@web-ts-toolkit/express-oidc-vault-redis-store 0.53.0 → 0.54.0

package/README.md

@@ -172,6 +172,20 @@ Rotation inherits omitted binding, accepts the same key, and rejects null/malfor
 
 `getSessionRevocationContext` resolves a live handle or unexpired alias and all live members of its current lineage inside one Lua snapshot. A directly observed live handle always participates even if its reverse-index membership is missing, so peers cannot make that bound handle appear unbound. It returns only `logicalSessionId`, allowlisted `provider.issuer/clientId`, and optional original `deviceBinding`; no tokens/profile/metadata/arbitrary provider fields leave Redis. Alias payloads still contain only their logical ID: absence of an alias binding never means an unbound lineage. Malformed/inconsistent binding/provider authority throws a fixed diagnostic. Expired aliases/empty lineages return `null`, and `getSession(alias)` remains `null`. This call materializes the whole logical-member set and reads member primaries inside Lua; large lineages remain scale-dependent server work.
 
+## Dedicated Logout Continuation Tickets
+
+The inferred factory result also satisfies core `OidcVaultLogoutNavigationStoreProvider`, requiring `createLogoutNavigationTicket` / `consumeLogoutNavigationTicket` alongside the separate device-binding capability. Import ticket/create/consume types and `OidcVaultLogoutNavigationCapacityError` from the **core root**. Both methods remain optional on the base custom-store contract; this storage extension does not register HTTP routes.
+
+`logoutNavigationMaxEntries` is a positive safe integer, default **10000**, shared across effective ticket namespaces in one `keyPrefix`, independent of replay. First successful create persists the limit in **`<keyPrefix>:logout-navigation-capacity`** (constant-size, no expiry). Ticket operations reject a different configured limit. Unknown consumes create no configuration or per-request keys. Payloads are **`<keyPrefix>:logout-navigation-ticket:<namespace>:<ticketHash>`**, written with absolute **PXAT**. The bounded expiry/capacity ZSET is **`<keyPrefix>:logout-navigation-expiries`**; its members contain only namespace/hash identities, never URLs.
+
+Native Lua uses server **TIME**, validates touched key types/configuration/accounting before writes, checks live collision before ZCARD capacity, then atomically updates payload/index membership. Live collision throws `OidcVaultStoreConflictError` without replacement/extension. Capacity throws `OidcVaultLogoutNavigationCapacityError`, never evicting live grants. Each operation retires its selected entry plus at most **64 unrelated expiries**. A live index entry protects an early-disappeared payload identity from reuse; consume retires it and returns null, freeing capacity once. Payload TTL does not lose index accounting. A ZSET with a live deadline expires at its latest retained deadline. If consuming the last live grant leaves only overdue accounting, the script retains that bounded ledger for later cleanup instead of expiring more than 64 entries synchronously; it can remain idle. Payloads still expire independently, and no live window is extended.
+
+Exactly five scalar fields are captured before awaits and returned detached: `namespace`, `ticketHash`, `upstreamLogoutUrl`, `createdAt`, `expiresAt`. Core's README defines canonical scope/hash formats, 256-bit ticket generation, Date-range integer epochs, original TTL 1000..120000 ms, remaining TTL >0 and <=120000 ms, and 16384-byte HTTP(S) URL syntax. Invalid creates throw TypeError; invalid/unknown/spent/expired/malformed selected consumes return null and retire selected unusable data. Backend/configuration/accounting/wrong-type failures throw, never successful grants. Injected application `now` is not used for ticket expiry. URL validation is repeated after native atomic retirement; invalid destinations never become grants.
+
+The existing cached-script runner performs only its definite NOSCRIPT load/retry; arbitrary transport failures are not retried and may follow commit. Provision script ACLs for **SET/PXAT and PERSIST**, as well as TIME/TYPE/GET/DEL/ZSCORE/ZRANGEBYSCORE/ZREM/ZCARD/ZADD/ZREVRANGE/PEXPIREAT. Client connection/shutdown stays caller-owned; standalone and acquired/wrapped Sentinel master scope remains, with no Cluster support added.
+
+The final URL can retain an ID-token hint; hashing does not encrypt it. No raw ticket, full session/profile, handle/subject or separate tokens are stored. Exclude records/URLs and arbitrary backend errors from logs. Session/lineage/backchannel deletion does not cascade to authorized tickets. Existing identity, alias, rotation, replay and failover-durability boundaries remain intact.
+
 ## Per-Request DPoP Replay And Capacity
 
 | Redis option           | Default      | Contract                                                                |

package/index.d.mts

@@ -1,4 +1,4 @@
-import { OidcVaultDeviceBindingStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
+import { OidcVaultDeviceBindingStoreProvider, OidcVaultLogoutNavigationStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
 
 /**
  * Thrown when a stored Redis value cannot be parsed or fails structural
@@ -59,6 +59,8 @@ interface OidcVaultRedisClient {
  * `disconnect()`). The package never calls `connect`, `quit`, or `disconnect`.
  */
 interface RedisOidcVaultStoreOptions {
+    /** Independent ticket cap across effective namespaces per keyPrefix; positive safe integer, default 10000. */
+    logoutNavigationMaxEntries?: number;
     /** Positive safe integer per shared keyPrefix; default 100000. Configure identically on all clients. */
     dpopReplayMaxEntries?: number;
     /** Connected Redis client or compatible adapter implementing {@link OidcVaultRedisClient}. */
@@ -92,10 +94,12 @@ interface RedisOidcVaultStoreOptions {
  * not supported and is rejected here. Guarded consumes and per-proof replay use
  * cached atomic Lua; replay is shared per keyPrefix, uses server TIME, and never
  * evicts live entries. All clients must use the same dpopReplayMaxEntries.
+ * Dedicated logout continuation tickets also use native atomic scripts and
+ * server TIME, with independent logoutNavigationMaxEntries (default 10000).
  *
  * @param options construction options; see {@link RedisOidcVaultStoreOptions}.
- * @returns a provider satisfying the stronger `OidcVaultDeviceBindingStoreProvider` contract.
+ * @returns a provider satisfying both device-binding and logout-navigation capabilities.
  */
-declare function createRedisOidcVaultStore(options: RedisOidcVaultStoreOptions): OidcVaultDeviceBindingStoreProvider;
+declare function createRedisOidcVaultStore(options: RedisOidcVaultStoreOptions): OidcVaultDeviceBindingStoreProvider & OidcVaultLogoutNavigationStoreProvider;
 
 export { type OidcVaultRedisClient, OidcVaultRedisStoreRecordError, type RedisOidcVaultStoreOptions, createRedisOidcVaultStore };

package/index.d.ts

@@ -1,4 +1,4 @@
-import { OidcVaultDeviceBindingStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
+import { OidcVaultDeviceBindingStoreProvider, OidcVaultLogoutNavigationStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
 
 /**
  * Thrown when a stored Redis value cannot be parsed or fails structural
@@ -59,6 +59,8 @@ interface OidcVaultRedisClient {
  * `disconnect()`). The package never calls `connect`, `quit`, or `disconnect`.
  */
 interface RedisOidcVaultStoreOptions {
+    /** Independent ticket cap across effective namespaces per keyPrefix; positive safe integer, default 10000. */
+    logoutNavigationMaxEntries?: number;
     /** Positive safe integer per shared keyPrefix; default 100000. Configure identically on all clients. */
     dpopReplayMaxEntries?: number;
     /** Connected Redis client or compatible adapter implementing {@link OidcVaultRedisClient}. */
@@ -92,10 +94,12 @@ interface RedisOidcVaultStoreOptions {
  * not supported and is rejected here. Guarded consumes and per-proof replay use
  * cached atomic Lua; replay is shared per keyPrefix, uses server TIME, and never
  * evicts live entries. All clients must use the same dpopReplayMaxEntries.
+ * Dedicated logout continuation tickets also use native atomic scripts and
+ * server TIME, with independent logoutNavigationMaxEntries (default 10000).
  *
  * @param options construction options; see {@link RedisOidcVaultStoreOptions}.
- * @returns a provider satisfying the stronger `OidcVaultDeviceBindingStoreProvider` contract.
+ * @returns a provider satisfying both device-binding and logout-navigation capabilities.
  */
-declare function createRedisOidcVaultStore(options: RedisOidcVaultStoreOptions): OidcVaultDeviceBindingStoreProvider;
+declare function createRedisOidcVaultStore(options: RedisOidcVaultStoreOptions): OidcVaultDeviceBindingStoreProvider & OidcVaultLogoutNavigationStoreProvider;
 
 export { type OidcVaultRedisClient, OidcVaultRedisStoreRecordError, type RedisOidcVaultStoreOptions, createRedisOidcVaultStore };

package/index.js

@@ -70,6 +70,18 @@ var RedisOidcVaultStoreKeys = class {
   dpopProofs() {
     return `${this.keyPrefix}:dpop-proofs`;
   }
+  logoutNavigationTicket(id) {
+    return this.logoutNavigationTicketPrefix() + id;
+  }
+  logoutNavigationTicketPrefix() {
+    return `${this.keyPrefix}:logout-navigation-ticket:`;
+  }
+  logoutNavigationExpiries() {
+    return `${this.keyPrefix}:logout-navigation-expiries`;
+  }
+  logoutNavigationCapacity() {
+    return `${this.keyPrefix}:logout-navigation-capacity`;
+  }
   rotatedSessionAliasIndex(logicalSessionId) {
     return prefixKey(this.keyPrefix, "rotated-session-alias-index", logicalSessionId);
   }
@@ -87,6 +99,160 @@ var RedisOidcVaultStoreKeys = class {
   }
 };
 
+// src/logout-ticket-validation.ts
+var HASH = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+var PREFIX = "logout-navigation:v1:";
+var UNSAFE_URL = /[\s\\\u0000-\u001f\u007f-\u009f]/u;
+var usableEpoch = (value) => typeof value === "number" && Number.isSafeInteger(value) && Math.abs(value) <= 864e13;
+var captureTicketIdentity = (input) => ({
+  namespace: input?.namespace,
+  ticketHash: input?.ticketHash
+});
+var validTicketIdentity = (input) => typeof input.namespace === "string" && input.namespace.startsWith(PREFIX) && HASH.test(input.namespace.slice(PREFIX.length)) && typeof input.ticketHash === "string" && HASH.test(input.ticketHash);
+var captureTicket = (input) => ({
+  ...captureTicketIdentity(input),
+  upstreamLogoutUrl: input?.upstreamLogoutUrl,
+  createdAt: input?.createdAt,
+  expiresAt: input?.expiresAt
+});
+var validTicket = (record, now) => {
+  if (!record || typeof record !== "object" || Array.isArray(record) || Object.keys(record).length !== 5 || !validTicketIdentity(record) || !usableEpoch(record.createdAt) || !usableEpoch(record.expiresAt) || record.expiresAt - record.createdAt < 1e3 || record.expiresAt - record.createdAt > 12e4 || now !== void 0 && (record.expiresAt <= now || record.expiresAt - now > 12e4) || typeof record.upstreamLogoutUrl !== "string" || !/^https?:\/\//i.test(record.upstreamLogoutUrl) || /^https?:\/\/[^/?#]*@/i.test(record.upstreamLogoutUrl) || UNSAFE_URL.test(record.upstreamLogoutUrl) || Buffer.byteLength(record.upstreamLogoutUrl, "utf8") > 16384)
+    return false;
+  try {
+    const url = new URL(record.upstreamLogoutUrl);
+    return (url.protocol === "https:" || url.protocol === "http:") && !url.username && !url.password && !url.hash && !record.upstreamLogoutUrl.includes("#") && Buffer.byteLength(url.href, "utf8") <= 16384;
+  } catch {
+    return false;
+  }
+};
+var assertTicket = (record, now) => {
+  if (!validTicket(record, now)) throw new TypeError("OIDC vault logout navigation ticket is invalid or expired.");
+};
+var ticketLimit = (value) => {
+  const max = value === void 0 ? 1e4 : value;
+  if (!Number.isSafeInteger(max) || max <= 0)
+    throw new TypeError("OIDC vault logoutNavigationMaxEntries must be a positive safe integer.");
+  return max;
+};
+var ticketId = ({ namespace, ticketHash }) => `${namespace}:${ticketHash}`;
+
+// src/logout-tickets.ts
+var LOGOUT_NAVIGATION_TICKET_SCRIPT = `
+local function epoch(value)
+  return type(value) == 'number' and value == value and math.abs(value) <= 8640000000000000 and value == math.floor(value)
+end
+local function hash(value)
+  return type(value) == 'string' and #value == 43 and string.match(value, '^[A-Za-z0-9_-]+$') ~= nil
+    and string.match(string.sub(value, 43), '^[AEIMQUYcgkosw048]$') ~= nil
+end
+local function identity(member)
+  return type(member) == 'string' and string.sub(member, 1, 21) == 'logout-navigation:v1:'
+    and #member == 108 and string.sub(member, 65, 65) == ':'
+    and hash(string.sub(member, 22, 64)) and hash(string.sub(member, 66))
+end
+local function keyType(key, expected)
+  local kind = redis.call('TYPE', key)['ok']
+  if kind ~= 'none' and kind ~= expected then error('OIDC vault Redis logout navigation key has unexpected type') end
+end
+local function accountingError()
+  error('OIDC vault Redis logout navigation configuration/accounting is inconsistent')
+end
+local function record(raw, member, now)
+  local ok, value = pcall(cjson.decode, raw)
+  if not ok or type(value) ~= 'table' then return nil end
+  local count = 0
+  for key, _ in pairs(value) do
+    if key ~= 'namespace' and key ~= 'ticketHash' and key ~= 'upstreamLogoutUrl' and key ~= 'createdAt' and key ~= 'expiresAt' then return nil end
+    count = count + 1
+  end
+  if count ~= 5 or type(value['namespace']) ~= 'string' or type(value['ticketHash']) ~= 'string'
+    or value['namespace'] .. ':' .. value['ticketHash'] ~= member
+    or not epoch(value['createdAt']) or not epoch(value['expiresAt'])
+    or value['expiresAt'] - value['createdAt'] < 1000 or value['expiresAt'] - value['createdAt'] > 120000
+    or value['expiresAt'] <= now or value['expiresAt'] - now > 120000
+    or type(value['upstreamLogoutUrl']) ~= 'string' or #value['upstreamLogoutUrl'] > 16384 then return nil end
+  return value
+end
+local mode, member, prefix, max = ARGV[1], ARGV[2], ARGV[3], tonumber(ARGV[4])
+if not identity(member) then error('OIDC vault Redis logout navigation identity is invalid') end
+local time = redis.call('TIME')
+local now = tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+if not epoch(now) then error('OIDC vault Redis logout navigation store clock is invalid') end
+local incoming = nil
+if mode == 'create' then
+  incoming = record(ARGV[5], member, now)
+  if incoming == nil then return -1 end
+end
+keyType(KEYS[1], 'string')
+keyType(KEYS[2], 'zset')
+keyType(KEYS[3], 'string')
+local config = redis.call('GET', KEYS[3])
+local count = redis.call('ZCARD', KEYS[2])
+if (config ~= false and config ~= ARGV[4]) or count > max or (config == false and count > 0) then accountingError() end
+local latest = redis.call('ZREVRANGE', KEYS[2], 0, 0, 'WITHSCORES')
+if #latest > 0 and (not identity(latest[1]) or not epoch(tonumber(latest[2]))) then accountingError() end
+local raw = redis.call('GET', KEYS[1])
+local score = redis.call('ZSCORE', KEYS[2], member)
+if score ~= false and not epoch(tonumber(score)) then accountingError() end
+if raw ~= false and (score == false or config == false) then accountingError() end
+local selected = raw ~= false and record(raw, member, now) or nil
+if selected ~= nil and selected['expiresAt'] ~= tonumber(score) then accountingError() end
+-- A still-live ledger protects even an early-disappeared payload from reuse.
+if mode == 'create' and score ~= false and tonumber(score) > now and (raw == false or selected ~= nil) then return 2 end
+local expired = redis.call('ZRANGEBYSCORE', KEYS[2], '-inf', now, 'WITHSCORES', 'LIMIT', 0, 65)
+local cleanup = {}
+for i = 1, #expired, 2 do
+  local other, deadline = expired[i], tonumber(expired[i + 1])
+  if other ~= member and #cleanup < 64 then
+    if not identity(other) or not epoch(deadline) then accountingError() end
+    local key = prefix .. other
+    keyType(key, 'string')
+    local otherRaw = redis.call('GET', key)
+    if otherRaw ~= false then
+      local otherRecord = record(otherRaw, other, now)
+      if otherRecord ~= nil then accountingError() end
+    end
+    table.insert(cleanup, other)
+  end
+end
+-- All type/config/accounting validation has completed. No unbounded work follows.
+for _, other in ipairs(cleanup) do
+  redis.call('DEL', prefix .. other)
+  redis.call('ZREM', KEYS[2], other)
+end
+if score ~= false then redis.call('ZREM', KEYS[2], member) end
+if raw ~= false then redis.call('DEL', KEYS[1]) end
+if mode == 'create' then
+  if redis.call('ZCARD', KEYS[2]) >= max then return 3 end
+  if config == false then redis.call('SET', KEYS[3], ARGV[4]) end
+  redis.call('SET', KEYS[1], ARGV[5], 'PXAT', string.format('%.0f', incoming['expiresAt']))
+  redis.call('ZADD', KEYS[2], incoming['expiresAt'], member)
+end
+local last = redis.call('ZREVRANGE', KEYS[2], 0, 0, 'WITHSCORES')
+if #last > 0 then
+  if tonumber(last[2]) > now then redis.call('PEXPIREAT', KEYS[2], string.format('%.0f', tonumber(last[2])))
+  else redis.call('PERSIST', KEYS[2]) end
+end
+if mode == 'create' then return 1 end
+-- URL syntax is also revalidated by the caller after atomic retirement; invalid
+-- payloads are burned, never restored or redirected. No read/delete gap exists.
+if selected ~= nil then return raw end
+return false
+`;
+var buildLogoutNavigationTicketCommand = (keys, input, maxEntries, creating) => [
+  "EVAL",
+  LOGOUT_NAVIGATION_TICKET_SCRIPT,
+  "3",
+  keys.logoutNavigationTicket(ticketId(input)),
+  keys.logoutNavigationExpiries(),
+  keys.logoutNavigationCapacity(),
+  creating ? "create" : "consume",
+  ticketId(input),
+  keys.logoutNavigationTicketPrefix(),
+  String(maxEntries),
+  creating ? JSON.stringify(creating) : ""
+];
+
 // src/records.ts
 var serialize = (value) => JSON.stringify(value);
 var OidcVaultRedisStoreRecordError = class extends Error {
@@ -960,7 +1126,9 @@ var RedisOidcVaultStore = class {
   scriptRunner;
   indexCleanupCursor = "0";
   dpopReplayMaxEntries;
+  logoutNavigationMaxEntries;
   constructor(options) {
+    this.logoutNavigationMaxEntries = ticketLimit(options.logoutNavigationMaxEntries);
     this.dpopReplayMaxEntries = options.dpopReplayMaxEntries === void 0 ? 1e5 : options.dpopReplayMaxEntries;
     if (!Number.isSafeInteger(this.dpopReplayMaxEntries) || this.dpopReplayMaxEntries <= 0) {
       throw new TypeError("OIDC vault DPoP replay maximum entries must be a positive safe integer.");
@@ -1065,6 +1233,34 @@ var RedisOidcVaultStore = class {
     if (result === 2 || result === "2") throw new import_express_oidc_vault.OidcVaultDpopReplayCapacityError();
     return result === 1 || result === "1";
   }
+  async createLogoutNavigationTicket(input) {
+    const record = captureTicket(input);
+    assertTicket(record);
+    const result = await this.runScript(
+      buildLogoutNavigationTicketCommand(this.keys, record, this.logoutNavigationMaxEntries, record)
+    );
+    if (result === -1) throw new TypeError("OIDC vault logout navigation ticket is invalid or expired.");
+    if (result === 2) throw new import_express_oidc_vault.OidcVaultStoreConflictError();
+    if (result === 3) throw new import_express_oidc_vault.OidcVaultLogoutNavigationCapacityError();
+    if (result !== 1) throw new Error("OIDC vault Redis logout navigation create returned an unexpected result.");
+  }
+  async consumeLogoutNavigationTicket(input) {
+    const identity = captureTicketIdentity(input);
+    if (!validTicketIdentity(identity)) return null;
+    const raw = await this.runScript(
+      buildLogoutNavigationTicketCommand(this.keys, identity, this.logoutNavigationMaxEntries)
+    );
+    if (raw === null || raw === false) return null;
+    if (typeof raw !== "string")
+      throw new Error("OIDC vault Redis logout navigation consume returned an unexpected result.");
+    let record;
+    try {
+      record = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    return validTicket(record) && record.namespace === identity.namespace && record.ticketHash === identity.ticketHash ? captureTicket(record) : null;
+  }
   /**
    * Creates a session record atomically, then runs best-effort index
    * maintenance.

package/index.mjs

@@ -1,7 +1,8 @@
 // src/index.ts
 import {
   OidcVaultStoreConflictError,
-  OidcVaultDpopReplayCapacityError
+  OidcVaultDpopReplayCapacityError,
+  OidcVaultLogoutNavigationCapacityError
 } from "@web-ts-toolkit/express-oidc-vault";
 
 // src/keys.ts
@@ -48,6 +49,18 @@ var RedisOidcVaultStoreKeys = class {
   dpopProofs() {
     return `${this.keyPrefix}:dpop-proofs`;
   }
+  logoutNavigationTicket(id) {
+    return this.logoutNavigationTicketPrefix() + id;
+  }
+  logoutNavigationTicketPrefix() {
+    return `${this.keyPrefix}:logout-navigation-ticket:`;
+  }
+  logoutNavigationExpiries() {
+    return `${this.keyPrefix}:logout-navigation-expiries`;
+  }
+  logoutNavigationCapacity() {
+    return `${this.keyPrefix}:logout-navigation-capacity`;
+  }
   rotatedSessionAliasIndex(logicalSessionId) {
     return prefixKey(this.keyPrefix, "rotated-session-alias-index", logicalSessionId);
   }
@@ -65,6 +78,160 @@ var RedisOidcVaultStoreKeys = class {
   }
 };
 
+// src/logout-ticket-validation.ts
+var HASH = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+var PREFIX = "logout-navigation:v1:";
+var UNSAFE_URL = /[\s\\\u0000-\u001f\u007f-\u009f]/u;
+var usableEpoch = (value) => typeof value === "number" && Number.isSafeInteger(value) && Math.abs(value) <= 864e13;
+var captureTicketIdentity = (input) => ({
+  namespace: input?.namespace,
+  ticketHash: input?.ticketHash
+});
+var validTicketIdentity = (input) => typeof input.namespace === "string" && input.namespace.startsWith(PREFIX) && HASH.test(input.namespace.slice(PREFIX.length)) && typeof input.ticketHash === "string" && HASH.test(input.ticketHash);
+var captureTicket = (input) => ({
+  ...captureTicketIdentity(input),
+  upstreamLogoutUrl: input?.upstreamLogoutUrl,
+  createdAt: input?.createdAt,
+  expiresAt: input?.expiresAt
+});
+var validTicket = (record, now) => {
+  if (!record || typeof record !== "object" || Array.isArray(record) || Object.keys(record).length !== 5 || !validTicketIdentity(record) || !usableEpoch(record.createdAt) || !usableEpoch(record.expiresAt) || record.expiresAt - record.createdAt < 1e3 || record.expiresAt - record.createdAt > 12e4 || now !== void 0 && (record.expiresAt <= now || record.expiresAt - now > 12e4) || typeof record.upstreamLogoutUrl !== "string" || !/^https?:\/\//i.test(record.upstreamLogoutUrl) || /^https?:\/\/[^/?#]*@/i.test(record.upstreamLogoutUrl) || UNSAFE_URL.test(record.upstreamLogoutUrl) || Buffer.byteLength(record.upstreamLogoutUrl, "utf8") > 16384)
+    return false;
+  try {
+    const url = new URL(record.upstreamLogoutUrl);
+    return (url.protocol === "https:" || url.protocol === "http:") && !url.username && !url.password && !url.hash && !record.upstreamLogoutUrl.includes("#") && Buffer.byteLength(url.href, "utf8") <= 16384;
+  } catch {
+    return false;
+  }
+};
+var assertTicket = (record, now) => {
+  if (!validTicket(record, now)) throw new TypeError("OIDC vault logout navigation ticket is invalid or expired.");
+};
+var ticketLimit = (value) => {
+  const max = value === void 0 ? 1e4 : value;
+  if (!Number.isSafeInteger(max) || max <= 0)
+    throw new TypeError("OIDC vault logoutNavigationMaxEntries must be a positive safe integer.");
+  return max;
+};
+var ticketId = ({ namespace, ticketHash }) => `${namespace}:${ticketHash}`;
+
+// src/logout-tickets.ts
+var LOGOUT_NAVIGATION_TICKET_SCRIPT = `
+local function epoch(value)
+  return type(value) == 'number' and value == value and math.abs(value) <= 8640000000000000 and value == math.floor(value)
+end
+local function hash(value)
+  return type(value) == 'string' and #value == 43 and string.match(value, '^[A-Za-z0-9_-]+$') ~= nil
+    and string.match(string.sub(value, 43), '^[AEIMQUYcgkosw048]$') ~= nil
+end
+local function identity(member)
+  return type(member) == 'string' and string.sub(member, 1, 21) == 'logout-navigation:v1:'
+    and #member == 108 and string.sub(member, 65, 65) == ':'
+    and hash(string.sub(member, 22, 64)) and hash(string.sub(member, 66))
+end
+local function keyType(key, expected)
+  local kind = redis.call('TYPE', key)['ok']
+  if kind ~= 'none' and kind ~= expected then error('OIDC vault Redis logout navigation key has unexpected type') end
+end
+local function accountingError()
+  error('OIDC vault Redis logout navigation configuration/accounting is inconsistent')
+end
+local function record(raw, member, now)
+  local ok, value = pcall(cjson.decode, raw)
+  if not ok or type(value) ~= 'table' then return nil end
+  local count = 0
+  for key, _ in pairs(value) do
+    if key ~= 'namespace' and key ~= 'ticketHash' and key ~= 'upstreamLogoutUrl' and key ~= 'createdAt' and key ~= 'expiresAt' then return nil end
+    count = count + 1
+  end
+  if count ~= 5 or type(value['namespace']) ~= 'string' or type(value['ticketHash']) ~= 'string'
+    or value['namespace'] .. ':' .. value['ticketHash'] ~= member
+    or not epoch(value['createdAt']) or not epoch(value['expiresAt'])
+    or value['expiresAt'] - value['createdAt'] < 1000 or value['expiresAt'] - value['createdAt'] > 120000
+    or value['expiresAt'] <= now or value['expiresAt'] - now > 120000
+    or type(value['upstreamLogoutUrl']) ~= 'string' or #value['upstreamLogoutUrl'] > 16384 then return nil end
+  return value
+end
+local mode, member, prefix, max = ARGV[1], ARGV[2], ARGV[3], tonumber(ARGV[4])
+if not identity(member) then error('OIDC vault Redis logout navigation identity is invalid') end
+local time = redis.call('TIME')
+local now = tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+if not epoch(now) then error('OIDC vault Redis logout navigation store clock is invalid') end
+local incoming = nil
+if mode == 'create' then
+  incoming = record(ARGV[5], member, now)
+  if incoming == nil then return -1 end
+end
+keyType(KEYS[1], 'string')
+keyType(KEYS[2], 'zset')
+keyType(KEYS[3], 'string')
+local config = redis.call('GET', KEYS[3])
+local count = redis.call('ZCARD', KEYS[2])
+if (config ~= false and config ~= ARGV[4]) or count > max or (config == false and count > 0) then accountingError() end
+local latest = redis.call('ZREVRANGE', KEYS[2], 0, 0, 'WITHSCORES')
+if #latest > 0 and (not identity(latest[1]) or not epoch(tonumber(latest[2]))) then accountingError() end
+local raw = redis.call('GET', KEYS[1])
+local score = redis.call('ZSCORE', KEYS[2], member)
+if score ~= false and not epoch(tonumber(score)) then accountingError() end
+if raw ~= false and (score == false or config == false) then accountingError() end
+local selected = raw ~= false and record(raw, member, now) or nil
+if selected ~= nil and selected['expiresAt'] ~= tonumber(score) then accountingError() end
+-- A still-live ledger protects even an early-disappeared payload from reuse.
+if mode == 'create' and score ~= false and tonumber(score) > now and (raw == false or selected ~= nil) then return 2 end
+local expired = redis.call('ZRANGEBYSCORE', KEYS[2], '-inf', now, 'WITHSCORES', 'LIMIT', 0, 65)
+local cleanup = {}
+for i = 1, #expired, 2 do
+  local other, deadline = expired[i], tonumber(expired[i + 1])
+  if other ~= member and #cleanup < 64 then
+    if not identity(other) or not epoch(deadline) then accountingError() end
+    local key = prefix .. other
+    keyType(key, 'string')
+    local otherRaw = redis.call('GET', key)
+    if otherRaw ~= false then
+      local otherRecord = record(otherRaw, other, now)
+      if otherRecord ~= nil then accountingError() end
+    end
+    table.insert(cleanup, other)
+  end
+end
+-- All type/config/accounting validation has completed. No unbounded work follows.
+for _, other in ipairs(cleanup) do
+  redis.call('DEL', prefix .. other)
+  redis.call('ZREM', KEYS[2], other)
+end
+if score ~= false then redis.call('ZREM', KEYS[2], member) end
+if raw ~= false then redis.call('DEL', KEYS[1]) end
+if mode == 'create' then
+  if redis.call('ZCARD', KEYS[2]) >= max then return 3 end
+  if config == false then redis.call('SET', KEYS[3], ARGV[4]) end
+  redis.call('SET', KEYS[1], ARGV[5], 'PXAT', string.format('%.0f', incoming['expiresAt']))
+  redis.call('ZADD', KEYS[2], incoming['expiresAt'], member)
+end
+local last = redis.call('ZREVRANGE', KEYS[2], 0, 0, 'WITHSCORES')
+if #last > 0 then
+  if tonumber(last[2]) > now then redis.call('PEXPIREAT', KEYS[2], string.format('%.0f', tonumber(last[2])))
+  else redis.call('PERSIST', KEYS[2]) end
+end
+if mode == 'create' then return 1 end
+-- URL syntax is also revalidated by the caller after atomic retirement; invalid
+-- payloads are burned, never restored or redirected. No read/delete gap exists.
+if selected ~= nil then return raw end
+return false
+`;
+var buildLogoutNavigationTicketCommand = (keys, input, maxEntries, creating) => [
+  "EVAL",
+  LOGOUT_NAVIGATION_TICKET_SCRIPT,
+  "3",
+  keys.logoutNavigationTicket(ticketId(input)),
+  keys.logoutNavigationExpiries(),
+  keys.logoutNavigationCapacity(),
+  creating ? "create" : "consume",
+  ticketId(input),
+  keys.logoutNavigationTicketPrefix(),
+  String(maxEntries),
+  creating ? JSON.stringify(creating) : ""
+];
+
 // src/records.ts
 var serialize = (value) => JSON.stringify(value);
 var OidcVaultRedisStoreRecordError = class extends Error {
@@ -938,7 +1105,9 @@ var RedisOidcVaultStore = class {
   scriptRunner;
   indexCleanupCursor = "0";
   dpopReplayMaxEntries;
+  logoutNavigationMaxEntries;
   constructor(options) {
+    this.logoutNavigationMaxEntries = ticketLimit(options.logoutNavigationMaxEntries);
     this.dpopReplayMaxEntries = options.dpopReplayMaxEntries === void 0 ? 1e5 : options.dpopReplayMaxEntries;
     if (!Number.isSafeInteger(this.dpopReplayMaxEntries) || this.dpopReplayMaxEntries <= 0) {
       throw new TypeError("OIDC vault DPoP replay maximum entries must be a positive safe integer.");
@@ -1043,6 +1212,34 @@ var RedisOidcVaultStore = class {
     if (result === 2 || result === "2") throw new OidcVaultDpopReplayCapacityError();
     return result === 1 || result === "1";
   }
+  async createLogoutNavigationTicket(input) {
+    const record = captureTicket(input);
+    assertTicket(record);
+    const result = await this.runScript(
+      buildLogoutNavigationTicketCommand(this.keys, record, this.logoutNavigationMaxEntries, record)
+    );
+    if (result === -1) throw new TypeError("OIDC vault logout navigation ticket is invalid or expired.");
+    if (result === 2) throw new OidcVaultStoreConflictError();
+    if (result === 3) throw new OidcVaultLogoutNavigationCapacityError();
+    if (result !== 1) throw new Error("OIDC vault Redis logout navigation create returned an unexpected result.");
+  }
+  async consumeLogoutNavigationTicket(input) {
+    const identity = captureTicketIdentity(input);
+    if (!validTicketIdentity(identity)) return null;
+    const raw = await this.runScript(
+      buildLogoutNavigationTicketCommand(this.keys, identity, this.logoutNavigationMaxEntries)
+    );
+    if (raw === null || raw === false) return null;
+    if (typeof raw !== "string")
+      throw new Error("OIDC vault Redis logout navigation consume returned an unexpected result.");
+    let record;
+    try {
+      record = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    return validTicket(record) && record.namespace === identity.namespace && record.ticketHash === identity.ticketHash ? captureTicket(record) : null;
+  }
   /**
    * Creates a session record atomically, then runs best-effort index
    * maintenance.

package/package.json

@@ -2,7 +2,7 @@
   "name": "@web-ts-toolkit/express-oidc-vault-redis-store",
   "description": "Redis store provider for @web-ts-toolkit/express-oidc-vault",
   "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/express-oidc-vault-redis-store",
-  "version": "0.53.0",
+  "version": "0.54.0",
   "sideEffects": false,
   "keywords": [
     "express",
@@ -29,7 +29,7 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "@web-ts-toolkit/express-oidc-vault": "0.53.0"
+    "@web-ts-toolkit/express-oidc-vault": "0.54.0"
   },
   "files": [
     "**/*",