@protobase/server 0.48.0 → 0.49.0

package/dist/better-auth/saml-plugin.d.ts

@@ -0,0 +1,993 @@
+import { ResolvedSamlProvider } from "./saml-sign-in.js";
+import { SSOOptions } from "@better-auth/sso";
+//#region src/better-auth/saml-plugin.d.ts
+/**
+ * Better Auth's SSO plugin with the configured providers. Their domains are trusted, so an address there links to the
+ * account that has it; organizations are not assigned by provider, and nobody registers providers.
+ */
+export declare const samlPlugin: (providers: ResolvedSamlProvider[], baseURL: string) => {
+  id: "sso";
+  version: string;
+  endpoints: {
+    spMetadata: ReturnType<(options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/metadata", {
+      method: "GET";
+      query: import("zod").ZodObject<{
+        providerId: import("zod").ZodString;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+            };
+          };
+        };
+      };
+    }, Response>>;
+    registerSSOProvider: import("better-call").StrictEndpoint<"/sso/register", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        [x: string]: import("zod").ZodOptional<import("zod").ZodAny>;
+      }, import("zod/v4/core").$strip>;
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+      metadata: {
+        $Infer: {
+          body: Record<string, any>;
+        };
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      issuer: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      domain: {
+                        type: string;
+                        description: string;
+                      };
+                      domainVerified: {
+                        type: string;
+                        description: string;
+                      };
+                      domainVerificationToken: {
+                        type: string;
+                        description: string;
+                      };
+                      oidcConfig: {
+                        type: string;
+                        properties: {
+                          issuer: {
+                            type: string;
+                            format: string;
+                            description: string;
+                          };
+                          pkce: {
+                            type: string;
+                            description: string;
+                          };
+                          clientId: {
+                            type: string;
+                            description: string;
+                          };
+                          clientSecret: {
+                            type: string;
+                            description: string;
+                          };
+                          authorizationEndpoint: {
+                            type: string;
+                            format: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          discoveryEndpoint: {
+                            type: string;
+                            format: string;
+                            description: string;
+                          };
+                          userInfoEndpoint: {
+                            type: string;
+                            format: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          scopes: {
+                            type: string;
+                            items: {
+                              type: string;
+                            };
+                            nullable: boolean;
+                            description: string;
+                          };
+                          tokenEndpoint: {
+                            type: string;
+                            format: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          tokenEndpointAuthentication: {
+                            type: string;
+                            enum: string[];
+                            nullable: boolean;
+                            description: string;
+                          };
+                          jwksEndpoint: {
+                            type: string;
+                            format: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          mapping: {
+                            type: string;
+                            nullable: boolean;
+                            properties: {
+                              email: {
+                                type: string;
+                                description: string;
+                              };
+                              emailVerified: {
+                                type: string;
+                                nullable: boolean;
+                                description: string;
+                              };
+                              name: {
+                                type: string;
+                                description: string;
+                              };
+                              image: {
+                                type: string;
+                                nullable: boolean;
+                                description: string;
+                              };
+                              extraFields: {
+                                type: string;
+                                additionalProperties: {
+                                  type: string;
+                                };
+                                nullable: boolean;
+                                description: string;
+                              };
+                            };
+                          };
+                        };
+                        required: string[];
+                        description: string;
+                      };
+                      organizationId: {
+                        type: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      userId: {
+                        type: string;
+                        description: string;
+                      };
+                      providerId: {
+                        type: string;
+                        description: string;
+                      };
+                      redirectURI: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      redirectURI: string;
+      oidcConfig: import("@better-auth/sso").OIDCConfig | null;
+      samlConfig: import("@better-auth/sso").SAMLConfig | null;
+    } & Omit<{
+      domainVerified: boolean;
+    } & {
+      issuer: string;
+      oidcConfig?: import("@better-auth/sso").OIDCConfig | undefined;
+      samlConfig?: import("@better-auth/sso").SAMLConfig | undefined;
+      userId: string;
+      providerId: string;
+      organizationId?: string | undefined;
+      domain: string;
+    }, "samlConfig" | "oidcConfig"> & {
+      domainVerified: boolean;
+      domainVerificationToken: string;
+    }>;
+    signInSSO: ReturnType<(options?: SSOOptions) => import("better-call").StrictEndpoint<"/sign-in/sso", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        email: import("zod").ZodOptional<import("zod").ZodString>;
+        organizationSlug: import("zod").ZodOptional<import("zod").ZodString>;
+        providerId: import("zod").ZodOptional<import("zod").ZodString>;
+        domain: import("zod").ZodOptional<import("zod").ZodString>;
+        callbackURL: import("zod").ZodString;
+        errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+        newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+        scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+        loginHint: import("zod").ZodOptional<import("zod").ZodString>;
+        additionalParams: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>>;
+        requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
+        providerType: import("zod").ZodOptional<import("zod").ZodEnum<{
+          saml: "saml";
+          oidc: "oidc";
+        }>>;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          requestBody: {
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object";
+                  properties: {
+                    email: {
+                      type: string;
+                      description: string;
+                    };
+                    organizationSlug: {
+                      type: string;
+                      description: string;
+                    };
+                    providerId: {
+                      type: string;
+                      description: string;
+                    };
+                    domain: {
+                      type: string;
+                      description: string;
+                    };
+                    callbackURL: {
+                      type: string;
+                      description: string;
+                    };
+                    errorCallbackURL: {
+                      type: string;
+                      description: string;
+                    };
+                    newUserCallbackURL: {
+                      type: string;
+                      description: string;
+                    };
+                    scopes: {
+                      type: string;
+                      items: {
+                        type: string;
+                      };
+                      description: string;
+                    };
+                    loginHint: {
+                      type: string;
+                      description: string;
+                    };
+                    additionalParams: {
+                      type: string;
+                      additionalProperties: {
+                        type: string;
+                      };
+                      description: string;
+                    };
+                    requestSignUp: {
+                      type: string;
+                      description: string;
+                    };
+                    providerType: {
+                      type: string;
+                      enum: string[];
+                      description: string;
+                    };
+                  };
+                  required: string[];
+                };
+              };
+            };
+          };
+          responses: {
+            "200": {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      url: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      redirect: {
+                        type: string;
+                        description: string;
+                        enum: boolean[];
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      url: string;
+      redirect: boolean;
+    }>>;
+    callbackSSO: ReturnType<(options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback/:providerId", {
+      method: "GET";
+      query: import("zod").ZodObject<{
+        code: import("zod").ZodOptional<import("zod").ZodString>;
+        state: import("zod").ZodOptional<import("zod").ZodString>;
+        error: import("zod").ZodOptional<import("zod").ZodString>;
+        error_description: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>;
+      allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
+      metadata: {
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          responses: {
+            "302": {
+              description: string;
+            };
+          };
+        };
+        scope: "server";
+      };
+    }, never>>;
+    callbackSSOShared: ReturnType<(options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback", {
+      metadata: {
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          responses: {
+            "302": {
+              description: string;
+            };
+          };
+        };
+        scope: "server";
+      };
+      method: "GET";
+      query: import("zod").ZodObject<{
+        code: import("zod").ZodOptional<import("zod").ZodString>;
+        state: import("zod").ZodOptional<import("zod").ZodString>;
+        error: import("zod").ZodOptional<import("zod").ZodString>;
+        error_description: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>;
+      allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
+    }, never>>;
+    acsEndpoint: ReturnType<(options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+      method: ("GET" | "POST")[];
+      body: import("zod").ZodOptional<import("zod").ZodObject<{
+        SAMLResponse: import("zod").ZodString;
+        RelayState: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
+      query: import("zod").ZodOptional<import("zod").ZodObject<{
+        RelayState: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
+      metadata: {
+        allowedMediaTypes: string[];
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          responses: {
+            "302": {
+              description: string;
+            };
+            "400": {
+              description: string;
+            };
+            "404": {
+              description: string;
+            };
+          };
+        };
+        scope: "server";
+      };
+    }, never>>;
+    sloEndpoint: ReturnType<(options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
+      method: ("GET" | "POST")[];
+      body: import("zod").ZodOptional<import("zod").ZodObject<{
+        SAMLRequest: import("zod").ZodOptional<import("zod").ZodString>;
+        SAMLResponse: import("zod").ZodOptional<import("zod").ZodString>;
+        RelayState: import("zod").ZodOptional<import("zod").ZodString>;
+        SigAlg: import("zod").ZodOptional<import("zod").ZodString>;
+        Signature: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
+      query: import("zod").ZodOptional<import("zod").ZodObject<{
+        SAMLRequest: import("zod").ZodOptional<import("zod").ZodString>;
+        SAMLResponse: import("zod").ZodOptional<import("zod").ZodString>;
+        RelayState: import("zod").ZodOptional<import("zod").ZodString>;
+        SigAlg: import("zod").ZodOptional<import("zod").ZodString>;
+        Signature: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
+      metadata: {
+        allowedMediaTypes: string[];
+        scope: "server";
+      };
+    }, void | Response>>;
+    initiateSLO: ReturnType<(options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/logout/:providerId", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>;
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+      metadata: {
+        readonly scope: "server";
+      };
+    }, never>>;
+    listSSOProviders: ReturnType<(options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/providers", {
+      method: "GET";
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+      metadata: {
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+            };
+          };
+        };
+      };
+    }, {
+      providers: {
+        providerId: string;
+        type: string;
+        issuer: string;
+        domain: string;
+        organizationId: string | null;
+        domainVerified: boolean;
+        oidcConfig: {
+          discoveryEndpoint: string;
+          clientIdLastFour: string;
+          pkce: boolean;
+          authorizationEndpoint: string | undefined;
+          tokenEndpoint: string | undefined;
+          userInfoEndpoint: string | undefined;
+          jwksEndpoint: string | undefined;
+          scopes: string[] | undefined;
+          tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | "private_key_jwt" | undefined;
+        } | undefined;
+        samlConfig: {
+          entryPoint: string;
+          callbackUrl: string | undefined;
+          idpInitiatedCallbackUrl: string | undefined;
+          audience: string | undefined;
+          wantAssertionsSigned: boolean | undefined;
+          authnRequestsSigned: boolean | undefined;
+          identifierFormat: string | undefined;
+          signatureAlgorithm: string | undefined;
+          digestAlgorithm: string | undefined;
+          certificate: ({
+            fingerprintSha256: string;
+            notBefore: string;
+            notAfter: string;
+            publicKeyAlgorithm: string;
+          } | {
+            error: string;
+          })[] | undefined;
+        } | undefined;
+        spMetadataUrl: string;
+      }[];
+    }>>;
+    getSSOProvider: ReturnType<(options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/get-provider", {
+      method: "GET";
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+      query: import("zod").ZodObject<{
+        providerId: import("zod").ZodString;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+            };
+            "404": {
+              description: string;
+            };
+            "403": {
+              description: string;
+            };
+          };
+        };
+      };
+    }, {
+      providerId: string;
+      type: string;
+      issuer: string;
+      domain: string;
+      organizationId: string | null;
+      domainVerified: boolean;
+      oidcConfig: {
+        discoveryEndpoint: string;
+        clientIdLastFour: string;
+        pkce: boolean;
+        authorizationEndpoint: string | undefined;
+        tokenEndpoint: string | undefined;
+        userInfoEndpoint: string | undefined;
+        jwksEndpoint: string | undefined;
+        scopes: string[] | undefined;
+        tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | "private_key_jwt" | undefined;
+      } | undefined;
+      samlConfig: {
+        entryPoint: string;
+        callbackUrl: string | undefined;
+        idpInitiatedCallbackUrl: string | undefined;
+        audience: string | undefined;
+        wantAssertionsSigned: boolean | undefined;
+        authnRequestsSigned: boolean | undefined;
+        identifierFormat: string | undefined;
+        signatureAlgorithm: string | undefined;
+        digestAlgorithm: string | undefined;
+        certificate: ({
+          fingerprintSha256: string;
+          notBefore: string;
+          notAfter: string;
+          publicKeyAlgorithm: string;
+        } | {
+          error: string;
+        })[] | undefined;
+      } | undefined;
+      spMetadataUrl: string;
+    }>>;
+    updateSSOProvider: ReturnType<(options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/update-provider", {
+      method: "POST";
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+      body: import("zod").ZodObject<{
+        issuer: import("zod").ZodOptional<import("zod").ZodString>;
+        domain: import("zod").ZodOptional<import("zod").ZodString>;
+        oidcConfig: import("zod").ZodOptional<import("zod").ZodObject<{
+          clientId: import("zod").ZodOptional<import("zod").ZodString>;
+          clientSecret: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          authorizationEndpoint: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          tokenEndpoint: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          userInfoEndpoint: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          tokenEndpointAuthentication: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodEnum<{
+            client_secret_post: "client_secret_post";
+            client_secret_basic: "client_secret_basic";
+            private_key_jwt: "private_key_jwt";
+          }>>>;
+          privateKeyId: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          privateKeyAlgorithm: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          jwksEndpoint: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          discoveryEndpoint: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          skipDiscovery: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodBoolean>>;
+          scopes: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>>;
+          pkce: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodBoolean>>>;
+          overrideUserInfo: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodBoolean>>;
+          mapping: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodObject<{
+            email: import("zod").ZodOptional<import("zod").ZodString>;
+            emailVerified: import("zod").ZodOptional<import("zod").ZodString>;
+            name: import("zod").ZodOptional<import("zod").ZodString>;
+            image: import("zod").ZodOptional<import("zod").ZodString>;
+            extraFields: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+          }, import("zod/v4/core").$strict>>>;
+        }, import("zod/v4/core").$strip>>;
+        samlConfig: import("zod").ZodOptional<import("zod").ZodObject<{
+          mapping: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodObject<{
+            email: import("zod").ZodOptional<import("zod").ZodString>;
+            emailVerified: import("zod").ZodOptional<import("zod").ZodString>;
+            name: import("zod").ZodOptional<import("zod").ZodString>;
+            firstName: import("zod").ZodOptional<import("zod").ZodString>;
+            lastName: import("zod").ZodOptional<import("zod").ZodString>;
+            extraFields: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+          }, import("zod/v4/core").$strict>>>;
+          privateKey: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          spMetadata: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodObject<{
+            metadata: import("zod").ZodOptional<import("zod").ZodString>;
+            entityID: import("zod").ZodOptional<import("zod").ZodString>;
+            binding: import("zod").ZodOptional<import("zod").ZodString>;
+            privateKey: import("zod").ZodOptional<import("zod").ZodString>;
+            privateKeyPass: import("zod").ZodOptional<import("zod").ZodString>;
+            isAssertionEncrypted: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            encPrivateKey: import("zod").ZodOptional<import("zod").ZodString>;
+            encPrivateKeyPass: import("zod").ZodOptional<import("zod").ZodString>;
+          }, import("zod/v4/core").$strip>>>;
+          cert: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodArray<import("zod").ZodString>]>>>;
+          entryPoint: import("zod").ZodOptional<import("zod").ZodString>;
+          audience: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          callbackUrl: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          wantAssertionsSigned: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodBoolean>>;
+          authnRequestsSigned: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodBoolean>>;
+          signatureAlgorithm: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          digestAlgorithm: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          identifierFormat: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+          idpInitiatedCallbackUrl: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+          idpMetadata: import("zod").ZodOptional<import("zod").ZodObject<{
+            cert: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodArray<import("zod").ZodString>]>>;
+            privateKey: import("zod").ZodOptional<import("zod").ZodString>;
+            privateKeyPass: import("zod").ZodOptional<import("zod").ZodString>;
+            isAssertionEncrypted: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            encPrivateKey: import("zod").ZodOptional<import("zod").ZodString>;
+            encPrivateKeyPass: import("zod").ZodOptional<import("zod").ZodString>;
+            singleSignOnService: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+              Binding: import("zod").ZodString;
+              Location: import("zod").ZodString;
+            }, import("zod/v4/core").$strip>>>;
+            singleLogoutService: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+              Binding: import("zod").ZodString;
+              Location: import("zod").ZodString;
+            }, import("zod/v4/core").$strip>>>;
+            metadata: import("zod").ZodOptional<import("zod").ZodString>;
+            entityID: import("zod").ZodOptional<import("zod").ZodString>;
+          }, import("zod/v4/core").$strip>>;
+        }, import("zod/v4/core").$strip>>;
+        providerId: import("zod").ZodString;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+            };
+            "404": {
+              description: string;
+            };
+            "403": {
+              description: string;
+            };
+          };
+        };
+      };
+    }, {
+      providerId: string;
+      type: string;
+      issuer: string;
+      domain: string;
+      organizationId: string | null;
+      domainVerified: boolean;
+      oidcConfig: {
+        discoveryEndpoint: string;
+        clientIdLastFour: string;
+        pkce: boolean;
+        authorizationEndpoint: string | undefined;
+        tokenEndpoint: string | undefined;
+        userInfoEndpoint: string | undefined;
+        jwksEndpoint: string | undefined;
+        scopes: string[] | undefined;
+        tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | "private_key_jwt" | undefined;
+      } | undefined;
+      samlConfig: {
+        entryPoint: string;
+        callbackUrl: string | undefined;
+        idpInitiatedCallbackUrl: string | undefined;
+        audience: string | undefined;
+        wantAssertionsSigned: boolean | undefined;
+        authnRequestsSigned: boolean | undefined;
+        identifierFormat: string | undefined;
+        signatureAlgorithm: string | undefined;
+        digestAlgorithm: string | undefined;
+        certificate: ({
+          fingerprintSha256: string;
+          notBefore: string;
+          notAfter: string;
+          publicKeyAlgorithm: string;
+        } | {
+          error: string;
+        })[] | undefined;
+      } | undefined;
+      spMetadataUrl: string;
+    }>>;
+    deleteSSOProvider: ReturnType<(options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/delete-provider", {
+      method: "POST";
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+      body: import("zod").ZodObject<{
+        providerId: import("zod").ZodString;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+            };
+            "404": {
+              description: string;
+            };
+            "403": {
+              description: string;
+            };
+          };
+        };
+      };
+    }, {
+      success: boolean;
+    }>>;
+  } & {
+    requestDomainVerification: ReturnType<(options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/request-domain-verification", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        providerId: import("zod").ZodString;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        openapi: {
+          summary: string;
+          description: string;
+          responses: {
+            "404": {
+              description: string;
+            };
+            "409": {
+              description: string;
+            };
+            "201": {
+              description: string;
+            };
+          };
+        };
+      };
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+    }, {
+      domainVerificationToken: string;
+    }>>;
+    verifyDomain: ReturnType<(options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/verify-domain", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        providerId: import("zod").ZodString;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        openapi: {
+          summary: string;
+          description: string;
+          responses: {
+            "404": {
+              description: string;
+            };
+            "409": {
+              description: string;
+            };
+            "502": {
+              description: string;
+            };
+            "204": {
+              description: string;
+            };
+          };
+        };
+      };
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+    }, void>>;
+  };
+  $Infer: {
+    SSOProvider: {
+      domainVerified: boolean;
+    } & {
+      issuer: string;
+      oidcConfig?: import("@better-auth/sso").OIDCConfig | undefined;
+      samlConfig?: import("@better-auth/sso").SAMLConfig | undefined;
+      userId: string;
+      providerId: string;
+      organizationId?: string | undefined;
+      domain: string;
+    };
+  };
+  options: NoInfer<{
+    defaultSSO: {
+      domain: string;
+      providerId: string;
+      samlConfig?: import("@better-auth/sso").SAMLConfig;
+      oidcConfig?: import("@better-auth/sso").OIDCConfig;
+      privateKey?: {
+        privateKeyJwk?: JsonWebKey;
+        privateKeyPem?: string;
+      };
+    }[];
+    domainVerification: {
+      enabled: true;
+    };
+    organizationProvisioning: {
+      disabled: true;
+    };
+    providersLimit: number;
+  }>;
+};
+//#endregion