@protobase/server 0.21.9 → 0.21.11

package/dist/better-auth/create-auth.d.ts

@@ -6,6 +6,7 @@ import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js
 import { OrganizationRole } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
+import { SsoOptions } from "./saml-sign-in.js";
 import { signUpPaths } from "./sign-up/sign-up-plugin.js";
 import "../index.js";
 import { BetterAuthOptions } from "better-auth";
@@ -96,6 +97,13 @@ export type CreateAuthOptions = {
    * environment says. Left out when `socialProviders` has a provider with the same id.
    */
   signInProvider?: PlatformSignIn | false;
+  /**
+   * Single sign-on with the app's SAML 2.0 identity providers, for example `{ saml: [{ id: 'okta', name: 'Okta',
+   * domains: ['example.com'], idp: { metadata } }] }` (see `SamlProvider`). Like `socialProviders`, a provider signs up
+   * people without an account, with the default role, but only at its `domains`, where it also links to the account
+   * with the same address. Default none.
+   */
+  sso?: SsoOptions;
   /**
    * Turns on organizations: people work in one at a time, records of `.tenant` resources are scoped to it, and roles
    * are held globally (on the user) or per membership. Off by default: the app works as one organization.
@@ -2323,7 +2331,9 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress?: string | null | undefined;
+              ipAddress?
+              /** The app's name it signs in and mails as: `appName`, else `PROTOBASE_APP_NAME`, else `Protobase`. */
+              /** The app's name it signs in and mails as: `appName`, else `PROTOBASE_APP_NAME`, else `Protobase`. */ : string | null | undefined;
               userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
@@ -3085,208 +3095,33 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
     };
   } | {
-    id: "protobase-sign-in-policy";
-    schema: {
-      readonly signInPolicy: {
-        readonly modelName: "sign_in_policy";
-        readonly fields: {
-          readonly password: {
-            readonly type: "string";
-            readonly required: true;
-          };
-          readonly emailCode: {
-            readonly type: "string";
-            readonly required: true;
-            readonly fieldName: "email_code";
-          };
-          readonly passkey: {
-            readonly type: "string";
-            readonly required: true;
-          };
-          readonly twoFactor: {
-            readonly type: "string";
-            readonly required: true;
-            readonly fieldName: "two_factor";
-          };
-          readonly staffAccess: {
-            readonly type: "string";
-            readonly required: true;
-            readonly defaultValue: "allowed";
-            readonly fieldName: "staff_access";
-          };
-          readonly platformSignIn: {
-            readonly type: "string";
-            readonly required: true;
-            readonly defaultValue: "allowed";
-            readonly fieldName: "platform_sign_in";
-          };
-          readonly createdAt: {
-            readonly type: "date";
-            readonly required: true;
-            readonly fieldName: "created_at";
-          };
-          readonly createdBy: {
-            readonly type: "string";
-            readonly required: false;
-            readonly fieldName: "created_by";
-          };
-        };
-      };
-    };
+    id: "sso";
+    version: string;
     endpoints: {
-      getSignInPolicy: import("better-auth").StrictEndpoint<"/policy/sign-in", {
+      spMetadata: ReturnType<(options?: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sso/saml2/sp/metadata", {
         method: "GET";
-        use: import("better-auth").Middleware<{
-          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
-            session: {
-              session: Record<string, any> & {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                userId: string;
-                expiresAt: Date;
-                token: string;
-                ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
-              };
-              user: Record<string, any> & {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-              };
-            };
-          }>>[];
-        }, (inputContext: import("better-auth").MiddlewareInputContext<{
-          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
-            session: {
-              session: Record<string, any> & {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                userId: string;
-                expiresAt: Date;
-                token: string;
-                ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
-              };
-              user: Record<string, any> & {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
+        query: import("zod").ZodObject<{
+          providerId: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "200": {
+                description: string;
               };
             };
-          }>>[];
-        }>) => Promise<{
-          session: {
-            session: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
-            };
-            user: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            };
-          } & {
-            session: {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
-            } & Record<string, any>;
-            user: {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            } & Record<string, any>;
           };
-        }>>[];
-      }, {
-        savedBy?: string | undefined;
-        savedAt?: string | undefined;
-        platformSignIn?: string | undefined;
-        operator?: string | undefined;
-        policy: SignInPolicy;
-        effective: SignInPolicy;
-        mail: boolean;
-      }>;
-      setSignInPolicy: import("better-auth").StrictEndpoint<"/policy/sign-in", {
+        };
+      }, Response>>;
+      registerSSOProvider: import("better-auth").StrictEndpoint<"/sso/register", {
         method: "POST";
-        use: import("better-auth").Middleware<{
-          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
-            session: {
-              session: Record<string, any> & {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                userId: string;
-                expiresAt: Date;
-                token: string;
-                ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
-              };
-              user: Record<string, any> & {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-              };
-            };
-          }>>[];
-        }, (inputContext: import("better-auth").MiddlewareInputContext<{
-          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
-            session: {
-              session: Record<string, any> & {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                userId: string;
-                expiresAt: Date;
-                token: string;
-                ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
-              };
-              user: Record<string, any> & {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-              };
-            };
-          }>>[];
-        }>) => Promise<{
+        body: import("zod").ZodObject<{
+          [x: string]: import("zod").ZodOptional<import("zod").ZodAny>;
+        }, import("zod/v4/core").$strip>;
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3307,50 +3142,1218 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               name: string;
               image?: string | null | undefined;
             };
-          } & {
-            session: {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
-            } & Record<string, any>;
-            user: {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            } & Record<string, any>;
           };
         }>>[];
-        body: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
-      }, {
-        savedBy?: string | undefined;
-        savedAt?: string | undefined;
-        platformSignIn?: string | undefined;
-        operator?: string | undefined;
-        policy: SignInPolicy;
-        effective: SignInPolicy;
-        mail: boolean;
-      }>;
-      getSignInMethods: import("better-auth").StrictEndpoint<"/account/sign-in-methods", {
-        method: "GET";
-        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
-          session: {
-            session: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
+        metadata: {
+          $Infer: {
+            body: Record<string, any>;
+          };
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        issuer: {
+                          type: string;
+                          format: string;
+                          description: string;
+                        };
+                        domain: {
+                          type: string;
+                          description: string;
+                        };
+                        domainVerified: {
+                          type: string;
+                          description: string;
+                        };
+                        domainVerificationToken: {
+                          type: string;
+                          description: string;
+                        };
+                        oidcConfig: {
+                          type: string;
+                          properties: {
+                            issuer: {
+                              type: string;
+                              format: string;
+                              description: string;
+                            };
+                            pkce: {
+                              type: string;
+                              description: string;
+                            };
+                            clientId: {
+                              type: string;
+                              description: string;
+                            };
+                            clientSecret: {
+                              type: string;
+                              description: string;
+                            };
+                            authorizationEndpoint: {
+                              type: string;
+                              format: string;
+                              nullable: boolean;
+                              description: string;
+                            };
+                            discoveryEndpoint: {
+                              type: string;
+                              format: string;
+                              description: string;
+                            };
+                            userInfoEndpoint: {
+                              type: string;
+                              format: string;
+                              nullable: boolean;
+                              description: string;
+                            };
+                            scopes: {
+                              type: string;
+                              items: {
+                                type: string;
+                              };
+                              nullable: boolean;
+                              description: string;
+                            };
+                            tokenEndpoint: {
+                              type: string;
+                              format: string;
+                              nullable: boolean;
+                              description: string;
+                            };
+                            tokenEndpointAuthentication: {
+                              type: string;
+                              enum: string[];
+                              nullable: boolean;
+                              description: string;
+                            };
+                            jwksEndpoint: {
+                              type: string;
+                              format: string;
+                              nullable: boolean;
+                              description: string;
+                            };
+                            mapping: {
+                              type: string;
+                              nullable: boolean;
+                              properties: {
+                                email: {
+                                  type: string;
+                                  description: string;
+                                };
+                                emailVerified: {
+                                  type: string;
+                                  nullable: boolean;
+                                  description: string;
+                                };
+                                name: {
+                                  type: string;
+                                  description: string;
+                                };
+                                image: {
+                                  type: string;
+                                  nullable: boolean;
+                                  description: string;
+                                };
+                                extraFields: {
+                                  type: string;
+                                  additionalProperties: {
+                                    type: string;
+                                  };
+                                  nullable: boolean;
+                                  description: string;
+                                };
+                              };
+                              required: string[];
+                            };
+                          };
+                          required: string[];
+                          description: string;
+                        };
+                        organizationId: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        userId: {
+                          type: string;
+                          description: string;
+                        };
+                        providerId: {
+                          type: string;
+                          description: string;
+                        };
+                        redirectURI: {
+                          type: string;
+                          format: string;
+                          description: string;
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      }, {
+        redirectURI: string;
+        oidcConfig: import("@better-auth/sso").OIDCConfig | null;
+        samlConfig: import("@better-auth/sso").SAMLConfig | null;
+      } & Omit<{
+        domainVerified: boolean;
+      } & {
+        issuer: string;
+        oidcConfig?: import("@better-auth/sso").OIDCConfig | undefined;
+        samlConfig?: import("@better-auth/sso").SAMLConfig | undefined;
+        userId: string;
+        providerId: string;
+        organizationId?: string | undefined;
+        domain: string;
+      }, "samlConfig" | "oidcConfig"> & {
+        domainVerified: boolean;
+        domainVerificationToken: string;
+      }>;
+      signInSSO: ReturnType<(options?: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sign-in/sso", {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          email: import("zod").ZodOptional<import("zod").ZodString>;
+          organizationSlug: import("zod").ZodOptional<import("zod").ZodString>;
+          providerId: import("zod").ZodOptional<import("zod").ZodString>;
+          domain: import("zod").ZodOptional<import("zod").ZodString>;
+          callbackURL: import("zod").ZodString;
+          errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+          newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+          scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+          loginHint: import("zod").ZodOptional<import("zod").ZodString>;
+          additionalParams: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>>;
+          requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
+          providerType: import("zod").ZodOptional<import("zod").ZodEnum<{
+            saml: "saml";
+            oidc: "oidc";
+          }>>;
+        }, import("zod/v4/core").$strip>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            requestBody: {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      email: {
+                        type: string;
+                        description: string;
+                      };
+                      organizationSlug: {
+                        type: string;
+                        description: string;
+                      };
+                      providerId: {
+                        type: string;
+                        description: string;
+                      };
+                      domain: {
+                        type: string;
+                        description: string;
+                      };
+                      callbackURL: {
+                        type: string;
+                        description: string;
+                      };
+                      errorCallbackURL: {
+                        type: string;
+                        description: string;
+                      };
+                      newUserCallbackURL: {
+                        type: string;
+                        description: string;
+                      };
+                      scopes: {
+                        type: string;
+                        items: {
+                          type: string;
+                        };
+                        description: string;
+                      };
+                      loginHint: {
+                        type: string;
+                        description: string;
+                      };
+                      additionalParams: {
+                        type: string;
+                        additionalProperties: {
+                          type: string;
+                        };
+                        description: string;
+                      };
+                      requestSignUp: {
+                        type: string;
+                        description: string;
+                      };
+                      providerType: {
+                        type: string;
+                        enum: string[];
+                        description: string;
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+            responses: {
+              "200": {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        url: {
+                          type: string;
+                          format: string;
+                          description: string;
+                        };
+                        redirect: {
+                          type: string;
+                          description: string;
+                          enum: boolean[];
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      }, {
+        url: string;
+        redirect: boolean;
+      }>>;
+      callbackSSO: ReturnType<(options?: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sso/callback/:providerId", {
+        method: "GET";
+        query: import("zod").ZodObject<{
+          code: import("zod").ZodOptional<import("zod").ZodString>;
+          state: import("zod").ZodOptional<import("zod").ZodString>;
+          error: import("zod").ZodOptional<import("zod").ZodString>;
+          error_description: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+        allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "302": {
+                description: string;
+              };
+            };
+          };
+          scope: "server";
+        };
+      }, never>>;
+      callbackSSOShared: ReturnType<(options?: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sso/callback", {
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "302": {
+                description: string;
+              };
+            };
+          };
+          scope: "server";
+        };
+        method: "GET";
+        query: import("zod").ZodObject<{
+          code: import("zod").ZodOptional<import("zod").ZodString>;
+          state: import("zod").ZodOptional<import("zod").ZodString>;
+          error: import("zod").ZodOptional<import("zod").ZodString>;
+          error_description: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+        allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
+      }, never>>;
+      acsEndpoint: ReturnType<(options?: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+        method: ("GET" | "POST")[];
+        body: import("zod").ZodOptional<import("zod").ZodObject<{
+          SAMLResponse: import("zod").ZodString;
+          RelayState: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        query: import("zod").ZodOptional<import("zod").ZodObject<{
+          RelayState: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        metadata: {
+          allowedMediaTypes: string[];
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "302": {
+                description: string;
+              };
+              "400": {
+                description: string;
+              };
+              "404": {
+                description: string;
+              };
+            };
+          };
+          scope: "server";
+        };
+      }, never>>;
+      sloEndpoint: ReturnType<(options?: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
+        method: ("GET" | "POST")[];
+        body: import("zod").ZodOptional<import("zod").ZodObject<{
+          SAMLRequest: import("zod").ZodOptional<import("zod").ZodString>;
+          SAMLResponse: import("zod").ZodOptional<import("zod").ZodString>;
+          RelayState: import("zod").ZodOptional<import("zod").ZodString>;
+          SigAlg: import("zod").ZodOptional<import("zod").ZodString>;
+          Signature: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        query: import("zod").ZodOptional<import("zod").ZodObject<{
+          SAMLRequest: import("zod").ZodOptional<import("zod").ZodString>;
+          SAMLResponse: import("zod").ZodOptional<import("zod").ZodString>;
+          RelayState: import("zod").ZodOptional<import("zod").ZodString>;
+          SigAlg: import("zod").ZodOptional<import("zod").ZodString>;
+          Signature: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        metadata: {
+          allowedMediaTypes: string[];
+          scope: "server";
+        };
+      }, void | Response>>;
+      initiateSLO: ReturnType<(options?: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sso/saml2/logout/:providerId", {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        metadata: {
+          readonly scope: "server";
+        };
+      }, never>>;
+      listSSOProviders: ReturnType<(options?: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sso/providers", {
+        method: "GET";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+              };
+            };
+          };
+        };
+      }, {
+        providers: {
+          providerId: string;
+          type: string;
+          issuer: string;
+          domain: string;
+          organizationId: string | null;
+          domainVerified: boolean;
+          oidcConfig: {
+            discoveryEndpoint: string;
+            clientIdLastFour: string;
+            pkce: boolean;
+            authorizationEndpoint: string | undefined;
+            tokenEndpoint: string | undefined;
+            userInfoEndpoint: string | undefined;
+            jwksEndpoint: string | undefined;
+            scopes: string[] | undefined;
+            tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | "private_key_jwt" | undefined;
+          } | undefined;
+          samlConfig: {
+            entryPoint: string;
+            callbackUrl: string | undefined;
+            idpInitiatedCallbackUrl: string | undefined;
+            audience: string | undefined;
+            wantAssertionsSigned: boolean | undefined;
+            authnRequestsSigned: boolean | undefined;
+            identifierFormat: string | undefined;
+            signatureAlgorithm: string | undefined;
+            digestAlgorithm: string | undefined;
+            certificate: ({
+              fingerprintSha256: string;
+              notBefore: string;
+              notAfter: string;
+              publicKeyAlgorithm: string;
+            } | {
+              error: string;
+            })[] | undefined;
+          } | undefined;
+          spMetadataUrl: string;
+        }[];
+      }>>;
+      getSSOProvider: ReturnType<(options?: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sso/get-provider", {
+        method: "GET";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        query: import("zod").ZodObject<{
+          providerId: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+              };
+              "404": {
+                description: string;
+              };
+              "403": {
+                description: string;
+              };
+            };
+          };
+        };
+      }, {
+        providerId: string;
+        type: string;
+        issuer: string;
+        domain: string;
+        organizationId: string | null;
+        domainVerified: boolean;
+        oidcConfig: {
+          discoveryEndpoint: string;
+          clientIdLastFour: string;
+          pkce: boolean;
+          authorizationEndpoint: string | undefined;
+          tokenEndpoint: string | undefined;
+          userInfoEndpoint: string | undefined;
+          jwksEndpoint: string | undefined;
+          scopes: string[] | undefined;
+          tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | "private_key_jwt" | undefined;
+        } | undefined;
+        samlConfig: {
+          entryPoint: string;
+          callbackUrl: string | undefined;
+          idpInitiatedCallbackUrl: string | undefined;
+          audience: string | undefined;
+          wantAssertionsSigned: boolean | undefined;
+          authnRequestsSigned: boolean | undefined;
+          identifierFormat: string | undefined;
+          signatureAlgorithm: string | undefined;
+          digestAlgorithm: string | undefined;
+          certificate: ({
+            fingerprintSha256: string;
+            notBefore: string;
+            notAfter: string;
+            publicKeyAlgorithm: string;
+          } | {
+            error: string;
+          })[] | undefined;
+        } | undefined;
+        spMetadataUrl: string;
+      }>>;
+      updateSSOProvider: ReturnType<(options: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sso/update-provider", {
+        method: "POST";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          issuer: import("zod").ZodOptional<import("zod").ZodString>;
+          domain: import("zod").ZodOptional<import("zod").ZodString>;
+          oidcConfig: import("zod").ZodOptional<import("zod").ZodObject<{
+            clientId: import("zod").ZodOptional<import("zod").ZodString>;
+            clientSecret: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            authorizationEndpoint: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            tokenEndpoint: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            userInfoEndpoint: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            tokenEndpointAuthentication: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodEnum<{
+              client_secret_post: "client_secret_post";
+              client_secret_basic: "client_secret_basic";
+              private_key_jwt: "private_key_jwt";
+            }>>>;
+            privateKeyId: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            privateKeyAlgorithm: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            jwksEndpoint: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            discoveryEndpoint: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            skipDiscovery: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodBoolean>>;
+            scopes: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>>;
+            pkce: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodBoolean>>>;
+            overrideUserInfo: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodBoolean>>;
+            mapping: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodObject<{
+              email: import("zod").ZodString;
+              emailVerified: import("zod").ZodOptional<import("zod").ZodString>;
+              name: import("zod").ZodString;
+              image: import("zod").ZodOptional<import("zod").ZodString>;
+              extraFields: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+            }, import("zod/v4/core").$strict>>>;
+          }, import("zod/v4/core").$strip>>;
+          samlConfig: import("zod").ZodOptional<import("zod").ZodObject<{
+            audience: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            mapping: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodObject<{
+              email: import("zod").ZodString;
+              emailVerified: import("zod").ZodOptional<import("zod").ZodString>;
+              name: import("zod").ZodString;
+              firstName: import("zod").ZodOptional<import("zod").ZodString>;
+              lastName: import("zod").ZodOptional<import("zod").ZodString>;
+              extraFields: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+            }, import("zod/v4/core").$strict>>>;
+            privateKey: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            spMetadata: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodObject<{
+              metadata: import("zod").ZodOptional<import("zod").ZodString>;
+              entityID: import("zod").ZodOptional<import("zod").ZodString>;
+              binding: import("zod").ZodOptional<import("zod").ZodString>;
+              privateKey: import("zod").ZodOptional<import("zod").ZodString>;
+              privateKeyPass: import("zod").ZodOptional<import("zod").ZodString>;
+              isAssertionEncrypted: import("zod").ZodOptional<import("zod").ZodBoolean>;
+              encPrivateKey: import("zod").ZodOptional<import("zod").ZodString>;
+              encPrivateKeyPass: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>>>;
+            cert: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodArray<import("zod").ZodString>]>>>;
+            entryPoint: import("zod").ZodOptional<import("zod").ZodString>;
+            callbackUrl: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            wantAssertionsSigned: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodBoolean>>;
+            authnRequestsSigned: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodBoolean>>;
+            signatureAlgorithm: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            digestAlgorithm: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            identifierFormat: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+            idpInitiatedCallbackUrl: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+            idpMetadata: import("zod").ZodOptional<import("zod").ZodObject<{
+              cert: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodArray<import("zod").ZodString>]>>;
+              privateKey: import("zod").ZodOptional<import("zod").ZodString>;
+              privateKeyPass: import("zod").ZodOptional<import("zod").ZodString>;
+              isAssertionEncrypted: import("zod").ZodOptional<import("zod").ZodBoolean>;
+              encPrivateKey: import("zod").ZodOptional<import("zod").ZodString>;
+              encPrivateKeyPass: import("zod").ZodOptional<import("zod").ZodString>;
+              singleSignOnService: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+                Binding: import("zod").ZodString;
+                Location: import("zod").ZodString;
+              }, import("zod/v4/core").$strip>>>;
+              singleLogoutService: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+                Binding: import("zod").ZodString;
+                Location: import("zod").ZodString;
+              }, import("zod/v4/core").$strip>>>;
+              metadata: import("zod").ZodOptional<import("zod").ZodString>;
+              entityID: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>>;
+          }, import("zod/v4/core").$strip>>;
+          providerId: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+              };
+              "404": {
+                description: string;
+              };
+              "403": {
+                description: string;
+              };
+            };
+          };
+        };
+      }, {
+        providerId: string;
+        type: string;
+        issuer: string;
+        domain: string;
+        organizationId: string | null;
+        domainVerified: boolean;
+        oidcConfig: {
+          discoveryEndpoint: string;
+          clientIdLastFour: string;
+          pkce: boolean;
+          authorizationEndpoint: string | undefined;
+          tokenEndpoint: string | undefined;
+          userInfoEndpoint: string | undefined;
+          jwksEndpoint: string | undefined;
+          scopes: string[] | undefined;
+          tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | "private_key_jwt" | undefined;
+        } | undefined;
+        samlConfig: {
+          entryPoint: string;
+          callbackUrl: string | undefined;
+          idpInitiatedCallbackUrl: string | undefined;
+          audience: string | undefined;
+          wantAssertionsSigned: boolean | undefined;
+          authnRequestsSigned: boolean | undefined;
+          identifierFormat: string | undefined;
+          signatureAlgorithm: string | undefined;
+          digestAlgorithm: string | undefined;
+          certificate: ({
+            fingerprintSha256: string;
+            notBefore: string;
+            notAfter: string;
+            publicKeyAlgorithm: string;
+          } | {
+            error: string;
+          })[] | undefined;
+        } | undefined;
+        spMetadataUrl: string;
+      }>>;
+      deleteSSOProvider: ReturnType<(options?: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sso/delete-provider", {
+        method: "POST";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          providerId: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+              };
+              "404": {
+                description: string;
+              };
+              "403": {
+                description: string;
+              };
+            };
+          };
+        };
+      }, {
+        success: boolean;
+      }>>;
+    } & {
+      requestDomainVerification: ReturnType<(options: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sso/request-domain-verification", {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          providerId: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+        metadata: {
+          openapi: {
+            summary: string;
+            description: string;
+            responses: {
+              "404": {
+                description: string;
+              };
+              "409": {
+                description: string;
+              };
+              "201": {
+                description: string;
+              };
+            };
+          };
+        };
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        domainVerificationToken: string;
+      }>>;
+      verifyDomain: ReturnType<(options: import("@better-auth/sso").SSOOptions) => import("better-auth").StrictEndpoint<"/sso/verify-domain", {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          providerId: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+        metadata: {
+          openapi: {
+            summary: string;
+            description: string;
+            responses: {
+              "404": {
+                description: string;
+              };
+              "409": {
+                description: string;
+              };
+              "502": {
+                description: string;
+              };
+              "204": {
+                description: string;
+              };
+            };
+          };
+        };
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, void>>;
+    };
+    $Infer: {
+      SSOProvider: {
+        domainVerified: boolean;
+      } & {
+        issuer: string;
+        oidcConfig?: import("@better-auth/sso").OIDCConfig | undefined;
+        samlConfig?: import("@better-auth/sso").SAMLConfig | undefined;
+        userId: string;
+        providerId: string;
+        organizationId?: string | undefined;
+        domain: string;
+      };
+    };
+    options: NoInfer<{
+      defaultSSO: {
+        domain: string;
+        providerId: string;
+        samlConfig?: import("@better-auth/sso").SAMLConfig;
+        oidcConfig?: import("@better-auth/sso").OIDCConfig;
+        privateKey?: {
+          privateKeyJwk?: JsonWebKey;
+          privateKeyPem?: string;
+        };
+      }[];
+      domainVerification: {
+        enabled: true;
+      };
+      organizationProvisioning: {
+        disabled: true;
+      };
+      providersLimit: number;
+    }>;
+  } | {
+    id: "protobase-saml-guard";
+    hooks: {
+      before: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
+  } | {
+    id: "protobase-sign-in-policy";
+    schema: {
+      readonly signInPolicy: {
+        readonly modelName: "sign_in_policy";
+        readonly fields: {
+          readonly password: {
+            readonly type: "string";
+            readonly required: true;
+          };
+          readonly emailCode: {
+            readonly type: "string";
+            readonly required: true;
+            readonly fieldName: "email_code";
+          };
+          readonly passkey: {
+            readonly type: "string";
+            readonly required: true;
+          };
+          readonly twoFactor: {
+            readonly type: "string";
+            readonly required: true;
+            readonly fieldName: "two_factor";
+          };
+          readonly staffAccess: {
+            readonly type: "string";
+            readonly required: true;
+            readonly defaultValue: "allowed";
+            readonly fieldName: "staff_access";
+          };
+          readonly platformSignIn: {
+            readonly type: "string";
+            readonly required: true;
+            readonly defaultValue: "allowed";
+            readonly fieldName: "platform_sign_in";
+          };
+          readonly createdAt: {
+            readonly type: "date";
+            readonly required: true;
+            readonly fieldName: "created_at";
+          };
+          readonly createdBy: {
+            readonly type: "string";
+            readonly required: false;
+            readonly fieldName: "created_by";
+          };
+        };
+      };
+    };
+    endpoints: {
+      getSignInPolicy: import("better-auth").StrictEndpoint<"/policy/sign-in", {
+        method: "GET";
+        use: import("better-auth").Middleware<{
+          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+            session: {
+              session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+              user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            };
+          }>>[];
+        }, (inputContext: import("better-auth").MiddlewareInputContext<{
+          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+            session: {
+              session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+              user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            };
+          }>>[];
+        }>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          } & {
+            session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, any>;
+            user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, any>;
+          };
+        }>>[];
+      }, {
+        savedBy?: string | undefined;
+        savedAt?: string | undefined;
+        platformSignIn?: string | undefined;
+        operator?: string | undefined;
+        policy: SignInPolicy;
+        effective: SignInPolicy;
+        mail: boolean;
+      }>;
+      setSignInPolicy: import("better-auth").StrictEndpoint<"/policy/sign-in", {
+        method: "POST";
+        use: import("better-auth").Middleware<{
+          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+            session: {
+              session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+              user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            };
+          }>>[];
+        }, (inputContext: import("better-auth").MiddlewareInputContext<{
+          use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+            session: {
+              session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+              user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            };
+          }>>[];
+        }>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          } & {
+            session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, any>;
+            user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, any>;
+          };
+        }>>[];
+        body: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+      }, {
+        savedBy?: string | undefined;
+        savedAt?: string | undefined;
+        platformSignIn?: string | undefined;
+        operator?: string | undefined;
+        policy: SignInPolicy;
+        effective: SignInPolicy;
+        mail: boolean;
+      }>;
+      getSignInMethods: import("better-auth").StrictEndpoint<"/account/sign-in-methods", {
+        method: "GET";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
@@ -3749,15 +4752,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           name?: string;
           slug?: string;
           logo?: string | null;
-          metadata?
-          /**
-           * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
-           * sign-in provider already resolved.
-           */
-          /**
-           * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
-           * sign-in provider already resolved.
-           */ : Record<string, any>;
+          metadata?: Record<string, any>;
           [key: string]: any;
         };
       }>;
@@ -4381,6 +5376,11 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     provider: string;
     name: string;
   } | undefined;
+  /** The id and name of each SAML provider, for the sign-in page. */
+  samlProviders: {
+    id: string;
+    name: string;
+  }[];
 };
 export type AdminAuth = ReturnType<typeof createAuth>;
 //#endregion