@web-ts-toolkit/express-oidc-vault-mongodb-store 0.43.0 → 0.48.0

package/index.js

@@ -26,20 +26,96 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/store.ts
+var import_express_oidc_vault3 = require("@web-ts-toolkit/express-oidc-vault");
+var import_node_util = require("util");
+
+// src/binding.ts
 var import_express_oidc_vault = require("@web-ts-toolkit/express-oidc-vault");
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isHash = (value) => typeof value === "string" && value.length === 43 && /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/.test(value);
+var isBinding = (value) => isRecord(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null) && Object.keys(value).length === 2 && Object.hasOwn(value, "type") && Object.hasOwn(value, "jkt") && value.type === "dpop" && isHash(value.jkt);
+var hasValidSessionBinding = (record) => record.deviceBinding === void 0 || isBinding(record.deviceBinding);
+var hasValidRecordBinding = (record) => hasValidSessionBinding(record) && (record.browserBindingHash === void 0 || isHash(record.browserBindingHash)) && (record.deviceBinding === void 0 || record.browserBindingHash !== void 0);
+var assertRecordBinding = (record) => {
+  if (!hasValidRecordBinding(record))
+    throw new TypeError("OIDC vault store record has invalid device/browser binding.");
+};
+var assertSessionBinding = (record) => {
+  if (!hasValidSessionBinding(record)) throw new TypeError("OIDC vault store session has invalid device binding.");
+};
+var isBindingMatch = (match) => isRecord(match) && Object.hasOwn(match, "deviceBinding") && Object.hasOwn(match, "browserBindingHash") && (match.deviceBinding === null || isBinding(match.deviceBinding)) && (match.browserBindingHash === null || isHash(match.browserBindingHash));
+var bindingMatchFilter = (match) => ({
+  ...match.deviceBinding === null ? { deviceBinding: { $exists: false } } : {
+    "deviceBinding.type": match.deviceBinding.type,
+    "deviceBinding.jkt": match.deviceBinding.jkt,
+    $expr: {
+      $eq: [
+        {
+          $size: {
+            $objectToArray: { $cond: [{ $eq: [{ $type: "$deviceBinding" }, "object"] }, "$deviceBinding", {}] }
+          }
+        },
+        2
+      ]
+    }
+  },
+  browserBindingHash: match.browserBindingHash === null ? { $exists: false } : match.browserBindingHash
+});
+var inheritSessionBinding = (source, next) => {
+  assertSessionBinding(source);
+  assertSessionBinding(next);
+  if (next.deviceBinding !== void 0 && next.deviceBinding.jkt !== source.deviceBinding?.jkt) {
+    throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session rotation cannot change or add device binding.");
+  }
+  if (source.deviceBinding !== void 0) next.deviceBinding = { type: "dpop", jkt: source.deviceBinding.jkt };
+};
+var toRevocationContext = (session) => {
+  assertSessionBinding(session);
+  const provider = session.deviceBinding === void 0 && session.provider === null ? void 0 : session.provider;
+  const expiry = session.deviceBinding === void 0 && session.expiresAt === null ? void 0 : session.expiresAt;
+  if (typeof session._id !== "string" || typeof session.subject !== "string" || session.logicalSessionId !== void 0 && typeof session.logicalSessionId !== "string" || expiry !== void 0 && (!(expiry instanceof Date) || !Number.isFinite(expiry.getTime())) || provider !== void 0 && (!isRecord(provider) || provider.issuer !== void 0 && typeof provider.issuer !== "string" || provider.clientId !== void 0 && typeof provider.clientId !== "string")) {
+    throw new Error("OIDC vault MongoDB lineage has malformed session/provider authority.");
+  }
+  return {
+    logicalSessionId: session.logicalSessionId ?? session._id,
+    ...session.deviceBinding === void 0 ? {} : { deviceBinding: { ...session.deviceBinding } },
+    ...provider === void 0 ? {} : {
+      provider: {
+        ...provider.issuer === void 0 ? {} : { issuer: provider.issuer },
+        ...provider.clientId === void 0 ? {} : { clientId: provider.clientId }
+      }
+    }
+  };
+};
+var assertSameLineageAuthority = (source, member) => {
+  toRevocationContext(member);
+  if (source.deviceBinding?.jkt !== member.deviceBinding?.jkt || source.subject !== member.subject || source.provider?.issuer !== member.provider?.issuer || source.provider?.clientId !== member.provider?.clientId) {
+    throw new Error("OIDC vault MongoDB lineage has inconsistent device binding or provider identity.");
+  }
+};
 
 // src/documents.ts
+var providerToDocument = (provider) => {
+  if (provider === null || typeof provider !== "object") return provider;
+  const prototype = Object.getPrototypeOf(provider);
+  if (prototype !== Object.prototype && prototype !== null) return provider;
+  const copy = { ...provider };
+  if (copy.issuer === void 0) delete copy.issuer;
+  if (copy.clientId === void 0) delete copy.clientId;
+  return copy;
+};
 var sessionToDocument = (session) => ({
   _id: session.sessionId,
   logicalSessionId: session.logicalSessionId ?? session.sessionId,
   subject: session.subject,
   providerSessionId: session.providerSessionId,
-  provider: session.provider,
+  ...session.provider === void 0 ? {} : { provider: providerToDocument(session.provider) },
+  ...session.deviceBinding === void 0 ? {} : { deviceBinding: { ...session.deviceBinding } },
   refreshToken: session.refreshToken,
   idToken: session.idToken,
   accessToken: session.accessToken,
   scope: session.scope,
-  expiresAt: typeof session.expiresAt === "number" ? new Date(session.expiresAt) : void 0,
+  ...session.expiresAt === void 0 ? {} : { expiresAt: new Date(session.expiresAt) },
   createdAt: session.createdAt,
   updatedAt: session.updatedAt,
   user: session.user,
@@ -50,7 +126,8 @@ var documentToSession = (session) => ({
   logicalSessionId: session.logicalSessionId ?? session._id,
   subject: session.subject,
   providerSessionId: session.providerSessionId,
-  provider: session.provider,
+  provider: session.deviceBinding === void 0 && session.provider === null ? void 0 : session.provider,
+  ...session.deviceBinding === void 0 ? {} : { deviceBinding: { ...session.deviceBinding } },
   refreshToken: session.refreshToken,
   idToken: session.idToken,
   accessToken: session.accessToken,
@@ -61,22 +138,26 @@ var documentToSession = (session) => ({
   user: session.user,
   metadata: session.metadata
 });
-var authorizationTransactionToDocument = (record) => ({
-  _id: record.state,
-  ...record,
-  expiresAt: new Date(record.expiresAt)
-});
-var exchangeCodeToDocument = (record) => ({
-  _id: record.code,
-  ...record,
-  expiresAt: new Date(record.expiresAt)
-});
+var authorizationTransactionToDocument = (record) => {
+  const document = { _id: record.state, ...record, expiresAt: new Date(record.expiresAt) };
+  if (document.deviceBinding === void 0) delete document.deviceBinding;
+  if (document.browserBindingHash === void 0) delete document.browserBindingHash;
+  return document;
+};
+var exchangeCodeToDocument = (record) => {
+  const document = { _id: record.code, ...record, expiresAt: new Date(record.expiresAt) };
+  if (document.deviceBinding === void 0) delete document.deviceBinding;
+  if (document.browserBindingHash === void 0) delete document.browserBindingHash;
+  return document;
+};
 var authorizationDocumentToRecord = (record) => ({
   state: record.state,
   nonce: record.nonce,
   pkceVerifier: record.pkceVerifier,
   codeChallenge: record.codeChallenge,
   returnTo: record.returnTo,
+  ...record.deviceBinding === void 0 ? {} : { deviceBinding: { ...record.deviceBinding } },
+  ...record.browserBindingHash === void 0 ? {} : { browserBindingHash: record.browserBindingHash },
   createdAt: record.createdAt,
   expiresAt: record.expiresAt.getTime(),
   metadata: record.metadata
@@ -85,10 +166,17 @@ var exchangeDocumentToRecord = (record) => ({
   code: record.code,
   sessionId: record.sessionId,
   returnTo: record.returnTo,
+  ...record.deviceBinding === void 0 ? {} : { deviceBinding: { ...record.deviceBinding } },
+  ...record.browserBindingHash === void 0 ? {} : { browserBindingHash: record.browserBindingHash },
   createdAt: record.createdAt,
   expiresAt: record.expiresAt.getTime()
 });
 var isExpired = (record, now) => record.expiresAt instanceof Date && record.expiresAt.getTime() <= now;
+var validDate = (value) => value instanceof Date && Number.isFinite(value.getTime());
+var optionalString = (value) => value === void 0 || typeof value === "string";
+var validAuthorizationDocument = (record, state) => record._id === state && record.state === state && typeof record.nonce === "string" && typeof record.pkceVerifier === "string" && typeof record.codeChallenge === "string" && Number.isFinite(record.createdAt) && validDate(record.expiresAt) && hasValidRecordBinding(record);
+var validExchangeDocument = (record, code) => record._id === code && record.code === code && typeof record.sessionId === "string" && Number.isFinite(record.createdAt) && validDate(record.expiresAt) && hasValidRecordBinding(record);
+var validSessionDocument = (record, sessionId) => record._id === sessionId && typeof record.subject === "string" && optionalString(record.logicalSessionId) && typeof record.refreshToken === "string" && typeof record.idToken === "string" && (record.expiresAt === void 0 || record.deviceBinding === void 0 && record.expiresAt === null || validDate(record.expiresAt)) && hasValidSessionBinding(record);
 
 // src/options.ts
 var DEFAULT_ROTATED_SESSION_ALIAS_RETENTION_MS = 5 * 60 * 1e3;
@@ -97,7 +185,9 @@ var DEFAULT_COLLECTION_NAMES = {
   exchangeCodes: "oidc_vault_exchange_codes",
   sessions: "oidc_vault_sessions",
   backchannelLogoutTokenJtis: "oidc_vault_backchannel_logout_token_jtis",
-  rotatedSessionAliases: "oidc_vault_rotated_session_aliases"
+  rotatedSessionAliases: "oidc_vault_rotated_session_aliases",
+  dpopProofs: "oidc_vault_dpop_proofs",
+  dpopReplayCapacity: "oidc_vault_dpop_replay_capacity"
 };
 var validateCollectionName = (role, name) => {
   if (name.length === 0) {
@@ -119,7 +209,9 @@ var resolveCollectionNames = (options) => {
     exchangeCodes: options.exchangeCodesCollectionName ?? DEFAULT_COLLECTION_NAMES.exchangeCodes,
     sessions: options.sessionsCollectionName ?? DEFAULT_COLLECTION_NAMES.sessions,
     backchannelLogoutTokenJtis: options.backchannelLogoutTokenJtisCollectionName ?? DEFAULT_COLLECTION_NAMES.backchannelLogoutTokenJtis,
-    rotatedSessionAliases: options.rotatedSessionAliasesCollectionName ?? DEFAULT_COLLECTION_NAMES.rotatedSessionAliases
+    rotatedSessionAliases: options.rotatedSessionAliasesCollectionName ?? DEFAULT_COLLECTION_NAMES.rotatedSessionAliases,
+    dpopProofs: options.dpopProofsCollectionName ?? DEFAULT_COLLECTION_NAMES.dpopProofs,
+    dpopReplayCapacity: options.dpopReplayCapacityCollectionName ?? DEFAULT_COLLECTION_NAMES.dpopReplayCapacity
   };
   for (const [role, name] of Object.entries(collectionNames)) {
     validateCollectionName(role, name);
@@ -161,6 +253,10 @@ var ensureStoreIndexes = async (collections) => {
     createTtlIndex(collections.sessions),
     createTtlIndex(collections.backchannelLogoutTokenJtis),
     createTtlIndex(collections.rotatedSessionAliases),
+    createTtlIndex(collections.dpopProofs),
+    // Accounting outlives physical proof TTL deletion until a serialized
+    // bounded cleanup decrements capacity. Never TTL-delete these entries.
+    collections.dpopReplayCapacity.createIndex({ kind: 1, expiresAt: 1 }, { name: "dpop_expiry_accounting_idx" }),
     collections.rotatedSessionAliases.createIndex({ logicalSessionId: 1 }, { name: "logical_session_idx" }),
     collections.sessions.createIndex(
       { subject: 1, "provider.issuer": 1, "provider.clientId": 1 },
@@ -174,14 +270,155 @@ var ensureStoreIndexes = async (collections) => {
   ]);
 };
 
+// src/dpop-replay.ts
+var import_express_oidc_vault2 = require("@web-ts-toolkit/express-oidc-vault");
+var CAPACITY_ID = "capacity";
+var reservationId = (replayKey) => `proof:${replayKey}`;
+var isDate = (value) => value instanceof Date && Number.isFinite(value.getTime());
+var MongoDpopReplayReservations = class {
+  constructor(db, proofs, capacity, maxEntries, now) {
+    this.db = db;
+    this.proofs = proofs;
+    this.capacity = capacity;
+    this.maxEntries = maxEntries;
+    this.now = now;
+  }
+  async initialize() {
+    const indexes = await this.capacity.listIndexes().toArray();
+    if (indexes.some((index) => index.expireAfterSeconds !== void 0)) {
+      throw new Error("OIDC vault MongoDB replay capacity accounting must not have TTL indexes.");
+    }
+    try {
+      await this.capacity.updateOne(
+        { _id: CAPACITY_ID },
+        {
+          $setOnInsert: {
+            kind: "capacity",
+            entries: 0,
+            revision: 0,
+            maxEntries: this.maxEntries,
+            proofsCollectionName: this.proofs.collectionName
+          }
+        },
+        { upsert: true }
+      );
+    } catch (error) {
+      if (!(typeof error === "object" && error !== null && "code" in error && error.code === 11e3)) throw error;
+    }
+    this.validateCapacity(await this.capacity.findOne({ _id: CAPACITY_ID }));
+  }
+  async reserve(input) {
+    if (!this.validWindow(input, this.now())) return false;
+    const session = this.db.client.startSession();
+    try {
+      const result = await session.withTransaction(
+        async () => {
+          const now = this.now();
+          if (!this.validWindow(input, now)) return false;
+          const capacity = await this.capacity.findOneAndUpdate(
+            { _id: CAPACITY_ID },
+            { $inc: { revision: 1 } },
+            { session, returnDocument: "after" }
+          );
+          this.validateCapacity(capacity);
+          const proof = await this.proofs.findOne({ _id: input.replayKey }, { session });
+          if (proof && !isDate(proof.expiresAt))
+            throw new Error("OIDC vault MongoDB replay proof has malformed expiry.");
+          if (proof && proof.expiresAt.getTime() > now) return false;
+          const id = reservationId(input.replayKey);
+          const existing = await this.capacity.findOne({ _id: id }, { session });
+          if (existing) {
+            this.validateReservation(existing);
+            if (existing.expiresAt.getTime() > now) return false;
+          }
+          let removed = 0;
+          if (existing) removed += (await this.capacity.deleteOne({ _id: id }, { session })).deletedCount;
+          const expired = await this.capacity.find({ kind: "reservation", expiresAt: { $lte: new Date(now) } }, { session }).sort({ expiresAt: 1 }).limit(64).toArray();
+          for (const row of expired) this.validateReservation(row);
+          if (expired.length > 0) {
+            removed += (await this.capacity.deleteMany(
+              { _id: { $in: expired.map((row) => row._id) }, kind: "reservation" },
+              { session }
+            )).deletedCount;
+            await this.proofs.deleteMany(
+              { _id: { $in: expired.map((row) => row.replayKey) }, expiresAt: { $lte: new Date(now) } },
+              { session }
+            );
+          }
+          const entries = capacity.entries - removed;
+          if (!Number.isSafeInteger(entries) || entries < 0)
+            throw new Error("OIDC vault MongoDB replay capacity accounting is inconsistent.");
+          if (entries >= this.maxEntries) throw new import_express_oidc_vault2.OidcVaultDpopReplayCapacityError();
+          await this.proofs.replaceOne(
+            { _id: input.replayKey },
+            { expiresAt: new Date(input.expiresAt) },
+            { upsert: true, session }
+          );
+          await this.capacity.insertOne(
+            { _id: id, kind: "reservation", replayKey: input.replayKey, expiresAt: new Date(input.expiresAt) },
+            { session }
+          );
+          await this.capacity.updateOne({ _id: CAPACITY_ID }, { $set: { entries: entries + 1 } }, { session });
+          return true;
+        },
+        { readConcern: { level: "snapshot" } }
+      );
+      return result === true;
+    } finally {
+      await session.endSession();
+    }
+  }
+  validWindow(input, now) {
+    if (!Number.isFinite(now)) throw new Error("OIDC vault DPoP replay store clock is invalid.");
+    return typeof input.replayKey === "string" && Number.isSafeInteger(input.expiresAt) && input.expiresAt > now && input.expiresAt - now <= 36e4;
+  }
+  validateCapacity(row) {
+    if (!row || row.kind !== "capacity" || row.maxEntries !== this.maxEntries || row.proofsCollectionName !== this.proofs.collectionName || !Number.isSafeInteger(row.entries) || row.entries < 0 || row.entries > this.maxEntries || !Number.isSafeInteger(row.revision)) {
+      throw new Error("OIDC vault MongoDB replay capacity configuration/accounting is inconsistent.");
+    }
+  }
+  validateReservation(row) {
+    if (row.kind !== "reservation" || typeof row.replayKey !== "string" || row._id !== reservationId(row.replayKey) || !isDate(row.expiresAt)) {
+      throw new Error("OIDC vault MongoDB replay expiry accounting is malformed.");
+    }
+  }
+};
+
 // src/store.ts
-var toSubjectDeleteInput = (input) => typeof input === "string" ? { subject: input } : input;
-var toProviderSessionDeleteInput = (input) => typeof input === "string" ? { providerSessionId: input } : input;
-var toLogicalSessionDeleteInput = (input) => typeof input === "string" ? { logicalSessionId: input } : input;
+var snapshotInput = (input, seen = /* @__PURE__ */ new WeakMap()) => {
+  if (input === null || typeof input !== "object") return input;
+  const prototype = Object.getPrototypeOf(input);
+  if (!Array.isArray(input) && prototype !== Object.prototype && prototype !== null) return input;
+  if (seen.has(input)) return seen.get(input);
+  const copy = Array.isArray(input) ? new Array(input.length) : Object.create(prototype);
+  seen.set(input, copy);
+  for (const key of Reflect.ownKeys(input)) {
+    if (Object.prototype.propertyIsEnumerable.call(input, key)) {
+      Object.defineProperty(copy, key, {
+        value: snapshotInput(Reflect.get(input, key), seen),
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    }
+  }
+  return copy;
+};
+var toSubjectDeleteInput = (input) => typeof input === "string" ? { subject: input } : { ...input };
+var toProviderSessionDeleteInput = (input) => typeof input === "string" ? { providerSessionId: input } : { ...input };
+var toLogicalSessionDeleteInput = (input) => typeof input === "string" ? { logicalSessionId: input } : { ...input };
 var isDuplicateKeyError = (error) => typeof error === "object" && error !== null && "code" in error && error.code === 11e3;
+var isSameSessionDocumentGeneration = (current, expected) => current._id === expected._id && (current.logicalSessionId ?? current._id) === (expected.logicalSessionId ?? expected._id) && current.subject === expected.subject && current.providerSessionId === expected.providerSessionId && (0, import_node_util.isDeepStrictEqual)(
+  current.deviceBinding === void 0 && current.provider === null ? void 0 : current.provider,
+  expected.provider
+) && (0, import_node_util.isDeepStrictEqual)(current.deviceBinding, expected.deviceBinding) && current.refreshToken === expected.refreshToken && current.idToken === expected.idToken && current.accessToken === expected.accessToken && current.scope === expected.scope && (current.expiresAt?.getTime() ?? null) === (expected.expiresAt?.getTime() ?? null) && current.createdAt === expected.createdAt && current.updatedAt === expected.updatedAt && (0, import_node_util.isDeepStrictEqual)(current.user, expected.user) && (0, import_node_util.isDeepStrictEqual)(current.metadata, expected.metadata);
 var MongoOidcVaultStore = class {
   constructor(options) {
     const collectionNames = resolveCollectionNames(options);
+    const maxEntries = options.dpopReplayMaxEntries === void 0 ? 1e5 : options.dpopReplayMaxEntries;
+    if (!Number.isSafeInteger(maxEntries) || maxEntries <= 0) {
+      throw new TypeError("OIDC vault DPoP replay maximum entries must be a positive safe integer.");
+    }
     this.db = options.db;
     this.authorizationTransactions = options.db.collection(
       collectionNames.authorizationTransactions
@@ -194,11 +431,20 @@ var MongoOidcVaultStore = class {
     this.rotatedSessionAliases = options.db.collection(
       collectionNames.rotatedSessionAliases
     );
+    this.dpopProofs = options.db.collection(collectionNames.dpopProofs);
+    this.dpopReplayCapacity = options.db.collection(collectionNames.dpopReplayCapacity);
     this.rotatedSessionAliasRetentionMs = options.rotatedSessionAliasRetentionMs ?? DEFAULT_ROTATED_SESSION_ALIAS_RETENTION_MS;
     if (!Number.isFinite(this.rotatedSessionAliasRetentionMs) || this.rotatedSessionAliasRetentionMs <= 0) {
       throw new TypeError("OIDC vault rotated session alias retention must be a finite positive duration.");
     }
     this.now = options.now ?? (() => Date.now());
+    this.dpopReplay = new MongoDpopReplayReservations(
+      this.db,
+      this.dpopProofs,
+      this.dpopReplayCapacity,
+      maxEntries,
+      this.now
+    );
     this.initialization = this.initialize().then(void 0, (error) => {
       this.initializationError = error;
     });
@@ -207,6 +453,8 @@ var MongoOidcVaultStore = class {
     await this.waitUntilReady();
   }
   async createAuthorizationTransaction(input) {
+    input = snapshotInput({ ...input });
+    assertRecordBinding(input);
     await this.waitUntilReady();
     await this.authorizationTransactions.replaceOne({ _id: input.state }, authorizationTransactionToDocument(input), {
       upsert: true
@@ -214,25 +462,70 @@ var MongoOidcVaultStore = class {
   }
   async consumeAuthorizationTransaction(state) {
     await this.waitUntilReady();
-    const record = await this.authorizationTransactions.findOneAndDelete({ _id: state });
-    if (!record || isExpired(record, this.now())) {
+    const record = await this.authorizationTransactions.findOneAndDelete({
+      _id: state,
+      deviceBinding: { $exists: false },
+      browserBindingHash: { $exists: false }
+    });
+    if (!record || !validAuthorizationDocument(record, state) || isExpired(record, this.now())) {
       return null;
     }
     return authorizationDocumentToRecord(record);
   }
+  async getAuthorizationTransaction(state) {
+    await this.waitUntilReady();
+    const record = await this.authorizationTransactions.findOne({ _id: state });
+    return record && validAuthorizationDocument(record, state) && !isExpired(record, this.now()) ? authorizationDocumentToRecord(record) : null;
+  }
+  async consumeAuthorizationTransactionIfMatches(input) {
+    input = snapshotInput({ ...input });
+    if (!isBindingMatch(input.match)) return null;
+    await this.waitUntilReady();
+    const record = await this.authorizationTransactions.findOneAndDelete({
+      _id: input.state,
+      expiresAt: { $gt: new Date(this.now()) },
+      ...bindingMatchFilter(input.match)
+    });
+    return record && validAuthorizationDocument(record, input.state) && !isExpired(record, this.now()) ? authorizationDocumentToRecord(record) : null;
+  }
   async createExchangeCode(input) {
+    input = snapshotInput({ ...input });
+    assertRecordBinding(input);
     await this.waitUntilReady();
     await this.exchangeCodes.replaceOne({ _id: input.code }, exchangeCodeToDocument(input), { upsert: true });
   }
   async consumeExchangeCode(code) {
     await this.waitUntilReady();
-    const record = await this.exchangeCodes.findOneAndDelete({ _id: code });
-    if (!record || isExpired(record, this.now())) {
+    const record = await this.exchangeCodes.findOneAndDelete({
+      _id: code,
+      deviceBinding: { $exists: false },
+      browserBindingHash: { $exists: false }
+    });
+    if (!record || !validExchangeDocument(record, code) || isExpired(record, this.now())) {
       return null;
     }
     return exchangeDocumentToRecord(record);
   }
+  async getExchangeCode(code) {
+    await this.waitUntilReady();
+    const record = await this.exchangeCodes.findOne({ _id: code });
+    return record && validExchangeDocument(record, code) && !isExpired(record, this.now()) ? exchangeDocumentToRecord(record) : null;
+  }
+  async consumeExchangeCodeIfMatches(input) {
+    input = snapshotInput({ ...input });
+    if (!isBindingMatch(input.match) || typeof input.expectedSessionId !== "string") return null;
+    await this.waitUntilReady();
+    const record = await this.exchangeCodes.findOneAndDelete({
+      _id: input.code,
+      sessionId: input.expectedSessionId,
+      expiresAt: { $gt: new Date(this.now()) },
+      ...bindingMatchFilter(input.match)
+    });
+    return record && validExchangeDocument(record, input.code) && !isExpired(record, this.now()) ? exchangeDocumentToRecord(record) : null;
+  }
   async createSession(input) {
+    input = snapshotInput({ ...input });
+    assertSessionBinding(input);
     await this.waitUntilReady();
     const timestamp = this.now();
     const session = {
@@ -247,21 +540,69 @@ var MongoOidcVaultStore = class {
   async getSession(sessionId) {
     await this.waitUntilReady();
     const session = await this.sessions.findOne({ _id: sessionId });
-    if (!session || await this.isExpiredAndCleanup(this.sessions, session)) {
+    if (!session || !validSessionDocument(session, sessionId) || await this.isExpiredAndCleanup(this.sessions, session)) {
       return null;
     }
     return documentToSession(session);
   }
+  async getSessionRevocationContext(sessionId) {
+    await this.waitUntilReady();
+    const transaction = this.db.client.startSession();
+    const projection = { _id: 1, logicalSessionId: 1, subject: 1, provider: 1, deviceBinding: 1, expiresAt: 1 };
+    try {
+      return await transaction.withTransaction(
+        async () => {
+          const now = this.now();
+          const live = await this.sessions.findOne({ _id: sessionId }, { session: transaction, projection });
+          let logicalSessionId;
+          if (live) {
+            toRevocationContext(live);
+            if (!isExpired(live, now)) logicalSessionId = live.logicalSessionId ?? live._id;
+          }
+          if (logicalSessionId === void 0) {
+            const alias = await this.rotatedSessionAliases.findOne({ _id: sessionId }, { session: transaction });
+            if (!alias || isExpired(alias, now)) return null;
+            if (typeof alias.logicalSessionId !== "string" || !(alias.expiresAt instanceof Date) || !Number.isFinite(alias.expiresAt.getTime())) {
+              throw new Error("OIDC vault MongoDB store has malformed revocation alias.");
+            }
+            logicalSessionId = alias.logicalSessionId;
+          }
+          const members = await this.sessions.find(
+            { $or: [{ logicalSessionId }, { logicalSessionId: { $exists: false }, _id: logicalSessionId }] },
+            { session: transaction, projection }
+          ).toArray();
+          let source;
+          for (const member of members) {
+            toRevocationContext(member);
+            if (isExpired(member, now)) continue;
+            if (source) assertSameLineageAuthority(source, member);
+            else source = member;
+          }
+          return source ? toRevocationContext(source) : null;
+        },
+        { readConcern: { level: "snapshot" } }
+      ) ?? null;
+    } finally {
+      await transaction.endSession();
+    }
+  }
+  async reserveDpopProof(input) {
+    input = { replayKey: input.replayKey, expiresAt: input.expiresAt };
+    await this.waitUntilReady();
+    return this.dpopReplay.reserve(input);
+  }
   async rotateSession(input) {
+    input = { sessionId: input.sessionId, nextSession: snapshotInput({ ...input.nextSession }) };
+    assertSessionBinding(input.nextSession);
     await this.waitUntilReady();
     if (input.nextSession.sessionId === input.sessionId) {
-      throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session rotation target must use a different session ID.");
+      throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session rotation target must use a different session ID.");
     }
     try {
       return await this.rotateSessionWithTransaction(input);
     } catch (error) {
       if (isDuplicateKeyError(error)) {
-        throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session rotation target already exists.");
+        throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session rotation target already exists.");
       }
       throw error;
     }
@@ -273,7 +614,7 @@ var MongoOidcVaultStore = class {
       const logicalSessionId = session.logicalSessionId ?? session._id;
       const result = await this.sessions.deleteOne({ _id: sessionId });
       if (result.deletedCount === 1) {
-        await this.deleteRotatedSessionAliasesByLogicalSessionId(logicalSessionId);
+        await this.deleteAliasesForInactiveLogicalSessions([logicalSessionId]);
         return;
       }
       const alias2 = await this.rotatedSessionAliases.findOne({ _id: sessionId });
@@ -288,13 +629,14 @@ var MongoOidcVaultStore = class {
     }
   }
   async deleteSessionsByLogicalSessionId(input) {
-    await this.waitUntilReady();
     const resolved = toLogicalSessionDeleteInput(input);
+    await this.waitUntilReady();
     const result = await this.sessions.deleteMany({ logicalSessionId: resolved.logicalSessionId });
-    await this.deleteRotatedSessionAliasesByLogicalSessionId(resolved.logicalSessionId);
+    await this.deleteAliasesForInactiveLogicalSessions([resolved.logicalSessionId]);
     return result.deletedCount;
   }
   async consumeBackchannelLogoutTokenJti(input) {
+    input = { ...input };
     await this.waitUntilReady();
     const now = this.now();
     if (!Number.isFinite(input.expiresAt) || input.expiresAt <= now) {
@@ -327,8 +669,8 @@ var MongoOidcVaultStore = class {
     }
   }
   async deleteSessionsBySubject(input) {
-    await this.waitUntilReady();
     const resolved = toSubjectDeleteInput(input);
+    await this.waitUntilReady();
     const filter = { subject: resolved.subject };
     if (resolved.issuer !== void 0) {
       filter["provider.issuer"] = resolved.issuer;
@@ -340,8 +682,8 @@ var MongoOidcVaultStore = class {
     return result.deletedCount;
   }
   async deleteSessionsByProviderSessionId(input) {
-    await this.waitUntilReady();
     const resolved = toProviderSessionDeleteInput(input);
+    await this.waitUntilReady();
     const filter = { providerSessionId: resolved.providerSessionId };
     if (resolved.issuer !== void 0) {
       filter["provider.issuer"] = resolved.issuer;
@@ -359,10 +701,13 @@ var MongoOidcVaultStore = class {
         exchangeCodes: this.exchangeCodes,
         sessions: this.sessions,
         backchannelLogoutTokenJtis: this.backchannelLogoutTokenJtis,
-        rotatedSessionAliases: this.rotatedSessionAliases
+        rotatedSessionAliases: this.rotatedSessionAliases,
+        dpopProofs: this.dpopProofs,
+        dpopReplayCapacity: this.dpopReplayCapacity
       }),
       assertTransactionSupport(this.db)
     ]);
+    await this.dpopReplay.initialize();
   }
   async waitUntilReady() {
     await this.initialization;
@@ -371,14 +716,22 @@ var MongoOidcVaultStore = class {
     }
   }
   async rotateSessionWithTransaction(input) {
+    const { previous, nextSession } = await this.normalizeRotatedSession(input);
+    const expectedSource = sessionToDocument(previous);
     const session = this.db.client.startSession();
-    const nextSession = await this.normalizeRotatedSession(input);
     try {
       await session.withTransaction(async () => {
+        const current = await this.sessions.findOne({ _id: input.sessionId }, { session });
+        if (!current || isExpired(current, this.now())) {
+          throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
+        }
+        if (!isSameSessionDocumentGeneration(current, expectedSource)) {
+          throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session changed before rotation could commit.");
+        }
         await this.sessions.insertOne(sessionToDocument(nextSession), { session });
         const deleteResult = await this.sessions.deleteOne({ _id: input.sessionId }, { session });
         if (deleteResult.deletedCount !== 1) {
-          throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
+          throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
         }
         await this.createRotatedSessionAlias(input.sessionId, nextSession, session);
       });
@@ -397,7 +750,10 @@ var MongoOidcVaultStore = class {
         $set: {
           logicalSessionId,
           expiresAt: this.getRotatedSessionAliasExpiresAt(nextSession, now)
-        }
+        },
+        // A no-op alias update would not conflict with an older cleanup
+        // snapshot. Every rotation must write, even with identical values.
+        $inc: { revision: 1 }
       },
       { upsert: true, session }
     );
@@ -405,11 +761,15 @@ var MongoOidcVaultStore = class {
   async normalizeRotatedSession(input) {
     const previous = await this.getSession(input.sessionId);
     if (!previous) {
-      throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
+      throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
     }
+    inheritSessionBinding(previous, input.nextSession);
     return {
-      ...input.nextSession,
-      logicalSessionId: input.nextSession.logicalSessionId ?? previous.logicalSessionId ?? input.sessionId
+      previous,
+      nextSession: {
+        ...input.nextSession,
+        logicalSessionId: input.nextSession.logicalSessionId ?? previous.logicalSessionId ?? input.sessionId
+      }
     };
   }
   async deleteSessionsAndAliasesByFilter(filter) {
@@ -425,7 +785,7 @@ var MongoOidcVaultStore = class {
       }
       const result = await this.sessions.deleteMany(filter);
       deletedCount += result.deletedCount;
-      await this.rotatedSessionAliases.deleteMany({ logicalSessionId: { $in: logicalSessionIds } });
+      await this.deleteAliasesForInactiveLogicalSessions(logicalSessionIds);
     }
   }
   getRotatedSessionAliasExpiresAt(nextSession, now) {
@@ -433,8 +793,36 @@ var MongoOidcVaultStore = class {
       typeof nextSession.expiresAt === "number" ? nextSession.expiresAt : now + this.rotatedSessionAliasRetentionMs
     );
   }
-  async deleteRotatedSessionAliasesByLogicalSessionId(logicalSessionId) {
-    await this.rotatedSessionAliases.deleteMany({ logicalSessionId });
+  async deleteAliasesForInactiveLogicalSessions(logicalSessionIds) {
+    const session = this.db.client.startSession();
+    try {
+      await session.withTransaction(
+        async () => {
+          const live = await this.sessions.find(
+            {
+              $and: [
+                {
+                  $or: [
+                    { logicalSessionId: { $in: logicalSessionIds } },
+                    { logicalSessionId: { $exists: false }, _id: { $in: logicalSessionIds } }
+                  ]
+                },
+                { $nor: [{ expiresAt: { $lte: new Date(this.now()) } }] }
+              ]
+            },
+            { session, projection: { _id: 1, logicalSessionId: 1 } }
+          ).toArray();
+          const survivingIds = new Set(live.map((record) => record.logicalSessionId ?? record._id));
+          const inactiveIds = logicalSessionIds.filter((id) => !survivingIds.has(id));
+          if (inactiveIds.length > 0) {
+            await this.rotatedSessionAliases.deleteMany({ logicalSessionId: { $in: inactiveIds } }, { session });
+          }
+        },
+        { readConcern: { level: "snapshot" } }
+      );
+    } finally {
+      await session.endSession();
+    }
   }
   async isExpiredAndCleanup(collection, record) {
     if (!isExpired(record, this.now())) {