@better-auth/sso 1.7.0-rc.1 → 1.7.0-rc.3

package/dist/client.d.mts

@@ -1,6 +1,5 @@
-import { t as SSOPlugin } from "./index-A_DJ_AqL.mjs";
+import { t as SSOPlugin } from "./index-Sxfa9KQp.mjs";
 import { DBFieldAttribute } from "better-auth/db";
-
 //#region src/client.d.ts
 interface SSOClientOptions {
   domainVerification?: {

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-lPD-GbqS.mjs";
+import { t as PACKAGE_VERSION } from "./version-xoFrTW0m.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-A_DJ_AqL.d.mts → index-Sxfa9KQp.d.mts}

@@ -1,9 +1,11 @@
 import { APIError } from "better-auth/api";
 import * as z from "zod";
+import "@better-fetch/fetch";
+import samlifyDefault from "samlify";
 import { DBFieldAttribute, FieldAttributeToObject, InferAdditionalFieldsFromPluginOptions, RemoveFieldsWithReturnedFalse } from "better-auth/db";
-import { Awaitable, OAuth2Tokens, User } from "better-auth";
-import * as better_call0 from "better-call";
-
+import { Awaitable, DBTransactionAdapter, OAuth2Tokens, User } from "better-auth";
+import "@better-auth/core/db/adapter";
+import "@better-auth/core";
 //#region src/saml/algorithms.d.ts
 declare const SignatureAlgorithm: {
   readonly RSA_SHA1: "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
@@ -45,7 +47,6 @@ interface AlgorithmValidationOptions {
 //#endregion
 //#region src/types.d.ts
 interface OIDCMapping {
-  id?: string | undefined;
   email?: string | undefined;
   emailVerified?: string | undefined;
   name?: string | undefined;
@@ -53,7 +54,6 @@ interface OIDCMapping {
   extraFields?: Record<string, string> | undefined;
 }
 interface SAMLMapping {
-  id?: string | undefined;
   email?: string | undefined;
   emailVerified?: string | undefined;
   name?: string | undefined;
@@ -90,6 +90,41 @@ interface OIDCConfig {
    */
   allowIdpInitiated?: boolean | undefined;
 }
+interface SAMLIdentityProviderMetadataBase {
+  /**
+   * IdP signing certificate(s). Pass a single PEM string or an array for
+   * rolling rotation. Takes precedence over the top-level `cert` when both
+   * are set. Omit when `metadata` XML is supplied.
+   */
+  cert?: string | string[] | undefined;
+  privateKey?: string | undefined;
+  privateKeyPass?: string | undefined;
+  isAssertionEncrypted?: boolean | undefined;
+  encPrivateKey?: string | undefined;
+  encPrivateKeyPass?: string | undefined;
+  singleSignOnService?: Array<{
+    Binding: string;
+    Location: string;
+  }> | undefined;
+  singleLogoutService?: Array<{
+    Binding: string;
+    Location: string;
+  }> | undefined;
+}
+/**
+ * The trusted identity-provider authority for a SAML connection.
+ *
+ * Metadata XML carries the IdP entity ID. Manual configurations must declare
+ * `entityID` explicitly so the service provider's issuer is never mistaken
+ * for the identity provider's authority.
+ */
+type SAMLIdentityProviderMetadata = SAMLIdentityProviderMetadataBase & ({
+  metadata: string;
+  entityID?: string | undefined;
+} | {
+  metadata?: undefined;
+  entityID: string;
+});
 interface SAMLConfig {
   /**
    * SP Entity ID. Used as the `entityID` in SP metadata when
@@ -118,29 +153,12 @@ interface SAMLConfig {
    * flows when no RelayState callback URL is available.
    */
   callbackUrl?: string | undefined;
-  idpMetadata?: {
-    metadata?: string;
-    entityID?: string;
-    /**
-     * IdP signing certificate(s). Pass a single PEM string or an array
-     * for rolling rotation. Takes precedence over the top-level `cert`
-     * when both are set. Omit when `metadata` XML is supplied.
-     */
-    cert?: string | string[];
-    privateKey?: string;
-    privateKeyPass?: string;
-    isAssertionEncrypted?: boolean;
-    encPrivateKey?: string;
-    encPrivateKeyPass?: string;
-    singleSignOnService?: Array<{
-      Binding: string;
-      Location: string;
-    }>;
-    singleLogoutService?: Array<{
-      Binding: string;
-      Location: string;
-    }>;
-  } | undefined;
+  /**
+   * Fallback absolute URL or same-origin relative path for IdP-initiated SAML
+   * responses when RelayState has no safe callback, including error redirects.
+   */
+  idpInitiatedCallbackUrl?: string | undefined;
+  idpMetadata: SAMLIdentityProviderMetadata;
   /**
    * SP metadata configuration. All fields are optional; when omitted,
    * SP metadata is auto-generated from `issuer`, `wantAssertionsSigned`,
@@ -157,9 +175,10 @@ interface SAMLConfig {
     encPrivateKeyPass?: string | undefined;
   };
   /**
-   * Request signed assertions from the IdP. When true, the SP metadata
-   * advertises `WantAssertionsSigned="true"` and samlify will reject
-   * unsigned assertions.
+   * Request and require signed assertions from the IdP. When true, generated
+   * SP metadata advertises `WantAssertionsSigned="true"` and the ACS rejects
+   * unsigned assertions. Custom SP metadata supplies the effective policy and
+   * accepts the XML Schema boolean forms `true`, `false`, `1`, and `0`.
    */
   wantAssertionsSigned?: boolean | undefined;
   authnRequestsSigned?: boolean | undefined;
@@ -204,7 +223,125 @@ type SSOProviderSchema<O extends SSOOptions> = {
     } ? Field : {});
   };
 };
+/** Decision returned by an SSO user resolver. */
+type SSOUserResolution = {
+  action: "continue";
+} | {
+  action: "link";
+  userId: string;
+  profile: "preserve" | "update";
+} | {
+  action: "reject";
+  code: string;
+  message?: string | undefined;
+};
+/** Normalized provider attributes available to an SSO user resolver. */
+type SSOProviderUserProfile = {
+  email: string;
+  emailVerified: boolean;
+  name: string;
+  image?: string | null | undefined;
+} & Record<string, unknown>;
+/**
+ * Opaque reference to the SSO provider configuration accepted for the current
+ * authentication flow.
+ *
+ * This reference is a transient authentication fence. Applications must not
+ * persist it as a tenant or user binding.
+ */
+interface SSOProviderReference {
+  providerId: string;
+  source: {
+    type: "configured";
+  } | {
+    type: "persisted";
+    recordId: string;
+  };
+  authenticationConfigurationFingerprint: string;
+}
+interface BaseSSOUserResolutionInput {
+  providerId: string;
+  accountKey: {
+    issuer: string;
+    providerAccountId: string;
+  };
+  providerUser: SSOProviderUserProfile;
+  providerReference: SSOProviderReference;
+}
+/** OIDC identity and profile data available to an application's SSO resolver. */
+interface SSOOIDCUserResolutionInput extends BaseSSOUserResolutionInput {
+  protocol: "oidc";
+  /** Raw claims from UserInfo, or the verified ID Token when UserInfo is absent. */
+  providerClaims: Record<string, unknown>;
+  /** Claims from the cryptographically verified ID Token. */
+  verifiedIdTokenClaims: Record<string, unknown>;
+}
+/** SAML identity and assertion data available to an application's SSO resolver. */
+interface SSOSAMLUserResolutionInput extends BaseSSOUserResolutionInput {
+  protocol: "saml";
+  /**
+   * Attributes from the verified assertion. Multi-valued attributes remain
+   * arrays and all scalar values remain strings.
+   */
+  providerAttributes: Record<string, string | readonly string[]>;
+}
+/** Verified SSO identity and provider data available to an application resolver. */
+type SSOUserResolutionInput = SSOOIDCUserResolutionInput | SSOSAMLUserResolutionInput;
+/** Transaction-bound capabilities available while resolving an SSO user. */
+interface SSOUserResolutionContext {
+  database: DBTransactionAdapter;
+}
+interface BaseSSOProviderMutationGuardInput {
+  provider: {
+    id: string;
+    providerId: string;
+    organizationId: string | null;
+  };
+  /**
+   * Opaque reference to the exact locked provider configuration.
+   *
+   * This value is transient and must not be persisted as a tenant binding.
+   */
+  providerReference: SSOProviderReference;
+}
+/** Mutation attempted against one exact persisted SSO provider row. */
+type SSOProviderMutationGuardInput = (BaseSSOProviderMutationGuardInput & {
+  action: "update";
+  /**
+   * True when the validated proposal changes provider identity,
+   * routing, or verification policy used to authenticate accounts.
+   */
+  isAuthenticationBoundaryChange: boolean;
+}) | (BaseSSOProviderMutationGuardInput & {
+  action: "delete";
+});
+/** Transaction-bound context for guarding a persisted provider mutation. */
+interface SSOProviderMutationGuardContext {
+  database: DBTransactionAdapter;
+}
 interface SSOOptions {
+  /**
+   * Resolve a verified provider identity to a Better Auth user.
+   *
+   * For OIDC, `accountKey` is derived from the validated ID Token. For SAML,
+   * it contains the verified IdP entity ID and signed NameID. Profile fields,
+   * raw OIDC claims, and SAML assertion attributes are protocol-accepted
+   * provider data and may require application-level validation.
+   *
+   * The callback runs on every SSO sign-in inside the same native database
+   * transaction as account finalization and session creation.
+   */
+  resolveUser?: ((input: SSOUserResolutionInput, context: SSOUserResolutionContext) => Awaitable<SSOUserResolution>) | undefined;
+  /**
+   * Guards updates and deletion of an exact persisted SSO provider.
+   *
+   * The callback runs after the provider row is locked and before any provider
+   * or linked Account mutation. Update inputs disclose only whether the
+   * validated proposal changes the authentication boundary; proposed secrets
+   * and configuration values are never exposed. Throw to reject the mutation.
+   * Better Auth converts callback failures into a stable conflict response.
+   */
+  guardProviderMutation?: ((input: SSOProviderMutationGuardInput, context: SSOProviderMutationGuardContext) => Awaitable<void>) | undefined;
   /**
    * custom function to provision a user when they sign in with an SSO provider.
    */
@@ -341,7 +478,7 @@ interface SSOOptions {
         domain?: string | undefined;
         domainVerified?: string | undefined;
       };
-      additionalFields?: { [key in string]: DBFieldAttribute };
+      additionalFields?: { [key in string]: DBFieldAttribute; };
     };
   } | undefined;
   /**
@@ -511,7 +648,7 @@ interface SSOOptions {
      */
     maxResponseSize?: number;
     /**
-     * Maximum allowed size for IdP metadata XML in bytes.
+     * Maximum allowed size for IdP or SP metadata XML in bytes.
      *
      * @default 102400 (100KB)
      */
@@ -536,11 +673,16 @@ interface SSOOptions {
      * @default false
      */
     wantLogoutResponseSigned?: boolean;
+    /**
+     * Global fallback absolute URL or same-origin relative path for
+     * IdP-initiated SAML responses when the provider has no safe callback.
+     */
+    idpInitiatedCallbackUrl?: string | undefined;
   };
 }
 //#endregion
 //#region src/routes/domain-verification.d.ts
-declare const requestDomainVerification: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/request-domain-verification", {
+declare const requestDomainVerification: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/request-domain-verification", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -562,7 +704,7 @@ declare const requestDomainVerification: (options: SSOOptions) => better_call0.S
       };
     };
   };
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -588,7 +730,7 @@ declare const requestDomainVerification: (options: SSOOptions) => better_call0.S
 }, {
   domainVerificationToken: string;
 }>;
-declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/verify-domain", {
+declare const verifyDomain: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/verify-domain", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -613,7 +755,7 @@ declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint
       };
     };
   };
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -651,9 +793,9 @@ type ParsedCert = ReturnType<typeof parseCertificate>;
 type SanitizedCert = ParsedCert | {
   error: string;
 };
-declare const listSSOProviders: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/providers", {
+declare const listSSOProviders: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/providers", {
   method: "GET";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -709,6 +851,8 @@ declare const listSSOProviders: (options?: SSOOptions) => better_call0.StrictEnd
     } | undefined;
     samlConfig: {
       entryPoint: string;
+      callbackUrl: string | undefined;
+      idpInitiatedCallbackUrl: string | undefined;
       audience: string | undefined;
       wantAssertionsSigned: boolean | undefined;
       authnRequestsSigned: boolean | undefined;
@@ -720,9 +864,9 @@ declare const listSSOProviders: (options?: SSOOptions) => better_call0.StrictEnd
     spMetadataUrl: string;
   }[];
 }>;
-declare const getSSOProvider: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/get-provider", {
+declare const getSSOProvider: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/get-provider", {
   method: "GET";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -786,6 +930,8 @@ declare const getSSOProvider: (options?: SSOOptions) => better_call0.StrictEndpo
   } | undefined;
   samlConfig: {
     entryPoint: string;
+    callbackUrl: string | undefined;
+    idpInitiatedCallbackUrl: string | undefined;
     audience: string | undefined;
     wantAssertionsSigned: boolean | undefined;
     authnRequestsSigned: boolean | undefined;
@@ -796,9 +942,9 @@ declare const getSSOProvider: (options?: SSOOptions) => better_call0.StrictEndpo
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/update-provider", {
+declare const updateSSOProvider: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/update-provider", {
   method: "POST";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -844,22 +990,44 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
       pkce: z.ZodOptional<z.ZodOptional<z.ZodDefault<z.ZodBoolean>>>;
       overrideUserInfo: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
       mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
-        id: z.ZodString;
         email: z.ZodString;
         emailVerified: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         image: z.ZodOptional<z.ZodString>;
         extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>>;
+      }, z.core.$strict>>>;
     }, z.core.$strip>>;
     samlConfig: z.ZodOptional<z.ZodObject<{
-      entryPoint: z.ZodOptional<z.ZodString>;
-      cert: z.ZodOptional<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
       audience: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-      callbackUrl: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-      idpMetadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+      mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+        email: z.ZodString;
+        emailVerified: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        firstName: z.ZodOptional<z.ZodString>;
+        lastName: z.ZodOptional<z.ZodString>;
+        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      }, z.core.$strict>>>;
+      privateKey: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      spMetadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
         metadata: z.ZodOptional<z.ZodString>;
         entityID: z.ZodOptional<z.ZodString>;
+        binding: z.ZodOptional<z.ZodString>;
+        privateKey: z.ZodOptional<z.ZodString>;
+        privateKeyPass: z.ZodOptional<z.ZodString>;
+        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
+        encPrivateKey: z.ZodOptional<z.ZodString>;
+        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>>;
+      cert: z.ZodOptional<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+      entryPoint: z.ZodOptional<z.ZodString>;
+      callbackUrl: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      wantAssertionsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+      authnRequestsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+      signatureAlgorithm: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      digestAlgorithm: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      identifierFormat: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      idpInitiatedCallbackUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+      idpMetadata: z.ZodOptional<z.ZodObject<{
         cert: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
         privateKey: z.ZodOptional<z.ZodString>;
         privateKeyPass: z.ZodOptional<z.ZodString>;
@@ -874,32 +1042,9 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
           Binding: z.ZodString;
           Location: z.ZodString;
         }, z.core.$strip>>>;
-      }, z.core.$strip>>>;
-      spMetadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
         metadata: z.ZodOptional<z.ZodString>;
         entityID: z.ZodOptional<z.ZodString>;
-        binding: z.ZodOptional<z.ZodString>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        privateKeyPass: z.ZodOptional<z.ZodString>;
-        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-        encPrivateKey: z.ZodOptional<z.ZodString>;
-        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>>>;
-      wantAssertionsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
-      authnRequestsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
-      signatureAlgorithm: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-      digestAlgorithm: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-      identifierFormat: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-      privateKey: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-      mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
-        id: z.ZodString;
-        email: z.ZodString;
-        emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        firstName: z.ZodOptional<z.ZodString>;
-        lastName: z.ZodOptional<z.ZodString>;
-        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>>;
+      }, z.core.$strip>>;
     }, z.core.$strip>>;
     providerId: z.ZodString;
   }, z.core.$strip>;
@@ -941,6 +1086,8 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
   } | undefined;
   samlConfig: {
     entryPoint: string;
+    callbackUrl: string | undefined;
+    idpInitiatedCallbackUrl: string | undefined;
     audience: string | undefined;
     wantAssertionsSigned: boolean | undefined;
     authnRequestsSigned: boolean | undefined;
@@ -951,9 +1098,9 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const deleteSSOProvider: () => better_call0.StrictEndpoint<"/sso/delete-provider", {
+declare const deleteSSOProvider: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/delete-provider", {
   method: "POST";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1002,7 +1149,7 @@ declare const deleteSSOProvider: () => better_call0.StrictEndpoint<"/sso/delete-
 }>;
 //#endregion
 //#region src/routes/sso.d.ts
-declare const spMetadata: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/metadata", {
+declare const spMetadata: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/metadata", {
   method: "GET";
   query: z.ZodObject<{
     providerId: z.ZodString;
@@ -1020,12 +1167,12 @@ declare const spMetadata: (options?: SSOOptions) => better_call0.StrictEndpoint<
     };
   };
 }, Response>;
-declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call0.StrictEndpoint<"/sso/register", {
+declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import("better-call").StrictEndpoint<"/sso/register", {
   method: "POST";
   body: z.ZodObject<{
     [x: string]: z.ZodOptional<z.ZodAny>;
   }, z.core.$strip>;
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1148,10 +1295,6 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
                         type: string;
                         nullable: boolean;
                         properties: {
-                          id: {
-                            type: string;
-                            description: string;
-                          };
                           email: {
                             type: string;
                             description: string;
@@ -1218,15 +1361,15 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
   redirectURI: string;
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
-} & Omit<InferSSOProvider<O>, "oidcConfig" | "samlConfig"> & {
+} & Omit<InferSSOProvider<O>, "samlConfig" | "oidcConfig"> & {
   domainVerified: boolean;
   domainVerificationToken: string;
 } : {
   redirectURI: string;
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
-} & Omit<InferSSOProvider<O>, "oidcConfig" | "samlConfig">>;
-declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sign-in/sso", {
+} & Omit<InferSSOProvider<O>, "samlConfig" | "oidcConfig">>;
+declare const signInSSO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sign-in/sso", {
   method: "POST";
   body: z.ZodObject<{
     email: z.ZodOptional<z.ZodString>;
@@ -1348,7 +1491,7 @@ declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"
   url: string;
   redirect: boolean;
 }>;
-declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback/:providerId", {
+declare const callbackSSO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback/:providerId", {
   method: "GET";
   query: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
@@ -1376,7 +1519,7 @@ declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint
  * Used when `options.redirectURI` is set — the `providerId` is read from
  * the OAuth state instead of the URL path.
  */
-declare const callbackSSOShared: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback", {
+declare const callbackSSOShared: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback", {
   metadata: {
     openapi: {
       operationId: string;
@@ -1399,7 +1542,7 @@ declare const callbackSSOShared: (options?: SSOOptions) => better_call0.StrictEn
   }, z.core.$strip>;
   allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
 }, void>;
-declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+declare const acsEndpoint: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLResponse: z.ZodString;
@@ -1429,7 +1572,7 @@ declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint
     scope: "server";
   };
 }, never>;
-declare const sloEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
+declare const sloEndpoint: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLRequest: z.ZodOptional<z.ZodString>;
@@ -1450,12 +1593,12 @@ declare const sloEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint
     scope: "server";
   };
 }, void | Response>;
-declare const initiateSLO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/logout/:providerId", {
+declare const initiateSLO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/logout/:providerId", {
   method: "POST";
   body: z.ZodObject<{
     callbackURL: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1505,6 +1648,25 @@ declare const DEFAULT_MAX_SAML_RESPONSE_SIZE: number;
  */
 declare const DEFAULT_MAX_SAML_METADATA_SIZE: number;
 //#endregion
+//#region src/routes/helpers.d.ts
+interface SAMLServiceProviderPolicy {
+  /** Effective assertion-signing requirement advertised by SP metadata. */
+  wantAssertionsSigned: boolean;
+}
+/**
+ * Parses custom SP metadata and returns its effective verification policy.
+ *
+ * Configurations without custom metadata use the code-defined policy directly.
+ * Invalid or unusable custom metadata throws an API error with the
+ * `SAML_INVALID_SP_METADATA` code.
+ */
+declare function deriveSAMLServiceProviderPolicy(config: Pick<SAMLConfig, "spMetadata" | "wantAssertionsSigned">): SAMLServiceProviderPolicy;
+/**
+ * Derive the verified SAML identity-provider entity ID using the same metadata
+ * parsing and manual-configuration validation as SAML authentication.
+ */
+declare function deriveSAMLIdentityProviderEntityID(config: SAMLConfig): string;
+//#endregion
 //#region src/saml/timestamp.d.ts
 interface TimestampValidationOptions {
   clockSkew?: number;
@@ -1600,7 +1762,29 @@ interface OIDCDiscoveryDocument {
 /**
  * Error codes for OIDC discovery operations.
  */
-type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */ | "discovery_invalid_url" /** OIDC endpoint URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */ | "discovery_private_host" /** Server-side OIDC endpoint fetch received an HTTP redirect response */ | "oidc_endpoint_redirect" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
+type DiscoveryErrorCode =
+/** Request to discovery endpoint timed out */
+"discovery_timeout" |
+/** Discovery endpoint returned 404 or similar */
+"discovery_not_found" |
+/** Discovery endpoint returned invalid JSON */
+"discovery_invalid_json" |
+/** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */
+"discovery_invalid_url" |
+/** OIDC endpoint URL is not trusted by the trusted origins configuration */
+"discovery_untrusted_origin" |
+/** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */
+"discovery_private_host" |
+/** Server-side OIDC endpoint fetch received an HTTP redirect response */
+"oidc_endpoint_redirect" |
+/** Discovery document issuer doesn't match configured issuer */
+"issuer_mismatch" |
+/** Discovery document is missing required fields */
+"discovery_incomplete" |
+/** IdP only advertises token auth methods that Better Auth doesn't currently support */
+"unsupported_token_auth_method" |
+/** Catch-all for unexpected errors */
+"discovery_unexpected_error";
 /**
  * Custom error class for OIDC discovery failures.
  * Can be caught and mapped to APIError at the edge.
@@ -1837,4 +2021,4 @@ declare function sso<O extends SSOOptions>(options?: O | undefined): {
   options: NoInfer<O>;
 };
 //#endregion
-export { DataEncryptionAlgorithm as A, DEFAULT_MAX_SAML_METADATA_SIZE as C, SSOOptions as D, SAMLConfig as E, DigestAlgorithm as M, KeyEncryptionAlgorithm as N, SSOProvider as O, SignatureAlgorithm as P, DEFAULT_CLOCK_SKEW_MS as S, OIDCConfig as T, REQUIRED_DISCOVERY_FIELDS as _, fetchDiscoveryDocument as a, TimestampValidationOptions as b, normalizeUrl as c, validateDiscoveryUrl as d, DiscoverOIDCConfigParams as f, OIDCDiscoveryDocument as g, HydratedOIDCConfig as h, discoverOIDCConfig as i, DeprecatedAlgorithmBehavior as j, AlgorithmValidationOptions as k, selectTokenEndpointAuthMethod as l, DiscoveryErrorCode as m, sso as n, needsRuntimeDiscovery as o, DiscoveryError as p, computeDiscoveryUrl as r, normalizeDiscoveryUrls as s, SSOPlugin as t, validateDiscoveryDocument as u, RequiredDiscoveryField as v, DEFAULT_MAX_SAML_RESPONSE_SIZE as w, validateSAMLTimestamp as x, SAMLConditions as y };
+export { SAMLIdentityProviderMetadata as A, SSOUserResolutionContext as B, deriveSAMLIdentityProviderEntityID as C, DEFAULT_MAX_SAML_RESPONSE_SIZE as D, DEFAULT_MAX_SAML_METADATA_SIZE as E, SSOProviderMutationGuardInput as F, DigestAlgorithm as G, AlgorithmValidationOptions as H, SSOProviderReference as I, KeyEncryptionAlgorithm as K, SSOProviderUserProfile as L, SSOOptions as M, SSOProvider as N, OIDCConfig as O, SSOProviderMutationGuardContext as P, SSOSAMLUserResolutionInput as R, SAMLServiceProviderPolicy as S, DEFAULT_CLOCK_SKEW_MS as T, DataEncryptionAlgorithm as U, SSOUserResolutionInput as V, DeprecatedAlgorithmBehavior as W, REQUIRED_DISCOVERY_FIELDS as _, fetchDiscoveryDocument as a, TimestampValidationOptions as b, normalizeUrl as c, validateDiscoveryUrl as d, DiscoverOIDCConfigParams as f, OIDCDiscoveryDocument as g, HydratedOIDCConfig as h, discoverOIDCConfig as i, SSOOIDCUserResolutionInput as j, SAMLConfig as k, selectTokenEndpointAuthMethod as l, DiscoveryErrorCode as m, sso as n, needsRuntimeDiscovery as o, DiscoveryError as p, SignatureAlgorithm as q, computeDiscoveryUrl as r, normalizeDiscoveryUrls as s, SSOPlugin as t, validateDiscoveryDocument as u, RequiredDiscoveryField as v, deriveSAMLServiceProviderPolicy as w, validateSAMLTimestamp as x, SAMLConditions as y, SSOUserResolution as z };

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as DataEncryptionAlgorithm, C as DEFAULT_MAX_SAML_METADATA_SIZE, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as DEFAULT_CLOCK_SKEW_MS, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as DEFAULT_MAX_SAML_RESPONSE_SIZE, x as validateSAMLTimestamp, y as SAMLConditions } from "./index-A_DJ_AqL.mjs";
-export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SSOOptions, SSOPlugin, SSOProvider, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };
+import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-Sxfa9KQp.mjs";
+export { type AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, type DeprecatedAlgorithmBehavior, DigestAlgorithm, type DiscoverOIDCConfigParams, DiscoveryError, type DiscoveryErrorCode, type HydratedOIDCConfig, KeyEncryptionAlgorithm, type OIDCConfig, type OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, type RequiredDiscoveryField, type SAMLConditions, type SAMLConfig, type SAMLIdentityProviderMetadata, type SAMLServiceProviderPolicy, type SSOOIDCUserResolutionInput, type SSOOptions, SSOPlugin, type SSOProvider, type SSOProviderMutationGuardContext, type SSOProviderMutationGuardInput, type SSOProviderReference, type SSOProviderUserProfile, type SSOSAMLUserResolutionInput, type SSOUserResolution, type SSOUserResolutionContext, type SSOUserResolutionInput, SignatureAlgorithm, type TimestampValidationOptions, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };