAlgorithm = {
-	TRIPLEDES_CBC: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc",
-	AES_128_CBC: "http://www.w3.org/2001/04/xmlenc#aes128-cbc",
-	AES_192_CBC: "http://www.w3.org/2001/04/xmlenc#aes192-cbc",
-	AES_256_CBC: "http://www.w3.org/2001/04/xmlenc#aes256-cbc",
-	AES_128_GCM: "http://www.w3.org/2009/xmlenc11#aes128-gcm",
-	AES_192_GCM: "http://www.w3.org/2009/xmlenc11#aes192-gcm",
-	AES_256_GCM: "http://www.w3.org/2009/xmlenc11#aes256-gcm"
-};
-const DEPRECATED_SIGNATURE_ALGORITHMS = [SignatureAlgorithm.RSA_SHA1];
-const DEPRECATED_KEY_ENCRYPTION_ALGORITHMS = [KeyEncryptionAlgorithm.RSA_1_5];
-const DEPRECATED_DATA_ENCRYPTION_ALGORITHMS = [DataEncryptionAlgorithm.TRIPLEDES_CBC];
-const DEPRECATED_DIGEST_ALGORITHMS = [DigestAlgorithm.SHA1];
-const SECURE_SIGNATURE_ALGORITHMS = [
-	SignatureAlgorithm.RSA_SHA256,
-	SignatureAlgorithm.RSA_SHA384,
-	SignatureAlgorithm.RSA_SHA512,
-	SignatureAlgorithm.ECDSA_SHA256,
-	SignatureAlgorithm.ECDSA_SHA384,
-	SignatureAlgorithm.ECDSA_SHA512
-];
-const SECURE_DIGEST_ALGORITHMS = [
-	DigestAlgorithm.SHA256,
-	DigestAlgorithm.SHA384,
-	DigestAlgorithm.SHA512
-];
-const SHORT_FORM_SIGNATURE_TO_URI = {
-	sha1: SignatureAlgorithm.RSA_SHA1,
-	sha256: SignatureAlgorithm.RSA_SHA256,
-	sha384: SignatureAlgorithm.RSA_SHA384,
-	sha512: SignatureAlgorithm.RSA_SHA512,
-	"rsa-sha1": SignatureAlgorithm.RSA_SHA1,
-	"rsa-sha256": SignatureAlgorithm.RSA_SHA256,
-	"rsa-sha384": SignatureAlgorithm.RSA_SHA384,
-	"rsa-sha512": SignatureAlgorithm.RSA_SHA512,
-	"ecdsa-sha256": SignatureAlgorithm.ECDSA_SHA256,
-	"ecdsa-sha384": SignatureAlgorithm.ECDSA_SHA384,
-	"ecdsa-sha512": SignatureAlgorithm.ECDSA_SHA512
-};
-const SHORT_FORM_DIGEST_TO_URI = {
-	sha1: DigestAlgorithm.SHA1,
-	sha256: DigestAlgorithm.SHA256,
-	sha384: DigestAlgorithm.SHA384,
-	sha512: DigestAlgorithm.SHA512
-};
-function normalizeSignatureAlgorithm(alg) {
-	return SHORT_FORM_SIGNATURE_TO_URI[alg.toLowerCase()] ?? alg;
+/**
+* Compute the discovery URL from an issuer URL.
+*
+* Per OIDC Discovery spec, the discovery document is located at:
+* <issuer>/.well-known/openid-configuration
+*
+* Handles trailing slashes correctly.
+*/
+function computeDiscoveryUrl(issuer) {
+	return `${issuer.endsWith("/") ? issuer.slice(0, -1) : issuer}/.well-known/openid-configuration`;
 }
-function normalizeDigestAlgorithm(alg) {
-	return SHORT_FORM_DIGEST_TO_URI[alg.toLowerCase()] ?? alg;
+/**
+* Validate a discovery URL before fetching.
+*
+* @param url - The discovery URL to validate
+* @param isTrustedOrigin - Origin verification tester function
+* @throws DiscoveryError if URL is invalid
+*/
+function validateDiscoveryUrl(url, isTrustedOrigin) {
+	const discoveryEndpoint = parseURL("discoveryEndpoint", url).toString();
+	if (!isTrustedOrigin(discoveryEndpoint)) throw new DiscoveryError("discovery_untrusted_origin", `The main discovery endpoint "${discoveryEndpoint}" is not trusted by your trusted origins configuration.`, { url: discoveryEndpoint });
 }
-function extractEncryptionAlgorithms(xml) {
+/**
+* Validate that a user-supplied OIDC endpoint URL is safe to fetch.
+*
+* Layered checks (in order):
+*   1. URL parsing + http(s) scheme            → discovery_invalid_url
+*   2. Public-routable host (RFC 6890)         → allowed
+*   3. Operator-allowlisted via trustedOrigins → allowed (opt-in for internal IdPs)
+*   4. Otherwise                               → discovery_private_host
+*
+* Step 2 rejects loopback, RFC 1918, link-local, ULA, shared-address,
+* cloud-metadata FQDNs (e.g. `169.254.169.254`, `metadata.google.internal`),
+* multicast, and reserved ranges. See `isPublicRoutableHost` in
+* `@better-auth/core/utils/host`.
+*
+* Step 3 is the documented escape hatch for customers whose IdP runs on a
+* private network or behind a corporate VPN: they add the IdP origin to their
+* `trustedOrigins` configuration.
+*
+* @param name - The endpoint field name, used in error messages
+* @param endpoint - The URL to validate
+* @param isTrustedOrigin - Predicate matching the configured `trustedOrigins`
+* @throws DiscoveryError(discovery_invalid_url)  — malformed URL or non-http(s) scheme
+* @throws DiscoveryError(discovery_private_host) — host is not publicly routable and not allowlisted
+*/
+function validateOIDCEndpointUrl(name, endpoint, isTrustedOrigin) {
+	const parsed = parseURL(name, endpoint);
+	if (isPublicRoutableHost(parsed.hostname)) return;
+	if (isTrustedOrigin(parsed.toString())) return;
+	throw new DiscoveryError("discovery_private_host", `The ${name} URL (${parsed.toString()}) is not publicly routable: ${parsed.hostname}. If this is an internal IdP, add its origin to trustedOrigins.`, {
+		endpoint: name,
+		url: endpoint,
+		hostname: parsed.hostname
+	});
+}
+/**
+* Validate every present OIDC endpoint URL in a registration or update body.
+*
+* Each provided URL is checked with {@link validateOIDCEndpointUrl}.
+* Omitted (undefined / null / empty) fields are skipped.
+*
+* @param config - OIDC endpoint URLs from the request body
+* @param isTrustedOrigin - Predicate matching the configured `trustedOrigins`
+* @throws DiscoveryError on the first invalid endpoint
+*/
+function validateOIDCEndpointUrls(config, isTrustedOrigin) {
+	const fields = [
+		["authorizationEndpoint", config.authorizationEndpoint],
+		["tokenEndpoint", config.tokenEndpoint],
+		["userInfoEndpoint", config.userInfoEndpoint],
+		["jwksEndpoint", config.jwksEndpoint],
+		["discoveryEndpoint", config.discoveryEndpoint]
+	];
+	for (const [name, url] of fields) if (url) validateOIDCEndpointUrl(name, url, isTrustedOrigin);
+}
+/**
+* Re-validate an endpoint by resolving its hostname and rejecting any resolved
+* address that is not publicly routable.
+*
+* {@link validateOIDCEndpointUrl} only classifies the literal hostname, so
+* a host like `idp.example` whose DNS record points at `127.0.0.1`,
+* `169.254.169.254`, or an RFC 1918 address passes that check unchanged. This
+* function closes that gap by performing the same RFC 6890 classification on the
+* addresses the host actually resolves to, right before the server-side fetch.
+*
+* Best-effort by design:
+*   - Operator-allowlisted origins (trustedOrigins) are skipped — this is the
+*     documented escape hatch for internal IdPs.
+*   - IP-literal hosts are already fully covered by the synchronous check.
+*   - On runtimes without `node:dns` (e.g. Cloudflare Workers / edge), DNS
+*     resolution is unavailable; we fall back to the synchronous host check and
+*     the platform's own egress controls.
+*
+* Note: this resolves once and validates the result; it does not pin the address
+* for the subsequent connection, so a change in the resolved address between
+* this lookup and the fetch remains theoretically possible. It nonetheless
+* rejects the common case of a DNS record that statically points at an internal
+* address.
+*
+* @throws DiscoveryError(discovery_private_host) if any resolved address is not public
+*/
+async function assertEndpointResolvesPublic(name, endpoint, isTrustedOrigin) {
+	const parsed = parseURL(name, endpoint);
+	if (isTrustedOrigin(parsed.toString())) return;
+	const host = parsed.hostname;
+	if (classifyHost(host).literal !== "fqdn") return;
+	let dns;
 	try {
-		const parsed = xmlParser.parse(xml);
-		const keyAlg = (findNode(parsed, "EncryptedKey")?.EncryptionMethod)?.["@_Algorithm"];
-		const dataAlg = (findNode(parsed, "EncryptedData")?.EncryptionMethod)?.["@_Algorithm"];
-		return {
-			keyEncryption: keyAlg || null,
-			dataEncryption: dataAlg || null
-		};
+		dns = await import("node:dns/promises");
 	} catch {
-		return {
-			keyEncryption: null,
-			dataEncryption: null
-		};
+		return;
 	}
-}
-function hasEncryptedAssertion(xml) {
+	let resolved;
 	try {
-		return findNode(xmlParser.parse(xml), "EncryptedAssertion") !== null;
+		resolved = await dns.lookup(host, { all: true });
 	} catch {
-		return false;
+		return;
 	}
+	for (const { address } of resolved) if (!isPublicRoutableHost(address)) throw new DiscoveryError("discovery_private_host", `The ${name} host "${host}" resolves to a non-publicly-routable address (${address}). If this is an internal IdP, add its origin to trustedOrigins.`, {
+		endpoint: name,
+		url: endpoint,
+		hostname: host,
+		resolved: address
+	});
 }
-function handleDeprecatedAlgorithm(message, behavior, errorCode) {
-	switch (behavior) {
-		case "reject": throw new APIError("BAD_REQUEST", {
-			message,
-			code: errorCode
-		});
-		case "warn":
-			console.warn(`[SAML Security Warning] ${message}`);
-			break;
-		case "allow": break;
-	}
+/**
+* Validate an OIDC endpoint immediately before a server-side fetch.
+*/
+async function assertOIDCEndpointAllowed(name, endpoint, isTrustedOrigin) {
+	validateOIDCEndpointUrl(name, endpoint, isTrustedOrigin);
+	await assertEndpointResolvesPublic(name, endpoint, isTrustedOrigin);
 }
-function validateSignatureAlgorithm(algorithm, options = {}) {
-	if (!algorithm) return;
-	const { onDeprecated = "warn", allowedSignatureAlgorithms } = options;
-	if (allowedSignatureAlgorithms) {
-		if (!allowedSignatureAlgorithms.includes(algorithm)) throw new APIError("BAD_REQUEST", {
-			message: `SAML signature algorithm not in allow-list: ${algorithm}`,
-			code: "SAML_ALGORITHM_NOT_ALLOWED"
-		});
-		return;
-	}
-	if (DEPRECATED_SIGNATURE_ALGORITHMS.includes(algorithm)) {
-		handleDeprecatedAlgorithm(`SAML response uses deprecated signature algorithm: ${algorithm}. Please configure your IdP to use SHA-256 or stronger.`, onDeprecated, "SAML_DEPRECATED_ALGORITHM");
-		return;
+/**
+* Re-validate, at fetch time, every OIDC endpoint that is fetched server-side
+* (token, userinfo, jwks). `authorizationEndpoint` is intentionally excluded
+* because it is a browser redirect target, not a server-side fetch.
+*/
+async function assertServerFetchedOIDCEndpointsAllowed(config, isTrustedOrigin) {
+	const fields = [
+		["tokenEndpoint", config.tokenEndpoint],
+		["userInfoEndpoint", config.userInfoEndpoint],
+		["jwksEndpoint", config.jwksEndpoint]
+	];
+	for (const [name, url] of fields) {
+		if (!url) continue;
+		await assertOIDCEndpointAllowed(name, url, isTrustedOrigin);
 	}
-	if (!SECURE_SIGNATURE_ALGORITHMS.includes(algorithm)) throw new APIError("BAD_REQUEST", {
-		message: `SAML signature algorithm not recognized: ${algorithm}`,
-		code: "SAML_UNKNOWN_ALGORITHM"
+}
+/**
+* Convert an explicit HTTP redirect response into the OIDC configuration error
+* used by all server-side endpoint fetches.
+*/
+function throwRedirectError(name, endpoint, status, location) {
+	throw new DiscoveryError("oidc_endpoint_redirect", `The ${name} (${endpoint}) returned an HTTP ${status} redirect. Configure the final OIDC endpoint URL instead of a redirecting URL.`, {
+		endpoint: name,
+		url: endpoint,
+		status,
+		location
 	});
 }
-function validateEncryptionAlgorithms(algorithms, options = {}) {
-	const { onDeprecated = "warn", allowedKeyEncryptionAlgorithms, allowedDataEncryptionAlgorithms } = options;
-	const { keyEncryption, dataEncryption } = algorithms;
-	if (keyEncryption) {
-		if (allowedKeyEncryptionAlgorithms) {
-			if (!allowedKeyEncryptionAlgorithms.includes(keyEncryption)) throw new APIError("BAD_REQUEST", {
-				message: `SAML key encryption algorithm not in allow-list: ${keyEncryption}`,
-				code: "SAML_ALGORITHM_NOT_ALLOWED"
-			});
-		} else if (DEPRECATED_KEY_ENCRYPTION_ALGORITHMS.includes(keyEncryption)) handleDeprecatedAlgorithm(`SAML response uses deprecated key encryption algorithm: ${keyEncryption}. Please configure your IdP to use RSA-OAEP.`, onDeprecated, "SAML_DEPRECATED_ALGORITHM");
-	}
-	if (dataEncryption) {
-		if (allowedDataEncryptionAlgorithms) {
-			if (!allowedDataEncryptionAlgorithms.includes(dataEncryption)) throw new APIError("BAD_REQUEST", {
-				message: `SAML data encryption algorithm not in allow-list: ${dataEncryption}`,
-				code: "SAML_ALGORITHM_NOT_ALLOWED"
-			});
-		} else if (DEPRECATED_DATA_ENCRYPTION_ALGORITHMS.includes(dataEncryption)) handleDeprecatedAlgorithm(`SAML response uses deprecated data encryption algorithm: ${dataEncryption}. Please configure your IdP to use AES-GCM.`, onDeprecated, "SAML_DEPRECATED_ALGORITHM");
-	}
+/**
+* Fetch a configured OIDC endpoint without following redirects.
+*
+* Every server-side OIDC request goes through this helper so private-host
+* checks and redirect handling stay consistent across discovery, token, and
+* userinfo calls.
+*/
+async function fetchOIDCEndpoint(name, endpoint, options, isTrustedOrigin) {
+	await assertOIDCEndpointAllowed(name, endpoint, isTrustedOrigin);
+	let redirectLocation = null;
+	const { onError, ...fetchOptions } = options;
+	const response = await betterFetch(endpoint, {
+		...fetchOptions,
+		redirect: "manual",
+		onError: async (context) => {
+			if (isHttpRedirectStatus(context.response.status)) redirectLocation = context.response.headers.get("location");
+			await onError?.(context);
+		}
+	});
+	if (response.error && isHttpRedirectStatus(response.error.status)) throwRedirectError(name, endpoint, response.error.status, redirectLocation);
+	return response;
 }
-function validateSAMLAlgorithms(response, options) {
-	validateSignatureAlgorithm(response.sigAlg, options);
-	if (hasEncryptedAssertion(response.samlContent)) validateEncryptionAlgorithms(extractEncryptionAlgorithms(response.samlContent), options);
+/**
+* Native-fetch variant for libraries that require a `fetch` implementation,
+* such as jose's remote JWKS loader.
+*/
+async function fetchOIDCEndpointResponse(name, endpoint, init, isTrustedOrigin) {
+	await assertOIDCEndpointAllowed(name, endpoint, isTrustedOrigin);
+	const response = await fetch(endpoint, {
+		...init,
+		redirect: "manual"
+	});
+	if (isHttpRedirectStatus(response.status)) throwRedirectError(name, endpoint, response.status, response.headers.get("location"));
+	return response;
 }
-function validateConfigAlgorithms(config, options = {}) {
-	const { onDeprecated = "warn", allowedSignatureAlgorithms, allowedDigestAlgorithms } = options;
-	if (config.signatureAlgorithm) {
-		const normalized = normalizeSignatureAlgorithm(config.signatureAlgorithm);
-		if (allowedSignatureAlgorithms) {
-			if (!allowedSignatureAlgorithms.map(normalizeSignatureAlgorithm).includes(normalized)) throw new APIError("BAD_REQUEST", {
-				message: `SAML signature algorithm not in allow-list: ${config.signatureAlgorithm}`,
-				code: "SAML_ALGORITHM_NOT_ALLOWED"
+/**
+* Validate an OIDC ID token using the same endpoint fetch policy as the rest of
+* the SSO OIDC flow.
+*/
+async function validateOIDCIdToken(token, jwksEndpoint, options, isTrustedOrigin) {
+	return jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint), { [customFetch]: (url, init) => fetchOIDCEndpointResponse("jwksEndpoint", url, init, isTrustedOrigin) }), {
+		audience: options.audience,
+		issuer: options.issuer
+	});
+}
+/**
+* Fetch the OIDC discovery document from the IdP.
+*
+* @param url - The discovery endpoint URL
+* @param timeout - Request timeout in milliseconds
+* @returns The parsed discovery document
+* @throws DiscoveryError on network errors, timeouts, or invalid responses
+*/
+async function fetchDiscoveryDocument(url, timeout = DEFAULT_DISCOVERY_TIMEOUT, isTrustedOrigin = () => false) {
+	try {
+		const response = await fetchOIDCEndpoint("discoveryEndpoint", url, {
+			method: "GET",
+			timeout
+		}, isTrustedOrigin);
+		if (response.error) {
+			const { status } = response.error;
+			if (status === 404) throw new DiscoveryError("discovery_not_found", "Discovery endpoint not found", {
+				url,
+				status
 			});
-		} else if (DEPRECATED_SIGNATURE_ALGORITHMS.includes(normalized)) handleDeprecatedAlgorithm(`SAML config uses deprecated signature algorithm: ${config.signatureAlgorithm}. Consider using SHA-256 or stronger.`, onDeprecated, "SAML_DEPRECATED_CONFIG_ALGORITHM");
-		else if (!SECURE_SIGNATURE_ALGORITHMS.includes(normalized)) throw new APIError("BAD_REQUEST", {
-			message: `SAML signature algorithm not recognized: ${config.signatureAlgorithm}`,
-			code: "SAML_UNKNOWN_ALGORITHM"
-		});
-	}
-	if (config.digestAlgorithm) {
-		const normalized = normalizeDigestAlgorithm(config.digestAlgorithm);
-		if (allowedDigestAlgorithms) {
-			if (!allowedDigestAlgorithms.map(normalizeDigestAlgorithm).includes(normalized)) throw new APIError("BAD_REQUEST", {
-				message: `SAML digest algorithm not in allow-list: ${config.digestAlgorithm}`,
-				code: "SAML_ALGORITHM_NOT_ALLOWED"
+			if (status === 408) throw new DiscoveryError("discovery_timeout", "Discovery request timed out", {
+				url,
+				timeout
 			});
-		} else if (DEPRECATED_DIGEST_ALGORITHMS.includes(normalized)) handleDeprecatedAlgorithm(`SAML config uses deprecated digest algorithm: ${config.digestAlgorithm}. Consider using SHA-256 or stronger.`, onDeprecated, "SAML_DEPRECATED_CONFIG_ALGORITHM");
-		else if (!SECURE_DIGEST_ALGORITHMS.includes(normalized)) throw new APIError("BAD_REQUEST", {
-			message: `SAML digest algorithm not recognized: ${config.digestAlgorithm}`,
-			code: "SAML_UNKNOWN_ALGORITHM"
+			throw new DiscoveryError("discovery_unexpected_error", `Unexpected discovery error: ${response.error.statusText}`, {
+				url,
+				...response.error
+			});
+		}
+		if (!response.data) throw new DiscoveryError("discovery_invalid_json", "Discovery endpoint returned an empty response", { url });
+		const data = response.data;
+		if (typeof data === "string") throw new DiscoveryError("discovery_invalid_json", "Discovery endpoint returned invalid JSON", {
+			url,
+			bodyPreview: data.slice(0, 200)
 		});
-	}
-}
-//#endregion
-//#region src/saml/assertions.ts
-function countAssertions(xml) {
-	let parsed;
-	try {
-		parsed = xmlParser.parse(xml);
-	} catch {
-		throw new APIError("BAD_REQUEST", {
-			message: "Failed to parse SAML response XML",
-			code: "SAML_INVALID_XML"
+		return data;
+	} catch (error) {
+		if (error instanceof DiscoveryError) throw error;
+		if (error instanceof Error && error.name === "AbortError") throw new DiscoveryError("discovery_timeout", "Discovery request timed out", {
+			url,
+			timeout
 		});
+		throw new DiscoveryError("discovery_unexpected_error", `Unexpected error during discovery: ${error instanceof Error ? error.message : String(error)}`, { url }, { cause: error });
 	}
-	const assertions = countAllNodes(parsed, "Assertion");
-	const encryptedAssertions = countAllNodes(parsed, "EncryptedAssertion");
-	return {
-		assertions,
-		encryptedAssertions,
-		total: assertions + encryptedAssertions
-	};
 }
-function validateSingleAssertion(samlResponse) {
-	let xml;
-	try {
-		xml = new TextDecoder().decode(base64.decode(samlResponse.replace(/\s+/g, "")));
-		if (!xml.includes("<")) throw new Error("Not XML");
-	} catch {
-		throw new APIError("BAD_REQUEST", {
-			message: "Invalid base64-encoded SAML response",
-			code: "SAML_INVALID_ENCODING"
-		});
-	}
-	const counts = countAssertions(xml);
-	if (counts.total === 0) throw new APIError("BAD_REQUEST", {
-		message: "SAML response contains no assertions",
-		code: "SAML_NO_ASSERTION"
+/**
+* Validate a discovery document.
+*
+* Checks:
+* 1. All required fields are present
+* 2. Issuer matches the configured issuer (case-sensitive, exact match)
+*
+* Invariant: If this function returns without throwing, the document is safe
+* to use for hydrating OIDC config (required fields present, issuer matches
+* configured value, basic structural sanity verified).
+*
+* @param doc - The discovery document to validate
+* @param configuredIssuer - The expected issuer value
+* @throws DiscoveryError if validation fails
+*/
+function validateDiscoveryDocument(doc, configuredIssuer) {
+	const missingFields = [];
+	for (const field of REQUIRED_DISCOVERY_FIELDS) if (!doc[field]) missingFields.push(field);
+	if (missingFields.length > 0) throw new DiscoveryError("discovery_incomplete", `Discovery document is missing required fields: ${missingFields.join(", ")}`, { missingFields });
+	if ((doc.issuer.endsWith("/") ? doc.issuer.slice(0, -1) : doc.issuer) !== (configuredIssuer.endsWith("/") ? configuredIssuer.slice(0, -1) : configuredIssuer)) throw new DiscoveryError("issuer_mismatch", `Discovered issuer "${doc.issuer}" does not match configured issuer "${configuredIssuer}"`, {
+		discovered: doc.issuer,
+		configured: configuredIssuer
 	});
-	if (counts.total > 1) throw new APIError("BAD_REQUEST", {
-		message: `SAML response contains ${counts.total} assertions, expected exactly 1`,
-		code: "SAML_MULTIPLE_ASSERTIONS"
+}
+/**
+* Normalize URLs in the discovery document.
+*
+* @param document - The discovery document
+* @param issuer - The base issuer URL
+* @param isTrustedOrigin - Origin verification tester function
+* @returns The normalized discovery document
+*/
+function normalizeDiscoveryUrls(document, issuer, isTrustedOrigin) {
+	const doc = { ...document };
+	doc.token_endpoint = normalizeAndValidateUrl("token_endpoint", doc.token_endpoint, issuer, isTrustedOrigin);
+	doc.authorization_endpoint = normalizeAndValidateUrl("authorization_endpoint", doc.authorization_endpoint, issuer, isTrustedOrigin);
+	doc.jwks_uri = normalizeAndValidateUrl("jwks_uri", doc.jwks_uri, issuer, isTrustedOrigin);
+	if (doc.userinfo_endpoint) doc.userinfo_endpoint = normalizeAndValidateUrl("userinfo_endpoint", doc.userinfo_endpoint, issuer, isTrustedOrigin);
+	if (doc.revocation_endpoint) doc.revocation_endpoint = normalizeAndValidateUrl("revocation_endpoint", doc.revocation_endpoint, issuer, isTrustedOrigin);
+	if (doc.end_session_endpoint) doc.end_session_endpoint = normalizeAndValidateUrl("end_session_endpoint", doc.end_session_endpoint, issuer, isTrustedOrigin);
+	if (doc.introspection_endpoint) doc.introspection_endpoint = normalizeAndValidateUrl("introspection_endpoint", doc.introspection_endpoint, issuer, isTrustedOrigin);
+	return doc;
+}
+/**
+* Normalizes and validates a single URL endpoint
+* @param name The url name
+* @param endpoint The url to validate
+* @param issuer The issuer base url
+* @param isTrustedOrigin - Origin verification tester function
+* @returns
+*/
+function normalizeAndValidateUrl(name, endpoint, issuer, isTrustedOrigin) {
+	const url = normalizeUrl(name, endpoint, issuer);
+	if (!isTrustedOrigin(url)) throw new DiscoveryError("discovery_untrusted_origin", `The ${name} "${url}" is not trusted by your trusted origins configuration.`, {
+		endpoint: name,
+		url
 	});
+	return url;
 }
-//#endregion
-//#region src/saml/response-validation.ts
-function errorRedirectUrl(base, error, description) {
+/**
+* Normalize a single URL endpoint.
+*
+* @param name - The endpoint name (e.g token_endpoint)
+* @param endpoint - The endpoint URL to normalize
+* @param issuer - The base issuer URL
+* @returns The normalized endpoint URL
+*/
+function normalizeUrl(name, endpoint, issuer) {
 	try {
-		const url = new URL(base);
-		url.searchParams.set("error", error);
-		url.searchParams.set("error_description", description);
-		return url.toString();
+		return parseURL(name, endpoint).toString();
 	} catch {
-		const hashIdx = base.indexOf("#");
-		const path = hashIdx >= 0 ? base.slice(0, hashIdx) : base;
-		const hash = hashIdx >= 0 ? base.slice(hashIdx + 1) : void 0;
-		return `${path}${path.includes("?") ? "&" : "?"}${`error=${encodeURIComponent(error)}&error_description=${encodeURIComponent(description)}`}${hash ? `#${hash}` : ""}`;
+		const issuerURL = parseURL(name, issuer);
+		const basePath = issuerURL.pathname.replace(/\/+$/, "");
+		const endpointPath = endpoint.replace(/^\/+/, "");
+		return parseURL(name, basePath + "/" + endpointPath, issuerURL.origin).toString();
 	}
 }
 /**
-* Validates the InResponseTo attribute of a SAML Response.
-*
-* This binds the IdP's Response to a specific SP-initiated AuthnRequest,
-* preventing replay attacks, unsolicited response injection, and
-* cross-provider assertion swaps.
+* Parses the given URL or throws in case of invalid or unsupported protocols
 *
-* The InResponseTo value lives at `extract.response.inResponseTo` in
-* samlify's parsed output (not at the top level).
+* @param name the url name
+* @param endpoint the endpoint url
+* @param [base] optional base path
+* @returns
 */
-async function validateInResponseTo(c, ctx) {
-	if (ctx.options.enableInResponseToValidation === false) return;
-	const inResponseTo = ctx.extract.response?.inResponseTo;
-	const allowIdpInitiated = ctx.options.allowIdpInitiated ?? false;
-	if (inResponseTo) {
-		let storedRequest = null;
-		const verification = await c.context.internalAdapter.findVerificationValue(`${AUTHN_REQUEST_KEY_PREFIX}${inResponseTo}`);
-		if (verification) try {
-			storedRequest = JSON.parse(verification.value);
-			if (storedRequest && storedRequest.expiresAt < Date.now()) storedRequest = null;
-		} catch {
-			storedRequest = null;
-		}
-		if (!storedRequest) {
-			c.context.logger.error("SAML InResponseTo validation failed: unknown or expired request ID", {
-				inResponseTo,
-				providerId: ctx.providerId
-			});
-			throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "invalid_saml_response", "Unknown or expired request ID"));
-		}
-		if (storedRequest.providerId !== ctx.providerId) {
-			c.context.logger.error("SAML InResponseTo validation failed: provider mismatch", {
-				inResponseTo,
-				expectedProvider: storedRequest.providerId,
-				actualProvider: ctx.providerId
-			});
-			await c.context.internalAdapter.deleteVerificationByIdentifier(`${AUTHN_REQUEST_KEY_PREFIX}${inResponseTo}`);
-			throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "invalid_saml_response", "Provider mismatch"));
-		}
-		await c.context.internalAdapter.deleteVerificationByIdentifier(`${AUTHN_REQUEST_KEY_PREFIX}${inResponseTo}`);
-	} else if (!allowIdpInitiated) {
-		c.context.logger.error("SAML IdP-initiated SSO rejected: InResponseTo missing and allowIdpInitiated is false", { providerId: ctx.providerId });
-		throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "unsolicited_response", "IdP-initiated SSO not allowed"));
+function parseURL(name, endpoint, base) {
+	let endpointURL;
+	try {
+		endpointURL = new URL(endpoint, base);
+		if (endpointURL.protocol === "http:" || endpointURL.protocol === "https:") return endpointURL;
+	} catch (error) {
+		throw new DiscoveryError("discovery_invalid_url", `The url "${name}" must be valid: ${endpoint}`, { url: endpoint }, { cause: error });
 	}
+	throw new DiscoveryError("discovery_invalid_url", `The url "${name}" must use the http or https supported protocols: ${endpoint}`, {
+		url: endpoint,
+		protocol: endpointURL.protocol
+	});
 }
 /**
-* Validates the AudienceRestriction of a SAML assertion.
+* Select the token endpoint authentication method.
 *
-* Per SAML 2.0 Core §2.5.1, an assertion's Audience element specifies
-* the intended recipient SP. Without this check, an assertion issued
-* for a different SP (e.g., another application sharing the same IdP)
-* could be accepted.
+* @param doc - The discovery document
+* @param existing - Existing authentication method from config
+* @returns The selected authentication method
 */
-function validateAudience(c, ctx) {
-	if (!ctx.expectedAudience) return;
-	const audience = ctx.extract.audience;
-	if (!audience) {
-		c.context.logger.error("SAML assertion missing AudienceRestriction but audience is configured — rejecting", { providerId: ctx.providerId });
-		throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "invalid_saml_response", "Audience restriction missing"));
-	}
-	const audiences = Array.isArray(audience) ? audience : [audience];
-	if (!audiences.includes(ctx.expectedAudience)) {
-		c.context.logger.error("SAML audience mismatch: assertion was issued for a different service provider", {
-			expected: ctx.expectedAudience,
-			received: audiences,
-			providerId: ctx.providerId
+function selectTokenEndpointAuthMethod(doc, existing) {
+	if (existing === "private_key_jwt") return existing;
+	if (existing) return existing;
+	const supported = doc.token_endpoint_auth_methods_supported;
+	if (!supported || supported.length === 0) return "client_secret_basic";
+	if (supported.includes("client_secret_basic")) return "client_secret_basic";
+	if (supported.includes("client_secret_post")) return "client_secret_post";
+	if (supported.includes("private_key_jwt")) return "private_key_jwt";
+	return "client_secret_basic";
+}
+/**
+* Check if a provider configuration needs runtime discovery.
+*
+* Returns true if we need discovery at runtime to complete the token exchange
+* and validation. Specifically checks for:
+* - `tokenEndpoint` - required for exchanging authorization code for tokens
+* - `jwksEndpoint` - required for validating ID token signatures
+* - `authorizationEndpoint` - required for redirecting users to the IdP for login
+*
+* @param config - Partial OIDC config from the provider
+* @returns true if runtime discovery should be performed
+*/
+function needsRuntimeDiscovery(config) {
+	if (!config) return true;
+	return !config.tokenEndpoint || !config.jwksEndpoint || !config.authorizationEndpoint;
+}
+/**
+* Runs runtime OIDC discovery when the stored config is missing required
+* endpoints, and merges the hydrated fields back into the config.
+* Throws if discovery fails.
+*/
+async function ensureRuntimeDiscovery(config, issuer, isTrustedOrigin) {
+	let resolved = config;
+	if (needsRuntimeDiscovery(config)) {
+		const hydrated = await discoverOIDCConfig({
+			issuer,
+			existingConfig: config,
+			isTrustedOrigin
 		});
-		throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "invalid_saml_response", "Audience mismatch"));
+		resolved = {
+			...config,
+			authorizationEndpoint: hydrated.authorizationEndpoint,
+			tokenEndpoint: hydrated.tokenEndpoint,
+			tokenEndpointAuthentication: hydrated.tokenEndpointAuthentication,
+			userInfoEndpoint: hydrated.userInfoEndpoint,
+			jwksEndpoint: hydrated.jwksEndpoint
+		};
 	}
+	await assertServerFetchedOIDCEndpointsAllowed(resolved, isTrustedOrigin);
+	return resolved;
 }
 //#endregion
-//#region src/routes/schemas.ts
-const oidcMappingSchema = z.object({
-	id: z.string().optional(),
-	email: z.string().optional(),
-	emailVerified: z.string().optional(),
-	name: z.string().optional(),
-	image: z.string().optional(),
-	extraFields: z.record(z.string(), z.any()).optional()
-}).optional();
-const samlMappingSchema = z.object({
-	id: z.string().optional(),
-	email: z.string().optional(),
-	emailVerified: z.string().optional(),
-	name: z.string().optional(),
-	firstName: z.string().optional(),
-	lastName: z.string().optional(),
-	extraFields: z.record(z.string(), z.any()).optional()
-}).optional();
-const oidcConfigSchema = z.object({
-	clientId: z.string().optional(),
-	clientSecret: z.string().optional(),
-	authorizationEndpoint: z.string().url().optional(),
-	tokenEndpoint: z.string().url().optional(),
-	userInfoEndpoint: z.string().url().optional(),
-	tokenEndpointAuthentication: z.enum([
-		"client_secret_post",
-		"client_secret_basic",
-		"private_key_jwt"
-	]).optional(),
-	privateKeyId: z.string().optional(),
-	privateKeyAlgorithm: z.string().optional(),
-	jwksEndpoint: z.string().url().optional(),
-	discoveryEndpoint: z.string().url().optional(),
-	scopes: z.array(z.string()).optional(),
-	pkce: z.boolean().optional(),
-	overrideUserInfo: z.boolean().optional(),
-	mapping: oidcMappingSchema
-});
-const samlConfigSchema = z.object({
-	entryPoint: z.string().url().optional(),
-	cert: z.string().optional(),
-	callbackUrl: z.string().url().optional(),
-	audience: z.string().optional(),
-	idpMetadata: z.object({
-		metadata: z.string().optional(),
-		entityID: z.string().optional(),
-		cert: z.string().optional(),
-		privateKey: z.string().optional(),
-		privateKeyPass: z.string().optional(),
-		isAssertionEncrypted: z.boolean().optional(),
-		encPrivateKey: z.string().optional(),
-		encPrivateKeyPass: z.string().optional(),
-		singleSignOnService: z.array(z.object({
-			Binding: z.string(),
-			Location: z.string().url()
-		})).optional()
-	}).optional(),
-	spMetadata: z.object({
-		metadata: z.string().optional(),
-		entityID: z.string().optional(),
-		binding: z.string().optional(),
-		privateKey: z.string().optional(),
-		privateKeyPass: z.string().optional(),
-		isAssertionEncrypted: z.boolean().optional(),
-		encPrivateKey: z.string().optional(),
-		encPrivateKeyPass: z.string().optional()
-	}).optional(),
-	wantAssertionsSigned: z.boolean().optional(),
-	authnRequestsSigned: z.boolean().optional(),
-	signatureAlgorithm: z.string().optional(),
-	digestAlgorithm: z.string().optional(),
-	identifierFormat: z.string().optional(),
-	privateKey: z.string().optional(),
-	decryptionPvk: z.string().optional(),
-	additionalParams: z.record(z.string(), z.any()).optional(),
-	mapping: samlMappingSchema
-});
-const updateSSOProviderBodySchema = z.object({
-	issuer: z.string().url().optional(),
-	domain: z.string().optional(),
-	oidcConfig: oidcConfigSchema.optional(),
-	samlConfig: samlConfigSchema.optional()
+//#region src/oidc/errors.ts
+/**
+* OIDC Discovery Error Mapping
+*
+* Maps DiscoveryError codes to appropriate APIError responses.
+* Used at the boundary between the discovery pipeline and HTTP handlers.
+*/
+/**
+* Maps a DiscoveryError to an appropriate APIError for HTTP responses.
+*
+* Error code mapping:
+* - discovery_invalid_url        → 400 BAD_REQUEST
+* - discovery_not_found          → 400 BAD_REQUEST
+* - discovery_untrusted_origin   → 400 BAD_REQUEST
+* - discovery_private_host       → 400 BAD_REQUEST
+* - oidc_endpoint_redirect       → 400 BAD_REQUEST
+* - discovery_invalid_json       → 400 BAD_REQUEST
+* - discovery_incomplete         → 400 BAD_REQUEST
+* - issuer_mismatch              → 400 BAD_REQUEST
+* - unsupported_token_auth_method → 400 BAD_REQUEST
+* - discovery_timeout            → 502 BAD_GATEWAY
+* - discovery_unexpected_error   → 502 BAD_GATEWAY
+*
+* @param error - The DiscoveryError to map
+* @returns An APIError with appropriate status and message
+*/
+function mapDiscoveryErrorToAPIError(error) {
+	switch (error.code) {
+		case "discovery_timeout": return new APIError("BAD_GATEWAY", {
+			message: `OIDC discovery timed out: ${error.message}`,
+			code: error.code
+		});
+		case "discovery_unexpected_error": return new APIError("BAD_GATEWAY", {
+			message: `OIDC discovery failed: ${error.message}`,
+			code: error.code
+		});
+		case "discovery_not_found": return new APIError("BAD_REQUEST", {
+			message: `OIDC discovery endpoint not found. The issuer may not support OIDC discovery, or the URL is incorrect. ${error.message}`,
+			code: error.code
+		});
+		case "discovery_invalid_url": return new APIError("BAD_REQUEST", {
+			message: `Invalid OIDC endpoint URL: ${error.message}`,
+			code: error.code
+		});
+		case "discovery_untrusted_origin": return new APIError("BAD_REQUEST", {
+			message: `Untrusted OIDC discovery URL: ${error.message}`,
+			code: error.code
+		});
+		case "discovery_private_host": return new APIError("BAD_REQUEST", {
+			message: error.message,
+			code: error.code
+		});
+		case "oidc_endpoint_redirect": return new APIError("BAD_REQUEST", {
+			message: error.message,
+			code: error.code
+		});
+		case "discovery_invalid_json": return new APIError("BAD_REQUEST", {
+			message: `OIDC discovery returned invalid data: ${error.message}`,
+			code: error.code
+		});
+		case "discovery_incomplete": return new APIError("BAD_REQUEST", {
+			message: `OIDC discovery document is missing required fields: ${error.message}`,
+			code: error.code
+		});
+		case "issuer_mismatch": return new APIError("BAD_REQUEST", {
+			message: `OIDC issuer mismatch: ${error.message}`,
+			code: error.code
+		});
+		case "unsupported_token_auth_method": return new APIError("BAD_REQUEST", {
+			message: `Incompatible OIDC provider: ${error.message}`,
+			code: error.code
+		});
+		default:
+			error.code;
+			return new APIError("INTERNAL_SERVER_ERROR", {
+				message: `Unexpected discovery error: ${error.message}`,
+				code: "discovery_unexpected_error"
+			});
+	}
+}
+//#endregion
+//#region src/saml/parser.ts
+const xmlParser = new XMLParser({
+	ignoreAttributes: false,
+	attributeNamePrefix: "@_",
+	removeNSPrefix: true,
+	processEntities: false
 });
+function findNode(obj, nodeName) {
+	if (!obj || typeof obj !== "object") return null;
+	const record = obj;
+	if (nodeName in record) return record[nodeName];
+	for (const value of Object.values(record)) if (Array.isArray(value)) for (const item of value) {
+		const found = findNode(item, nodeName);
+		if (found) return found;
+	}
+	else if (typeof value === "object" && value !== null) {
+		const found = findNode(value, nodeName);
+		if (found) return found;
+	}
+	return null;
+}
+function countAllNodes(obj, nodeName) {
+	if (!obj || typeof obj !== "object") return 0;
+	let count = 0;
+	const record = obj;
+	if (nodeName in record) {
+		const node = record[nodeName];
+		count += Array.isArray(node) ? node.length : 1;
+	}
+	for (const value of Object.values(record)) if (Array.isArray(value)) for (const item of value) count += countAllNodes(item, nodeName);
+	else if (typeof value === "object" && value !== null) count += countAllNodes(value, nodeName);
+	return count;
+}
 //#endregion
-//#region src/routes/providers.ts
-const ADMIN_ROLES = ["owner", "admin"];
-async function isOrgAdmin(ctx, userId, organizationId) {
-	const member = await ctx.context.adapter.findOne({
-		model: "member",
-		where: [{
-			field: "userId",
-			value: userId
-		}, {
-			field: "organizationId",
-			value: organizationId
-		}]
-	});
-	if (!member) return false;
-	return member.role.split(",").some((r) => ADMIN_ROLES.includes(r.trim()));
+//#region src/saml/algorithms.ts
+const SignatureAlgorithm = {
+	RSA_SHA1: "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
+	RSA_SHA256: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+	RSA_SHA384: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384",
+	RSA_SHA512: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512",
+	ECDSA_SHA256: "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256",
+	ECDSA_SHA384: "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384",
+	ECDSA_SHA512: "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"
+};
+const DigestAlgorithm = {
+	SHA1: "http://www.w3.org/2000/09/xmldsig#sha1",
+	SHA256: "http://www.w3.org/2001/04/xmlenc#sha256",
+	SHA384: "http://www.w3.org/2001/04/xmldsig-more#sha384",
+	SHA512: "http://www.w3.org/2001/04/xmlenc#sha512"
+};
+const KeyEncryptionAlgorithm = {
+	RSA_1_5: "http://www.w3.org/2001/04/xmlenc#rsa-1_5",
+	RSA_OAEP: "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p",
+	RSA_OAEP_SHA256: "http://www.w3.org/2009/xmlenc11#rsa-oaep"
+};
+const DataEncryptionAlgorithm = {
+	TRIPLEDES_CBC: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc",
+	AES_128_CBC: "http://www.w3.org/2001/04/xmlenc#aes128-cbc",
+	AES_192_CBC: "http://www.w3.org/2001/04/xmlenc#aes192-cbc",
+	AES_256_CBC: "http://www.w3.org/2001/04/xmlenc#aes256-cbc",
+	AES_128_GCM: "http://www.w3.org/2009/xmlenc11#aes128-gcm",
+	AES_192_GCM: "http://www.w3.org/2009/xmlenc11#aes192-gcm",
+	AES_256_GCM: "http://www.w3.org/2009/xmlenc11#aes256-gcm"
+};
+const DEPRECATED_SIGNATURE_ALGORITHMS = [SignatureAlgorithm.RSA_SHA1];
+const DEPRECATED_KEY_ENCRYPTION_ALGORITHMS = [KeyEncryptionAlgorithm.RSA_1_5];
+const DEPRECATED_DATA_ENCRYPTION_ALGORITHMS = [DataEncryptionAlgorithm.TRIPLEDES_CBC];
+const DEPRECATED_DIGEST_ALGORITHMS = [DigestAlgorithm.SHA1];
+const SECURE_SIGNATURE_ALGORITHMS = [
+	SignatureAlgorithm.RSA_SHA256,
+	SignatureAlgorithm.RSA_SHA384,
+	SignatureAlgorithm.RSA_SHA512,
+	SignatureAlgorithm.ECDSA_SHA256,
+	SignatureAlgorithm.ECDSA_SHA384,
+	SignatureAlgorithm.ECDSA_SHA512
+];
+const SECURE_DIGEST_ALGORITHMS = [
+	DigestAlgorithm.SHA256,
+	DigestAlgorithm.SHA384,
+	DigestAlgorithm.SHA512
+];
+const SHORT_FORM_SIGNATURE_TO_URI = {
+	sha1: SignatureAlgorithm.RSA_SHA1,
+	sha256: SignatureAlgorithm.RSA_SHA256,
+	sha384: SignatureAlgorithm.RSA_SHA384,
+	sha512: SignatureAlgorithm.RSA_SHA512,
+	"rsa-sha1": SignatureAlgorithm.RSA_SHA1,
+	"rsa-sha256": SignatureAlgorithm.RSA_SHA256,
+	"rsa-sha384": SignatureAlgorithm.RSA_SHA384,
+	"rsa-sha512": SignatureAlgorithm.RSA_SHA512,
+	"ecdsa-sha256": SignatureAlgorithm.ECDSA_SHA256,
+	"ecdsa-sha384": SignatureAlgorithm.ECDSA_SHA384,
+	"ecdsa-sha512": SignatureAlgorithm.ECDSA_SHA512
+};
+const SHORT_FORM_DIGEST_TO_URI = {
+	sha1: DigestAlgorithm.SHA1,
+	sha256: DigestAlgorithm.SHA256,
+	sha384: DigestAlgorithm.SHA384,
+	sha512: DigestAlgorithm.SHA512
+};
+function normalizeSignatureAlgorithm(alg) {
+	return SHORT_FORM_SIGNATURE_TO_URI[alg.toLowerCase()] ?? alg;
 }
-async function batchCheckOrgAdmin(ctx, userId, organizationIds) {
-	if (organizationIds.length === 0) return /* @__PURE__ */ new Set();
-	const members = await ctx.context.adapter.findMany({
-		model: "member",
-		where: [{
-			field: "userId",
-			value: userId
-		}, {
-			field: "organizationId",
-			value: organizationIds,
-			operator: "in"
-		}]
-	});
-	const adminOrgIds = /* @__PURE__ */ new Set();
-	for (const member of members) if (member.role.split(",").some((r) => ADMIN_ROLES.includes(r.trim()))) adminOrgIds.add(member.organizationId);
-	return adminOrgIds;
+function normalizeDigestAlgorithm(alg) {
+	return SHORT_FORM_DIGEST_TO_URI[alg.toLowerCase()] ?? alg;
 }
-function sanitizeProvider(provider, baseURL) {
-	let oidcConfig = null;
-	let samlConfig = null;
+function extractEncryptionAlgorithms(xml) {
 	try {
-		oidcConfig = safeJsonParse(provider.oidcConfig);
+		const parsed = xmlParser.parse(xml);
+		const keyAlg = (findNode(parsed, "EncryptedKey")?.EncryptionMethod)?.["@_Algorithm"];
+		const dataAlg = (findNode(parsed, "EncryptedData")?.EncryptionMethod)?.["@_Algorithm"];
+		return {
+			keyEncryption: keyAlg || null,
+			dataEncryption: dataAlg || null
+		};
 	} catch {
-		oidcConfig = null;
+		return {
+			keyEncryption: null,
+			dataEncryption: null
+		};
 	}
+}
+function hasEncryptedAssertion(xml) {
 	try {
-		samlConfig = safeJsonParse(provider.samlConfig);
+		return findNode(xmlParser.parse(xml), "EncryptedAssertion") !== null;
 	} catch {
-		samlConfig = null;
+		return false;
 	}
-	const type = samlConfig ? "saml" : "oidc";
-	return {
-		providerId: provider.providerId,
-		type,
-		issuer: provider.issuer,
-		domain: provider.domain,
-		organizationId: provider.organizationId || null,
-		domainVerified: provider.domainVerified ?? false,
-		oidcConfig: oidcConfig ? {
-			discoveryEndpoint: oidcConfig.discoveryEndpoint,
-			clientIdLastFour: maskClientId(oidcConfig.clientId),
-			pkce: oidcConfig.pkce,
-			authorizationEndpoint: oidcConfig.authorizationEndpoint,
-			tokenEndpoint: oidcConfig.tokenEndpoint,
-			userInfoEndpoint: oidcConfig.userInfoEndpoint,
-			jwksEndpoint: oidcConfig.jwksEndpoint,
-			scopes: oidcConfig.scopes,
-			tokenEndpointAuthentication: oidcConfig.tokenEndpointAuthentication
-		} : void 0,
-		samlConfig: samlConfig ? {
-			entryPoint: samlConfig.entryPoint,
-			callbackUrl: samlConfig.callbackUrl,
-			audience: samlConfig.audience,
-			wantAssertionsSigned: samlConfig.wantAssertionsSigned,
-			authnRequestsSigned: samlConfig.authnRequestsSigned,
-			identifierFormat: samlConfig.identifierFormat,
-			signatureAlgorithm: samlConfig.signatureAlgorithm,
-			digestAlgorithm: samlConfig.digestAlgorithm,
-			certificate: (() => {
-				try {
-					return parseCertificate(samlConfig.cert);
-				} catch {
-					return { error: "Failed to parse certificate" };
-				}
-			})()
-		} : void 0,
-		spMetadataUrl: `${baseURL}/sso/saml2/sp/metadata?providerId=${encodeURIComponent(provider.providerId)}`
-	};
 }
-const listSSOProviders = () => {
-	return createAuthEndpoint("/sso/providers", {
-		method: "GET",
-		use: [sessionMiddleware],
-		metadata: { openapi: {
-			operationId: "listSSOProviders",
-			summary: "List SSO providers",
-			description: "Returns a list of SSO providers the user has access to",
-			responses: { "200": { description: "List of SSO providers" } }
-		} }
-	}, async (ctx) => {
-		const userId = ctx.context.session.user.id;
-		const allProviders = await ctx.context.adapter.findMany({ model: "ssoProvider" });
-		const userOwnedProviders = allProviders.filter((p) => p.userId === userId && !p.organizationId);
-		const orgProviders = allProviders.filter((p) => p.organizationId !== null && p.organizationId !== void 0);
-		const orgPluginEnabled = ctx.context.hasPlugin("organization");
-		let accessibleProviders = [...userOwnedProviders];
-		if (orgPluginEnabled && orgProviders.length > 0) {
-			const adminOrgIds = await batchCheckOrgAdmin(ctx, userId, [...new Set(orgProviders.map((p) => p.organizationId).filter((id) => id !== null && id !== void 0))]);
-			const orgAccessibleProviders = orgProviders.filter((provider) => provider.organizationId && adminOrgIds.has(provider.organizationId));
-			accessibleProviders = [...accessibleProviders, ...orgAccessibleProviders];
-		} else if (!orgPluginEnabled) {
-			const userOwnedOrgProviders = orgProviders.filter((p) => p.userId === userId);
-			accessibleProviders = [...accessibleProviders, ...userOwnedOrgProviders];
-		}
-		const providers = accessibleProviders.map((p) => sanitizeProvider(p, ctx.context.baseURL));
-		return ctx.json({ providers });
-	});
-};
-const getSSOProviderQuerySchema = z.object({ providerId: z.string() });
-async function checkProviderAccess(ctx, providerId) {
-	const userId = ctx.context.session.user.id;
-	const provider = await ctx.context.adapter.findOne({
-		model: "ssoProvider",
-		where: [{
-			field: "providerId",
-			value: providerId
-		}]
-	});
-	if (!provider) throw new APIError("NOT_FOUND", { message: "Provider not found" });
-	let hasAccess = false;
-	if (provider.organizationId) if (ctx.context.hasPlugin("organization")) hasAccess = await isOrgAdmin(ctx, userId, provider.organizationId);
-	else hasAccess = provider.userId === userId;
-	else hasAccess = provider.userId === userId;
-	if (!hasAccess) throw new APIError("FORBIDDEN", { message: "You don't have access to this provider" });
-	return provider;
+function handleDeprecatedAlgorithm(message, behavior, errorCode) {
+	switch (behavior) {
+		case "reject": throw new APIError("BAD_REQUEST", {
+			message,
+			code: errorCode
+		});
+		case "warn":
+			console.warn(`[SAML Security Warning] ${message}`);
+			break;
+		case "allow": break;
+	}
 }
-const getSSOProvider = () => {
-	return createAuthEndpoint("/sso/get-provider", {
-		method: "GET",
-		use: [sessionMiddleware],
-		query: getSSOProviderQuerySchema,
-		metadata: { openapi: {
-			operationId: "getSSOProvider",
-			summary: "Get SSO provider details",
-			description: "Returns sanitized details for a specific SSO provider",
-			responses: {
-				"200": { description: "SSO provider details" },
-				"404": { description: "Provider not found" },
-				"403": { description: "Access denied" }
-			}
-		} }
-	}, async (ctx) => {
-		const { providerId } = ctx.query;
-		const provider = await checkProviderAccess(ctx, providerId);
-		return ctx.json(sanitizeProvider(provider, ctx.context.baseURL));
+function validateSignatureAlgorithm(algorithm, options = {}) {
+	if (!algorithm) return;
+	const { onDeprecated = "warn", allowedSignatureAlgorithms } = options;
+	if (allowedSignatureAlgorithms) {
+		if (!allowedSignatureAlgorithms.includes(algorithm)) throw new APIError("BAD_REQUEST", {
+			message: `SAML signature algorithm not in allow-list: ${algorithm}`,
+			code: "SAML_ALGORITHM_NOT_ALLOWED"
+		});
+		return;
+	}
+	if (DEPRECATED_SIGNATURE_ALGORITHMS.includes(algorithm)) {
+		handleDeprecatedAlgorithm(`SAML response uses deprecated signature algorithm: ${algorithm}. Please configure your IdP to use SHA-256 or stronger.`, onDeprecated, "SAML_DEPRECATED_ALGORITHM");
+		return;
+	}
+	if (!SECURE_SIGNATURE_ALGORITHMS.includes(algorithm)) throw new APIError("BAD_REQUEST", {
+		message: `SAML signature algorithm not recognized: ${algorithm}`,
+		code: "SAML_UNKNOWN_ALGORITHM"
 	});
-};
-function parseAndValidateConfig(configString, configType) {
-	let config = null;
-	try {
-		config = safeJsonParse(configString);
-	} catch {
-		config = null;
+}
+function validateEncryptionAlgorithms(algorithms, options = {}) {
+	const { onDeprecated = "warn", allowedKeyEncryptionAlgorithms, allowedDataEncryptionAlgorithms } = options;
+	const { keyEncryption, dataEncryption } = algorithms;
+	if (keyEncryption) {
+		if (allowedKeyEncryptionAlgorithms) {
+			if (!allowedKeyEncryptionAlgorithms.includes(keyEncryption)) throw new APIError("BAD_REQUEST", {
+				message: `SAML key encryption algorithm not in allow-list: ${keyEncryption}`,
+				code: "SAML_ALGORITHM_NOT_ALLOWED"
+			});
+		} else if (DEPRECATED_KEY_ENCRYPTION_ALGORITHMS.includes(keyEncryption)) handleDeprecatedAlgorithm(`SAML response uses deprecated key encryption algorithm: ${keyEncryption}. Please configure your IdP to use RSA-OAEP.`, onDeprecated, "SAML_DEPRECATED_ALGORITHM");
+	}
+	if (dataEncryption) {
+		if (allowedDataEncryptionAlgorithms) {
+			if (!allowedDataEncryptionAlgorithms.includes(dataEncryption)) throw new APIError("BAD_REQUEST", {
+				message: `SAML data encryption algorithm not in allow-list: ${dataEncryption}`,
+				code: "SAML_ALGORITHM_NOT_ALLOWED"
+			});
+		} else if (DEPRECATED_DATA_ENCRYPTION_ALGORITHMS.includes(dataEncryption)) handleDeprecatedAlgorithm(`SAML response uses deprecated data encryption algorithm: ${dataEncryption}. Please configure your IdP to use AES-GCM.`, onDeprecated, "SAML_DEPRECATED_ALGORITHM");
 	}
-	if (!config) throw new APIError("BAD_REQUEST", { message: `Cannot update ${configType} config for a provider that doesn't have ${configType} configured` });
-	return config;
 }
-function mergeSAMLConfig(current, updates, issuer) {
-	return {
-		...current,
-		...updates,
-		issuer,
-		entryPoint: updates.entryPoint ?? current.entryPoint,
-		cert: updates.cert ?? current.cert,
-		callbackUrl: updates.callbackUrl ?? current.callbackUrl,
-		spMetadata: updates.spMetadata ?? current.spMetadata,
-		idpMetadata: updates.idpMetadata ?? current.idpMetadata,
-		mapping: updates.mapping ?? current.mapping,
-		audience: updates.audience ?? current.audience,
-		wantAssertionsSigned: updates.wantAssertionsSigned ?? current.wantAssertionsSigned,
-		authnRequestsSigned: updates.authnRequestsSigned ?? current.authnRequestsSigned,
-		identifierFormat: updates.identifierFormat ?? current.identifierFormat,
-		signatureAlgorithm: updates.signatureAlgorithm ?? current.signatureAlgorithm,
-		digestAlgorithm: updates.digestAlgorithm ?? current.digestAlgorithm
-	};
+function validateSAMLAlgorithms(response, options) {
+	validateSignatureAlgorithm(response.sigAlg, options);
+	if (hasEncryptedAssertion(response.samlContent)) validateEncryptionAlgorithms(extractEncryptionAlgorithms(response.samlContent), options);
+}
+function validateConfigAlgorithms(config, options = {}) {
+	const { onDeprecated = "warn", allowedSignatureAlgorithms, allowedDigestAlgorithms } = options;
+	if (config.signatureAlgorithm) {
+		const normalized = normalizeSignatureAlgorithm(config.signatureAlgorithm);
+		if (allowedSignatureAlgorithms) {
+			if (!allowedSignatureAlgorithms.map(normalizeSignatureAlgorithm).includes(normalized)) throw new APIError("BAD_REQUEST", {
+				message: `SAML signature algorithm not in allow-list: ${config.signatureAlgorithm}`,
+				code: "SAML_ALGORITHM_NOT_ALLOWED"
+			});
+		} else if (DEPRECATED_SIGNATURE_ALGORITHMS.includes(normalized)) handleDeprecatedAlgorithm(`SAML config uses deprecated signature algorithm: ${config.signatureAlgorithm}. Consider using SHA-256 or stronger.`, onDeprecated, "SAML_DEPRECATED_CONFIG_ALGORITHM");
+		else if (!SECURE_SIGNATURE_ALGORITHMS.includes(normalized)) throw new APIError("BAD_REQUEST", {
+			message: `SAML signature algorithm not recognized: ${config.signatureAlgorithm}`,
+			code: "SAML_UNKNOWN_ALGORITHM"
+		});
+	}
+	if (config.digestAlgorithm) {
+		const normalized = normalizeDigestAlgorithm(config.digestAlgorithm);
+		if (allowedDigestAlgorithms) {
+			if (!allowedDigestAlgorithms.map(normalizeDigestAlgorithm).includes(normalized)) throw new APIError("BAD_REQUEST", {
+				message: `SAML digest algorithm not in allow-list: ${config.digestAlgorithm}`,
+				code: "SAML_ALGORITHM_NOT_ALLOWED"
+			});
+		} else if (DEPRECATED_DIGEST_ALGORITHMS.includes(normalized)) handleDeprecatedAlgorithm(`SAML config uses deprecated digest algorithm: ${config.digestAlgorithm}. Consider using SHA-256 or stronger.`, onDeprecated, "SAML_DEPRECATED_CONFIG_ALGORITHM");
+		else if (!SECURE_DIGEST_ALGORITHMS.includes(normalized)) throw new APIError("BAD_REQUEST", {
+			message: `SAML digest algorithm not recognized: ${config.digestAlgorithm}`,
+			code: "SAML_UNKNOWN_ALGORITHM"
+		});
+	}
 }
-function mergeOIDCConfig(current, updates, issuer) {
+//#endregion
+//#region src/saml/assertions.ts
+function countAssertions(xml) {
+	let parsed;
+	try {
+		parsed = xmlParser.parse(xml);
+	} catch {
+		throw new APIError("BAD_REQUEST", {
+			message: "Failed to parse SAML response XML",
+			code: "SAML_INVALID_XML"
+		});
+	}
+	const assertions = countAllNodes(parsed, "Assertion");
+	const encryptedAssertions = countAllNodes(parsed, "EncryptedAssertion");
 	return {
-		...current,
-		...updates,
-		issuer,
-		pkce: updates.pkce ?? current.pkce ?? true,
-		clientId: updates.clientId ?? current.clientId,
-		clientSecret: updates.clientSecret ?? current.clientSecret,
-		discoveryEndpoint: updates.discoveryEndpoint ?? current.discoveryEndpoint,
-		mapping: updates.mapping ?? current.mapping,
-		scopes: updates.scopes ?? current.scopes,
-		authorizationEndpoint: updates.authorizationEndpoint ?? current.authorizationEndpoint,
-		tokenEndpoint: updates.tokenEndpoint ?? current.tokenEndpoint,
-		userInfoEndpoint: updates.userInfoEndpoint ?? current.userInfoEndpoint,
-		jwksEndpoint: updates.jwksEndpoint ?? current.jwksEndpoint,
-		tokenEndpointAuthentication: updates.tokenEndpointAuthentication ?? current.tokenEndpointAuthentication,
-		privateKeyId: updates.privateKeyId ?? current.privateKeyId,
-		privateKeyAlgorithm: updates.privateKeyAlgorithm ?? current.privateKeyAlgorithm
+		assertions,
+		encryptedAssertions,
+		total: assertions + encryptedAssertions
 	};
 }
-const updateSSOProvider = (options) => {
-	return createAuthEndpoint("/sso/update-provider", {
-		method: "POST",
-		use: [sessionMiddleware],
-		body: updateSSOProviderBodySchema.extend({ providerId: z.string() }),
-		metadata: { openapi: {
-			operationId: "updateSSOProvider",
-			summary: "Update SSO provider",
-			description: "Partially update an SSO provider. Only provided fields are updated. If domain changes, domainVerified is reset to false.",
-			responses: {
-				"200": { description: "SSO provider updated successfully" },
-				"404": { description: "Provider not found" },
-				"403": { description: "Access denied" }
-			}
-		} }
-	}, async (ctx) => {
-		const { providerId, ...body } = ctx.body;
-		const { issuer, domain, samlConfig, oidcConfig } = body;
-		if (!issuer && !domain && !samlConfig && !oidcConfig) throw new APIError("BAD_REQUEST", { message: "No fields provided for update" });
-		const existingProvider = await checkProviderAccess(ctx, providerId);
-		const updateData = {};
-		if (body.issuer !== void 0) updateData.issuer = body.issuer;
-		if (body.domain !== void 0) {
-			updateData.domain = body.domain;
-			if (body.domain !== existingProvider.domain) updateData.domainVerified = false;
-		}
-		if (body.samlConfig) {
-			if (body.samlConfig.idpMetadata?.metadata) {
-				const maxMetadataSize = options?.saml?.maxMetadataSize ?? 102400;
-				if (new TextEncoder().encode(body.samlConfig.idpMetadata.metadata).length > maxMetadataSize) throw new APIError("BAD_REQUEST", { message: `IdP metadata exceeds maximum allowed size (${maxMetadataSize} bytes)` });
-			}
-			if (body.samlConfig.signatureAlgorithm !== void 0 || body.samlConfig.digestAlgorithm !== void 0) validateConfigAlgorithms({
-				signatureAlgorithm: body.samlConfig.signatureAlgorithm,
-				digestAlgorithm: body.samlConfig.digestAlgorithm
-			}, options?.saml?.algorithms);
-			const currentSamlConfig = parseAndValidateConfig(existingProvider.samlConfig, "SAML");
-			const updatedSamlConfig = mergeSAMLConfig(currentSamlConfig, body.samlConfig, updateData.issuer || currentSamlConfig.issuer || existingProvider.issuer);
-			updateData.samlConfig = JSON.stringify(updatedSamlConfig);
-		}
-		if (body.oidcConfig) {
-			const currentOidcConfig = parseAndValidateConfig(existingProvider.oidcConfig, "OIDC");
-			const updatedOidcConfig = mergeOIDCConfig(currentOidcConfig, body.oidcConfig, updateData.issuer || currentOidcConfig.issuer || existingProvider.issuer);
-			if (updatedOidcConfig.tokenEndpointAuthentication !== "private_key_jwt" && !updatedOidcConfig.clientSecret) throw new APIError("BAD_REQUEST", { message: "clientSecret is required when using client_secret_basic or client_secret_post authentication" });
-			if (updatedOidcConfig.tokenEndpointAuthentication === "private_key_jwt" && !options?.resolvePrivateKey && !options?.defaultSSO?.some((p) => p.providerId === providerId && "privateKey" in p && p.privateKey)) throw new APIError("BAD_REQUEST", { message: "private_key_jwt authentication requires either a resolvePrivateKey callback or a privateKey in defaultSSO" });
-			updateData.oidcConfig = JSON.stringify(updatedOidcConfig);
-		}
-		await ctx.context.adapter.update({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: providerId
-			}],
-			update: updateData
-		});
-		const fullProvider = await ctx.context.adapter.findOne({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: providerId
-			}]
+function validateSingleAssertion(samlResponse) {
+	let xml;
+	try {
+		xml = new TextDecoder().decode(base64.decode(samlResponse.replace(/\s+/g, "")));
+		if (!xml.includes("<")) throw new Error("Not XML");
+	} catch {
+		throw new APIError("BAD_REQUEST", {
+			message: "Invalid base64-encoded SAML response",
+			code: "SAML_INVALID_ENCODING"
 		});
-		if (!fullProvider) throw new APIError("NOT_FOUND", { message: "Provider not found after update" });
-		return ctx.json(sanitizeProvider(fullProvider, ctx.context.baseURL));
+	}
+	const counts = countAssertions(xml);
+	if (counts.total === 0) throw new APIError("BAD_REQUEST", {
+		message: "SAML response contains no assertions",
+		code: "SAML_NO_ASSERTION"
 	});
-};
-const deleteSSOProvider = () => {
-	return createAuthEndpoint("/sso/delete-provider", {
-		method: "POST",
-		use: [sessionMiddleware],
-		body: z.object({ providerId: z.string() }),
-		metadata: { openapi: {
-			operationId: "deleteSSOProvider",
-			summary: "Delete SSO provider",
-			description: "Deletes an SSO provider",
-			responses: {
-				"200": { description: "SSO provider deleted successfully" },
-				"404": { description: "Provider not found" },
-				"403": { description: "Access denied" }
-			}
-		} }
-	}, async (ctx) => {
-		const { providerId } = ctx.body;
-		await checkProviderAccess(ctx, providerId);
-		await ctx.context.adapter.delete({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: providerId
-			}]
-		});
-		return ctx.json({ success: true });
+	if (counts.total > 1) throw new APIError("BAD_REQUEST", {
+		message: `SAML response contains ${counts.total} assertions, expected exactly 1`,
+		code: "SAML_MULTIPLE_ASSERTIONS"
 	});
-};
+}
 //#endregion
-//#region src/oidc/types.ts
-/**
-* Custom error class for OIDC discovery failures.
-* Can be caught and mapped to APIError at the edge.
-*/
-var DiscoveryError = class DiscoveryError extends Error {
-	code;
-	details;
-	constructor(code, message, details, options) {
-		super(message, options);
-		this.name = "DiscoveryError";
-		this.code = code;
-		this.details = details;
-		if (Error.captureStackTrace) Error.captureStackTrace(this, DiscoveryError);
-	}
-};
-/**
-* Required fields that must be present in a valid discovery document.
-*/
-const REQUIRED_DISCOVERY_FIELDS = [
-	"issuer",
-	"authorization_endpoint",
-	"token_endpoint",
-	"jwks_uri"
-];
+//#region src/saml/error-codes.ts
+const SAML_ERROR_CODES = defineErrorCodes({
+	SINGLE_LOGOUT_NOT_ENABLED: "Single Logout is not enabled",
+	INVALID_LOGOUT_RESPONSE: "Invalid LogoutResponse",
+	INVALID_LOGOUT_REQUEST: "Invalid LogoutRequest",
+	LOGOUT_FAILED_AT_IDP: "Logout failed at IdP",
+	IDP_SLO_NOT_SUPPORTED: "IdP does not support Single Logout Service",
+	SAML_PROVIDER_NOT_FOUND: "SAML provider not found",
+	CERT_SOURCE_MISSING: "samlConfig requires either a signing certificate (cert or idpMetadata.cert) or an idpMetadata.metadata XML document."
+});
 //#endregion
-//#region src/oidc/discovery.ts
+//#region src/saml/cert.ts
 /**
-* OIDC Discovery Pipeline
-*
-* Implements OIDC discovery document fetching, validation, and hydration.
-* This module is used both at provider registration time (to persist validated config)
-* and at runtime (to hydrate legacy providers that are missing metadata).
-*
-* @see https://openid.net/specs/openid-connect-discovery-1_0.html
+* IdP signing-certificate rules for SAML configs. Centralized so the runtime
+* verification path (`createIdP`), the sanitizer (`getSSOProvider` and
+* friends), and the registration validator agree on precedence and the
+* "exactly one cert source" contract.
 */
-/** Default timeout for discovery requests (10 seconds) */
-const DEFAULT_DISCOVERY_TIMEOUT = 1e4;
 /**
-* Main entry point: Discover and hydrate OIDC configuration from an issuer.
-*
-* This function:
-* 1. Computes the discovery URL from the issuer
-* 2. Validates the discovery URL
-* 3. Fetches the discovery document
-* 4. Validates the discovery document (issuer match + required fields)
-* 5. Normalizes URLs
-* 6. Selects token endpoint auth method
-* 7. Merges with existing config (existing values take precedence)
-*
-* @param params - Discovery parameters
-* @param isTrustedOrigin - Origin verification tester function
-* @returns Hydrated OIDC configuration ready for persistence
-* @throws DiscoveryError on any failure
+* Returns the IdP signing certificates Better Auth trusts for this provider
+* as a list. `idpMetadata.cert` wins when both are set; the top-level `cert`
+* is the fallback. Returns `undefined` when neither is set (the certs come
+* from `idpMetadata.metadata` XML instead).
 */
-async function discoverOIDCConfig(params) {
-	const { issuer, existingConfig, timeout = DEFAULT_DISCOVERY_TIMEOUT } = params;
-	const discoveryUrl = params.discoveryEndpoint || existingConfig?.discoveryEndpoint || computeDiscoveryUrl(issuer);
-	validateDiscoveryUrl(discoveryUrl, params.isTrustedOrigin);
-	const discoveryDoc = await fetchDiscoveryDocument(discoveryUrl, timeout);
-	validateDiscoveryDocument(discoveryDoc, issuer);
-	const normalizedDoc = normalizeDiscoveryUrls(discoveryDoc, issuer, params.isTrustedOrigin);
-	const tokenEndpointAuth = selectTokenEndpointAuthMethod(normalizedDoc, existingConfig?.tokenEndpointAuthentication);
-	return {
-		issuer: existingConfig?.issuer ?? normalizedDoc.issuer,
-		discoveryEndpoint: existingConfig?.discoveryEndpoint ?? discoveryUrl,
-		authorizationEndpoint: existingConfig?.authorizationEndpoint ?? normalizedDoc.authorization_endpoint,
-		tokenEndpoint: existingConfig?.tokenEndpoint ?? normalizedDoc.token_endpoint,
-		jwksEndpoint: existingConfig?.jwksEndpoint ?? normalizedDoc.jwks_uri,
-		userInfoEndpoint: existingConfig?.userInfoEndpoint ?? normalizedDoc.userinfo_endpoint,
-		tokenEndpointAuthentication: existingConfig?.tokenEndpointAuthentication ?? tokenEndpointAuth,
-		scopesSupported: existingConfig?.scopesSupported ?? normalizedDoc.scopes_supported
-	};
+function resolveSigningCerts(config) {
+	const cert = config.idpMetadata?.cert ?? config.cert;
+	if (cert === void 0) return void 0;
+	return Array.isArray(cert) ? cert : [cert];
 }
 /**
-* Compute the discovery URL from an issuer URL.
-*
-* Per OIDC Discovery spec, the discovery document is located at:
-* <issuer>/.well-known/openid-configuration
-*
-* Handles trailing slashes correctly.
+* Reject SAML configs with no signing-cert source. samlify needs either an
+* `idpMetadata.metadata` XML document (which embeds the certs) or an explicit
+* PEM under `cert` or `idpMetadata.cert`; without one of those it has nothing
+* to verify responses against.
 */
-function computeDiscoveryUrl(issuer) {
-	return `${issuer.endsWith("/") ? issuer.slice(0, -1) : issuer}/.well-known/openid-configuration`;
+function validateCertSources(config) {
+	const hasMetadataXml = !!config.idpMetadata?.metadata;
+	const hasExplicitCert = config.idpMetadata?.cert !== void 0 || config.cert !== void 0;
+	if (!hasMetadataXml && !hasExplicitCert) throw APIError.from("BAD_REQUEST", SAML_ERROR_CODES.CERT_SOURCE_MISSING);
 }
-/**
-* Validate a discovery URL before fetching.
-*
-* @param url - The discovery URL to validate
-* @param isTrustedOrigin - Origin verification tester function
-* @throws DiscoveryError if URL is invalid
-*/
-function validateDiscoveryUrl(url, isTrustedOrigin) {
-	const discoveryEndpoint = parseURL("discoveryEndpoint", url).toString();
-	if (!isTrustedOrigin(discoveryEndpoint)) throw new DiscoveryError("discovery_untrusted_origin", `The main discovery endpoint "${discoveryEndpoint}" is not trusted by your trusted origins configuration.`, { url: discoveryEndpoint });
+//#endregion
+//#region src/saml/response-binding.ts
+const SAML_HTTP_POST_BINDING = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+const SAML_BEARER_CONFIRMATION_METHOD = "urn:oasis:names:tc:SAML:2.0:cm:bearer";
+function toNode(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	return value;
+}
+function toNodeArray(value) {
+	if (Array.isArray(value)) return value.map(toNode).filter((node) => !!node);
+	const node = toNode(value);
+	return node ? [node] : [];
+}
+function firstNode(value) {
+	return toNodeArray(value)[0] ?? null;
+}
+function toStringArray(value) {
+	if (typeof value === "string") return [value];
+	if (Array.isArray(value)) return value.flatMap(toStringArray);
+	const text = toNode(value)?.["#text"];
+	return typeof text === "string" ? [text] : [];
+}
+function toStringSet(values) {
+	return new Set(values.filter((value) => !!value));
+}
+function parseSAMLContent(samlContent) {
+	try {
+		const parsed = toNode(xmlParser.parse(samlContent));
+		if (parsed) return parsed;
+	} catch {}
+	throw new APIError("BAD_REQUEST", {
+		message: "SAML response XML could not be parsed",
+		code: "SAML_RESPONSE_INVALID_XML"
+	});
+}
+function getSAMLPostAssertionConsumerServiceUrls(metadata) {
+	if (!metadata) return [];
+	try {
+		const locations = toNodeArray(findNode(toNode(xmlParser.parse(metadata)), "SPSSODescriptor")).flatMap((descriptor) => toNodeArray(descriptor.AssertionConsumerService).filter((service) => service["@_Binding"] === SAML_HTTP_POST_BINDING).map((service) => service["@_Location"]).filter((location) => typeof location === "string" && !!location));
+		return [...new Set(locations)];
+	} catch {
+		return [];
+	}
+}
+function hasSAMLEncryptedAssertion(samlContent) {
+	try {
+		return countAllNodes(xmlParser.parse(samlContent), "EncryptedAssertion") > 0;
+	} catch {
+		return false;
+	}
+}
+function getResponseNode(parsed) {
+	return firstNode(parsed.Response);
+}
+function getAssertionNode(parsed, response) {
+	const assertion = firstNode(response?.Assertion) ?? firstNode(parsed.Assertion);
+	if (assertion) return assertion;
+	throw new APIError("BAD_REQUEST", {
+		message: "SAML response is missing an assertion",
+		code: "SAML_ASSERTION_MISSING"
+	});
+}
+function getAudienceRestrictionGroups(assertion) {
+	return toNodeArray(firstNode(assertion.Conditions)?.AudienceRestriction).map((restriction) => toStringArray(restriction.Audience).filter(Boolean));
+}
+function validateAudienceRestrictions(assertion, expectedAudiences) {
+	const audienceGroups = getAudienceRestrictionGroups(assertion);
+	if (audienceGroups.length === 0 || audienceGroups.every((group) => !group.length)) throw new APIError("BAD_REQUEST", {
+		message: "SAML assertion is missing an AudienceRestriction",
+		code: "SAML_AUDIENCE_MISSING"
+	});
+	if (audienceGroups.some((group) => !group.some((audience) => expectedAudiences.has(audience)))) throw new APIError("BAD_REQUEST", {
+		message: "SAML assertion audience does not match this Service Provider",
+		code: "SAML_AUDIENCE_MISMATCH"
+	});
+}
+function getBearerSubjectConfirmationData(assertion) {
+	return toNodeArray(firstNode(assertion.Subject)?.SubjectConfirmation).filter((confirmation) => confirmation["@_Method"] === SAML_BEARER_CONFIRMATION_METHOD).map((confirmation) => firstNode(confirmation.SubjectConfirmationData)).filter((data) => !!data);
+}
+function validateBearerRecipient(assertion, expectedRecipients) {
+	const confirmationData = getBearerSubjectConfirmationData(assertion);
+	if (!confirmationData.length) throw new APIError("BAD_REQUEST", {
+		message: "SAML assertion is missing bearer SubjectConfirmationData",
+		code: "SAML_BEARER_CONFIRMATION_MISSING"
+	});
+	const recipients = confirmationData.map((data) => data["@_Recipient"]).filter((recipient) => typeof recipient === "string");
+	if (!recipients.length) throw new APIError("BAD_REQUEST", {
+		message: "SAML bearer SubjectConfirmationData is missing a Recipient",
+		code: "SAML_RECIPIENT_MISSING"
+	});
+	if (!recipients.some((recipient) => expectedRecipients.has(recipient))) throw new APIError("BAD_REQUEST", {
+		message: "SAML bearer SubjectConfirmationData Recipient does not match this Service Provider",
+		code: "SAML_RECIPIENT_MISMATCH"
+	});
+}
+function validateResponseDestination(response, expectedRecipients) {
+	const destination = response?.["@_Destination"];
+	if (typeof destination !== "string" || !destination) return;
+	if (!expectedRecipients.has(destination)) throw new APIError("BAD_REQUEST", {
+		message: "SAML response Destination does not match this Service Provider",
+		code: "SAML_DESTINATION_MISMATCH"
+	});
+}
+function validateSAMLResponseBinding(samlContent, options) {
+	const expectedAudiences = toStringSet(options.expectedAudiences);
+	const expectedRecipients = toStringSet(options.expectedRecipients);
+	const parsed = parseSAMLContent(samlContent);
+	const response = getResponseNode(parsed);
+	const assertion = getAssertionNode(parsed, response);
+	validateAudienceRestrictions(assertion, expectedAudiences);
+	validateBearerRecipient(assertion, expectedRecipients);
+	validateResponseDestination(response, expectedRecipients);
+}
+//#endregion
+//#region src/saml/response-validation.ts
+function errorRedirectUrl(base, error, description) {
+	try {
+		const url = new URL(base);
+		url.searchParams.set("error", error);
+		url.searchParams.set("error_description", description);
+		return url.toString();
+	} catch {
+		const hashIdx = base.indexOf("#");
+		const path = hashIdx >= 0 ? base.slice(0, hashIdx) : base;
+		const hash = hashIdx >= 0 ? base.slice(hashIdx + 1) : void 0;
+		return `${path}${path.includes("?") ? "&" : "?"}${`error=${encodeURIComponent(error)}&error_description=${encodeURIComponent(description)}`}${hash ? `#${hash}` : ""}`;
+	}
 }
 /**
-* Fetch the OIDC discovery document from the IdP.
+* Validates the InResponseTo attribute of a SAML Response.
 *
-* @param url - The discovery endpoint URL
-* @param timeout - Request timeout in milliseconds
-* @returns The parsed discovery document
-* @throws DiscoveryError on network errors, timeouts, or invalid responses
+* This binds the IdP's Response to a specific SP-initiated AuthnRequest,
+* preventing replay attacks, unsolicited response injection, and
+* cross-provider assertion swaps.
+*
+* The InResponseTo value lives at `extract.response.inResponseTo` in
+* samlify's parsed output (not at the top level).
 */
-async function fetchDiscoveryDocument(url, timeout = DEFAULT_DISCOVERY_TIMEOUT) {
-	try {
-		const response = await betterFetch(url, {
-			method: "GET",
-			timeout
-		});
-		if (response.error) {
-			const { status } = response.error;
-			if (status === 404) throw new DiscoveryError("discovery_not_found", "Discovery endpoint not found", {
-				url,
-				status
-			});
-			if (status === 408) throw new DiscoveryError("discovery_timeout", "Discovery request timed out", {
-				url,
-				timeout
+async function validateInResponseTo(c, ctx) {
+	if (ctx.options.enableInResponseToValidation === false) return;
+	const inResponseTo = ctx.extract.response?.inResponseTo;
+	const allowIdpInitiated = ctx.options.allowIdpInitiated ?? false;
+	if (inResponseTo) {
+		const consumed = await c.context.internalAdapter.consumeVerificationValue(`${AUTHN_REQUEST_KEY_PREFIX}${inResponseTo}`);
+		let storedRequest = null;
+		if (consumed) try {
+			storedRequest = JSON.parse(consumed.value);
+		} catch {
+			storedRequest = null;
+		}
+		if (!storedRequest) {
+			c.context.logger.error("SAML InResponseTo validation failed: unknown or expired request ID", {
+				inResponseTo,
+				providerId: ctx.providerId
 			});
-			throw new DiscoveryError("discovery_unexpected_error", `Unexpected discovery error: ${response.error.statusText}`, {
-				url,
-				...response.error
+			throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "invalid_saml_response", "Unknown or expired request ID"));
+		}
+		if (storedRequest.providerId !== ctx.providerId) {
+			c.context.logger.error("SAML InResponseTo validation failed: provider mismatch", {
+				inResponseTo,
+				expectedProvider: storedRequest.providerId,
+				actualProvider: ctx.providerId
 			});
+			throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "invalid_saml_response", "Provider mismatch"));
 		}
-		if (!response.data) throw new DiscoveryError("discovery_invalid_json", "Discovery endpoint returned an empty response", { url });
-		const data = response.data;
-		if (typeof data === "string") throw new DiscoveryError("discovery_invalid_json", "Discovery endpoint returned invalid JSON", {
-			url,
-			bodyPreview: data.slice(0, 200)
-		});
-		return data;
-	} catch (error) {
-		if (error instanceof DiscoveryError) throw error;
-		if (error instanceof Error && error.name === "AbortError") throw new DiscoveryError("discovery_timeout", "Discovery request timed out", {
-			url,
-			timeout
-		});
-		throw new DiscoveryError("discovery_unexpected_error", `Unexpected error during discovery: ${error instanceof Error ? error.message : String(error)}`, { url }, { cause: error });
+	} else if (!allowIdpInitiated) {
+		c.context.logger.error("SAML IdP-initiated SSO rejected: InResponseTo missing and allowIdpInitiated is false", { providerId: ctx.providerId });
+		throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "unsolicited_response", "IdP-initiated SSO not allowed"));
 	}
 }
 /**
-* Validate a discovery document.
-*
-* Checks:
-* 1. All required fields are present
-* 2. Issuer matches the configured issuer (case-sensitive, exact match)
-*
-* Invariant: If this function returns without throwing, the document is safe
-* to use for hydrating OIDC config (required fields present, issuer matches
-* configured value, basic structural sanity verified).
+* Validates the AudienceRestriction of a SAML assertion.
 *
-* @param doc - The discovery document to validate
-* @param configuredIssuer - The expected issuer value
-* @throws DiscoveryError if validation fails
+* Per SAML 2.0 Core §2.5.1, an assertion's Audience element specifies
+* the intended recipient SP. Without this check, an assertion issued
+* for a different SP (e.g., another application sharing the same IdP)
+* could be accepted.
 */
-function validateDiscoveryDocument(doc, configuredIssuer) {
-	const missingFields = [];
-	for (const field of REQUIRED_DISCOVERY_FIELDS) if (!doc[field]) missingFields.push(field);
-	if (missingFields.length > 0) throw new DiscoveryError("discovery_incomplete", `Discovery document is missing required fields: ${missingFields.join(", ")}`, { missingFields });
-	if ((doc.issuer.endsWith("/") ? doc.issuer.slice(0, -1) : doc.issuer) !== (configuredIssuer.endsWith("/") ? configuredIssuer.slice(0, -1) : configuredIssuer)) throw new DiscoveryError("issuer_mismatch", `Discovered issuer "${doc.issuer}" does not match configured issuer "${configuredIssuer}"`, {
-		discovered: doc.issuer,
-		configured: configuredIssuer
+function validateAudience(c, ctx) {
+	if (!ctx.expectedAudience) {
+		c.context.logger.warn("Could not determine SP entity ID for audience validation; skipping", { providerId: ctx.providerId });
+		return;
+	}
+	const audience = ctx.extract.audience;
+	if (!audience) {
+		c.context.logger.error("SAML assertion missing AudienceRestriction but audience is configured — rejecting", { providerId: ctx.providerId });
+		throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "invalid_saml_response", "Audience restriction missing"));
+	}
+	const audiences = Array.isArray(audience) ? audience : [audience];
+	if (!audiences.includes(ctx.expectedAudience)) {
+		c.context.logger.error("SAML audience mismatch: assertion was issued for a different service provider", {
+			expected: ctx.expectedAudience,
+			received: audiences,
+			providerId: ctx.providerId
+		});
+		throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "invalid_saml_response", "Audience mismatch"));
+	}
+}
+//#endregion
+//#region src/routes/schemas.ts
+function getSSOProviderAdditionalFields$1(options) {
+	return options?.schema?.ssoProvider?.additionalFields ?? {};
+}
+function getSSOProviderAdditionalFieldsSchema(options) {
+	const additionalFields = getSSOProviderAdditionalFields$1(options);
+	const schema = toZodSchema({
+		fields: additionalFields,
+		isClientSide: true
 	});
+	const blockedInputFields = {};
+	for (const key in additionalFields) if (additionalFields[key]?.input === false) blockedInputFields[key] = z.any().optional();
+	return schema.extend(blockedInputFields);
 }
-/**
-* Normalize URLs in the discovery document.
-*
-* @param document - The discovery document
-* @param issuer - The base issuer URL
-* @param isTrustedOrigin - Origin verification tester function
-* @returns The normalized discovery document
-*/
-function normalizeDiscoveryUrls(document, issuer, isTrustedOrigin) {
-	const doc = { ...document };
-	doc.token_endpoint = normalizeAndValidateUrl("token_endpoint", doc.token_endpoint, issuer, isTrustedOrigin);
-	doc.authorization_endpoint = normalizeAndValidateUrl("authorization_endpoint", doc.authorization_endpoint, issuer, isTrustedOrigin);
-	doc.jwks_uri = normalizeAndValidateUrl("jwks_uri", doc.jwks_uri, issuer, isTrustedOrigin);
-	if (doc.userinfo_endpoint) doc.userinfo_endpoint = normalizeAndValidateUrl("userinfo_endpoint", doc.userinfo_endpoint, issuer, isTrustedOrigin);
-	if (doc.revocation_endpoint) doc.revocation_endpoint = normalizeAndValidateUrl("revocation_endpoint", doc.revocation_endpoint, issuer, isTrustedOrigin);
-	if (doc.end_session_endpoint) doc.end_session_endpoint = normalizeAndValidateUrl("end_session_endpoint", doc.end_session_endpoint, issuer, isTrustedOrigin);
-	if (doc.introspection_endpoint) doc.introspection_endpoint = normalizeAndValidateUrl("introspection_endpoint", doc.introspection_endpoint, issuer, isTrustedOrigin);
-	return doc;
+function assertNoBlockedAdditionalFieldInput(fields, data) {
+	for (const key in fields) if (fields[key]?.input === false && key in data) throw new APIError("BAD_REQUEST", { message: `${key} is not allowed to be set` });
 }
-/**
-* Normalizes and validates a single URL endpoint
-* @param name The url name
-* @param endpoint The url to validate
-* @param issuer The issuer base url
-* @param isTrustedOrigin - Origin verification tester function
-* @returns
-*/
-function normalizeAndValidateUrl(name, endpoint, issuer, isTrustedOrigin) {
-	const url = normalizeUrl(name, endpoint, issuer);
-	if (!isTrustedOrigin(url)) throw new DiscoveryError("discovery_untrusted_origin", `The ${name} "${url}" is not trusted by your trusted origins configuration.`, {
-		endpoint: name,
-		url
+function parseSSOProviderAdditionalFields(options, data, action) {
+	const fields = getSSOProviderAdditionalFields$1(options);
+	assertNoBlockedAdditionalFieldInput(fields, data);
+	return parseInputData(data, {
+		fields,
+		action
+	});
+}
+const oidcMappingSchema = z.object({
+	id: z.string().meta({ description: "Field mapping for user ID (defaults to 'sub')" }),
+	email: z.string().meta({ description: "Field mapping for email (defaults to 'email')" }),
+	emailVerified: z.string().meta({ description: "Field mapping for email verification (defaults to 'email_verified')" }).optional(),
+	name: z.string().meta({ description: "Field mapping for name (defaults to 'name')" }),
+	image: z.string().meta({ description: "Field mapping for image (defaults to 'picture')" }).optional(),
+	extraFields: z.record(z.string(), z.any()).optional()
+}).optional();
+const samlMappingSchema = z.object({
+	id: z.string().meta({ description: "Field mapping for user ID (defaults to 'nameID')" }),
+	email: z.string().meta({ description: "Field mapping for email (defaults to 'email')" }),
+	emailVerified: z.string().meta({ description: "Field mapping for email verification" }).optional(),
+	name: z.string().meta({ description: "Field mapping for name (defaults to 'displayName')" }),
+	firstName: z.string().meta({ description: "Field mapping for first name (defaults to 'givenName')" }).optional(),
+	lastName: z.string().meta({ description: "Field mapping for last name (defaults to 'surname')" }).optional(),
+	extraFields: z.record(z.string(), z.any()).optional()
+}).optional();
+const signingCertSchema = z.union([z.string(), z.array(z.string()).nonempty()]).meta({ description: "IdP signing certificate(s). Pass a single PEM string or an array for rolling rotation." });
+const oidcConfigSchema = z.object({
+	clientId: z.string().meta({ description: "The client ID" }),
+	clientSecret: z.string().meta({ description: "The client secret. Required for client_secret_basic/client_secret_post. Optional for private_key_jwt." }).optional(),
+	authorizationEndpoint: z.string().url().meta({ description: "The authorization endpoint" }).optional(),
+	tokenEndpoint: z.string().url().meta({ description: "The token endpoint" }).optional(),
+	userInfoEndpoint: z.string().url().meta({ description: "The user info endpoint" }).optional(),
+	tokenEndpointAuthentication: z.enum([
+		"client_secret_post",
+		"client_secret_basic",
+		"private_key_jwt"
+	]).optional(),
+	privateKeyId: z.string().optional(),
+	privateKeyAlgorithm: z.string().optional(),
+	jwksEndpoint: z.string().url().meta({ description: "The JWKS endpoint" }).optional(),
+	discoveryEndpoint: z.string().url().optional(),
+	skipDiscovery: z.boolean().meta({ description: "Skip OIDC discovery during registration. When true, you must provide authorizationEndpoint, tokenEndpoint, and jwksEndpoint manually." }).optional(),
+	scopes: z.array(z.string()).meta({ description: "The scopes to request. Defaults to ['openid', 'email', 'profile', 'offline_access']" }).optional(),
+	pkce: z.boolean().meta({ description: "Whether to use PKCE for the authorization flow" }).default(true).optional(),
+	overrideUserInfo: z.boolean().optional(),
+	mapping: oidcMappingSchema
+});
+const samlConfigSchema = z.object({
+	entryPoint: z.string().url().meta({ description: "The IdP SSO URL (entry point)" }),
+	cert: signingCertSchema.meta({ description: "IdP signing certificate(s). Pass a single PEM string or an array for rolling rotation. Omit when `idpMetadata.metadata` XML carries the certs. When both this and `idpMetadata.cert` are set, `idpMetadata.cert` wins." }).optional(),
+	audience: z.string().optional(),
+	callbackUrl: z.string().refine((url) => !url.includes("#"), { message: "callbackUrl must not contain a fragment" }).optional(),
+	idpMetadata: z.object({
+		metadata: z.string().optional(),
+		entityID: z.string().optional(),
+		cert: signingCertSchema.meta({ description: "IdP signing certificate(s). Pass a single PEM string or an array for rolling rotation. Takes precedence over the top-level `cert`." }).optional(),
+		privateKey: z.string().optional(),
+		privateKeyPass: z.string().optional(),
+		isAssertionEncrypted: z.boolean().optional(),
+		encPrivateKey: z.string().optional(),
+		encPrivateKeyPass: z.string().optional(),
+		singleSignOnService: z.array(z.object({
+			Binding: z.string().meta({ description: "The binding type for the SSO service" }),
+			Location: z.string().url().meta({ description: "The URL for the SSO service" })
+		})).meta({ description: "Single Sign-On service configuration" }).optional(),
+		singleLogoutService: z.array(z.object({
+			Binding: z.string(),
+			Location: z.string().url()
+		})).optional()
+	}).optional(),
+	spMetadata: z.object({
+		metadata: z.string().optional(),
+		entityID: z.string().optional(),
+		binding: z.string().optional(),
+		privateKey: z.string().optional(),
+		privateKeyPass: z.string().optional(),
+		isAssertionEncrypted: z.boolean().optional(),
+		encPrivateKey: z.string().optional(),
+		encPrivateKeyPass: z.string().optional()
+	}).optional(),
+	wantAssertionsSigned: z.boolean().optional(),
+	authnRequestsSigned: z.boolean().optional(),
+	signatureAlgorithm: z.string().optional(),
+	digestAlgorithm: z.string().optional(),
+	identifierFormat: z.string().optional(),
+	privateKey: z.string().optional(),
+	mapping: samlMappingSchema
+});
+const registerSSOProviderBodySchema = z.object({
+	providerId: z.string().meta({ description: "The ID of the provider. This is used to identify the provider during login and callback" }),
+	issuer: z.string().url().meta({ description: "The issuer URL of the provider" }),
+	domain: z.string().meta({ description: "The domain(s) of the provider. For enterprise multi-domain SSO where a single IdP serves multiple email domains, use comma-separated values (e.g., 'company.com,subsidiary.com,acquired-company.com')" }),
+	oidcConfig: oidcConfigSchema.optional(),
+	samlConfig: samlConfigSchema.optional(),
+	organizationId: z.string().meta({ description: "If organization plugin is enabled, the organization id to link the provider to" }).optional(),
+	overrideUserInfo: z.boolean().meta({ description: "Override user info with the provider info. Defaults to false" }).default(false).optional()
+});
+function getRegisterSSOProviderBodySchema(options) {
+	return registerSSOProviderBodySchema.extend({ ...getSSOProviderAdditionalFieldsSchema(options).shape });
+}
+const updateSSOProviderBodySchema = z.object({
+	issuer: z.string().url().optional(),
+	domain: z.string().optional(),
+	oidcConfig: oidcConfigSchema.partial().optional(),
+	samlConfig: samlConfigSchema.partial().optional()
+});
+function getUpdateSSOProviderBodySchema(options) {
+	return updateSSOProviderBodySchema.extend({
+		providerId: z.string(),
+		...getSSOProviderAdditionalFieldsSchema(options).partial().shape
+	});
+}
+//#endregion
+//#region src/routes/providers.ts
+const ADMIN_ROLES = ["owner", "admin"];
+const OIDC_IDENTITY_BOUNDARY_FIELDS = [
+	"authorizationEndpoint",
+	"clientId",
+	"discoveryEndpoint",
+	"jwksEndpoint",
+	"tokenEndpoint",
+	"userInfoEndpoint"
+];
+const SAML_IDENTITY_BOUNDARY_FIELDS = [
+	"audience",
+	"callbackUrl",
+	"entryPoint",
+	"identifierFormat"
+];
+const SAML_IDP_BOUNDARY_FIELDS = [
+	"metadata",
+	"entityID",
+	"singleSignOnService"
+];
+const SAML_SP_BOUNDARY_FIELDS = ["metadata", "entityID"];
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stableStringify(value) {
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	if (isRecord(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+	return JSON.stringify(value) ?? String(value);
+}
+function identityValueChanged(current, updated) {
+	return stableStringify(current) !== stableStringify(updated);
+}
+function hasChangedField(current, updated, fields) {
+	return fields.some((field) => identityValueChanged(current?.[field], updated?.[field]));
+}
+function oidcIdentityBoundaryChanged(current, updated) {
+	return hasChangedField(current, updated, OIDC_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(current.mapping?.id, updated.mapping?.id);
+}
+function samlIdentityBoundaryChanged(current, updated) {
+	return hasChangedField(current, updated, SAML_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(current.mapping?.id, updated.mapping?.id) || hasChangedField(current.idpMetadata, updated.idpMetadata, SAML_IDP_BOUNDARY_FIELDS) || hasChangedField(current.spMetadata, updated.spMetadata, SAML_SP_BOUNDARY_FIELDS);
+}
+function parseConfigSnapshot(config, configType) {
+	if (!config) return;
+	if (typeof config === "string") return parseAndValidateConfig(config, configType);
+	return config;
+}
+function ssoProviderIdentityBoundaryChanged(current, updated) {
+	if (identityValueChanged(current.issuer, updated.issuer)) return true;
+	const currentSamlConfig = parseConfigSnapshot(current.samlConfig, "SAML");
+	const updatedSamlConfig = parseConfigSnapshot(updated.samlConfig, "SAML");
+	if (currentSamlConfig && (!updatedSamlConfig || samlIdentityBoundaryChanged(currentSamlConfig, updatedSamlConfig))) return true;
+	const currentOidcConfig = parseConfigSnapshot(current.oidcConfig, "OIDC");
+	const updatedOidcConfig = parseConfigSnapshot(updated.oidcConfig, "OIDC");
+	return Boolean(currentOidcConfig && (!updatedOidcConfig || oidcIdentityBoundaryChanged(currentOidcConfig, updatedOidcConfig)));
+}
+async function lockSSOProviderRow(adapter, providerId) {
+	return (await getCurrentAdapter(adapter)).update({
+		model: "ssoProvider",
+		where: [{
+			field: "providerId",
+			value: providerId
+		}],
+		update: { providerId }
+	});
+}
+async function lockSSOProviderForAccountLink(ctx, provider) {
+	const lockedProvider = await lockSSOProviderRow(ctx.context.adapter, provider.providerId);
+	if (!lockedProvider) {
+		if (provider.userId === "default") return;
+		throw new APIError("CONFLICT", {
+			code: "SSO_PROVIDER_CHANGED",
+			message: "SSO provider changed while account linking was in progress"
+		});
+	}
+	if (ssoProviderIdentityBoundaryChanged(provider, lockedProvider)) throw new APIError("CONFLICT", {
+		code: "SSO_PROVIDER_CHANGED",
+		message: "SSO provider changed while account linking was in progress"
+	});
+}
+function getSSOProviderAdditionalFields(options) {
+	return options?.schema?.ssoProvider?.additionalFields ?? {};
+}
+function filterSSOProviderAdditionalFields(provider, options) {
+	return filterOutputFields(provider, getSSOProviderAdditionalFields(options));
+}
+function getReturnedSSOProviderAdditionalFields(provider, options) {
+	const additionalFields = getSSOProviderAdditionalFields(options);
+	const result = {};
+	for (const key in additionalFields) {
+		if (additionalFields[key]?.returned === false) continue;
+		if (key in provider) result[key] = provider[key];
+	}
+	return result;
+}
+function hasOrgAdminRole(member) {
+	return member.role.split(",").some((r) => ADMIN_ROLES.includes(r.trim()));
+}
+function parseCertOrError(cert) {
+	try {
+		return parseCertificate(cert);
+	} catch {
+		return { error: "Failed to parse certificate" };
+	}
+}
+function sanitizeSigningCerts(config) {
+	const certs = resolveSigningCerts(config);
+	if (certs === void 0) return void 0;
+	return certs.map(parseCertOrError);
+}
+async function isOrgAdmin(ctx, userId, organizationId) {
+	const member = await ctx.context.adapter.findOne({
+		model: "member",
+		where: [{
+			field: "userId",
+			value: userId
+		}, {
+			field: "organizationId",
+			value: organizationId
+		}]
 	});
-	return url;
+	return member ? hasOrgAdminRole(member) : false;
 }
-/**
-* Normalize a single URL endpoint.
-*
-* @param name - The endpoint name (e.g token_endpoint)
-* @param endpoint - The endpoint URL to normalize
-* @param issuer - The base issuer URL
-* @returns The normalized endpoint URL
-*/
-function normalizeUrl(name, endpoint, issuer) {
+async function batchCheckOrgAdmin(ctx, userId, organizationIds) {
+	if (organizationIds.length === 0) return /* @__PURE__ */ new Set();
+	const members = await ctx.context.adapter.findMany({
+		model: "member",
+		where: [{
+			field: "userId",
+			value: userId
+		}, {
+			field: "organizationId",
+			value: organizationIds,
+			operator: "in"
+		}]
+	});
+	const adminOrgIds = /* @__PURE__ */ new Set();
+	for (const member of members) if (hasOrgAdminRole(member)) adminOrgIds.add(member.organizationId);
+	return adminOrgIds;
+}
+function sanitizeProvider(provider, baseURL, options) {
+	let oidcConfig = null;
+	let samlConfig = null;
 	try {
-		return parseURL(name, endpoint).toString();
+		oidcConfig = safeJsonParse(provider.oidcConfig);
 	} catch {
-		const issuerURL = parseURL(name, issuer);
-		const basePath = issuerURL.pathname.replace(/\/+$/, "");
-		const endpointPath = endpoint.replace(/^\/+/, "");
-		return parseURL(name, basePath + "/" + endpointPath, issuerURL.origin).toString();
+		oidcConfig = null;
 	}
-}
-/**
-* Parses the given URL or throws in case of invalid or unsupported protocols
-*
-* @param name the url name
-* @param endpoint the endpoint url
-* @param [base] optional base path
-* @returns
-*/
-function parseURL(name, endpoint, base) {
-	let endpointURL;
 	try {
-		endpointURL = new URL(endpoint, base);
-		if (endpointURL.protocol === "http:" || endpointURL.protocol === "https:") return endpointURL;
-	} catch (error) {
-		throw new DiscoveryError("discovery_invalid_url", `The url "${name}" must be valid: ${endpoint}`, { url: endpoint }, { cause: error });
+		samlConfig = safeJsonParse(provider.samlConfig);
+	} catch {
+		samlConfig = null;
 	}
-	throw new DiscoveryError("discovery_invalid_url", `The url "${name}" must use the http or https supported protocols: ${endpoint}`, {
-		url: endpoint,
-		protocol: endpointURL.protocol
-	});
-}
-/**
-* Select the token endpoint authentication method.
-*
-* @param doc - The discovery document
-* @param existing - Existing authentication method from config
-* @returns The selected authentication method
-*/
-function selectTokenEndpointAuthMethod(doc, existing) {
-	if (existing === "private_key_jwt") return existing;
-	if (existing) return existing;
-	const supported = doc.token_endpoint_auth_methods_supported;
-	if (!supported || supported.length === 0) return "client_secret_basic";
-	if (supported.includes("client_secret_basic")) return "client_secret_basic";
-	if (supported.includes("client_secret_post")) return "client_secret_post";
-	if (supported.includes("private_key_jwt")) return "private_key_jwt";
-	return "client_secret_basic";
+	const type = samlConfig ? "saml" : "oidc";
+	return {
+		...getReturnedSSOProviderAdditionalFields(provider, options),
+		providerId: provider.providerId,
+		type,
+		issuer: provider.issuer,
+		domain: provider.domain,
+		organizationId: provider.organizationId || null,
+		domainVerified: provider.domainVerified ?? false,
+		oidcConfig: oidcConfig ? {
+			discoveryEndpoint: oidcConfig.discoveryEndpoint,
+			clientIdLastFour: maskClientId(oidcConfig.clientId),
+			pkce: oidcConfig.pkce,
+			authorizationEndpoint: oidcConfig.authorizationEndpoint,
+			tokenEndpoint: oidcConfig.tokenEndpoint,
+			userInfoEndpoint: oidcConfig.userInfoEndpoint,
+			jwksEndpoint: oidcConfig.jwksEndpoint,
+			scopes: oidcConfig.scopes,
+			tokenEndpointAuthentication: oidcConfig.tokenEndpointAuthentication
+		} : void 0,
+		samlConfig: samlConfig ? {
+			entryPoint: samlConfig.entryPoint,
+			audience: samlConfig.audience,
+			wantAssertionsSigned: samlConfig.wantAssertionsSigned,
+			authnRequestsSigned: samlConfig.authnRequestsSigned,
+			identifierFormat: samlConfig.identifierFormat,
+			signatureAlgorithm: samlConfig.signatureAlgorithm,
+			digestAlgorithm: samlConfig.digestAlgorithm,
+			certificate: sanitizeSigningCerts(samlConfig)
+		} : void 0,
+		spMetadataUrl: `${baseURL}/sso/saml2/sp/metadata?providerId=${encodeURIComponent(provider.providerId)}`
+	};
 }
-/**
-* Check if a provider configuration needs runtime discovery.
-*
-* Returns true if we need discovery at runtime to complete the token exchange
-* and validation. Specifically checks for:
-* - `tokenEndpoint` - required for exchanging authorization code for tokens
-* - `jwksEndpoint` - required for validating ID token signatures
-* - `authorizationEndpoint` - required for redirecting users to the IdP for login
-*
-* @param config - Partial OIDC config from the provider
-* @returns true if runtime discovery should be performed
-*/
-function needsRuntimeDiscovery(config) {
-	if (!config) return true;
-	return !config.tokenEndpoint || !config.jwksEndpoint || !config.authorizationEndpoint;
+const listSSOProviders = (options) => {
+	return createAuthEndpoint("/sso/providers", {
+		method: "GET",
+		use: [sessionMiddleware],
+		metadata: { openapi: {
+			operationId: "listSSOProviders",
+			summary: "List SSO providers",
+			description: "Returns a list of SSO providers the user has access to",
+			responses: { "200": { description: "List of SSO providers. The `certificate` field is an array of parsed certificates for SAML providers, or absent when certs live inside `idpMetadata.metadata`." } }
+		} }
+	}, async (ctx) => {
+		const userId = ctx.context.session.user.id;
+		const allProviders = await ctx.context.adapter.findMany({ model: "ssoProvider" });
+		const userOwnedProviders = allProviders.filter((p) => p.userId === userId && !p.organizationId);
+		const orgProviders = allProviders.filter((p) => p.organizationId !== null && p.organizationId !== void 0);
+		const orgPluginEnabled = ctx.context.hasPlugin("organization");
+		let accessibleProviders = [...userOwnedProviders];
+		if (orgPluginEnabled && orgProviders.length > 0) {
+			const adminOrgIds = await batchCheckOrgAdmin(ctx, userId, [...new Set(orgProviders.map((p) => p.organizationId).filter((id) => id !== null && id !== void 0))]);
+			const orgAccessibleProviders = orgProviders.filter((provider) => provider.organizationId && adminOrgIds.has(provider.organizationId));
+			accessibleProviders = [...accessibleProviders, ...orgAccessibleProviders];
+		} else if (!orgPluginEnabled) {
+			const userOwnedOrgProviders = orgProviders.filter((p) => p.userId === userId);
+			accessibleProviders = [...accessibleProviders, ...userOwnedOrgProviders];
+		}
+		const providers = accessibleProviders.map((p) => sanitizeProvider(p, ctx.context.baseURL, options));
+		return ctx.json({ providers });
+	});
+};
+const getSSOProviderQuerySchema = z.object({ providerId: z.string() });
+async function checkProviderAccess(ctx, providerId) {
+	const userId = ctx.context.session.user.id;
+	const provider = await ctx.context.adapter.findOne({
+		model: "ssoProvider",
+		where: [{
+			field: "providerId",
+			value: providerId
+		}]
+	});
+	if (!provider) throw new APIError("NOT_FOUND", { message: "Provider not found" });
+	let hasAccess = false;
+	if (provider.organizationId) if (ctx.context.hasPlugin("organization")) hasAccess = await isOrgAdmin(ctx, userId, provider.organizationId);
+	else hasAccess = provider.userId === userId;
+	else hasAccess = provider.userId === userId;
+	if (!hasAccess) throw new APIError("FORBIDDEN", { message: "You don't have access to this provider" });
+	return provider;
 }
-/**
-* Runs runtime OIDC discovery when the stored config is missing required
-* endpoints, and merges the hydrated fields back into the config.
-* Throws if discovery fails.
-*/
-async function ensureRuntimeDiscovery(config, issuer, isTrustedOrigin) {
-	if (!needsRuntimeDiscovery(config)) return config;
-	const hydrated = await discoverOIDCConfig({
-		issuer,
-		existingConfig: config,
-		isTrustedOrigin
+const getSSOProvider = (options) => {
+	return createAuthEndpoint("/sso/get-provider", {
+		method: "GET",
+		use: [sessionMiddleware],
+		query: getSSOProviderQuerySchema,
+		metadata: { openapi: {
+			operationId: "getSSOProvider",
+			summary: "Get SSO provider details",
+			description: "Returns sanitized details for a specific SSO provider",
+			responses: {
+				"200": { description: "SSO provider details. The `certificate` field is an array of parsed certificates for SAML providers, or absent when certs live inside `idpMetadata.metadata`." },
+				"404": { description: "Provider not found" },
+				"403": { description: "Access denied" }
+			}
+		} }
+	}, async (ctx) => {
+		const { providerId } = ctx.query;
+		const provider = await checkProviderAccess(ctx, providerId);
+		return ctx.json(sanitizeProvider(provider, ctx.context.baseURL, options));
 	});
+};
+function parseAndValidateConfig(configString, configType) {
+	let config = null;
+	try {
+		config = safeJsonParse(configString);
+	} catch {
+		config = null;
+	}
+	if (!config) throw new APIError("BAD_REQUEST", { message: `Cannot update ${configType} config for a provider that doesn't have ${configType} configured` });
+	return config;
+}
+function mergeSAMLConfig(current, updates, issuer) {
 	return {
-		...config,
-		authorizationEndpoint: hydrated.authorizationEndpoint,
-		tokenEndpoint: hydrated.tokenEndpoint,
-		tokenEndpointAuthentication: hydrated.tokenEndpointAuthentication,
-		userInfoEndpoint: hydrated.userInfoEndpoint,
-		jwksEndpoint: hydrated.jwksEndpoint
+		...current,
+		...updates,
+		issuer,
+		entryPoint: updates.entryPoint ?? current.entryPoint,
+		cert: updates.cert ?? current.cert,
+		spMetadata: updates.spMetadata ?? current.spMetadata,
+		idpMetadata: updates.idpMetadata ?? current.idpMetadata,
+		mapping: updates.mapping ?? current.mapping,
+		audience: updates.audience ?? current.audience,
+		callbackUrl: updates.callbackUrl ?? current.callbackUrl,
+		wantAssertionsSigned: updates.wantAssertionsSigned ?? current.wantAssertionsSigned,
+		authnRequestsSigned: updates.authnRequestsSigned ?? current.authnRequestsSigned,
+		identifierFormat: updates.identifierFormat ?? current.identifierFormat,
+		signatureAlgorithm: updates.signatureAlgorithm ?? current.signatureAlgorithm,
+		digestAlgorithm: updates.digestAlgorithm ?? current.digestAlgorithm
 	};
 }
-//#endregion
-//#region src/oidc/errors.ts
-/**
-* OIDC Discovery Error Mapping
-*
-* Maps DiscoveryError codes to appropriate APIError responses.
-* Used at the boundary between the discovery pipeline and HTTP handlers.
-*/
-/**
-* Maps a DiscoveryError to an appropriate APIError for HTTP responses.
-*
-* Error code mapping:
-* - discovery_invalid_url       → 400 BAD_REQUEST
-* - discovery_not_found         → 400 BAD_REQUEST
-* - discovery_invalid_json      → 400 BAD_REQUEST
-* - discovery_incomplete        → 400 BAD_REQUEST
-* - issuer_mismatch             → 400 BAD_REQUEST
-* - unsupported_token_auth_method → 400 BAD_REQUEST
-* - discovery_timeout           → 502 BAD_GATEWAY
-* - discovery_unexpected_error  → 502 BAD_GATEWAY
-*
-* @param error - The DiscoveryError to map
-* @returns An APIError with appropriate status and message
-*/
-function mapDiscoveryErrorToAPIError(error) {
-	switch (error.code) {
-		case "discovery_timeout": return new APIError("BAD_GATEWAY", {
-			message: `OIDC discovery timed out: ${error.message}`,
-			code: error.code
-		});
-		case "discovery_unexpected_error": return new APIError("BAD_GATEWAY", {
-			message: `OIDC discovery failed: ${error.message}`,
-			code: error.code
+function mergeOIDCConfig(current, updates, issuer) {
+	return {
+		...current,
+		...updates,
+		issuer,
+		pkce: updates.pkce ?? current.pkce ?? true,
+		clientId: updates.clientId ?? current.clientId,
+		clientSecret: updates.clientSecret ?? current.clientSecret,
+		discoveryEndpoint: updates.discoveryEndpoint ?? current.discoveryEndpoint,
+		mapping: updates.mapping ?? current.mapping,
+		scopes: updates.scopes ?? current.scopes,
+		authorizationEndpoint: updates.authorizationEndpoint ?? current.authorizationEndpoint,
+		tokenEndpoint: updates.tokenEndpoint ?? current.tokenEndpoint,
+		userInfoEndpoint: updates.userInfoEndpoint ?? current.userInfoEndpoint,
+		jwksEndpoint: updates.jwksEndpoint ?? current.jwksEndpoint,
+		tokenEndpointAuthentication: updates.tokenEndpointAuthentication ?? current.tokenEndpointAuthentication,
+		privateKeyId: updates.privateKeyId ?? current.privateKeyId,
+		privateKeyAlgorithm: updates.privateKeyAlgorithm ?? current.privateKeyAlgorithm
+	};
+}
+const updateSSOProvider = (options) => {
+	const updateBodySchema = getUpdateSSOProviderBodySchema(options);
+	return createAuthEndpoint("/sso/update-provider", {
+		method: "POST",
+		use: [sessionMiddleware],
+		body: updateBodySchema,
+		metadata: { openapi: {
+			operationId: "updateSSOProvider",
+			summary: "Update SSO provider",
+			description: "Partially update an SSO provider. Only provided fields are updated. If domain changes, domainVerified is reset to false.",
+			responses: {
+				"200": { description: "SSO provider updated successfully. The `certificate` field is an array of parsed certificates for SAML providers, or absent when certs live inside `idpMetadata.metadata`." },
+				"404": { description: "Provider not found" },
+				"403": { description: "Access denied" }
+			}
+		} }
+	}, async (ctx) => {
+		const { providerId, ...body } = ctx.body;
+		const { issuer, domain, samlConfig, oidcConfig } = body;
+		const additionalFields = parseSSOProviderAdditionalFields(options, body, "update");
+		if (!issuer && !domain && !samlConfig && !oidcConfig && Object.keys(additionalFields).length === 0) throw new APIError("BAD_REQUEST", { message: "No fields provided for update" });
+		await checkProviderAccess(ctx, providerId);
+		const fullProvider = await runWithTransaction(ctx.context.adapter, async () => {
+			const trx = await getCurrentAdapter(ctx.context.adapter);
+			const existingProvider = await lockSSOProviderRow(ctx.context.adapter, providerId);
+			if (!existingProvider) throw new APIError("NOT_FOUND", { message: "Provider not found" });
+			const updateData = { ...additionalFields };
+			let providerIdentityBoundaryChanged = body.issuer !== void 0 && body.issuer !== existingProvider.issuer;
+			if (body.issuer !== void 0) updateData.issuer = body.issuer;
+			if (body.domain !== void 0) {
+				updateData.domain = body.domain;
+				if (body.domain !== existingProvider.domain) updateData.domainVerified = false;
+			}
+			if (body.samlConfig) {
+				if (body.samlConfig.idpMetadata?.metadata) {
+					const maxMetadataSize = options?.saml?.maxMetadataSize ?? 102400;
+					if (new TextEncoder().encode(body.samlConfig.idpMetadata.metadata).length > maxMetadataSize) throw new APIError("BAD_REQUEST", { message: `IdP metadata exceeds maximum allowed size (${maxMetadataSize} bytes)` });
+				}
+				if (body.samlConfig.signatureAlgorithm !== void 0 || body.samlConfig.digestAlgorithm !== void 0) validateConfigAlgorithms({
+					signatureAlgorithm: body.samlConfig.signatureAlgorithm,
+					digestAlgorithm: body.samlConfig.digestAlgorithm
+				}, options?.saml?.algorithms);
+				const currentSamlConfig = parseAndValidateConfig(existingProvider.samlConfig, "SAML");
+				const updatedSamlConfig = mergeSAMLConfig(currentSamlConfig, body.samlConfig, updateData.issuer || currentSamlConfig.issuer || existingProvider.issuer);
+				validateCertSources(updatedSamlConfig);
+				if (samlIdentityBoundaryChanged(currentSamlConfig, updatedSamlConfig)) providerIdentityBoundaryChanged = true;
+				updateData.samlConfig = JSON.stringify(updatedSamlConfig);
+			}
+			if (body.oidcConfig) {
+				try {
+					validateOIDCEndpointUrls(body.oidcConfig, (url) => ctx.context.isTrustedOrigin(url));
+				} catch (error) {
+					if (error instanceof DiscoveryError) throw mapDiscoveryErrorToAPIError(error);
+					throw error;
+				}
+				const currentOidcConfig = parseAndValidateConfig(existingProvider.oidcConfig, "OIDC");
+				const updatedOidcConfig = mergeOIDCConfig(currentOidcConfig, body.oidcConfig, updateData.issuer || currentOidcConfig.issuer || existingProvider.issuer);
+				if (updatedOidcConfig.tokenEndpointAuthentication !== "private_key_jwt" && !updatedOidcConfig.clientSecret) throw new APIError("BAD_REQUEST", { message: "clientSecret is required when using client_secret_basic or client_secret_post authentication" });
+				if (updatedOidcConfig.tokenEndpointAuthentication === "private_key_jwt" && !options?.resolvePrivateKey && !options?.defaultSSO?.some((p) => p.providerId === providerId && "privateKey" in p && p.privateKey)) throw new APIError("BAD_REQUEST", { message: "private_key_jwt authentication requires either a resolvePrivateKey callback or a privateKey in defaultSSO" });
+				if (oidcIdentityBoundaryChanged(currentOidcConfig, updatedOidcConfig)) providerIdentityBoundaryChanged = true;
+				updateData.oidcConfig = JSON.stringify(updatedOidcConfig);
+			}
+			if (providerIdentityBoundaryChanged) {
+				if (await trx.findOne({
+					model: "account",
+					where: [{
+						field: "providerId",
+						value: providerId
+					}]
+				})) throw new APIError("CONFLICT", { message: "Cannot change SSO provider identity fields while linked accounts exist" });
+			}
+			await trx.update({
+				model: "ssoProvider",
+				where: [{
+					field: "providerId",
+					value: providerId
+				}],
+				update: updateData
+			});
+			const updatedProvider = await trx.findOne({
+				model: "ssoProvider",
+				where: [{
+					field: "providerId",
+					value: providerId
+				}]
+			});
+			if (!updatedProvider) throw new APIError("NOT_FOUND", { message: "Provider not found after update" });
+			return updatedProvider;
 		});
-		case "discovery_not_found": return new APIError("BAD_REQUEST", {
-			message: `OIDC discovery endpoint not found. The issuer may not support OIDC discovery, or the URL is incorrect. ${error.message}`,
-			code: error.code
+		return ctx.json(sanitizeProvider(fullProvider, ctx.context.baseURL, options));
+	});
+};
+const deleteSSOProvider = () => {
+	return createAuthEndpoint("/sso/delete-provider", {
+		method: "POST",
+		use: [sessionMiddleware],
+		body: z.object({ providerId: z.string() }),
+		metadata: { openapi: {
+			operationId: "deleteSSOProvider",
+			summary: "Delete SSO provider",
+			description: "Deletes an SSO provider",
+			responses: {
+				"200": { description: "SSO provider deleted successfully" },
+				"404": { description: "Provider not found" },
+				"403": { description: "Access denied" }
+			}
+		} }
+	}, async (ctx) => {
+		const { providerId } = ctx.body;
+		await checkProviderAccess(ctx, providerId);
+		await runWithTransaction(ctx.context.adapter, async () => {
+			const trx = await getCurrentAdapter(ctx.context.adapter);
+			await trx.deleteMany({
+				model: "account",
+				where: [{
+					field: "providerId",
+					value: providerId
+				}]
+			});
+			await trx.delete({
+				model: "ssoProvider",
+				where: [{
+					field: "providerId",
+					value: providerId
+				}]
+			});
 		});
-		case "discovery_invalid_url": return new APIError("BAD_REQUEST", {
-			message: `Invalid OIDC discovery URL: ${error.message}`,
-			code: error.code
+		return ctx.json({ success: true });
+	});
+};
+//#endregion
+//#region src/routes/domain-verification.ts
+const DNS_LABEL_MAX_LENGTH = 63;
+const DEFAULT_TOKEN_PREFIX = "better-auth-token";
+const domainVerificationBodySchema = z.object({ providerId: z.string() });
+function getVerificationIdentifier(options, providerId) {
+	return `_${options.domainVerification?.tokenPrefix || DEFAULT_TOKEN_PREFIX}-${providerId}`;
+}
+const requestDomainVerification = (options) => {
+	return createAuthEndpoint("/sso/request-domain-verification", {
+		method: "POST",
+		body: domainVerificationBodySchema,
+		metadata: { openapi: {
+			summary: "Request a domain verification",
+			description: "Request a domain verification for the given SSO provider",
+			responses: {
+				"404": { description: "Provider not found" },
+				"409": { description: "Domain has already been verified" },
+				"201": { description: "Domain submitted for verification" }
+			}
+		} },
+		use: [sessionMiddleware]
+	}, async (ctx) => {
+		const body = ctx.body;
+		const provider = await checkProviderAccess(ctx, body.providerId);
+		if (provider.domainVerified) throw new APIError("CONFLICT", {
+			message: "Domain has already been verified",
+			code: "DOMAIN_VERIFIED"
 		});
-		case "discovery_untrusted_origin": return new APIError("BAD_REQUEST", {
-			message: `Untrusted OIDC discovery URL: ${error.message}`,
-			code: error.code
+		const identifier = getVerificationIdentifier(options, provider.providerId);
+		const activeVerification = await ctx.context.internalAdapter.findVerificationValue(identifier);
+		if (activeVerification && new Date(activeVerification.expiresAt) > /* @__PURE__ */ new Date()) {
+			ctx.setStatus(201);
+			return ctx.json({ domainVerificationToken: activeVerification.value });
+		}
+		const domainVerificationToken = generateRandomString(24);
+		await ctx.context.internalAdapter.createVerificationValue({
+			identifier,
+			value: domainVerificationToken,
+			expiresAt: new Date(Date.now() + 3600 * 24 * 7 * 1e3)
 		});
-		case "discovery_invalid_json": return new APIError("BAD_REQUEST", {
-			message: `OIDC discovery returned invalid data: ${error.message}`,
-			code: error.code
+		ctx.setStatus(201);
+		return ctx.json({ domainVerificationToken });
+	});
+};
+const verifyDomain = (options) => {
+	return createAuthEndpoint("/sso/verify-domain", {
+		method: "POST",
+		body: domainVerificationBodySchema,
+		metadata: { openapi: {
+			summary: "Verify the provider domain ownership",
+			description: "Verify the provider domain ownership via DNS records",
+			responses: {
+				"404": { description: "Provider not found" },
+				"409": { description: "Domain has already been verified or no pending verification exists" },
+				"502": { description: "Unable to verify domain ownership due to upstream validator error" },
+				"204": { description: "Domain ownership was verified" }
+			}
+		} },
+		use: [sessionMiddleware]
+	}, async (ctx) => {
+		const body = ctx.body;
+		const provider = await checkProviderAccess(ctx, body.providerId);
+		if (provider.domainVerified) throw new APIError("CONFLICT", {
+			message: "Domain has already been verified",
+			code: "DOMAIN_VERIFIED"
 		});
-		case "discovery_incomplete": return new APIError("BAD_REQUEST", {
-			message: `OIDC discovery document is missing required fields: ${error.message}`,
-			code: error.code
+		const identifier = getVerificationIdentifier(options, provider.providerId);
+		if (identifier.length > DNS_LABEL_MAX_LENGTH) throw new APIError("BAD_REQUEST", {
+			message: `Verification identifier exceeds the DNS label limit of ${DNS_LABEL_MAX_LENGTH} characters`,
+			code: "IDENTIFIER_TOO_LONG"
 		});
-		case "issuer_mismatch": return new APIError("BAD_REQUEST", {
-			message: `OIDC issuer mismatch: ${error.message}`,
-			code: error.code
+		const activeVerification = await ctx.context.internalAdapter.findVerificationValue(identifier);
+		if (!activeVerification || new Date(activeVerification.expiresAt) <= /* @__PURE__ */ new Date()) throw new APIError("NOT_FOUND", {
+			message: "No pending domain verification exists",
+			code: "NO_PENDING_VERIFICATION"
 		});
-		case "unsupported_token_auth_method": return new APIError("BAD_REQUEST", {
-			message: `Incompatible OIDC provider: ${error.message}`,
-			code: error.code
+		let dns;
+		try {
+			dns = await import("node:dns/promises");
+		} catch (error) {
+			ctx.context.logger.error("The core node:dns module is required for the domain verification feature", error);
+			throw new APIError("INTERNAL_SERVER_ERROR", {
+				message: "Unable to verify domain ownership due to server error",
+				code: "DOMAIN_VERIFICATION_FAILED"
+			});
+		}
+		const domains = parseProviderDomains(provider.domain);
+		if (!domains) throw new APIError("BAD_REQUEST", {
+			message: "Invalid domain",
+			code: "INVALID_DOMAIN"
 		});
-		default:
-			error.code;
-			return new APIError("INTERNAL_SERVER_ERROR", {
-				message: `Unexpected discovery error: ${error.message}`,
-				code: "discovery_unexpected_error"
+		for (const domain of domains) {
+			let records = [];
+			try {
+				records = (await dns.resolveTxt(`${identifier}.${domain}`)).map((record) => record.join(""));
+			} catch (error) {
+				ctx.context.logger.warn(`DNS resolution failure while validating domain ownership for ${domain}`, error);
+			}
+			const verificationValue = activeVerification.value;
+			const verificationRecord = `${activeVerification.identifier}=${verificationValue}`;
+			if (!records.find((record) => {
+				const normalizedRecord = record.trim();
+				return normalizedRecord === verificationRecord || normalizedRecord === verificationValue;
+			})) throw new APIError("BAD_GATEWAY", {
+				message: `Unable to verify domain ownership for ${domain}. Try again later`,
+				code: "DOMAIN_VERIFICATION_FAILED"
 			});
-	}
-}
-//#endregion
-//#region src/saml/error-codes.ts
-const SAML_ERROR_CODES = defineErrorCodes({
-	SINGLE_LOGOUT_NOT_ENABLED: "Single Logout is not enabled",
-	INVALID_LOGOUT_RESPONSE: "Invalid LogoutResponse",
-	INVALID_LOGOUT_REQUEST: "Invalid LogoutRequest",
-	LOGOUT_FAILED_AT_IDP: "Logout failed at IdP",
-	IDP_SLO_NOT_SUPPORTED: "IdP does not support Single Logout Service",
-	SAML_PROVIDER_NOT_FOUND: "SAML provider not found"
-});
+		}
+		await ctx.context.adapter.update({
+			model: "ssoProvider",
+			where: [{
+				field: "providerId",
+				value: provider.providerId
+			}],
+			update: { domainVerified: true }
+		});
+		ctx.setStatus(204);
+	});
+};
 //#endregion
 //#region src/saml-state.ts
-async function generateRelayState(c, link, additionalData) {
+async function generateRelayState(c, link) {
 	const callbackURL = c.body.callbackURL;
 	if (!callbackURL) throw new APIError("BAD_REQUEST", { message: "callbackURL is required" });
-	const codeVerifier = generateRandomString(128);
 	const stateData = {
-		...additionalData ? additionalData : {},
 		callbackURL,
-		codeVerifier,
+		codeVerifier: generateRandomString(128),
 		errorURL: c.body.errorCallbackURL,
 		newUserURL: c.body.newUserCallbackURL,
 		link,
@@ -1508,8 +2028,17 @@ async function parseRelayState(c) {
 	if (!parsedData.errorURL) parsedData.errorURL = errorURL;
 	return parsedData;
 }
+const saml = typeof samlifyNamespace.SPMetadata === "function" && typeof samlifyNamespace.setSchemaValidator === "function" ? samlifyNamespace : samlifyDefault ?? samlifyNamespace;
 //#endregion
 //#region src/routes/helpers.ts
+/**
+* Same as `normalizePem`, but applied across the resolved list of IdP signing
+* certificates so multi-cert rotation configs survive the line-trim step.
+*/
+function normalizePemList(certs) {
+	if (!certs) return certs;
+	return certs.map((pem) => normalizePem(pem) ?? pem);
+}
 async function findSAMLProvider(providerId, options, adapter) {
 	if (options?.defaultSSO?.length) {
 		const match = options.defaultSSO.find((p) => p.providerId === providerId);
@@ -1536,41 +2065,47 @@ async function findSAMLProvider(providerId, options, adapter) {
 function createSP(config, baseURL, providerId, opts) {
 	const spData = config.spMetadata;
 	const sloLocation = `${baseURL}/sso/saml2/sp/slo/${providerId}`;
-	const acsUrl = config.callbackUrl || `${baseURL}/sso/saml2/sp/acs/${providerId}`;
-	return saml.ServiceProvider({
+	const acsUrl = `${baseURL}/sso/saml2/sp/acs/${providerId}`;
+	let metadata = spData?.metadata;
+	if (!metadata) metadata = saml.SPMetadata({
 		entityID: spData?.entityID || config.issuer,
-		assertionConsumerService: spData?.metadata ? void 0 : [{
+		assertionConsumerService: [{
 			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
 			Location: acsUrl
 		}],
-		singleLogoutService: [{
+		singleLogoutService: opts?.sloOptions ? [{
 			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
 			Location: sloLocation
 		}, {
 			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
 			Location: sloLocation
-		}],
+		}] : void 0,
 		wantMessageSigned: config.wantAssertionsSigned || false,
+		authnRequestsSigned: config.authnRequestsSigned || false,
+		nameIDFormat: config.identifierFormat ? [config.identifierFormat] : void 0
+	}).getMetadata() || "";
+	return saml.ServiceProvider({
+		metadata,
+		allowCreate: true,
 		wantLogoutRequestSigned: opts?.sloOptions?.wantLogoutRequestSigned ?? false,
 		wantLogoutResponseSigned: opts?.sloOptions?.wantLogoutResponseSigned ?? false,
-		metadata: spData?.metadata,
-		privateKey: spData?.privateKey || config.privateKey,
+		privateKey: normalizePem(spData?.privateKey || config.privateKey),
 		privateKeyPass: spData?.privateKeyPass,
 		isAssertionEncrypted: spData?.isAssertionEncrypted || false,
-		encPrivateKey: spData?.encPrivateKey,
+		encPrivateKey: normalizePem(spData?.encPrivateKey),
 		encPrivateKeyPass: spData?.encPrivateKeyPass,
-		nameIDFormat: config.identifierFormat ? [config.identifierFormat] : void 0,
-		relayState: opts?.relayState
+		relayState: opts?.relayState,
+		clockDrifts: opts?.clockSkew && opts?.clockSkew !== 0 ? [-opts.clockSkew, opts.clockSkew] : void 0
 	});
 }
 function createIdP(config) {
 	const idpData = config.idpMetadata;
 	if (idpData?.metadata) return saml.IdentityProvider({
 		metadata: idpData.metadata,
-		privateKey: idpData.privateKey,
+		privateKey: normalizePem(idpData.privateKey),
 		privateKeyPass: idpData.privateKeyPass,
 		isAssertionEncrypted: idpData.isAssertionEncrypted,
-		encPrivateKey: idpData.encPrivateKey,
+		encPrivateKey: normalizePem(idpData.encPrivateKey),
 		encPrivateKeyPass: idpData.encPrivateKeyPass
 	});
 	return saml.IdentityProvider({
@@ -1580,10 +2115,10 @@ function createIdP(config) {
 			Location: config.entryPoint
 		}],
 		singleLogoutService: idpData?.singleLogoutService,
-		signingCert: idpData?.cert || config.cert,
+		signingCert: normalizePemList(resolveSigningCerts(config)),
 		wantAuthnRequestsSigned: config.authnRequestsSigned || false,
 		isAssertionEncrypted: idpData?.isAssertionEncrypted || false,
-		encPrivateKey: idpData?.encPrivateKey,
+		encPrivateKey: normalizePem(idpData?.encPrivateKey),
 		encPrivateKeyPass: idpData?.encPrivateKeyPass
 	});
 }
@@ -1591,7 +2126,17 @@ function escapeHtml(str) {
 	if (!str) return "";
 	return String(str).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+function isSAMLPostBindingLocation(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	return url.protocol === "http:" || url.protocol === "https:";
+}
 function createSAMLPostForm(action, samlParam, samlValue, relayState) {
+	if (!isSAMLPostBindingLocation(action)) throw new APIError("BAD_REQUEST", { message: "SAML POST binding location must be an absolute http or https URL" });
 	const safeAction = escapeHtml(action);
 	const safeSamlParam = escapeHtml(samlParam);
 	const safeSamlValue = escapeHtml(samlValue);
@@ -1661,6 +2206,14 @@ function getSafeRedirectUrl(url, callbackPath, appOrigin, isTrustedOrigin) {
 		}
 		return url;
 	}
+	try {
+		const absoluteUrl = new URL(url);
+		if (absoluteUrl.origin === appOrigin) {
+			const callbackPathname = new URL(callbackPath).pathname;
+			if (absoluteUrl.pathname === callbackPathname) return appOrigin;
+			return url;
+		}
+	} catch {}
 	if (!isTrustedOrigin(url, { allowRelativePaths: false })) return appOrigin;
 	try {
 		const callbackPathname = new URL(callbackPath).pathname;
@@ -1670,6 +2223,39 @@ function getSafeRedirectUrl(url, callbackPath, appOrigin, isTrustedOrigin) {
 	}
 	return url;
 }
+function buildSAMLRedirectUrl(url, params) {
+	const searchParams = new URLSearchParams(params);
+	try {
+		const isRelativePath = url.startsWith("/") && !url.startsWith("//");
+		const parsedUrl = new URL(url, "http://better-auth.local");
+		for (const [key, value] of searchParams) parsedUrl.searchParams.set(key, value);
+		if (isRelativePath) return `${parsedUrl.pathname}${parsedUrl.search}${parsedUrl.hash}`;
+		return parsedUrl.toString();
+	} catch {
+		const hashIndex = url.indexOf("#");
+		const urlWithoutFragment = hashIndex === -1 ? url : url.slice(0, hashIndex);
+		const fragment = hashIndex === -1 ? "" : url.slice(hashIndex);
+		return `${urlWithoutFragment}${urlWithoutFragment.includes("?") ? "&" : "?"}${searchParams.toString()}${fragment}`;
+	}
+}
+function toArray(value) {
+	if (Array.isArray(value)) return value;
+	return value ? [value] : [];
+}
+function getExpectedSAMLRecipients(config, baseURL, providerId, currentCallbackPath, assertionConsumerServiceUrl) {
+	const configuredPostAssertionConsumerServiceUrls = getSAMLPostAssertionConsumerServiceUrls(config.spMetadata?.metadata);
+	return [
+		currentCallbackPath,
+		`${baseURL}/sso/saml2/sp/acs/${providerId}`,
+		...configuredPostAssertionConsumerServiceUrls,
+		...toArray(assertionConsumerServiceUrl)
+	];
+}
+async function getSAMLResponseBindingContent(sp, samlContent) {
+	if (!hasSAMLEncryptedAssertion(samlContent)) return samlContent;
+	const [decryptedContent] = await saml.SamlLib.decryptAssertion(sp, samlContent);
+	return decryptedContent;
+}
 /**
 * Extracts the Assertion ID from a SAML response XML.
 * Used for replay protection per SAML 2.0 Core section 2.3.3.
@@ -1694,8 +2280,8 @@ function extractAssertionId(samlContent) {
 /**
 * Unified SAML response processing pipeline.
 *
-* Both `/sso/saml2/callback/:providerId` (POST) and `/sso/saml2/sp/acs/:providerId`
-* delegate to this function. It handles the full lifecycle: provider lookup,
+* The `/sso/saml2/sp/acs/:providerId` endpoint delegates to this function.
+* It handles the full lifecycle: provider lookup,
 * SP/IdP construction, response validation, session creation, and redirect
 * URL computation.
 */
@@ -1716,7 +2302,7 @@ async function processSAMLResponse(ctx, params, options) {
 	if (options?.domainVerification?.enabled && !("domainVerified" in provider && provider.domainVerified)) throw new APIError("UNAUTHORIZED", { message: "Provider domain has not been verified" });
 	const parsedSamlConfig = typeof provider.samlConfig === "object" ? provider.samlConfig : safeJsonParse(provider.samlConfig);
 	if (!parsedSamlConfig) throw new APIError("BAD_REQUEST", { message: "Invalid SAML configuration" });
-	const sp = createSP(parsedSamlConfig, ctx.context.baseURL, providerId);
+	const sp = createSP(parsedSamlConfig, ctx.context.baseURL, providerId, { clockSkew: options?.saml?.clockSkew });
 	const idp = createIdP(parsedSamlConfig);
 	const samlRedirectUrl = getSafeRedirectUrl(relayState?.callbackURL || parsedSamlConfig.callbackUrl, params.currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
 	validateSingleAssertion(SAMLResponse);
@@ -1738,12 +2324,47 @@ async function processSAMLResponse(ctx, params, options) {
 		});
 	}
 	const { extract } = parsedResponse;
+	const samlContent = parsedResponse.samlContent;
 	validateSAMLAlgorithms(parsedResponse, options?.saml?.algorithms);
 	validateSAMLTimestamp(extract.conditions, {
 		clockSkew: options?.saml?.clockSkew,
 		requireTimestamps: options?.saml?.requireTimestamps,
 		logger: ctx.context.logger
 	});
+	const expectedAudiences = [sp.entityMeta.getEntityID(), parsedSamlConfig.audience];
+	const assertionConsumerServiceUrl = sp.entityMeta.getAssertionConsumerService(SAML_HTTP_POST_BINDING);
+	const expectedRecipients = getExpectedSAMLRecipients(parsedSamlConfig, ctx.context.baseURL, providerId, currentCallbackPath, assertionConsumerServiceUrl);
+	let samlBindingContent;
+	try {
+		samlBindingContent = await getSAMLResponseBindingContent(sp, samlContent);
+		validateSAMLResponseBinding(samlBindingContent, {
+			expectedAudiences,
+			expectedRecipients
+		});
+	} catch (error) {
+		if (isAPIError(error)) {
+			ctx.context.logger.error("SAML response binding validation failed", {
+				providerId,
+				code: error.body?.code,
+				expectedAudiences: expectedAudiences.filter(Boolean),
+				expectedRecipients: expectedRecipients.filter(Boolean)
+			});
+			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+				error: "invalid_saml_response",
+				error_description: error.body?.message || error.message || "Invalid SAML response"
+			}));
+		}
+		ctx.context.logger.error("SAML response binding validation failed", {
+			providerId,
+			error,
+			expectedAudiences: expectedAudiences.filter(Boolean),
+			expectedRecipients: expectedRecipients.filter(Boolean)
+		});
+		throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+			error: "invalid_saml_response",
+			error_description: "SAML response binding could not be validated"
+		}));
+	}
 	await validateInResponseTo(ctx, {
 		extract,
 		providerId,
@@ -1755,37 +2376,18 @@ async function processSAMLResponse(ctx, params, options) {
 	});
 	validateAudience(ctx, {
 		extract,
-		expectedAudience: parsedSamlConfig.audience,
+		expectedAudience: parsedSamlConfig.audience || sp.entityMeta.getEntityID(),
 		providerId,
 		redirectUrl: samlRedirectUrl
 	});
-	const samlContent = parsedResponse.samlContent;
-	const assertionId = samlContent ? extractAssertionId(samlContent) : null;
+	const assertionId = extractAssertionId(samlBindingContent);
 	if (assertionId) {
 		const issuer = idp.entityMeta.getEntityID();
 		const conditions = extract.conditions;
 		const clockSkew = options?.saml?.clockSkew ?? 3e5;
 		const expiresAt = conditions?.notOnOrAfter ? new Date(conditions.notOnOrAfter).getTime() + clockSkew : Date.now() + DEFAULT_ASSERTION_TTL_MS;
-		const existingAssertion = await ctx.context.internalAdapter.findVerificationValue(`${USED_ASSERTION_KEY_PREFIX}${assertionId}`);
-		let isReplay = false;
-		if (existingAssertion) try {
-			if (JSON.parse(existingAssertion.value).expiresAt >= Date.now()) isReplay = true;
-		} catch (error) {
-			ctx.context.logger.warn("Failed to parse stored assertion record", {
-				assertionId,
-				error
-			});
-		}
-		if (isReplay) {
-			ctx.context.logger.error("SAML assertion replay detected: assertion ID already used", {
-				assertionId,
-				issuer,
-				providerId
-			});
-			throw ctx.redirect(`${samlRedirectUrl}?error=replay_detected&error_description=SAML+assertion+has+already+been+used`);
-		}
-		await ctx.context.internalAdapter.createVerificationValue({
-			identifier: `${USED_ASSERTION_KEY_PREFIX}${assertionId}`,
+		if (!await ctx.context.internalAdapter.reserveVerificationValue({
+			identifier: `saml-used-assertion:${assertionId}`,
 			value: JSON.stringify({
 				assertionId,
 				issuer,
@@ -1794,16 +2396,30 @@ async function processSAMLResponse(ctx, params, options) {
 				expiresAt
 			}),
 			expiresAt: new Date(expiresAt)
-		});
+		})) {
+			ctx.context.logger.error("SAML assertion replay detected: assertion ID already used", {
+				assertionId,
+				issuer,
+				providerId
+			});
+			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+				error: "replay_detected",
+				error_description: "SAML assertion has already been used"
+			}));
+		}
 	} else ctx.context.logger.warn("Could not extract assertion ID for replay protection", { providerId });
 	const attributes = extract.attributes || {};
 	const mapping = parsedSamlConfig.mapping ?? {};
+	const attr = (key) => {
+		const value = attributes[key];
+		return Array.isArray(value) ? value[0] : value;
+	};
 	const userInfo = {
 		...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, attributes[value]])),
-		id: attributes[mapping.id || "nameID"] || extract.nameID,
-		email: (attributes[mapping.email || "email"] || extract.nameID || "").toLowerCase(),
-		name: [attributes[mapping.firstName || "givenName"], attributes[mapping.lastName || "surname"]].filter(Boolean).join(" ") || attributes[mapping.name || "displayName"] || extract.nameID,
-		emailVerified: options?.trustEmailVerified && mapping.emailVerified ? attributes[mapping.emailVerified] || false : false
+		id: attr(mapping.id || "nameID") || extract.nameID,
+		email: (attr(mapping.email || "email") || extract.nameID || "").toLowerCase(),
+		name: [attr(mapping.firstName || "givenName"), attr(mapping.lastName || "surname")].filter(Boolean).join(" ") || attr(mapping.name || "displayName") || extract.nameID,
+		emailVerified: options?.trustEmailVerified && mapping.emailVerified ? parseProviderEmailVerified(attr(mapping.emailVerified)) : false
 	};
 	if (!userInfo.id || !userInfo.email) {
 		ctx.context.logger.error("Missing essential user info from SAML response", {
@@ -1814,26 +2430,47 @@ async function processSAMLResponse(ctx, params, options) {
 		});
 		throw new APIError("BAD_REQUEST", { message: "Unable to extract user ID or email from SAML response" });
 	}
-	const isTrustedProvider = ctx.context.trustedProviders.includes(providerId) || "domainVerified" in provider && !!provider.domainVerified && validateEmailDomain(userInfo.email, provider.domain);
+	const isTrustedProvider = "domainVerified" in provider && !!provider.domainVerified && validateEmailDomain(userInfo.email, provider.domain);
 	const callbackUrl = relayState?.callbackURL || parsedSamlConfig.callbackUrl || ctx.context.baseURL;
-	const result = await handleOAuthUserInfo(ctx, {
-		userInfo: {
-			email: userInfo.email,
-			name: userInfo.name || userInfo.email,
-			id: userInfo.id,
-			emailVerified: Boolean(userInfo.emailVerified)
-		},
-		account: {
-			providerId,
-			accountId: userInfo.id,
-			accessToken: "",
-			refreshToken: ""
-		},
-		callbackURL: callbackUrl,
-		disableSignUp: options?.disableImplicitSignUp,
-		isTrustedProvider
-	});
-	if (result.error) throw ctx.redirect(`${samlRedirectUrl}?error=${result.error.split(" ").join("_")}`);
+	const errorUrl = relayState?.errorURL || samlRedirectUrl;
+	let result;
+	try {
+		result = await runWithTransaction(ctx.context.adapter, async () => {
+			await lockSSOProviderForAccountLink(ctx, provider);
+			return handleOAuthUserInfo(ctx, {
+				userInfo: {
+					email: userInfo.email,
+					name: userInfo.name || userInfo.email,
+					id: userInfo.id,
+					emailVerified: userInfo.emailVerified
+				},
+				account: {
+					providerId,
+					accountId: userInfo.id,
+					accessToken: "",
+					refreshToken: ""
+				},
+				callbackURL: callbackUrl,
+				disableSignUp: options?.disableImplicitSignUp,
+				source: {
+					method: "sso-saml",
+					sso: {
+						providerId,
+						profile: attributes
+					}
+				},
+				isTrustedProvider,
+				trustProviderByName: false
+			});
+		});
+	} catch (e) {
+		if (isAPIError(e) && e.body?.code) throw ctx.redirect(buildSAMLRedirectUrl(errorUrl, {
+			error: e.body.code,
+			...e.body.message ? { error_description: e.body.message } : {}
+		}));
+		throw e;
+	}
+	if (result.error) throw ctx.redirect(buildSAMLRedirectUrl(callbackUrl, { error: result.error.split(" ").join("_") }));
 	const { session, user } = result.data;
 	if (options?.provisionUser && (result.isRegister || options.provisionUserOnEveryLogin)) await options.provisionUser({
 		user,
@@ -1847,7 +2484,7 @@ async function processSAMLResponse(ctx, params, options) {
 			providerId,
 			accountId: userInfo.id,
 			email: userInfo.email,
-			emailVerified: Boolean(userInfo.emailVerified),
+			emailVerified: userInfo.emailVerified,
 			rawAttributes: attributes
 		},
 		provider,
@@ -1861,6 +2498,7 @@ async function processSAMLResponse(ctx, params, options) {
 		const samlSessionKey = `${SAML_SESSION_KEY_PREFIX}${providerId}:${extract.nameID}`;
 		const samlSessionData = {
 			sessionId: session.id,
+			sessionToken: session.token,
 			providerId,
 			nameID: extract.nameID,
 			sessionIndex: extract.sessionIndex?.sessionIndex
@@ -1880,6 +2518,14 @@ async function processSAMLResponse(ctx, params, options) {
 }
 //#endregion
 //#region src/routes/sso.ts
+const BUILT_IN_ACCOUNT_PROVIDER_IDS = [
+	"credential",
+	"email-otp",
+	"magic-link",
+	"phone-number",
+	"anonymous",
+	"siwe"
+];
 /**
 * Builds the OIDC redirect URI. Uses the shared `redirectURI` option
 * when set, otherwise falls back to `/sso/callback/:providerId`.
@@ -1893,10 +2539,7 @@ function getOIDCRedirectURI(baseURL, providerId, options) {
 	}
 	return `${baseURL}/sso/callback/${providerId}`;
 }
-const spMetadataQuerySchema = z.object({
-	providerId: z.string(),
-	format: z.enum(["xml", "json"]).default("xml")
-});
+const spMetadataQuerySchema = z.object({ providerId: z.string() });
 const spMetadata = (options) => {
 	return createAuthEndpoint("/sso/saml2/sp/metadata", {
 		method: "GET",
@@ -1908,290 +2551,191 @@ const spMetadata = (options) => {
 			responses: { "200": { description: "SAML metadata in XML format" } }
 		} }
 	}, async (ctx) => {
-		const provider = await ctx.context.adapter.findOne({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: ctx.query.providerId
-			}]
-		});
+		const provider = await findSAMLProvider(ctx.query.providerId, options, ctx.context.adapter);
 		if (!provider) throw new APIError("NOT_FOUND", { message: "No provider found for the given providerId" });
-		const parsedSamlConfig = safeJsonParse(provider.samlConfig);
+		const parsedSamlConfig = provider.samlConfig;
 		if (!parsedSamlConfig) throw new APIError("BAD_REQUEST", { message: "Invalid SAML configuration" });
-		const sloLocation = `${ctx.context.baseURL}/sso/saml2/sp/slo/${ctx.query.providerId}`;
-		const singleLogoutService = options?.saml?.enableSingleLogout ? [{
-			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
-			Location: sloLocation
-		}, {
-			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
-			Location: sloLocation
-		}] : void 0;
-		const sp = parsedSamlConfig.spMetadata.metadata ? saml.ServiceProvider({ metadata: parsedSamlConfig.spMetadata.metadata }) : saml.SPMetadata({
-			entityID: parsedSamlConfig.spMetadata?.entityID || parsedSamlConfig.issuer,
-			assertionConsumerService: [{
-				Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
-				Location: parsedSamlConfig.callbackUrl || `${ctx.context.baseURL}/sso/saml2/sp/acs/${ctx.query.providerId}`
-			}],
-			singleLogoutService,
-			wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
-			authnRequestsSigned: parsedSamlConfig.authnRequestsSigned || false,
-			nameIDFormat: parsedSamlConfig.identifierFormat ? [parsedSamlConfig.identifierFormat] : void 0
-		});
+		const sp = createSP(parsedSamlConfig, ctx.context.baseURL, ctx.query.providerId, options?.saml?.enableSingleLogout ? { sloOptions: {
+			wantLogoutRequestSigned: options?.saml?.wantLogoutRequestSigned,
+			wantLogoutResponseSigned: options?.saml?.wantLogoutResponseSigned
+		} } : void 0);
 		return new Response(sp.getMetadata(), { headers: { "Content-Type": "application/xml" } });
 	});
 };
-const ssoProviderBodySchema = z.object({
-	providerId: z.string({}).meta({ description: "The ID of the provider. This is used to identify the provider during login and callback" }),
-	issuer: z.string({}).meta({ description: "The issuer of the provider" }),
-	domain: z.string({}).meta({ description: "The domain(s) of the provider. For enterprise multi-domain SSO where a single IdP serves multiple email domains, use comma-separated values (e.g., 'company.com,subsidiary.com,acquired-company.com')" }),
-	oidcConfig: z.object({
-		clientId: z.string({}).meta({ description: "The client ID" }),
-		clientSecret: z.string({}).optional().meta({ description: "The client secret. Required for client_secret_basic/client_secret_post. Optional for private_key_jwt." }),
-		authorizationEndpoint: z.string({}).meta({ description: "The authorization endpoint" }).optional(),
-		tokenEndpoint: z.string({}).meta({ description: "The token endpoint" }).optional(),
-		userInfoEndpoint: z.string({}).meta({ description: "The user info endpoint" }).optional(),
-		tokenEndpointAuthentication: z.enum([
-			"client_secret_post",
-			"client_secret_basic",
-			"private_key_jwt"
-		]).optional(),
-		privateKeyId: z.string().optional(),
-		privateKeyAlgorithm: z.string().optional(),
-		jwksEndpoint: z.string({}).meta({ description: "The JWKS endpoint" }).optional(),
-		discoveryEndpoint: z.string().optional(),
-		skipDiscovery: z.boolean().meta({ description: "Skip OIDC discovery during registration. When true, you must provide authorizationEndpoint, tokenEndpoint, and jwksEndpoint manually." }).optional(),
-		scopes: z.array(z.string(), {}).meta({ description: "The scopes to request. Defaults to ['openid', 'email', 'profile', 'offline_access']" }).optional(),
-		pkce: z.boolean({}).meta({ description: "Whether to use PKCE for the authorization flow" }).default(true).optional(),
-		mapping: z.object({
-			id: z.string({}).meta({ description: "Field mapping for user ID (defaults to 'sub')" }),
-			email: z.string({}).meta({ description: "Field mapping for email (defaults to 'email')" }),
-			emailVerified: z.string({}).meta({ description: "Field mapping for email verification (defaults to 'email_verified')" }).optional(),
-			name: z.string({}).meta({ description: "Field mapping for name (defaults to 'name')" }),
-			image: z.string({}).meta({ description: "Field mapping for image (defaults to 'picture')" }).optional(),
-			extraFields: z.record(z.string(), z.any()).optional()
-		}).optional()
-	}).optional(),
-	samlConfig: z.object({
-		entryPoint: z.string({}).meta({ description: "The entry point of the provider" }),
-		cert: z.string({}).meta({ description: "The certificate of the provider" }),
-		callbackUrl: z.string({}).meta({ description: "The callback URL of the provider" }),
-		audience: z.string().optional(),
-		idpMetadata: z.object({
-			metadata: z.string().optional(),
-			entityID: z.string().optional(),
-			cert: z.string().optional(),
-			privateKey: z.string().optional(),
-			privateKeyPass: z.string().optional(),
-			isAssertionEncrypted: z.boolean().optional(),
-			encPrivateKey: z.string().optional(),
-			encPrivateKeyPass: z.string().optional(),
-			singleSignOnService: z.array(z.object({
-				Binding: z.string().meta({ description: "The binding type for the SSO service" }),
-				Location: z.string().meta({ description: "The URL for the SSO service" })
-			})).optional().meta({ description: "Single Sign-On service configuration" })
-		}).optional(),
-		spMetadata: z.object({
-			metadata: z.string().optional(),
-			entityID: z.string().optional(),
-			binding: z.string().optional(),
-			privateKey: z.string().optional(),
-			privateKeyPass: z.string().optional(),
-			isAssertionEncrypted: z.boolean().optional(),
-			encPrivateKey: z.string().optional(),
-			encPrivateKeyPass: z.string().optional()
-		}),
-		wantAssertionsSigned: z.boolean().optional(),
-		authnRequestsSigned: z.boolean().optional(),
-		signatureAlgorithm: z.string().optional(),
-		digestAlgorithm: z.string().optional(),
-		identifierFormat: z.string().optional(),
-		privateKey: z.string().optional(),
-		decryptionPvk: z.string().optional(),
-		additionalParams: z.record(z.string(), z.any()).optional(),
-		mapping: z.object({
-			id: z.string({}).meta({ description: "Field mapping for user ID (defaults to 'nameID')" }),
-			email: z.string({}).meta({ description: "Field mapping for email (defaults to 'email')" }),
-			emailVerified: z.string({}).meta({ description: "Field mapping for email verification" }).optional(),
-			name: z.string({}).meta({ description: "Field mapping for name (defaults to 'displayName')" }),
-			firstName: z.string({}).meta({ description: "Field mapping for first name (defaults to 'givenName')" }).optional(),
-			lastName: z.string({}).meta({ description: "Field mapping for last name (defaults to 'surname')" }).optional(),
-			extraFields: z.record(z.string(), z.any()).optional()
-		}).optional()
-	}).optional(),
-	organizationId: z.string({}).meta({ description: "If organization plugin is enabled, the organization id to link the provider to" }).optional(),
-	overrideUserInfo: z.boolean({}).meta({ description: "Override user info with the provider info. Defaults to false" }).default(false).optional()
-});
 const registerSSOProvider = (options) => {
 	return createAuthEndpoint("/sso/register", {
 		method: "POST",
-		body: ssoProviderBodySchema,
+		body: getRegisterSSOProviderBodySchema(options),
 		use: [sessionMiddleware],
-		metadata: { openapi: {
-			operationId: "registerSSOProvider",
-			summary: "Register an OIDC provider",
-			description: "This endpoint is used to register an OIDC provider. This is used to configure the provider and link it to an organization",
-			responses: { "200": {
-				description: "OIDC provider created successfully",
-				content: { "application/json": { schema: {
-					type: "object",
-					properties: {
-						issuer: {
-							type: "string",
-							format: "uri",
-							description: "The issuer URL of the provider"
-						},
-						domain: {
-							type: "string",
-							description: "The domain of the provider, used for email matching"
-						},
-						domainVerified: {
-							type: "boolean",
-							description: "A boolean indicating whether the domain has been verified or not"
-						},
-						domainVerificationToken: {
-							type: "string",
-							description: "Domain verification token. It can be used to prove ownership over the SSO domain"
-						},
-						oidcConfig: {
-							type: "object",
-							properties: {
-								issuer: {
-									type: "string",
-									format: "uri",
-									description: "The issuer URL of the provider"
-								},
-								pkce: {
-									type: "boolean",
-									description: "Whether PKCE is enabled for the authorization flow"
-								},
-								clientId: {
-									type: "string",
-									description: "The client ID for the provider"
-								},
-								clientSecret: {
-									type: "string",
-									description: "The client secret for the provider"
-								},
-								authorizationEndpoint: {
-									type: "string",
-									format: "uri",
-									nullable: true,
-									description: "The authorization endpoint URL"
-								},
-								discoveryEndpoint: {
-									type: "string",
-									format: "uri",
-									description: "The discovery endpoint URL"
-								},
-								userInfoEndpoint: {
-									type: "string",
-									format: "uri",
-									nullable: true,
-									description: "The user info endpoint URL"
-								},
-								scopes: {
-									type: "array",
-									items: { type: "string" },
-									nullable: true,
-									description: "The scopes requested from the provider"
-								},
-								tokenEndpoint: {
-									type: "string",
-									format: "uri",
-									nullable: true,
-									description: "The token endpoint URL"
-								},
-								tokenEndpointAuthentication: {
-									type: "string",
-									enum: ["client_secret_post", "client_secret_basic"],
-									nullable: true,
-									description: "Authentication method for the token endpoint"
-								},
-								jwksEndpoint: {
-									type: "string",
-									format: "uri",
-									nullable: true,
-									description: "The JWKS endpoint URL"
-								},
-								mapping: {
-									type: "object",
-									nullable: true,
-									properties: {
-										id: {
-											type: "string",
-											description: "Field mapping for user ID (defaults to 'sub')"
-										},
-										email: {
-											type: "string",
-											description: "Field mapping for email (defaults to 'email')"
-										},
-										emailVerified: {
-											type: "string",
-											nullable: true,
-											description: "Field mapping for email verification (defaults to 'email_verified')"
-										},
-										name: {
-											type: "string",
-											description: "Field mapping for name (defaults to 'name')"
-										},
-										image: {
-											type: "string",
-											nullable: true,
-											description: "Field mapping for image (defaults to 'picture')"
-										},
-										extraFields: {
-											type: "object",
-											additionalProperties: { type: "string" },
-											nullable: true,
-											description: "Additional field mappings"
-										}
+		metadata: {
+			$Infer: { body: {} },
+			openapi: {
+				operationId: "registerSSOProvider",
+				summary: "Register an OIDC provider",
+				description: "This endpoint is used to register an OIDC provider. This is used to configure the provider and link it to an organization",
+				responses: { "200": {
+					description: "OIDC provider created successfully",
+					content: { "application/json": { schema: {
+						type: "object",
+						properties: {
+							issuer: {
+								type: "string",
+								format: "uri",
+								description: "The issuer URL of the provider"
+							},
+							domain: {
+								type: "string",
+								description: "The domain of the provider, used for email matching"
+							},
+							domainVerified: {
+								type: "boolean",
+								description: "A boolean indicating whether the domain has been verified or not"
+							},
+							domainVerificationToken: {
+								type: "string",
+								description: "Domain verification token. It can be used to prove ownership over the SSO domain"
+							},
+							oidcConfig: {
+								type: "object",
+								properties: {
+									issuer: {
+										type: "string",
+										format: "uri",
+										description: "The issuer URL of the provider"
+									},
+									pkce: {
+										type: "boolean",
+										description: "Whether PKCE is enabled for the authorization flow"
+									},
+									clientId: {
+										type: "string",
+										description: "The client ID for the provider"
+									},
+									clientSecret: {
+										type: "string",
+										description: "The client secret for the provider"
+									},
+									authorizationEndpoint: {
+										type: "string",
+										format: "uri",
+										nullable: true,
+										description: "The authorization endpoint URL"
+									},
+									discoveryEndpoint: {
+										type: "string",
+										format: "uri",
+										description: "The discovery endpoint URL"
+									},
+									userInfoEndpoint: {
+										type: "string",
+										format: "uri",
+										nullable: true,
+										description: "The user info endpoint URL"
 									},
-									required: [
-										"id",
-										"email",
-										"name"
-									]
-								}
+									scopes: {
+										type: "array",
+										items: { type: "string" },
+										nullable: true,
+										description: "The scopes requested from the provider"
+									},
+									tokenEndpoint: {
+										type: "string",
+										format: "uri",
+										nullable: true,
+										description: "The token endpoint URL"
+									},
+									tokenEndpointAuthentication: {
+										type: "string",
+										enum: ["client_secret_post", "client_secret_basic"],
+										nullable: true,
+										description: "Authentication method for the token endpoint"
+									},
+									jwksEndpoint: {
+										type: "string",
+										format: "uri",
+										nullable: true,
+										description: "The JWKS endpoint URL"
+									},
+									mapping: {
+										type: "object",
+										nullable: true,
+										properties: {
+											id: {
+												type: "string",
+												description: "Field mapping for user ID (defaults to 'sub')"
+											},
+											email: {
+												type: "string",
+												description: "Field mapping for email (defaults to 'email')"
+											},
+											emailVerified: {
+												type: "string",
+												nullable: true,
+												description: "Field mapping for email verification (defaults to 'email_verified')"
+											},
+											name: {
+												type: "string",
+												description: "Field mapping for name (defaults to 'name')"
+											},
+											image: {
+												type: "string",
+												nullable: true,
+												description: "Field mapping for image (defaults to 'picture')"
+											},
+											extraFields: {
+												type: "object",
+												additionalProperties: { type: "string" },
+												nullable: true,
+												description: "Additional field mappings"
+											}
+										},
+										required: [
+											"id",
+											"email",
+											"name"
+										]
+									}
+								},
+								required: [
+									"issuer",
+									"pkce",
+									"clientId",
+									"clientSecret",
+									"discoveryEndpoint"
+								],
+								description: "OIDC configuration for the provider"
 							},
-							required: [
-								"issuer",
-								"pkce",
-								"clientId",
-								"clientSecret",
-								"discoveryEndpoint"
-							],
-							description: "OIDC configuration for the provider"
-						},
-						organizationId: {
-							type: "string",
-							nullable: true,
-							description: "ID of the linked organization, if any"
-						},
-						userId: {
-							type: "string",
-							description: "ID of the user who registered the provider"
-						},
-						providerId: {
-							type: "string",
-							description: "Unique identifier for the provider"
+							organizationId: {
+								type: "string",
+								nullable: true,
+								description: "ID of the linked organization, if any"
+							},
+							userId: {
+								type: "string",
+								description: "ID of the user who registered the provider"
+							},
+							providerId: {
+								type: "string",
+								description: "Unique identifier for the provider"
+							},
+							redirectURI: {
+								type: "string",
+								format: "uri",
+								description: "The redirect URI for the provider callback"
+							}
 						},
-						redirectURI: {
-							type: "string",
-							format: "uri",
-							description: "The redirect URI for the provider callback"
-						}
-					},
-					required: [
-						"issuer",
-						"domain",
-						"oidcConfig",
-						"userId",
-						"providerId",
-						"redirectURI"
-					]
-				} } }
-			} }
-		} }
+						required: [
+							"issuer",
+							"domain",
+							"oidcConfig",
+							"userId",
+							"providerId",
+							"redirectURI"
+						]
+					} } }
+				} }
+			}
+		}
 	}, async (ctx) => {
 		const user = ctx.context.session?.user;
 		if (!user) throw new APIError("UNAUTHORIZED");
@@ -2205,13 +2749,13 @@ const registerSSOProvider = (options) => {
 			}]
 		})).length >= limit) throw new APIError("FORBIDDEN", { message: "You have reached the maximum number of SSO providers" });
 		const body = ctx.body;
-		if (z.string().url().safeParse(body.issuer).error) throw new APIError("BAD_REQUEST", { message: "Invalid issuer. Must be a valid URL" });
+		const additionalFields = parseSSOProviderAdditionalFields(options, body, "create");
 		if (body.samlConfig?.idpMetadata?.metadata) {
 			const maxMetadataSize = options?.saml?.maxMetadataSize ?? 102400;
 			if (new TextEncoder().encode(body.samlConfig.idpMetadata.metadata).length > maxMetadataSize) throw new APIError("BAD_REQUEST", { message: `IdP metadata exceeds maximum allowed size (${maxMetadataSize} bytes)` });
 		}
 		if (ctx.body.organizationId) {
-			if (!await ctx.context.adapter.findOne({
+			const member = await ctx.context.adapter.findOne({
 				model: "member",
 				where: [{
 					field: "userId",
@@ -2220,7 +2764,31 @@ const registerSSOProvider = (options) => {
 					field: "organizationId",
 					value: ctx.body.organizationId
 				}]
-			})) throw new APIError("BAD_REQUEST", { message: "You are not a member of the organization" });
+			});
+			if (!member) throw new APIError("BAD_REQUEST", { message: "You are not a member of the organization" });
+			if (ctx.context.hasPlugin("organization") && !hasOrgAdminRole(member)) throw new APIError("FORBIDDEN", { message: "You must be an organization owner or admin to register SSO providers" });
+		}
+		if (new Set([
+			...BUILT_IN_ACCOUNT_PROVIDER_IDS,
+			...Object.keys(ctx.context.options.socialProviders ?? {}),
+			...ctx.context.socialProviders.map((p) => p.id),
+			...ctx.context.trustedProviders,
+			...options?.defaultSSO?.map((p) => p.providerId) ?? []
+		]).has(body.providerId)) {
+			ctx.context.logger.warn(`SSO provider registration rejected for reserved providerId: ${body.providerId}`);
+			throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is reserved and cannot be used for an SSO provider" });
+		}
+		if (ctx.context.hasPlugin("scim")) {
+			if (await ctx.context.adapter.findOne({
+				model: "scimProvider",
+				where: [{
+					field: "providerId",
+					value: body.providerId
+				}]
+			})) {
+				ctx.context.logger.warn(`SSO provider registration rejected for SCIM providerId: ${body.providerId}`);
+				throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is already used by a SCIM provider and cannot be used for an SSO provider" });
+			}
 		}
 		if (await ctx.context.adapter.findOne({
 			model: "ssoProvider",
@@ -2232,6 +2800,12 @@ const registerSSOProvider = (options) => {
 			ctx.context.logger.info(`SSO provider creation attempt with existing providerId: ${body.providerId}`);
 			throw new APIError("UNPROCESSABLE_ENTITY", { message: "SSO provider with this providerId already exists" });
 		}
+		if (body.oidcConfig) try {
+			validateOIDCEndpointUrls(body.oidcConfig, (url) => ctx.context.isTrustedOrigin(url));
+		} catch (error) {
+			if (error instanceof DiscoveryError) throw mapDiscoveryErrorToAPIError(error);
+			throw error;
+		}
 		let hydratedOIDCConfig = null;
 		if (body.oidcConfig && !body.oidcConfig.skipDiscovery) try {
 			hydratedOIDCConfig = await discoverOIDCConfig({
@@ -2293,6 +2867,7 @@ const registerSSOProvider = (options) => {
 				signatureAlgorithm: body.samlConfig.signatureAlgorithm,
 				digestAlgorithm: body.samlConfig.digestAlgorithm
 			}, options?.saml?.algorithms);
+			validateCertSources(body.samlConfig);
 			const hasIdpMetadata = body.samlConfig.idpMetadata?.metadata;
 			let hasEntryPoint = false;
 			if (body.samlConfig.entryPoint) try {
@@ -2308,6 +2883,7 @@ const registerSSOProvider = (options) => {
 				issuer: body.issuer,
 				domain: body.domain,
 				domainVerified: false,
+				...additionalFields,
 				oidcConfig: (() => {
 					const config = buildOIDCConfig();
 					if (config) {
@@ -2321,8 +2897,8 @@ const registerSSOProvider = (options) => {
 					issuer: body.issuer,
 					entryPoint: body.samlConfig.entryPoint,
 					cert: body.samlConfig.cert,
-					callbackUrl: body.samlConfig.callbackUrl,
 					audience: body.samlConfig.audience,
+					callbackUrl: body.samlConfig.callbackUrl,
 					idpMetadata: body.samlConfig.idpMetadata,
 					spMetadata: body.samlConfig.spMetadata,
 					wantAssertionsSigned: body.samlConfig.wantAssertionsSigned,
@@ -2331,8 +2907,6 @@ const registerSSOProvider = (options) => {
 					digestAlgorithm: body.samlConfig.digestAlgorithm,
 					identifierFormat: body.samlConfig.identifierFormat,
 					privateKey: body.samlConfig.privateKey,
-					decryptionPvk: body.samlConfig.decryptionPvk,
-					additionalParams: body.samlConfig.additionalParams,
 					mapping: body.samlConfig.mapping
 				}) : null,
 				organizationId: body.organizationId,
@@ -2352,7 +2926,7 @@ const registerSSOProvider = (options) => {
 			});
 		}
 		const result = {
-			...provider,
+			...filterSSOProviderAdditionalFields(provider, options),
 			oidcConfig: safeJsonParse(provider.oidcConfig),
 			samlConfig: safeJsonParse(provider.samlConfig),
 			redirectURI: getOIDCRedirectURI(ctx.context.baseURL, provider.providerId, options),
@@ -2363,17 +2937,18 @@ const registerSSOProvider = (options) => {
 	});
 };
 const signInSSOBodySchema = z.object({
-	email: z.string({}).meta({ description: "The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided" }).optional(),
-	organizationSlug: z.string({}).meta({ description: "The slug of the organization to sign in with" }).optional(),
-	providerId: z.string({}).meta({ description: "The ID of the provider to sign in with. This can be provided instead of email or issuer" }).optional(),
-	domain: z.string({}).meta({ description: "The domain of the provider." }).optional(),
-	callbackURL: z.string({}).meta({ description: "The URL to redirect to after login" }),
-	errorCallbackURL: z.string({}).meta({ description: "The URL to redirect to after login" }).optional(),
-	newUserCallbackURL: z.string({}).meta({ description: "The URL to redirect to after login if the user is new" }).optional(),
+	email: z.string({}).meta({ description: "The email address to sign in with. Used to resolve the provider via the email domain; optional if providerId, domain, or organizationSlug is provided." }).optional(),
+	organizationSlug: z.string({}).meta({ description: "The slug of the organization to sign in with." }).optional(),
+	providerId: z.string({}).meta({ description: "The ID of the provider to sign in with. Can be provided instead of email." }).optional(),
+	domain: z.string({}).meta({ description: "The email domain of the provider. Can be provided instead of email." }).optional(),
+	callbackURL: z.string({}).meta({ description: "The URL to redirect to after successful sign-in." }),
+	errorCallbackURL: z.string({}).meta({ description: "The URL to redirect to if the sign-in flow fails." }).optional(),
+	newUserCallbackURL: z.string({}).meta({ description: "The URL to redirect to after sign-in if the user is newly registered." }).optional(),
 	scopes: z.array(z.string(), {}).meta({ description: "Scopes to request from the provider." }).optional(),
-	loginHint: z.string({}).meta({ description: "Login hint to send to the identity provider (e.g., email or identifier). If supported, will be sent as 'login_hint'." }).optional(),
-	requestSignUp: z.boolean({}).meta({ description: "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider" }).optional(),
-	providerType: z.enum(["oidc", "saml"]).optional()
+	loginHint: z.string({}).meta({ description: "Login hint to send to the identity provider (e.g., email or identifier). If supported, sent as 'login_hint'." }).optional(),
+	additionalParams: additionalAuthorizationParamsSchema,
+	requestSignUp: z.boolean({}).meta({ description: "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider." }).optional(),
+	providerType: z.enum(["oidc", "saml"]).meta({ description: "The provider protocol to sign in with." }).optional()
 });
 const signInSSO = (options) => {
 	return createAuthEndpoint("/sign-in/sso", {
@@ -2388,31 +2963,54 @@ const signInSSO = (options) => {
 				properties: {
 					email: {
 						type: "string",
-						description: "The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided"
+						description: "The email address to sign in with. Used to resolve the provider via the email domain; optional if providerId, domain, or organizationSlug is provided."
 					},
-					issuer: {
+					organizationSlug: {
 						type: "string",
-						description: "The issuer identifier, this is the URL of the provider and can be used to verify the provider and identify the provider during login. It's optional if the email is provided"
+						description: "The slug of the organization to sign in with."
 					},
 					providerId: {
 						type: "string",
-						description: "The ID of the provider to sign in with. This can be provided instead of email or issuer"
+						description: "The ID of the provider to sign in with. Can be provided instead of email."
+					},
+					domain: {
+						type: "string",
+						description: "The email domain of the provider. Can be provided instead of email."
 					},
 					callbackURL: {
 						type: "string",
-						description: "The URL to redirect to after login"
+						description: "The URL to redirect to after successful sign-in."
 					},
 					errorCallbackURL: {
 						type: "string",
-						description: "The URL to redirect to after login"
+						description: "The URL to redirect to if the sign-in flow fails."
 					},
 					newUserCallbackURL: {
 						type: "string",
-						description: "The URL to redirect to after login if the user is new"
+						description: "The URL to redirect to after sign-in if the user is newly registered."
+					},
+					scopes: {
+						type: "array",
+						items: { type: "string" },
+						description: "Scopes to request from the provider."
 					},
 					loginHint: {
 						type: "string",
 						description: "Login hint to send to the identity provider (e.g., email or identifier). If supported, sent as 'login_hint'."
+					},
+					additionalParams: {
+						type: "object",
+						additionalProperties: { type: "string" },
+						description: "Extra query parameters to append to the OIDC provider authorization URL. RFC 6749 reserved keys (state, client_id, redirect_uri, response_type, code_challenge, code_challenge_method, scope) are rejected. Not supported for SAML providers."
+					},
+					requestSignUp: {
+						type: "boolean",
+						description: "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider."
+					},
+					providerType: {
+						type: "string",
+						enum: ["oidc", "saml"],
+						description: "The provider protocol to sign in with."
 					}
 				},
 				required: ["callbackURL"]
@@ -2455,7 +3053,7 @@ const signInSSO = (options) => {
 		});
 		let provider = null;
 		if (options?.defaultSSO?.length) {
-			const matchingDefault = providerId ? options.defaultSSO.find((defaultProvider) => defaultProvider.providerId === providerId) : options.defaultSSO.find((defaultProvider) => defaultProvider.domain === domain);
+			const matchingDefault = providerId ? options.defaultSSO.find((defaultProvider) => defaultProvider.providerId === providerId) : options.defaultSSO.find((defaultProvider) => domain && domainMatches(domain, defaultProvider.domain));
 			if (matchingDefault) provider = {
 				issuer: matchingDefault.samlConfig?.issuer || matchingDefault.oidcConfig?.issuer || "",
 				providerId: matchingDefault.providerId,
@@ -2509,7 +3107,8 @@ const signInSSO = (options) => {
 				throw error;
 			}
 			if (!config.authorizationEndpoint) throw new APIError("BAD_REQUEST", { message: "Invalid OIDC configuration. Authorization URL not found." });
-			const state = await generateState(ctx, void 0, options?.redirectURI?.trim() ? { ssoProviderId: provider.providerId } : false);
+			if (options?.redirectURI?.trim()) await addOAuthServerContext({ ssoProviderId: provider.providerId });
+			const state = await generateState(ctx);
 			const redirectURI = getOIDCRedirectURI(ctx.context.baseURL, provider.providerId, options);
 			const authorizationURL = await createAuthorizationURL({
 				id: provider.issuer,
@@ -2527,7 +3126,8 @@ const signInSSO = (options) => {
 					"offline_access"
 				],
 				loginHint: ctx.body.loginHint || email,
-				authorizationEndpoint: config.authorizationEndpoint
+				authorizationEndpoint: config.authorizationEndpoint,
+				additionalParams: ctx.body.additionalParams
 			});
 			return ctx.json({
 				url: authorizationURL.toString(),
@@ -2535,50 +3135,13 @@ const signInSSO = (options) => {
 			});
 		}
 		if (provider.samlConfig) {
+			if (ctx.body.additionalParams) throw new APIError("BAD_REQUEST", { message: "additionalParams is not supported for SAML providers; the SAML AuthnRequest is signed and cannot carry caller-supplied query parameters." });
 			const parsedSamlConfig = typeof provider.samlConfig === "object" ? provider.samlConfig : safeJsonParse(provider.samlConfig);
 			if (!parsedSamlConfig) throw new APIError("BAD_REQUEST", { message: "Invalid SAML configuration" });
 			if (parsedSamlConfig.authnRequestsSigned && !parsedSamlConfig.spMetadata?.privateKey && !parsedSamlConfig.privateKey) throw new APIError("BAD_REQUEST", { message: "authnRequestsSigned is enabled but no privateKey provided in spMetadata or samlConfig" });
-			const { state: relayState } = await generateRelayState(ctx, void 0, false);
-			let metadata = parsedSamlConfig.spMetadata.metadata;
-			if (!metadata) metadata = saml.SPMetadata({
-				entityID: parsedSamlConfig.spMetadata?.entityID || parsedSamlConfig.issuer,
-				assertionConsumerService: [{
-					Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
-					Location: parsedSamlConfig.callbackUrl || `${ctx.context.baseURL}/sso/saml2/sp/acs/${provider.providerId}`
-				}],
-				wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
-				authnRequestsSigned: parsedSamlConfig.authnRequestsSigned || false,
-				nameIDFormat: parsedSamlConfig.identifierFormat ? [parsedSamlConfig.identifierFormat] : void 0
-			}).getMetadata() || "";
-			const sp = saml.ServiceProvider({
-				metadata,
-				allowCreate: true,
-				privateKey: parsedSamlConfig.spMetadata?.privateKey || parsedSamlConfig.privateKey,
-				privateKeyPass: parsedSamlConfig.spMetadata?.privateKeyPass,
-				relayState
-			});
-			const idpData = parsedSamlConfig.idpMetadata;
-			let idp;
-			if (!idpData?.metadata) idp = saml.IdentityProvider({
-				entityID: idpData?.entityID || parsedSamlConfig.issuer,
-				singleSignOnService: idpData?.singleSignOnService || [{
-					Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
-					Location: parsedSamlConfig.entryPoint
-				}],
-				signingCert: idpData?.cert || parsedSamlConfig.cert,
-				wantAuthnRequestsSigned: parsedSamlConfig.authnRequestsSigned || false,
-				isAssertionEncrypted: idpData?.isAssertionEncrypted || false,
-				encPrivateKey: idpData?.encPrivateKey,
-				encPrivateKeyPass: idpData?.encPrivateKeyPass
-			});
-			else idp = saml.IdentityProvider({
-				metadata: idpData.metadata,
-				privateKey: idpData.privateKey,
-				privateKeyPass: idpData.privateKeyPass,
-				isAssertionEncrypted: idpData.isAssertionEncrypted,
-				encPrivateKey: idpData.encPrivateKey,
-				encPrivateKeyPass: idpData.encPrivateKeyPass
-			});
+			const { state: relayState } = await generateRelayState(ctx, void 0);
+			const sp = createSP(parsedSamlConfig, ctx.context.baseURL, provider.providerId, { relayState });
+			const idp = createIdP(parsedSamlConfig);
 			const loginRequest = sp.createLoginRequest(idp, "redirect");
 			if (!loginRequest) throw new APIError("BAD_REQUEST", { message: "Invalid SAML request" });
 			if (loginRequest.id && options?.saml?.enableInResponseToValidation !== false) {
@@ -2605,10 +3168,26 @@ const signInSSO = (options) => {
 };
 const callbackSSOQuerySchema = z.object({
 	code: z.string().optional(),
-	state: z.string(),
+	state: z.string().optional(),
 	error: z.string().optional(),
 	error_description: z.string().optional()
 });
+function getStringErrorField(value, field) {
+	if (!value || typeof value !== "object") return;
+	const fieldValue = value[field];
+	return typeof fieldValue === "string" && fieldValue.length > 0 ? fieldValue : void 0;
+}
+function getOIDCErrorDescription(error, fallback) {
+	const nestedError = error && typeof error === "object" ? error.error : void 0;
+	const description = getStringErrorField(nestedError, "error_description") || getStringErrorField(error, "error_description") || getStringErrorField(nestedError, "message") || getStringErrorField(error, "message") || getStringErrorField(error, "statusText") || getStringErrorField(nestedError, "error") || getStringErrorField(error, "error");
+	if (description) return description;
+	if (error && typeof error === "object") {
+		const status = error.status;
+		if (typeof status === "number") return `HTTP ${status}`;
+		if (typeof status === "string" && status.length > 0) return status;
+	}
+	return fallback;
+}
 /**
 * Core OIDC callback handler logic, shared between the per-provider and
 * shared callback endpoints. Resolves the provider, exchanges the
@@ -2625,30 +3204,17 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 		throw ctx.redirect(`${errorURL}?error=invalid_state`);
 	}
 	const { callbackURL, errorURL, newUserURL, requestSignUp } = stateData;
-	if (!code || error) throw ctx.redirect(`${errorURL || callbackURL}?error=${error}&error_description=${error_description}`);
-	let provider = null;
-	if (options?.defaultSSO?.length) {
-		const matchingDefault = options.defaultSSO.find((defaultProvider) => defaultProvider.providerId === providerId);
-		if (matchingDefault) provider = {
-			...matchingDefault,
-			issuer: matchingDefault.oidcConfig?.issuer || "",
-			userId: "default",
-			...options.domainVerification?.enabled ? { domainVerified: true } : {}
-		};
-	}
-	if (!provider) provider = await ctx.context.adapter.findOne({
-		model: "ssoProvider",
-		where: [{
-			field: "providerId",
-			value: providerId
-		}]
-	}).then((res) => {
-		if (!res) return null;
-		return {
-			...res,
-			oidcConfig: safeJsonParse(res.oidcConfig) || void 0
-		};
-	});
+	const redirectOIDCError = (error, description) => {
+		const baseURL = errorURL || callbackURL;
+		const params = new URLSearchParams({
+			error,
+			error_description: description
+		});
+		const separator = baseURL.includes("?") ? "&" : "?";
+		throw ctx.redirect(`${baseURL}${separator}${params.toString()}`);
+	};
+	if (!code || error) redirectOIDCError(error || "invalid_request", error_description || (error ? error : "authorization_code_not_found"));
+	const provider = await resolveOIDCProvider(ctx, options, providerId);
 	if (!provider) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=provider not found`);
 	if (options?.domainVerification?.enabled && !("domainVerified" in provider && provider.domainVerified)) throw new APIError("UNAUTHORIZED", { message: "Provider domain has not been verified" });
 	let config = provider.oidcConfig;
@@ -2669,11 +3235,9 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 		]
 	};
 	if (!config.tokenEndpoint) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=token_endpoint_not_found`);
-	let authMethod = "basic";
-	if (config.tokenEndpointAuthentication === "client_secret_post") authMethod = "post";
-	else if (config.tokenEndpointAuthentication === "private_key_jwt") authMethod = "private_key_jwt";
-	let clientAssertionConfig;
-	if (authMethod === "private_key_jwt") {
+	const tokenEndpoint = config.tokenEndpoint;
+	let tokenEndpointAuth = config.tokenEndpointAuthentication === "client_secret_post" ? { method: "client_secret_post" } : { method: "client_secret_basic" };
+	if (config.tokenEndpointAuthentication === "private_key_jwt") {
 		let resolved;
 		const matchingDefault = options?.defaultSSO?.find((p) => p.providerId === provider.providerId && "privateKey" in p && p.privateKey);
 		if (matchingDefault && "privateKey" in matchingDefault) resolved = matchingDefault.privateKey;
@@ -2682,55 +3246,73 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 			keyId: config.privateKeyId,
 			issuer: config.issuer
 		});
-		if (!resolved) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=no_private_key_available`);
+		if (!resolved || !resolved.privateKeyJwk && !resolved.privateKeyPem) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=no_private_key_available`);
 		const rawAlg = config.privateKeyAlgorithm ?? resolved.algorithm;
-		const algorithm = rawAlg && ASSERTION_SIGNING_ALGORITHMS.includes(rawAlg) ? rawAlg : void 0;
-		clientAssertionConfig = {
-			privateKeyJwk: resolved.privateKeyJwk,
-			privateKeyPem: resolved.privateKeyPem,
-			kid: config.privateKeyId ?? resolved.kid,
-			algorithm,
-			tokenEndpoint: config.tokenEndpoint
+		const algorithm = rawAlg && PRIVATE_KEY_JWT_SIGNING_ALGORITHMS.includes(rawAlg) ? rawAlg : void 0;
+		tokenEndpointAuth = {
+			method: "private_key_jwt",
+			getClientAssertion: createPrivateKeyJwtClientAssertionGetter({
+				privateKeyJwk: resolved.privateKeyJwk,
+				privateKeyPem: resolved.privateKeyPem,
+				kid: config.privateKeyId ?? resolved.kid,
+				algorithm
+			})
 		};
 	}
-	const tokenResponse = await validateAuthorizationCode({
-		code,
-		codeVerifier: config.pkce ? stateData.codeVerifier : void 0,
-		redirectURI: getOIDCRedirectURI(ctx.context.baseURL, provider.providerId, options),
-		options: {
-			clientId: config.clientId,
-			clientSecret: config.clientSecret
-		},
-		tokenEndpoint: config.tokenEndpoint,
-		authentication: authMethod,
-		clientAssertion: clientAssertionConfig
-	}).catch((e) => {
+	const tokenRequestOptions = { clientId: config.clientId };
+	if (tokenEndpointAuth.method !== "private_key_jwt") tokenRequestOptions.clientSecret = config.clientSecret;
+	const tokenResponse = await (async () => {
+		const { body, headers } = await authorizationCodeRequest({
+			code,
+			codeVerifier: config.pkce ? stateData.codeVerifier : void 0,
+			redirectURI: getOIDCRedirectURI(ctx.context.baseURL, provider.providerId, options),
+			options: tokenRequestOptions,
+			tokenEndpoint,
+			tokenEndpointAuth
+		});
+		const { data, error } = await fetchOIDCEndpoint("tokenEndpoint", tokenEndpoint, {
+			method: "POST",
+			body,
+			headers
+		}, (url) => ctx.context.isTrustedOrigin(url));
+		if (error) redirectOIDCError("invalid_provider", getOIDCErrorDescription(error, "token_response_error"));
+		if (!data) throw new Error("Token endpoint returned an empty response");
+		return getOAuth2Tokens(data);
+	})().catch((e) => {
+		if (isAPIError(e)) throw e;
 		ctx.context.logger.error("Error validating authorization code", e);
-		if (e instanceof BetterFetchError) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=${e.message}`);
-		return null;
+		if (e instanceof DiscoveryError) redirectOIDCError("invalid_provider", e.message);
+		redirectOIDCError("invalid_provider", getOIDCErrorDescription(e, "token_response_error"));
 	});
 	if (!tokenResponse) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=token_response_not_found`);
 	let userInfo = null;
 	const mapping = config.mapping || {};
+	let rawProfile;
 	if (config.userInfoEndpoint) {
-		const userInfoResponse = await betterFetch(config.userInfoEndpoint, { headers: { Authorization: `Bearer ${tokenResponse.accessToken}` } });
-		if (userInfoResponse.error) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=${userInfoResponse.error.message}`);
-		const rawUserInfo = userInfoResponse.data;
+		const userInfoResponse = await fetchOIDCEndpoint("userInfoEndpoint", config.userInfoEndpoint, { headers: { Authorization: `Bearer ${tokenResponse.accessToken}` } }, (url) => ctx.context.isTrustedOrigin(url)).catch((e) => {
+			if (e instanceof DiscoveryError) redirectOIDCError("invalid_provider", e.message);
+			throw e;
+		});
+		if (userInfoResponse.error) redirectOIDCError("invalid_provider", userInfoResponse.error.message || userInfoResponse.error.statusText || "userinfo_response_error");
+		const rawUserInfo = userInfoResponse.data ?? redirectOIDCError("invalid_provider", "userinfo_response_not_found");
+		rawProfile = rawUserInfo;
 		userInfo = {
 			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, rawUserInfo[value]])),
 			id: rawUserInfo[mapping.id || "sub"],
 			email: rawUserInfo[mapping.email || "email"],
-			emailVerified: options?.trustEmailVerified ? rawUserInfo[mapping.emailVerified || "email_verified"] : false,
+			emailVerified: options?.trustEmailVerified ? parseProviderEmailVerified(rawUserInfo[mapping.emailVerified || "email_verified"]) : false,
 			name: rawUserInfo[mapping.name || "name"],
 			image: rawUserInfo[mapping.image || "picture"]
 		};
 	} else if (tokenResponse.idToken) {
 		const idToken = decodeJwt(tokenResponse.idToken);
+		rawProfile = idToken;
 		if (!config.jwksEndpoint) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=jwks_endpoint_not_found`);
-		const verified = await validateToken(tokenResponse.idToken, config.jwksEndpoint, {
+		const verified = await validateOIDCIdToken(tokenResponse.idToken, config.jwksEndpoint, {
 			audience: config.clientId,
 			issuer: provider.issuer
-		}).catch((e) => {
+		}, (url) => ctx.context.isTrustedOrigin(url)).catch((e) => {
+			if (e instanceof DiscoveryError) redirectOIDCError("invalid_provider", e.message);
 			ctx.context.logger.error(e);
 			return null;
 		});
@@ -2739,37 +3321,67 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, verified.payload[value]])),
 			id: idToken[mapping.id || "sub"],
 			email: idToken[mapping.email || "email"],
-			emailVerified: options?.trustEmailVerified ? idToken[mapping.emailVerified || "email_verified"] : false,
+			emailVerified: options?.trustEmailVerified ? parseProviderEmailVerified(idToken[mapping.emailVerified || "email_verified"]) : false,
 			name: idToken[mapping.name || "name"],
 			image: idToken[mapping.image || "picture"]
 		};
 	} else throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=user_info_endpoint_not_found`);
 	if (!userInfo.email || !userInfo.id) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=missing_user_info`);
-	const isTrustedProvider = "domainVerified" in provider && provider.domainVerified === true && validateEmailDomain(userInfo.email, provider.domain);
-	const linked = await handleOAuthUserInfo(ctx, {
-		userInfo: {
-			email: userInfo.email,
-			name: userInfo.name || "",
-			id: userInfo.id,
-			image: userInfo.image,
-			emailVerified: options?.trustEmailVerified ? userInfo.emailVerified || false : false
-		},
-		account: {
-			idToken: tokenResponse.idToken,
-			accessToken: tokenResponse.accessToken,
-			refreshToken: tokenResponse.refreshToken,
-			accountId: userInfo.id,
-			providerId: provider.providerId,
-			accessTokenExpiresAt: tokenResponse.accessTokenExpiresAt,
-			refreshTokenExpiresAt: tokenResponse.refreshTokenExpiresAt,
-			scope: tokenResponse.scopes?.join(",")
-		},
-		callbackURL,
-		disableSignUp: options?.disableImplicitSignUp && !requestSignUp,
-		overrideUserInfo: config.overrideUserInfo,
-		isTrustedProvider
-	});
-	if (linked.error) throw ctx.redirect(`${errorURL || callbackURL}?error=${linked.error}`);
+	const userInfoEmail = userInfo.email;
+	const userInfoId = userInfo.id;
+	const isTrustedProvider = "domainVerified" in provider && provider.domainVerified === true && validateEmailDomain(userInfoEmail, provider.domain);
+	let linked;
+	try {
+		linked = await runWithTransaction(ctx.context.adapter, async () => {
+			await lockSSOProviderForAccountLink(ctx, provider);
+			return handleOAuthUserInfo(ctx, {
+				userInfo: {
+					email: userInfoEmail,
+					name: userInfo.name || "",
+					id: userInfoId,
+					image: userInfo.image,
+					emailVerified: options?.trustEmailVerified ? userInfo.emailVerified || false : false
+				},
+				account: {
+					idToken: tokenResponse.idToken,
+					accessToken: tokenResponse.accessToken,
+					refreshToken: tokenResponse.refreshToken,
+					accountId: userInfoId,
+					providerId: provider.providerId,
+					accessTokenExpiresAt: tokenResponse.accessTokenExpiresAt,
+					refreshTokenExpiresAt: tokenResponse.refreshTokenExpiresAt,
+					scope: tokenResponse.scopes?.join(",")
+				},
+				callbackURL,
+				disableSignUp: options?.disableImplicitSignUp && !requestSignUp,
+				overrideUserInfo: config.overrideUserInfo,
+				source: {
+					method: "sso-oidc",
+					sso: {
+						providerId: provider.providerId,
+						profile: rawProfile
+					}
+				},
+				isTrustedProvider,
+				trustProviderByName: false
+			});
+		});
+	} catch (e) {
+		if (isAPIError(e) && e.body?.code) {
+			const baseURL = errorURL || callbackURL;
+			const params = new URLSearchParams({ error: e.body.code });
+			if (e.body.message) params.set("error_description", e.body.message);
+			const sep = baseURL.includes("?") ? "&" : "?";
+			throw ctx.redirect(`${baseURL}${sep}${params.toString()}`);
+		}
+		throw e;
+	}
+	if (linked.error) {
+		const baseURL = errorURL || callbackURL;
+		const params = new URLSearchParams({ error: linked.error });
+		const sep = baseURL.includes("?") ? "&" : "?";
+		throw ctx.redirect(`${baseURL}${sep}${params.toString()}`);
+	}
 	const { session, user } = linked.data;
 	if (options?.provisionUser && (linked.isRegister || options.provisionUserOnEveryLogin)) await options.provisionUser({
 		user,
@@ -2782,8 +3394,8 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 		profile: {
 			providerType: "oidc",
 			providerId: provider.providerId,
-			accountId: userInfo.id,
-			email: userInfo.email,
+			accountId: userInfoId,
+			email: userInfoEmail,
 			emailVerified: Boolean(userInfo.emailVerified),
 			rawAttributes: userInfo
 		},
@@ -2817,9 +3429,86 @@ const callbackSSOEndpointConfig = {
 		}
 	}
 };
+/**
+* Resolves an SSO provider by `providerId`, first checking `options.defaultSSO`
+* and falling back to the `ssoProvider` table. Returns `null` when no match is
+* found so the caller can decide how to react (redirect, silently skip, etc.).
+*/
+async function resolveOIDCProvider(ctx, options, providerId) {
+	const matchingDefault = options?.defaultSSO?.find((defaultProvider) => defaultProvider.providerId === providerId);
+	if (matchingDefault) return {
+		...matchingDefault,
+		issuer: matchingDefault.oidcConfig?.issuer || "",
+		userId: "default",
+		...options?.domainVerification?.enabled ? { domainVerified: true } : {}
+	};
+	return ctx.context.adapter.findOne({
+		model: "ssoProvider",
+		where: [{
+			field: "providerId",
+			value: providerId
+		}]
+	}).then((res) => {
+		if (!res) return null;
+		return {
+			...res,
+			oidcConfig: safeJsonParse(res.oidcConfig) || void 0
+		};
+	});
+}
+/**
+* Restarts the OAuth flow server-side when a stateless callback arrives for
+* an OIDC provider that opted into IDP-initiated flows. Silently returns
+* otherwise, letting the normal handler produce its error redirect.
+*/
+async function bounceIfIdpInitiated(ctx, options, providerId) {
+	const provider = await resolveOIDCProvider(ctx, options, providerId);
+	if (!provider?.oidcConfig?.allowIdpInitiated) return;
+	let config = provider.oidcConfig;
+	try {
+		config = await ensureRuntimeDiscovery(config, provider.issuer, (url) => ctx.context.isTrustedOrigin(url));
+	} catch (error) {
+		ctx.context.logger.error("IDP-initiated bounce skipped: OIDC discovery failed", {
+			providerId: provider.providerId,
+			issuer: provider.issuer,
+			error
+		});
+		return;
+	}
+	if (!config.authorizationEndpoint) {
+		ctx.context.logger.error("IDP-initiated bounce skipped: authorizationEndpoint missing after discovery", {
+			providerId: provider.providerId,
+			issuer: provider.issuer
+		});
+		return;
+	}
+	if (options?.redirectURI?.trim()) await addOAuthServerContext({ ssoProviderId: provider.providerId });
+	const state = await generateState(ctx);
+	const redirectURI = getOIDCRedirectURI(ctx.context.baseURL, provider.providerId, options);
+	const authorizationURL = await createAuthorizationURL({
+		id: provider.issuer,
+		options: {
+			clientId: config.clientId,
+			clientSecret: config.clientSecret
+		},
+		redirectURI,
+		state: state.state,
+		codeVerifier: config.pkce ? state.codeVerifier : void 0,
+		scopes: config.scopes || [
+			"openid",
+			"email",
+			"profile",
+			"offline_access"
+		],
+		authorizationEndpoint: config.authorizationEndpoint
+	});
+	throw ctx.redirect(authorizationURL.toString());
+}
 const callbackSSO = (options) => {
 	return createAuthEndpoint("/sso/callback/:providerId", callbackSSOEndpointConfig, async (ctx) => {
-		return handleOIDCCallback(ctx, options, ctx.params.providerId);
+		const providerId = ctx.params.providerId;
+		if (ctx.query.state === void 0 && ctx.query.code) await bounceIfIdpInitiated(ctx, options, providerId);
+		return handleOIDCCallback(ctx, options, providerId);
 	});
 };
 /**
@@ -2845,7 +3534,7 @@ const callbackSSOShared = (options) => {
 			const errorURL = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
 			throw ctx.redirect(`${errorURL}?error=invalid_state`);
 		}
-		const providerId = stateData.ssoProviderId;
+		const providerId = stateData.serverContext?.ssoProviderId;
 		if (!providerId) {
 			const errorURL = stateData.errorURL || stateData.callbackURL;
 			throw ctx.redirect(`${errorURL}?error=invalid_state&error_description=missing_provider_id`);
@@ -2853,72 +3542,42 @@ const callbackSSOShared = (options) => {
 		return handleOIDCCallback(ctx, options, providerId, stateData);
 	});
 };
-const callbackSSOSAMLBodySchema = z.object({
+const acsEndpointBodySchema = z.object({
 	SAMLResponse: z.string(),
 	RelayState: z.string().optional()
 });
-const callbackSSOSAML = (options) => {
-	return createAuthEndpoint("/sso/saml2/callback/:providerId", {
+const acsEndpoint = (options) => {
+	return createAuthEndpoint("/sso/saml2/sp/acs/:providerId", {
 		method: ["GET", "POST"],
-		body: callbackSSOSAMLBodySchema.optional(),
+		body: acsEndpointBodySchema.optional(),
 		query: z.object({ RelayState: z.string().optional() }).optional(),
 		metadata: {
 			...HIDE_METADATA,
 			allowedMediaTypes: ["application/x-www-form-urlencoded", "application/json"],
 			openapi: {
-				operationId: "handleSAMLCallback",
-				summary: "Callback URL for SAML provider",
-				description: "This endpoint is used as the callback URL for SAML providers. Supports both GET and POST methods for IdP-initiated and SP-initiated flows.",
+				operationId: "handleSAMLAssertionConsumerService",
+				summary: "SAML Assertion Consumer Service",
+				description: "Handles SAML responses from IdP after successful authentication. Supports GET for post-auth redirects and POST for SAML response processing.",
 				responses: {
-					"302": { description: "Redirects to the callback URL" },
-					"400": { description: "Invalid SAML response" },
-					"401": { description: "Unauthorized - SAML authentication failed" }
+					"302": { description: "Redirects after authentication (success or error with query params)" },
+					"400": { description: "Missing SAMLResponse in POST body" },
+					"404": { description: "SAML provider not found" }
 				}
 			}
 		}
 	}, async (ctx) => {
 		const { providerId } = ctx.params;
+		const currentCallbackPath = `${ctx.context.baseURL}/sso/saml2/sp/acs/${providerId}`;
 		const appOrigin = new URL(ctx.context.baseURL).origin;
-		const errorURL = ctx.context.options.onAPIError?.errorURL || `${appOrigin}/error`;
-		const currentCallbackPath = `${ctx.context.baseURL}/sso/saml2/callback/${providerId}`;
 		if (ctx.method === "GET" && !ctx.body?.SAMLResponse) {
-			if (!(await getSessionFromCtx(ctx))?.session) throw ctx.redirect(`${errorURL}?error=invalid_request`);
+			if (!(await getSessionFromCtx(ctx))?.session) {
+				const errorURL = ctx.context.options.onAPIError?.errorURL || `${appOrigin}/error`;
+				throw ctx.redirect(`${errorURL}?error=invalid_request`);
+			}
 			const relayState = ctx.query?.RelayState;
-			const safeRedirectUrl = getSafeRedirectUrl(relayState, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
-			throw ctx.redirect(safeRedirectUrl);
+			throw ctx.redirect(getSafeRedirectUrl(relayState, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings)));
 		}
 		if (!ctx.body?.SAMLResponse) throw new APIError("BAD_REQUEST", { message: "SAMLResponse is required for POST requests" });
-		const safeRedirectUrl = await processSAMLResponse(ctx, {
-			SAMLResponse: ctx.body.SAMLResponse,
-			RelayState: ctx.body.RelayState,
-			providerId,
-			currentCallbackPath
-		}, options);
-		throw ctx.redirect(safeRedirectUrl);
-	});
-};
-const acsEndpointBodySchema = z.object({
-	SAMLResponse: z.string(),
-	RelayState: z.string().optional()
-});
-const acsEndpoint = (options) => {
-	return createAuthEndpoint("/sso/saml2/sp/acs/:providerId", {
-		method: "POST",
-		body: acsEndpointBodySchema,
-		metadata: {
-			...HIDE_METADATA,
-			allowedMediaTypes: ["application/x-www-form-urlencoded", "application/json"],
-			openapi: {
-				operationId: "handleSAMLAssertionConsumerService",
-				summary: "SAML Assertion Consumer Service",
-				description: "Handles SAML responses from IdP after successful authentication",
-				responses: { "302": { description: "Redirects to the callback URL after successful authentication" } }
-			}
-		}
-	}, async (ctx) => {
-		const { providerId } = ctx.params;
-		const currentCallbackPath = `${ctx.context.baseURL}/sso/saml2/sp/acs/${providerId}`;
-		const appOrigin = new URL(ctx.context.baseURL).origin;
 		try {
 			const safeRedirectUrl = await processSAMLResponse(ctx, {
 				SAMLResponse: ctx.body.SAMLResponse,
@@ -2930,9 +3589,8 @@ const acsEndpoint = (options) => {
 		} catch (error) {
 			if (error instanceof Response || error && typeof error === "object" && "status" in error && error.status === 302) throw error;
 			if (error instanceof APIError && error.statusCode === 400) {
-				const internalCode = error.body?.code || "";
-				const errorCode = internalCode === "SAML_MULTIPLE_ASSERTIONS" ? "multiple_assertions" : internalCode === "SAML_NO_ASSERTION" ? "no_assertion" : internalCode.toLowerCase() || "saml_error";
-				const redirectUrl = getSafeRedirectUrl(ctx.body.RelayState || void 0, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+				const errorCode = (error.body?.code || "saml_error").toLowerCase();
+				const redirectUrl = getSafeRedirectUrl(ctx.body?.RelayState || void 0, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
 				throw ctx.redirect(`${redirectUrl}${redirectUrl.includes("?") ? "&" : "?"}error=${encodeURIComponent(errorCode)}&error_description=${encodeURIComponent(error.message)}`);
 			}
 			throw error;
@@ -3025,7 +3683,7 @@ async function handleLogoutRequest(ctx, sp, idp, relayState, providerId) {
 	if (stored) {
 		const data = safeJsonParse(stored.value);
 		if (data) if (!sessionIndex || !data.sessionIndex || sessionIndex === data.sessionIndex) {
-			await ctx.context.internalAdapter.deleteSession(data.sessionId).catch((e) => ctx.context.logger.warn("Failed to delete session during SLO", { error: e }));
+			await ctx.context.internalAdapter.deleteSession(data.sessionToken).catch((e) => ctx.context.logger.warn("Failed to delete session during SLO", { error: e }));
 			await ctx.context.internalAdapter.deleteVerificationByIdentifier(`${SAML_SESSION_BY_ID_PREFIX}${data.sessionId}`).catch((e) => ctx.context.logger.warn("Failed to delete SAML session lookup during SLO", e));
 		} else ctx.context.logger.warn("SessionIndex mismatch in LogoutRequest - skipping session deletion", {
 			providerId,
@@ -3035,10 +3693,9 @@ async function handleLogoutRequest(ctx, sp, idp, relayState, providerId) {
 		await ctx.context.internalAdapter.deleteVerificationByIdentifier(key).catch((e) => ctx.context.logger.warn("Failed to delete SAML session key during SLO", e));
 	}
 	const currentSession = await getSessionFromCtx(ctx);
-	if (currentSession?.session) await ctx.context.internalAdapter.deleteSession(currentSession.session.id);
+	if (currentSession?.session) await ctx.context.internalAdapter.deleteSession(currentSession.session.token);
 	deleteSessionCookie(ctx);
-	const requestId = parsed.extract.request?.id || "";
-	const res = sp.createLogoutResponse(idp, null, binding, relayState || "", (template) => template.replace("{InResponseTo}", requestId).replace("{StatusCode}", SAML_STATUS_SUCCESS));
+	const res = sp.createLogoutResponse(idp, parsed, binding, relayState || "");
 	if (binding === "post" && res.entityEndpoint) return createSAMLPostForm(res.entityEndpoint, "SAMLResponse", res.context, relayState);
 	throw ctx.redirect(res.context);
 }
@@ -3091,7 +3748,7 @@ const initiateSLO = (options) => {
 		});
 		if (samlSessionKey) await ctx.context.internalAdapter.deleteVerificationByIdentifier(samlSessionKey).catch((e) => ctx.context.logger.warn("Failed to delete SAML session key during logout", e));
 		await ctx.context.internalAdapter.deleteVerificationByIdentifier(sessionLookupKey).catch((e) => ctx.context.logger.warn("Failed to delete session lookup key during logout", e));
-		await ctx.context.internalAdapter.deleteSession(session.session.id);
+		await ctx.context.internalAdapter.deleteSession(session.session.token);
 		deleteSessionCookie(ctx);
 		throw ctx.redirect(logoutRequest.context);
 	});
@@ -3107,12 +3764,43 @@ saml.setSchemaValidator({ async validate(xml) {
 * These endpoints receive POST requests from external Identity Providers,
 * which won't have a matching Origin header.
 */
-const SAML_SKIP_ORIGIN_CHECK_PATHS = [
-	"/sso/saml2/callback",
-	"/sso/saml2/sp/acs",
-	"/sso/saml2/sp/slo"
+const SAML_SKIP_ORIGIN_CHECK_PATHS = ["/sso/saml2/sp/acs", "/sso/saml2/sp/slo"];
+const SSO_PROVIDER_BUILT_IN_FIELD_KEYS = [
+	"id",
+	"issuer",
+	"oidcConfig",
+	"samlConfig",
+	"userId",
+	"providerId",
+	"organizationId",
+	"domain",
+	"domainVerified"
+];
+const SSO_PROVIDER_RESPONSE_FIELD_KEYS = [
+	"type",
+	"spMetadataUrl",
+	"redirectURI",
+	"domainVerificationToken"
 ];
+const SSO_PROVIDER_BUILT_IN_FIELD_KEY_SET = new Set(SSO_PROVIDER_BUILT_IN_FIELD_KEYS);
+const SSO_PROVIDER_RESPONSE_FIELD_KEY_SET = new Set(SSO_PROVIDER_RESPONSE_FIELD_KEYS);
+function getSSOProviderBuiltInFieldName(options, key) {
+	const fieldNames = options?.fields;
+	const schemaFieldNames = options?.schema?.ssoProvider?.fields;
+	return fieldNames?.[key] ?? schemaFieldNames?.[key] ?? key;
+}
+function assertNoAdditionalFieldCollisions(options) {
+	const additionalFields = options?.schema?.ssoProvider?.additionalFields ?? {};
+	const builtInFieldNames = new Set(SSO_PROVIDER_BUILT_IN_FIELD_KEYS.map((key) => getSSOProviderBuiltInFieldName(options, key)));
+	for (const [key, field] of Object.entries(additionalFields)) {
+		if (SSO_PROVIDER_BUILT_IN_FIELD_KEY_SET.has(key)) throw new Error(`ssoProvider additional field "${key}" conflicts with a built-in field`);
+		if (SSO_PROVIDER_RESPONSE_FIELD_KEY_SET.has(key)) throw new Error(`ssoProvider additional field "${key}" conflicts with a returned provider field`);
+		const fieldName = field.fieldName ?? key;
+		if (builtInFieldNames.has(fieldName)) throw new Error(`ssoProvider additional field "${key}" maps to built-in field "${fieldName}"`);
+	}
+}
 function sso(options) {
+	assertNoAdditionalFieldCollisions(options);
 	const optionsWithStore = options;
 	let endpoints = {
 		spMetadata: spMetadata(optionsWithStore),
@@ -3120,12 +3808,11 @@ function sso(options) {
 		signInSSO: signInSSO(optionsWithStore),
 		callbackSSO: callbackSSO(optionsWithStore),
 		callbackSSOShared: callbackSSOShared(optionsWithStore),
-		callbackSSOSAML: callbackSSOSAML(optionsWithStore),
 		acsEndpoint: acsEndpoint(optionsWithStore),
 		sloEndpoint: sloEndpoint(optionsWithStore),
 		initiateSLO: initiateSLO(optionsWithStore),
-		listSSOProviders: listSSOProviders(),
-		getSSOProvider: getSSOProvider(),
+		listSSOProviders: listSSOProviders(optionsWithStore),
+		getSSOProvider: getSSOProvider(optionsWithStore),
 		updateSSOProvider: updateSSOProvider(optionsWithStore),
 		deleteSSOProvider: deleteSSOProvider()
 	};
@@ -3182,22 +3869,22 @@ function sso(options) {
 			}]
 		},
 		schema: { ssoProvider: {
-			modelName: options?.modelName ?? "ssoProvider",
+			modelName: options?.modelName ?? options?.schema?.ssoProvider?.modelName ?? "ssoProvider",
 			fields: {
 				issuer: {
 					type: "string",
 					required: true,
-					fieldName: options?.fields?.issuer ?? "issuer"
+					fieldName: options?.fields?.issuer ?? options?.schema?.ssoProvider?.fields?.issuer ?? "issuer"
 				},
 				oidcConfig: {
 					type: "string",
 					required: false,
-					fieldName: options?.fields?.oidcConfig ?? "oidcConfig"
+					fieldName: options?.fields?.oidcConfig ?? options?.schema?.ssoProvider?.fields?.oidcConfig ?? "oidcConfig"
 				},
 				samlConfig: {
 					type: "string",
 					required: false,
-					fieldName: options?.fields?.samlConfig ?? "samlConfig"
+					fieldName: options?.fields?.samlConfig ?? options?.schema?.ssoProvider?.fields?.samlConfig ?? "samlConfig"
 				},
 				userId: {
 					type: "string",
@@ -3205,30 +3892,33 @@ function sso(options) {
 						model: "user",
 						field: "id"
 					},
-					fieldName: options?.fields?.userId ?? "userId"
+					fieldName: options?.fields?.userId ?? options?.schema?.ssoProvider?.fields?.userId ?? "userId"
 				},
 				providerId: {
 					type: "string",
 					required: true,
 					unique: true,
-					fieldName: options?.fields?.providerId ?? "providerId"
+					fieldName: options?.fields?.providerId ?? options?.schema?.ssoProvider?.fields?.providerId ?? "providerId"
 				},
 				organizationId: {
 					type: "string",
 					required: false,
-					fieldName: options?.fields?.organizationId ?? "organizationId"
+					fieldName: options?.fields?.organizationId ?? options?.schema?.ssoProvider?.fields?.organizationId ?? "organizationId"
 				},
 				domain: {
 					type: "string",
 					required: true,
-					fieldName: options?.fields?.domain ?? "domain"
+					fieldName: options?.fields?.domain ?? options?.schema?.ssoProvider?.fields?.domain ?? "domain"
 				},
 				...options?.domainVerification?.enabled ? { domainVerified: {
 					type: "boolean",
-					required: false
-				} } : {}
+					required: false,
+					fieldName: options?.schema?.ssoProvider?.fields?.domainVerified ?? "domainVerified"
+				} } : {},
+				...options?.schema?.ssoProvider?.additionalFields ?? {}
 			}
 		} },
+		$Infer: { SSOProvider: {} },
 		options
 	};
 }