@web-ts-toolkit/express-oidc-vault-memory-store 0.52.0 → 0.54.0

package/README.md

@@ -94,6 +94,7 @@ The store keeps these record kinds in separate in-process maps:
 - rotated-session aliases, used only so an old public session ID can revoke the current logical session
 - backchannel logout token JTIs, consumed once until their expiry time
 - DPoP proof reservations with their own bounded expiry heap/capacity
+- dedicated logout continuation tickets with independent capacity and removable expiry nodes
 
 `createAuthorizationTransaction`, `createExchangeCode`, and `createSession` are upserts; creating the same key again replaces the old value. A `createSession` replacement takes over the session ID with its own subject/logical/provider-session scope, and clears any stale rotation alias held under that ID so the reused ID cannot invoke an old logical-session meaning. Portable callers must still create sessions with a fresh unused ID and handle `OidcVaultStoreConflictError`: reusing a live ID replaces on memory/MongoDB but rejects on Redis. MongoDB also retains an alias row under a reused ID until expiry or lineage cleanup; only fresh-ID creation is portable.
 
@@ -128,6 +129,16 @@ All shared types (`OidcVaultDeviceBindingStoreProvider`, `OidcVaultRecordBinding
 
 Session rotation inherits omitted/undefined binding and accepts the same original key; it rejects null/malformed binding, a changed key, or adding a binding to an unbound source before mutation. Session IDs still follow the upsert/alias contracts above. A revocation alias never supplies historical or missing binding as proof of unboundness: all live lineage members must agree on binding/provider identity (malformed/inconsistent authority throws a fixed private diagnostic). Revocation context scans that lineage's candidates in the session map; it does not authenticate aliases through `getSession`.
 
+## Dedicated Logout Continuation Tickets
+
+The inferred factory result satisfies both core `OidcVaultDeviceBindingStoreProvider` and `OidcVaultLogoutNavigationStoreProvider`. The latter requires `createLogoutNavigationTicket` / `consumeLogoutNavigationTicket`; they remain optional on the base custom-store contract. Import ticket/create/consume types and `OidcVaultLogoutNavigationCapacityError` from the **core root**. This storage extension does not enable HTTP routes.
+
+`logoutNavigationMaxEntries` is a positive safe integer, default **10000**, shared across effective ticket namespaces in this object, independent of replay capacity. Live collisions throw `OidcVaultStoreConflictError` before capacity rejection, preserving destination/expiry. New admissions at capacity throw `OidcVaultLogoutNavigationCapacityError`, never evicting live grants. Exactly five scalar fields are captured before yielding and returned detached: `namespace`, `ticketHash`, `upstreamLogoutUrl`, `createdAt`, `expiresAt`. Invalid creates throw TypeError; invalid/unknown/spent/expired/malformed selected consumes return null and retire selected unusable data. Clock failures throw. Core's README defines canonical scope/hash formats, 256-bit generation, Date-range integer clocks/epochs, 1000..120000-ms original and maximum remaining lifetime, strict expiry, and 16384-byte HTTP(S) URL syntax.
+
+A dedicated map and **removable indexed min-heap** retain one node per ticket. Check/remove has no asynchronous gap; arbitrary consumes remove their heap node immediately, without tombstones. Each ticket operation removes its selected entry plus at most **64 unrelated expiries**, with O(log N) heap work and no session/alias/replay sweeps. Unknown consumes allocate no entries. Expired payloads can remain idle until later ticket traffic or disposal, but are unusable and occupy the fixed cap. No timers. Only this same memory object shares consumption; separate objects/processes do not.
+
+The already-built URL can retain an ID-token hint; hashing does not encrypt it. No raw ticket/session/profile/separate tokens are stored. Exclude records/URLs from diagnostics. Session/lineage/backchannel deletion does not cascade to authorized tickets; discarding the store loses them. Existing identity, alias, rotation and replay contracts remain intact.
+
 ## Per-Request DPoP Replay And Capacity
 
 | Memory option          | Default    | Contract                                                                   |

package/index.d.mts

@@ -1,7 +1,9 @@
-import { OidcVaultDeviceBindingStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
+import { OidcVaultDeviceBindingStoreProvider, OidcVaultLogoutNavigationStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
 
 /** Construction options for the named package-root memory-store factory. */
 interface MemoryOidcVaultStoreOptions {
+    /** Independent physical-store ticket cap, shared across namespaces; default 10000. No live eviction. */
+    logoutNavigationMaxEntries?: number;
     /** Positive safe integer shared by this store object; default 100000. No live replay reservations are evicted. */
     dpopReplayMaxEntries?: number;
     /**
@@ -20,10 +22,11 @@ interface MemoryOidcVaultStoreOptions {
  * during store operations, and lost when the Node.js process exits. Do not use
  * this provider when sessions must survive restarts or be shared by multiple
  * application instances. The returned stronger provider includes guarded
- * exact/null consumes, token-free revocation context, and bounded DPoP replay.
+ * exact/null consumes, token-free revocation context, bounded DPoP replay and
+ * independent, atomic logout continuation tickets (default cap 10000).
  * Replay is shared only by callers reusing this same object; the store does not
  * verify HTTP proofs. Capacity defaults to 100000 and never evicts live entries.
  */
-declare function createMemoryOidcVaultStore(options?: MemoryOidcVaultStoreOptions): OidcVaultDeviceBindingStoreProvider;
+declare function createMemoryOidcVaultStore(options?: MemoryOidcVaultStoreOptions): OidcVaultDeviceBindingStoreProvider & OidcVaultLogoutNavigationStoreProvider;
 
 export { type MemoryOidcVaultStoreOptions, createMemoryOidcVaultStore };

package/index.d.ts

@@ -1,7 +1,9 @@
-import { OidcVaultDeviceBindingStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
+import { OidcVaultDeviceBindingStoreProvider, OidcVaultLogoutNavigationStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
 
 /** Construction options for the named package-root memory-store factory. */
 interface MemoryOidcVaultStoreOptions {
+    /** Independent physical-store ticket cap, shared across namespaces; default 10000. No live eviction. */
+    logoutNavigationMaxEntries?: number;
     /** Positive safe integer shared by this store object; default 100000. No live replay reservations are evicted. */
     dpopReplayMaxEntries?: number;
     /**
@@ -20,10 +22,11 @@ interface MemoryOidcVaultStoreOptions {
  * during store operations, and lost when the Node.js process exits. Do not use
  * this provider when sessions must survive restarts or be shared by multiple
  * application instances. The returned stronger provider includes guarded
- * exact/null consumes, token-free revocation context, and bounded DPoP replay.
+ * exact/null consumes, token-free revocation context, bounded DPoP replay and
+ * independent, atomic logout continuation tickets (default cap 10000).
  * Replay is shared only by callers reusing this same object; the store does not
  * verify HTTP proofs. Capacity defaults to 100000 and never evicts live entries.
  */
-declare function createMemoryOidcVaultStore(options?: MemoryOidcVaultStoreOptions): OidcVaultDeviceBindingStoreProvider;
+declare function createMemoryOidcVaultStore(options?: MemoryOidcVaultStoreOptions): OidcVaultDeviceBindingStoreProvider & OidcVaultLogoutNavigationStoreProvider;
 
 export { type MemoryOidcVaultStoreOptions, createMemoryOidcVaultStore };

package/index.js

@@ -23,7 +23,7 @@ __export(index_exports, {
   createMemoryOidcVaultStore: () => createMemoryOidcVaultStore
 });
 module.exports = __toCommonJS(index_exports);
-var import_express_oidc_vault3 = require("@web-ts-toolkit/express-oidc-vault");
+var import_express_oidc_vault4 = require("@web-ts-toolkit/express-oidc-vault");
 
 // src/binding.ts
 var import_express_oidc_vault = require("@web-ts-toolkit/express-oidc-vault");
@@ -138,6 +138,117 @@ var DpopReplayReservations = class {
   }
 };
 
+// src/logout-tickets.ts
+var import_express_oidc_vault3 = require("@web-ts-toolkit/express-oidc-vault");
+
+// src/logout-ticket-validation.ts
+var HASH = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+var PREFIX = "logout-navigation:v1:";
+var UNSAFE_URL = /[\s\\\u0000-\u001f\u007f-\u009f]/u;
+var usableEpoch = (value) => typeof value === "number" && Number.isSafeInteger(value) && Math.abs(value) <= 864e13;
+var ticketNow = (now) => {
+  if (!usableEpoch(now)) throw new Error("OIDC vault logout navigation store clock is invalid.");
+  return now;
+};
+var captureTicketIdentity = (input) => ({
+  namespace: input?.namespace,
+  ticketHash: input?.ticketHash
+});
+var validTicketIdentity = (input) => typeof input.namespace === "string" && input.namespace.startsWith(PREFIX) && HASH.test(input.namespace.slice(PREFIX.length)) && typeof input.ticketHash === "string" && HASH.test(input.ticketHash);
+var captureTicket = (input) => ({
+  ...captureTicketIdentity(input),
+  upstreamLogoutUrl: input?.upstreamLogoutUrl,
+  createdAt: input?.createdAt,
+  expiresAt: input?.expiresAt
+});
+var validTicket = (record, now) => {
+  if (!record || typeof record !== "object" || Array.isArray(record) || Object.keys(record).length !== 5 || !validTicketIdentity(record) || !usableEpoch(record.createdAt) || !usableEpoch(record.expiresAt) || record.expiresAt - record.createdAt < 1e3 || record.expiresAt - record.createdAt > 12e4 || now !== void 0 && (record.expiresAt <= now || record.expiresAt - now > 12e4) || typeof record.upstreamLogoutUrl !== "string" || !/^https?:\/\//i.test(record.upstreamLogoutUrl) || /^https?:\/\/[^/?#]*@/i.test(record.upstreamLogoutUrl) || UNSAFE_URL.test(record.upstreamLogoutUrl) || Buffer.byteLength(record.upstreamLogoutUrl, "utf8") > 16384)
+    return false;
+  try {
+    const url = new URL(record.upstreamLogoutUrl);
+    return (url.protocol === "https:" || url.protocol === "http:") && !url.username && !url.password && !url.hash && !record.upstreamLogoutUrl.includes("#") && Buffer.byteLength(url.href, "utf8") <= 16384;
+  } catch {
+    return false;
+  }
+};
+var assertTicket = (record, now) => {
+  if (!validTicket(record, now)) throw new TypeError("OIDC vault logout navigation ticket is invalid or expired.");
+};
+var ticketLimit = (value) => {
+  const max = value === void 0 ? 1e4 : value;
+  if (!Number.isSafeInteger(max) || max <= 0)
+    throw new TypeError("OIDC vault logoutNavigationMaxEntries must be a positive safe integer.");
+  return max;
+};
+var ticketId = ({ namespace, ticketHash }) => `${namespace}:${ticketHash}`;
+
+// src/logout-tickets.ts
+var LogoutNavigationTickets = class {
+  constructor(maxEntries) {
+    this.maxEntries = maxEntries;
+    this.tickets = /* @__PURE__ */ new Map();
+    this.expiryHeap = [];
+  }
+  create(record, now) {
+    ticketNow(now);
+    assertTicket(record, now);
+    const id = ticketId(record);
+    const existing = this.tickets.get(id);
+    if (existing && validTicket(existing.record, now)) throw new import_express_oidc_vault3.OidcVaultStoreConflictError();
+    if (existing) this.remove(existing.index);
+    this.cleanup(now);
+    if (this.tickets.size >= this.maxEntries) throw new import_express_oidc_vault3.OidcVaultLogoutNavigationCapacityError();
+    const entry = { id, record, index: this.expiryHeap.length };
+    this.tickets.set(id, entry);
+    this.expiryHeap.push(entry);
+    this.moveUp(entry.index);
+  }
+  consume(input, now) {
+    ticketNow(now);
+    const selected = this.tickets.get(ticketId(input));
+    if (selected) this.remove(selected.index);
+    this.cleanup(now);
+    return selected && validTicket(selected.record, now) && ticketId(selected.record) === ticketId(input) ? { ...selected.record } : null;
+  }
+  cleanup(now) {
+    for (let cleaned = 0; cleaned < 64 && this.expiryHeap[0]?.record.expiresAt <= now; cleaned += 1) this.remove(0);
+  }
+  remove(index) {
+    const removed = this.expiryHeap[index];
+    const last = this.expiryHeap.pop();
+    this.tickets.delete(removed.id);
+    if (index === this.expiryHeap.length) return;
+    this.expiryHeap[index] = last;
+    last.index = index;
+    this.moveUp(index);
+    this.moveDown(last.index);
+  }
+  swap(left, right) {
+    [this.expiryHeap[left], this.expiryHeap[right]] = [this.expiryHeap[right], this.expiryHeap[left]];
+    this.expiryHeap[left].index = left;
+    this.expiryHeap[right].index = right;
+  }
+  moveUp(index) {
+    while (index > 0) {
+      const parent = Math.floor((index - 1) / 2);
+      if (this.expiryHeap[parent].record.expiresAt <= this.expiryHeap[index].record.expiresAt) break;
+      this.swap(parent, index);
+      index = parent;
+    }
+  }
+  moveDown(index) {
+    for (; ; ) {
+      const left = index * 2 + 1;
+      if (left >= this.expiryHeap.length) return;
+      const right = left + 1;
+      const child = right < this.expiryHeap.length && this.expiryHeap[right].record.expiresAt < this.expiryHeap[left].record.expiresAt ? right : left;
+      if (this.expiryHeap[index].record.expiresAt <= this.expiryHeap[child].record.expiresAt) return;
+      this.swap(index, child);
+      index = child;
+    }
+  }
+};
+
 // src/index.ts
 var cloneRecord = (value) => structuredClone(value);
 var isExpiredRecord = (value, now) => typeof value.expiresAt === "number" && value.expiresAt <= now;
@@ -180,6 +291,7 @@ var MemoryOidcVaultStore = class {
       throw new TypeError("OIDC vault DPoP replay maximum entries must be a positive safe integer.");
     }
     this.dpopProofs = new DpopReplayReservations(maxEntries);
+    this.logoutTickets = new LogoutNavigationTickets(ticketLimit(options.logoutNavigationMaxEntries));
     this.now = options.now ?? (() => Date.now());
   }
   async createAuthorizationTransaction(input) {
@@ -310,6 +422,15 @@ var MemoryOidcVaultStore = class {
     input = { replayKey: input.replayKey, expiresAt: input.expiresAt };
     return this.dpopProofs.reserve(input, this.now());
   }
+  async createLogoutNavigationTicket(input) {
+    const record = captureTicket(input);
+    this.logoutTickets.create(record, this.now());
+  }
+  async consumeLogoutNavigationTicket(input) {
+    const identity = captureTicketIdentity(input);
+    if (!validTicketIdentity(identity)) return null;
+    return this.logoutTickets.consume(identity, this.now());
+  }
   async rotateSession(input) {
     const timestamp = this.now();
     const sourceSession = this.sessions.get(input.sessionId);
@@ -319,14 +440,14 @@ var MemoryOidcVaultStore = class {
     }
     const liveSourceSession = this.sessions.get(input.sessionId);
     if (!liveSourceSession || !hasValidSessionRecord(liveSourceSession, input.sessionId)) {
-      throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
+      throw new import_express_oidc_vault4.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
     }
     if (input.nextSession.sessionId === input.sessionId) {
-      throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session rotation target must use a different session ID.");
+      throw new import_express_oidc_vault4.OidcVaultStoreConflictError("OIDC vault session rotation target must use a different session ID.");
     }
     const existingTargetSession = this.sessions.get(input.nextSession.sessionId);
     if (existingTargetSession && !isExpiredRecord(existingTargetSession, timestamp)) {
-      throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session rotation target already exists.");
+      throw new import_express_oidc_vault4.OidcVaultStoreConflictError("OIDC vault session rotation target already exists.");
     }
     const nextSession = cloneRecord(input.nextSession);
     inheritSessionBinding(liveSourceSession, nextSession);

package/index.mjs

@@ -1,6 +1,6 @@
 // src/index.ts
 import {
-  OidcVaultStoreConflictError as OidcVaultStoreConflictError2
+  OidcVaultStoreConflictError as OidcVaultStoreConflictError3
 } from "@web-ts-toolkit/express-oidc-vault";
 
 // src/binding.ts
@@ -116,6 +116,120 @@ var DpopReplayReservations = class {
   }
 };
 
+// src/logout-tickets.ts
+import {
+  OidcVaultLogoutNavigationCapacityError,
+  OidcVaultStoreConflictError as OidcVaultStoreConflictError2
+} from "@web-ts-toolkit/express-oidc-vault";
+
+// src/logout-ticket-validation.ts
+var HASH = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+var PREFIX = "logout-navigation:v1:";
+var UNSAFE_URL = /[\s\\\u0000-\u001f\u007f-\u009f]/u;
+var usableEpoch = (value) => typeof value === "number" && Number.isSafeInteger(value) && Math.abs(value) <= 864e13;
+var ticketNow = (now) => {
+  if (!usableEpoch(now)) throw new Error("OIDC vault logout navigation store clock is invalid.");
+  return now;
+};
+var captureTicketIdentity = (input) => ({
+  namespace: input?.namespace,
+  ticketHash: input?.ticketHash
+});
+var validTicketIdentity = (input) => typeof input.namespace === "string" && input.namespace.startsWith(PREFIX) && HASH.test(input.namespace.slice(PREFIX.length)) && typeof input.ticketHash === "string" && HASH.test(input.ticketHash);
+var captureTicket = (input) => ({
+  ...captureTicketIdentity(input),
+  upstreamLogoutUrl: input?.upstreamLogoutUrl,
+  createdAt: input?.createdAt,
+  expiresAt: input?.expiresAt
+});
+var validTicket = (record, now) => {
+  if (!record || typeof record !== "object" || Array.isArray(record) || Object.keys(record).length !== 5 || !validTicketIdentity(record) || !usableEpoch(record.createdAt) || !usableEpoch(record.expiresAt) || record.expiresAt - record.createdAt < 1e3 || record.expiresAt - record.createdAt > 12e4 || now !== void 0 && (record.expiresAt <= now || record.expiresAt - now > 12e4) || typeof record.upstreamLogoutUrl !== "string" || !/^https?:\/\//i.test(record.upstreamLogoutUrl) || /^https?:\/\/[^/?#]*@/i.test(record.upstreamLogoutUrl) || UNSAFE_URL.test(record.upstreamLogoutUrl) || Buffer.byteLength(record.upstreamLogoutUrl, "utf8") > 16384)
+    return false;
+  try {
+    const url = new URL(record.upstreamLogoutUrl);
+    return (url.protocol === "https:" || url.protocol === "http:") && !url.username && !url.password && !url.hash && !record.upstreamLogoutUrl.includes("#") && Buffer.byteLength(url.href, "utf8") <= 16384;
+  } catch {
+    return false;
+  }
+};
+var assertTicket = (record, now) => {
+  if (!validTicket(record, now)) throw new TypeError("OIDC vault logout navigation ticket is invalid or expired.");
+};
+var ticketLimit = (value) => {
+  const max = value === void 0 ? 1e4 : value;
+  if (!Number.isSafeInteger(max) || max <= 0)
+    throw new TypeError("OIDC vault logoutNavigationMaxEntries must be a positive safe integer.");
+  return max;
+};
+var ticketId = ({ namespace, ticketHash }) => `${namespace}:${ticketHash}`;
+
+// src/logout-tickets.ts
+var LogoutNavigationTickets = class {
+  constructor(maxEntries) {
+    this.maxEntries = maxEntries;
+    this.tickets = /* @__PURE__ */ new Map();
+    this.expiryHeap = [];
+  }
+  create(record, now) {
+    ticketNow(now);
+    assertTicket(record, now);
+    const id = ticketId(record);
+    const existing = this.tickets.get(id);
+    if (existing && validTicket(existing.record, now)) throw new OidcVaultStoreConflictError2();
+    if (existing) this.remove(existing.index);
+    this.cleanup(now);
+    if (this.tickets.size >= this.maxEntries) throw new OidcVaultLogoutNavigationCapacityError();
+    const entry = { id, record, index: this.expiryHeap.length };
+    this.tickets.set(id, entry);
+    this.expiryHeap.push(entry);
+    this.moveUp(entry.index);
+  }
+  consume(input, now) {
+    ticketNow(now);
+    const selected = this.tickets.get(ticketId(input));
+    if (selected) this.remove(selected.index);
+    this.cleanup(now);
+    return selected && validTicket(selected.record, now) && ticketId(selected.record) === ticketId(input) ? { ...selected.record } : null;
+  }
+  cleanup(now) {
+    for (let cleaned = 0; cleaned < 64 && this.expiryHeap[0]?.record.expiresAt <= now; cleaned += 1) this.remove(0);
+  }
+  remove(index) {
+    const removed = this.expiryHeap[index];
+    const last = this.expiryHeap.pop();
+    this.tickets.delete(removed.id);
+    if (index === this.expiryHeap.length) return;
+    this.expiryHeap[index] = last;
+    last.index = index;
+    this.moveUp(index);
+    this.moveDown(last.index);
+  }
+  swap(left, right) {
+    [this.expiryHeap[left], this.expiryHeap[right]] = [this.expiryHeap[right], this.expiryHeap[left]];
+    this.expiryHeap[left].index = left;
+    this.expiryHeap[right].index = right;
+  }
+  moveUp(index) {
+    while (index > 0) {
+      const parent = Math.floor((index - 1) / 2);
+      if (this.expiryHeap[parent].record.expiresAt <= this.expiryHeap[index].record.expiresAt) break;
+      this.swap(parent, index);
+      index = parent;
+    }
+  }
+  moveDown(index) {
+    for (; ; ) {
+      const left = index * 2 + 1;
+      if (left >= this.expiryHeap.length) return;
+      const right = left + 1;
+      const child = right < this.expiryHeap.length && this.expiryHeap[right].record.expiresAt < this.expiryHeap[left].record.expiresAt ? right : left;
+      if (this.expiryHeap[index].record.expiresAt <= this.expiryHeap[child].record.expiresAt) return;
+      this.swap(index, child);
+      index = child;
+    }
+  }
+};
+
 // src/index.ts
 var cloneRecord = (value) => structuredClone(value);
 var isExpiredRecord = (value, now) => typeof value.expiresAt === "number" && value.expiresAt <= now;
@@ -158,6 +272,7 @@ var MemoryOidcVaultStore = class {
       throw new TypeError("OIDC vault DPoP replay maximum entries must be a positive safe integer.");
     }
     this.dpopProofs = new DpopReplayReservations(maxEntries);
+    this.logoutTickets = new LogoutNavigationTickets(ticketLimit(options.logoutNavigationMaxEntries));
     this.now = options.now ?? (() => Date.now());
   }
   async createAuthorizationTransaction(input) {
@@ -288,6 +403,15 @@ var MemoryOidcVaultStore = class {
     input = { replayKey: input.replayKey, expiresAt: input.expiresAt };
     return this.dpopProofs.reserve(input, this.now());
   }
+  async createLogoutNavigationTicket(input) {
+    const record = captureTicket(input);
+    this.logoutTickets.create(record, this.now());
+  }
+  async consumeLogoutNavigationTicket(input) {
+    const identity = captureTicketIdentity(input);
+    if (!validTicketIdentity(identity)) return null;
+    return this.logoutTickets.consume(identity, this.now());
+  }
   async rotateSession(input) {
     const timestamp = this.now();
     const sourceSession = this.sessions.get(input.sessionId);
@@ -297,14 +421,14 @@ var MemoryOidcVaultStore = class {
     }
     const liveSourceSession = this.sessions.get(input.sessionId);
     if (!liveSourceSession || !hasValidSessionRecord(liveSourceSession, input.sessionId)) {
-      throw new OidcVaultStoreConflictError2("OIDC vault session no longer exists for rotation.");
+      throw new OidcVaultStoreConflictError3("OIDC vault session no longer exists for rotation.");
     }
     if (input.nextSession.sessionId === input.sessionId) {
-      throw new OidcVaultStoreConflictError2("OIDC vault session rotation target must use a different session ID.");
+      throw new OidcVaultStoreConflictError3("OIDC vault session rotation target must use a different session ID.");
     }
     const existingTargetSession = this.sessions.get(input.nextSession.sessionId);
     if (existingTargetSession && !isExpiredRecord(existingTargetSession, timestamp)) {
-      throw new OidcVaultStoreConflictError2("OIDC vault session rotation target already exists.");
+      throw new OidcVaultStoreConflictError3("OIDC vault session rotation target already exists.");
     }
     const nextSession = cloneRecord(input.nextSession);
     inheritSessionBinding(liveSourceSession, nextSession);

package/package.json

@@ -2,7 +2,7 @@
   "name": "@web-ts-toolkit/express-oidc-vault-memory-store",
   "description": "In-memory store provider for @web-ts-toolkit/express-oidc-vault",
   "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/express-oidc-vault-memory-store",
-  "version": "0.52.0",
+  "version": "0.54.0",
   "sideEffects": false,
   "keywords": [
     "express",
@@ -29,7 +29,7 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "@web-ts-toolkit/express-oidc-vault": "0.52.0"
+    "@web-ts-toolkit/express-oidc-vault": "0.54.0"
   },
   "files": [
     "**/*",