@_mustachio/openauth 0.10.0 → 0.12.0

package/dist/esm/http/router.js

@@ -2,8 +2,11 @@
 import { Hono } from "hono";
 import { makeAuthorizeHandler } from "./handlers/authorize";
 import { makeCallbackHandler } from "./handlers/callback";
+import { makeEndSessionHandler } from "./handlers/end-session";
 import { makeDiscoveryHandler, makeJwksHandler } from "./handlers/metadata";
 import { makeMethodRouteHandler } from "./handlers/method-route";
+import { makeParHandler } from "./handlers/par";
+import { makeRegisterHandler } from "./handlers/register";
 import { makeIntrospectHandler, makeRevokeHandler } from "./handlers/revocation";
 import { makeTokenHandler } from "./handlers/token";
 import { makeUserinfoHandler } from "./handlers/userinfo";
@@ -28,6 +31,13 @@ function buildRouter(deps) {
   app.post("/userinfo", makeUserinfoHandler(deps));
   app.post("/revoke", makeRevokeHandler(deps));
   app.post("/introspect", makeIntrospectHandler(deps));
+  app.use("/end_session", tenantMiddleware(deps));
+  app.get("/end_session", makeEndSessionHandler(deps));
+  app.post("/end_session", makeEndSessionHandler(deps));
+  app.use("/par", tenantMiddleware(deps));
+  app.post("/par", makeParHandler(deps));
+  app.use("/register", tenantMiddleware(deps));
+  app.post("/register", makeRegisterHandler(deps));
   return app;
 }
 export {

package/dist/esm/http/schemas/authorize.js

@@ -17,8 +17,14 @@ var authorizeQuerySchema = z.object({
   code_challenge_method: z.literal("S256").optional(),
   prompt: csv.optional(),
   ui_locales: csv.optional(),
-  nonce: z.string().optional()
+  nonce: z.string().optional(),
+  claims: z.string().min(1).optional()
+}).passthrough();
+var authorizeRequestUriQuerySchema = z.object({
+  client_id: z.string({ required_error: "missing client_id" }).min(1, "empty client_id"),
+  request_uri: z.string({ required_error: "missing request_uri" }).min(1)
 }).passthrough();
 export {
-  authorizeQuerySchema
+  authorizeQuerySchema,
+  authorizeRequestUriQuerySchema
 };

package/dist/esm/http/schemas/end-session.js

@@ -0,0 +1,13 @@
+// src/http/schemas/end-session.ts
+import { z } from "zod";
+var endSessionParamsSchema = z.object({
+  id_token_hint: z.string().optional(),
+  client_id: z.string().min(1).optional(),
+  post_logout_redirect_uri: z.string().url("post_logout_redirect_uri must be a valid URL").optional(),
+  state: z.string().optional(),
+  logout_hint: z.string().optional(),
+  ui_locales: z.string().optional()
+}).passthrough();
+export {
+  endSessionParamsSchema
+};

package/dist/esm/http/schemas/par.js

@@ -0,0 +1,9 @@
+// src/http/schemas/par.ts
+import { z } from "zod";
+var parBodySchema = z.object({
+  client_id: z.string({ required_error: "missing client_id" }).min(1, "empty client_id"),
+  client_secret: z.string().optional()
+}).catchall(z.string());
+export {
+  parBodySchema
+};

package/dist/esm/http/schemas/register.js

@@ -0,0 +1,16 @@
+// src/http/schemas/register.ts
+import { z } from "zod";
+var registerBodySchema = z.object({
+  client_name: z.string().min(1).optional(),
+  redirect_uris: z.array(z.string().url("redirect_uri must be a valid URL")).min(1, "redirect_uris must be a non-empty array"),
+  grant_types: z.array(z.string()).optional(),
+  response_types: z.array(z.string()).optional(),
+  token_endpoint_auth_method: z.enum(["none", "client_secret_basic", "client_secret_post"]).optional(),
+  scope: z.string().optional(),
+  post_logout_redirect_uris: z.array(z.string().url()).optional(),
+  sector_identifier_uri: z.string().url().optional(),
+  contacts: z.array(z.string()).optional()
+}).passthrough();
+export {
+  registerBodySchema
+};

package/dist/esm/http/schemas/revocation.js

@@ -13,6 +13,6 @@ var introspectBodySchema = z.object({
   client_secret: z.string().optional()
 });
 export {
-  revokeBodySchema,
-  introspectBodySchema
+  introspectBodySchema,
+  revokeBodySchema
 };

package/dist/esm/http/schemas/token.js

@@ -46,12 +46,12 @@ var tokenRequestSchema = z.discriminatedUnion("grant_type", [
   tokenExchangeGrantSchema
 ]);
 export {
-  tokenRequestSchema,
-  tokenExchangeGrantSchema,
-  refreshTokenGrantSchema,
-  clientCredentialsGrantSchema,
-  authorizationCodeGrantSchema,
-  TOKEN_EXCHANGE_GRANT_TYPE,
+  ACCESS_TOKEN_TYPE,
   REFRESH_TOKEN_TYPE,
-  ACCESS_TOKEN_TYPE
+  TOKEN_EXCHANGE_GRANT_TYPE,
+  authorizationCodeGrantSchema,
+  clientCredentialsGrantSchema,
+  refreshTokenGrantSchema,
+  tokenExchangeGrantSchema,
+  tokenRequestSchema
 };

package/dist/esm/index.js

@@ -65,16 +65,19 @@ function createIdP(opts) {
     ...opts.callbackHostFor ? { callbackHostFor: opts.callbackHostFor } : {},
     resolveTenant: opts.resolveTenant,
     success: opts.success,
+    ...opts.onLogout ? { onLogout: opts.onLogout } : {},
     ...opts.persistUpstreamTokens ? { persistUpstreamTokens: opts.persistUpstreamTokens } : {},
     ...opts.exchangeAudience ? { exchangeAudience: opts.exchangeAudience } : {},
     ...opts.renderPicker ? { renderPicker: opts.renderPicker } : {},
+    ...opts.registerClient ? { registerClient: opts.registerClient } : {},
     ...opts.buildCustomContext ? { buildCustomContext: opts.buildCustomContext } : {},
     clock,
     cookieDefaults: {
       secure: opts.cookies?.secure ?? true,
       ...opts.cookies?.domain !== undefined ? { domain: opts.cookies.domain } : {},
       ...opts.cookies?.path !== undefined ? { path: opts.cookies.path } : {}
-    }
+    },
+    ...opts.customScopeClaims !== undefined ? { customScopeClaims: opts.customScopeClaims } : {}
   };
   const app = buildRouter(deps);
   const fetch = async (req) => await app.fetch(req);
@@ -86,41 +89,44 @@ function createIdP(opts) {
     jwks: fetch,
     discovery: fetch,
     revoke: fetch,
-    introspect: fetch
+    introspect: fetch,
+    endSession: fetch,
+    par: fetch,
+    register: fetch
   };
 }
 export {
-  yahooFactory,
-  xFactory,
-  twitchFactory,
-  spotifyFactory,
-  slackFactory,
-  revokeAllForSubject,
-  passwordMethod,
-  passkeyMethod,
-  ok,
-  oidcFactory,
-  oauth2Factory,
-  microsoftFactory,
-  m2mMethod,
-  linkedinFactory,
-  keycloakFactory,
-  jumpcloudFactory,
-  isOk,
-  isErr,
-  googleFactory,
-  githubFactory,
-  facebookFactory,
-  err,
-  discordFactory,
-  createIdP,
-  cognitoFactory,
-  codeMethod,
-  buildOidcMethod,
-  buildOauth2Method,
-  authError,
-  asTenantId,
-  argon2idHasher,
+  DEFAULT_ARGON2ID_PARAMS,
   appleFactory,
-  DEFAULT_ARGON2ID_PARAMS
+  argon2idHasher,
+  asTenantId,
+  authError,
+  buildOauth2Method,
+  buildOidcMethod,
+  codeMethod,
+  cognitoFactory,
+  createIdP,
+  discordFactory,
+  err,
+  facebookFactory,
+  githubFactory,
+  googleFactory,
+  isErr,
+  isOk,
+  jumpcloudFactory,
+  keycloakFactory,
+  linkedinFactory,
+  m2mMethod,
+  microsoftFactory,
+  oauth2Factory,
+  oidcFactory,
+  ok,
+  passkeyMethod,
+  passwordMethod,
+  revokeAllForSubject,
+  slackFactory,
+  spotifyFactory,
+  twitchFactory,
+  xFactory,
+  yahooFactory
 };

package/dist/esm/methods/oauth2-factory.js

@@ -79,6 +79,6 @@ var oidcFactory = {
   })
 };
 export {
-  oidcFactory,
-  oauth2Factory
+  oauth2Factory,
+  oidcFactory
 };

package/dist/esm/methods/password-hash.js

@@ -74,6 +74,6 @@ function parsePhc(stored) {
   }
 }
 export {
-  argon2idHasher,
-  DEFAULT_ARGON2ID_PARAMS
+  DEFAULT_ARGON2ID_PARAMS,
+  argon2idHasher
 };

package/dist/esm/methods/providers/index.js

@@ -1,17 +1,33 @@
+// src/methods/providers/index.ts
+import { googleFactory } from "./google";
+import { githubFactory } from "./github";
+import { appleFactory } from "./apple";
+import { microsoftFactory } from "./microsoft";
+import { discordFactory } from "./discord";
+import { facebookFactory } from "./facebook";
+import { linkedinFactory } from "./linkedin";
+import { slackFactory } from "./slack";
+import { spotifyFactory } from "./spotify";
+import { twitchFactory } from "./twitch";
+import { xFactory } from "./x";
+import { yahooFactory } from "./yahoo";
+import { jumpcloudFactory } from "./jumpcloud";
+import { keycloakFactory } from "./keycloak";
+import { cognitoFactory } from "./cognito";
 export {
-  yahooFactory,
-  xFactory,
-  twitchFactory,
-  spotifyFactory,
-  slackFactory,
-  microsoftFactory,
-  linkedinFactory,
-  keycloakFactory,
-  jumpcloudFactory,
-  googleFactory,
-  githubFactory,
-  facebookFactory,
-  discordFactory,
+  appleFactory,
   cognitoFactory,
-  appleFactory
+  discordFactory,
+  facebookFactory,
+  githubFactory,
+  googleFactory,
+  jumpcloudFactory,
+  keycloakFactory,
+  linkedinFactory,
+  microsoftFactory,
+  slackFactory,
+  spotifyFactory,
+  twitchFactory,
+  xFactory,
+  yahooFactory
 };

package/dist/esm/methods/saml-sp/acs.js

@@ -0,0 +1,208 @@
+// src/methods/saml-sp/acs.ts
+import xmldom from "@xmldom/xmldom";
+import { authError } from "../../types/error";
+import { mapProfile } from "./attributes";
+import { buildSamlInstance, deriveSpEntityId } from "./saml-instance";
+var { DOMParser } = xmldom;
+function checkRecipient(profile, acsUrl) {
+  if (typeof profile.getAssertionXml !== "function") {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: node-saml profile exposes no getAssertionXml(); cannot " + "perform the Recipient binding check. Refusing to authenticate.")
+    };
+  }
+  let doc;
+  try {
+    doc = new DOMParser().parseFromString(profile.getAssertionXml(), "text/xml");
+  } catch (e) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: failed to parse the verified assertion for the " + "Recipient check", e)
+    };
+  }
+  const nodes = doc.getElementsByTagNameNS("*", "SubjectConfirmationData");
+  const recipients = [];
+  for (let i = 0;i < nodes.length; i++) {
+    const r = nodes[i]?.getAttribute("Recipient");
+    if (r)
+      recipients.push(r);
+  }
+  if (recipients.length === 0) {
+    return {
+      kind: "denied",
+      reason: "assertion has no SubjectConfirmationData/@Recipient binding it " + "to this ACS"
+    };
+  }
+  if (!recipients.includes(acsUrl)) {
+    return {
+      kind: "denied",
+      reason: "recipient mismatch: assertion not addressed to this ACS"
+    };
+  }
+  return null;
+}
+function extractReplayInfo(profile) {
+  if (typeof profile.getAssertionXml !== "function")
+    return null;
+  let doc;
+  try {
+    doc = new DOMParser().parseFromString(profile.getAssertionXml(), "text/xml");
+  } catch {
+    return null;
+  }
+  const root = doc.documentElement;
+  const assertionId = root?.getAttribute("ID") ?? "";
+  if (!assertionId)
+    return null;
+  let earliest = null;
+  for (const tag of ["Conditions", "SubjectConfirmationData"]) {
+    const els = doc.getElementsByTagNameNS("*", tag);
+    for (let i = 0;i < els.length; i++) {
+      const v = els[i]?.getAttribute("NotOnOrAfter");
+      if (!v)
+        continue;
+      const ms = Date.parse(v);
+      if (!Number.isNaN(ms))
+        earliest = earliest === null ? ms : Math.min(earliest, ms);
+    }
+  }
+  return { assertionId, notOnOrAfterMs: earliest };
+}
+async function consumeAssertion(ctx, methodId, config) {
+  const idpInitiated = ctx.flow === null;
+  let spEntityId;
+  let acsUrl;
+  if (idpInitiated) {
+    if (!config.idpInitiated) {
+      return {
+        kind: "error",
+        error: authError.internalError("saml-sp: unsolicited Response reached a method with no " + "idpInitiated config")
+      };
+    }
+    if (!ctx.dispatch) {
+      return {
+        kind: "error",
+        error: authError.internalError("saml-sp: IdP-initiated ACS dispatched without issuer context")
+      };
+    }
+    spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+    acsUrl = ctx.dispatch.callbackUrl;
+  } else {
+    const state = ctx.methodState;
+    if (!state || !state.spEntityId || !state.acsUrl) {
+      return {
+        kind: "error",
+        error: authError.internalError("saml-sp: ACS reached without AuthnRequest method state " + "(spEntityId / acsUrl). The flow did not originate from this method.")
+      };
+    }
+    spEntityId = state.spEntityId;
+    acsUrl = state.acsUrl;
+  }
+  let samlResponse;
+  let relayState;
+  try {
+    const form = new URLSearchParams(await ctx.request.text());
+    samlResponse = form.get("SAMLResponse");
+    relayState = form.get("RelayState");
+  } catch {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: ACS could not read POST body")
+    };
+  }
+  if (!samlResponse) {
+    return { kind: "denied", reason: "missing SAMLResponse" };
+  }
+  let saml;
+  try {
+    saml = buildSamlInstance(config, {
+      spEntityId,
+      acsUrl,
+      scratch: ctx.methodScratch,
+      ...idpInitiated ? { idpInitiated: true } : {},
+      ...config.allowEncryptedAssertions && config.decryptionKey ? { decryptionPvk: config.decryptionKey.privateKeyPem } : {}
+    }, Date.now());
+  } catch (e) {
+    return {
+      kind: "error",
+      error: authError.internalError(`saml-sp: cannot construct verifier: ${e instanceof Error ? e.message : String(e)}`, e)
+    };
+  }
+  let profile;
+  try {
+    const result = await saml.validatePostResponseAsync({
+      SAMLResponse: samlResponse,
+      ...relayState !== null ? { RelayState: relayState } : {}
+    });
+    profile = result.profile;
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    if (!config.allowEncryptedAssertions && msg.includes("No decryption key")) {
+      return {
+        kind: "denied",
+        reason: "encrypted assertion received but encrypted assertions are not " + "enabled for this SAML connection (set allowEncryptedAssertions " + "+ decryptionKey)"
+      };
+    }
+    return { kind: "denied", reason: `assertion rejected: ${msg}` };
+  }
+  if (!profile || !profile.nameID) {
+    return { kind: "denied", reason: "assertion produced no usable subject" };
+  }
+  const recipientFailure = checkRecipient(profile, acsUrl);
+  if (recipientFailure)
+    return recipientFailure;
+  if (idpInitiated) {
+    const replay = extractReplayInfo(profile);
+    if (!replay) {
+      return {
+        kind: "error",
+        error: authError.internalError("saml-sp: cannot read assertion @ID for IdP-initiated replay " + "protection. Refusing to authenticate.")
+      };
+    }
+    const key = `idp-replay:${replay.assertionId}`;
+    const seen = await ctx.methodScratch.get(key);
+    if (seen.ok) {
+      return {
+        kind: "denied",
+        reason: "assertion replay detected (assertion ID already seen)"
+      };
+    }
+    const skewMs = (config.clockSkewSeconds ?? 60) * 1000;
+    const now = Date.now();
+    const horizon = replay.notOnOrAfterMs !== null ? replay.notOnOrAfterMs - now + skewMs : 10 * 60000;
+    const ttlMs = Math.min(Math.max(horizon, skewMs, 60000), 24 * 60 * 60000);
+    const recorded = await ctx.methodScratch.put(key, "1", ttlMs);
+    if (!recorded.ok) {
+      return {
+        kind: "error",
+        error: authError.internalError("saml-sp: could not record assertion ID for replay protection")
+      };
+    }
+  }
+  const verified = {
+    nameID: profile.nameID,
+    nameIDFormat: profile.nameIDFormat ?? "",
+    ...profile.sessionIndex !== undefined ? { sessionIndex: profile.sessionIndex } : {},
+    attributes: profile.attributes ?? {},
+    responseXml: profile.getSamlResponseXml?.() ?? ""
+  };
+  const mapped = mapProfile(verified, config.attributeMapping);
+  if ("error" in mapped) {
+    return { kind: "denied", reason: mapped.error };
+  }
+  return {
+    kind: "success",
+    providerSubject: mapped.providerSubject,
+    properties: mapped.properties,
+    ...idpInitiated && config.idpInitiated ? {
+      unsolicitedBinding: {
+        clientId: config.idpInitiated.defaultClientId,
+        redirectUri: config.idpInitiated.defaultRedirectUri,
+        scopes: config.idpInitiated.defaultScopes ?? []
+      }
+    } : {}
+  };
+}
+export {
+  consumeAssertion
+};

package/dist/esm/methods/saml-sp/attributes.js

@@ -0,0 +1,75 @@
+// src/methods/saml-sp/attributes.ts
+var NAME_ID_FORMAT_BY_URN = {
+  "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent": "persistent",
+  "urn:oasis:names:tc:SAML:2.0:nameid-format:transient": "transient",
+  "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress": "emailAddress",
+  "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified": "unspecified"
+};
+function normalizeNameIdFormat(urn) {
+  return NAME_ID_FORMAT_BY_URN[urn] ?? "unspecified";
+}
+function scalar(v) {
+  if (typeof v === "string")
+    return v;
+  if (Array.isArray(v) && v.length > 0 && typeof v[0] === "string") {
+    return v[0];
+  }
+  return;
+}
+function multi(v) {
+  if (typeof v === "string")
+    return v;
+  if (Array.isArray(v)) {
+    const strs = v.filter((x) => typeof x === "string");
+    return strs.length > 0 ? strs : undefined;
+  }
+  return;
+}
+function resolveRef(ref, profile) {
+  if (ref.source === "nameId")
+    return profile.nameID;
+  return multi(profile.attributes[ref.name]);
+}
+function mapProfile(profile, mapping) {
+  const subjectRef = mapping.subject ?? { source: "nameId" };
+  const subjectVal = scalar(resolveRef(subjectRef, profile));
+  if (!subjectVal) {
+    return {
+      error: subjectRef.source === "nameId" ? "assertion NameID is empty; cannot derive subject" : `subject attribute "${subjectRef.name}" missing from assertion`
+    };
+  }
+  const attributes = {};
+  const put = (key, ref) => {
+    if (!ref)
+      return;
+    const v = resolveRef(ref, profile);
+    if (v !== undefined)
+      attributes[key] = v;
+  };
+  put("email", mapping.email);
+  put("name", mapping.name);
+  put("groups", mapping.groups);
+  if (mapping.emailVerified) {
+    attributes["emailVerified"] = mapping.emailVerified.value ? "true" : "false";
+  }
+  for (const [key, ref] of Object.entries(mapping.custom ?? {})) {
+    put(key, ref);
+  }
+  const authnInstant = profile.authnInstant ? Date.parse(profile.authnInstant) : Date.now();
+  return {
+    providerSubject: subjectVal,
+    properties: {
+      nameId: {
+        value: profile.nameID,
+        format: normalizeNameIdFormat(profile.nameIDFormat)
+      },
+      attributes,
+      ...profile.sessionIndex !== undefined ? { sessionIndex: profile.sessionIndex } : {},
+      authnInstant: Number.isNaN(authnInstant) ? Date.now() : authnInstant,
+      raw: { responseXml: profile.responseXml }
+    }
+  };
+}
+export {
+  mapProfile
+};

package/dist/esm/methods/saml-sp/authnrequest.js

@@ -0,0 +1,63 @@
+// src/methods/saml-sp/authnrequest.ts
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { buildSamlInstance, deriveSpEntityId } from "./saml-instance";
+async function buildAuthnRequestRedirect(ctx, methodId, config) {
+  if (!ctx.dispatch) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: dispatch missing on /authorize")
+    };
+  }
+  if (config.signAuthnRequest && !config.signingKey) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: signAuthnRequest is true but signingKey is missing " + "(config schema should have rejected this).")
+    };
+  }
+  const spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  const acsUrl = ctx.dispatch.callbackUrl;
+  const probe = await ctx.methodScratch.put("authnrequest-scratch-probe", "1", 1000);
+  if (isErr(probe)) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: the configured SessionStore adapter does not support " + "methodScratch (saveScratch/readScratch/deleteScratch), which " + "SAML SP requires for InResponseTo replay protection. Deploy " + "SAML against an adapter that implements the scratch trio.")
+    };
+  }
+  let redirectUrl;
+  try {
+    const saml = buildSamlInstance(config, {
+      spEntityId,
+      acsUrl,
+      scratch: ctx.methodScratch,
+      ...config.signAuthnRequest && config.signingKey ? {
+        signing: {
+          privateKeyPem: config.signingKey.privateKeyPem,
+          certPem: config.signingKey.certPem
+        }
+      } : {}
+    }, Date.now());
+    redirectUrl = await saml.getAuthorizeUrlAsync(ctx.dispatch.state, undefined, {});
+  } catch (e) {
+    return {
+      kind: "error",
+      error: authError.internalError(`saml-sp: failed to build AuthnRequest: ${e instanceof Error ? e.message : String(e)}`, e)
+    };
+  }
+  return {
+    kind: "challenge",
+    response: new Response(null, {
+      status: 302,
+      headers: { location: redirectUrl }
+    }),
+    saveMethodState: {
+      relayState: ctx.dispatch.state,
+      issuedAt: Date.now(),
+      spEntityId,
+      acsUrl
+    }
+  };
+}
+export {
+  buildAuthnRequestRedirect
+};

package/dist/esm/methods/saml-sp/cache-provider.js

@@ -0,0 +1,33 @@
+// src/methods/saml-sp/cache-provider.ts
+import { isOk } from "../../types/result";
+var KEY_PREFIX = "saml-inresponseto:";
+function methodScratchCacheProvider(scratch, ttlMs) {
+  return {
+    async saveAsync(key, value) {
+      const createdAt = Date.now();
+      const item = { value, createdAt };
+      const r = await scratch.put(`${KEY_PREFIX}${key}`, JSON.stringify(item), ttlMs);
+      return isOk(r) ? item : null;
+    },
+    async getAsync(key) {
+      const r = await scratch.get(`${KEY_PREFIX}${key}`);
+      if (!isOk(r))
+        return null;
+      try {
+        const item = JSON.parse(r.value);
+        return item.value;
+      } catch {
+        return null;
+      }
+    },
+    async removeAsync(key) {
+      if (key === null)
+        return null;
+      const r = await scratch.delete(`${KEY_PREFIX}${key}`);
+      return isOk(r) ? key : null;
+    }
+  };
+}
+export {
+  methodScratchCacheProvider
+};

package/dist/esm/methods/saml-sp/cert-rotation.js

@@ -0,0 +1,13 @@
+// src/methods/saml-sp/cert-rotation.ts
+function selectActiveCertPems(certs, nowMs) {
+  return certs.filter((c) => {
+    if (c.notBefore !== undefined && nowMs < c.notBefore)
+      return false;
+    if (c.notAfter !== undefined && nowMs >= c.notAfter)
+      return false;
+    return true;
+  }).map((c) => c.pem);
+}
+export {
+  selectActiveCertPems
+};