@better-auth/sso 1.7.0-beta.1 → 1.7.0-beta.10

package/dist/client.d.mts

@@ -1,10 +1,18 @@
-import { t as SSOPlugin } from "./index-CagV4mMx.mjs";
+import { t as SSOPlugin } from "./index-A_DJ_AqL.mjs";
+import { DBFieldAttribute } from "better-auth/db";
 
 //#region src/client.d.ts
 interface SSOClientOptions {
   domainVerification?: {
     enabled: boolean;
   } | undefined;
+  schema?: {
+    ssoProvider?: {
+      additionalFields?: {
+        [key: string]: DBFieldAttribute;
+      };
+    };
+  } | undefined;
 }
 declare const ssoClient: <CO extends SSOClientOptions>(options?: CO | undefined) => {
   id: "sso-client";
@@ -15,6 +23,7 @@ declare const ssoClient: <CO extends SSOClientOptions>(options?: CO | undefined)
         enabled: true;
       } ? true : false;
     };
+    schema: CO["schema"];
   }>;
   pathMethods: {
     "/sso/providers": "GET";

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-C22JHwcK.mjs";
+import { t as PACKAGE_VERSION } from "./version-C-W6yUfI.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-CagV4mMx.d.mts → index-A_DJ_AqL.d.mts}

@@ -1,6 +1,7 @@
 import { APIError } from "better-auth/api";
 import * as z from "zod";
-import { Awaitable, BetterAuthPlugin, OAuth2Tokens, User } from "better-auth";
+import { DBFieldAttribute, FieldAttributeToObject, InferAdditionalFieldsFromPluginOptions, RemoveFieldsWithReturnedFalse } from "better-auth/db";
+import { Awaitable, OAuth2Tokens, User } from "better-auth";
 import * as better_call0 from "better-call";
 
 //#region src/saml/algorithms.d.ts
@@ -79,6 +80,15 @@ interface OIDCConfig {
   privateKeyAlgorithm?: string | undefined;
   jwksEndpoint?: string | undefined;
   mapping?: OIDCMapping | undefined;
+  /**
+   * Accept callbacks from OIDC providers that initiate the OAuth flow
+   * without sending a `state` parameter. When enabled, stateless callbacks
+   * restart the OAuth flow server-side with a fresh `state` and PKCE
+   * verifier. See the SSO docs for details.
+   *
+   * @default false
+   */
+  allowIdpInitiated?: boolean | undefined;
 }
 interface SAMLConfig {
   /**
@@ -94,17 +104,29 @@ interface SAMLConfig {
    */
   entryPoint: string;
   /**
-   * IdP signing certificate. Used to verify SAML response signatures
-   * when `idpMetadata.metadata` is not provided. Ignored when IdP
-   * metadata XML is set (the certificate is extracted from the XML).
-   * When both this and `idpMetadata.cert` are set, `idpMetadata.cert` takes precedence.
+   * IdP signing certificate(s). Used to verify SAML response signatures when
+   * `idpMetadata.metadata` is not provided. Ignored when IdP metadata XML is
+   * set (the certificate is extracted from the XML). When both this and
+   * `idpMetadata.cert` are set, `idpMetadata.cert` takes precedence. Pass an
+   * array of PEM strings for rolling rotation; responses signed by any
+   * listed cert are accepted.
    */
-  cert: string;
+  cert?: string | string[];
   audience?: string | undefined;
+  /**
+   * Provider-level post-auth redirect URL for IdP-initiated or fallback SAML
+   * flows when no RelayState callback URL is available.
+   */
+  callbackUrl?: string | undefined;
   idpMetadata?: {
     metadata?: string;
     entityID?: string;
-    cert?: string;
+    /**
+     * IdP signing certificate(s). Pass a single PEM string or an array
+     * for rolling rotation. Takes precedence over the top-level `cert`
+     * when both are set. Omit when `metadata` XML is supplied.
+     */
+    cert?: string | string[];
     privateKey?: string;
     privateKeyPass?: string;
     isAssertionEncrypted?: boolean;
@@ -156,11 +178,32 @@ type BaseSSOProvider = {
   organizationId?: string | undefined;
   domain: string;
 };
+type SSOProviderAdditionalFields<O extends SSOOptions, IsClientSide extends boolean> = O["schema"] extends {
+  ssoProvider?: {
+    additionalFields: infer Field extends Record<string, DBFieldAttribute>;
+  };
+} ? IsClientSide extends true ? FieldAttributeToObject<RemoveFieldsWithReturnedFalse<Field>> : FieldAttributeToObject<Field> : {};
+type SSOProviderAdditionalFieldsInput<O extends SSOOptions, IsClientSide extends boolean = true> = InferAdditionalFieldsFromPluginOptions<"ssoProvider", O, IsClientSide>;
+type InferSSOProvider<O extends SSOOptions, IsClientSide extends boolean = true> = (O["domainVerification"] extends {
+  enabled: true;
+} ? {
+  domainVerified: boolean;
+} & BaseSSOProvider : BaseSSOProvider) & SSOProviderAdditionalFields<O, IsClientSide>;
 type SSOProvider<O extends SSOOptions> = O["domainVerification"] extends {
   enabled: true;
 } ? {
   domainVerified: boolean;
-} & BaseSSOProvider : BaseSSOProvider;
+} & BaseSSOProvider & SSOProviderAdditionalFields<O, false> : BaseSSOProvider & SSOProviderAdditionalFields<O, false>;
+type SSOProviderSchema<O extends SSOOptions> = {
+  ssoProvider: {
+    modelName: string;
+    fields: Record<string, DBFieldAttribute> & (O["schema"] extends {
+      ssoProvider?: {
+        additionalFields: infer Field extends Record<string, DBFieldAttribute>;
+      };
+    } ? Field : {});
+  };
+};
 interface SSOOptions {
   /**
    * custom function to provision a user when they sign in with an SSO provider.
@@ -282,6 +325,25 @@ interface SSOOptions {
     organizationId?: string | undefined;
     domain?: string | undefined;
   };
+  /**
+   * The schema for the SSO plugin.
+   */
+  schema?: {
+    ssoProvider?: {
+      modelName?: string | undefined;
+      fields?: {
+        issuer?: string | undefined;
+        oidcConfig?: string | undefined;
+        samlConfig?: string | undefined;
+        userId?: string | undefined;
+        providerId?: string | undefined;
+        organizationId?: string | undefined;
+        domain?: string | undefined;
+        domainVerified?: string | undefined;
+      };
+      additionalFields?: { [key in string]: DBFieldAttribute };
+    };
+  } | undefined;
   /**
    * Configure the maximum number of SSO providers a user can register.
    * You can also pass a function that returns a number.
@@ -576,8 +638,20 @@ declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint
   }>)[];
 }, void>;
 //#endregion
+//#region src/utils.d.ts
+declare function parseCertificate(certPem: string): {
+  fingerprintSha256: string;
+  notBefore: string;
+  notAfter: string;
+  publicKeyAlgorithm: string;
+};
+//#endregion
 //#region src/routes/providers.d.ts
-declare const listSSOProviders: () => better_call0.StrictEndpoint<"/sso/providers", {
+type ParsedCert = ReturnType<typeof parseCertificate>;
+type SanitizedCert = ParsedCert | {
+  error: string;
+};
+declare const listSSOProviders: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/providers", {
   method: "GET";
   use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
     session: {
@@ -641,19 +715,12 @@ declare const listSSOProviders: () => better_call0.StrictEndpoint<"/sso/provider
       identifierFormat: string | undefined;
       signatureAlgorithm: string | undefined;
       digestAlgorithm: string | undefined;
-      certificate: {
-        fingerprintSha256: string;
-        notBefore: string;
-        notAfter: string;
-        publicKeyAlgorithm: string;
-      } | {
-        error: string;
-      };
+      certificate: SanitizedCert[] | undefined;
     } | undefined;
     spMetadataUrl: string;
   }[];
 }>;
-declare const getSSOProvider: () => better_call0.StrictEndpoint<"/sso/get-provider", {
+declare const getSSOProvider: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/get-provider", {
   method: "GET";
   use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
     session: {
@@ -725,14 +792,7 @@ declare const getSSOProvider: () => better_call0.StrictEndpoint<"/sso/get-provid
     identifierFormat: string | undefined;
     signatureAlgorithm: string | undefined;
     digestAlgorithm: string | undefined;
-    certificate: {
-      fingerprintSha256: string;
-      notBefore: string;
-      notAfter: string;
-      publicKeyAlgorithm: string;
-    } | {
-      error: string;
-    };
+    certificate: SanitizedCert[] | undefined;
   } | undefined;
   spMetadataUrl: string;
 }>;
@@ -766,39 +826,41 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
     domain: z.ZodOptional<z.ZodString>;
     oidcConfig: z.ZodOptional<z.ZodObject<{
       clientId: z.ZodOptional<z.ZodString>;
-      clientSecret: z.ZodOptional<z.ZodString>;
-      authorizationEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpoint: z.ZodOptional<z.ZodString>;
-      userInfoEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
+      clientSecret: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      authorizationEndpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      tokenEndpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      userInfoEndpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      tokenEndpointAuthentication: z.ZodOptional<z.ZodOptional<z.ZodEnum<{
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
         private_key_jwt: "private_key_jwt";
-      }>>;
-      privateKeyId: z.ZodOptional<z.ZodString>;
-      privateKeyAlgorithm: z.ZodOptional<z.ZodString>;
-      jwksEndpoint: z.ZodOptional<z.ZodString>;
-      discoveryEndpoint: z.ZodOptional<z.ZodString>;
-      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-      pkce: z.ZodOptional<z.ZodBoolean>;
-      overrideUserInfo: z.ZodOptional<z.ZodBoolean>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodString>;
+      }>>>;
+      privateKeyId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      privateKeyAlgorithm: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      jwksEndpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      discoveryEndpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      skipDiscovery: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+      scopes: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+      pkce: z.ZodOptional<z.ZodOptional<z.ZodDefault<z.ZodBoolean>>>;
+      overrideUserInfo: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+      mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
         emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
         image: z.ZodOptional<z.ZodString>;
         extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
+      }, z.core.$strip>>>;
     }, z.core.$strip>>;
     samlConfig: z.ZodOptional<z.ZodObject<{
       entryPoint: z.ZodOptional<z.ZodString>;
-      cert: z.ZodOptional<z.ZodString>;
-      audience: z.ZodOptional<z.ZodString>;
-      idpMetadata: z.ZodOptional<z.ZodObject<{
+      cert: z.ZodOptional<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+      audience: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      callbackUrl: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      idpMetadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
         metadata: z.ZodOptional<z.ZodString>;
         entityID: z.ZodOptional<z.ZodString>;
-        cert: z.ZodOptional<z.ZodString>;
+        cert: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
         privateKey: z.ZodOptional<z.ZodString>;
         privateKeyPass: z.ZodOptional<z.ZodString>;
         isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
@@ -808,8 +870,12 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
           Binding: z.ZodString;
           Location: z.ZodString;
         }, z.core.$strip>>>;
-      }, z.core.$strip>>;
-      spMetadata: z.ZodOptional<z.ZodObject<{
+        singleLogoutService: z.ZodOptional<z.ZodArray<z.ZodObject<{
+          Binding: z.ZodString;
+          Location: z.ZodString;
+        }, z.core.$strip>>>;
+      }, z.core.$strip>>>;
+      spMetadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
         metadata: z.ZodOptional<z.ZodString>;
         entityID: z.ZodOptional<z.ZodString>;
         binding: z.ZodOptional<z.ZodString>;
@@ -818,22 +884,22 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
         isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
         encPrivateKey: z.ZodOptional<z.ZodString>;
         encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>>;
-      wantAssertionsSigned: z.ZodOptional<z.ZodBoolean>;
-      authnRequestsSigned: z.ZodOptional<z.ZodBoolean>;
-      signatureAlgorithm: z.ZodOptional<z.ZodString>;
-      digestAlgorithm: z.ZodOptional<z.ZodString>;
-      identifierFormat: z.ZodOptional<z.ZodString>;
-      privateKey: z.ZodOptional<z.ZodString>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>>;
+      wantAssertionsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+      authnRequestsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+      signatureAlgorithm: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      digestAlgorithm: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      identifierFormat: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      privateKey: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
         emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
         firstName: z.ZodOptional<z.ZodString>;
         lastName: z.ZodOptional<z.ZodString>;
         extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
+      }, z.core.$strip>>>;
     }, z.core.$strip>>;
     providerId: z.ZodString;
   }, z.core.$strip>;
@@ -881,14 +947,7 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
     identifierFormat: string | undefined;
     signatureAlgorithm: string | undefined;
     digestAlgorithm: string | undefined;
-    certificate: {
-      fingerprintSha256: string;
-      notBefore: string;
-      notAfter: string;
-      publicKeyAlgorithm: string;
-    } | {
-      error: string;
-    };
+    certificate: SanitizedCert[] | undefined;
   } | undefined;
   spMetadataUrl: string;
 }>;
@@ -964,82 +1023,7 @@ declare const spMetadata: (options?: SSOOptions) => better_call0.StrictEndpoint<
 declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call0.StrictEndpoint<"/sso/register", {
   method: "POST";
   body: z.ZodObject<{
-    providerId: z.ZodString;
-    issuer: z.ZodString;
-    domain: z.ZodString;
-    oidcConfig: z.ZodOptional<z.ZodObject<{
-      clientId: z.ZodString;
-      clientSecret: z.ZodOptional<z.ZodString>;
-      authorizationEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpoint: z.ZodOptional<z.ZodString>;
-      userInfoEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
-        client_secret_post: "client_secret_post";
-        client_secret_basic: "client_secret_basic";
-        private_key_jwt: "private_key_jwt";
-      }>>;
-      privateKeyId: z.ZodOptional<z.ZodString>;
-      privateKeyAlgorithm: z.ZodOptional<z.ZodString>;
-      jwksEndpoint: z.ZodOptional<z.ZodString>;
-      discoveryEndpoint: z.ZodOptional<z.ZodString>;
-      skipDiscovery: z.ZodOptional<z.ZodBoolean>;
-      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-      pkce: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodString;
-        email: z.ZodString;
-        emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        image: z.ZodOptional<z.ZodString>;
-        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    samlConfig: z.ZodOptional<z.ZodObject<{
-      entryPoint: z.ZodString;
-      cert: z.ZodString;
-      audience: z.ZodOptional<z.ZodString>;
-      idpMetadata: z.ZodOptional<z.ZodObject<{
-        metadata: z.ZodOptional<z.ZodString>;
-        entityID: z.ZodOptional<z.ZodString>;
-        cert: z.ZodOptional<z.ZodString>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        privateKeyPass: z.ZodOptional<z.ZodString>;
-        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-        encPrivateKey: z.ZodOptional<z.ZodString>;
-        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-        singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
-          Binding: z.ZodString;
-          Location: z.ZodString;
-        }, z.core.$strip>>>;
-      }, z.core.$strip>>;
-      spMetadata: z.ZodOptional<z.ZodObject<{
-        metadata: z.ZodOptional<z.ZodString>;
-        entityID: z.ZodOptional<z.ZodString>;
-        binding: z.ZodOptional<z.ZodString>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        privateKeyPass: z.ZodOptional<z.ZodString>;
-        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-        encPrivateKey: z.ZodOptional<z.ZodString>;
-        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>>;
-      wantAssertionsSigned: z.ZodOptional<z.ZodBoolean>;
-      authnRequestsSigned: z.ZodOptional<z.ZodBoolean>;
-      signatureAlgorithm: z.ZodOptional<z.ZodString>;
-      digestAlgorithm: z.ZodOptional<z.ZodString>;
-      identifierFormat: z.ZodOptional<z.ZodString>;
-      privateKey: z.ZodOptional<z.ZodString>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodString;
-        email: z.ZodString;
-        emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        firstName: z.ZodOptional<z.ZodString>;
-        lastName: z.ZodOptional<z.ZodString>;
-        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    organizationId: z.ZodOptional<z.ZodString>;
-    overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    [x: string]: z.ZodOptional<z.ZodAny>;
   }, z.core.$strip>;
   use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
     session: {
@@ -1065,6 +1049,9 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
     };
   }>)[];
   metadata: {
+    $Infer: {
+      body: Record<string, any> & SSOProviderAdditionalFieldsInput<O>;
+    };
     openapi: {
       operationId: string;
       summary: string;
@@ -1231,14 +1218,14 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
   redirectURI: string;
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
-} & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig"> & {
+} & Omit<InferSSOProvider<O>, "oidcConfig" | "samlConfig"> & {
   domainVerified: boolean;
   domainVerificationToken: string;
 } : {
   redirectURI: string;
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
-} & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig">>;
+} & Omit<InferSSOProvider<O>, "oidcConfig" | "samlConfig">>;
 declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sign-in/sso", {
   method: "POST";
   body: z.ZodObject<{
@@ -1251,6 +1238,7 @@ declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"
     newUserCallbackURL: z.ZodOptional<z.ZodString>;
     scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     loginHint: z.ZodOptional<z.ZodString>;
+    additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     requestSignUp: z.ZodOptional<z.ZodBoolean>;
     providerType: z.ZodOptional<z.ZodEnum<{
       saml: "saml";
@@ -1272,7 +1260,7 @@ declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"
                   type: string;
                   description: string;
                 };
-                issuer: {
+                organizationSlug: {
                   type: string;
                   description: string;
                 };
@@ -1280,6 +1268,10 @@ declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"
                   type: string;
                   description: string;
                 };
+                domain: {
+                  type: string;
+                  description: string;
+                };
                 callbackURL: {
                   type: string;
                   description: string;
@@ -1292,10 +1284,33 @@ declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"
                   type: string;
                   description: string;
                 };
+                scopes: {
+                  type: string;
+                  items: {
+                    type: string;
+                  };
+                  description: string;
+                };
                 loginHint: {
                   type: string;
                   description: string;
                 };
+                additionalParams: {
+                  type: string;
+                  additionalProperties: {
+                    type: string;
+                  };
+                  description: string;
+                };
+                requestSignUp: {
+                  type: string;
+                  description: string;
+                };
+                providerType: {
+                  type: string;
+                  enum: string[];
+                  description: string;
+                };
               };
               required: string[];
             };
@@ -1337,7 +1352,7 @@ declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint
   method: "GET";
   query: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
-    state: z.ZodString;
+    state: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
     error_description: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
@@ -1378,14 +1393,14 @@ declare const callbackSSOShared: (options?: SSOOptions) => better_call0.StrictEn
   method: "GET";
   query: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
-    state: z.ZodString;
+    state: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
     error_description: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
   allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
 }, void>;
 declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
-  method: ("POST" | "GET")[];
+  method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLResponse: z.ZodString;
     RelayState: z.ZodOptional<z.ZodString>;
@@ -1415,7 +1430,7 @@ declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint
   };
 }, never>;
 declare const sloEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
-  method: ("POST" | "GET")[];
+  method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLRequest: z.ZodOptional<z.ZodString>;
     SAMLResponse: z.ZodOptional<z.ZodString>;
@@ -1585,7 +1600,7 @@ interface OIDCDiscoveryDocument {
 /**
  * Error codes for OIDC discovery operations.
  */
-type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** Discovery URL is invalid or malformed */ | "discovery_invalid_url" /** Discovery URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
+type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */ | "discovery_invalid_url" /** OIDC endpoint URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */ | "discovery_private_host" /** Server-side OIDC endpoint fetch received an HTTP redirect response */ | "oidc_endpoint_redirect" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
 /**
  * Custom error class for OIDC discovery failures.
  * Can be caught and mapped to APIError at the edge.
@@ -1700,7 +1715,7 @@ declare function validateDiscoveryUrl(url: string, isTrustedOrigin: DiscoverOIDC
  * @returns The parsed discovery document
  * @throws DiscoveryError on network errors, timeouts, or invalid responses
  */
-declare function fetchDiscoveryDocument(url: string, timeout?: number): Promise<OIDCDiscoveryDocument>;
+declare function fetchDiscoveryDocument(url: string, timeout?: number, isTrustedOrigin?: (url: string) => boolean): Promise<OIDCDiscoveryDocument>;
 /**
  * Validate a discovery document.
  *
@@ -1791,6 +1806,11 @@ type SSOPlugin<O extends SSOOptions> = {
       enabled: true;
     };
   } ? DomainVerificationEndpoints : {});
+  schema: SSOProviderSchema<O>;
+  $Infer: {
+    SSOProvider: InferSSOProvider<O>;
+  };
+  options: NoInfer<O>;
 };
 declare function sso<O extends SSOOptions & {
   domainVerification?: {
@@ -1800,13 +1820,20 @@ declare function sso<O extends SSOOptions & {
   id: "sso";
   version: string;
   endpoints: SSOEndpoints<O> & DomainVerificationEndpoints;
-  schema: NonNullable<BetterAuthPlugin["schema"]>;
+  schema: SSOProviderSchema<O>;
+  $Infer: {
+    SSOProvider: InferSSOProvider<O>;
+  };
   options: NoInfer<O>;
 };
 declare function sso<O extends SSOOptions>(options?: O | undefined): {
   id: "sso";
   version: string;
   endpoints: SSOEndpoints<O>;
+  schema: SSOProviderSchema<O>;
+  $Infer: {
+    SSOProvider: InferSSOProvider<O>;
+  };
   options: NoInfer<O>;
 };
 //#endregion

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as DataEncryptionAlgorithm, C as DEFAULT_MAX_SAML_METADATA_SIZE, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as DEFAULT_CLOCK_SKEW_MS, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as DEFAULT_MAX_SAML_RESPONSE_SIZE, x as validateSAMLTimestamp, y as SAMLConditions } from "./index-CagV4mMx.mjs";
+import { A as DataEncryptionAlgorithm, C as DEFAULT_MAX_SAML_METADATA_SIZE, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as DEFAULT_CLOCK_SKEW_MS, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as DEFAULT_MAX_SAML_RESPONSE_SIZE, x as validateSAMLTimestamp, y as SAMLConditions } from "./index-A_DJ_AqL.mjs";
 export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SSOOptions, SSOPlugin, SSOProvider, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };