@web-ts-toolkit/express-oidc-vault-redis-store 0.43.0 → 0.48.0

package/index.mjs

@@ -1,6 +1,7 @@
 // src/index.ts
 import {
-  OidcVaultStoreConflictError
+  OidcVaultStoreConflictError,
+  OidcVaultDpopReplayCapacityError
 } from "@web-ts-toolkit/express-oidc-vault";
 
 // src/keys.ts
@@ -44,6 +45,9 @@ var RedisOidcVaultStoreKeys = class {
   backchannelLogoutTokenJti(jti) {
     return prefixKey(this.keyPrefix, "backchannel-logout-jti", jti);
   }
+  dpopProofs() {
+    return `${this.keyPrefix}:dpop-proofs`;
+  }
   rotatedSessionAliasIndex(logicalSessionId) {
     return prefixKey(this.keyPrefix, "rotated-session-alias-index", logicalSessionId);
   }
@@ -71,14 +75,27 @@ var OidcVaultRedisStoreRecordError = class extends Error {
 };
 var isPlainRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isString = (value) => typeof value === "string";
+var isBindingHash = (value) => typeof value === "string" && value.length === 43 && /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/.test(value);
+var validateDpopBinding = (value) => isPlainRecord(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null) && Object.keys(value).length === 2 && Object.hasOwn(value, "type") && Object.hasOwn(value, "jkt") && value.type === "dpop" && isBindingHash(value.jkt);
+var validateRecordBinding = (record) => (record.deviceBinding === void 0 || validateDpopBinding(record.deviceBinding)) && (record.browserBindingHash === void 0 || isBindingHash(record.browserBindingHash)) && (record.deviceBinding === void 0 || record.browserBindingHash !== void 0);
+var validateBindingMatch = (value) => isPlainRecord(value) && Object.hasOwn(value, "deviceBinding") && Object.hasOwn(value, "browserBindingHash") && (value.deviceBinding === null || validateDpopBinding(value.deviceBinding)) && (value.browserBindingHash === null || isBindingHash(value.browserBindingHash));
+var assertRecordBinding = (record) => {
+  if (!validateRecordBinding(record))
+    throw new TypeError("OIDC vault store record has invalid device/browser binding.");
+};
+var assertSessionBinding = (record) => {
+  if (record.deviceBinding !== void 0 && !validateDpopBinding(record.deviceBinding)) {
+    throw new TypeError("OIDC vault store session has invalid device binding.");
+  }
+};
 var isOptionalString = (value) => value === void 0 || isString(value);
 var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);
 var isOptionalFiniteNumber = (value) => value === void 0 || isFiniteNumber(value);
 var isStringRecord = (value) => isPlainRecord(value);
-var validateAuthorizationTransaction = (value) => isPlainRecord(value) && isString(value.state) && isString(value.nonce) && isString(value.pkceVerifier) && isString(value.codeChallenge) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt) && (value.metadata === void 0 || isStringRecord(value.metadata));
-var validateExchangeCodeRecord = (value) => isPlainRecord(value) && isString(value.code) && isString(value.sessionId) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt);
+var validateAuthorizationTransaction = (value, state) => isPlainRecord(value) && isString(value.state) && value.state === state && isString(value.nonce) && isString(value.pkceVerifier) && isString(value.codeChallenge) && validateRecordBinding(value) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt) && (value.metadata === void 0 || isStringRecord(value.metadata));
+var validateExchangeCodeRecord = (value, code) => isPlainRecord(value) && isString(value.code) && value.code === code && isString(value.sessionId) && validateRecordBinding(value) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt);
 var validateProviderMetadata = (value) => value === void 0 || isPlainRecord(value) && isOptionalString(value.issuer) && isOptionalString(value.clientId);
-var validateSession = (value) => isPlainRecord(value) && isString(value.sessionId) && isOptionalString(value.logicalSessionId) && isString(value.subject) && isOptionalString(value.providerSessionId) && validateProviderMetadata(value.provider) && isString(value.refreshToken) && isString(value.idToken) && isOptionalString(value.accessToken) && isOptionalString(value.scope) && isOptionalFiniteNumber(value.expiresAt) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.updatedAt) && (value.user === void 0 || isPlainRecord(value.user)) && (value.metadata === void 0 || isPlainRecord(value.metadata));
+var validateSession = (value, sessionId) => isPlainRecord(value) && isString(value.sessionId) && value.sessionId === sessionId && isOptionalString(value.logicalSessionId) && isString(value.subject) && isOptionalString(value.providerSessionId) && validateProviderMetadata(value.provider) && (value.deviceBinding === void 0 || validateDpopBinding(value.deviceBinding)) && isString(value.refreshToken) && isString(value.idToken) && isOptionalString(value.accessToken) && isOptionalString(value.scope) && isOptionalFiniteNumber(value.expiresAt) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.updatedAt) && (value.user === void 0 || isPlainRecord(value.user)) && (value.metadata === void 0 || isPlainRecord(value.metadata));
 var parseStoredJson = (value, recordKind, validate) => {
   if (value === null) {
     return null;
@@ -107,6 +124,228 @@ var evalCommand = (script, keys, args) => [
   ...keys,
   ...args
 ];
+var BINDING_VALIDATION_HELPER = `
+local function isHash(value)
+  return type(value) == 'string' and #value == 43
+    and string.match(value, '^[A-Za-z0-9_-]+$') ~= nil
+    and string.match(string.sub(value, 43), '^[AEIMQUYcgkosw048]$') ~= nil
+end
+local function isBinding(value)
+  if type(value) ~= 'table' or value['type'] ~= 'dpop' or not isHash(value['jkt']) then return false end
+  local count = 0
+  for key, _ in pairs(value) do
+    if key ~= 'type' and key ~= 'jkt' then return false end
+    count = count + 1
+  end
+  return count == 2
+end
+local function validBinding(value)
+  return value == nil or isBinding(value)
+end
+local function validRecordBinding(record)
+  return validBinding(record['deviceBinding'])
+    and (record['browserBindingHash'] == nil or isHash(record['browserBindingHash']))
+    and (record['deviceBinding'] == nil or record['browserBindingHash'] ~= nil)
+end
+local function sameBinding(left, right)
+  if left == nil or right == nil then return left == right end
+  return isBinding(left) and isBinding(right) and left['jkt'] == right['jkt']
+end
+local function optionalString(value)
+  return value == nil or type(value) == 'string'
+end
+local function finiteNumber(value)
+  return type(value) == 'number' and value == value and value > -math.huge and value < math.huge
+end
+local function serverNow()
+  local time = redis.call('TIME')
+  return tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+end
+-- cjson decodes both {} and [] to a Lua table. Inspect the top-level value's
+-- lexical kind so an empty provider array cannot masquerade as legacy {}.
+-- Skip strings/escapes and nested containers; duplicate keys use the last
+-- occurrence, matching cjson/JSON.parse. No credential values are returned.
+local function optionalObjectField(raw, wanted)
+  local depth, position, shape = 0, 1, nil
+  while position <= #raw do
+    local char = string.sub(raw, position, position)
+    if char == '"' then
+      local start = position
+      position = position + 1
+      while position <= #raw do
+        local current = string.sub(raw, position, position)
+        if current == '\\\\' then position = position + 2
+        elseif current == '"' then break
+        else position = position + 1 end
+      end
+      if depth == 1 then
+        local after = position + 1
+        while string.match(string.sub(raw, after, after), '%s') do after = after + 1 end
+        if string.sub(raw, after, after) == ':' and cjson.decode(string.sub(raw, start, position)) == wanted then
+          after = after + 1
+          while string.match(string.sub(raw, after, after), '%s') do after = after + 1 end
+          shape = string.sub(raw, after, after)
+        end
+      end
+    elseif char == '{' or char == '[' then depth = depth + 1
+    elseif char == '}' or char == ']' then depth = depth - 1 end
+    position = position + 1
+  end
+  return shape == nil or shape == '{'
+end
+`;
+var CONSUME_GUARDED_RECORD_SCRIPT = `
+${BINDING_VALIDATION_HELPER}
+local raw = redis.call('GET', KEYS[1])
+if raw == false then return false end
+local ok, record = pcall(cjson.decode, raw)
+local kind = ARGV[1]
+local valid = ok and type(record) == 'table' and validRecordBinding(record)
+if valid then
+  valid = optionalString(record['returnTo']) and finiteNumber(record['createdAt']) and finiteNumber(record['expiresAt'])
+  if kind == 'transaction' then
+    valid = valid and record['state'] == ARGV[2] and type(record['nonce']) == 'string'
+      and type(record['pkceVerifier']) == 'string' and type(record['codeChallenge']) == 'string'
+      and (record['metadata'] == nil or type(record['metadata']) == 'table')
+  else
+    valid = valid and record['code'] == ARGV[2] and type(record['sessionId']) == 'string'
+  end
+end
+if not valid then
+  redis.call('DEL', KEYS[1])
+  return false
+end
+-- Legacy consumes preserve the historical Redis key-TTL policy. Guarded
+-- consumes additionally check payload expiry with server time (D5).
+if ARGV[3] ~= 'legacy' and record['expiresAt'] <= serverNow() then
+  redis.call('DEL', KEYS[1])
+  return false
+end
+if ARGV[3] == 'legacy' then
+  if record['deviceBinding'] ~= nil or record['browserBindingHash'] ~= nil then return false end
+else
+  local match = cjson.decode(ARGV[4])
+  if (match['deviceBinding'] ~= cjson.null and not isBinding(match['deviceBinding']))
+    or (match['browserBindingHash'] ~= cjson.null and not isHash(match['browserBindingHash'])) then return false end
+  if match['deviceBinding'] == cjson.null then
+    if record['deviceBinding'] ~= nil then return false end
+  elseif not sameBinding(record['deviceBinding'], match['deviceBinding']) then return false end
+  if match['browserBindingHash'] == cjson.null then
+    if record['browserBindingHash'] ~= nil then return false end
+  elseif record['browserBindingHash'] ~= match['browserBindingHash'] then return false end
+  if kind == 'exchange' and record['sessionId'] ~= ARGV[5] then return false end
+end
+redis.call('DEL', KEYS[1])
+return raw
+`;
+var buildConsumeGuardedRecordCommand = (key, kind, id, match, expectedSessionId) => evalCommand(
+  CONSUME_GUARDED_RECORD_SCRIPT,
+  [key],
+  [
+    kind,
+    id,
+    match === void 0 ? "legacy" : "guarded",
+    match === void 0 ? "" : serialize(match),
+    expectedSessionId ?? ""
+  ]
+);
+var RESERVE_DPOP_PROOF_SCRIPT = `
+${BINDING_VALIDATION_HELPER}
+local expiresAt = tonumber(ARGV[2])
+local now = serverNow()
+if not finiteNumber(expiresAt) or expiresAt ~= math.floor(expiresAt) or expiresAt > 9007199254740991
+  or expiresAt <= now or expiresAt - now > 360000 then return 0 end
+local keyType = redis.call('TYPE', KEYS[1])['ok']
+if keyType ~= 'none' and keyType ~= 'zset' then error('OIDC vault Redis replay key has unexpected type') end
+local existing = redis.call('ZSCORE', KEYS[1], ARGV[1])
+if existing ~= false and tonumber(existing) > now then return 0 end
+-- Hard LIMIT, not SCAN's hint: at most 64 expired entries per admission.
+local expired = redis.call('ZRANGEBYSCORE', KEYS[1], '-inf', now, 'LIMIT', 0, 64)
+if #expired > 0 then redis.call('ZREM', KEYS[1], unpack(expired)) end
+if existing ~= false then redis.call('ZREM', KEYS[1], ARGV[1]) end
+if redis.call('ZCARD', KEYS[1]) >= tonumber(ARGV[3]) then return 2 end
+redis.call('ZADD', KEYS[1], expiresAt, ARGV[1])
+-- Reclaim the whole set if traffic stops after its last retained expiry.
+local last = redis.call('ZREVRANGE', KEYS[1], 0, 0, 'WITHSCORES')
+redis.call('PEXPIREAT', KEYS[1], last[2])
+return 1
+`;
+var buildReserveDpopProofCommand = (keys, input, maxEntries) => evalCommand(
+  RESERVE_DPOP_PROOF_SCRIPT,
+  [keys.dpopProofs()],
+  [input.replayKey, String(input.expiresAt), String(maxEntries)]
+);
+var SESSION_REVOCATION_CONTEXT_SCRIPT = `
+${BINDING_VALIDATION_HELPER}
+local now = serverNow()
+local handle = ARGV[1]
+local sessionPrefix = ARGV[2]
+local logicalPrefix = ARGV[3]
+local function authority(raw, id)
+  local ok, record = pcall(cjson.decode, raw)
+  if not ok or type(record) ~= 'table' or record['sessionId'] ~= id
+    or not optionalString(record['logicalSessionId']) or type(record['subject']) ~= 'string'
+    or not validBinding(record['deviceBinding']) then error('OIDC vault Redis lineage has malformed session authority') end
+  local provider = record['provider']
+  if not optionalObjectField(raw, 'provider') or (provider ~= nil and (type(provider) ~= 'table' or not optionalString(provider['issuer'])
+    or not optionalString(provider['clientId']))) then error('OIDC vault Redis lineage has malformed provider identity') end
+  local expiry = record['expiresAt']
+  if expiry ~= nil and not finiteNumber(expiry) then error('OIDC vault Redis lineage has malformed session expiry') end
+  if expiry ~= nil and expiry <= now then return nil end
+  return record
+end
+local logicalId = nil
+local source = nil
+local primary = redis.call('GET', KEYS[1])
+if primary ~= false then
+  local record = authority(primary, handle)
+  if record ~= nil then
+    logicalId = record['logicalSessionId'] or handle
+    -- The directly observed live handle must participate even if its reverse
+    -- index membership was corrupted; never infer unboundness from peers alone.
+    source = record
+  end
+end
+if logicalId == nil then
+  local alias = redis.call('GET', KEYS[2])
+  if alias == false then return false end
+  local ok, decoded = pcall(cjson.decode, alias)
+  if not ok or type(decoded) ~= 'string' then error('OIDC vault Redis store has malformed revocation alias') end
+  logicalId = decoded
+end
+local members = redis.call('ZRANGE', logicalPrefix .. logicalId, 0, -1)
+for _, id in ipairs(members) do
+  local raw = redis.call('GET', sessionPrefix .. id)
+  if raw ~= false then
+    local member = authority(raw, id)
+    if member ~= nil and (member['logicalSessionId'] or id) == logicalId then
+      if source ~= nil then
+        local left = source['provider'] or {}
+        local right = member['provider'] or {}
+        if not sameBinding(source['deviceBinding'], member['deviceBinding']) or source['subject'] ~= member['subject']
+          or left['issuer'] ~= right['issuer'] or left['clientId'] ~= right['clientId'] then
+          error('OIDC vault Redis lineage has inconsistent device binding or provider identity')
+        end
+      else source = member end
+    end
+  end
+end
+if source == nil then return false end
+local result = { logicalSessionId = logicalId }
+if source['deviceBinding'] ~= nil then result['deviceBinding'] = source['deviceBinding'] end
+if source['provider'] ~= nil then
+  local provider = {}
+  provider['issuer'] = source['provider']['issuer']
+  provider['clientId'] = source['provider']['clientId']
+  result['provider'] = provider
+end
+return cjson.encode(result)
+`;
+var buildSessionRevocationContextCommand = (keys, sessionId) => evalCommand(
+  SESSION_REVOCATION_CONTEXT_SCRIPT,
+  [keys.session(sessionId), keys.rotatedSessionAlias(sessionId)],
+  [sessionId, keys.sessionPrefix(), keys.logicalSessionIndexPrefix()]
+);
 var scriptSha1 = (script) => createHash("sha1").update(script).digest("hex");
 var NOSCRIPT_ERROR_PREFIX = "NOSCRIPT";
 var isNoScriptError = (error) => {
@@ -244,7 +483,42 @@ end
 
 return 1
 `;
+var LIVE_LINEAGE_HELPER = `
+local function hasLiveMember(logicalIndexKey, sessionKeyPrefix, logicalSessionId, excludedId)
+  local members = redis.call('ZRANGE', logicalIndexKey, 0, -1)
+  for _, memberId in ipairs(members) do
+    if memberId ~= excludedId then
+      local value = redis.call('GET', sessionKeyPrefix .. memberId)
+      if value ~= false then
+        local ok, member = pcall(cjson.decode, value)
+        if ok and type(member) == 'table' and member['sessionId'] == memberId
+          and (member['logicalSessionId'] or memberId) == logicalSessionId then
+          return true
+        end
+      end
+    end
+  end
+  return false
+end
+`;
+var CLEANUP_INACTIVE_ALIASES_SCRIPT = `
+${LIVE_LINEAGE_HELPER}
+if hasLiveMember(KEYS[1], ARGV[1], ARGV[3], nil) then
+  return 0
+end
+local aliases = redis.call('ZRANGE', KEYS[2], 0, -1)
+for _, aliasId in ipairs(aliases) do
+  redis.call('DEL', ARGV[2] .. aliasId)
+end
+return redis.call('DEL', KEYS[2])
+`;
+var buildCleanupInactiveAliasesCommand = (keys, logicalSessionId) => evalCommand(
+  CLEANUP_INACTIVE_ALIASES_SCRIPT,
+  [keys.logicalSessionIndex(logicalSessionId), keys.rotatedSessionAliasIndex(logicalSessionId)],
+  [keys.sessionPrefix(), keys.rotatedSessionAliasPrefix(), logicalSessionId]
+);
 var DELETE_SESSION_SCRIPT = `
+${LIVE_LINEAGE_HELPER}
 local expected = cjson.decode(ARGV[1])
 local scopeKind = ARGV[2]
 local scopeValue = ARGV[3]
@@ -324,7 +598,16 @@ local function deleteRecord(sessionKey, session)
     assertZsetOrMissing(providerIndexKeyPrefix .. session['providerSessionId'])
   end
 
-  local aliasSessionIds = redis.call('ZRANGE', aliasIndexKey, 0, -1)
+  -- Check actual primaries, not just scores: TTL is authoritative and stale
+  -- logical memberships must not keep a terminated lineage's aliases alive.
+  -- This check and deletion share the script's atomic boundary with rotation.
+  local logicalIndexKey = logicalIndexKeyPrefix .. logicalSessionId
+  local hasSurvivor = hasLiveMember(logicalIndexKey, sessionKeyPrefix, logicalSessionId, sessionId)
+
+  local aliasSessionIds = {}
+  if not hasSurvivor then
+    aliasSessionIds = redis.call('ZRANGE', aliasIndexKey, 0, -1)
+  end
 
   if redis.call('DEL', sessionKey) == 0 then
     return 0
@@ -341,7 +624,9 @@ local function deleteRecord(sessionKey, session)
     redis.call('DEL', aliasKeyPrefix .. aliasSessionId)
   end
 
-  redis.call('DEL', aliasIndexKey)
+  if not hasSurvivor then
+    redis.call('DEL', aliasIndexKey)
+  end
 
   return 1
 end
@@ -380,6 +665,7 @@ end
 return deleted
 `;
 var ROTATE_SESSION_SCRIPT = `
+${BINDING_VALIDATION_HELPER}
 local newValue = ARGV[1]
 local newExpiresAt = ARGV[2]
 local oldSessionId = ARGV[3]
@@ -393,6 +679,7 @@ local oldAliasValue = ARGV[10]
 local oldAliasExpiresAt = ARGV[11]
 local aliasIndexKey = ARGV[12]
 local aliasIndexKeyPrefix = ARGV[13]
+local expectedSource = cjson.decode(ARGV[14])
 
 local function assertStringOrMissing(key)
   local keyType = redis.call('TYPE', key)['ok']
@@ -451,6 +738,25 @@ if redis.call('EXISTS', KEYS[1]) == 0 then
   return 0
 end
 
+local ok, source = pcall(cjson.decode, redis.call('GET', KEYS[1]))
+local next = cjson.decode(newValue)
+if not ok or type(source) ~= 'table' or source['sessionId'] ~= oldSessionId
+  or not validBinding(source['deviceBinding']) or not validBinding(next['deviceBinding']) then return 3 end
+local sourceProvider = source['provider'] or {}
+local expectedProvider = expectedSource['provider'] or {}
+if type(sourceProvider) ~= 'table' or type(expectedProvider) ~= 'table' then return 3 end
+-- Source authority CAS protects immutable binding and index ownership from
+-- same-ID replacement between the application preflight and this script.
+if (source['logicalSessionId'] or oldSessionId) ~= (expectedSource['logicalSessionId'] or oldSessionId)
+  or source['subject'] ~= expectedSource['subject'] or source['providerSessionId'] ~= expectedSource['providerSessionId']
+  or sourceProvider['issuer'] ~= expectedProvider['issuer'] or sourceProvider['clientId'] ~= expectedProvider['clientId']
+  or source['refreshToken'] ~= expectedSource['refreshToken'] or source['idToken'] ~= expectedSource['idToken']
+  or source['accessToken'] ~= expectedSource['accessToken'] or source['scope'] ~= expectedSource['scope']
+  or source['createdAt'] ~= expectedSource['createdAt'] or source['updatedAt'] ~= expectedSource['updatedAt']
+  or source['expiresAt'] ~= expectedSource['expiresAt']
+  or not sameBinding(source['deviceBinding'], expectedSource['deviceBinding'])
+  or not sameBinding(source['deviceBinding'], next['deviceBinding']) then return 3 end
+
 if oldSessionId == newSessionId then
   return 2
 end
@@ -503,6 +809,30 @@ redis.call('ZADD', aliasIndexKey, newScore, oldSessionId)
 
 return 1
 `;
+var COMPARE_AND_DELETE_SCRIPT = `
+local current = redis.call('GET', KEYS[1])
+
+if current == ARGV[1] then
+  return redis.call('DEL', KEYS[1])
+else
+  return 0
+end
+`;
+var buildCompareAndDeleteCommand = (key, observedValue) => evalCommand(COMPARE_AND_DELETE_SCRIPT, [key], [observedValue]);
+var REPAIR_SESSION_INDEX_SCRIPT = `
+local current = redis.call('GET', KEYS[1])
+
+if current == false or (ARGV[3] == '1' and current == ARGV[2]) then
+  return redis.call('ZREM', KEYS[2], ARGV[1])
+end
+
+return 0
+`;
+var buildRepairSessionIndexCommand = (sessionKey, indexKey, sessionId, observedValue) => evalCommand(
+  REPAIR_SESSION_INDEX_SCRIPT,
+  [sessionKey, indexKey],
+  [sessionId, observedValue ?? "", observedValue === null ? "0" : "1"]
+);
 var buildWriteSessionCommand = (keys, session) => evalCommand(
   WRITE_SESSION_SCRIPT,
   [
@@ -560,18 +890,38 @@ var buildRotateSessionCommand = (keys, previousSession, nextSession) => evalComm
     serialize(nextSession.logicalSessionId ?? nextSession.sessionId),
     serializeExpiresAt(nextSession.expiresAt),
     keys.rotatedSessionAliasIndex(nextSession.logicalSessionId ?? nextSession.sessionId),
-    keys.rotatedSessionAliasIndexPrefix()
+    keys.rotatedSessionAliasIndexPrefix(),
+    serialize(previousSession)
   ]
 );
 
 // src/index.ts
 var INDEX_CLEANUP_SCAN_COUNT = 100;
 var INDEX_REVOCATION_SCAN_COUNT = 250;
+var snapshotInput = (input, seen = /* @__PURE__ */ new WeakMap()) => {
+  if (input === null || typeof input !== "object") return input;
+  const prototype = Object.getPrototypeOf(input);
+  if (!Array.isArray(input) && prototype !== Object.prototype && prototype !== null) return input;
+  if (seen.has(input)) return seen.get(input);
+  const copy = Array.isArray(input) ? new Array(input.length) : Object.create(prototype);
+  seen.set(input, copy);
+  for (const key of Reflect.ownKeys(input)) {
+    if (Object.prototype.propertyIsEnumerable.call(input, key)) {
+      Object.defineProperty(copy, key, {
+        value: snapshotInput(Reflect.get(input, key), seen),
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    }
+  }
+  return copy;
+};
 var isRecord = (value) => typeof value === "object" && value !== null;
 var isUnsupportedClusterClient = (client) => isRecord(client) && typeof client.getSlotMaster === "function" && typeof client.nodeClient === "function" && Array.isArray(client.masters) && Array.isArray(client.slots);
-var toSubjectDeleteInput = (input) => typeof input === "string" ? { subject: input } : input;
-var toProviderSessionDeleteInput = (input) => typeof input === "string" ? { providerSessionId: input } : input;
-var toLogicalSessionDeleteInput = (input) => typeof input === "string" ? { logicalSessionId: input } : input;
+var toSubjectDeleteInput = (input) => typeof input === "string" ? { subject: input } : { ...input };
+var toProviderSessionDeleteInput = (input) => typeof input === "string" ? { providerSessionId: input } : { ...input };
+var toLogicalSessionDeleteInput = (input) => typeof input === "string" ? { logicalSessionId: input } : { ...input };
 var matchesProviderScope = (session, input) => {
   if (input.issuer !== void 0 && session.provider?.issuer !== input.issuer) {
     return false;
@@ -587,7 +937,12 @@ var RedisOidcVaultStore = class {
   now;
   scriptRunner;
   indexCleanupCursor = "0";
+  dpopReplayMaxEntries;
   constructor(options) {
+    this.dpopReplayMaxEntries = options.dpopReplayMaxEntries === void 0 ? 1e5 : options.dpopReplayMaxEntries;
+    if (!Number.isSafeInteger(this.dpopReplayMaxEntries) || this.dpopReplayMaxEntries <= 0) {
+      throw new TypeError("OIDC vault DPoP replay maximum entries must be a positive safe integer.");
+    }
     if (typeof options.client.sendCommand !== "function") {
       throw new Error("Redis store client must implement sendCommand(args) for atomic vault operations.");
     }
@@ -602,22 +957,109 @@ var RedisOidcVaultStore = class {
     this.scriptRunner = new RedisScriptRunner(options.client);
   }
   async createAuthorizationTransaction(input) {
+    input = snapshotInput({ ...input });
+    assertRecordBinding(input);
     await this.setJson(this.keys.authorizationTransaction(input.state), input, input.expiresAt);
   }
   async consumeAuthorizationTransaction(state) {
-    return this.consumeJson(
+    const value = await this.runScript(
+      buildConsumeGuardedRecordCommand(this.keys.authorizationTransaction(state), "transaction", state)
+    );
+    return this.parseOneTimeRecord(
+      value,
+      "authorization transaction",
+      (value2) => validateAuthorizationTransaction(value2, state)
+    );
+  }
+  async getAuthorizationTransaction(state) {
+    return this.getJson(
       this.keys.authorizationTransaction(state),
       "authorization transaction",
-      validateAuthorizationTransaction
+      (value) => validateAuthorizationTransaction(value, state),
+      { deleteMalformed: true, checkExpiry: true }
+    );
+  }
+  async consumeAuthorizationTransactionIfMatches(input) {
+    input = snapshotInput({ ...input });
+    if (!validateBindingMatch(input.match)) return null;
+    const value = await this.runScript(
+      buildConsumeGuardedRecordCommand(
+        this.keys.authorizationTransaction(input.state),
+        "transaction",
+        input.state,
+        input.match
+      )
+    );
+    return this.parseOneTimeRecord(
+      value,
+      "authorization transaction",
+      (value2) => validateAuthorizationTransaction(value2, input.state)
     );
   }
   async createExchangeCode(input) {
+    input = snapshotInput({ ...input });
+    assertRecordBinding(input);
     await this.setJson(this.keys.exchangeCode(input.code), input, input.expiresAt);
   }
   async consumeExchangeCode(code) {
-    return this.consumeJson(this.keys.exchangeCode(code), "exchange code", validateExchangeCodeRecord);
+    const value = await this.runScript(
+      buildConsumeGuardedRecordCommand(this.keys.exchangeCode(code), "exchange", code)
+    );
+    return this.parseOneTimeRecord(value, "exchange code", (value2) => validateExchangeCodeRecord(value2, code));
+  }
+  async getExchangeCode(code) {
+    return this.getJson(
+      this.keys.exchangeCode(code),
+      "exchange code",
+      (value) => validateExchangeCodeRecord(value, code),
+      { deleteMalformed: true, checkExpiry: true }
+    );
+  }
+  async consumeExchangeCodeIfMatches(input) {
+    input = snapshotInput({ ...input });
+    if (!validateBindingMatch(input.match) || typeof input.expectedSessionId !== "string") return null;
+    const value = await this.runScript(
+      buildConsumeGuardedRecordCommand(
+        this.keys.exchangeCode(input.code),
+        "exchange",
+        input.code,
+        input.match,
+        input.expectedSessionId
+      )
+    );
+    return this.parseOneTimeRecord(value, "exchange code", (value2) => validateExchangeCodeRecord(value2, input.code));
   }
+  async getSessionRevocationContext(sessionId) {
+    const raw = await this.runScript(buildSessionRevocationContextCommand(this.keys, sessionId));
+    if (typeof raw !== "string") return null;
+    const context = JSON.parse(raw);
+    if (Array.isArray(context.provider) && context.provider.length === 0) context.provider = {};
+    return context;
+  }
+  async reserveDpopProof(input) {
+    input = { replayKey: input.replayKey, expiresAt: input.expiresAt };
+    if (typeof input.replayKey !== "string" || !Number.isSafeInteger(input.expiresAt)) return false;
+    const result = await this.runScript(buildReserveDpopProofCommand(this.keys, input, this.dpopReplayMaxEntries));
+    if (result === 2 || result === "2") throw new OidcVaultDpopReplayCapacityError();
+    return result === 1 || result === "1";
+  }
+  /**
+   * Creates a session record atomically, then runs best-effort index
+   * maintenance.
+   *
+   * Result policy (SVH-02): once `writeSessionRecord` reports success the
+   * session is committed and this method resolves with the session even if
+   * post-commit index maintenance (`SCAN`/`TYPE`/`TIME`/`ZREMRANGEBYSCORE`)
+   * fails. A maintenance failure is reported once via a fixed-text
+   * `console.warn` identifying only the operation (no adapter error details,
+   * session IDs, keys, or token material) and is retried opportunistically by
+   * a later `createSession`/`rotateSession` call. Mutation-command failures (the
+   * atomic write script) still reject, and this method never retries a
+   * committed mutation.
+   */
   async createSession(input) {
+    input = snapshotInput({ ...input });
+    assertSessionBinding(input);
     const timestamp = this.now();
     const session = {
       ...input,
@@ -629,13 +1071,17 @@ var RedisOidcVaultStore = class {
     if (!written) {
       throw new OidcVaultStoreConflictError("OIDC vault session already exists.");
     }
-    await this.cleanupStaleIndexKeys();
+    await this.runPostCommitIndexMaintenance("createSession");
     return session;
   }
   async getSession(sessionId) {
-    return this.getJson(this.keys.session(sessionId), "session", validateSession, { deleteMalformed: true });
+    return this.getJson(this.keys.session(sessionId), "session", (value) => validateSession(value, sessionId), {
+      deleteMalformed: true
+    });
   }
   async rotateSession(input) {
+    input = { sessionId: input.sessionId, nextSession: snapshotInput({ ...input.nextSession }) };
+    assertSessionBinding(input.nextSession);
     const previousSession = await this.getSession(input.sessionId);
     if (!previousSession) {
       throw new OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
@@ -643,15 +1089,19 @@ var RedisOidcVaultStore = class {
     if (input.nextSession.sessionId === input.sessionId) {
       throw new OidcVaultStoreConflictError("OIDC vault session rotation target must use a different session ID.");
     }
+    if (input.nextSession.deviceBinding !== void 0 && input.nextSession.deviceBinding.jkt !== previousSession.deviceBinding?.jkt) {
+      throw new OidcVaultStoreConflictError("OIDC vault session rotation cannot change or add device binding.");
+    }
     const nextSession = {
       ...input.nextSession,
+      ...previousSession.deviceBinding === void 0 ? {} : { deviceBinding: { ...previousSession.deviceBinding } },
       logicalSessionId: input.nextSession.logicalSessionId ?? previousSession.logicalSessionId ?? previousSession.sessionId
     };
     const rotated = await this.rotateSessionRecord(previousSession, nextSession);
     if (!rotated) {
       throw new OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
     }
-    await this.cleanupStaleIndexKeys();
+    await this.runPostCommitIndexMaintenance("rotateSession");
     return nextSession;
   }
   async deleteSession(sessionId) {
@@ -665,13 +1115,11 @@ var RedisOidcVaultStore = class {
       );
       if (logicalSessionId) {
         await this.deleteSessionsByLogicalSessionId(logicalSessionId);
-        await this.deleteRotatedSessionAliasesByLogicalSessionId(logicalSessionId);
       }
-      await this.client.del(this.keys.session(sessionId));
+      await this.deleteSessionKeyIfMalformed(sessionId);
       return;
     }
     await this.deleteSessionRecord(session, { kind: "single" });
-    await this.deleteRotatedSessionAliasesByLogicalSessionId(session.logicalSessionId ?? session.sessionId);
   }
   async deleteSessionsByLogicalSessionId(input) {
     const resolved = toLogicalSessionDeleteInput(input);
@@ -701,18 +1149,21 @@ var RedisOidcVaultStore = class {
     await this.client.set(key, serialize(value), options);
   }
   async getJson(key, recordKind, validate, options) {
+    const raw = await this.client.get(key);
     try {
-      return parseStoredJson(await this.client.get(key), recordKind, validate);
+      const record = parseStoredJson(raw, recordKind, validate);
+      if (record !== null && options?.checkExpiry && isPlainRecord(record) && typeof record.expiresAt === "number" && record.expiresAt <= await this.redisServerTime())
+        return null;
+      return record;
     } catch (error) {
-      if (options?.deleteMalformed && error instanceof OidcVaultRedisStoreRecordError) {
-        await this.client.del(key);
+      if (options?.deleteMalformed && error instanceof OidcVaultRedisStoreRecordError && raw !== null) {
+        await this.deleteMalformedValueIfUnchanged(key, raw);
         return null;
       }
       throw error;
     }
   }
-  async consumeJson(key, recordKind, validate) {
-    const value = await this.sendCommand(["GETDEL", key]);
+  parseOneTimeRecord(value, recordKind, validate) {
     try {
       return typeof value === "string" ? parseStoredJson(value, recordKind, validate) : null;
     } catch (error) {
@@ -730,11 +1181,51 @@ var RedisOidcVaultStore = class {
     const result = await this.runScript(buildDeleteSessionCommand(this.keys, session, scope));
     return typeof result === "number" ? result : Number(result);
   }
+  /**
+   * Removes a stored value only when it still equals the malformed payload
+   * observed by a prior read (SVH-03). The equality check runs inside the Lua
+   * script, so a concurrent `createSession` reusing the same ID is never
+   * destroyed by a stale repair.
+   */
+  async deleteMalformedValueIfUnchanged(key, observedRaw) {
+    await this.runScript(buildCompareAndDeleteCommand(key, observedRaw));
+  }
+  /**
+   * Best-effort cleanup for the missing-session branch of `deleteSession`.
+   * Re-reads the session key and removes it only when it still holds malformed
+   * data. A missing key needs no cleanup and a freshly created valid session
+   * (same-ID reuse after the earlier read) is preserved; genuine logout of a
+   * live session never reaches this branch.
+   */
+  async deleteSessionKeyIfMalformed(sessionId) {
+    const sessionKey = this.keys.session(sessionId);
+    let raw;
+    try {
+      raw = await this.client.get(sessionKey);
+    } catch {
+      return;
+    }
+    if (raw === null) {
+      return;
+    }
+    try {
+      parseStoredJson(raw, "session", (value) => validateSession(value, sessionId));
+    } catch (error) {
+      if (error instanceof OidcVaultRedisStoreRecordError) {
+        await this.deleteMalformedValueIfUnchanged(sessionKey, raw);
+        return;
+      }
+      throw error;
+    }
+  }
   async rotateSessionRecord(previousSession, nextSession) {
     const result = await this.runScript(buildRotateSessionCommand(this.keys, previousSession, nextSession));
     if (result === 2 || result === "2") {
       throw new OidcVaultStoreConflictError("OIDC vault session rotation target already exists.");
     }
+    if (result === 3 || result === "3") {
+      throw new OidcVaultStoreConflictError("OIDC vault session changed before rotation could commit.");
+    }
     return result === 1 || result === "1";
   }
   async runScript(command) {
@@ -743,6 +1234,20 @@ var RedisOidcVaultStore = class {
   async cleanupExpiredIndexMembers(indexKey) {
     await this.sendCommand(["ZREMRANGEBYSCORE", indexKey, "-inf", String(await this.redisServerTime())]);
   }
+  /**
+   * Runs optional post-commit index maintenance without letting it masquerade
+   * as a failed mutation. Any failure is reported once via a fixed-text
+   * warning and swallowed so the already-committed session result stands; the
+   * next successful create/rotate retries the incremental scan from the
+   * retained cursor. Never retries the committed mutation itself.
+   */
+  async runPostCommitIndexMaintenance(operation) {
+    try {
+      await this.cleanupStaleIndexKeys();
+    } catch {
+      console.warn(`OIDC vault Redis index maintenance failed after ${operation} and will retry on a later write.`);
+    }
+  }
   async cleanupStaleIndexKeys() {
     const response = await this.sendCommand([
       "SCAN",
@@ -793,10 +1298,6 @@ var RedisOidcVaultStore = class {
     }
     return seconds * 1e3 + Math.floor(microseconds / 1e3);
   }
-  async getSessionIdsFromIndex(indexKey) {
-    const response = await this.sendCommand(["ZRANGE", indexKey, "0", "-1"]);
-    return Array.isArray(response) ? response.filter((value) => typeof value === "string") : [];
-  }
   async scanSessionIdsFromIndex(indexKey, cursor) {
     const response = await this.sendCommand(["ZSCAN", indexKey, cursor, "COUNT", String(INDEX_REVOCATION_SCAN_COUNT)]);
     if (!Array.isArray(response) || typeof response[0] !== "string" || !Array.isArray(response[1])) {
@@ -821,21 +1322,25 @@ var RedisOidcVaultStore = class {
       throw new Error("OIDC vault Redis store received an unexpected MGET response.");
     }
     return Promise.all(
-      response.map(async (value, index) => {
+      sessionIds.map(async (sessionId, index) => {
+        const value = response[index];
+        const raw = typeof value === "string" ? value : null;
         try {
-          return typeof value === "string" ? parseStoredJson(value, "session", validateSession) : null;
+          return { session: parseStoredJson(raw, "session", (parsed) => validateSession(parsed, sessionId)), raw };
         } catch (error) {
-          if (error instanceof OidcVaultRedisStoreRecordError) {
-            await this.client.del(this.keys.session(sessionIds[index]));
-            return null;
+          if (error instanceof OidcVaultRedisStoreRecordError && typeof value === "string") {
+            await this.deleteMalformedValueIfUnchanged(this.keys.session(sessionId), value);
+            return { session: null, raw };
           }
           throw error;
         }
       })
     );
   }
-  async removeSessionIdFromIndex(indexKey, sessionId) {
-    await this.sendCommand(["ZREM", indexKey, sessionId]);
+  async removeSessionIdFromIndex(indexKey, sessionId, observedRaw) {
+    await this.runScript(
+      buildRepairSessionIndexCommand(this.keys.session(sessionId), indexKey, sessionId, observedRaw)
+    );
   }
   async deleteSessionsFromIndex(indexKey, scope) {
     await this.cleanupExpiredIndexMembers(indexKey);
@@ -849,21 +1354,21 @@ var RedisOidcVaultStore = class {
       }
       const sessions = await this.getSessionRecords(batch.sessionIds);
       for (const [index, sessionId] of batch.sessionIds.entries()) {
-        const session = sessions[index];
+        const { session, raw } = sessions[index] ?? { session: null, raw: null };
         if (!session) {
-          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          await this.removeSessionIdFromIndex(indexKey, sessionId, raw);
           continue;
         }
         if ("logicalSessionId" in scope && (session.logicalSessionId ?? session.sessionId) !== scope.logicalSessionId) {
-          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          await this.removeSessionIdFromIndex(indexKey, sessionId, raw);
           continue;
         }
         if ("subject" in scope && session.subject !== scope.subject) {
-          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          await this.removeSessionIdFromIndex(indexKey, sessionId, raw);
           continue;
         }
         if ("providerSessionId" in scope && session.providerSessionId !== scope.providerSessionId) {
-          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          await this.removeSessionIdFromIndex(indexKey, sessionId, raw);
           continue;
         }
         if (!("logicalSessionId" in scope) && !matchesProviderScope(session, scope)) {
@@ -871,11 +1376,13 @@ var RedisOidcVaultStore = class {
         }
         const revoked = await this.deleteSessionRecord(session, this.toDeleteScriptScope(scope));
         if (revoked > 0) {
-          await this.deleteRotatedSessionAliasesByLogicalSessionId(session.logicalSessionId ?? session.sessionId);
           deleted += revoked;
         }
       }
     } while (cursor !== "0");
+    if (deleted === 0 && "logicalSessionId" in scope) {
+      await this.runScript(buildCleanupInactiveAliasesCommand(this.keys, scope.logicalSessionId));
+    }
     return deleted;
   }
   toDeleteScriptScope(scope) {
@@ -892,16 +1399,6 @@ var RedisOidcVaultStore = class {
       clientId: scope.clientId
     };
   }
-  async deleteRotatedSessionAliasesByLogicalSessionId(logicalSessionId) {
-    const aliasIndexKey = this.keys.rotatedSessionAliasIndex(logicalSessionId);
-    await this.cleanupExpiredIndexMembers(aliasIndexKey);
-    const aliasSessionIds = await this.getSessionIdsFromIndex(aliasIndexKey);
-    if (aliasSessionIds.length === 0) {
-      return;
-    }
-    await this.client.del(aliasSessionIds.map((sessionId) => this.keys.rotatedSessionAlias(sessionId)));
-    await this.client.del(aliasIndexKey);
-  }
   async sendCommand(args) {
     return this.client.sendCommand(args);
   }