@_mustachio/openauth 0.11.0 → 0.13.0

package/dist/types/methods/saml-sp/factory.d.ts

@@ -0,0 +1,920 @@
+/**
+ * SAML SP factory — `kind: "saml-sp"`.
+ *
+ * Parallels `oauth2Factory` / `oidcFactory`: a Zod `configSchema`
+ * validates the tenant-supplied `SamlSpConfig` blob (Zod 3.24+ is
+ * Standard Schema v1 conformant, so it satisfies
+ * `AuthMethodFactory.configSchema` directly), and `build` delegates to
+ * `buildSamlSpMethod`.
+ *
+ * No `@node-saml/*` import appears here — node-saml is reached only at
+ * request time inside the route handlers, so importing the factory
+ * type surface stays cheap and the public-API leak guard stays green.
+ */
+import { z } from "zod";
+import type { AuthMethodFactory } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    idp: z.ZodObject<{
+        entityId: z.ZodString;
+        ssoUrl: z.ZodString;
+        sloUrl: z.ZodOptional<z.ZodString>;
+        nameIdFormat: z.ZodOptional<z.ZodEnum<["persistent", "transient", "emailAddress", "unspecified"]>>;
+        signingCerts: z.ZodArray<z.ZodObject<{
+            pem: z.ZodString;
+            notBefore: z.ZodOptional<z.ZodNumber>;
+            notAfter: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }, {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        entityId: string;
+        ssoUrl: string;
+        signingCerts: {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }[];
+        nameIdFormat?: "persistent" | "transient" | "emailAddress" | "unspecified" | undefined;
+        sloUrl?: string | undefined;
+    }, {
+        entityId: string;
+        ssoUrl: string;
+        signingCerts: {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }[];
+        nameIdFormat?: "persistent" | "transient" | "emailAddress" | "unspecified" | undefined;
+        sloUrl?: string | undefined;
+    }>;
+    attributeMapping: z.ZodObject<{
+        subject: z.ZodOptional<z.ZodUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"nameId">;
+        }, "strip", z.ZodTypeAny, {
+            source: "nameId";
+        }, {
+            source: "nameId";
+        }>, z.ZodObject<{
+            source: z.ZodLiteral<"attribute">;
+            name: z.ZodString;
+            format: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }, {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }>]>>;
+        email: z.ZodOptional<z.ZodUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"nameId">;
+        }, "strip", z.ZodTypeAny, {
+            source: "nameId";
+        }, {
+            source: "nameId";
+        }>, z.ZodObject<{
+            source: z.ZodLiteral<"attribute">;
+            name: z.ZodString;
+            format: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }, {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }>]>>;
+        emailVerified: z.ZodOptional<z.ZodObject<{
+            source: z.ZodLiteral<"literal">;
+            value: z.ZodBoolean;
+        }, "strip", z.ZodTypeAny, {
+            value: boolean;
+            source: "literal";
+        }, {
+            value: boolean;
+            source: "literal";
+        }>>;
+        name: z.ZodOptional<z.ZodUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"nameId">;
+        }, "strip", z.ZodTypeAny, {
+            source: "nameId";
+        }, {
+            source: "nameId";
+        }>, z.ZodObject<{
+            source: z.ZodLiteral<"attribute">;
+            name: z.ZodString;
+            format: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }, {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }>]>>;
+        groups: z.ZodOptional<z.ZodUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"nameId">;
+        }, "strip", z.ZodTypeAny, {
+            source: "nameId";
+        }, {
+            source: "nameId";
+        }>, z.ZodObject<{
+            source: z.ZodLiteral<"attribute">;
+            name: z.ZodString;
+            format: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }, {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }>]>>;
+        custom: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"nameId">;
+        }, "strip", z.ZodTypeAny, {
+            source: "nameId";
+        }, {
+            source: "nameId";
+        }>, z.ZodObject<{
+            source: z.ZodLiteral<"attribute">;
+            name: z.ZodString;
+            format: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }, {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }>]>>>;
+    }, "strip", z.ZodTypeAny, {
+        subject?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        custom?: Record<string, {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }> | undefined;
+        name?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        email?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        groups?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        emailVerified?: {
+            value: boolean;
+            source: "literal";
+        } | undefined;
+    }, {
+        subject?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        custom?: Record<string, {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }> | undefined;
+        name?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        email?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        groups?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        emailVerified?: {
+            value: boolean;
+            source: "literal";
+        } | undefined;
+    }>;
+    signAuthnRequest: z.ZodOptional<z.ZodBoolean>;
+    signingKey: z.ZodOptional<z.ZodObject<{
+        privateKeyPem: z.ZodString;
+        certPem: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        privateKeyPem: string;
+        certPem: string;
+    }, {
+        privateKeyPem: string;
+        certPem: string;
+    }>>;
+    allowEncryptedAssertions: z.ZodOptional<z.ZodBoolean>;
+    decryptionKey: z.ZodOptional<z.ZodObject<{
+        privateKeyPem: z.ZodString;
+        certPem: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        privateKeyPem: string;
+        certPem: string;
+    }, {
+        privateKeyPem: string;
+        certPem: string;
+    }>>;
+    idpInitiated: z.ZodOptional<z.ZodObject<{
+        defaultClientId: z.ZodString;
+        defaultRedirectUri: z.ZodString;
+        defaultScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        defaultClientId: string;
+        defaultRedirectUri: string;
+        defaultScopes?: string[] | undefined;
+    }, {
+        defaultClientId: string;
+        defaultRedirectUri: string;
+        defaultScopes?: string[] | undefined;
+    }>>;
+    clockSkewSeconds: z.ZodOptional<z.ZodNumber>;
+    spEntityId: z.ZodOptional<z.ZodString>;
+    forceAuthn: z.ZodOptional<z.ZodBoolean>;
+    requestedAuthnContext: z.ZodOptional<z.ZodObject<{
+        classRefs: z.ZodArray<z.ZodString, "many">;
+        comparison: z.ZodOptional<z.ZodEnum<["exact", "minimum", "maximum", "better"]>>;
+    }, "strip", z.ZodTypeAny, {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    }, {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    }>>;
+    requireSignedAssertion: z.ZodOptional<z.ZodBoolean>;
+    requireSignedResponse: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    idp: {
+        entityId: string;
+        ssoUrl: string;
+        signingCerts: {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }[];
+        nameIdFormat?: "persistent" | "transient" | "emailAddress" | "unspecified" | undefined;
+        sloUrl?: string | undefined;
+    };
+    attributeMapping: {
+        subject?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        custom?: Record<string, {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }> | undefined;
+        name?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        email?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        groups?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        emailVerified?: {
+            value: boolean;
+            source: "literal";
+        } | undefined;
+    };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
+    idpInitiated?: {
+        defaultClientId: string;
+        defaultRedirectUri: string;
+        defaultScopes?: string[] | undefined;
+    } | undefined;
+    signAuthnRequest?: boolean | undefined;
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    allowEncryptedAssertions?: boolean | undefined;
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
+}, {
+    idp: {
+        entityId: string;
+        ssoUrl: string;
+        signingCerts: {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }[];
+        nameIdFormat?: "persistent" | "transient" | "emailAddress" | "unspecified" | undefined;
+        sloUrl?: string | undefined;
+    };
+    attributeMapping: {
+        subject?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        custom?: Record<string, {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }> | undefined;
+        name?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        email?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        groups?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        emailVerified?: {
+            value: boolean;
+            source: "literal";
+        } | undefined;
+    };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
+    idpInitiated?: {
+        defaultClientId: string;
+        defaultRedirectUri: string;
+        defaultScopes?: string[] | undefined;
+    } | undefined;
+    signAuthnRequest?: boolean | undefined;
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    allowEncryptedAssertions?: boolean | undefined;
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
+}>, {
+    idp: {
+        entityId: string;
+        ssoUrl: string;
+        signingCerts: {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }[];
+        nameIdFormat?: "persistent" | "transient" | "emailAddress" | "unspecified" | undefined;
+        sloUrl?: string | undefined;
+    };
+    attributeMapping: {
+        subject?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        custom?: Record<string, {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }> | undefined;
+        name?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        email?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        groups?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        emailVerified?: {
+            value: boolean;
+            source: "literal";
+        } | undefined;
+    };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
+    idpInitiated?: {
+        defaultClientId: string;
+        defaultRedirectUri: string;
+        defaultScopes?: string[] | undefined;
+    } | undefined;
+    signAuthnRequest?: boolean | undefined;
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    allowEncryptedAssertions?: boolean | undefined;
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
+}, {
+    idp: {
+        entityId: string;
+        ssoUrl: string;
+        signingCerts: {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }[];
+        nameIdFormat?: "persistent" | "transient" | "emailAddress" | "unspecified" | undefined;
+        sloUrl?: string | undefined;
+    };
+    attributeMapping: {
+        subject?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        custom?: Record<string, {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }> | undefined;
+        name?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        email?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        groups?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        emailVerified?: {
+            value: boolean;
+            source: "literal";
+        } | undefined;
+    };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
+    idpInitiated?: {
+        defaultClientId: string;
+        defaultRedirectUri: string;
+        defaultScopes?: string[] | undefined;
+    } | undefined;
+    signAuthnRequest?: boolean | undefined;
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    allowEncryptedAssertions?: boolean | undefined;
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
+}>, {
+    idp: {
+        entityId: string;
+        ssoUrl: string;
+        signingCerts: {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }[];
+        nameIdFormat?: "persistent" | "transient" | "emailAddress" | "unspecified" | undefined;
+        sloUrl?: string | undefined;
+    };
+    attributeMapping: {
+        subject?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        custom?: Record<string, {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }> | undefined;
+        name?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        email?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        groups?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        emailVerified?: {
+            value: boolean;
+            source: "literal";
+        } | undefined;
+    };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
+    idpInitiated?: {
+        defaultClientId: string;
+        defaultRedirectUri: string;
+        defaultScopes?: string[] | undefined;
+    } | undefined;
+    signAuthnRequest?: boolean | undefined;
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    allowEncryptedAssertions?: boolean | undefined;
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
+}, {
+    idp: {
+        entityId: string;
+        ssoUrl: string;
+        signingCerts: {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }[];
+        nameIdFormat?: "persistent" | "transient" | "emailAddress" | "unspecified" | undefined;
+        sloUrl?: string | undefined;
+    };
+    attributeMapping: {
+        subject?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        custom?: Record<string, {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }> | undefined;
+        name?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        email?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        groups?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        emailVerified?: {
+            value: boolean;
+            source: "literal";
+        } | undefined;
+    };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
+    idpInitiated?: {
+        defaultClientId: string;
+        defaultRedirectUri: string;
+        defaultScopes?: string[] | undefined;
+    } | undefined;
+    signAuthnRequest?: boolean | undefined;
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    allowEncryptedAssertions?: boolean | undefined;
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
+}>, {
+    idp: {
+        entityId: string;
+        ssoUrl: string;
+        signingCerts: {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }[];
+        nameIdFormat?: "persistent" | "transient" | "emailAddress" | "unspecified" | undefined;
+        sloUrl?: string | undefined;
+    };
+    attributeMapping: {
+        subject?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        custom?: Record<string, {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }> | undefined;
+        name?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        email?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        groups?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        emailVerified?: {
+            value: boolean;
+            source: "literal";
+        } | undefined;
+    };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
+    idpInitiated?: {
+        defaultClientId: string;
+        defaultRedirectUri: string;
+        defaultScopes?: string[] | undefined;
+    } | undefined;
+    signAuthnRequest?: boolean | undefined;
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    allowEncryptedAssertions?: boolean | undefined;
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
+}, {
+    idp: {
+        entityId: string;
+        ssoUrl: string;
+        signingCerts: {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }[];
+        nameIdFormat?: "persistent" | "transient" | "emailAddress" | "unspecified" | undefined;
+        sloUrl?: string | undefined;
+    };
+    attributeMapping: {
+        subject?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        custom?: Record<string, {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }> | undefined;
+        name?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        email?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        groups?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        emailVerified?: {
+            value: boolean;
+            source: "literal";
+        } | undefined;
+    };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
+    idpInitiated?: {
+        defaultClientId: string;
+        defaultRedirectUri: string;
+        defaultScopes?: string[] | undefined;
+    } | undefined;
+    signAuthnRequest?: boolean | undefined;
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    allowEncryptedAssertions?: boolean | undefined;
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
+}>;
+export type SamlSpFactoryConfig = z.infer<typeof samlSpConfigSchema>;
+/**
+ * Generic SAML 2.0 Service Provider factory.
+ *
+ * `kind: "saml-sp"`. Use a distinct `MethodConfig.id` per upstream IdP
+ * to register multiple SAML connections against a single tenant.
+ */
+export declare const samlSpFactory: AuthMethodFactory<SamlSpProperties, SamlSpState, SamlSpConfig>;
+export {};
+//# sourceMappingURL=factory.d.ts.map