@web-ts-toolkit/express-oidc-vault-redis-store 0.47.1 → 0.49.0

package/README.md

@@ -99,9 +99,9 @@ Bulk deletion makes one cursor traversal, rechecks scope in each atomic delete s
 
 ## Redis Version And Topology
 
-- **Minimum Redis version: 6.2.** One-time authorization transactions and exchange codes are consumed with `GETDEL`, which is unavailable before Redis 6.2. Versions 6.2 and 7.2 are exercised in integration tests.
+- **Supported minimum Redis version: 6.2.** Versions 6.2 and 7.2 are exercised in integration tests. One-time consumption now uses guarded cached Lua, including legacy consumes, so old calls cannot spend guarded records.
 - **Standalone Redis**: supported through the official `redis` `createClient(...)` client (`RedisClientType`). This is the tested topological default.
-- **Redis Sentinel**: supported by passing the underlying master client retrieved from a `redis.createSentinel(...)` sentinel — for example, the client returned by `await sentinel.acquire()`, or via `await sentinel.use(c => c)` patterns documented in the `redis` package. The bare `createSentinel(...)` root client does NOT satisfy this package's structural contract directly: its `sendCommand(isReadonly, args, options?)` requires an `isReadonly` first argument, while this store calls `sendCommand(args)`. Wrap the underlying master with an adapter conforming to `OidcVaultRedisClient` if you want to retain the Sentinel's connection management. Sentinel failover switches the underlying node, so vault state survives a failover subject to your Sentinel AOF/RDB durability settings.
+- **Redis Sentinel**: use an underlying master client retrieved from `redis.createSentinel(...)` (e.g. acquire/use patterns documented by that driver) or an adapter conforming to `OidcVaultRedisClient`. The bare Sentinel root has `sendCommand(isReadonly, args, options?)`, not this store's `sendCommand(args)`. Caller/adapter owns master acquisition, reconnect/failover and release. Automated provider tests exercise standalone 6.2/7.2, not Sentinel failover; replication/persistence guarantees are deployment-owned, and losing unexpired replay reservations during failover weakens replay protection until their window expires.
 - **Redis Cluster**: **not supported.** Cluster-shaped official clients are rejected when the store is created. The package's atomic vault scripts touch several keys without a hash-slot routing adapter, so Cluster routing could send parts of one logical operation to different nodes. Add a Cluster routing/hash-slot adapter before enabling it.
 
 ## Client Lifecycle And Ownership
@@ -127,8 +127,8 @@ Bulk deletion makes one cursor traversal, rechecks scope in each atomic delete s
 ## Expiry And Index Cleanup
 
 - expiring session records are stored with Redis `PXAT`, and revocation index scores use the same absolute expiration timestamp
-- authorization transactions and exchange codes also use `PXAT`. Redis key expiry is authoritative for reads/consumes; payload `expiresAt` is structurally validated but is not independently compared to a clock on each read. Valid single-record reads use one `GET` or `GETDEL`, without a separate `TIME` round trip, preserving the split-clock policy above
-- **TTL integrity assumption:** preserve the store-written key TTLs and matching index scores when restoring or migrating data. Externally removing/extending a TTL can make a past-dated payload readable/consumable; changing only a session TTL can also leave it live after its index membership is pruned. Read validation does not audit or repair this external expiry inconsistency. Shortening a key TTL makes the record unavailable as soon as Redis expires it, even if its payload expiry is later
+- authorization transactions and exchange codes also use `PXAT`. Legacy consumes and `getSession` preserve the key-TTL policy (no application-clock expiry check); legacy consumption uses one cached Lua call. The new transaction/code preflight getters compare payload expiry with Redis `TIME` (normally `GET` + `TIME`); guarded consumes compare payload expiry inside Lua with server time. They reject expired payloads even after externally altered TTLs
+- **TTL integrity assumption:** preserve the store-written key TTLs and matching index scores when restoring or migrating data. Externally removing/extending a TTL can still expose past-dated payloads through legacy consumes or `getSession`; changing only a session TTL can leave it live after index pruning. New guarded operations additionally enforce payload expiry, but do not repair external index/TTL inconsistencies. Shortening a key TTL makes a record unavailable immediately even when payload expiry is later
 - stale revocation memberships are pruned with Redis `TIME`, not the application clock, so a skewed application clock cannot remove a still-live Redis session from subject, provider-session, or logical-session indexes
 - indexed revocation also checks the primary session key before deleting or returning a session; expired primary values are not returned and missing primary values remove the stale membership encountered during traversal
 - indexed revocation uses `ZSCAN COUNT 250` and one `MGET` for the IDs returned in each batch. `COUNT` is a hint, not a hard batch cap (compact sorted sets can return all members); the batch is not further chunked. Response memory and repair concurrency can grow with the returned batch, while deletion scripts run sequentially
@@ -144,16 +144,55 @@ Bulk deletion makes one cursor traversal, rechecks scope in each atomic delete s
 - malformed one-time authorization transaction and exchange-code records are consumed atomically and return `null`, preventing reuse while failing closed
 - malformed session records are treated as unreadable, deleted when encountered through session reads or indexed revocation, and never returned as authenticated state
 - corruption repair deletes only the observed malformed payload through an atomic server-side compare-and-delete: a fresh same-ID record created after the stale read (session ID reuse is supported) is never destroyed by the repair, and the missing-session logout path applies the same guard instead of an unconditional delete
-- **Identity-validation compatibility note:** shape-valid records stored under the wrong identity now follow the malformed-record policy and return `null`. Session repair targets only the observed lookup key, never the embedded session ID; indexed membership repair retains the same generation guard. One-time mismatches are consumed by the original atomic `GETDEL`, with no follow-up delete that could remove a replacement
+- **Identity-validation compatibility note:** shape-valid records stored under the wrong identity follow the malformed-record policy and return `null`. Session repair targets only the observed lookup key, never the embedded session ID; indexed membership repair retains the same generation guard. One-time corruption is removed inside the same atomic consume script, with no follow-up delete that could remove a replacement
 - a stale repair observing corruption therefore preserves a concurrent replacement, while genuine logout of a live session (direct delete or scoped logical/subject/provider-session revocation) still deletes it; indexed revocation removes stale corrupt members and continues processing later valid sessions
 - Redis mutation scripts preflight expected key types before writing so wrong-type keys fail without deterministic partial mutation
 - package-generated validation and deterministic script diagnostics use fixed text without stored records. Arbitrary client/adapter failures can still reject operations with sensitive original errors; they are not generally sanitized for application logs. Use fixed operation names and allowlisted categories, not raw errors, connection URLs, session IDs, state/PKCE values, exchange codes or token-valued metric labels. The secret-independent post-commit warning policy above applies specifically to that warning path
 
 ## Main Exports
 
-Use named imports from the package root; there is no default export or public subpath API. Use Node.js `>=22.12.0` for the core dependency's CJS/ESM runtime support. TypeScript apps also need `@types/node` and `@types/express`.
+Use named imports from the package root; there is no default export or public subpath API. Use Node.js `>=22.12.0` for the core dependency's CJS/ESM runtime support. TypeScript apps also need `@types/node` and `@types/express`. Both ESM (`import`, `index.d.mts`) and CJS (`require`, `index.d.ts`) declaration conditions are shipped; consumer imports always use the package name.
 
 - `createRedisOidcVaultStore(...)`
 - `OidcVaultRedisStoreRecordError`
 - `type RedisOidcVaultStoreOptions`
 - `type OidcVaultRedisClient`
+
+## Device-Binding Store Capabilities
+
+The factory returns core `OidcVaultDeviceBindingStoreProvider`, with detached live `getAuthorizationTransaction(state)` and `getExchangeCode(code)`, atomic `consumeAuthorizationTransactionIfMatches({ state, match })` and `consumeExchangeCodeIfMatches({ code, expectedSessionId, match })`, token-free `getSessionRevocationContext(sessionId)`, and `reserveDpopProof({ replayKey, expiresAt })`.
+
+Import the stronger provider, match/consume/replay/revocation types and `OidcVaultDpopReplayCapacityError` from the **core package root**; the Redis package exports its factory/options/client and record error only. Either vault opt-in feature requires all six capabilities, while fingerprint-only flows do not reserve proofs. Use the same shared provider as API replayStore; the core shipped README includes complete DPoP issuer/API/browser usage.
+
+`match` requires both `deviceBinding` and `browserBindingHash`. Non-null values match exactly; **null requires stored absence**, never BSON/JSON null or “ignore”. Legacy records omit both; guarded unbound records have a cookie hash; bound records have that hash plus `{ type: 'dpop', jkt }`. Hashes are canonical 43-character SHA-256 base64url. Null/malformed/extra binding fields and key-without-hash records are invalid; writes reject and corrupted data returns no credentials. No JWK, proof algorithm, or historical mode is stored.
+
+Preflight getters are not locks. The consume script performs shape/identity/expiry, both matches, exchange-session match and deletion atomically; mismatch returns `null` without spending a live record. Matching races have one winner across independent Redis clients. **Legacy consumes now also use this script** and refuse guarded records, including cookie-only records, without spending them. There is no application-side get/unconditional-delete bypass. Malformed read cleanup retains the existing compare-and-delete generation guard.
+
+Rotation inherits omitted binding, accepts the same key, and rejects null/malformed, changed, or newly added binding before mutation. Lua also rechecks source identity, credential generation and binding against the preflight source so same-ID replacement cannot make a new lineage inherit an old key or lose index ownership. Target-ID, alias, deletion and post-commit maintenance policies remain as documented above.
+
+`getSessionRevocationContext` resolves a live handle or unexpired alias and all live members of its current lineage inside one Lua snapshot. A directly observed live handle always participates even if its reverse-index membership is missing, so peers cannot make that bound handle appear unbound. It returns only `logicalSessionId`, allowlisted `provider.issuer/clientId`, and optional original `deviceBinding`; no tokens/profile/metadata/arbitrary provider fields leave Redis. Alias payloads still contain only their logical ID: absence of an alias binding never means an unbound lineage. Malformed/inconsistent binding/provider authority throws a fixed diagnostic. Expired aliases/empty lineages return `null`, and `getSession(alias)` remains `null`. This call materializes the whole logical-member set and reads member primaries inside Lua; large lineages remain scale-dependent server work.
+
+## Per-Request DPoP Replay And Capacity
+
+| Redis option           | Default      | Contract                                                                |
+| ---------------------- | ------------ | ----------------------------------------------------------------------- |
+| `client`               | required     | Connected standalone-shaped client/adapter; caller owns lifecycle       |
+| `keyPrefix`            | `oidc-vault` | Shared vault/replay namespace; changing it is not migration             |
+| `dpopReplayMaxEntries` | `100000`     | Positive safe integer, identical on clients sharing the prefix          |
+| `now`                  | `Date.now`   | Store timestamps/backchannel preflight only; replay/TTL use server TIME |
+
+```ts
+const storeProvider = createRedisOidcVaultStore({
+  client: redis,
+  keyPrefix: 'oidc-vault',
+  dpopReplayMaxEntries: 100_000,
+});
+```
+
+`dpopReplayMaxEntries` is a positive safe integer (default **100000**), shared per key prefix across clients. Every client sharing that prefix must configure the same limit. The opaque proof keys are members of **`<keyPrefix>:dpop-proofs`**, a sorted set whose scores are absolute expiry milliseconds. This set is both replay state and capacity/expiry accounting; there is no separate counter that can leak after individual key TTLs.
+
+`reserveDpopProof` is normally **one cached `EVALSHA` round trip per proof**. Server `TIME` inside Lua owns the validity window; the optional application `now` hook cannot admit a stale proof or prune live reservations. A safe-integer future expiry is required, with remaining TTL **<=360000 ms**. Invalid/nonfinite/unsafe/fractional/expired (`<= server now`) or overlong input returns `false` without allocation. Duplicate-first `ZSCORE` rejects without extending expiry, even at capacity. Lua reclaims at most **64** expired members with `ZRANGEBYSCORE ... LIMIT 0 64`, plus the requested expired key, then atomically checks `ZCARD` and admits with `ZADD`. No session/alias scan, unbounded `ZREMRANGEBYSCORE`, or live-entry eviction occurs on replay admission.
+
+The replay set expires at its latest retained score (`PEXPIREAT`), reclaiming it if traffic stops; this deadline never extends a member's replay window. Expired members awaiting bounded cleanup may conservatively occupy capacity. New keys at capacity throw root `OidcVaultDpopReplayCapacityError` from `@web-ts-toolkit/express-oidc-vault`, with no live eviction or acceptance without replay state. Wrong-type/client failures reject. `NOSCRIPT` recovery loads and retries once, adding two round trips to the normal call; the existing runner never retries an arbitrary committed mutation on transport failure.
+
+Provision ACLs for cached scripts and their internal commands, including `TIME`, `TYPE`, `GET`, `DEL`, `ZSCORE`, `ZRANGEBYSCORE`, `ZREM`, `ZCARD`, `ZADD`, `ZREVRANGE` and `PEXPIREAT`. DPoP is a **per-request write**, unlike lower-volume backchannel JTIs (`SET NX PXAT`). Size capacity for unique proofs/second × validity window plus headroom (approved defaults: at most 70 seconds). Share identical namespaces/windows and synchronized clocks across instances; never release reservations after downstream failure, and retries need a fresh proof. Capacity/provider errors must map through orchestration to sanitized replay-unavailable and fail closed. Redis failover durability remains deployment-owned; these command/work bounds are not throughput/latency guarantees.

package/index.d.mts

@@ -1,4 +1,4 @@
-import { OidcVaultStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
+import { OidcVaultDeviceBindingStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
 
 /**
  * Thrown when a stored Redis value cannot be parsed or fails structural
@@ -34,7 +34,7 @@ declare class OidcVaultRedisStoreRecordError extends Error {
  *
  * `sendCommand` is required because atomic session writes, rotations,
  * deletions, and one-time record consumption transit Redis
- * `EVAL`/`GETDEL`/`TYPE`/`TIME`/`ZRANGE`/`ZSCAN`/`MGET` commands through it.
+ * cached Lua/`TYPE`/`TIME`/`ZRANGE`/`ZSCAN`/`MGET` commands through it.
  * It was previously optional in this type but always enforced at runtime.
  */
 interface OidcVaultRedisClient {
@@ -59,6 +59,8 @@ interface OidcVaultRedisClient {
  * `disconnect()`). The package never calls `connect`, `quit`, or `disconnect`.
  */
 interface RedisOidcVaultStoreOptions {
+    /** Positive safe integer per shared keyPrefix; default 100000. Configure identically on all clients. */
+    dpopReplayMaxEntries?: number;
     /** Connected Redis client or compatible adapter implementing {@link OidcVaultRedisClient}. */
     client: OidcVaultRedisClient;
     /**
@@ -77,7 +79,7 @@ interface RedisOidcVaultStoreOptions {
     now?: () => number;
 }
 /**
- * Create an `OidcVaultStoreProvider` backed by a connected Redis client.
+ * Create an `OidcVaultDeviceBindingStoreProvider` backed by a connected Redis client.
  *
  * Pass an already-connected official `redis` standalone client (or any adapter
  * implementing {@link OidcVaultRedisClient}). For Redis Sentinel deployments,
@@ -86,12 +88,14 @@ interface RedisOidcVaultStoreOptions {
  * satisfy the structural contract. The store does not connect, disconnect, or
  * attach `error` listeners; it only issues commands.
  *
- * The package requires Redis 6.2 or later (it uses `GETDEL`). Redis Cluster is
- * not supported and is rejected here.
+ * The package supports Redis 6.2 or later. Redis Cluster is
+ * not supported and is rejected here. Guarded consumes and per-proof replay use
+ * cached atomic Lua; replay is shared per keyPrefix, uses server TIME, and never
+ * evicts live entries. All clients must use the same dpopReplayMaxEntries.
  *
  * @param options construction options; see {@link RedisOidcVaultStoreOptions}.
- * @returns a provider satisfying the core `OidcVaultStoreProvider` contract.
+ * @returns a provider satisfying the stronger `OidcVaultDeviceBindingStoreProvider` contract.
  */
-declare function createRedisOidcVaultStore(options: RedisOidcVaultStoreOptions): OidcVaultStoreProvider;
+declare function createRedisOidcVaultStore(options: RedisOidcVaultStoreOptions): OidcVaultDeviceBindingStoreProvider;
 
 export { type OidcVaultRedisClient, OidcVaultRedisStoreRecordError, type RedisOidcVaultStoreOptions, createRedisOidcVaultStore };

package/index.d.ts

@@ -1,4 +1,4 @@
-import { OidcVaultStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
+import { OidcVaultDeviceBindingStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
 
 /**
  * Thrown when a stored Redis value cannot be parsed or fails structural
@@ -34,7 +34,7 @@ declare class OidcVaultRedisStoreRecordError extends Error {
  *
  * `sendCommand` is required because atomic session writes, rotations,
  * deletions, and one-time record consumption transit Redis
- * `EVAL`/`GETDEL`/`TYPE`/`TIME`/`ZRANGE`/`ZSCAN`/`MGET` commands through it.
+ * cached Lua/`TYPE`/`TIME`/`ZRANGE`/`ZSCAN`/`MGET` commands through it.
  * It was previously optional in this type but always enforced at runtime.
  */
 interface OidcVaultRedisClient {
@@ -59,6 +59,8 @@ interface OidcVaultRedisClient {
  * `disconnect()`). The package never calls `connect`, `quit`, or `disconnect`.
  */
 interface RedisOidcVaultStoreOptions {
+    /** Positive safe integer per shared keyPrefix; default 100000. Configure identically on all clients. */
+    dpopReplayMaxEntries?: number;
     /** Connected Redis client or compatible adapter implementing {@link OidcVaultRedisClient}. */
     client: OidcVaultRedisClient;
     /**
@@ -77,7 +79,7 @@ interface RedisOidcVaultStoreOptions {
     now?: () => number;
 }
 /**
- * Create an `OidcVaultStoreProvider` backed by a connected Redis client.
+ * Create an `OidcVaultDeviceBindingStoreProvider` backed by a connected Redis client.
  *
  * Pass an already-connected official `redis` standalone client (or any adapter
  * implementing {@link OidcVaultRedisClient}). For Redis Sentinel deployments,
@@ -86,12 +88,14 @@ interface RedisOidcVaultStoreOptions {
  * satisfy the structural contract. The store does not connect, disconnect, or
  * attach `error` listeners; it only issues commands.
  *
- * The package requires Redis 6.2 or later (it uses `GETDEL`). Redis Cluster is
- * not supported and is rejected here.
+ * The package supports Redis 6.2 or later. Redis Cluster is
+ * not supported and is rejected here. Guarded consumes and per-proof replay use
+ * cached atomic Lua; replay is shared per keyPrefix, uses server TIME, and never
+ * evicts live entries. All clients must use the same dpopReplayMaxEntries.
  *
  * @param options construction options; see {@link RedisOidcVaultStoreOptions}.
- * @returns a provider satisfying the core `OidcVaultStoreProvider` contract.
+ * @returns a provider satisfying the stronger `OidcVaultDeviceBindingStoreProvider` contract.
  */
-declare function createRedisOidcVaultStore(options: RedisOidcVaultStoreOptions): OidcVaultStoreProvider;
+declare function createRedisOidcVaultStore(options: RedisOidcVaultStoreOptions): OidcVaultDeviceBindingStoreProvider;
 
 export { type OidcVaultRedisClient, OidcVaultRedisStoreRecordError, type RedisOidcVaultStoreOptions, createRedisOidcVaultStore };

package/index.js

@@ -67,6 +67,9 @@ var RedisOidcVaultStoreKeys = class {
   backchannelLogoutTokenJti(jti) {
     return prefixKey(this.keyPrefix, "backchannel-logout-jti", jti);
   }
+  dpopProofs() {
+    return `${this.keyPrefix}:dpop-proofs`;
+  }
   rotatedSessionAliasIndex(logicalSessionId) {
     return prefixKey(this.keyPrefix, "rotated-session-alias-index", logicalSessionId);
   }
@@ -94,14 +97,27 @@ var OidcVaultRedisStoreRecordError = class extends Error {
 };
 var isPlainRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isString = (value) => typeof value === "string";
+var isBindingHash = (value) => typeof value === "string" && value.length === 43 && /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/.test(value);
+var validateDpopBinding = (value) => isPlainRecord(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null) && Object.keys(value).length === 2 && Object.hasOwn(value, "type") && Object.hasOwn(value, "jkt") && value.type === "dpop" && isBindingHash(value.jkt);
+var validateRecordBinding = (record) => (record.deviceBinding === void 0 || validateDpopBinding(record.deviceBinding)) && (record.browserBindingHash === void 0 || isBindingHash(record.browserBindingHash)) && (record.deviceBinding === void 0 || record.browserBindingHash !== void 0);
+var validateBindingMatch = (value) => isPlainRecord(value) && Object.hasOwn(value, "deviceBinding") && Object.hasOwn(value, "browserBindingHash") && (value.deviceBinding === null || validateDpopBinding(value.deviceBinding)) && (value.browserBindingHash === null || isBindingHash(value.browserBindingHash));
+var assertRecordBinding = (record) => {
+  if (!validateRecordBinding(record))
+    throw new TypeError("OIDC vault store record has invalid device/browser binding.");
+};
+var assertSessionBinding = (record) => {
+  if (record.deviceBinding !== void 0 && !validateDpopBinding(record.deviceBinding)) {
+    throw new TypeError("OIDC vault store session has invalid device binding.");
+  }
+};
 var isOptionalString = (value) => value === void 0 || isString(value);
 var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);
 var isOptionalFiniteNumber = (value) => value === void 0 || isFiniteNumber(value);
 var isStringRecord = (value) => isPlainRecord(value);
-var validateAuthorizationTransaction = (value, state) => isPlainRecord(value) && isString(value.state) && value.state === state && isString(value.nonce) && isString(value.pkceVerifier) && isString(value.codeChallenge) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt) && (value.metadata === void 0 || isStringRecord(value.metadata));
-var validateExchangeCodeRecord = (value, code) => isPlainRecord(value) && isString(value.code) && value.code === code && isString(value.sessionId) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt);
+var validateAuthorizationTransaction = (value, state) => isPlainRecord(value) && isString(value.state) && value.state === state && isString(value.nonce) && isString(value.pkceVerifier) && isString(value.codeChallenge) && validateRecordBinding(value) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt) && (value.metadata === void 0 || isStringRecord(value.metadata));
+var validateExchangeCodeRecord = (value, code) => isPlainRecord(value) && isString(value.code) && value.code === code && isString(value.sessionId) && validateRecordBinding(value) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt);
 var validateProviderMetadata = (value) => value === void 0 || isPlainRecord(value) && isOptionalString(value.issuer) && isOptionalString(value.clientId);
-var validateSession = (value, sessionId) => isPlainRecord(value) && isString(value.sessionId) && value.sessionId === sessionId && isOptionalString(value.logicalSessionId) && isString(value.subject) && isOptionalString(value.providerSessionId) && validateProviderMetadata(value.provider) && isString(value.refreshToken) && isString(value.idToken) && isOptionalString(value.accessToken) && isOptionalString(value.scope) && isOptionalFiniteNumber(value.expiresAt) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.updatedAt) && (value.user === void 0 || isPlainRecord(value.user)) && (value.metadata === void 0 || isPlainRecord(value.metadata));
+var validateSession = (value, sessionId) => isPlainRecord(value) && isString(value.sessionId) && value.sessionId === sessionId && isOptionalString(value.logicalSessionId) && isString(value.subject) && isOptionalString(value.providerSessionId) && validateProviderMetadata(value.provider) && (value.deviceBinding === void 0 || validateDpopBinding(value.deviceBinding)) && isString(value.refreshToken) && isString(value.idToken) && isOptionalString(value.accessToken) && isOptionalString(value.scope) && isOptionalFiniteNumber(value.expiresAt) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.updatedAt) && (value.user === void 0 || isPlainRecord(value.user)) && (value.metadata === void 0 || isPlainRecord(value.metadata));
 var parseStoredJson = (value, recordKind, validate) => {
   if (value === null) {
     return null;
@@ -130,6 +146,228 @@ var evalCommand = (script, keys, args) => [
   ...keys,
   ...args
 ];
+var BINDING_VALIDATION_HELPER = `
+local function isHash(value)
+  return type(value) == 'string' and #value == 43
+    and string.match(value, '^[A-Za-z0-9_-]+$') ~= nil
+    and string.match(string.sub(value, 43), '^[AEIMQUYcgkosw048]$') ~= nil
+end
+local function isBinding(value)
+  if type(value) ~= 'table' or value['type'] ~= 'dpop' or not isHash(value['jkt']) then return false end
+  local count = 0
+  for key, _ in pairs(value) do
+    if key ~= 'type' and key ~= 'jkt' then return false end
+    count = count + 1
+  end
+  return count == 2
+end
+local function validBinding(value)
+  return value == nil or isBinding(value)
+end
+local function validRecordBinding(record)
+  return validBinding(record['deviceBinding'])
+    and (record['browserBindingHash'] == nil or isHash(record['browserBindingHash']))
+    and (record['deviceBinding'] == nil or record['browserBindingHash'] ~= nil)
+end
+local function sameBinding(left, right)
+  if left == nil or right == nil then return left == right end
+  return isBinding(left) and isBinding(right) and left['jkt'] == right['jkt']
+end
+local function optionalString(value)
+  return value == nil or type(value) == 'string'
+end
+local function finiteNumber(value)
+  return type(value) == 'number' and value == value and value > -math.huge and value < math.huge
+end
+local function serverNow()
+  local time = redis.call('TIME')
+  return tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+end
+-- cjson decodes both {} and [] to a Lua table. Inspect the top-level value's
+-- lexical kind so an empty provider array cannot masquerade as legacy {}.
+-- Skip strings/escapes and nested containers; duplicate keys use the last
+-- occurrence, matching cjson/JSON.parse. No credential values are returned.
+local function optionalObjectField(raw, wanted)
+  local depth, position, shape = 0, 1, nil
+  while position <= #raw do
+    local char = string.sub(raw, position, position)
+    if char == '"' then
+      local start = position
+      position = position + 1
+      while position <= #raw do
+        local current = string.sub(raw, position, position)
+        if current == '\\\\' then position = position + 2
+        elseif current == '"' then break
+        else position = position + 1 end
+      end
+      if depth == 1 then
+        local after = position + 1
+        while string.match(string.sub(raw, after, after), '%s') do after = after + 1 end
+        if string.sub(raw, after, after) == ':' and cjson.decode(string.sub(raw, start, position)) == wanted then
+          after = after + 1
+          while string.match(string.sub(raw, after, after), '%s') do after = after + 1 end
+          shape = string.sub(raw, after, after)
+        end
+      end
+    elseif char == '{' or char == '[' then depth = depth + 1
+    elseif char == '}' or char == ']' then depth = depth - 1 end
+    position = position + 1
+  end
+  return shape == nil or shape == '{'
+end
+`;
+var CONSUME_GUARDED_RECORD_SCRIPT = `
+${BINDING_VALIDATION_HELPER}
+local raw = redis.call('GET', KEYS[1])
+if raw == false then return false end
+local ok, record = pcall(cjson.decode, raw)
+local kind = ARGV[1]
+local valid = ok and type(record) == 'table' and validRecordBinding(record)
+if valid then
+  valid = optionalString(record['returnTo']) and finiteNumber(record['createdAt']) and finiteNumber(record['expiresAt'])
+  if kind == 'transaction' then
+    valid = valid and record['state'] == ARGV[2] and type(record['nonce']) == 'string'
+      and type(record['pkceVerifier']) == 'string' and type(record['codeChallenge']) == 'string'
+      and (record['metadata'] == nil or type(record['metadata']) == 'table')
+  else
+    valid = valid and record['code'] == ARGV[2] and type(record['sessionId']) == 'string'
+  end
+end
+if not valid then
+  redis.call('DEL', KEYS[1])
+  return false
+end
+-- Legacy consumes preserve the historical Redis key-TTL policy. Guarded
+-- consumes additionally check payload expiry with server time (D5).
+if ARGV[3] ~= 'legacy' and record['expiresAt'] <= serverNow() then
+  redis.call('DEL', KEYS[1])
+  return false
+end
+if ARGV[3] == 'legacy' then
+  if record['deviceBinding'] ~= nil or record['browserBindingHash'] ~= nil then return false end
+else
+  local match = cjson.decode(ARGV[4])
+  if (match['deviceBinding'] ~= cjson.null and not isBinding(match['deviceBinding']))
+    or (match['browserBindingHash'] ~= cjson.null and not isHash(match['browserBindingHash'])) then return false end
+  if match['deviceBinding'] == cjson.null then
+    if record['deviceBinding'] ~= nil then return false end
+  elseif not sameBinding(record['deviceBinding'], match['deviceBinding']) then return false end
+  if match['browserBindingHash'] == cjson.null then
+    if record['browserBindingHash'] ~= nil then return false end
+  elseif record['browserBindingHash'] ~= match['browserBindingHash'] then return false end
+  if kind == 'exchange' and record['sessionId'] ~= ARGV[5] then return false end
+end
+redis.call('DEL', KEYS[1])
+return raw
+`;
+var buildConsumeGuardedRecordCommand = (key, kind, id, match, expectedSessionId) => evalCommand(
+  CONSUME_GUARDED_RECORD_SCRIPT,
+  [key],
+  [
+    kind,
+    id,
+    match === void 0 ? "legacy" : "guarded",
+    match === void 0 ? "" : serialize(match),
+    expectedSessionId ?? ""
+  ]
+);
+var RESERVE_DPOP_PROOF_SCRIPT = `
+${BINDING_VALIDATION_HELPER}
+local expiresAt = tonumber(ARGV[2])
+local now = serverNow()
+if not finiteNumber(expiresAt) or expiresAt ~= math.floor(expiresAt) or expiresAt > 9007199254740991
+  or expiresAt <= now or expiresAt - now > 360000 then return 0 end
+local keyType = redis.call('TYPE', KEYS[1])['ok']
+if keyType ~= 'none' and keyType ~= 'zset' then error('OIDC vault Redis replay key has unexpected type') end
+local existing = redis.call('ZSCORE', KEYS[1], ARGV[1])
+if existing ~= false and tonumber(existing) > now then return 0 end
+-- Hard LIMIT, not SCAN's hint: at most 64 expired entries per admission.
+local expired = redis.call('ZRANGEBYSCORE', KEYS[1], '-inf', now, 'LIMIT', 0, 64)
+if #expired > 0 then redis.call('ZREM', KEYS[1], unpack(expired)) end
+if existing ~= false then redis.call('ZREM', KEYS[1], ARGV[1]) end
+if redis.call('ZCARD', KEYS[1]) >= tonumber(ARGV[3]) then return 2 end
+redis.call('ZADD', KEYS[1], expiresAt, ARGV[1])
+-- Reclaim the whole set if traffic stops after its last retained expiry.
+local last = redis.call('ZREVRANGE', KEYS[1], 0, 0, 'WITHSCORES')
+redis.call('PEXPIREAT', KEYS[1], last[2])
+return 1
+`;
+var buildReserveDpopProofCommand = (keys, input, maxEntries) => evalCommand(
+  RESERVE_DPOP_PROOF_SCRIPT,
+  [keys.dpopProofs()],
+  [input.replayKey, String(input.expiresAt), String(maxEntries)]
+);
+var SESSION_REVOCATION_CONTEXT_SCRIPT = `
+${BINDING_VALIDATION_HELPER}
+local now = serverNow()
+local handle = ARGV[1]
+local sessionPrefix = ARGV[2]
+local logicalPrefix = ARGV[3]
+local function authority(raw, id)
+  local ok, record = pcall(cjson.decode, raw)
+  if not ok or type(record) ~= 'table' or record['sessionId'] ~= id
+    or not optionalString(record['logicalSessionId']) or type(record['subject']) ~= 'string'
+    or not validBinding(record['deviceBinding']) then error('OIDC vault Redis lineage has malformed session authority') end
+  local provider = record['provider']
+  if not optionalObjectField(raw, 'provider') or (provider ~= nil and (type(provider) ~= 'table' or not optionalString(provider['issuer'])
+    or not optionalString(provider['clientId']))) then error('OIDC vault Redis lineage has malformed provider identity') end
+  local expiry = record['expiresAt']
+  if expiry ~= nil and not finiteNumber(expiry) then error('OIDC vault Redis lineage has malformed session expiry') end
+  if expiry ~= nil and expiry <= now then return nil end
+  return record
+end
+local logicalId = nil
+local source = nil
+local primary = redis.call('GET', KEYS[1])
+if primary ~= false then
+  local record = authority(primary, handle)
+  if record ~= nil then
+    logicalId = record['logicalSessionId'] or handle
+    -- The directly observed live handle must participate even if its reverse
+    -- index membership was corrupted; never infer unboundness from peers alone.
+    source = record
+  end
+end
+if logicalId == nil then
+  local alias = redis.call('GET', KEYS[2])
+  if alias == false then return false end
+  local ok, decoded = pcall(cjson.decode, alias)
+  if not ok or type(decoded) ~= 'string' then error('OIDC vault Redis store has malformed revocation alias') end
+  logicalId = decoded
+end
+local members = redis.call('ZRANGE', logicalPrefix .. logicalId, 0, -1)
+for _, id in ipairs(members) do
+  local raw = redis.call('GET', sessionPrefix .. id)
+  if raw ~= false then
+    local member = authority(raw, id)
+    if member ~= nil and (member['logicalSessionId'] or id) == logicalId then
+      if source ~= nil then
+        local left = source['provider'] or {}
+        local right = member['provider'] or {}
+        if not sameBinding(source['deviceBinding'], member['deviceBinding']) or source['subject'] ~= member['subject']
+          or left['issuer'] ~= right['issuer'] or left['clientId'] ~= right['clientId'] then
+          error('OIDC vault Redis lineage has inconsistent device binding or provider identity')
+        end
+      else source = member end
+    end
+  end
+end
+if source == nil then return false end
+local result = { logicalSessionId = logicalId }
+if source['deviceBinding'] ~= nil then result['deviceBinding'] = source['deviceBinding'] end
+if source['provider'] ~= nil then
+  local provider = {}
+  provider['issuer'] = source['provider']['issuer']
+  provider['clientId'] = source['provider']['clientId']
+  result['provider'] = provider
+end
+return cjson.encode(result)
+`;
+var buildSessionRevocationContextCommand = (keys, sessionId) => evalCommand(
+  SESSION_REVOCATION_CONTEXT_SCRIPT,
+  [keys.session(sessionId), keys.rotatedSessionAlias(sessionId)],
+  [sessionId, keys.sessionPrefix(), keys.logicalSessionIndexPrefix()]
+);
 var scriptSha1 = (script) => (0, import_node_crypto.createHash)("sha1").update(script).digest("hex");
 var NOSCRIPT_ERROR_PREFIX = "NOSCRIPT";
 var isNoScriptError = (error) => {
@@ -449,6 +687,7 @@ end
 return deleted
 `;
 var ROTATE_SESSION_SCRIPT = `
+${BINDING_VALIDATION_HELPER}
 local newValue = ARGV[1]
 local newExpiresAt = ARGV[2]
 local oldSessionId = ARGV[3]
@@ -462,6 +701,7 @@ local oldAliasValue = ARGV[10]
 local oldAliasExpiresAt = ARGV[11]
 local aliasIndexKey = ARGV[12]
 local aliasIndexKeyPrefix = ARGV[13]
+local expectedSource = cjson.decode(ARGV[14])
 
 local function assertStringOrMissing(key)
   local keyType = redis.call('TYPE', key)['ok']
@@ -520,6 +760,25 @@ if redis.call('EXISTS', KEYS[1]) == 0 then
   return 0
 end
 
+local ok, source = pcall(cjson.decode, redis.call('GET', KEYS[1]))
+local next = cjson.decode(newValue)
+if not ok or type(source) ~= 'table' or source['sessionId'] ~= oldSessionId
+  or not validBinding(source['deviceBinding']) or not validBinding(next['deviceBinding']) then return 3 end
+local sourceProvider = source['provider'] or {}
+local expectedProvider = expectedSource['provider'] or {}
+if type(sourceProvider) ~= 'table' or type(expectedProvider) ~= 'table' then return 3 end
+-- Source authority CAS protects immutable binding and index ownership from
+-- same-ID replacement between the application preflight and this script.
+if (source['logicalSessionId'] or oldSessionId) ~= (expectedSource['logicalSessionId'] or oldSessionId)
+  or source['subject'] ~= expectedSource['subject'] or source['providerSessionId'] ~= expectedSource['providerSessionId']
+  or sourceProvider['issuer'] ~= expectedProvider['issuer'] or sourceProvider['clientId'] ~= expectedProvider['clientId']
+  or source['refreshToken'] ~= expectedSource['refreshToken'] or source['idToken'] ~= expectedSource['idToken']
+  or source['accessToken'] ~= expectedSource['accessToken'] or source['scope'] ~= expectedSource['scope']
+  or source['createdAt'] ~= expectedSource['createdAt'] or source['updatedAt'] ~= expectedSource['updatedAt']
+  or source['expiresAt'] ~= expectedSource['expiresAt']
+  or not sameBinding(source['deviceBinding'], expectedSource['deviceBinding'])
+  or not sameBinding(source['deviceBinding'], next['deviceBinding']) then return 3 end
+
 if oldSessionId == newSessionId then
   return 2
 end
@@ -653,7 +912,8 @@ var buildRotateSessionCommand = (keys, previousSession, nextSession) => evalComm
     serialize(nextSession.logicalSessionId ?? nextSession.sessionId),
     serializeExpiresAt(nextSession.expiresAt),
     keys.rotatedSessionAliasIndex(nextSession.logicalSessionId ?? nextSession.sessionId),
-    keys.rotatedSessionAliasIndexPrefix()
+    keys.rotatedSessionAliasIndexPrefix(),
+    serialize(previousSession)
   ]
 );
 
@@ -699,7 +959,12 @@ var RedisOidcVaultStore = class {
   now;
   scriptRunner;
   indexCleanupCursor = "0";
+  dpopReplayMaxEntries;
   constructor(options) {
+    this.dpopReplayMaxEntries = options.dpopReplayMaxEntries === void 0 ? 1e5 : options.dpopReplayMaxEntries;
+    if (!Number.isSafeInteger(this.dpopReplayMaxEntries) || this.dpopReplayMaxEntries <= 0) {
+      throw new TypeError("OIDC vault DPoP replay maximum entries must be a positive safe integer.");
+    }
     if (typeof options.client.sendCommand !== "function") {
       throw new Error("Redis store client must implement sendCommand(args) for atomic vault operations.");
     }
@@ -714,24 +979,91 @@ var RedisOidcVaultStore = class {
     this.scriptRunner = new RedisScriptRunner(options.client);
   }
   async createAuthorizationTransaction(input) {
+    input = snapshotInput({ ...input });
+    assertRecordBinding(input);
     await this.setJson(this.keys.authorizationTransaction(input.state), input, input.expiresAt);
   }
   async consumeAuthorizationTransaction(state) {
-    return this.consumeJson(
+    const value = await this.runScript(
+      buildConsumeGuardedRecordCommand(this.keys.authorizationTransaction(state), "transaction", state)
+    );
+    return this.parseOneTimeRecord(
+      value,
+      "authorization transaction",
+      (value2) => validateAuthorizationTransaction(value2, state)
+    );
+  }
+  async getAuthorizationTransaction(state) {
+    return this.getJson(
       this.keys.authorizationTransaction(state),
       "authorization transaction",
-      (value) => validateAuthorizationTransaction(value, state)
+      (value) => validateAuthorizationTransaction(value, state),
+      { deleteMalformed: true, checkExpiry: true }
+    );
+  }
+  async consumeAuthorizationTransactionIfMatches(input) {
+    input = snapshotInput({ ...input });
+    if (!validateBindingMatch(input.match)) return null;
+    const value = await this.runScript(
+      buildConsumeGuardedRecordCommand(
+        this.keys.authorizationTransaction(input.state),
+        "transaction",
+        input.state,
+        input.match
+      )
+    );
+    return this.parseOneTimeRecord(
+      value,
+      "authorization transaction",
+      (value2) => validateAuthorizationTransaction(value2, input.state)
     );
   }
   async createExchangeCode(input) {
+    input = snapshotInput({ ...input });
+    assertRecordBinding(input);
     await this.setJson(this.keys.exchangeCode(input.code), input, input.expiresAt);
   }
   async consumeExchangeCode(code) {
-    return this.consumeJson(
+    const value = await this.runScript(
+      buildConsumeGuardedRecordCommand(this.keys.exchangeCode(code), "exchange", code)
+    );
+    return this.parseOneTimeRecord(value, "exchange code", (value2) => validateExchangeCodeRecord(value2, code));
+  }
+  async getExchangeCode(code) {
+    return this.getJson(
       this.keys.exchangeCode(code),
       "exchange code",
-      (value) => validateExchangeCodeRecord(value, code)
+      (value) => validateExchangeCodeRecord(value, code),
+      { deleteMalformed: true, checkExpiry: true }
+    );
+  }
+  async consumeExchangeCodeIfMatches(input) {
+    input = snapshotInput({ ...input });
+    if (!validateBindingMatch(input.match) || typeof input.expectedSessionId !== "string") return null;
+    const value = await this.runScript(
+      buildConsumeGuardedRecordCommand(
+        this.keys.exchangeCode(input.code),
+        "exchange",
+        input.code,
+        input.match,
+        input.expectedSessionId
+      )
     );
+    return this.parseOneTimeRecord(value, "exchange code", (value2) => validateExchangeCodeRecord(value2, input.code));
+  }
+  async getSessionRevocationContext(sessionId) {
+    const raw = await this.runScript(buildSessionRevocationContextCommand(this.keys, sessionId));
+    if (typeof raw !== "string") return null;
+    const context = JSON.parse(raw);
+    if (Array.isArray(context.provider) && context.provider.length === 0) context.provider = {};
+    return context;
+  }
+  async reserveDpopProof(input) {
+    input = { replayKey: input.replayKey, expiresAt: input.expiresAt };
+    if (typeof input.replayKey !== "string" || !Number.isSafeInteger(input.expiresAt)) return false;
+    const result = await this.runScript(buildReserveDpopProofCommand(this.keys, input, this.dpopReplayMaxEntries));
+    if (result === 2 || result === "2") throw new import_express_oidc_vault.OidcVaultDpopReplayCapacityError();
+    return result === 1 || result === "1";
   }
   /**
    * Creates a session record atomically, then runs best-effort index
@@ -749,6 +1081,7 @@ var RedisOidcVaultStore = class {
    */
   async createSession(input) {
     input = snapshotInput({ ...input });
+    assertSessionBinding(input);
     const timestamp = this.now();
     const session = {
       ...input,
@@ -770,6 +1103,7 @@ var RedisOidcVaultStore = class {
   }
   async rotateSession(input) {
     input = { sessionId: input.sessionId, nextSession: snapshotInput({ ...input.nextSession }) };
+    assertSessionBinding(input.nextSession);
     const previousSession = await this.getSession(input.sessionId);
     if (!previousSession) {
       throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
@@ -777,8 +1111,12 @@ var RedisOidcVaultStore = class {
     if (input.nextSession.sessionId === input.sessionId) {
       throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session rotation target must use a different session ID.");
     }
+    if (input.nextSession.deviceBinding !== void 0 && input.nextSession.deviceBinding.jkt !== previousSession.deviceBinding?.jkt) {
+      throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session rotation cannot change or add device binding.");
+    }
     const nextSession = {
       ...input.nextSession,
+      ...previousSession.deviceBinding === void 0 ? {} : { deviceBinding: { ...previousSession.deviceBinding } },
       logicalSessionId: input.nextSession.logicalSessionId ?? previousSession.logicalSessionId ?? previousSession.sessionId
     };
     const rotated = await this.rotateSessionRecord(previousSession, nextSession);
@@ -835,7 +1173,10 @@ var RedisOidcVaultStore = class {
   async getJson(key, recordKind, validate, options) {
     const raw = await this.client.get(key);
     try {
-      return parseStoredJson(raw, recordKind, validate);
+      const record = parseStoredJson(raw, recordKind, validate);
+      if (record !== null && options?.checkExpiry && isPlainRecord(record) && typeof record.expiresAt === "number" && record.expiresAt <= await this.redisServerTime())
+        return null;
+      return record;
     } catch (error) {
       if (options?.deleteMalformed && error instanceof OidcVaultRedisStoreRecordError && raw !== null) {
         await this.deleteMalformedValueIfUnchanged(key, raw);
@@ -844,8 +1185,7 @@ var RedisOidcVaultStore = class {
       throw error;
     }
   }
-  async consumeJson(key, recordKind, validate) {
-    const value = await this.sendCommand(["GETDEL", key]);
+  parseOneTimeRecord(value, recordKind, validate) {
     try {
       return typeof value === "string" ? parseStoredJson(value, recordKind, validate) : null;
     } catch (error) {
@@ -905,6 +1245,9 @@ var RedisOidcVaultStore = class {
     if (result === 2 || result === "2") {
       throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session rotation target already exists.");
     }
+    if (result === 3 || result === "3") {
+      throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session changed before rotation could commit.");
+    }
     return result === 1 || result === "1";
   }
   async runScript(command) {

package/index.mjs

@@ -1,6 +1,7 @@
 // src/index.ts
 import {
-  OidcVaultStoreConflictError
+  OidcVaultStoreConflictError,
+  OidcVaultDpopReplayCapacityError
 } from "@web-ts-toolkit/express-oidc-vault";
 
 // src/keys.ts
@@ -44,6 +45,9 @@ var RedisOidcVaultStoreKeys = class {
   backchannelLogoutTokenJti(jti) {
     return prefixKey(this.keyPrefix, "backchannel-logout-jti", jti);
   }
+  dpopProofs() {
+    return `${this.keyPrefix}:dpop-proofs`;
+  }
   rotatedSessionAliasIndex(logicalSessionId) {
     return prefixKey(this.keyPrefix, "rotated-session-alias-index", logicalSessionId);
   }
@@ -71,14 +75,27 @@ var OidcVaultRedisStoreRecordError = class extends Error {
 };
 var isPlainRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isString = (value) => typeof value === "string";
+var isBindingHash = (value) => typeof value === "string" && value.length === 43 && /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/.test(value);
+var validateDpopBinding = (value) => isPlainRecord(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null) && Object.keys(value).length === 2 && Object.hasOwn(value, "type") && Object.hasOwn(value, "jkt") && value.type === "dpop" && isBindingHash(value.jkt);
+var validateRecordBinding = (record) => (record.deviceBinding === void 0 || validateDpopBinding(record.deviceBinding)) && (record.browserBindingHash === void 0 || isBindingHash(record.browserBindingHash)) && (record.deviceBinding === void 0 || record.browserBindingHash !== void 0);
+var validateBindingMatch = (value) => isPlainRecord(value) && Object.hasOwn(value, "deviceBinding") && Object.hasOwn(value, "browserBindingHash") && (value.deviceBinding === null || validateDpopBinding(value.deviceBinding)) && (value.browserBindingHash === null || isBindingHash(value.browserBindingHash));
+var assertRecordBinding = (record) => {
+  if (!validateRecordBinding(record))
+    throw new TypeError("OIDC vault store record has invalid device/browser binding.");
+};
+var assertSessionBinding = (record) => {
+  if (record.deviceBinding !== void 0 && !validateDpopBinding(record.deviceBinding)) {
+    throw new TypeError("OIDC vault store session has invalid device binding.");
+  }
+};
 var isOptionalString = (value) => value === void 0 || isString(value);
 var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);
 var isOptionalFiniteNumber = (value) => value === void 0 || isFiniteNumber(value);
 var isStringRecord = (value) => isPlainRecord(value);
-var validateAuthorizationTransaction = (value, state) => isPlainRecord(value) && isString(value.state) && value.state === state && isString(value.nonce) && isString(value.pkceVerifier) && isString(value.codeChallenge) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt) && (value.metadata === void 0 || isStringRecord(value.metadata));
-var validateExchangeCodeRecord = (value, code) => isPlainRecord(value) && isString(value.code) && value.code === code && isString(value.sessionId) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt);
+var validateAuthorizationTransaction = (value, state) => isPlainRecord(value) && isString(value.state) && value.state === state && isString(value.nonce) && isString(value.pkceVerifier) && isString(value.codeChallenge) && validateRecordBinding(value) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt) && (value.metadata === void 0 || isStringRecord(value.metadata));
+var validateExchangeCodeRecord = (value, code) => isPlainRecord(value) && isString(value.code) && value.code === code && isString(value.sessionId) && validateRecordBinding(value) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt);
 var validateProviderMetadata = (value) => value === void 0 || isPlainRecord(value) && isOptionalString(value.issuer) && isOptionalString(value.clientId);
-var validateSession = (value, sessionId) => isPlainRecord(value) && isString(value.sessionId) && value.sessionId === sessionId && isOptionalString(value.logicalSessionId) && isString(value.subject) && isOptionalString(value.providerSessionId) && validateProviderMetadata(value.provider) && isString(value.refreshToken) && isString(value.idToken) && isOptionalString(value.accessToken) && isOptionalString(value.scope) && isOptionalFiniteNumber(value.expiresAt) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.updatedAt) && (value.user === void 0 || isPlainRecord(value.user)) && (value.metadata === void 0 || isPlainRecord(value.metadata));
+var validateSession = (value, sessionId) => isPlainRecord(value) && isString(value.sessionId) && value.sessionId === sessionId && isOptionalString(value.logicalSessionId) && isString(value.subject) && isOptionalString(value.providerSessionId) && validateProviderMetadata(value.provider) && (value.deviceBinding === void 0 || validateDpopBinding(value.deviceBinding)) && isString(value.refreshToken) && isString(value.idToken) && isOptionalString(value.accessToken) && isOptionalString(value.scope) && isOptionalFiniteNumber(value.expiresAt) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.updatedAt) && (value.user === void 0 || isPlainRecord(value.user)) && (value.metadata === void 0 || isPlainRecord(value.metadata));
 var parseStoredJson = (value, recordKind, validate) => {
   if (value === null) {
     return null;
@@ -107,6 +124,228 @@ var evalCommand = (script, keys, args) => [
   ...keys,
   ...args
 ];
+var BINDING_VALIDATION_HELPER = `
+local function isHash(value)
+  return type(value) == 'string' and #value == 43
+    and string.match(value, '^[A-Za-z0-9_-]+$') ~= nil
+    and string.match(string.sub(value, 43), '^[AEIMQUYcgkosw048]$') ~= nil
+end
+local function isBinding(value)
+  if type(value) ~= 'table' or value['type'] ~= 'dpop' or not isHash(value['jkt']) then return false end
+  local count = 0
+  for key, _ in pairs(value) do
+    if key ~= 'type' and key ~= 'jkt' then return false end
+    count = count + 1
+  end
+  return count == 2
+end
+local function validBinding(value)
+  return value == nil or isBinding(value)
+end
+local function validRecordBinding(record)
+  return validBinding(record['deviceBinding'])
+    and (record['browserBindingHash'] == nil or isHash(record['browserBindingHash']))
+    and (record['deviceBinding'] == nil or record['browserBindingHash'] ~= nil)
+end
+local function sameBinding(left, right)
+  if left == nil or right == nil then return left == right end
+  return isBinding(left) and isBinding(right) and left['jkt'] == right['jkt']
+end
+local function optionalString(value)
+  return value == nil or type(value) == 'string'
+end
+local function finiteNumber(value)
+  return type(value) == 'number' and value == value and value > -math.huge and value < math.huge
+end
+local function serverNow()
+  local time = redis.call('TIME')
+  return tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+end
+-- cjson decodes both {} and [] to a Lua table. Inspect the top-level value's
+-- lexical kind so an empty provider array cannot masquerade as legacy {}.
+-- Skip strings/escapes and nested containers; duplicate keys use the last
+-- occurrence, matching cjson/JSON.parse. No credential values are returned.
+local function optionalObjectField(raw, wanted)
+  local depth, position, shape = 0, 1, nil
+  while position <= #raw do
+    local char = string.sub(raw, position, position)
+    if char == '"' then
+      local start = position
+      position = position + 1
+      while position <= #raw do
+        local current = string.sub(raw, position, position)
+        if current == '\\\\' then position = position + 2
+        elseif current == '"' then break
+        else position = position + 1 end
+      end
+      if depth == 1 then
+        local after = position + 1
+        while string.match(string.sub(raw, after, after), '%s') do after = after + 1 end
+        if string.sub(raw, after, after) == ':' and cjson.decode(string.sub(raw, start, position)) == wanted then
+          after = after + 1
+          while string.match(string.sub(raw, after, after), '%s') do after = after + 1 end
+          shape = string.sub(raw, after, after)
+        end
+      end
+    elseif char == '{' or char == '[' then depth = depth + 1
+    elseif char == '}' or char == ']' then depth = depth - 1 end
+    position = position + 1
+  end
+  return shape == nil or shape == '{'
+end
+`;
+var CONSUME_GUARDED_RECORD_SCRIPT = `
+${BINDING_VALIDATION_HELPER}
+local raw = redis.call('GET', KEYS[1])
+if raw == false then return false end
+local ok, record = pcall(cjson.decode, raw)
+local kind = ARGV[1]
+local valid = ok and type(record) == 'table' and validRecordBinding(record)
+if valid then
+  valid = optionalString(record['returnTo']) and finiteNumber(record['createdAt']) and finiteNumber(record['expiresAt'])
+  if kind == 'transaction' then
+    valid = valid and record['state'] == ARGV[2] and type(record['nonce']) == 'string'
+      and type(record['pkceVerifier']) == 'string' and type(record['codeChallenge']) == 'string'
+      and (record['metadata'] == nil or type(record['metadata']) == 'table')
+  else
+    valid = valid and record['code'] == ARGV[2] and type(record['sessionId']) == 'string'
+  end
+end
+if not valid then
+  redis.call('DEL', KEYS[1])
+  return false
+end
+-- Legacy consumes preserve the historical Redis key-TTL policy. Guarded
+-- consumes additionally check payload expiry with server time (D5).
+if ARGV[3] ~= 'legacy' and record['expiresAt'] <= serverNow() then
+  redis.call('DEL', KEYS[1])
+  return false
+end
+if ARGV[3] == 'legacy' then
+  if record['deviceBinding'] ~= nil or record['browserBindingHash'] ~= nil then return false end
+else
+  local match = cjson.decode(ARGV[4])
+  if (match['deviceBinding'] ~= cjson.null and not isBinding(match['deviceBinding']))
+    or (match['browserBindingHash'] ~= cjson.null and not isHash(match['browserBindingHash'])) then return false end
+  if match['deviceBinding'] == cjson.null then
+    if record['deviceBinding'] ~= nil then return false end
+  elseif not sameBinding(record['deviceBinding'], match['deviceBinding']) then return false end
+  if match['browserBindingHash'] == cjson.null then
+    if record['browserBindingHash'] ~= nil then return false end
+  elseif record['browserBindingHash'] ~= match['browserBindingHash'] then return false end
+  if kind == 'exchange' and record['sessionId'] ~= ARGV[5] then return false end
+end
+redis.call('DEL', KEYS[1])
+return raw
+`;
+var buildConsumeGuardedRecordCommand = (key, kind, id, match, expectedSessionId) => evalCommand(
+  CONSUME_GUARDED_RECORD_SCRIPT,
+  [key],
+  [
+    kind,
+    id,
+    match === void 0 ? "legacy" : "guarded",
+    match === void 0 ? "" : serialize(match),
+    expectedSessionId ?? ""
+  ]
+);
+var RESERVE_DPOP_PROOF_SCRIPT = `
+${BINDING_VALIDATION_HELPER}
+local expiresAt = tonumber(ARGV[2])
+local now = serverNow()
+if not finiteNumber(expiresAt) or expiresAt ~= math.floor(expiresAt) or expiresAt > 9007199254740991
+  or expiresAt <= now or expiresAt - now > 360000 then return 0 end
+local keyType = redis.call('TYPE', KEYS[1])['ok']
+if keyType ~= 'none' and keyType ~= 'zset' then error('OIDC vault Redis replay key has unexpected type') end
+local existing = redis.call('ZSCORE', KEYS[1], ARGV[1])
+if existing ~= false and tonumber(existing) > now then return 0 end
+-- Hard LIMIT, not SCAN's hint: at most 64 expired entries per admission.
+local expired = redis.call('ZRANGEBYSCORE', KEYS[1], '-inf', now, 'LIMIT', 0, 64)
+if #expired > 0 then redis.call('ZREM', KEYS[1], unpack(expired)) end
+if existing ~= false then redis.call('ZREM', KEYS[1], ARGV[1]) end
+if redis.call('ZCARD', KEYS[1]) >= tonumber(ARGV[3]) then return 2 end
+redis.call('ZADD', KEYS[1], expiresAt, ARGV[1])
+-- Reclaim the whole set if traffic stops after its last retained expiry.
+local last = redis.call('ZREVRANGE', KEYS[1], 0, 0, 'WITHSCORES')
+redis.call('PEXPIREAT', KEYS[1], last[2])
+return 1
+`;
+var buildReserveDpopProofCommand = (keys, input, maxEntries) => evalCommand(
+  RESERVE_DPOP_PROOF_SCRIPT,
+  [keys.dpopProofs()],
+  [input.replayKey, String(input.expiresAt), String(maxEntries)]
+);
+var SESSION_REVOCATION_CONTEXT_SCRIPT = `
+${BINDING_VALIDATION_HELPER}
+local now = serverNow()
+local handle = ARGV[1]
+local sessionPrefix = ARGV[2]
+local logicalPrefix = ARGV[3]
+local function authority(raw, id)
+  local ok, record = pcall(cjson.decode, raw)
+  if not ok or type(record) ~= 'table' or record['sessionId'] ~= id
+    or not optionalString(record['logicalSessionId']) or type(record['subject']) ~= 'string'
+    or not validBinding(record['deviceBinding']) then error('OIDC vault Redis lineage has malformed session authority') end
+  local provider = record['provider']
+  if not optionalObjectField(raw, 'provider') or (provider ~= nil and (type(provider) ~= 'table' or not optionalString(provider['issuer'])
+    or not optionalString(provider['clientId']))) then error('OIDC vault Redis lineage has malformed provider identity') end
+  local expiry = record['expiresAt']
+  if expiry ~= nil and not finiteNumber(expiry) then error('OIDC vault Redis lineage has malformed session expiry') end
+  if expiry ~= nil and expiry <= now then return nil end
+  return record
+end
+local logicalId = nil
+local source = nil
+local primary = redis.call('GET', KEYS[1])
+if primary ~= false then
+  local record = authority(primary, handle)
+  if record ~= nil then
+    logicalId = record['logicalSessionId'] or handle
+    -- The directly observed live handle must participate even if its reverse
+    -- index membership was corrupted; never infer unboundness from peers alone.
+    source = record
+  end
+end
+if logicalId == nil then
+  local alias = redis.call('GET', KEYS[2])
+  if alias == false then return false end
+  local ok, decoded = pcall(cjson.decode, alias)
+  if not ok or type(decoded) ~= 'string' then error('OIDC vault Redis store has malformed revocation alias') end
+  logicalId = decoded
+end
+local members = redis.call('ZRANGE', logicalPrefix .. logicalId, 0, -1)
+for _, id in ipairs(members) do
+  local raw = redis.call('GET', sessionPrefix .. id)
+  if raw ~= false then
+    local member = authority(raw, id)
+    if member ~= nil and (member['logicalSessionId'] or id) == logicalId then
+      if source ~= nil then
+        local left = source['provider'] or {}
+        local right = member['provider'] or {}
+        if not sameBinding(source['deviceBinding'], member['deviceBinding']) or source['subject'] ~= member['subject']
+          or left['issuer'] ~= right['issuer'] or left['clientId'] ~= right['clientId'] then
+          error('OIDC vault Redis lineage has inconsistent device binding or provider identity')
+        end
+      else source = member end
+    end
+  end
+end
+if source == nil then return false end
+local result = { logicalSessionId = logicalId }
+if source['deviceBinding'] ~= nil then result['deviceBinding'] = source['deviceBinding'] end
+if source['provider'] ~= nil then
+  local provider = {}
+  provider['issuer'] = source['provider']['issuer']
+  provider['clientId'] = source['provider']['clientId']
+  result['provider'] = provider
+end
+return cjson.encode(result)
+`;
+var buildSessionRevocationContextCommand = (keys, sessionId) => evalCommand(
+  SESSION_REVOCATION_CONTEXT_SCRIPT,
+  [keys.session(sessionId), keys.rotatedSessionAlias(sessionId)],
+  [sessionId, keys.sessionPrefix(), keys.logicalSessionIndexPrefix()]
+);
 var scriptSha1 = (script) => createHash("sha1").update(script).digest("hex");
 var NOSCRIPT_ERROR_PREFIX = "NOSCRIPT";
 var isNoScriptError = (error) => {
@@ -426,6 +665,7 @@ end
 return deleted
 `;
 var ROTATE_SESSION_SCRIPT = `
+${BINDING_VALIDATION_HELPER}
 local newValue = ARGV[1]
 local newExpiresAt = ARGV[2]
 local oldSessionId = ARGV[3]
@@ -439,6 +679,7 @@ local oldAliasValue = ARGV[10]
 local oldAliasExpiresAt = ARGV[11]
 local aliasIndexKey = ARGV[12]
 local aliasIndexKeyPrefix = ARGV[13]
+local expectedSource = cjson.decode(ARGV[14])
 
 local function assertStringOrMissing(key)
   local keyType = redis.call('TYPE', key)['ok']
@@ -497,6 +738,25 @@ if redis.call('EXISTS', KEYS[1]) == 0 then
   return 0
 end
 
+local ok, source = pcall(cjson.decode, redis.call('GET', KEYS[1]))
+local next = cjson.decode(newValue)
+if not ok or type(source) ~= 'table' or source['sessionId'] ~= oldSessionId
+  or not validBinding(source['deviceBinding']) or not validBinding(next['deviceBinding']) then return 3 end
+local sourceProvider = source['provider'] or {}
+local expectedProvider = expectedSource['provider'] or {}
+if type(sourceProvider) ~= 'table' or type(expectedProvider) ~= 'table' then return 3 end
+-- Source authority CAS protects immutable binding and index ownership from
+-- same-ID replacement between the application preflight and this script.
+if (source['logicalSessionId'] or oldSessionId) ~= (expectedSource['logicalSessionId'] or oldSessionId)
+  or source['subject'] ~= expectedSource['subject'] or source['providerSessionId'] ~= expectedSource['providerSessionId']
+  or sourceProvider['issuer'] ~= expectedProvider['issuer'] or sourceProvider['clientId'] ~= expectedProvider['clientId']
+  or source['refreshToken'] ~= expectedSource['refreshToken'] or source['idToken'] ~= expectedSource['idToken']
+  or source['accessToken'] ~= expectedSource['accessToken'] or source['scope'] ~= expectedSource['scope']
+  or source['createdAt'] ~= expectedSource['createdAt'] or source['updatedAt'] ~= expectedSource['updatedAt']
+  or source['expiresAt'] ~= expectedSource['expiresAt']
+  or not sameBinding(source['deviceBinding'], expectedSource['deviceBinding'])
+  or not sameBinding(source['deviceBinding'], next['deviceBinding']) then return 3 end
+
 if oldSessionId == newSessionId then
   return 2
 end
@@ -630,7 +890,8 @@ var buildRotateSessionCommand = (keys, previousSession, nextSession) => evalComm
     serialize(nextSession.logicalSessionId ?? nextSession.sessionId),
     serializeExpiresAt(nextSession.expiresAt),
     keys.rotatedSessionAliasIndex(nextSession.logicalSessionId ?? nextSession.sessionId),
-    keys.rotatedSessionAliasIndexPrefix()
+    keys.rotatedSessionAliasIndexPrefix(),
+    serialize(previousSession)
   ]
 );
 
@@ -676,7 +937,12 @@ var RedisOidcVaultStore = class {
   now;
   scriptRunner;
   indexCleanupCursor = "0";
+  dpopReplayMaxEntries;
   constructor(options) {
+    this.dpopReplayMaxEntries = options.dpopReplayMaxEntries === void 0 ? 1e5 : options.dpopReplayMaxEntries;
+    if (!Number.isSafeInteger(this.dpopReplayMaxEntries) || this.dpopReplayMaxEntries <= 0) {
+      throw new TypeError("OIDC vault DPoP replay maximum entries must be a positive safe integer.");
+    }
     if (typeof options.client.sendCommand !== "function") {
       throw new Error("Redis store client must implement sendCommand(args) for atomic vault operations.");
     }
@@ -691,24 +957,91 @@ var RedisOidcVaultStore = class {
     this.scriptRunner = new RedisScriptRunner(options.client);
   }
   async createAuthorizationTransaction(input) {
+    input = snapshotInput({ ...input });
+    assertRecordBinding(input);
     await this.setJson(this.keys.authorizationTransaction(input.state), input, input.expiresAt);
   }
   async consumeAuthorizationTransaction(state) {
-    return this.consumeJson(
+    const value = await this.runScript(
+      buildConsumeGuardedRecordCommand(this.keys.authorizationTransaction(state), "transaction", state)
+    );
+    return this.parseOneTimeRecord(
+      value,
+      "authorization transaction",
+      (value2) => validateAuthorizationTransaction(value2, state)
+    );
+  }
+  async getAuthorizationTransaction(state) {
+    return this.getJson(
       this.keys.authorizationTransaction(state),
       "authorization transaction",
-      (value) => validateAuthorizationTransaction(value, state)
+      (value) => validateAuthorizationTransaction(value, state),
+      { deleteMalformed: true, checkExpiry: true }
+    );
+  }
+  async consumeAuthorizationTransactionIfMatches(input) {
+    input = snapshotInput({ ...input });
+    if (!validateBindingMatch(input.match)) return null;
+    const value = await this.runScript(
+      buildConsumeGuardedRecordCommand(
+        this.keys.authorizationTransaction(input.state),
+        "transaction",
+        input.state,
+        input.match
+      )
+    );
+    return this.parseOneTimeRecord(
+      value,
+      "authorization transaction",
+      (value2) => validateAuthorizationTransaction(value2, input.state)
     );
   }
   async createExchangeCode(input) {
+    input = snapshotInput({ ...input });
+    assertRecordBinding(input);
     await this.setJson(this.keys.exchangeCode(input.code), input, input.expiresAt);
   }
   async consumeExchangeCode(code) {
-    return this.consumeJson(
+    const value = await this.runScript(
+      buildConsumeGuardedRecordCommand(this.keys.exchangeCode(code), "exchange", code)
+    );
+    return this.parseOneTimeRecord(value, "exchange code", (value2) => validateExchangeCodeRecord(value2, code));
+  }
+  async getExchangeCode(code) {
+    return this.getJson(
       this.keys.exchangeCode(code),
       "exchange code",
-      (value) => validateExchangeCodeRecord(value, code)
+      (value) => validateExchangeCodeRecord(value, code),
+      { deleteMalformed: true, checkExpiry: true }
+    );
+  }
+  async consumeExchangeCodeIfMatches(input) {
+    input = snapshotInput({ ...input });
+    if (!validateBindingMatch(input.match) || typeof input.expectedSessionId !== "string") return null;
+    const value = await this.runScript(
+      buildConsumeGuardedRecordCommand(
+        this.keys.exchangeCode(input.code),
+        "exchange",
+        input.code,
+        input.match,
+        input.expectedSessionId
+      )
     );
+    return this.parseOneTimeRecord(value, "exchange code", (value2) => validateExchangeCodeRecord(value2, input.code));
+  }
+  async getSessionRevocationContext(sessionId) {
+    const raw = await this.runScript(buildSessionRevocationContextCommand(this.keys, sessionId));
+    if (typeof raw !== "string") return null;
+    const context = JSON.parse(raw);
+    if (Array.isArray(context.provider) && context.provider.length === 0) context.provider = {};
+    return context;
+  }
+  async reserveDpopProof(input) {
+    input = { replayKey: input.replayKey, expiresAt: input.expiresAt };
+    if (typeof input.replayKey !== "string" || !Number.isSafeInteger(input.expiresAt)) return false;
+    const result = await this.runScript(buildReserveDpopProofCommand(this.keys, input, this.dpopReplayMaxEntries));
+    if (result === 2 || result === "2") throw new OidcVaultDpopReplayCapacityError();
+    return result === 1 || result === "1";
   }
   /**
    * Creates a session record atomically, then runs best-effort index
@@ -726,6 +1059,7 @@ var RedisOidcVaultStore = class {
    */
   async createSession(input) {
     input = snapshotInput({ ...input });
+    assertSessionBinding(input);
     const timestamp = this.now();
     const session = {
       ...input,
@@ -747,6 +1081,7 @@ var RedisOidcVaultStore = class {
   }
   async rotateSession(input) {
     input = { sessionId: input.sessionId, nextSession: snapshotInput({ ...input.nextSession }) };
+    assertSessionBinding(input.nextSession);
     const previousSession = await this.getSession(input.sessionId);
     if (!previousSession) {
       throw new OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
@@ -754,8 +1089,12 @@ var RedisOidcVaultStore = class {
     if (input.nextSession.sessionId === input.sessionId) {
       throw new OidcVaultStoreConflictError("OIDC vault session rotation target must use a different session ID.");
     }
+    if (input.nextSession.deviceBinding !== void 0 && input.nextSession.deviceBinding.jkt !== previousSession.deviceBinding?.jkt) {
+      throw new OidcVaultStoreConflictError("OIDC vault session rotation cannot change or add device binding.");
+    }
     const nextSession = {
       ...input.nextSession,
+      ...previousSession.deviceBinding === void 0 ? {} : { deviceBinding: { ...previousSession.deviceBinding } },
       logicalSessionId: input.nextSession.logicalSessionId ?? previousSession.logicalSessionId ?? previousSession.sessionId
     };
     const rotated = await this.rotateSessionRecord(previousSession, nextSession);
@@ -812,7 +1151,10 @@ var RedisOidcVaultStore = class {
   async getJson(key, recordKind, validate, options) {
     const raw = await this.client.get(key);
     try {
-      return parseStoredJson(raw, recordKind, validate);
+      const record = parseStoredJson(raw, recordKind, validate);
+      if (record !== null && options?.checkExpiry && isPlainRecord(record) && typeof record.expiresAt === "number" && record.expiresAt <= await this.redisServerTime())
+        return null;
+      return record;
     } catch (error) {
       if (options?.deleteMalformed && error instanceof OidcVaultRedisStoreRecordError && raw !== null) {
         await this.deleteMalformedValueIfUnchanged(key, raw);
@@ -821,8 +1163,7 @@ var RedisOidcVaultStore = class {
       throw error;
     }
   }
-  async consumeJson(key, recordKind, validate) {
-    const value = await this.sendCommand(["GETDEL", key]);
+  parseOneTimeRecord(value, recordKind, validate) {
     try {
       return typeof value === "string" ? parseStoredJson(value, recordKind, validate) : null;
     } catch (error) {
@@ -882,6 +1223,9 @@ var RedisOidcVaultStore = class {
     if (result === 2 || result === "2") {
       throw new OidcVaultStoreConflictError("OIDC vault session rotation target already exists.");
     }
+    if (result === 3 || result === "3") {
+      throw new OidcVaultStoreConflictError("OIDC vault session changed before rotation could commit.");
+    }
     return result === 1 || result === "1";
   }
   async runScript(command) {

package/package.json

@@ -2,7 +2,7 @@
   "name": "@web-ts-toolkit/express-oidc-vault-redis-store",
   "description": "Redis store provider for @web-ts-toolkit/express-oidc-vault",
   "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/express-oidc-vault-redis-store",
-  "version": "0.47.1",
+  "version": "0.49.0",
   "sideEffects": false,
   "keywords": [
     "express",
@@ -26,10 +26,10 @@
     }
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=22.12.0"
   },
   "dependencies": {
-    "@web-ts-toolkit/express-oidc-vault": "0.47.1"
+    "@web-ts-toolkit/express-oidc-vault": "0.49.0"
   },
   "files": [
     "**/*",