@web-ts-toolkit/express-oidc-vault 0.32.0 → 0.34.0

package/index.mjs

@@ -1,29 +1,46 @@
 // src/index.ts
 import { createHash, randomBytes } from "crypto";
 import express from "express";
-import { createRemoteJWKSet, jwtVerify } from "jose";
 
 // src/config.ts
 var DEFAULT_OIDC_SCOPES = "openid email profile";
-var MANUAL_CONFIG_REQUIREMENTS = ["authorizationEndpoint", "tokenEndpoint", "jwksUri"];
+var MANUAL_CONFIG_REQUIREMENTS = ["issuer", "authorizationEndpoint", "tokenEndpoint", "jwksUri"];
 var normalizeOptionalString = (value) => {
   const trimmed = value?.trim();
   return trimmed ? trimmed : void 0;
 };
+var normalizeHttpUrl = (value, optionName) => {
+  if (value === void 0) {
+    return void 0;
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${optionName} must be an absolute HTTP(S) URL.`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.origin === "null") {
+    throw new Error(`${optionName} must use http or https.`);
+  }
+  return url.toString();
+};
 var withOptionalValue = (target, key, value) => {
   if (value !== void 0) {
     target[key] = value;
   }
 };
 function resolveOidcVaultConfig(config = {}) {
-  const issuer = normalizeOptionalString(config.issuer);
+  const issuer = normalizeHttpUrl(normalizeOptionalString(config.issuer), "config.issuer");
   const clientId = normalizeOptionalString(config.clientId);
   const clientSecret = normalizeOptionalString(config.clientSecret);
   const scopes = normalizeOptionalString(config.scopes) ?? DEFAULT_OIDC_SCOPES;
+  const hasManualEndpoints = MANUAL_CONFIG_REQUIREMENTS.some(
+    (key) => key !== "issuer" && normalizeOptionalString(config[key])
+  );
   if (!clientId) {
     throw new Error("OIDC clientId is required.");
   }
-  if (issuer) {
+  if (issuer && !hasManualEndpoints) {
     const resolved2 = {
       mode: "issuer",
       issuer,
@@ -37,11 +54,28 @@ function resolveOidcVaultConfig(config = {}) {
     mode: "manual",
     scopes
   };
-  withOptionalValue(resolved, "authorizationEndpoint", normalizeOptionalString(config.authorizationEndpoint));
-  withOptionalValue(resolved, "tokenEndpoint", normalizeOptionalString(config.tokenEndpoint));
-  withOptionalValue(resolved, "userInfoEndpoint", normalizeOptionalString(config.userInfoEndpoint));
-  withOptionalValue(resolved, "jwksUri", normalizeOptionalString(config.jwksUri));
-  withOptionalValue(resolved, "endSessionEndpoint", normalizeOptionalString(config.endSessionEndpoint));
+  withOptionalValue(resolved, "issuer", issuer);
+  withOptionalValue(
+    resolved,
+    "authorizationEndpoint",
+    normalizeHttpUrl(normalizeOptionalString(config.authorizationEndpoint), "config.authorizationEndpoint")
+  );
+  withOptionalValue(
+    resolved,
+    "tokenEndpoint",
+    normalizeHttpUrl(normalizeOptionalString(config.tokenEndpoint), "config.tokenEndpoint")
+  );
+  withOptionalValue(
+    resolved,
+    "userInfoEndpoint",
+    normalizeHttpUrl(normalizeOptionalString(config.userInfoEndpoint), "config.userInfoEndpoint")
+  );
+  withOptionalValue(resolved, "jwksUri", normalizeHttpUrl(normalizeOptionalString(config.jwksUri), "config.jwksUri"));
+  withOptionalValue(
+    resolved,
+    "endSessionEndpoint",
+    normalizeHttpUrl(normalizeOptionalString(config.endSessionEndpoint), "config.endSessionEndpoint")
+  );
   withOptionalValue(resolved, "clientId", clientId);
   withOptionalValue(resolved, "clientSecret", clientSecret);
   const missing = MANUAL_CONFIG_REQUIREMENTS.filter((key) => !resolved[key]);
@@ -64,19 +98,13 @@ function resolveOidcVaultConfigFromEnv(env = process.env) {
   });
 }
 
-// src/types.ts
-var OidcVaultStoreConflictError = class extends Error {
-  constructor(message = "OIDC vault store operation conflicted with concurrent state changes.") {
-    super(message);
-    this.name = "OidcVaultStoreConflictError";
-  }
-};
-
-// src/index.ts
+// src/constants.ts
 var DEFAULT_OIDC_VAULT_BASE_PATH = "/auth/oidc";
 var DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS = 10 * 60 * 1e3;
 var DEFAULT_EXCHANGE_CODE_TTL_MS = 30 * 1e3;
 var DEFAULT_SESSION_COOKIE_NAME = "oidc_vault_session";
+var DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT = "16kb";
+var OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT = 16;
 var OIDC_VAULT_ROUTE_PATHS = {
   login: "/login",
   callback: "/callback",
@@ -85,51 +113,89 @@ var OIDC_VAULT_ROUTE_PATHS = {
   logout: "/logout",
   "backchannel-logout": "/backchannel-logout"
 };
-var discoveryCache = /* @__PURE__ */ new Map();
-var jwksCache = /* @__PURE__ */ new Map();
+
+// src/errors.ts
 var OidcVaultHttpError = class extends Error {
-  constructor(status, code, message) {
+  constructor(status, code, message, clientMessage = message) {
     super(message);
     this.status = status;
     this.code = code;
+    this.clientMessage = clientMessage;
   }
 };
-function normalizeOidcVaultBasePath(value) {
-  if (!value || value === "/") {
-    return DEFAULT_OIDC_VAULT_BASE_PATH;
-  }
-  return `/${value.replace(/^\/+|\/+$/g, "")}`;
-}
-var isRecord = (value) => typeof value === "object" && value !== null;
-var isString = (value) => typeof value === "string" && value.length > 0;
-var getNow = (options) => (options.now ?? Date.now)();
-var getSessionTransport = (options) => options.sessionTransport ?? "body";
-var usesCookieTransport = (options) => getSessionTransport(options) === "cookie";
-var createOpaqueId = (prefix) => `${prefix}_${randomBytes(16).toString("base64url")}`;
-var createPkceVerifier = () => randomBytes(32).toString("base64url");
-var createPkceChallenge = (verifier) => createHash("sha256").update(verifier).digest("base64url");
 var toErrorPayload = (error) => {
   if (error instanceof OidcVaultHttpError) {
     return {
       status: error.status,
       code: error.code,
-      message: error.message
+      message: error.clientMessage
     };
   }
   return {
     status: 500,
     code: "OIDC_VAULT_INTERNAL_ERROR",
-    message: error instanceof Error ? error.message : "Unexpected OIDC vault error."
+    message: "Unexpected OIDC vault error."
+  };
+};
+var isBodyParserError = (error) => {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+  const maybeParserError = error;
+  return typeof maybeParserError.type === "string" || typeof maybeParserError.status === "number";
+};
+var toBodyParserErrorPayload = (error) => {
+  if (error.type === "entity.too.large") {
+    return {
+      status: 413,
+      code: "OIDC_VAULT_REQUEST_BODY_TOO_LARGE",
+      message: "OIDC vault request body exceeds the configured size limit."
+    };
+  }
+  if (error.type === "parameters.too.many") {
+    return {
+      status: 413,
+      code: "OIDC_VAULT_REQUEST_BODY_PARAMETER_LIMIT_EXCEEDED",
+      message: "OIDC vault form request contains too many parameters."
+    };
+  }
+  if (error.type === "encoding.unsupported" || error.type === "charset.unsupported") {
+    return {
+      status: 415,
+      code: "OIDC_VAULT_UNSUPPORTED_REQUEST_BODY_ENCODING",
+      message: "OIDC vault request body encoding is not supported."
+    };
+  }
+  if (error.type === "entity.parse.failed") {
+    return {
+      status: 400,
+      code: "OIDC_VAULT_MALFORMED_REQUEST_BODY",
+      message: "OIDC vault request body is malformed."
+    };
+  }
+  const status = error.status ?? error.statusCode ?? 400;
+  return {
+    status: status >= 400 && status < 500 ? status : 400,
+    code: "OIDC_VAULT_INVALID_REQUEST_BODY",
+    message: "OIDC vault request body could not be parsed."
   };
 };
-var getRequestOrigin = (req) => `${req.protocol}://${req.get("host") ?? "localhost"}`;
-var getCallbackUri = (req, basePath) => `${getRequestOrigin(req)}${basePath}${OIDC_VAULT_ROUTE_PATHS.callback}`;
 var getRequiredString = (value, message, code, status = 400) => {
-  if (!isString(value)) {
+  if (typeof value !== "string" || value.length === 0) {
     throw new OidcVaultHttpError(status, code, message);
   }
   return value;
 };
+var getRequiredFiniteNonNegativeInteger = (value, message, code, status = 502) => {
+  if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
+    throw new OidcVaultHttpError(status, code, message);
+  }
+  return value;
+};
+
+// src/cookies.ts
+var getSessionTransport = (options) => options.sessionTransport ?? "body";
+var usesCookieTransport = (options) => getSessionTransport(options) === "cookie";
 var parseCookieHeader = (headerValue) => {
   if (!headerValue) {
     return {};
@@ -144,7 +210,15 @@ var parseCookieHeader = (headerValue) => {
     if (!name) {
       return cookies;
     }
-    cookies[name] = decodeURIComponent(value);
+    try {
+      cookies[name] = decodeURIComponent(value);
+    } catch {
+      throw new OidcVaultHttpError(
+        400,
+        "OIDC_VAULT_MALFORMED_SESSION_COOKIE",
+        "OIDC vault session cookie is malformed."
+      );
+    }
     return cookies;
   }, {});
 };
@@ -162,44 +236,36 @@ var resolveCookieOptions = (options) => {
     httpOnly: cookieOptions.httpOnly ?? true
   };
 };
-var usesCrossSiteCookieTransport = (options) => usesCookieTransport(options) && resolveCookieOptions(options).sameSite === "none";
-var resolveTrustedOrigins = (options) => new Set((options.trustedOrigins ?? []).map((value) => new URL(value).origin));
-var getRequestSourceOrigin = (req) => {
-  const origin = req.get("origin");
-  if (isString(origin)) {
-    return origin;
-  }
-  const referer = req.get("referer");
-  if (!isString(referer)) {
-    return void 0;
-  }
-  try {
-    return new URL(referer).origin;
-  } catch {
-    return void 0;
+var COOKIE_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var COOKIE_DOMAIN_PATTERN = /^\.?[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
+var hasUnsafeCookieValueCharacters = (value) => {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 31 || code === 127 || value[index] === ";") {
+      return true;
+    }
   }
+  return false;
 };
-var assertTrustedOrigin = (req, options, trustedOrigins, action) => {
-  if (!usesCrossSiteCookieTransport(options)) {
+var validateCookieOptions = (options) => {
+  if (!usesCookieTransport(options)) {
     return;
   }
-  const origin = getRequestSourceOrigin(req);
-  if (!origin || !trustedOrigins.has(origin)) {
-    throw new OidcVaultHttpError(
-      403,
-      "OIDC_VAULT_UNTRUSTED_ORIGIN",
-      `${action === "refresh" ? "Refresh" : "Logout"} request origin is not trusted.`
-    );
+  const cookieOptions = resolveCookieOptions(options);
+  if (!COOKIE_NAME_PATTERN.test(cookieOptions.name)) {
+    throw new Error("cookie.name must be a valid HTTP cookie name.");
   }
-};
-var validateOidcVaultOptions = (options) => {
-  const config = resolveOidcVaultConfig(options.config);
-  const trustedOrigins = resolveTrustedOrigins(options);
-  if (usesCrossSiteCookieTransport(options) && trustedOrigins.size === 0) {
-    throw new Error("trustedOrigins is required when using cross-site cookie transport.");
+  if (hasUnsafeCookieValueCharacters(cookieOptions.path) || !cookieOptions.path.startsWith("/")) {
+    throw new Error("cookie.path must start with / and cannot contain control characters or semicolons.");
+  }
+  if (cookieOptions.domain !== void 0 && !COOKIE_DOMAIN_PATTERN.test(cookieOptions.domain)) {
+    throw new Error("cookie.domain must be a valid cookie domain.");
+  }
+  if (!cookieOptions.httpOnly) {
+    throw new Error("cookie.httpOnly must be true for cookie session transport.");
   }
-  return { config, trustedOrigins };
 };
+var usesCrossSiteCookieTransport = (options) => usesCookieTransport(options) && resolveCookieOptions(options).sameSite === "none";
 var serializeCookie = (name, value, options, overrides) => {
   const sameSite = options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1);
   const parts = [`${name}=${encodeURIComponent(value)}`, `Path=${options.path}`, `SameSite=${sameSite}`];
@@ -238,126 +304,735 @@ var getSessionIdFromCookie = (req, options) => {
   const cookies = parseCookieHeader(req.headers.cookie);
   return cookies[resolveCookieOptions(options).name];
 };
-var getSessionIdFromRequest = (req, options, action) => {
-  const body = getBody(req);
-  if (usesCookieTransport(options)) {
-    const cookieSessionId = getSessionIdFromCookie(req, options);
-    if (isString(cookieSessionId)) {
-      return cookieSessionId;
-    }
-    if (isString(body.sessionId)) {
-      return body.sessionId;
+
+// src/utils.ts
+var isRecord = (value) => typeof value === "object" && value !== null;
+var isString = (value) => typeof value === "string" && value.length > 0;
+var getBody = (req) => isRecord(req.body) ? req.body : {};
+
+// src/origins.ts
+var parseHttpUrl = (value, optionName, example) => {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${optionName} must be an absolute HTTP(S) URL, for example ${example}.`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.origin === "null") {
+    throw new Error(`${optionName} must use http or https, for example ${example}.`);
+  }
+  return url;
+};
+var resolveTrustedOrigins = (options) => {
+  const origins = /* @__PURE__ */ new Set();
+  for (const value of options.trustedOrigins ?? []) {
+    if (!isString(value)) {
+      throw new Error(
+        "trustedOrigins entries must be absolute HTTP(S) URLs, for example https://frontend.example.com."
+      );
     }
-    throw new OidcVaultHttpError(
-      400,
-      "OIDC_VAULT_MISSING_SESSION_ID",
-      `${action === "refresh" ? "Refresh" : "Logout"} request is missing the session cookie.`
+    const url = parseHttpUrl(value, "trustedOrigins entries", "https://frontend.example.com");
+    origins.add(url.origin);
+  }
+  return origins;
+};
+var resolveBackendOrigin = (options) => {
+  if (!isString(options.backendOrigin)) {
+    throw new Error(
+      "backendOrigin is required and must be the public backend origin, for example https://api.example.com."
     );
   }
-  return getRequiredString(
-    body.sessionId,
-    `${action === "refresh" ? "Refresh" : "Logout"} request is missing sessionId.`,
-    "OIDC_VAULT_MISSING_SESSION_ID"
-  );
+  const url = parseHttpUrl(options.backendOrigin, "backendOrigin", "https://api.example.com");
+  return url.origin;
 };
-var createExchangeResponse = (options, session, issuedToken) => ({
-  sessionId: usesCookieTransport(options) ? void 0 : session.sessionId,
-  user: session.user,
-  ...issuedToken
-});
-var extractBearerToken = (authorizationHeader) => {
-  if (!authorizationHeader) {
-    throw new OidcVaultHttpError(401, "OIDC_VAULT_MISSING_BEARER_TOKEN", "Missing bearer token.");
+var resolveFrontendRedirectUri = (options) => {
+  if (options.frontendRedirectUri === void 0) {
+    return void 0;
   }
-  const [scheme, token, extra] = authorizationHeader.trim().split(/\s+/);
-  if (scheme?.toLowerCase() !== "bearer" || !token || extra) {
+  if (!isString(options.frontendRedirectUri)) {
+    throw new Error(
+      "frontendRedirectUri must be an absolute HTTP(S) URL, for example https://frontend.example.com/callback."
+    );
+  }
+  return parseHttpUrl(
+    options.frontendRedirectUri,
+    "frontendRedirectUri",
+    "https://frontend.example.com/callback"
+  ).toString();
+};
+var validatePostLogoutRedirectUri = (options) => {
+  if (options.postLogoutRedirectUri === void 0) {
+    return;
+  }
+  if (!isString(options.postLogoutRedirectUri)) {
+    throw new Error(
+      "postLogoutRedirectUri must be an absolute HTTP(S) URL registered with the OIDC provider, for example https://frontend.example.com/logged-out."
+    );
+  }
+  parseHttpUrl(options.postLogoutRedirectUri, "postLogoutRedirectUri", "https://frontend.example.com/logged-out");
+};
+var getRequestSourceOrigin = (req) => {
+  const origin = req.get("origin");
+  if (isString(origin)) {
+    return origin;
+  }
+  const referer = req.get("referer");
+  if (!isString(referer)) {
+    return void 0;
+  }
+  try {
+    return new URL(referer).origin;
+  } catch {
+    return void 0;
+  }
+};
+var assertTrustedOrigin = (req, options, trustedOrigins, action) => {
+  if (!usesCookieTransport(options)) {
+    return;
+  }
+  const origin = getRequestSourceOrigin(req);
+  if (!origin || !trustedOrigins.has(origin)) {
     throw new OidcVaultHttpError(
-      401,
-      "OIDC_VAULT_INVALID_AUTHORIZATION_HEADER",
-      "Authorization header must use the Bearer scheme."
+      403,
+      "OIDC_VAULT_UNTRUSTED_ORIGIN",
+      `${action === "refresh" ? "Refresh" : "Logout"} request origin is not trusted.`
     );
   }
-  return token;
 };
-var setBearerChallengeHeader = (res) => {
-  res.setHeader("WWW-Authenticate", "Bearer");
+
+// src/provider-client.ts
+import { createRemoteJWKSet } from "jose";
+var DEFAULT_PROVIDER_REQUEST_TIMEOUT_MS = 5e3;
+var DEFAULT_DISCOVERY_CACHE_TTL_MS = 10 * 6e4;
+var DEFAULT_DISCOVERY_CACHE_CAPACITY = 32;
+var DEFAULT_JWKS_CACHE_CAPACITY = 32;
+var DEFAULT_PROVIDER_ERROR_BODY_LIMIT = 1024;
+var DEFAULT_PROVIDER_JSON_BODY_LIMIT = 1024 * 1024;
+var discoveryCache = /* @__PURE__ */ new Map();
+var jwksCache = /* @__PURE__ */ new Map();
+var normalizeIssuerForDiscoveryComparison = (issuer) => issuer.replace(/\/+$/g, "");
+var assertDiscoveredIssuerMatchesConfig = (configuredIssuer, discoveredIssuer) => {
+  if (normalizeIssuerForDiscoveryComparison(configuredIssuer) !== normalizeIssuerForDiscoveryComparison(discoveredIssuer)) {
+    throw new OidcVaultHttpError(
+      502,
+      "OIDC_VAULT_DISCOVERY_INVALID",
+      "OIDC discovery response issuer does not match the configured issuer."
+    );
+  }
 };
-var BACKCHANNEL_LOGOUT_EVENT_CLAIM = "http://schemas.openid.net/event/backchannel-logout";
-var defaultJwtClaimsMapper = (claims) => {
-  const subject = getRequiredString(
-    claims.sub,
-    "JWT access token is missing sub.",
-    "OIDC_VAULT_INVALID_ACCESS_TOKEN",
-    401
-  );
-  return {
-    subject,
-    sessionId: typeof claims.sid === "string" ? claims.sid : void 0,
-    scope: typeof claims.scope === "string" ? claims.scope : void 0,
-    claims
-  };
+var validateDiscoveredHttpUrl = (value, fieldName) => {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new OidcVaultHttpError(
+      502,
+      "OIDC_VAULT_DISCOVERY_INVALID",
+      `OIDC discovery response ${fieldName} must be an absolute HTTP(S) URL.`
+    );
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.origin === "null") {
+    throw new OidcVaultHttpError(
+      502,
+      "OIDC_VAULT_DISCOVERY_INVALID",
+      `OIDC discovery response ${fieldName} must use http or https.`
+    );
+  }
+  return url.toString();
 };
 var buildWellKnownUrl = (issuer) => {
   const normalizedIssuer = issuer.endsWith("/") ? issuer : `${issuer}/`;
   return new URL(".well-known/openid-configuration", normalizedIssuer);
 };
-var resolveJwks = (jwksUri) => {
-  let jwks = jwksCache.get(jwksUri);
-  if (!jwks) {
-    jwks = createRemoteJWKSet(new URL(jwksUri));
-    jwksCache.set(jwksUri, jwks);
+var getProviderRequestTimeoutMs = (options = {}) => {
+  const timeout = options.providerRequestTimeoutMs ?? DEFAULT_PROVIDER_REQUEST_TIMEOUT_MS;
+  if (!Number.isFinite(timeout) || !Number.isInteger(timeout) || timeout <= 0) {
+    throw new OidcVaultHttpError(
+      500,
+      "OIDC_VAULT_INVALID_CONFIG",
+      "providerRequestTimeoutMs must be a positive finite integer."
+    );
   }
-  return jwks;
+  return timeout;
 };
-var appendQueryParam = (url, name, value) => {
-  if (value) {
-    url.searchParams.set(name, value);
+var evictOldestEntry = (cache, capacity) => {
+  while (cache.size > capacity) {
+    const oldestKey = cache.keys().next().value;
+    if (typeof oldestKey !== "string") {
+      return;
+    }
+    cache.delete(oldestKey);
   }
 };
-var buildAuthorizationUrl = (metadata, transaction, redirectUri) => {
-  const url = new URL(metadata.authorizationEndpoint);
-  appendQueryParam(url, "response_type", "code");
-  appendQueryParam(url, "client_id", metadata.clientId);
-  appendQueryParam(url, "redirect_uri", redirectUri);
-  appendQueryParam(url, "scope", metadata.scopes);
-  appendQueryParam(url, "state", transaction.state);
-  appendQueryParam(url, "nonce", transaction.nonce);
-  appendQueryParam(url, "code_challenge", transaction.codeChallenge);
-  appendQueryParam(url, "code_challenge_method", "S256");
-  return url.toString();
+var fetchProvider = async (input, init, errorCode, options) => {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), getProviderRequestTimeoutMs(options));
+  try {
+    return await fetch(input, {
+      ...init,
+      redirect: "manual",
+      signal: controller.signal
+    });
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new OidcVaultHttpError(502, errorCode, "OIDC provider request timed out.");
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
 };
-var buildLogoutUrl = (endSessionEndpoint, idTokenHint, postLogoutRedirectUri) => {
-  const url = new URL(endSessionEndpoint);
-  appendQueryParam(url, "id_token_hint", idTokenHint);
-  appendQueryParam(url, "post_logout_redirect_uri", postLogoutRedirectUri);
-  return url.toString();
+var readBoundedResponseText = async (response, limit, errorCode, options = {}) => {
+  if (!response.body) {
+    return "";
+  }
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let size = 0;
+  let text = "";
+  try {
+    for (; ; ) {
+      const result = await reader.read();
+      if (result.done) {
+        break;
+      }
+      size += result.value.byteLength;
+      if (size > limit) {
+        await reader.cancel();
+        if (options.truncate) {
+          return `${text.slice(0, limit)}...`;
+        }
+        throw new OidcVaultHttpError(502, errorCode, "OIDC provider response is too large.");
+      }
+      text += decoder.decode(result.value, { stream: true });
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return `${text}${decoder.decode()}`;
+};
+var resolveJwks = (jwksUri, options = {}) => {
+  let jwks = jwksCache.get(jwksUri);
+  if (!jwks) {
+    jwks = createRemoteJWKSet(new URL(jwksUri), {
+      timeoutDuration: getProviderRequestTimeoutMs(options),
+      cacheMaxAge: DEFAULT_DISCOVERY_CACHE_TTL_MS
+    });
+    jwksCache.set(jwksUri, jwks);
+    evictOldestEntry(jwksCache, DEFAULT_JWKS_CACHE_CAPACITY);
+  }
+  return jwks;
 };
-var toBasicAuthorization = (clientId, clientSecret) => `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;
-var readJsonResponse = async (response, errorCode) => {
-  const text = await response.text();
+var formEncodeClientCredential = (value) => new URLSearchParams([[value, ""]]).toString().slice(0, -1);
+var toBasicAuthorization = (clientId, clientSecret) => `Basic ${Buffer.from(`${formEncodeClientCredential(clientId)}:${formEncodeClientCredential(clientSecret)}`).toString("base64")}`;
+var readJsonResponse = async (response, errorCode, invalidJsonMessage = "OIDC provider returned invalid JSON.") => {
+  const text = await readBoundedResponseText(response, DEFAULT_PROVIDER_JSON_BODY_LIMIT, errorCode);
   if (!text) {
     return {};
   }
   try {
     return JSON.parse(text);
   } catch {
-    throw new OidcVaultHttpError(response.status, errorCode, text);
+    throw new OidcVaultHttpError(
+      response.ok ? 502 : response.status,
+      errorCode,
+      invalidJsonMessage,
+      invalidJsonMessage
+    );
   }
 };
-var getLogoutTokenFromRequest = (req) => {
-  const body = getBody(req);
-  return getRequiredString(
-    body.logout_token,
-    "Backchannel logout request is missing logout_token.",
-    "OIDC_VAULT_MISSING_LOGOUT_TOKEN"
+async function discoverIssuerMetadata(issuer, options) {
+  const now = Date.now();
+  const cached = discoveryCache.get(issuer);
+  let discoveryPromise = cached && cached.expiresAt > now ? cached.promise : void 0;
+  if (cached && !discoveryPromise) {
+    discoveryCache.delete(issuer);
+  }
+  if (!discoveryPromise) {
+    discoveryPromise = (async () => {
+      const discoveryUrl = buildWellKnownUrl(issuer);
+      const response = await fetchProvider(discoveryUrl, void 0, "OIDC_VAULT_DISCOVERY_FAILED", options);
+      if (!response.ok) {
+        const errorText = await readBoundedResponseText(
+          response,
+          DEFAULT_PROVIDER_ERROR_BODY_LIMIT,
+          "OIDC_VAULT_DISCOVERY_FAILED",
+          {
+            truncate: true
+          }
+        );
+        throw new OidcVaultHttpError(
+          502,
+          "OIDC_VAULT_DISCOVERY_FAILED",
+          errorText || `OIDC discovery failed with status ${response.status}.`,
+          "OIDC discovery failed."
+        );
+      }
+      const discovered = await readJsonResponse(
+        response,
+        "OIDC_VAULT_DISCOVERY_INVALID",
+        "OIDC discovery response is malformed JSON."
+      );
+      const authorizationEndpoint = validateDiscoveredHttpUrl(
+        getRequiredString(
+          discovered.authorization_endpoint,
+          "OIDC discovery response is missing authorization_endpoint.",
+          "OIDC_VAULT_DISCOVERY_INVALID",
+          502
+        ),
+        "authorization_endpoint"
+      );
+      const tokenEndpoint = validateDiscoveredHttpUrl(
+        getRequiredString(
+          discovered.token_endpoint,
+          "OIDC discovery response is missing token_endpoint.",
+          "OIDC_VAULT_DISCOVERY_INVALID",
+          502
+        ),
+        "token_endpoint"
+      );
+      const jwksUri = validateDiscoveredHttpUrl(
+        getRequiredString(
+          discovered.jwks_uri,
+          "OIDC discovery response is missing jwks_uri.",
+          "OIDC_VAULT_DISCOVERY_INVALID",
+          502
+        ),
+        "jwks_uri"
+      );
+      const discoveredIssuer = getRequiredString(
+        discovered.issuer,
+        "OIDC discovery response is missing issuer.",
+        "OIDC_VAULT_DISCOVERY_INVALID",
+        502
+      );
+      assertDiscoveredIssuerMatchesConfig(issuer, discoveredIssuer);
+      return {
+        issuer: discoveredIssuer,
+        authorizationEndpoint,
+        tokenEndpoint,
+        jwksUri,
+        userInfoEndpoint: typeof discovered.userinfo_endpoint === "string" ? validateDiscoveredHttpUrl(discovered.userinfo_endpoint, "userinfo_endpoint") : void 0,
+        endSessionEndpoint: typeof discovered.end_session_endpoint === "string" ? validateDiscoveredHttpUrl(discovered.end_session_endpoint, "end_session_endpoint") : void 0
+      };
+    })();
+    discoveryCache.set(issuer, {
+      expiresAt: now + DEFAULT_DISCOVERY_CACHE_TTL_MS,
+      promise: discoveryPromise
+    });
+    evictOldestEntry(discoveryCache, DEFAULT_DISCOVERY_CACHE_CAPACITY);
+    discoveryPromise.catch(() => {
+      if (discoveryCache.get(issuer)?.promise === discoveryPromise) {
+        discoveryCache.delete(issuer);
+      }
+    });
+  }
+  return discoveryPromise;
+}
+async function resolveProviderMetadata(config, options = {}) {
+  if (config.mode === "manual") {
+    if (!config.issuer) {
+      throw new OidcVaultHttpError(500, "OIDC_VAULT_INVALID_CONFIG", "Manual OIDC configuration requires issuer.");
+    }
+    return {
+      issuer: config.issuer,
+      authorizationEndpoint: config.authorizationEndpoint,
+      tokenEndpoint: config.tokenEndpoint,
+      jwksUri: config.jwksUri,
+      userInfoEndpoint: config.userInfoEndpoint,
+      endSessionEndpoint: config.endSessionEndpoint,
+      clientId: config.clientId,
+      clientSecret: config.clientSecret,
+      scopes: config.scopes
+    };
+  }
+  if (!config.issuer) {
+    throw new OidcVaultHttpError(500, "OIDC_VAULT_INVALID_CONFIG", "Issuer discovery requires an issuer URL.");
+  }
+  return {
+    ...await discoverIssuerMetadata(config.issuer, options),
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes
+  };
+}
+async function requestToken(metadata, params, options = {}) {
+  const clientId = metadata.clientId;
+  if (!clientId) {
+    throw new OidcVaultHttpError(500, "OIDC_VAULT_MISSING_CLIENT_ID", "OIDC clientId is required.");
+  }
+  const body = new URLSearchParams();
+  body.set("client_id", clientId);
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0) {
+      body.set(key, value);
+    }
+  }
+  const headers = {
+    "content-type": "application/x-www-form-urlencoded"
+  };
+  if (metadata.clientSecret) {
+    headers.authorization = toBasicAuthorization(clientId, metadata.clientSecret);
+  }
+  const response = await fetchProvider(
+    metadata.tokenEndpoint,
+    {
+      method: "POST",
+      headers,
+      body
+    },
+    "OIDC_VAULT_TOKEN_REQUEST_FAILED",
+    options
   );
+  const json = await readJsonResponse(response, "OIDC_VAULT_TOKEN_REQUEST_FAILED");
+  if (!response.ok) {
+    throw new OidcVaultHttpError(
+      502,
+      "OIDC_VAULT_TOKEN_REQUEST_FAILED",
+      typeof json.error_description === "string" ? json.error_description : `OIDC token request failed with status ${response.status}.`,
+      "OIDC token request failed."
+    );
+  }
+  return json;
+}
+function validateTokenResponse(tokenResponse) {
+  if (typeof tokenResponse.token_type !== "string" || tokenResponse.token_type.toLowerCase() !== "bearer") {
+    throw new OidcVaultHttpError(
+      502,
+      "OIDC_VAULT_INVALID_TOKEN_RESPONSE",
+      "OIDC token response token_type must be Bearer."
+    );
+  }
+  if (tokenResponse.expires_in !== void 0) {
+    getRequiredFiniteNonNegativeInteger(
+      tokenResponse.expires_in,
+      "OIDC token response expires_in must be a finite non-negative integer.",
+      "OIDC_VAULT_INVALID_TOKEN_RESPONSE"
+    );
+  }
+}
+async function fetchUserInfo(metadata, accessToken, options = {}) {
+  if (!metadata.userInfoEndpoint) {
+    return {};
+  }
+  const response = await fetchProvider(
+    metadata.userInfoEndpoint,
+    {
+      headers: {
+        authorization: `Bearer ${accessToken}`
+      }
+    },
+    "OIDC_VAULT_USERINFO_FAILED",
+    options
+  );
+  const json = await readJsonResponse(response, "OIDC_VAULT_USERINFO_FAILED");
+  if (!response.ok) {
+    throw new OidcVaultHttpError(
+      502,
+      "OIDC_VAULT_USERINFO_FAILED",
+      `OIDC userinfo request failed with status ${response.status}.`,
+      "OIDC userinfo request failed."
+    );
+  }
+  return json;
+}
+
+// src/token-validation.ts
+import { jwtVerify } from "jose";
+var BACKCHANNEL_LOGOUT_EVENT_CLAIM = "http://schemas.openid.net/event/backchannel-logout";
+var validateBackchannelLogoutTokenTyp = (typ) => {
+  if (typ !== void 0 && (typeof typ !== "string" || typ.toLowerCase() !== "logout+jwt")) {
+    throw new OidcVaultHttpError(
+      400,
+      "OIDC_VAULT_INVALID_LOGOUT_TOKEN",
+      "Backchannel logout token protected header typ must be logout+jwt when present."
+    );
+  }
+};
+var defaultJwtClaimsMapper = (claims) => {
+  const subject = getRequiredString(
+    claims.sub,
+    "JWT access token is missing sub.",
+    "OIDC_VAULT_INVALID_ACCESS_TOKEN",
+    401
+  );
+  return {
+    subject,
+    sessionId: typeof claims.sid === "string" ? claims.sid : void 0,
+    scope: typeof claims.scope === "string" ? claims.scope : void 0,
+    claims
+  };
+};
+var assertUserInfoSubject = (userInfo, subject) => {
+  if (!isString(userInfo.sub)) {
+    throw new OidcVaultHttpError(502, "OIDC_VAULT_INVALID_USERINFO", "OIDC userinfo response is missing sub.");
+  }
+  if (userInfo.sub !== subject) {
+    throw new OidcVaultHttpError(502, "OIDC_VAULT_INVALID_USERINFO", "OIDC userinfo sub does not match id_token sub.");
+  }
 };
-var createHookContext = (route, req, res, session, metadata) => ({ route, req, res, session, metadata });
 var mergeUserProfile = (sub, idTokenClaims, userInfo) => ({
   ...idTokenClaims,
   ...userInfo ?? {},
   sub
 });
+async function verifyIdToken(metadata, idToken, nonce, options = {}) {
+  if (!metadata.jwksUri) {
+    throw new OidcVaultHttpError(500, "OIDC_VAULT_MISSING_JWKS_URI", "OIDC jwksUri is required to validate id_token.");
+  }
+  if (!metadata.clientId) {
+    throw new OidcVaultHttpError(
+      500,
+      "OIDC_VAULT_MISSING_CLIENT_ID",
+      "OIDC clientId is required to validate id_token."
+    );
+  }
+  const jwks = resolveJwks(metadata.jwksUri, options);
+  const result = await jwtVerify(idToken, jwks, {
+    audience: metadata.clientId,
+    issuer: metadata.issuer
+  });
+  if (nonce && result.payload.nonce !== nonce) {
+    throw new OidcVaultHttpError(502, "OIDC_VAULT_INVALID_ID_TOKEN", "OIDC id_token nonce validation failed.");
+  }
+  if (typeof result.payload.exp !== "number") {
+    throw new OidcVaultHttpError(502, "OIDC_VAULT_INVALID_ID_TOKEN", "OIDC id_token is missing exp.");
+  }
+  if (typeof result.payload.iat !== "number") {
+    throw new OidcVaultHttpError(502, "OIDC_VAULT_INVALID_ID_TOKEN", "OIDC id_token is missing iat.");
+  }
+  if (!isString(result.payload.sub)) {
+    throw new OidcVaultHttpError(502, "OIDC_VAULT_INVALID_ID_TOKEN", "OIDC id_token is missing sub.");
+  }
+  if (result.payload.azp !== void 0 && result.payload.azp !== metadata.clientId) {
+    throw new OidcVaultHttpError(502, "OIDC_VAULT_INVALID_ID_TOKEN", "OIDC id_token azp validation failed.");
+  }
+  if (Array.isArray(result.payload.aud) && result.payload.aud.length > 1 && result.payload.azp !== metadata.clientId) {
+    throw new OidcVaultHttpError(
+      502,
+      "OIDC_VAULT_INVALID_ID_TOKEN",
+      "OIDC id_token azp is required for multiple audiences."
+    );
+  }
+  return result.payload;
+}
+async function verifyBackchannelLogoutToken(metadata, logoutToken, options = {}) {
+  if (!metadata.jwksUri) {
+    throw new OidcVaultHttpError(
+      500,
+      "OIDC_VAULT_MISSING_JWKS_URI",
+      "OIDC jwksUri is required to validate logout_token."
+    );
+  }
+  if (!metadata.clientId) {
+    throw new OidcVaultHttpError(
+      500,
+      "OIDC_VAULT_MISSING_CLIENT_ID",
+      "OIDC clientId is required to validate logout_token."
+    );
+  }
+  const jwks = resolveJwks(metadata.jwksUri, options);
+  const result = await jwtVerify(logoutToken, jwks, {
+    audience: metadata.clientId,
+    issuer: metadata.issuer
+  });
+  const claims = result.payload;
+  validateBackchannelLogoutTokenTyp(result.protectedHeader.typ);
+  if (claims.nonce !== void 0) {
+    throw new OidcVaultHttpError(
+      400,
+      "OIDC_VAULT_INVALID_LOGOUT_TOKEN",
+      "Backchannel logout token must not contain nonce."
+    );
+  }
+  if (!isRecord(claims.events) || !isRecord(claims.events[BACKCHANNEL_LOGOUT_EVENT_CLAIM])) {
+    throw new OidcVaultHttpError(
+      400,
+      "OIDC_VAULT_INVALID_LOGOUT_TOKEN",
+      "Backchannel logout token is missing the required event claim."
+    );
+  }
+  if (!isString(claims.sid) && !isString(claims.sub)) {
+    throw new OidcVaultHttpError(
+      400,
+      "OIDC_VAULT_INVALID_LOGOUT_TOKEN",
+      "Backchannel logout token must include sid or sub."
+    );
+  }
+  if (!isString(claims.jti)) {
+    throw new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_LOGOUT_TOKEN", "Backchannel logout token must include jti.");
+  }
+  getRequiredFiniteNonNegativeInteger(
+    claims.iat,
+    "Backchannel logout token must include iat.",
+    "OIDC_VAULT_INVALID_LOGOUT_TOKEN",
+    400
+  );
+  getRequiredFiniteNonNegativeInteger(
+    claims.exp,
+    "Backchannel logout token must include exp.",
+    "OIDC_VAULT_INVALID_LOGOUT_TOKEN",
+    400
+  );
+  return claims;
+}
+function createOidcVaultJwtAccessTokenValidator(options) {
+  return {
+    async validate(token) {
+      const result = await jwtVerify(token, options.key, {
+        issuer: options.issuer,
+        audience: options.audience,
+        algorithms: options.algorithms
+      });
+      const claims = result.payload;
+      return options.mapClaims ? options.mapClaims(claims) : defaultJwtClaimsMapper(claims);
+    }
+  };
+}
+
+// src/types.ts
+var OidcVaultStoreConflictError = class extends Error {
+  constructor(message = "OIDC vault store operation conflicted with concurrent state changes.") {
+    super(message);
+    this.name = "OidcVaultStoreConflictError";
+  }
+};
+
+// src/access-token-middleware.ts
+var extractBearerToken = (authorizationHeader) => {
+  if (!authorizationHeader) {
+    throw new OidcVaultHttpError(401, "OIDC_VAULT_MISSING_BEARER_TOKEN", "Missing bearer token.");
+  }
+  const [scheme, token, extra] = authorizationHeader.trim().split(/\s+/);
+  if (scheme?.toLowerCase() !== "bearer" || !token || extra) {
+    throw new OidcVaultHttpError(
+      401,
+      "OIDC_VAULT_INVALID_AUTHORIZATION_HEADER",
+      "Authorization header must use the Bearer scheme."
+    );
+  }
+  return token;
+};
+var setBearerChallengeHeader = (res) => {
+  res.setHeader("WWW-Authenticate", "Bearer");
+};
+function createOidcVaultAccessTokenMiddleware(options) {
+  return async (req, res, next) => {
+    try {
+      const token = extractBearerToken(req.get("authorization"));
+      const validationResult = await options.validator.validate(token);
+      const auth = {
+        token,
+        ...validationResult
+      };
+      const authenticatedRequest = req;
+      authenticatedRequest.auth = auth;
+      await options.onAuthContext?.({ req: authenticatedRequest, res, auth });
+      next();
+    } catch (error) {
+      if (error instanceof OidcVaultHttpError) {
+        setBearerChallengeHeader(res);
+        res.status(error.status).json({
+          code: error.code,
+          message: error.clientMessage
+        });
+        return;
+      }
+      setBearerChallengeHeader(res);
+      res.status(401).json({
+        code: "OIDC_VAULT_INVALID_ACCESS_TOKEN",
+        message: "Access token validation failed."
+      });
+    }
+  };
+}
+
+// src/index.ts
+function normalizeOidcVaultBasePath(value) {
+  if (!value || value === "/") {
+    return DEFAULT_OIDC_VAULT_BASE_PATH;
+  }
+  return `/${value.replace(/^\/+|\/+$/g, "")}`;
+}
+var getNow = (options) => (options.now ?? Date.now)();
+var createOpaqueId = (prefix) => `${prefix}_${randomBytes(16).toString("base64url")}`;
+var createPkceVerifier = () => randomBytes(32).toString("base64url");
+var createPkceChallenge = (verifier) => createHash("sha256").update(verifier).digest("base64url");
+var getCallbackUri = (backendOrigin, basePath) => `${backendOrigin}${basePath}${OIDC_VAULT_ROUTE_PATHS.callback}`;
+var validateOidcVaultOptions = (options) => {
+  const backendOrigin = resolveBackendOrigin(options);
+  const frontendRedirectUri = resolveFrontendRedirectUri(options);
+  validatePostLogoutRedirectUri(options);
+  validateCookieOptions(options);
+  const config = resolveOidcVaultConfig(options.config);
+  const configuredTrustedOrigins = resolveTrustedOrigins(options);
+  if (usesCrossSiteCookieTransport(options) && configuredTrustedOrigins.size === 0) {
+    throw new Error("trustedOrigins is required when using cross-site cookie transport.");
+  }
+  const trustedOrigins = new Set(configuredTrustedOrigins);
+  trustedOrigins.add(backendOrigin);
+  if (frontendRedirectUri) {
+    options.frontendRedirectUri = frontendRedirectUri;
+  }
+  return { backendOrigin, config, trustedOrigins };
+};
+var isStoreConflictError = (error) => error instanceof OidcVaultStoreConflictError || typeof error === "object" && error !== null && "name" in error && error.name === "OidcVaultStoreConflictError";
+var getSessionIdFromRequest = (req, options, action) => {
+  if (usesCookieTransport(options)) {
+    const cookieSessionId = getSessionIdFromCookie(req, options);
+    if (isString(cookieSessionId)) {
+      return cookieSessionId;
+    }
+    throw new OidcVaultHttpError(
+      400,
+      "OIDC_VAULT_MISSING_SESSION_ID",
+      `${action === "refresh" ? "Refresh" : "Logout"} request is missing the session cookie.`
+    );
+  }
+  const body = getBody(req);
+  return getRequiredString(
+    body.sessionId,
+    `${action === "refresh" ? "Refresh" : "Logout"} request is missing sessionId.`,
+    "OIDC_VAULT_MISSING_SESSION_ID"
+  );
+};
+var createExchangeResponse = (options, session, issuedToken) => ({
+  sessionId: usesCookieTransport(options) ? void 0 : session.sessionId,
+  user: session.user,
+  ...issuedToken
+});
+var appendQueryParam = (url, name, value) => {
+  if (value) {
+    url.searchParams.set(name, value);
+  }
+};
+var buildAuthorizationUrl = (metadata, transaction, redirectUri) => {
+  const url = new URL(metadata.authorizationEndpoint);
+  appendQueryParam(url, "response_type", "code");
+  appendQueryParam(url, "client_id", metadata.clientId);
+  appendQueryParam(url, "redirect_uri", redirectUri);
+  appendQueryParam(url, "scope", metadata.scopes);
+  appendQueryParam(url, "state", transaction.state);
+  appendQueryParam(url, "nonce", transaction.nonce);
+  appendQueryParam(url, "code_challenge", transaction.codeChallenge);
+  appendQueryParam(url, "code_challenge_method", "S256");
+  return url.toString();
+};
+var buildLogoutUrl = (endSessionEndpoint, idTokenHint, postLogoutRedirectUri) => {
+  const url = new URL(endSessionEndpoint);
+  appendQueryParam(url, "id_token_hint", idTokenHint);
+  appendQueryParam(url, "post_logout_redirect_uri", postLogoutRedirectUri);
+  return url.toString();
+};
+var getLogoutTokenFromRequest = (req) => {
+  const body = getBody(req);
+  return getRequiredString(
+    body.logout_token,
+    "Backchannel logout request is missing logout_token.",
+    "OIDC_VAULT_MISSING_LOGOUT_TOKEN"
+  );
+};
+var createHookContext = (route, req, res, session, metadata) => ({ route, req, res, session, metadata });
 var resolveReturnTo = (req, options) => {
   const rawReturnTo = req.query.returnTo;
   if (!isString(rawReturnTo)) {
@@ -372,7 +1047,12 @@ var resolveReturnTo = (req, options) => {
     );
   }
   const configuredUrl = new URL(configuredFrontendUri);
-  const resolvedUrl = rawReturnTo.startsWith("/") ? new URL(rawReturnTo, configuredUrl) : new URL(rawReturnTo);
+  let resolvedUrl;
+  try {
+    resolvedUrl = rawReturnTo.startsWith("/") ? new URL(rawReturnTo, configuredUrl) : new URL(rawReturnTo);
+  } catch {
+    throw new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_RETURN_TO", "returnTo must be a valid URL.");
+  }
   if (resolvedUrl.origin !== configuredUrl.origin) {
     throw new OidcVaultHttpError(
       400,
@@ -387,14 +1067,13 @@ var appendCodeToRedirectUri = (redirectUri, code) => {
   url.searchParams.set("code", code);
   return url.toString();
 };
-var getBody = (req) => isRecord(req.body) ? req.body : {};
 var withIssuedToken = async (req, res, options, session) => {
   if (!options.tokenIssuer) {
     return {};
   }
   return options.tokenIssuer.issue({ req, res, session });
 };
-var resolveFrontendRedirectUri = (transaction, options) => {
+var resolveFrontendRedirectUri2 = (transaction, options) => {
   const redirectUri = transaction.returnTo ?? options.frontendRedirectUri;
   if (!redirectUri) {
     throw new OidcVaultHttpError(
@@ -412,6 +1091,22 @@ async function callHook(route, hook, req, res, session, metadata) {
   }
   await hook(createHookContext(route, req, res, session, metadata));
 }
+async function callPostCommitHook(route, options, hook, req, res, session, metadata) {
+  if (!hook) {
+    return;
+  }
+  try {
+    await hook(createHookContext(route, req, res, session, metadata));
+  } catch (error) {
+    try {
+      await options.hooks?.onError?.({
+        ...createHookContext(route, req, res, session, metadata),
+        error
+      });
+    } catch {
+    }
+  }
+}
 async function handleRouteError(route, req, res, next, options, error) {
   try {
     await options.hooks?.onError?.({
@@ -439,208 +1134,21 @@ function createAsyncHandler(route, options, handler) {
     }
   };
 }
-async function discoverIssuerMetadata(issuer) {
-  let discoveryPromise = discoveryCache.get(issuer);
-  if (!discoveryPromise) {
-    discoveryPromise = (async () => {
-      const discoveryUrl = buildWellKnownUrl(issuer);
-      const response = await fetch(discoveryUrl);
-      if (!response.ok) {
-        const errorText = await response.text();
-        throw new OidcVaultHttpError(
-          502,
-          "OIDC_VAULT_DISCOVERY_FAILED",
-          errorText || `OIDC discovery failed with status ${response.status}.`
-        );
-      }
-      const discovered = await response.json();
-      const authorizationEndpoint = getRequiredString(
-        discovered.authorization_endpoint,
-        "OIDC discovery response is missing authorization_endpoint.",
-        "OIDC_VAULT_DISCOVERY_INVALID",
-        502
-      );
-      const tokenEndpoint = getRequiredString(
-        discovered.token_endpoint,
-        "OIDC discovery response is missing token_endpoint.",
-        "OIDC_VAULT_DISCOVERY_INVALID",
-        502
-      );
-      const jwksUri = getRequiredString(
-        discovered.jwks_uri,
-        "OIDC discovery response is missing jwks_uri.",
-        "OIDC_VAULT_DISCOVERY_INVALID",
-        502
-      );
-      return {
-        issuer: getRequiredString(
-          discovered.issuer,
-          "OIDC discovery response is missing issuer.",
-          "OIDC_VAULT_DISCOVERY_INVALID",
-          502
-        ),
-        authorizationEndpoint,
-        tokenEndpoint,
-        jwksUri,
-        userInfoEndpoint: typeof discovered.userinfo_endpoint === "string" ? discovered.userinfo_endpoint : void 0,
-        endSessionEndpoint: typeof discovered.end_session_endpoint === "string" ? discovered.end_session_endpoint : void 0
-      };
-    })();
-    discoveryCache.set(issuer, discoveryPromise);
-    discoveryPromise.catch(() => {
-      if (discoveryCache.get(issuer) === discoveryPromise) {
-        discoveryCache.delete(issuer);
-      }
-    });
-  }
-  return discoveryPromise;
-}
-async function resolveProviderMetadata(config) {
-  if (config.mode === "manual") {
-    return {
-      issuer: config.issuer,
-      authorizationEndpoint: config.authorizationEndpoint,
-      tokenEndpoint: config.tokenEndpoint,
-      jwksUri: config.jwksUri,
-      userInfoEndpoint: config.userInfoEndpoint,
-      endSessionEndpoint: config.endSessionEndpoint,
-      clientId: config.clientId,
-      clientSecret: config.clientSecret,
-      scopes: config.scopes
-    };
-  }
-  if (!config.issuer) {
-    throw new OidcVaultHttpError(500, "OIDC_VAULT_INVALID_CONFIG", "Issuer discovery requires an issuer URL.");
-  }
-  return {
-    ...await discoverIssuerMetadata(config.issuer),
-    clientId: config.clientId,
-    clientSecret: config.clientSecret,
-    scopes: config.scopes
-  };
-}
-async function requestToken(metadata, params) {
-  const clientId = metadata.clientId;
-  if (!clientId) {
-    throw new OidcVaultHttpError(500, "OIDC_VAULT_MISSING_CLIENT_ID", "OIDC clientId is required.");
-  }
-  const body = new URLSearchParams();
-  body.set("client_id", clientId);
-  for (const [key, value] of Object.entries(params)) {
-    if (value !== void 0) {
-      body.set(key, value);
+function createBodyParserErrorHandler() {
+  return (error, _req, res, next) => {
+    if (!isBodyParserError(error)) {
+      next(error);
+      return;
     }
-  }
-  const headers = {
-    "content-type": "application/x-www-form-urlencoded"
+    const payload = toBodyParserErrorPayload(error);
+    res.status(payload.status).json({
+      code: payload.code,
+      message: payload.message
+    });
   };
-  if (metadata.clientSecret) {
-    headers.authorization = toBasicAuthorization(clientId, metadata.clientSecret);
-  }
-  const response = await fetch(metadata.tokenEndpoint, {
-    method: "POST",
-    headers,
-    body
-  });
-  const json = await readJsonResponse(response, "OIDC_VAULT_TOKEN_REQUEST_FAILED");
-  if (!response.ok) {
-    throw new OidcVaultHttpError(
-      502,
-      "OIDC_VAULT_TOKEN_REQUEST_FAILED",
-      typeof json.error_description === "string" ? json.error_description : `OIDC token request failed with status ${response.status}.`
-    );
-  }
-  return json;
-}
-async function fetchUserInfo(metadata, accessToken) {
-  if (!metadata.userInfoEndpoint) {
-    return {};
-  }
-  const response = await fetch(metadata.userInfoEndpoint, {
-    headers: {
-      authorization: `Bearer ${accessToken}`
-    }
-  });
-  const json = await readJsonResponse(response, "OIDC_VAULT_USERINFO_FAILED");
-  if (!response.ok) {
-    throw new OidcVaultHttpError(
-      502,
-      "OIDC_VAULT_USERINFO_FAILED",
-      `OIDC userinfo request failed with status ${response.status}.`
-    );
-  }
-  return json;
-}
-async function verifyIdToken(metadata, idToken, nonce) {
-  if (!metadata.jwksUri) {
-    throw new OidcVaultHttpError(500, "OIDC_VAULT_MISSING_JWKS_URI", "OIDC jwksUri is required to validate id_token.");
-  }
-  if (!metadata.clientId) {
-    throw new OidcVaultHttpError(
-      500,
-      "OIDC_VAULT_MISSING_CLIENT_ID",
-      "OIDC clientId is required to validate id_token."
-    );
-  }
-  const jwks = resolveJwks(metadata.jwksUri);
-  const result = await jwtVerify(idToken, jwks, {
-    audience: metadata.clientId,
-    issuer: metadata.issuer
-  });
-  if (nonce && result.payload.nonce !== nonce) {
-    throw new OidcVaultHttpError(502, "OIDC_VAULT_INVALID_ID_TOKEN", "OIDC id_token nonce validation failed.");
-  }
-  return result.payload;
-}
-async function verifyBackchannelLogoutToken(metadata, logoutToken) {
-  if (!metadata.jwksUri) {
-    throw new OidcVaultHttpError(
-      500,
-      "OIDC_VAULT_MISSING_JWKS_URI",
-      "OIDC jwksUri is required to validate logout_token."
-    );
-  }
-  if (!metadata.clientId) {
-    throw new OidcVaultHttpError(
-      500,
-      "OIDC_VAULT_MISSING_CLIENT_ID",
-      "OIDC clientId is required to validate logout_token."
-    );
-  }
-  const jwks = resolveJwks(metadata.jwksUri);
-  const result = await jwtVerify(logoutToken, jwks, {
-    audience: metadata.clientId,
-    issuer: metadata.issuer
-  });
-  const claims = result.payload;
-  if (claims.nonce !== void 0) {
-    throw new OidcVaultHttpError(
-      400,
-      "OIDC_VAULT_INVALID_LOGOUT_TOKEN",
-      "Backchannel logout token must not contain nonce."
-    );
-  }
-  if (!isRecord(claims.events) || !(BACKCHANNEL_LOGOUT_EVENT_CLAIM in claims.events)) {
-    throw new OidcVaultHttpError(
-      400,
-      "OIDC_VAULT_INVALID_LOGOUT_TOKEN",
-      "Backchannel logout token is missing the required event claim."
-    );
-  }
-  if (!isString(claims.sid) && !isString(claims.sub)) {
-    throw new OidcVaultHttpError(
-      400,
-      "OIDC_VAULT_INVALID_LOGOUT_TOKEN",
-      "Backchannel logout token must include sid or sub."
-    );
-  }
-  if (!isString(claims.jti)) {
-    throw new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_LOGOUT_TOKEN", "Backchannel logout token must include jti.");
-  }
-  return claims;
 }
-var createLoginHandler = (options, config, basePath) => createAsyncHandler("login", options, async (req, res) => {
-  const metadata = await resolveProviderMetadata(config);
+var createLoginHandler = (options, config, backendOrigin, basePath) => createAsyncHandler("login", options, async (req, res) => {
+  const metadata = await resolveProviderMetadata(config, options);
   await callHook("login", options.hooks?.onLoginStart, req, res, void 0, { provider: metadata });
   const now = getNow(options);
   const pkceVerifier = createPkceVerifier();
@@ -654,14 +1162,14 @@ var createLoginHandler = (options, config, basePath) => createAsyncHandler("logi
     expiresAt: now + (options.authorizationTransactionTtlMs ?? DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS)
   };
   await options.storeProvider.createAuthorizationTransaction(transaction);
-  const authorizationUrl = buildAuthorizationUrl(metadata, transaction, getCallbackUri(req, basePath));
+  const authorizationUrl = buildAuthorizationUrl(metadata, transaction, getCallbackUri(backendOrigin, basePath));
   await callHook("login", options.hooks?.onAuthorizationUrl, req, res, void 0, {
     authorizationUrl,
     state: transaction.state
   });
   res.redirect(302, authorizationUrl);
 });
-var createCallbackHandler = (options, config, basePath) => createAsyncHandler("callback", options, async (req, res) => {
+var createCallbackHandler = (options, config, backendOrigin, basePath) => createAsyncHandler("callback", options, async (req, res) => {
   if (isString(req.query.error)) {
     throw new OidcVaultHttpError(400, "OIDC_VAULT_CALLBACK_ERROR", req.query.error);
   }
@@ -675,13 +1183,18 @@ var createCallbackHandler = (options, config, basePath) => createAsyncHandler("c
   if (!transaction) {
     throw new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_STATE", "OIDC state is invalid or expired.");
   }
-  const metadata = await resolveProviderMetadata(config);
-  const tokenResponse = await requestToken(metadata, {
-    grant_type: "authorization_code",
-    code,
-    code_verifier: transaction.pkceVerifier,
-    redirect_uri: getCallbackUri(req, basePath)
-  });
+  const metadata = await resolveProviderMetadata(config, options);
+  const tokenResponse = await requestToken(
+    metadata,
+    {
+      grant_type: "authorization_code",
+      code,
+      code_verifier: transaction.pkceVerifier,
+      redirect_uri: getCallbackUri(backendOrigin, basePath)
+    },
+    options
+  );
+  validateTokenResponse(tokenResponse);
   if (!isString(tokenResponse.id_token)) {
     throw new OidcVaultHttpError(502, "OIDC_VAULT_MISSING_ID_TOKEN", "OIDC token response is missing id_token.");
   }
@@ -697,9 +1210,12 @@ var createCallbackHandler = (options, config, basePath) => createAsyncHandler("c
     hasRefreshToken: true,
     hasIdToken: true
   });
-  const claims = await verifyIdToken(metadata, tokenResponse.id_token, transaction.nonce);
+  const claims = await verifyIdToken(metadata, tokenResponse.id_token, transaction.nonce, options);
   const subject = getRequiredString(claims.sub, "OIDC id_token is missing sub.", "OIDC_VAULT_INVALID_ID_TOKEN", 502);
-  const userInfo = shouldFetchUserInfo(options, metadata) && isString(tokenResponse.access_token) ? await fetchUserInfo(metadata, tokenResponse.access_token) : void 0;
+  const userInfo = shouldFetchUserInfo(options, metadata) && isString(tokenResponse.access_token) ? await fetchUserInfo(metadata, tokenResponse.access_token, options) : void 0;
+  if (userInfo) {
+    assertUserInfoSubject(userInfo, subject);
+  }
   if (userInfo) {
     await callHook("callback", options.hooks?.onUserInfo, req, res, void 0, { subject });
   }
@@ -707,6 +1223,7 @@ var createCallbackHandler = (options, config, basePath) => createAsyncHandler("c
   const sessionId = createOpaqueId("sess");
   const session = {
     sessionId,
+    logicalSessionId: sessionId,
     subject,
     providerSessionId: typeof claims.sid === "string" ? claims.sid : void 0,
     provider: {
@@ -717,7 +1234,6 @@ var createCallbackHandler = (options, config, basePath) => createAsyncHandler("c
     idToken: tokenResponse.id_token,
     accessToken: isString(tokenResponse.access_token) ? tokenResponse.access_token : void 0,
     scope: typeof tokenResponse.scope === "string" ? tokenResponse.scope : metadata.scopes,
-    expiresAt: typeof tokenResponse.expires_in === "number" ? now + tokenResponse.expires_in * 1e3 : void 0,
     createdAt: now,
     updatedAt: now,
     user: mergeUserProfile(subject, claims, userInfo),
@@ -727,16 +1243,25 @@ var createCallbackHandler = (options, config, basePath) => createAsyncHandler("c
   };
   await callHook("callback", options.hooks?.onBeforeSessionCreate, req, res, session, { subject });
   const createdSession = await options.storeProvider.createSession(session);
-  await callHook("callback", options.hooks?.onSessionCreated, req, res, createdSession, { subject });
   const exchangeCode = createOpaqueId("code");
-  await options.storeProvider.createExchangeCode({
-    code: exchangeCode,
-    sessionId: createdSession.sessionId,
-    returnTo: transaction.returnTo,
-    createdAt: now,
-    expiresAt: now + (options.exchangeCodeTtlMs ?? DEFAULT_EXCHANGE_CODE_TTL_MS)
+  try {
+    await options.storeProvider.createExchangeCode({
+      code: exchangeCode,
+      sessionId: createdSession.sessionId,
+      returnTo: transaction.returnTo,
+      createdAt: now,
+      expiresAt: now + (options.exchangeCodeTtlMs ?? DEFAULT_EXCHANGE_CODE_TTL_MS)
+    });
+  } catch (error) {
+    await options.storeProvider.deleteSessionsByLogicalSessionId({
+      logicalSessionId: createdSession.logicalSessionId ?? createdSession.sessionId
+    });
+    throw error;
+  }
+  await callPostCommitHook("callback", options, options.hooks?.onSessionCreated, req, res, createdSession, {
+    subject
   });
-  res.redirect(302, appendCodeToRedirectUri(resolveFrontendRedirectUri(transaction, options), exchangeCode));
+  res.redirect(302, appendCodeToRedirectUri(resolveFrontendRedirectUri2(transaction, options), exchangeCode));
 });
 var createExchangeHandler = (options) => createAsyncHandler("exchange", options, async (req, res) => {
   const body = getBody(req);
@@ -749,7 +1274,18 @@ var createExchangeHandler = (options) => createAsyncHandler("exchange", options,
   if (!session) {
     throw new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_SESSION", "Session is missing or expired.");
   }
-  const issuedToken = await withIssuedToken(req, res, options, session);
+  let issuedToken;
+  try {
+    issuedToken = await withIssuedToken(req, res, options, session);
+  } catch (error) {
+    await options.storeProvider.deleteSessionsByLogicalSessionId({
+      logicalSessionId: session.logicalSessionId ?? session.sessionId
+    });
+    if (usesCookieTransport(options)) {
+      clearSessionCookie(res, options);
+    }
+    throw error;
+  }
   if (usesCookieTransport(options)) {
     setSessionCookie(res, options, session.sessionId);
   }
@@ -766,30 +1302,43 @@ var createRefreshHandler = (options, config, trustedOrigins) => createAsyncHandl
     }
     throw new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_SESSION", "Session is missing or expired.");
   }
-  const metadata = await resolveProviderMetadata(config);
-  const tokenResponse = await requestToken(metadata, {
-    grant_type: "refresh_token",
-    refresh_token: currentSession.refreshToken
-  });
-  const idToken = isString(tokenResponse.id_token) ? tokenResponse.id_token : currentSession.idToken;
-  const claims = await verifyIdToken(metadata, idToken);
-  const subject = getRequiredString(claims.sub, "OIDC id_token is missing sub.", "OIDC_VAULT_INVALID_ID_TOKEN", 502);
-  const userInfo = shouldFetchUserInfo(options, metadata) && isString(tokenResponse.access_token) ? await fetchUserInfo(metadata, tokenResponse.access_token) : void 0;
+  const metadata = await resolveProviderMetadata(config, options);
+  const tokenResponse = await requestToken(
+    metadata,
+    {
+      grant_type: "refresh_token",
+      refresh_token: currentSession.refreshToken
+    },
+    options
+  );
+  validateTokenResponse(tokenResponse);
+  const newIdToken = isString(tokenResponse.id_token) ? tokenResponse.id_token : void 0;
+  const idToken = newIdToken ?? currentSession.idToken;
+  const claims = newIdToken ? await verifyIdToken(metadata, newIdToken, void 0, options) : currentSession.user ?? { sub: currentSession.subject };
+  const subject = newIdToken ? getRequiredString(claims.sub, "OIDC id_token is missing sub.", "OIDC_VAULT_INVALID_ID_TOKEN", 502) : currentSession.subject;
+  if (newIdToken && subject !== currentSession.subject) {
+    throw new OidcVaultHttpError(502, "OIDC_VAULT_INVALID_ID_TOKEN", "OIDC refreshed id_token sub changed.");
+  }
+  const userInfo = shouldFetchUserInfo(options, metadata) && isString(tokenResponse.access_token) ? await fetchUserInfo(metadata, tokenResponse.access_token, options) : void 0;
+  if (userInfo) {
+    assertUserInfoSubject(userInfo, subject);
+  }
   const now = getNow(options);
+  const logicalSessionId = currentSession.logicalSessionId ?? currentSession.sessionId;
   const nextSession = {
     ...currentSession,
     sessionId: createOpaqueId("sess"),
+    logicalSessionId,
     subject,
     providerSessionId: typeof claims.sid === "string" ? claims.sid : currentSession.providerSessionId,
     refreshToken: isString(tokenResponse.refresh_token) ? tokenResponse.refresh_token : currentSession.refreshToken,
     idToken,
     accessToken: isString(tokenResponse.access_token) ? tokenResponse.access_token : currentSession.accessToken,
     scope: typeof tokenResponse.scope === "string" ? tokenResponse.scope : currentSession.scope,
-    expiresAt: typeof tokenResponse.expires_in === "number" ? now + tokenResponse.expires_in * 1e3 : currentSession.expiresAt,
+    expiresAt: currentSession.expiresAt,
     updatedAt: now,
     user: mergeUserProfile(subject, claims, userInfo ?? currentSession.user)
   };
-  const issuedToken = await withIssuedToken(req, res, options, nextSession);
   let rotatedSession;
   try {
     rotatedSession = await options.storeProvider.rotateSession({
@@ -797,7 +1346,7 @@ var createRefreshHandler = (options, config, trustedOrigins) => createAsyncHandl
       nextSession
     });
   } catch (error) {
-    if (error instanceof OidcVaultStoreConflictError) {
+    if (isStoreConflictError(error)) {
       if (usesCookieTransport(options)) {
         clearSessionCookie(res, options);
       }
@@ -805,7 +1354,19 @@ var createRefreshHandler = (options, config, trustedOrigins) => createAsyncHandl
     }
     throw error;
   }
-  await callHook("refresh", options.hooks?.onSessionRefreshed, req, res, rotatedSession, {
+  let issuedToken;
+  try {
+    issuedToken = await withIssuedToken(req, res, options, rotatedSession);
+  } catch (error) {
+    await options.storeProvider.deleteSessionsByLogicalSessionId({
+      logicalSessionId: rotatedSession.logicalSessionId ?? rotatedSession.sessionId
+    });
+    if (usesCookieTransport(options)) {
+      clearSessionCookie(res, options);
+    }
+    throw error;
+  }
+  await callPostCommitHook("refresh", options, options.hooks?.onSessionRefreshed, req, res, rotatedSession, {
     previousSessionId: currentSession.sessionId
   });
   if (usesCookieTransport(options)) {
@@ -821,6 +1382,7 @@ var createLogoutHandler = (options, config, trustedOrigins) => createAsyncHandle
   const redirect = body.redirect === true;
   const session = await options.storeProvider.getSession(sessionId);
   if (!session) {
+    await options.storeProvider.deleteSession(sessionId);
     if (usesCookieTransport(options)) {
       clearSessionCookie(res, options);
     }
@@ -828,26 +1390,38 @@ var createLogoutHandler = (options, config, trustedOrigins) => createAsyncHandle
     return;
   }
   await callHook("logout", options.hooks?.onBeforeLogout, req, res, session, void 0);
-  await options.storeProvider.deleteSession(sessionId);
+  await options.storeProvider.deleteSessionsByLogicalSessionId({
+    logicalSessionId: session.logicalSessionId ?? session.sessionId
+  });
   if (usesCookieTransport(options)) {
     clearSessionCookie(res, options);
   }
-  const metadata = await resolveProviderMetadata(config);
+  const metadata = await resolveProviderMetadata(config, options);
   const upstreamLogoutUrl = metadata.endSessionEndpoint ? buildLogoutUrl(metadata.endSessionEndpoint, session.idToken, options.postLogoutRedirectUri) : void 0;
-  await callHook("logout", options.hooks?.onLogout, req, res, session, { upstreamLogoutUrl });
+  await callPostCommitHook("logout", options, options.hooks?.onLogout, req, res, session);
   if (redirect && upstreamLogoutUrl) {
     res.redirect(302, upstreamLogoutUrl);
     return;
   }
   res.status(200).json({
-    loggedOut: true,
-    upstreamLogoutUrl
+    loggedOut: true
   });
 });
 var createBackchannelLogoutHandler = (options, config) => createAsyncHandler("backchannel-logout", options, async (req, res) => {
-  const metadata = await resolveProviderMetadata(config);
+  const metadata = await resolveProviderMetadata(config, options);
   const logoutToken = getLogoutTokenFromRequest(req);
-  const claims = await verifyBackchannelLogoutToken(metadata, logoutToken);
+  const claims = await verifyBackchannelLogoutToken(metadata, logoutToken, options);
+  const firstUse = await options.storeProvider.consumeBackchannelLogoutTokenJti({
+    jti: claims.jti,
+    expiresAt: claims.exp * 1e3
+  });
+  if (!firstUse) {
+    res.status(200).json({
+      loggedOut: true,
+      revokedSessions: 0
+    });
+    return;
+  }
   const revokedSessions = isString(claims.sid) ? await options.storeProvider.deleteSessionsByProviderSessionId({
     providerSessionId: claims.sid,
     issuer: metadata.issuer,
@@ -857,7 +1431,7 @@ var createBackchannelLogoutHandler = (options, config) => createAsyncHandler("ba
     issuer: metadata.issuer,
     clientId: metadata.clientId
   });
-  await callHook("backchannel-logout", options.hooks?.onLogout, req, res, void 0, {
+  await callPostCommitHook("backchannel-logout", options, options.hooks?.onLogout, req, res, void 0, {
     providerSessionId: claims.sid,
     subject: claims.sub,
     revokedSessions
@@ -867,73 +1441,30 @@ var createBackchannelLogoutHandler = (options, config) => createAsyncHandler("ba
     revokedSessions
   });
 });
-function registerRoutes(router, options, config, trustedOrigins, basePath) {
-  router.get(OIDC_VAULT_ROUTE_PATHS.login, createLoginHandler(options, config, basePath));
-  router.get(OIDC_VAULT_ROUTE_PATHS.callback, createCallbackHandler(options, config, basePath));
+function registerRoutes(router, options, config, trustedOrigins, backendOrigin, basePath) {
+  router.get(OIDC_VAULT_ROUTE_PATHS.login, createLoginHandler(options, config, backendOrigin, basePath));
+  router.get(OIDC_VAULT_ROUTE_PATHS.callback, createCallbackHandler(options, config, backendOrigin, basePath));
   router.post(OIDC_VAULT_ROUTE_PATHS.exchange, createExchangeHandler(options));
   router.post(OIDC_VAULT_ROUTE_PATHS.refresh, createRefreshHandler(options, config, trustedOrigins));
   router.post(OIDC_VAULT_ROUTE_PATHS.logout, createLogoutHandler(options, config, trustedOrigins));
   router.post(OIDC_VAULT_ROUTE_PATHS["backchannel-logout"], createBackchannelLogoutHandler(options, config));
 }
-function createOidcVaultJwtAccessTokenValidator(options) {
-  return {
-    async validate(token) {
-      const result = await jwtVerify(token, options.key, {
-        issuer: options.issuer,
-        audience: options.audience,
-        algorithms: options.algorithms
-      });
-      const claims = result.payload;
-      return options.mapClaims ? options.mapClaims(claims) : defaultJwtClaimsMapper(claims);
-    }
-  };
-}
-function createOidcVaultAccessTokenMiddleware(options) {
-  return async (req, res, next) => {
-    try {
-      const token = extractBearerToken(req.get("authorization"));
-      const validationResult = await options.validator.validate(token);
-      const auth = {
-        token,
-        ...validationResult
-      };
-      const authenticatedRequest = req;
-      authenticatedRequest.auth = auth;
-      await options.onAuthContext?.({ req: authenticatedRequest, res, auth });
-      next();
-    } catch (error) {
-      if (error instanceof OidcVaultHttpError) {
-        setBearerChallengeHeader(res);
-        res.status(error.status).json({
-          code: error.code,
-          message: error.message
-        });
-        return;
-      }
-      if (error instanceof Error) {
-        setBearerChallengeHeader(res);
-        res.status(401).json({
-          code: "OIDC_VAULT_INVALID_ACCESS_TOKEN",
-          message: error.message || "Access token validation failed."
-        });
-        return;
-      }
-      setBearerChallengeHeader(res);
-      res.status(401).json({
-        code: "OIDC_VAULT_INVALID_ACCESS_TOKEN",
-        message: "Access token validation failed."
-      });
-    }
-  };
-}
 function createOidcVaultMiddleware(options) {
-  const { config, trustedOrigins } = validateOidcVaultOptions(options);
+  const { backendOrigin, config, trustedOrigins } = validateOidcVaultOptions(options);
   const rootRouter = express.Router();
   const baseRouter = express.Router();
   const basePath = normalizeOidcVaultBasePath(options.basePath);
-  baseRouter.use(express.json());
-  baseRouter.use(express.urlencoded({ extended: false }));
-  registerRoutes(baseRouter, options, config, trustedOrigins, basePath);
+  const requestBodyLimit = options.requestBodyLimit ?? DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT;
+  baseRouter.use(express.json({ limit: requestBodyLimit }));
+  baseRouter.use(
+    express.urlencoded({
+      extended: false,
+      limit: requestBodyLimit,
+      parameterLimit: OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT
+    })
+  );
+  baseRouter.use(createBodyParserErrorHandler());
+  registerRoutes(baseRouter, options, config, trustedOrigins, backendOrigin, basePath);
   rootRouter.use(basePath, baseRouter);
   return rootRouter;
 }
@@ -942,8 +1473,9 @@ export {
   DEFAULT_EXCHANGE_CODE_TTL_MS,
   DEFAULT_OIDC_SCOPES,
   DEFAULT_OIDC_VAULT_BASE_PATH,
-  DEFAULT_SESSION_COOKIE_NAME,
+  DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT,
   OIDC_VAULT_ROUTE_PATHS,
+  OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT,
   OidcVaultStoreConflictError,
   createOidcVaultAccessTokenMiddleware,
   createOidcVaultJwtAccessTokenValidator,