@web-ts-toolkit/express-oidc-vault-mongodb-store 0.53.0 → 0.54.0

package/README.md

@@ -74,7 +74,7 @@ process.once('SIGTERM', async () => {
 
 ## Collection Names
 
-The provider uses seven separate MongoDB collections by default:
+The provider uses nine separate MongoDB collections by default:
 
 - `oidc_vault_authorization_transactions`: authorization transaction state, nonce, PKCE verifier, and metadata
 - `oidc_vault_exchange_codes`: short-lived frontend exchange codes
@@ -83,6 +83,8 @@ The provider uses seven separate MongoDB collections by default:
 - `oidc_vault_rotated_session_aliases`: stale rotated session IDs mapped to active logical sessions
 - `oidc_vault_dpop_proofs`: unique DPoP proof IDs with a TTL expiry index
 - `oidc_vault_dpop_replay_capacity`: shared capacity/serialization row and indexed, non-TTL expiry-accounting rows
+- `oidc_vault_logout_navigation_tickets`: dedicated continuation URL payloads with TTL expiry and a fixed pairing row
+- `oidc_vault_logout_navigation_capacity`: separate serialized ticket capacity and non-TTL expiry ledger
 
 Override collection names when your deployment needs explicit naming:
 
@@ -96,13 +98,15 @@ const storeProvider = createMongoOidcVaultStore({
   rotatedSessionAliasesCollectionName: 'auth_oidc_rotated_session_aliases',
   dpopProofsCollectionName: 'auth_dpop_proofs',
   dpopReplayCapacityCollectionName: 'auth_dpop_capacity',
+  logoutNavigationTicketsCollectionName: 'auth_logout_tickets',
+  logoutNavigationCapacityCollectionName: 'auth_logout_capacity',
 });
 ```
 
 ## Startup And Client Ownership
 
 - use MongoDB when your team already standardizes on Mongo and you want the auth vault data in the same operational platform
-- the provider uses seven separate collections: transactions, exchange codes, sessions, backchannel JTIs, aliases, DPoP proofs and replay capacity/accounting
+- the provider uses nine separate collections: transactions, exchange codes, sessions, backchannel JTIs, aliases, DPoP proofs, replay capacity/accounting, logout tickets and ticket capacity/accounting
 - TTL indexes are created on expiring records; sessions, authorization transactions, exchange codes, backchannel logout token JTIs, and rotated-session aliases are also checked for expiration during relevant reads or consumes (`expiresAt <= now()` is expired), so behavior does not depend only on Mongo's background TTL monitor timing
 - session rotation, coherent revocation-context reads, replay-capacity admission and inactive-lineage alias cleanup require MongoDB transactions; use a replica set or sharded deployment because standalone servers fail readiness instead of using non-atomic fallbacks
 - startup readiness creates required indexes and verifies transaction-capable topology; connect the MongoDB client, create the store, await `storeProvider.ready()`, then accept traffic
@@ -111,6 +115,34 @@ const storeProvider = createMongoOidcVaultStore({
 
 Drain HTTP requests and any other in-flight store operations before closing the caller-owned `MongoClient`. The store has no shutdown method or background cleanup timer. Its explicit transaction sessions are ended in `finally` on success and failure; MongoDB's TTL monitor belongs to the server. Shared state and durability depend on your deployment, replication and backup configuration.
 
+## Primary Reads And Migration
+
+The store selects **primary** for its own collection reads, including authorization/exchange/session preflight, alias/liveness queries, and readiness index/configuration reads. Rotation, revocation-context, inactive-alias cleanup, and replay transactions also explicitly use primary. This overrides `secondaryPreferred`, `secondary`, or other read preferences inherited from a URI, `MongoClient`, or `Db` for vault work only; there is no secondary-read exception for authentication state.
+
+Reuse an application connection even when ordinary application reads prefer secondaries:
+
+```ts
+import { MongoClient } from 'mongodb';
+import { createMongoOidcVaultStore } from '@web-ts-toolkit/express-oidc-vault-mongodb-store';
+
+const client = new MongoClient(process.env.MONGODB_URI!, { readPreference: 'secondaryPreferred' });
+await client.connect();
+const db = client.db('app-auth');
+const storeProvider = createMongoOidcVaultStore({ db });
+await storeProvider.ready();
+
+// Vault reads/transactions use primary; unrelated handles keep caller defaults.
+const applicationRecords = db.collection('application_records');
+await applicationRecords.findOne({});
+
+// After draining requests and other in-flight store work:
+await client.close();
+```
+
+Migration: applications with a separate primary-only vault client can instead pass their existing connected `Db`, preserving the same database and configured collection names. No second client, replacement `Db`, or per-operation application override is needed. The store leaves caller/client/Db defaults, read-preference tags/staleness settings, unrelated collection routing, BSON serialization options, and existing read/write concerns intact. The caller still owns connection, shutdown, and pool/selection/timeout configuration.
+
+Compatibility: vault reads that previously inherited secondary routing now require a primary. If none is available, readiness or the affected operation rejects with the backend/driver error under the caller's selection/timeout policy; the store never falls back to a secondary or memory. Deletion errors can still follow committed session deletion, as described below. Primary selection is a routing policy: it does **not** add linearizable read concern, causal sessions across separate store calls, stronger write concern, or failover durability. Existing snapshot transaction concerns and rotation's inherited concerns are unchanged. Configure durability for your deployment; replica-set coverage does not certify sharded topology or distributed-failure behavior.
+
 ## Rotation Aliases And Lifetime
 
 - rotation requires a distinct unused target session ID; missing-source, same-ID, existing-target, changed-source, and expired-source rotation conflicts throw `OidcVaultStoreConflictError` without changing source or target records (the source document is re-read inside the transaction and must still match the generation seen before the transaction, including liveness, so a same-ID replacement committed after the rotation's source read aborts instead of being consumed)
@@ -192,6 +224,24 @@ Migration detail: the pre-binding Mongo mapper wrote BSON null for omitted **pro
 
 `getSessionRevocationContext(sessionId)` resolves a live handle or unexpired alias to a currently live lineage using one snapshot transaction. It projects only logical ID/subject/provider/binding/expiry (no refresh/ID/access tokens fetched) and returns only `logicalSessionId`, allowlisted `provider.issuer/clientId`, and optional original `deviceBinding`. No profile/metadata/arbitrary provider fields are returned. Aliases remain token/binding-free; they resolve surviving session authority rather than treating missing alias binding as unbound. Malformed/inconsistent lineage binding/provider authority throws a fixed private diagnostic. Expired aliases/empty lineages return `null`; `getSession(alias)` remains `null`. Lineage queries materialize their surviving candidates; this is not bounded replay-admission work.
 
+## Dedicated Logout Continuation Tickets
+
+`OidcVaultMongoStoreProvider` also satisfies core `OidcVaultLogoutNavigationStoreProvider`, with required `createLogoutNavigationTicket` / `consumeLogoutNavigationTicket` and retained `ready()`. Ticket/create/consume types and `OidcVaultLogoutNavigationCapacityError` are core-root exports; both methods remain optional on the base custom-store contract. This storage extension does not register HTTP routes.
+
+| Mongo ticket option                      | Default                                 | Contract                                                                                    |
+| ---------------------------------------- | --------------------------------------- | ------------------------------------------------------------------------------------------- |
+| `logoutNavigationMaxEntries`             | `10000`                                 | Positive safe integer, identical on shared clients; independent of replay                   |
+| `logoutNavigationTicketsCollectionName`  | `oidc_vault_logout_navigation_tickets`  | Composite namespace/hash `_id`, five-field payload with Date expiry, `expiresAt_ttl`        |
+| `logoutNavigationCapacityCollectionName` | `oidc_vault_logout_navigation_capacity` | Non-TTL capacity/revision and hash/expiry ledger; `logout_navigation_expiry_accounting_idx` |
+
+All **nine** collection roles must be distinct. Readiness rejects TTL indexes on the ticket ledger and validates limits/pairing in **both directions**: a fixed configuration row in the payload collection and a fixed capacity row in the ledger. Both new handles/readiness reads use primary on the supplied Db; **every ticket transaction explicitly uses primary and snapshot read concern**. Caller defaults, concerns and client lifecycle are retained. No secondary/memory fallback.
+
+Create/consume serialize on an actual capacity-row revision write. Transactions validate count/ledger consistency, retire the selected entry plus at most **64 unrelated indexed expiries**, and commit payload/ledger/count changes together. The consistency count is proportional to retained accounting, bounded by configured capacity; the single row can contend. Cleanup/retries add work; no throughput SLA. Successful consume frees its count once. A live ledger protects an identity from collision reuse after early payload disappearance; consume retires it and returns null. Physical TTL deletion never loses accounting. Expired payloads awaiting TTL are unusable; non-TTL accounting may occupy capacity while idle until later traffic. Normal retention is at most the cap in payloads/ledger entries plus two fixed configuration rows. Changing a collection or limit without a matching migration fails closed.
+
+Exactly five scalar fields are captured before the first await and returned detached: `namespace`, `ticketHash`, `upstreamLogoutUrl`, `createdAt`, `expiresAt`. Core's README defines canonical scope/hash formats, 256-bit ticket generation, Date-range integer epochs/clocks, original TTL 1000..120000 ms, remaining TTL >0 and <=120000 ms, and 16384-byte HTTP(S) URL syntax. Invalid creates throw TypeError; live collisions throw `OidcVaultStoreConflictError` before capacity rejection without replacement/extension. Capacity throws `OidcVaultLogoutNavigationCapacityError`, never evicting live grants. Invalid/unknown/spent/expired/malformed selected consumes return null; selected unusable payloads are retired. Backend, clock, pairing and accounting failures throw; transaction failures roll back. Ambiguous acknowledgements are not retry authority.
+
+The final URL can retain an ID-token hint; hashing does not encrypt it. No raw ticket, full session/profile, handle/subject or separate tokens are stored. Exclude records/credential URLs and arbitrary errors from logs. Session/lineage/backchannel deletion does not cascade to authorized tickets. Provisioning is additive; existing identity, rotation, alias and replay semantics remain intact.
+
 ## Per-Request DPoP Replay, Capacity And TTL Accounting
 
 | Mongo replay option                | Default                           | Contract                                                                        |
@@ -210,7 +260,7 @@ const storeProvider = createMongoOidcVaultStore({
 await storeProvider.ready();
 ```
 
-`dpopReplayMaxEntries` is a positive safe integer, default **100000**, shared across independent clients using the paired replay collections. All seven collection names must be distinct and valid. Every shared client must use the same capacity and proof/accounting collection pairing; readiness fails if the persisted capacity configuration disagrees. Changing names starts an independent namespace, not a migration. No instance-local admission counter or replay fallback is used.
+`dpopReplayMaxEntries` is a positive safe integer, default **100000**, shared across independent clients using the paired replay collections. All nine collection names must be distinct and valid. Every shared client must use the same capacity and proof/accounting collection pairing; readiness fails if the persisted capacity configuration disagrees. Changing names starts an independent namespace, not a migration. No instance-local admission counter or replay fallback is used.
 
 `reserveDpopProof({ replayKey, expiresAt })` reserves an opaque key verbatim after proof verification. Expiry must be a safe-integer future millisecond epoch with remaining TTL **<=360000 ms**. Nonfinite/unsafe/fractional/expired (`<= now()`) or overlong windows return `false` without allocation. A duplicate returns `false` without extending expiry, before capacity checks. Valid expired IDs may be admitted again.
 

package/index.d.mts

@@ -1,5 +1,5 @@
 import { Db } from 'mongodb';
-import { OidcVaultDeviceBindingStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
+import { OidcVaultDeviceBindingStoreProvider, OidcVaultLogoutNavigationStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
 
 /**
  * Options for `createMongoOidcVaultStore`.
@@ -9,9 +9,16 @@ import { OidcVaultDeviceBindingStoreProvider } from '@web-ts-toolkit/express-oid
  * from `ready()`, so applications should await readiness before accepting
  * traffic. Rotation and shared replay admission require transactions; standalone servers
  * fail closed instead of using non-atomic multi-write fallback behavior.
+ *
+ * Store-owned collection reads (including readiness) and all store transactions
+ * use primary, overriding URI/client/Db secondary preferences only for vault work.
+ * The supplied Db, namespaces, unrelated collections, BSON options and existing
+ * read/write concerns are retained; no extra client is created. An unavailable
+ * primary causes an error, never secondary or memory fallback. Primary selection
+ * does not add linearizable reads, cross-call causal sessions or failover durability.
  */
 interface MongoOidcVaultStoreOptions {
-    /** MongoDB database handle. The caller owns the underlying client lifecycle. */
+    /** Connected caller-owned database; vault handles/transactions use primary without changing its defaults or client lifecycle. */
     db: Db;
     /** Collection for authorization transactions, keyed by OIDC `state`. */
     authorizationTransactionsCollectionName?: string;
@@ -29,6 +36,12 @@ interface MongoOidcVaultStoreOptions {
     dpopReplayCapacityCollectionName?: string;
     /** Positive safe integer shared by both replay collections; default 100000. All clients must configure the same limit. */
     dpopReplayMaxEntries?: number;
+    /** TTL payloads; default `oidc_vault_logout_navigation_tickets`. Distinct from every other role. */
+    logoutNavigationTicketsCollectionName?: string;
+    /** Non-TTL serialization/expiry ledger; default `oidc_vault_logout_navigation_capacity`. */
+    logoutNavigationCapacityCollectionName?: string;
+    /** Independent ticket cap across namespaces in the paired collections; positive safe integer, default 10000. */
+    logoutNavigationMaxEntries?: number;
     /**
      * Finite alias retention for sessions without explicit expiry, in
      * milliseconds. Defaults to `DEFAULT_ROTATED_SESSION_ALIAS_RETENTION_MS`.
@@ -42,15 +55,19 @@ interface MongoOidcVaultStoreOptions {
  *
  * Create the store after connecting the MongoDB client, then await `ready()`
  * before accepting traffic. The application owns the MongoDB client lifecycle,
- * including shutdown.
+ * including shutdown. Vault reads/transactions require primary without changing
+ * caller defaults or strengthening read/write concerns.
  */
 interface OidcVaultMongoStoreProvider extends OidcVaultDeviceBindingStoreProvider {
+    createLogoutNavigationTicket: OidcVaultLogoutNavigationStoreProvider['createLogoutNavigationTicket'];
+    consumeLogoutNavigationTicket: OidcVaultLogoutNavigationStoreProvider['consumeLogoutNavigationTicket'];
     /**
      * Waits for startup validation to complete.
      *
      * Readiness validates collection names, creates required indexes, and verifies
      * the MongoDB deployment supports rotation/replay transactions and matching
-     * shared replay-capacity configuration.
+     * shared replay/ticket-capacity configuration and ticket collection pairing.
+     * Index/configuration reads use primary even if caller defaults prefer secondaries.
      * If readiness fails, every store operation rejects with the same error.
      */
     ready(): Promise<void>;
@@ -65,8 +82,12 @@ declare const DEFAULT_ROTATED_SESSION_ALIAS_RETENTION_MS: number;
  * Pass a `Db` from an already-connected caller-owned `MongoClient`, await
  * `store.ready()` before accepting traffic, and close the client from your own
  * shutdown path. Readiness validates all configured collection names, creates
- * required indexes for the seven store collections, validates shared replay
- * capacity, and verifies transaction support for rotation/replay admission.
+ * required indexes for nine store collections, validates shared replay/ticket
+ * capacity and pairing, and verifies transaction support for rotation/replay/tickets.
+ * Store collection reads and transactions use primary even when caller defaults
+ * prefer secondaries. Caller defaults/namespaces/concerns are preserved; no extra
+ * client or secondary/memory fallback is used. This does not add linearizable
+ * reads, cross-call causal sessions or failover durability.
  */
 declare function createMongoOidcVaultStore(options: MongoOidcVaultStoreOptions): OidcVaultMongoStoreProvider;
 

package/index.d.ts

@@ -1,5 +1,5 @@
 import { Db } from 'mongodb';
-import { OidcVaultDeviceBindingStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
+import { OidcVaultDeviceBindingStoreProvider, OidcVaultLogoutNavigationStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
 
 /**
  * Options for `createMongoOidcVaultStore`.
@@ -9,9 +9,16 @@ import { OidcVaultDeviceBindingStoreProvider } from '@web-ts-toolkit/express-oid
  * from `ready()`, so applications should await readiness before accepting
  * traffic. Rotation and shared replay admission require transactions; standalone servers
  * fail closed instead of using non-atomic multi-write fallback behavior.
+ *
+ * Store-owned collection reads (including readiness) and all store transactions
+ * use primary, overriding URI/client/Db secondary preferences only for vault work.
+ * The supplied Db, namespaces, unrelated collections, BSON options and existing
+ * read/write concerns are retained; no extra client is created. An unavailable
+ * primary causes an error, never secondary or memory fallback. Primary selection
+ * does not add linearizable reads, cross-call causal sessions or failover durability.
  */
 interface MongoOidcVaultStoreOptions {
-    /** MongoDB database handle. The caller owns the underlying client lifecycle. */
+    /** Connected caller-owned database; vault handles/transactions use primary without changing its defaults or client lifecycle. */
     db: Db;
     /** Collection for authorization transactions, keyed by OIDC `state`. */
     authorizationTransactionsCollectionName?: string;
@@ -29,6 +36,12 @@ interface MongoOidcVaultStoreOptions {
     dpopReplayCapacityCollectionName?: string;
     /** Positive safe integer shared by both replay collections; default 100000. All clients must configure the same limit. */
     dpopReplayMaxEntries?: number;
+    /** TTL payloads; default `oidc_vault_logout_navigation_tickets`. Distinct from every other role. */
+    logoutNavigationTicketsCollectionName?: string;
+    /** Non-TTL serialization/expiry ledger; default `oidc_vault_logout_navigation_capacity`. */
+    logoutNavigationCapacityCollectionName?: string;
+    /** Independent ticket cap across namespaces in the paired collections; positive safe integer, default 10000. */
+    logoutNavigationMaxEntries?: number;
     /**
      * Finite alias retention for sessions without explicit expiry, in
      * milliseconds. Defaults to `DEFAULT_ROTATED_SESSION_ALIAS_RETENTION_MS`.
@@ -42,15 +55,19 @@ interface MongoOidcVaultStoreOptions {
  *
  * Create the store after connecting the MongoDB client, then await `ready()`
  * before accepting traffic. The application owns the MongoDB client lifecycle,
- * including shutdown.
+ * including shutdown. Vault reads/transactions require primary without changing
+ * caller defaults or strengthening read/write concerns.
  */
 interface OidcVaultMongoStoreProvider extends OidcVaultDeviceBindingStoreProvider {
+    createLogoutNavigationTicket: OidcVaultLogoutNavigationStoreProvider['createLogoutNavigationTicket'];
+    consumeLogoutNavigationTicket: OidcVaultLogoutNavigationStoreProvider['consumeLogoutNavigationTicket'];
     /**
      * Waits for startup validation to complete.
      *
      * Readiness validates collection names, creates required indexes, and verifies
      * the MongoDB deployment supports rotation/replay transactions and matching
-     * shared replay-capacity configuration.
+     * shared replay/ticket-capacity configuration and ticket collection pairing.
+     * Index/configuration reads use primary even if caller defaults prefer secondaries.
      * If readiness fails, every store operation rejects with the same error.
      */
     ready(): Promise<void>;
@@ -65,8 +82,12 @@ declare const DEFAULT_ROTATED_SESSION_ALIAS_RETENTION_MS: number;
  * Pass a `Db` from an already-connected caller-owned `MongoClient`, await
  * `store.ready()` before accepting traffic, and close the client from your own
  * shutdown path. Readiness validates all configured collection names, creates
- * required indexes for the seven store collections, validates shared replay
- * capacity, and verifies transaction support for rotation/replay admission.
+ * required indexes for nine store collections, validates shared replay/ticket
+ * capacity and pairing, and verifies transaction support for rotation/replay/tickets.
+ * Store collection reads and transactions use primary even when caller defaults
+ * prefer secondaries. Caller defaults/namespaces/concerns are preserved; no extra
+ * client or secondary/memory fallback is used. This does not add linearizable
+ * reads, cross-call causal sessions or failover durability.
  */
 declare function createMongoOidcVaultStore(options: MongoOidcVaultStoreOptions): OidcVaultMongoStoreProvider;
 

package/index.js

@@ -26,7 +26,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/store.ts
-var import_express_oidc_vault3 = require("@web-ts-toolkit/express-oidc-vault");
+var import_express_oidc_vault4 = require("@web-ts-toolkit/express-oidc-vault");
 var import_node_util = require("util");
 
 // src/binding.ts
@@ -187,7 +187,9 @@ var DEFAULT_COLLECTION_NAMES = {
   backchannelLogoutTokenJtis: "oidc_vault_backchannel_logout_token_jtis",
   rotatedSessionAliases: "oidc_vault_rotated_session_aliases",
   dpopProofs: "oidc_vault_dpop_proofs",
-  dpopReplayCapacity: "oidc_vault_dpop_replay_capacity"
+  dpopReplayCapacity: "oidc_vault_dpop_replay_capacity",
+  logoutNavigationTickets: "oidc_vault_logout_navigation_tickets",
+  logoutNavigationCapacity: "oidc_vault_logout_navigation_capacity"
 };
 var validateCollectionName = (role, name) => {
   if (name.length === 0) {
@@ -211,7 +213,9 @@ var resolveCollectionNames = (options) => {
     backchannelLogoutTokenJtis: options.backchannelLogoutTokenJtisCollectionName ?? DEFAULT_COLLECTION_NAMES.backchannelLogoutTokenJtis,
     rotatedSessionAliases: options.rotatedSessionAliasesCollectionName ?? DEFAULT_COLLECTION_NAMES.rotatedSessionAliases,
     dpopProofs: options.dpopProofsCollectionName ?? DEFAULT_COLLECTION_NAMES.dpopProofs,
-    dpopReplayCapacity: options.dpopReplayCapacityCollectionName ?? DEFAULT_COLLECTION_NAMES.dpopReplayCapacity
+    dpopReplayCapacity: options.dpopReplayCapacityCollectionName ?? DEFAULT_COLLECTION_NAMES.dpopReplayCapacity,
+    logoutNavigationTickets: options.logoutNavigationTicketsCollectionName ?? DEFAULT_COLLECTION_NAMES.logoutNavigationTickets,
+    logoutNavigationCapacity: options.logoutNavigationCapacityCollectionName ?? DEFAULT_COLLECTION_NAMES.logoutNavigationCapacity
   };
   for (const [role, name] of Object.entries(collectionNames)) {
     validateCollectionName(role, name);
@@ -254,6 +258,11 @@ var ensureStoreIndexes = async (collections) => {
     createTtlIndex(collections.backchannelLogoutTokenJtis),
     createTtlIndex(collections.rotatedSessionAliases),
     createTtlIndex(collections.dpopProofs),
+    createTtlIndex(collections.logoutNavigationTickets),
+    collections.logoutNavigationCapacity.createIndex(
+      { kind: 1, expiresAt: 1 },
+      { name: "logout_navigation_expiry_accounting_idx" }
+    ),
     // Accounting outlives physical proof TTL deletion until a serialized
     // bounded cleanup decrements capacity. Never TTL-delete these entries.
     collections.dpopReplayCapacity.createIndex({ kind: 1, expiresAt: 1 }, { name: "dpop_expiry_accounting_idx" }),
@@ -361,7 +370,7 @@ var MongoDpopReplayReservations = class {
           await this.capacity.updateOne({ _id: CAPACITY_ID }, { $set: { entries: entries + 1 } }, { session });
           return true;
         },
-        { readConcern: { level: "snapshot" } }
+        { readPreference: "primary", readConcern: { level: "snapshot" } }
       );
       return result === true;
     } finally {
@@ -384,6 +393,219 @@ var MongoDpopReplayReservations = class {
   }
 };
 
+// src/read-policy.ts
+var primaryCollection = (db, name) => db.collection(name, { readPreference: "primary" });
+
+// src/logout-tickets.ts
+var import_express_oidc_vault3 = require("@web-ts-toolkit/express-oidc-vault");
+
+// src/logout-ticket-validation.ts
+var HASH = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+var PREFIX = "logout-navigation:v1:";
+var UNSAFE_URL = /[\s\\\u0000-\u001f\u007f-\u009f]/u;
+var usableEpoch = (value) => typeof value === "number" && Number.isSafeInteger(value) && Math.abs(value) <= 864e13;
+var ticketNow = (now) => {
+  if (!usableEpoch(now)) throw new Error("OIDC vault logout navigation store clock is invalid.");
+  return now;
+};
+var captureTicketIdentity = (input) => ({
+  namespace: input?.namespace,
+  ticketHash: input?.ticketHash
+});
+var validTicketIdentity = (input) => typeof input.namespace === "string" && input.namespace.startsWith(PREFIX) && HASH.test(input.namespace.slice(PREFIX.length)) && typeof input.ticketHash === "string" && HASH.test(input.ticketHash);
+var captureTicket = (input) => ({
+  ...captureTicketIdentity(input),
+  upstreamLogoutUrl: input?.upstreamLogoutUrl,
+  createdAt: input?.createdAt,
+  expiresAt: input?.expiresAt
+});
+var validTicket = (record, now) => {
+  if (!record || typeof record !== "object" || Array.isArray(record) || Object.keys(record).length !== 5 || !validTicketIdentity(record) || !usableEpoch(record.createdAt) || !usableEpoch(record.expiresAt) || record.expiresAt - record.createdAt < 1e3 || record.expiresAt - record.createdAt > 12e4 || now !== void 0 && (record.expiresAt <= now || record.expiresAt - now > 12e4) || typeof record.upstreamLogoutUrl !== "string" || !/^https?:\/\//i.test(record.upstreamLogoutUrl) || /^https?:\/\/[^/?#]*@/i.test(record.upstreamLogoutUrl) || UNSAFE_URL.test(record.upstreamLogoutUrl) || Buffer.byteLength(record.upstreamLogoutUrl, "utf8") > 16384)
+    return false;
+  try {
+    const url = new URL(record.upstreamLogoutUrl);
+    return (url.protocol === "https:" || url.protocol === "http:") && !url.username && !url.password && !url.hash && !record.upstreamLogoutUrl.includes("#") && Buffer.byteLength(url.href, "utf8") <= 16384;
+  } catch {
+    return false;
+  }
+};
+var assertTicket = (record, now) => {
+  if (!validTicket(record, now)) throw new TypeError("OIDC vault logout navigation ticket is invalid or expired.");
+};
+var ticketLimit = (value) => {
+  const max = value === void 0 ? 1e4 : value;
+  if (!Number.isSafeInteger(max) || max <= 0)
+    throw new TypeError("OIDC vault logoutNavigationMaxEntries must be a positive safe integer.");
+  return max;
+};
+var ticketId = ({ namespace, ticketHash }) => `${namespace}:${ticketHash}`;
+
+// src/logout-tickets.ts
+var CONFIG = "configuration";
+var CAPACITY = "capacity";
+var ledgerId = (id) => `ticket:${id}`;
+var accountingError = () => new Error("OIDC vault MongoDB logout navigation configuration/accounting is inconsistent.");
+var isDate2 = (date) => date instanceof Date && usableEpoch(date.getTime());
+var MongoLogoutNavigationTickets = class {
+  constructor(db, tickets, capacity, maxEntries, now) {
+    this.db = db;
+    this.tickets = tickets;
+    this.capacity = capacity;
+    this.maxEntries = maxEntries;
+    this.now = now;
+  }
+  async initialize() {
+    if ((await this.capacity.listIndexes().toArray()).some((index) => index.expireAfterSeconds !== void 0))
+      throw new Error("OIDC vault MongoDB logout navigation capacity accounting must not have TTL indexes.");
+    for (const initialize of [
+      () => this.tickets.updateOne(
+        { _id: CONFIG },
+        { $setOnInsert: { capacityCollectionName: this.capacity.collectionName, maxEntries: this.maxEntries } },
+        { upsert: true }
+      ),
+      () => this.capacity.updateOne(
+        { _id: CAPACITY },
+        {
+          $setOnInsert: {
+            kind: "capacity",
+            ticketsCollectionName: this.tickets.collectionName,
+            maxEntries: this.maxEntries,
+            entries: 0,
+            revision: 0
+          }
+        },
+        { upsert: true }
+      )
+    ]) {
+      try {
+        await initialize();
+      } catch (error) {
+        if (!(typeof error === "object" && error !== null && "code" in error && error.code === 11e3)) throw error;
+      }
+    }
+    this.validateConfig(await this.tickets.findOne({ _id: CONFIG }));
+    this.validateCapacity(await this.capacity.findOne({ _id: CAPACITY }));
+  }
+  create(record) {
+    assertTicket(record, ticketNow(this.now()));
+    return this.perform(record, record).then(() => void 0);
+  }
+  consume(identity) {
+    return this.perform(identity);
+  }
+  async perform(identity, creating) {
+    const id = ticketId(identity);
+    const session = this.db.client.startSession();
+    try {
+      const result = await session.withTransaction(
+        async () => {
+          const capacity = await this.capacity.findOneAndUpdate(
+            { _id: CAPACITY },
+            { $inc: { revision: 1 } },
+            { session, returnDocument: "after" }
+          );
+          this.validateCapacity(capacity);
+          this.validateConfig(await this.tickets.findOne({ _id: CONFIG }, { session }));
+          if (await this.capacity.countDocuments({ _id: { $ne: CAPACITY } }, { session }) !== capacity.entries)
+            throw accountingError();
+          const now = ticketNow(this.now());
+          if (creating) assertTicket(creating, now);
+          const payload = await this.tickets.findOne({ _id: id }, { session });
+          const selected = await this.capacity.findOne({ _id: ledgerId(id) }, { session });
+          if (selected) this.validateLedger(selected);
+          if (payload && !selected) throw accountingError();
+          const record = payload && "expiresAt" in payload && isDate2(payload.expiresAt) && Object.keys(payload).length === 6 ? {
+            namespace: payload.namespace,
+            ticketHash: payload.ticketHash,
+            upstreamLogoutUrl: payload.upstreamLogoutUrl,
+            createdAt: payload.createdAt,
+            expiresAt: payload.expiresAt.getTime()
+          } : null;
+          const valid = record && validTicket(record, now) && ticketId(record) === id;
+          if (valid && selected.expiresAt.getTime() !== record.expiresAt) throw accountingError();
+          if (creating && selected && selected.expiresAt.getTime() > now && (!payload || valid))
+            throw new import_express_oidc_vault3.OidcVaultStoreConflictError();
+          const expired = await this.capacity.find({ kind: "ticket", _id: { $ne: ledgerId(id) }, expiresAt: { $lte: new Date(now) } }, { session }).sort({ expiresAt: 1 }).limit(64).toArray();
+          for (const row of expired) this.validateLedger(row);
+          if (expired.length) {
+            const payloads = await this.tickets.find(
+              {
+                _id: {
+                  $in: expired.map((row) => ticketId({ namespace: row.namespace, ticketHash: row.ticketHash }))
+                }
+              },
+              { session }
+            ).toArray();
+            for (const payload2 of payloads)
+              if ("expiresAt" in payload2 && isDate2(payload2.expiresAt) && payload2.expiresAt.getTime() > now)
+                throw accountingError();
+          }
+          const retired = [...expired, ...selected ? [selected] : []];
+          if (retired.length) {
+            const removed = await this.capacity.deleteMany(
+              { _id: { $in: retired.map((row) => row._id) } },
+              { session }
+            );
+            if (removed.deletedCount !== retired.length) throw accountingError();
+            await this.tickets.deleteMany(
+              {
+                _id: {
+                  $in: retired.map((row) => ticketId({ namespace: row.namespace, ticketHash: row.ticketHash }))
+                }
+              },
+              { session }
+            );
+          }
+          const entries = capacity.entries - retired.length;
+          if (entries < 0) throw accountingError();
+          if (creating) {
+            if (entries >= this.maxEntries) throw new import_express_oidc_vault3.OidcVaultLogoutNavigationCapacityError();
+            await this.tickets.insertOne(
+              { _id: id, ...creating, expiresAt: new Date(creating.expiresAt) },
+              { session }
+            );
+            await this.capacity.insertOne(
+              {
+                _id: ledgerId(id),
+                kind: "ticket",
+                namespace: identity.namespace,
+                ticketHash: identity.ticketHash,
+                expiresAt: new Date(creating.expiresAt)
+              },
+              { session }
+            );
+          }
+          await this.capacity.updateOne(
+            { _id: CAPACITY },
+            { $set: { entries: entries + (creating ? 1 : 0) } },
+            { session }
+          );
+          const finalNow = ticketNow(this.now());
+          if (creating) assertTicket(creating, finalNow);
+          return !creating && valid && validTicket(record, finalNow) ? record : null;
+        },
+        { readPreference: "primary", readConcern: { level: "snapshot" } }
+      );
+      return result ?? null;
+    } finally {
+      await session.endSession();
+    }
+  }
+  validateConfig(row) {
+    if (!row || !("capacityCollectionName" in row) || row.capacityCollectionName !== this.capacity.collectionName || row.maxEntries !== this.maxEntries)
+      throw accountingError();
+  }
+  validateCapacity(row) {
+    if (!row || row.kind !== "capacity" || row.maxEntries !== this.maxEntries || row.ticketsCollectionName !== this.tickets.collectionName || !Number.isSafeInteger(row.entries) || row.entries < 0 || row.entries > this.maxEntries || !Number.isSafeInteger(row.revision) || row.revision < 0)
+      throw accountingError();
+  }
+  validateLedger(row) {
+    const identity = { namespace: row.namespace, ticketHash: row.ticketHash };
+    if (row.kind !== "ticket" || !validTicketIdentity(identity) || row._id !== ledgerId(ticketId(identity)) || !isDate2(row.expiresAt))
+      throw accountingError();
+  }
+};
+
 // src/store.ts
 var snapshotInput = (input, seen = /* @__PURE__ */ new WeakMap()) => {
   if (input === null || typeof input !== "object") return input;
@@ -415,29 +637,51 @@ var isSameSessionDocumentGeneration = (current, expected) => current._id === exp
 var MongoOidcVaultStore = class {
   constructor(options) {
     const collectionNames = resolveCollectionNames(options);
+    const logoutMaxEntries = ticketLimit(options.logoutNavigationMaxEntries);
     const maxEntries = options.dpopReplayMaxEntries === void 0 ? 1e5 : options.dpopReplayMaxEntries;
     if (!Number.isSafeInteger(maxEntries) || maxEntries <= 0) {
       throw new TypeError("OIDC vault DPoP replay maximum entries must be a positive safe integer.");
     }
     this.db = options.db;
-    this.authorizationTransactions = options.db.collection(
+    this.authorizationTransactions = primaryCollection(
+      this.db,
       collectionNames.authorizationTransactions
     );
-    this.exchangeCodes = options.db.collection(collectionNames.exchangeCodes);
-    this.sessions = options.db.collection(collectionNames.sessions);
-    this.backchannelLogoutTokenJtis = options.db.collection(
+    this.exchangeCodes = primaryCollection(this.db, collectionNames.exchangeCodes);
+    this.sessions = primaryCollection(this.db, collectionNames.sessions);
+    this.backchannelLogoutTokenJtis = primaryCollection(
+      this.db,
       collectionNames.backchannelLogoutTokenJtis
     );
-    this.rotatedSessionAliases = options.db.collection(
+    this.rotatedSessionAliases = primaryCollection(
+      this.db,
       collectionNames.rotatedSessionAliases
     );
-    this.dpopProofs = options.db.collection(collectionNames.dpopProofs);
-    this.dpopReplayCapacity = options.db.collection(collectionNames.dpopReplayCapacity);
+    this.dpopProofs = primaryCollection(this.db, collectionNames.dpopProofs);
+    this.dpopReplayCapacity = primaryCollection(
+      this.db,
+      collectionNames.dpopReplayCapacity
+    );
+    this.logoutNavigationTickets = primaryCollection(
+      this.db,
+      collectionNames.logoutNavigationTickets
+    );
+    this.logoutNavigationCapacity = primaryCollection(
+      this.db,
+      collectionNames.logoutNavigationCapacity
+    );
     this.rotatedSessionAliasRetentionMs = options.rotatedSessionAliasRetentionMs ?? DEFAULT_ROTATED_SESSION_ALIAS_RETENTION_MS;
     if (!Number.isFinite(this.rotatedSessionAliasRetentionMs) || this.rotatedSessionAliasRetentionMs <= 0) {
       throw new TypeError("OIDC vault rotated session alias retention must be a finite positive duration.");
     }
     this.now = options.now ?? (() => Date.now());
+    this.logoutTickets = new MongoLogoutNavigationTickets(
+      this.db,
+      this.logoutNavigationTickets,
+      this.logoutNavigationCapacity,
+      logoutMaxEntries,
+      this.now
+    );
     this.dpopReplay = new MongoDpopReplayReservations(
       this.db,
       this.dpopProofs,
@@ -452,6 +696,18 @@ var MongoOidcVaultStore = class {
   async ready() {
     await this.waitUntilReady();
   }
+  async createLogoutNavigationTicket(input) {
+    const record = captureTicket(input);
+    assertTicket(record);
+    await this.waitUntilReady();
+    await this.logoutTickets.create(record);
+  }
+  async consumeLogoutNavigationTicket(input) {
+    const identity = captureTicketIdentity(input);
+    if (!validTicketIdentity(identity)) return null;
+    await this.waitUntilReady();
+    return this.logoutTickets.consume(identity);
+  }
   async createAuthorizationTransaction(input) {
     input = snapshotInput({ ...input });
     assertRecordBinding(input);
@@ -580,7 +836,7 @@ var MongoOidcVaultStore = class {
           }
           return source ? toRevocationContext(source) : null;
         },
-        { readConcern: { level: "snapshot" } }
+        { readPreference: "primary", readConcern: { level: "snapshot" } }
       ) ?? null;
     } finally {
       await transaction.endSession();
@@ -596,13 +852,13 @@ var MongoOidcVaultStore = class {
     assertSessionBinding(input.nextSession);
     await this.waitUntilReady();
     if (input.nextSession.sessionId === input.sessionId) {
-      throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session rotation target must use a different session ID.");
+      throw new import_express_oidc_vault4.OidcVaultStoreConflictError("OIDC vault session rotation target must use a different session ID.");
     }
     try {
       return await this.rotateSessionWithTransaction(input);
     } catch (error) {
       if (isDuplicateKeyError(error)) {
-        throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session rotation target already exists.");
+        throw new import_express_oidc_vault4.OidcVaultStoreConflictError("OIDC vault session rotation target already exists.");
       }
       throw error;
     }
@@ -703,11 +959,14 @@ var MongoOidcVaultStore = class {
         backchannelLogoutTokenJtis: this.backchannelLogoutTokenJtis,
         rotatedSessionAliases: this.rotatedSessionAliases,
         dpopProofs: this.dpopProofs,
-        dpopReplayCapacity: this.dpopReplayCapacity
+        dpopReplayCapacity: this.dpopReplayCapacity,
+        logoutNavigationTickets: this.logoutNavigationTickets,
+        logoutNavigationCapacity: this.logoutNavigationCapacity
       }),
       assertTransactionSupport(this.db)
     ]);
     await this.dpopReplay.initialize();
+    await this.logoutTickets.initialize();
   }
   async waitUntilReady() {
     await this.initialization;
@@ -720,21 +979,24 @@ var MongoOidcVaultStore = class {
     const expectedSource = sessionToDocument(previous);
     const session = this.db.client.startSession();
     try {
-      await session.withTransaction(async () => {
-        const current = await this.sessions.findOne({ _id: input.sessionId }, { session });
-        if (!current || isExpired(current, this.now())) {
-          throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
-        }
-        if (!isSameSessionDocumentGeneration(current, expectedSource)) {
-          throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session changed before rotation could commit.");
-        }
-        await this.sessions.insertOne(sessionToDocument(nextSession), { session });
-        const deleteResult = await this.sessions.deleteOne({ _id: input.sessionId }, { session });
-        if (deleteResult.deletedCount !== 1) {
-          throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
-        }
-        await this.createRotatedSessionAlias(input.sessionId, nextSession, session);
-      });
+      await session.withTransaction(
+        async () => {
+          const current = await this.sessions.findOne({ _id: input.sessionId }, { session });
+          if (!current || isExpired(current, this.now())) {
+            throw new import_express_oidc_vault4.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
+          }
+          if (!isSameSessionDocumentGeneration(current, expectedSource)) {
+            throw new import_express_oidc_vault4.OidcVaultStoreConflictError("OIDC vault session changed before rotation could commit.");
+          }
+          await this.sessions.insertOne(sessionToDocument(nextSession), { session });
+          const deleteResult = await this.sessions.deleteOne({ _id: input.sessionId }, { session });
+          if (deleteResult.deletedCount !== 1) {
+            throw new import_express_oidc_vault4.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
+          }
+          await this.createRotatedSessionAlias(input.sessionId, nextSession, session);
+        },
+        { readPreference: "primary" }
+      );
       return nextSession;
     } finally {
       await session.endSession();
@@ -761,7 +1023,7 @@ var MongoOidcVaultStore = class {
   async normalizeRotatedSession(input) {
     const previous = await this.getSession(input.sessionId);
     if (!previous) {
-      throw new import_express_oidc_vault3.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
+      throw new import_express_oidc_vault4.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
     }
     inheritSessionBinding(previous, input.nextSession);
     return {
@@ -818,7 +1080,7 @@ var MongoOidcVaultStore = class {
             await this.rotatedSessionAliases.deleteMany({ logicalSessionId: { $in: inactiveIds } }, { session });
           }
         },
-        { readConcern: { level: "snapshot" } }
+        { readPreference: "primary", readConcern: { level: "snapshot" } }
       );
     } finally {
       await session.endSession();

package/index.mjs

@@ -1,6 +1,6 @@
 // src/store.ts
 import {
-  OidcVaultStoreConflictError as OidcVaultStoreConflictError2
+  OidcVaultStoreConflictError as OidcVaultStoreConflictError3
 } from "@web-ts-toolkit/express-oidc-vault";
 import { isDeepStrictEqual } from "util";
 
@@ -162,7 +162,9 @@ var DEFAULT_COLLECTION_NAMES = {
   backchannelLogoutTokenJtis: "oidc_vault_backchannel_logout_token_jtis",
   rotatedSessionAliases: "oidc_vault_rotated_session_aliases",
   dpopProofs: "oidc_vault_dpop_proofs",
-  dpopReplayCapacity: "oidc_vault_dpop_replay_capacity"
+  dpopReplayCapacity: "oidc_vault_dpop_replay_capacity",
+  logoutNavigationTickets: "oidc_vault_logout_navigation_tickets",
+  logoutNavigationCapacity: "oidc_vault_logout_navigation_capacity"
 };
 var validateCollectionName = (role, name) => {
   if (name.length === 0) {
@@ -186,7 +188,9 @@ var resolveCollectionNames = (options) => {
     backchannelLogoutTokenJtis: options.backchannelLogoutTokenJtisCollectionName ?? DEFAULT_COLLECTION_NAMES.backchannelLogoutTokenJtis,
     rotatedSessionAliases: options.rotatedSessionAliasesCollectionName ?? DEFAULT_COLLECTION_NAMES.rotatedSessionAliases,
     dpopProofs: options.dpopProofsCollectionName ?? DEFAULT_COLLECTION_NAMES.dpopProofs,
-    dpopReplayCapacity: options.dpopReplayCapacityCollectionName ?? DEFAULT_COLLECTION_NAMES.dpopReplayCapacity
+    dpopReplayCapacity: options.dpopReplayCapacityCollectionName ?? DEFAULT_COLLECTION_NAMES.dpopReplayCapacity,
+    logoutNavigationTickets: options.logoutNavigationTicketsCollectionName ?? DEFAULT_COLLECTION_NAMES.logoutNavigationTickets,
+    logoutNavigationCapacity: options.logoutNavigationCapacityCollectionName ?? DEFAULT_COLLECTION_NAMES.logoutNavigationCapacity
   };
   for (const [role, name] of Object.entries(collectionNames)) {
     validateCollectionName(role, name);
@@ -229,6 +233,11 @@ var ensureStoreIndexes = async (collections) => {
     createTtlIndex(collections.backchannelLogoutTokenJtis),
     createTtlIndex(collections.rotatedSessionAliases),
     createTtlIndex(collections.dpopProofs),
+    createTtlIndex(collections.logoutNavigationTickets),
+    collections.logoutNavigationCapacity.createIndex(
+      { kind: 1, expiresAt: 1 },
+      { name: "logout_navigation_expiry_accounting_idx" }
+    ),
     // Accounting outlives physical proof TTL deletion until a serialized
     // bounded cleanup decrements capacity. Never TTL-delete these entries.
     collections.dpopReplayCapacity.createIndex({ kind: 1, expiresAt: 1 }, { name: "dpop_expiry_accounting_idx" }),
@@ -336,7 +345,7 @@ var MongoDpopReplayReservations = class {
           await this.capacity.updateOne({ _id: CAPACITY_ID }, { $set: { entries: entries + 1 } }, { session });
           return true;
         },
-        { readConcern: { level: "snapshot" } }
+        { readPreference: "primary", readConcern: { level: "snapshot" } }
       );
       return result === true;
     } finally {
@@ -359,6 +368,222 @@ var MongoDpopReplayReservations = class {
   }
 };
 
+// src/read-policy.ts
+var primaryCollection = (db, name) => db.collection(name, { readPreference: "primary" });
+
+// src/logout-tickets.ts
+import {
+  OidcVaultLogoutNavigationCapacityError,
+  OidcVaultStoreConflictError as OidcVaultStoreConflictError2
+} from "@web-ts-toolkit/express-oidc-vault";
+
+// src/logout-ticket-validation.ts
+var HASH = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+var PREFIX = "logout-navigation:v1:";
+var UNSAFE_URL = /[\s\\\u0000-\u001f\u007f-\u009f]/u;
+var usableEpoch = (value) => typeof value === "number" && Number.isSafeInteger(value) && Math.abs(value) <= 864e13;
+var ticketNow = (now) => {
+  if (!usableEpoch(now)) throw new Error("OIDC vault logout navigation store clock is invalid.");
+  return now;
+};
+var captureTicketIdentity = (input) => ({
+  namespace: input?.namespace,
+  ticketHash: input?.ticketHash
+});
+var validTicketIdentity = (input) => typeof input.namespace === "string" && input.namespace.startsWith(PREFIX) && HASH.test(input.namespace.slice(PREFIX.length)) && typeof input.ticketHash === "string" && HASH.test(input.ticketHash);
+var captureTicket = (input) => ({
+  ...captureTicketIdentity(input),
+  upstreamLogoutUrl: input?.upstreamLogoutUrl,
+  createdAt: input?.createdAt,
+  expiresAt: input?.expiresAt
+});
+var validTicket = (record, now) => {
+  if (!record || typeof record !== "object" || Array.isArray(record) || Object.keys(record).length !== 5 || !validTicketIdentity(record) || !usableEpoch(record.createdAt) || !usableEpoch(record.expiresAt) || record.expiresAt - record.createdAt < 1e3 || record.expiresAt - record.createdAt > 12e4 || now !== void 0 && (record.expiresAt <= now || record.expiresAt - now > 12e4) || typeof record.upstreamLogoutUrl !== "string" || !/^https?:\/\//i.test(record.upstreamLogoutUrl) || /^https?:\/\/[^/?#]*@/i.test(record.upstreamLogoutUrl) || UNSAFE_URL.test(record.upstreamLogoutUrl) || Buffer.byteLength(record.upstreamLogoutUrl, "utf8") > 16384)
+    return false;
+  try {
+    const url = new URL(record.upstreamLogoutUrl);
+    return (url.protocol === "https:" || url.protocol === "http:") && !url.username && !url.password && !url.hash && !record.upstreamLogoutUrl.includes("#") && Buffer.byteLength(url.href, "utf8") <= 16384;
+  } catch {
+    return false;
+  }
+};
+var assertTicket = (record, now) => {
+  if (!validTicket(record, now)) throw new TypeError("OIDC vault logout navigation ticket is invalid or expired.");
+};
+var ticketLimit = (value) => {
+  const max = value === void 0 ? 1e4 : value;
+  if (!Number.isSafeInteger(max) || max <= 0)
+    throw new TypeError("OIDC vault logoutNavigationMaxEntries must be a positive safe integer.");
+  return max;
+};
+var ticketId = ({ namespace, ticketHash }) => `${namespace}:${ticketHash}`;
+
+// src/logout-tickets.ts
+var CONFIG = "configuration";
+var CAPACITY = "capacity";
+var ledgerId = (id) => `ticket:${id}`;
+var accountingError = () => new Error("OIDC vault MongoDB logout navigation configuration/accounting is inconsistent.");
+var isDate2 = (date) => date instanceof Date && usableEpoch(date.getTime());
+var MongoLogoutNavigationTickets = class {
+  constructor(db, tickets, capacity, maxEntries, now) {
+    this.db = db;
+    this.tickets = tickets;
+    this.capacity = capacity;
+    this.maxEntries = maxEntries;
+    this.now = now;
+  }
+  async initialize() {
+    if ((await this.capacity.listIndexes().toArray()).some((index) => index.expireAfterSeconds !== void 0))
+      throw new Error("OIDC vault MongoDB logout navigation capacity accounting must not have TTL indexes.");
+    for (const initialize of [
+      () => this.tickets.updateOne(
+        { _id: CONFIG },
+        { $setOnInsert: { capacityCollectionName: this.capacity.collectionName, maxEntries: this.maxEntries } },
+        { upsert: true }
+      ),
+      () => this.capacity.updateOne(
+        { _id: CAPACITY },
+        {
+          $setOnInsert: {
+            kind: "capacity",
+            ticketsCollectionName: this.tickets.collectionName,
+            maxEntries: this.maxEntries,
+            entries: 0,
+            revision: 0
+          }
+        },
+        { upsert: true }
+      )
+    ]) {
+      try {
+        await initialize();
+      } catch (error) {
+        if (!(typeof error === "object" && error !== null && "code" in error && error.code === 11e3)) throw error;
+      }
+    }
+    this.validateConfig(await this.tickets.findOne({ _id: CONFIG }));
+    this.validateCapacity(await this.capacity.findOne({ _id: CAPACITY }));
+  }
+  create(record) {
+    assertTicket(record, ticketNow(this.now()));
+    return this.perform(record, record).then(() => void 0);
+  }
+  consume(identity) {
+    return this.perform(identity);
+  }
+  async perform(identity, creating) {
+    const id = ticketId(identity);
+    const session = this.db.client.startSession();
+    try {
+      const result = await session.withTransaction(
+        async () => {
+          const capacity = await this.capacity.findOneAndUpdate(
+            { _id: CAPACITY },
+            { $inc: { revision: 1 } },
+            { session, returnDocument: "after" }
+          );
+          this.validateCapacity(capacity);
+          this.validateConfig(await this.tickets.findOne({ _id: CONFIG }, { session }));
+          if (await this.capacity.countDocuments({ _id: { $ne: CAPACITY } }, { session }) !== capacity.entries)
+            throw accountingError();
+          const now = ticketNow(this.now());
+          if (creating) assertTicket(creating, now);
+          const payload = await this.tickets.findOne({ _id: id }, { session });
+          const selected = await this.capacity.findOne({ _id: ledgerId(id) }, { session });
+          if (selected) this.validateLedger(selected);
+          if (payload && !selected) throw accountingError();
+          const record = payload && "expiresAt" in payload && isDate2(payload.expiresAt) && Object.keys(payload).length === 6 ? {
+            namespace: payload.namespace,
+            ticketHash: payload.ticketHash,
+            upstreamLogoutUrl: payload.upstreamLogoutUrl,
+            createdAt: payload.createdAt,
+            expiresAt: payload.expiresAt.getTime()
+          } : null;
+          const valid = record && validTicket(record, now) && ticketId(record) === id;
+          if (valid && selected.expiresAt.getTime() !== record.expiresAt) throw accountingError();
+          if (creating && selected && selected.expiresAt.getTime() > now && (!payload || valid))
+            throw new OidcVaultStoreConflictError2();
+          const expired = await this.capacity.find({ kind: "ticket", _id: { $ne: ledgerId(id) }, expiresAt: { $lte: new Date(now) } }, { session }).sort({ expiresAt: 1 }).limit(64).toArray();
+          for (const row of expired) this.validateLedger(row);
+          if (expired.length) {
+            const payloads = await this.tickets.find(
+              {
+                _id: {
+                  $in: expired.map((row) => ticketId({ namespace: row.namespace, ticketHash: row.ticketHash }))
+                }
+              },
+              { session }
+            ).toArray();
+            for (const payload2 of payloads)
+              if ("expiresAt" in payload2 && isDate2(payload2.expiresAt) && payload2.expiresAt.getTime() > now)
+                throw accountingError();
+          }
+          const retired = [...expired, ...selected ? [selected] : []];
+          if (retired.length) {
+            const removed = await this.capacity.deleteMany(
+              { _id: { $in: retired.map((row) => row._id) } },
+              { session }
+            );
+            if (removed.deletedCount !== retired.length) throw accountingError();
+            await this.tickets.deleteMany(
+              {
+                _id: {
+                  $in: retired.map((row) => ticketId({ namespace: row.namespace, ticketHash: row.ticketHash }))
+                }
+              },
+              { session }
+            );
+          }
+          const entries = capacity.entries - retired.length;
+          if (entries < 0) throw accountingError();
+          if (creating) {
+            if (entries >= this.maxEntries) throw new OidcVaultLogoutNavigationCapacityError();
+            await this.tickets.insertOne(
+              { _id: id, ...creating, expiresAt: new Date(creating.expiresAt) },
+              { session }
+            );
+            await this.capacity.insertOne(
+              {
+                _id: ledgerId(id),
+                kind: "ticket",
+                namespace: identity.namespace,
+                ticketHash: identity.ticketHash,
+                expiresAt: new Date(creating.expiresAt)
+              },
+              { session }
+            );
+          }
+          await this.capacity.updateOne(
+            { _id: CAPACITY },
+            { $set: { entries: entries + (creating ? 1 : 0) } },
+            { session }
+          );
+          const finalNow = ticketNow(this.now());
+          if (creating) assertTicket(creating, finalNow);
+          return !creating && valid && validTicket(record, finalNow) ? record : null;
+        },
+        { readPreference: "primary", readConcern: { level: "snapshot" } }
+      );
+      return result ?? null;
+    } finally {
+      await session.endSession();
+    }
+  }
+  validateConfig(row) {
+    if (!row || !("capacityCollectionName" in row) || row.capacityCollectionName !== this.capacity.collectionName || row.maxEntries !== this.maxEntries)
+      throw accountingError();
+  }
+  validateCapacity(row) {
+    if (!row || row.kind !== "capacity" || row.maxEntries !== this.maxEntries || row.ticketsCollectionName !== this.tickets.collectionName || !Number.isSafeInteger(row.entries) || row.entries < 0 || row.entries > this.maxEntries || !Number.isSafeInteger(row.revision) || row.revision < 0)
+      throw accountingError();
+  }
+  validateLedger(row) {
+    const identity = { namespace: row.namespace, ticketHash: row.ticketHash };
+    if (row.kind !== "ticket" || !validTicketIdentity(identity) || row._id !== ledgerId(ticketId(identity)) || !isDate2(row.expiresAt))
+      throw accountingError();
+  }
+};
+
 // src/store.ts
 var snapshotInput = (input, seen = /* @__PURE__ */ new WeakMap()) => {
   if (input === null || typeof input !== "object") return input;
@@ -390,29 +615,51 @@ var isSameSessionDocumentGeneration = (current, expected) => current._id === exp
 var MongoOidcVaultStore = class {
   constructor(options) {
     const collectionNames = resolveCollectionNames(options);
+    const logoutMaxEntries = ticketLimit(options.logoutNavigationMaxEntries);
     const maxEntries = options.dpopReplayMaxEntries === void 0 ? 1e5 : options.dpopReplayMaxEntries;
     if (!Number.isSafeInteger(maxEntries) || maxEntries <= 0) {
       throw new TypeError("OIDC vault DPoP replay maximum entries must be a positive safe integer.");
     }
     this.db = options.db;
-    this.authorizationTransactions = options.db.collection(
+    this.authorizationTransactions = primaryCollection(
+      this.db,
       collectionNames.authorizationTransactions
     );
-    this.exchangeCodes = options.db.collection(collectionNames.exchangeCodes);
-    this.sessions = options.db.collection(collectionNames.sessions);
-    this.backchannelLogoutTokenJtis = options.db.collection(
+    this.exchangeCodes = primaryCollection(this.db, collectionNames.exchangeCodes);
+    this.sessions = primaryCollection(this.db, collectionNames.sessions);
+    this.backchannelLogoutTokenJtis = primaryCollection(
+      this.db,
       collectionNames.backchannelLogoutTokenJtis
     );
-    this.rotatedSessionAliases = options.db.collection(
+    this.rotatedSessionAliases = primaryCollection(
+      this.db,
       collectionNames.rotatedSessionAliases
     );
-    this.dpopProofs = options.db.collection(collectionNames.dpopProofs);
-    this.dpopReplayCapacity = options.db.collection(collectionNames.dpopReplayCapacity);
+    this.dpopProofs = primaryCollection(this.db, collectionNames.dpopProofs);
+    this.dpopReplayCapacity = primaryCollection(
+      this.db,
+      collectionNames.dpopReplayCapacity
+    );
+    this.logoutNavigationTickets = primaryCollection(
+      this.db,
+      collectionNames.logoutNavigationTickets
+    );
+    this.logoutNavigationCapacity = primaryCollection(
+      this.db,
+      collectionNames.logoutNavigationCapacity
+    );
     this.rotatedSessionAliasRetentionMs = options.rotatedSessionAliasRetentionMs ?? DEFAULT_ROTATED_SESSION_ALIAS_RETENTION_MS;
     if (!Number.isFinite(this.rotatedSessionAliasRetentionMs) || this.rotatedSessionAliasRetentionMs <= 0) {
       throw new TypeError("OIDC vault rotated session alias retention must be a finite positive duration.");
     }
     this.now = options.now ?? (() => Date.now());
+    this.logoutTickets = new MongoLogoutNavigationTickets(
+      this.db,
+      this.logoutNavigationTickets,
+      this.logoutNavigationCapacity,
+      logoutMaxEntries,
+      this.now
+    );
     this.dpopReplay = new MongoDpopReplayReservations(
       this.db,
       this.dpopProofs,
@@ -427,6 +674,18 @@ var MongoOidcVaultStore = class {
   async ready() {
     await this.waitUntilReady();
   }
+  async createLogoutNavigationTicket(input) {
+    const record = captureTicket(input);
+    assertTicket(record);
+    await this.waitUntilReady();
+    await this.logoutTickets.create(record);
+  }
+  async consumeLogoutNavigationTicket(input) {
+    const identity = captureTicketIdentity(input);
+    if (!validTicketIdentity(identity)) return null;
+    await this.waitUntilReady();
+    return this.logoutTickets.consume(identity);
+  }
   async createAuthorizationTransaction(input) {
     input = snapshotInput({ ...input });
     assertRecordBinding(input);
@@ -555,7 +814,7 @@ var MongoOidcVaultStore = class {
           }
           return source ? toRevocationContext(source) : null;
         },
-        { readConcern: { level: "snapshot" } }
+        { readPreference: "primary", readConcern: { level: "snapshot" } }
       ) ?? null;
     } finally {
       await transaction.endSession();
@@ -571,13 +830,13 @@ var MongoOidcVaultStore = class {
     assertSessionBinding(input.nextSession);
     await this.waitUntilReady();
     if (input.nextSession.sessionId === input.sessionId) {
-      throw new OidcVaultStoreConflictError2("OIDC vault session rotation target must use a different session ID.");
+      throw new OidcVaultStoreConflictError3("OIDC vault session rotation target must use a different session ID.");
     }
     try {
       return await this.rotateSessionWithTransaction(input);
     } catch (error) {
       if (isDuplicateKeyError(error)) {
-        throw new OidcVaultStoreConflictError2("OIDC vault session rotation target already exists.");
+        throw new OidcVaultStoreConflictError3("OIDC vault session rotation target already exists.");
       }
       throw error;
     }
@@ -678,11 +937,14 @@ var MongoOidcVaultStore = class {
         backchannelLogoutTokenJtis: this.backchannelLogoutTokenJtis,
         rotatedSessionAliases: this.rotatedSessionAliases,
         dpopProofs: this.dpopProofs,
-        dpopReplayCapacity: this.dpopReplayCapacity
+        dpopReplayCapacity: this.dpopReplayCapacity,
+        logoutNavigationTickets: this.logoutNavigationTickets,
+        logoutNavigationCapacity: this.logoutNavigationCapacity
       }),
       assertTransactionSupport(this.db)
     ]);
     await this.dpopReplay.initialize();
+    await this.logoutTickets.initialize();
   }
   async waitUntilReady() {
     await this.initialization;
@@ -695,21 +957,24 @@ var MongoOidcVaultStore = class {
     const expectedSource = sessionToDocument(previous);
     const session = this.db.client.startSession();
     try {
-      await session.withTransaction(async () => {
-        const current = await this.sessions.findOne({ _id: input.sessionId }, { session });
-        if (!current || isExpired(current, this.now())) {
-          throw new OidcVaultStoreConflictError2("OIDC vault session no longer exists for rotation.");
-        }
-        if (!isSameSessionDocumentGeneration(current, expectedSource)) {
-          throw new OidcVaultStoreConflictError2("OIDC vault session changed before rotation could commit.");
-        }
-        await this.sessions.insertOne(sessionToDocument(nextSession), { session });
-        const deleteResult = await this.sessions.deleteOne({ _id: input.sessionId }, { session });
-        if (deleteResult.deletedCount !== 1) {
-          throw new OidcVaultStoreConflictError2("OIDC vault session no longer exists for rotation.");
-        }
-        await this.createRotatedSessionAlias(input.sessionId, nextSession, session);
-      });
+      await session.withTransaction(
+        async () => {
+          const current = await this.sessions.findOne({ _id: input.sessionId }, { session });
+          if (!current || isExpired(current, this.now())) {
+            throw new OidcVaultStoreConflictError3("OIDC vault session no longer exists for rotation.");
+          }
+          if (!isSameSessionDocumentGeneration(current, expectedSource)) {
+            throw new OidcVaultStoreConflictError3("OIDC vault session changed before rotation could commit.");
+          }
+          await this.sessions.insertOne(sessionToDocument(nextSession), { session });
+          const deleteResult = await this.sessions.deleteOne({ _id: input.sessionId }, { session });
+          if (deleteResult.deletedCount !== 1) {
+            throw new OidcVaultStoreConflictError3("OIDC vault session no longer exists for rotation.");
+          }
+          await this.createRotatedSessionAlias(input.sessionId, nextSession, session);
+        },
+        { readPreference: "primary" }
+      );
       return nextSession;
     } finally {
       await session.endSession();
@@ -736,7 +1001,7 @@ var MongoOidcVaultStore = class {
   async normalizeRotatedSession(input) {
     const previous = await this.getSession(input.sessionId);
     if (!previous) {
-      throw new OidcVaultStoreConflictError2("OIDC vault session no longer exists for rotation.");
+      throw new OidcVaultStoreConflictError3("OIDC vault session no longer exists for rotation.");
     }
     inheritSessionBinding(previous, input.nextSession);
     return {
@@ -793,7 +1058,7 @@ var MongoOidcVaultStore = class {
             await this.rotatedSessionAliases.deleteMany({ logicalSessionId: { $in: inactiveIds } }, { session });
           }
         },
-        { readConcern: { level: "snapshot" } }
+        { readPreference: "primary", readConcern: { level: "snapshot" } }
       );
     } finally {
       await session.endSession();

package/package.json

@@ -2,7 +2,7 @@
   "name": "@web-ts-toolkit/express-oidc-vault-mongodb-store",
   "description": "MongoDB store provider for @web-ts-toolkit/express-oidc-vault",
   "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/express-oidc-vault-mongodb-store",
-  "version": "0.53.0",
+  "version": "0.54.0",
   "sideEffects": false,
   "keywords": [
     "express",
@@ -29,7 +29,7 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "@web-ts-toolkit/express-oidc-vault": "0.53.0",
+    "@web-ts-toolkit/express-oidc-vault": "0.54.0",
     "mongodb": "^6.20.0"
   },
   "files": [