@better-auth/sso 1.7.0-rc.0 → 1.7.0-rc.2

package/dist/client.d.mts

@@ -1,6 +1,5 @@
-import { t as SSOPlugin } from "./index-A_DJ_AqL.mjs";
+import { t as SSOPlugin } from "./index-D1yk91me.mjs";
 import { DBFieldAttribute } from "better-auth/db";
-
 //#region src/client.d.ts
 interface SSOClientOptions {
   domainVerification?: {

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BDD29zmX.mjs";
+import { t as PACKAGE_VERSION } from "./version-m-Zfjx6T.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-A_DJ_AqL.d.mts → index-D1yk91me.d.mts}

@@ -1,9 +1,9 @@
 import { APIError } from "better-auth/api";
 import * as z from "zod";
+import "@better-fetch/fetch";
 import { DBFieldAttribute, FieldAttributeToObject, InferAdditionalFieldsFromPluginOptions, RemoveFieldsWithReturnedFalse } from "better-auth/db";
-import { Awaitable, OAuth2Tokens, User } from "better-auth";
-import * as better_call0 from "better-call";
-
+import { Awaitable, DBTransactionAdapter, OAuth2Tokens, User } from "better-auth";
+import "@better-auth/core";
 //#region src/saml/algorithms.d.ts
 declare const SignatureAlgorithm: {
   readonly RSA_SHA1: "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
@@ -45,7 +45,6 @@ interface AlgorithmValidationOptions {
 //#endregion
 //#region src/types.d.ts
 interface OIDCMapping {
-  id?: string | undefined;
   email?: string | undefined;
   emailVerified?: string | undefined;
   name?: string | undefined;
@@ -53,7 +52,6 @@ interface OIDCMapping {
   extraFields?: Record<string, string> | undefined;
 }
 interface SAMLMapping {
-  id?: string | undefined;
   email?: string | undefined;
   emailVerified?: string | undefined;
   name?: string | undefined;
@@ -90,6 +88,41 @@ interface OIDCConfig {
    */
   allowIdpInitiated?: boolean | undefined;
 }
+interface SAMLIdentityProviderMetadataBase {
+  /**
+   * IdP signing certificate(s). Pass a single PEM string or an array for
+   * rolling rotation. Takes precedence over the top-level `cert` when both
+   * are set. Omit when `metadata` XML is supplied.
+   */
+  cert?: string | string[] | undefined;
+  privateKey?: string | undefined;
+  privateKeyPass?: string | undefined;
+  isAssertionEncrypted?: boolean | undefined;
+  encPrivateKey?: string | undefined;
+  encPrivateKeyPass?: string | undefined;
+  singleSignOnService?: Array<{
+    Binding: string;
+    Location: string;
+  }> | undefined;
+  singleLogoutService?: Array<{
+    Binding: string;
+    Location: string;
+  }> | undefined;
+}
+/**
+ * The trusted identity-provider authority for a SAML connection.
+ *
+ * Metadata XML carries the IdP entity ID. Manual configurations must declare
+ * `entityID` explicitly so the service provider's issuer is never mistaken
+ * for the identity provider's authority.
+ */
+type SAMLIdentityProviderMetadata = SAMLIdentityProviderMetadataBase & ({
+  metadata: string;
+  entityID?: string | undefined;
+} | {
+  metadata?: undefined;
+  entityID: string;
+});
 interface SAMLConfig {
   /**
    * SP Entity ID. Used as the `entityID` in SP metadata when
@@ -118,29 +151,12 @@ interface SAMLConfig {
    * flows when no RelayState callback URL is available.
    */
   callbackUrl?: string | undefined;
-  idpMetadata?: {
-    metadata?: string;
-    entityID?: string;
-    /**
-     * IdP signing certificate(s). Pass a single PEM string or an array
-     * for rolling rotation. Takes precedence over the top-level `cert`
-     * when both are set. Omit when `metadata` XML is supplied.
-     */
-    cert?: string | string[];
-    privateKey?: string;
-    privateKeyPass?: string;
-    isAssertionEncrypted?: boolean;
-    encPrivateKey?: string;
-    encPrivateKeyPass?: string;
-    singleSignOnService?: Array<{
-      Binding: string;
-      Location: string;
-    }>;
-    singleLogoutService?: Array<{
-      Binding: string;
-      Location: string;
-    }>;
-  } | undefined;
+  /**
+   * Fallback absolute URL or same-origin relative path for IdP-initiated SAML
+   * responses when RelayState has no safe callback, including error redirects.
+   */
+  idpInitiatedCallbackUrl?: string | undefined;
+  idpMetadata: SAMLIdentityProviderMetadata;
   /**
    * SP metadata configuration. All fields are optional; when omitted,
    * SP metadata is auto-generated from `issuer`, `wantAssertionsSigned`,
@@ -204,7 +220,56 @@ type SSOProviderSchema<O extends SSOOptions> = {
     } ? Field : {});
   };
 };
+/** Decision returned by an SSO user resolver. */
+type SSOUserResolution = {
+  action: "continue";
+} | {
+  action: "link";
+  userId: string;
+  profile: "preserve" | "update";
+} | {
+  action: "reject";
+  code: string;
+  message?: string | undefined;
+};
+/** Normalized provider attributes available to an SSO user resolver. */
+type SSOProviderUserProfile = {
+  email: string;
+  emailVerified: boolean;
+  name: string;
+  image?: string | null | undefined;
+} & Record<string, unknown>;
+/** OIDC identity and profile data available to an application's SSO resolver. */
+interface SSOUserResolutionInput {
+  protocol: "oidc";
+  providerId: string;
+  accountKey: {
+    issuer: string;
+    providerAccountId: string;
+  };
+  providerUser: SSOProviderUserProfile;
+  providerClaims: Record<string, unknown>;
+}
+/** Transaction-bound capabilities available while resolving an SSO user. */
+interface SSOUserResolutionContext {
+  database: DBTransactionAdapter;
+}
 interface SSOOptions {
+  /**
+   * Resolve a verified provider identity to a Better Auth user.
+   *
+   * Currently invoked for OIDC callbacks only.
+   *
+   * TODO: Invoke this resolver for SAML callbacks after normalizing the verified
+   * IdP entity ID as `accountKey.issuer` and the signed NameID as
+   * `accountKey.providerAccountId`.
+   *
+   * `accountKey` is derived from the validated ID Token. Profile fields and raw
+   * claims are protocol-accepted provider data and may require application-level
+   * validation. The callback runs on every OIDC sign-in inside the same native
+   * database transaction as account finalization and session creation.
+   */
+  resolveUser?: ((input: SSOUserResolutionInput, context: SSOUserResolutionContext) => Awaitable<SSOUserResolution>) | undefined;
   /**
    * custom function to provision a user when they sign in with an SSO provider.
    */
@@ -341,7 +406,7 @@ interface SSOOptions {
         domain?: string | undefined;
         domainVerified?: string | undefined;
       };
-      additionalFields?: { [key in string]: DBFieldAttribute };
+      additionalFields?: { [key in string]: DBFieldAttribute; };
     };
   } | undefined;
   /**
@@ -536,11 +601,16 @@ interface SSOOptions {
      * @default false
      */
     wantLogoutResponseSigned?: boolean;
+    /**
+     * Global fallback absolute URL or same-origin relative path for
+     * IdP-initiated SAML responses when the provider has no safe callback.
+     */
+    idpInitiatedCallbackUrl?: string | undefined;
   };
 }
 //#endregion
 //#region src/routes/domain-verification.d.ts
-declare const requestDomainVerification: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/request-domain-verification", {
+declare const requestDomainVerification: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/request-domain-verification", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -562,7 +632,7 @@ declare const requestDomainVerification: (options: SSOOptions) => better_call0.S
       };
     };
   };
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -588,7 +658,7 @@ declare const requestDomainVerification: (options: SSOOptions) => better_call0.S
 }, {
   domainVerificationToken: string;
 }>;
-declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/verify-domain", {
+declare const verifyDomain: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/verify-domain", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -613,7 +683,7 @@ declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint
       };
     };
   };
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -651,9 +721,9 @@ type ParsedCert = ReturnType<typeof parseCertificate>;
 type SanitizedCert = ParsedCert | {
   error: string;
 };
-declare const listSSOProviders: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/providers", {
+declare const listSSOProviders: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/providers", {
   method: "GET";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -709,6 +779,8 @@ declare const listSSOProviders: (options?: SSOOptions) => better_call0.StrictEnd
     } | undefined;
     samlConfig: {
       entryPoint: string;
+      callbackUrl: string | undefined;
+      idpInitiatedCallbackUrl: string | undefined;
       audience: string | undefined;
       wantAssertionsSigned: boolean | undefined;
       authnRequestsSigned: boolean | undefined;
@@ -720,9 +792,9 @@ declare const listSSOProviders: (options?: SSOOptions) => better_call0.StrictEnd
     spMetadataUrl: string;
   }[];
 }>;
-declare const getSSOProvider: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/get-provider", {
+declare const getSSOProvider: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/get-provider", {
   method: "GET";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -786,6 +858,8 @@ declare const getSSOProvider: (options?: SSOOptions) => better_call0.StrictEndpo
   } | undefined;
   samlConfig: {
     entryPoint: string;
+    callbackUrl: string | undefined;
+    idpInitiatedCallbackUrl: string | undefined;
     audience: string | undefined;
     wantAssertionsSigned: boolean | undefined;
     authnRequestsSigned: boolean | undefined;
@@ -796,9 +870,9 @@ declare const getSSOProvider: (options?: SSOOptions) => better_call0.StrictEndpo
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/update-provider", {
+declare const updateSSOProvider: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/update-provider", {
   method: "POST";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -844,37 +918,18 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
       pkce: z.ZodOptional<z.ZodOptional<z.ZodDefault<z.ZodBoolean>>>;
       overrideUserInfo: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
       mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
-        id: z.ZodString;
         email: z.ZodString;
         emailVerified: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         image: z.ZodOptional<z.ZodString>;
         extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>>;
+      }, z.core.$strict>>>;
     }, z.core.$strip>>;
     samlConfig: z.ZodOptional<z.ZodObject<{
-      entryPoint: z.ZodOptional<z.ZodString>;
-      cert: z.ZodOptional<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
       audience: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      cert: z.ZodOptional<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+      entryPoint: z.ZodOptional<z.ZodString>;
       callbackUrl: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-      idpMetadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
-        metadata: z.ZodOptional<z.ZodString>;
-        entityID: z.ZodOptional<z.ZodString>;
-        cert: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        privateKeyPass: z.ZodOptional<z.ZodString>;
-        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-        encPrivateKey: z.ZodOptional<z.ZodString>;
-        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-        singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
-          Binding: z.ZodString;
-          Location: z.ZodString;
-        }, z.core.$strip>>>;
-        singleLogoutService: z.ZodOptional<z.ZodArray<z.ZodObject<{
-          Binding: z.ZodString;
-          Location: z.ZodString;
-        }, z.core.$strip>>>;
-      }, z.core.$strip>>>;
       spMetadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
         metadata: z.ZodOptional<z.ZodString>;
         entityID: z.ZodOptional<z.ZodString>;
@@ -892,14 +947,32 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
       identifierFormat: z.ZodOptional<z.ZodOptional<z.ZodString>>;
       privateKey: z.ZodOptional<z.ZodOptional<z.ZodString>>;
       mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
-        id: z.ZodString;
         email: z.ZodString;
         emailVerified: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         firstName: z.ZodOptional<z.ZodString>;
         lastName: z.ZodOptional<z.ZodString>;
         extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>>;
+      }, z.core.$strict>>>;
+      idpInitiatedCallbackUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+      idpMetadata: z.ZodOptional<z.ZodObject<{
+        cert: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        privateKey: z.ZodOptional<z.ZodString>;
+        privateKeyPass: z.ZodOptional<z.ZodString>;
+        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
+        encPrivateKey: z.ZodOptional<z.ZodString>;
+        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
+        singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
+          Binding: z.ZodString;
+          Location: z.ZodString;
+        }, z.core.$strip>>>;
+        singleLogoutService: z.ZodOptional<z.ZodArray<z.ZodObject<{
+          Binding: z.ZodString;
+          Location: z.ZodString;
+        }, z.core.$strip>>>;
+        metadata: z.ZodOptional<z.ZodString>;
+        entityID: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
     }, z.core.$strip>>;
     providerId: z.ZodString;
   }, z.core.$strip>;
@@ -941,6 +1014,8 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
   } | undefined;
   samlConfig: {
     entryPoint: string;
+    callbackUrl: string | undefined;
+    idpInitiatedCallbackUrl: string | undefined;
     audience: string | undefined;
     wantAssertionsSigned: boolean | undefined;
     authnRequestsSigned: boolean | undefined;
@@ -951,9 +1026,9 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const deleteSSOProvider: () => better_call0.StrictEndpoint<"/sso/delete-provider", {
+declare const deleteSSOProvider: () => import("better-call").StrictEndpoint<"/sso/delete-provider", {
   method: "POST";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1002,7 +1077,7 @@ declare const deleteSSOProvider: () => better_call0.StrictEndpoint<"/sso/delete-
 }>;
 //#endregion
 //#region src/routes/sso.d.ts
-declare const spMetadata: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/metadata", {
+declare const spMetadata: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/metadata", {
   method: "GET";
   query: z.ZodObject<{
     providerId: z.ZodString;
@@ -1020,12 +1095,12 @@ declare const spMetadata: (options?: SSOOptions) => better_call0.StrictEndpoint<
     };
   };
 }, Response>;
-declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call0.StrictEndpoint<"/sso/register", {
+declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import("better-call").StrictEndpoint<"/sso/register", {
   method: "POST";
   body: z.ZodObject<{
     [x: string]: z.ZodOptional<z.ZodAny>;
   }, z.core.$strip>;
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1148,10 +1223,6 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
                         type: string;
                         nullable: boolean;
                         properties: {
-                          id: {
-                            type: string;
-                            description: string;
-                          };
                           email: {
                             type: string;
                             description: string;
@@ -1218,15 +1289,15 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
   redirectURI: string;
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
-} & Omit<InferSSOProvider<O>, "oidcConfig" | "samlConfig"> & {
+} & Omit<InferSSOProvider<O>, "samlConfig" | "oidcConfig"> & {
   domainVerified: boolean;
   domainVerificationToken: string;
 } : {
   redirectURI: string;
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
-} & Omit<InferSSOProvider<O>, "oidcConfig" | "samlConfig">>;
-declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sign-in/sso", {
+} & Omit<InferSSOProvider<O>, "samlConfig" | "oidcConfig">>;
+declare const signInSSO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sign-in/sso", {
   method: "POST";
   body: z.ZodObject<{
     email: z.ZodOptional<z.ZodString>;
@@ -1348,7 +1419,7 @@ declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"
   url: string;
   redirect: boolean;
 }>;
-declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback/:providerId", {
+declare const callbackSSO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback/:providerId", {
   method: "GET";
   query: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
@@ -1376,7 +1447,7 @@ declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint
  * Used when `options.redirectURI` is set — the `providerId` is read from
  * the OAuth state instead of the URL path.
  */
-declare const callbackSSOShared: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback", {
+declare const callbackSSOShared: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback", {
   metadata: {
     openapi: {
       operationId: string;
@@ -1399,7 +1470,7 @@ declare const callbackSSOShared: (options?: SSOOptions) => better_call0.StrictEn
   }, z.core.$strip>;
   allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
 }, void>;
-declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+declare const acsEndpoint: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLResponse: z.ZodString;
@@ -1429,7 +1500,7 @@ declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint
     scope: "server";
   };
 }, never>;
-declare const sloEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
+declare const sloEndpoint: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLRequest: z.ZodOptional<z.ZodString>;
@@ -1450,12 +1521,12 @@ declare const sloEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint
     scope: "server";
   };
 }, void | Response>;
-declare const initiateSLO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/logout/:providerId", {
+declare const initiateSLO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/logout/:providerId", {
   method: "POST";
   body: z.ZodObject<{
     callbackURL: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1600,7 +1671,29 @@ interface OIDCDiscoveryDocument {
 /**
  * Error codes for OIDC discovery operations.
  */
-type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */ | "discovery_invalid_url" /** OIDC endpoint URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */ | "discovery_private_host" /** Server-side OIDC endpoint fetch received an HTTP redirect response */ | "oidc_endpoint_redirect" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
+type DiscoveryErrorCode =
+/** Request to discovery endpoint timed out */
+"discovery_timeout" |
+/** Discovery endpoint returned 404 or similar */
+"discovery_not_found" |
+/** Discovery endpoint returned invalid JSON */
+"discovery_invalid_json" |
+/** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */
+"discovery_invalid_url" |
+/** OIDC endpoint URL is not trusted by the trusted origins configuration */
+"discovery_untrusted_origin" |
+/** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */
+"discovery_private_host" |
+/** Server-side OIDC endpoint fetch received an HTTP redirect response */
+"oidc_endpoint_redirect" |
+/** Discovery document issuer doesn't match configured issuer */
+"issuer_mismatch" |
+/** Discovery document is missing required fields */
+"discovery_incomplete" |
+/** IdP only advertises token auth methods that Better Auth doesn't currently support */
+"unsupported_token_auth_method" |
+/** Catch-all for unexpected errors */
+"discovery_unexpected_error";
 /**
  * Custom error class for OIDC discovery failures.
  * Can be caught and mapped to APIError at the edge.
@@ -1837,4 +1930,4 @@ declare function sso<O extends SSOOptions>(options?: O | undefined): {
   options: NoInfer<O>;
 };
 //#endregion
-export { DataEncryptionAlgorithm as A, DEFAULT_MAX_SAML_METADATA_SIZE as C, SSOOptions as D, SAMLConfig as E, DigestAlgorithm as M, KeyEncryptionAlgorithm as N, SSOProvider as O, SignatureAlgorithm as P, DEFAULT_CLOCK_SKEW_MS as S, OIDCConfig as T, REQUIRED_DISCOVERY_FIELDS as _, fetchDiscoveryDocument as a, TimestampValidationOptions as b, normalizeUrl as c, validateDiscoveryUrl as d, DiscoverOIDCConfigParams as f, OIDCDiscoveryDocument as g, HydratedOIDCConfig as h, discoverOIDCConfig as i, DeprecatedAlgorithmBehavior as j, AlgorithmValidationOptions as k, selectTokenEndpointAuthMethod as l, DiscoveryErrorCode as m, sso as n, needsRuntimeDiscovery as o, DiscoveryError as p, computeDiscoveryUrl as r, normalizeDiscoveryUrls as s, SSOPlugin as t, validateDiscoveryDocument as u, RequiredDiscoveryField as v, DEFAULT_MAX_SAML_RESPONSE_SIZE as w, validateSAMLTimestamp as x, SAMLConditions as y };
+export { SSOProviderUserProfile as A, DEFAULT_MAX_SAML_METADATA_SIZE as C, SAMLIdentityProviderMetadata as D, SAMLConfig as E, DataEncryptionAlgorithm as F, DeprecatedAlgorithmBehavior as I, DigestAlgorithm as L, SSOUserResolutionContext as M, SSOUserResolutionInput as N, SSOOptions as O, AlgorithmValidationOptions as P, KeyEncryptionAlgorithm as R, DEFAULT_CLOCK_SKEW_MS as S, OIDCConfig as T, REQUIRED_DISCOVERY_FIELDS as _, fetchDiscoveryDocument as a, TimestampValidationOptions as b, normalizeUrl as c, validateDiscoveryUrl as d, DiscoverOIDCConfigParams as f, OIDCDiscoveryDocument as g, HydratedOIDCConfig as h, discoverOIDCConfig as i, SSOUserResolution as j, SSOProvider as k, selectTokenEndpointAuthMethod as l, DiscoveryErrorCode as m, sso as n, needsRuntimeDiscovery as o, DiscoveryError as p, computeDiscoveryUrl as r, normalizeDiscoveryUrls as s, SSOPlugin as t, validateDiscoveryDocument as u, RequiredDiscoveryField as v, DEFAULT_MAX_SAML_RESPONSE_SIZE as w, validateSAMLTimestamp as x, SAMLConditions as y, SignatureAlgorithm as z };

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as DataEncryptionAlgorithm, C as DEFAULT_MAX_SAML_METADATA_SIZE, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as DEFAULT_CLOCK_SKEW_MS, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as DEFAULT_MAX_SAML_RESPONSE_SIZE, x as validateSAMLTimestamp, y as SAMLConditions } from "./index-A_DJ_AqL.mjs";
-export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SSOOptions, SSOPlugin, SSOProvider, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };
+import { A as SSOProviderUserProfile, C as DEFAULT_MAX_SAML_METADATA_SIZE, D as SAMLIdentityProviderMetadata, E as SAMLConfig, F as DataEncryptionAlgorithm, I as DeprecatedAlgorithmBehavior, L as DigestAlgorithm, M as SSOUserResolutionContext, N as SSOUserResolutionInput, O as SSOOptions, P as AlgorithmValidationOptions, R as KeyEncryptionAlgorithm, S as DEFAULT_CLOCK_SKEW_MS, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOUserResolution, k as SSOProvider, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as DEFAULT_MAX_SAML_RESPONSE_SIZE, x as validateSAMLTimestamp, y as SAMLConditions, z as SignatureAlgorithm } from "./index-D1yk91me.mjs";
+export { type AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, type DeprecatedAlgorithmBehavior, DigestAlgorithm, type DiscoverOIDCConfigParams, DiscoveryError, type DiscoveryErrorCode, type HydratedOIDCConfig, KeyEncryptionAlgorithm, type OIDCConfig, type OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, type RequiredDiscoveryField, type SAMLConditions, type SAMLConfig, type SAMLIdentityProviderMetadata, type SSOOptions, SSOPlugin, type SSOProvider, type SSOProviderUserProfile, type SSOUserResolution, type SSOUserResolutionContext, type SSOUserResolutionInput, SignatureAlgorithm, type TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };