@web-ts-toolkit/express-oidc-vault 0.42.2 → 0.47.1

package/index.d.ts

@@ -10,6 +10,17 @@ interface OidcVaultUserProfile {
     preferredUsername?: string;
     [key: string]: unknown;
 }
+/**
+ * Stored session identity. Exchange, refresh, and live-session logout compare
+ * each defined field verbatim against resolved middleware config before use.
+ * Known mismatches fail with 401 `OIDC_VAULT_INVALID_SESSION` without changing
+ * the session or cookie. Issuer trailing-slash variants are distinct.
+ *
+ * Omitted fields remain legacy-compatible and are not backfilled by refresh.
+ * Complete isolation requires separate session/alias, exchange-code, and
+ * transaction namespaces: exchange spends its code before this check, and
+ * logout's stale-alias path has no live identity to check.
+ */
 interface OidcVaultProviderMetadata {
     issuer?: string;
     clientId?: string;
@@ -35,11 +46,21 @@ interface OidcVaultSession {
      * This controls the lifetime of the refresh-token-backed server-side session.
      * It is not derived from upstream OAuth `expires_in`, which only describes the
      * upstream access token lifetime. Leave unset when your application or store
-     * owns session lifetime through another policy.
+     * owns session lifetime through another policy. `sessionTtlMs` assigns an
+     * absolute maximum at callback creation; a precreate hook may shorten it.
+     * Refresh preserves this timestamp rather than renewing the lifetime.
      */
     expiresAt?: number;
     createdAt: number;
     updatedAt: number;
+    /**
+     * Verified session profile. On refresh with a new `id_token`, the profile
+     * is rebuilt from fresh verified ID claims overlaid with freshly fetched
+     * matching UserInfo; retained values are never carried forward, so removed
+     * provider claims disappear. Application custom attributes belong in
+     * `metadata`, not in `user`. Without a new `id_token`, the retained
+     * profile is kept verbatim (fresh UserInfo still overlays per key).
+     */
     user?: OidcVaultUserProfile;
     /**
      * Store-portable application metadata.
@@ -101,6 +122,21 @@ interface ConsumeBackchannelLogoutTokenJtiInput {
 declare class OidcVaultStoreConflictError extends Error {
     constructor(message?: string);
 }
+/**
+ * Portable store boundary for JSON-compatible plain objects/arrays and scalar
+ * values (strings, finite numbers, booleans, null). Built-in providers capture
+ * inputs at invocation before asynchronous work; returned portable data is
+ * detached from caller input and stored state. Native BSON/JSON/structured-clone
+ * values outside that subset retain provider-specific serialization semantics;
+ * opaque native objects have no cross-provider mutation-isolation guarantee.
+ *
+ * Bulk deletion counts primary records removed, never alias cleanup. Memory
+ * excludes expired sessions; MongoDB can count expired rows awaiting TTL cleanup;
+ * Redis counts actual primary deletions during a cursor traversal. Counts are not
+ * proof that no matches remain: concurrent arrivals can survive. MongoDB scoped
+ * deletion repeats until an empty query; Redis traverses once. Neither provides
+ * a global logout snapshot, and errors can follow earlier committed deletions.
+ */
 interface OidcVaultStoreProvider {
     /** Upsert an authorization transaction by `state`. */
     createAuthorizationTransaction(input: AuthorizationTransactionInput): Promise<void>;
@@ -108,29 +144,80 @@ interface OidcVaultStoreProvider {
     /** Upsert an exchange code record by `code`. */
     createExchangeCode(input: ExchangeCodeRecordInput): Promise<void>;
     consumeExchangeCode(code: string): Promise<ExchangeCodeRecord | null>;
-    /** Upsert a session by `sessionId`, defaulting timestamps and logical lineage when omitted. */
+    /**
+     * Create a session by `sessionId`, defaulting timestamps and logical lineage when omitted.
+     *
+     * Duplicate-ID behavior is provider-specific (SVH-06): the memory and
+     * MongoDB providers replace the existing session (upsert), while the Redis
+     * provider rejects a live duplicate with `OidcVaultStoreConflictError`
+     * without changing the existing record or indexes (create-only, preserving
+     * RVR-02 index ownership). A rejected create preserves the original record
+     * and its subject/logical/provider-session index memberships; an accepted
+     * replacement takes over the ID with its own subject/logical/provider-session
+     * scope. Reusing an ID that holds only a stale rotation alias clears that
+     * alias on memory/Redis, while MongoDB can retain the stale alias row until
+     * expiry or lineage cleanup (FU-SVH-05b).
+     *
+     * Portable callers must always create sessions with a fresh unused
+     * `sessionId` and handle `OidcVaultStoreConflictError`: reusing a live ID is
+     * non-portable (it may replace or reject), and concurrent reuse races
+     * rotation source checks (SVH-08). The core middleware only creates fresh
+     * random IDs, so it never depends on duplicate-create behavior.
+     */
     createSession(input: OidcVaultSessionInput): Promise<OidcVaultSession>;
     getSession(sessionId: string): Promise<OidcVaultSession | null>;
     /**
      * Atomically replace an existing session with a distinct unused `nextSession.sessionId`.
      *
      * Providers preserve the existing logical session ID when the next session omits
-     * one, retain the old public session ID as a revocation alias while the lineage
-     * remains live, and throw `OidcVaultStoreConflictError` without changing source
-     * or target data when the source is missing, the target already exists, or the
-     * target ID equals the source ID.
+     * one and retain the old public session ID as an in-flight-request revocation
+     * alias. Rotation itself does not revoke the lineage. Providers throw
+     * `OidcVaultStoreConflictError` without changing source or target data when
+     * the source is missing, the target already exists, or the target ID equals
+     * the source ID.
+     *
+     * Each alias expires with its immediate successor session's `expiresAt` and is
+     * not extended by later rotations, so an earlier alias can stop working while
+     * the lineage is still live. A rotation that assigns an explicitly different
+     * logical session ID assigns the new source-ID alias to the new lineage;
+     * earlier aliases keep the old lineage and deadline if retained. Memory
+     * eagerly retires inactive old-lineage aliases on ownership transitions;
+     * MongoDB/Redis can retain them until expiry or explicit cleanup. Use distinct
+     * logical IDs for unrelated login families. Sessions without `expiresAt` have
+     * provider-specific retention: memory and Redis impose no alias time limit, while
+     * MongoDB applies its finite `rotatedSessionAliasRetentionMs` fallback
+     * (default 5 minutes). Generic callers must treat an expired alias as a hint,
+     * not a revocation channel; core refresh rotates the live session directly and
+     * preserves `expiresAt`, so it does not depend on alias lifetime (SVH-05).
      */
     rotateSession(input: RotateSessionInput): Promise<OidcVaultSession>;
+    /**
+     * Delete a live public-ID record, or revoke the logical lineage through an
+     * unexpired alias when no live record exists. Aliases are not readable through
+     * `getSession` and have no issuer/client filter. Scoped/direct deletion preserves
+     * unexpired aliases while another live member survives, even in another scope.
+     */
     deleteSession(sessionId: string): Promise<void>;
+    /** Revoke a logical lineage without an issuer/client filter; see provider count/concurrency notes. */
     deleteSessionsByLogicalSessionId(input: string | DeleteSessionsByLogicalSessionIdInput): Promise<number>;
     /**
      * Record a backchannel logout JTI once until its finite future expiry.
      *
      * Returns `false` for duplicate, expired, exact-boundary, `NaN`, or infinite
      * expiries. A JTI rejected for invalid or already-expired expiry is not stored.
+     *
+     * The core middleware (BOV-01) passes an opaque replay key that already
+     * namespaces the raw logout-token `jti` by issuer and client ID, so
+     * providers must treat `jti` as an opaque string and need no schema change. Pre-BOV-01 raw-`jti` records use
+     * a different key shape and expire naturally with the logout-token `exp`;
+     * they are never matched by namespaced keys. Retry safety comes from the
+     * atomic single-key reservation plus idempotent catch-up deletion in the
+     * route handler, not from a multi-key store transaction.
      */
     consumeBackchannelLogoutTokenJti(input: ConsumeBackchannelLogoutTokenJtiInput): Promise<boolean>;
+    /** Delete matching subject sessions, filtering by each supplied issuer/client; string input is unscoped. */
     deleteSessionsBySubject(input: string | DeleteSessionsBySubjectInput): Promise<number>;
+    /** Delete matching provider-session IDs, filtering by each supplied issuer/client; string input is unscoped. */
     deleteSessionsByProviderSessionId(input: string | DeleteSessionsByProviderSessionIdInput): Promise<number>;
 }
 interface OidcVaultHookContext {
@@ -141,6 +228,11 @@ interface OidcVaultHookContext {
     metadata?: Record<string, unknown>;
 }
 interface OidcVaultErrorContext extends OidcVaultHookContext {
+    /**
+     * Original private diagnostic, separate from sanitized browser JSON. Narrow
+     * before use; provider transport errors retain the original failure in
+     * `error.cause`, while issuer-result validation supplies a TypeError directly.
+     */
     error: unknown;
 }
 interface OidcVaultHooks {
@@ -148,6 +240,13 @@ interface OidcVaultHooks {
     onAuthorizationUrl?(context: OidcVaultHookContext): void | Promise<void>;
     onCallbackTokens?(context: OidcVaultHookContext): void | Promise<void>;
     onUserInfo?(context: OidcVaultHookContext): void | Promise<void>;
+    /**
+     * May mutate the session before persistence or veto creation by throwing.
+     * With `sessionTtlMs`, the session already carries the absolute expiry.
+     * After this hook, a valid earlier epoch-millisecond expiry is preserved;
+     * removal, extension, or an invalid timestamp restores the configured cap.
+     * Without `sessionTtlMs`, application/store lifetime policy is unchanged.
+     */
     onBeforeSessionCreate?(context: OidcVaultHookContext): void | Promise<void>;
     onSessionCreated?(context: OidcVaultHookContext): void | Promise<void>;
     onSessionRefreshed?(context: OidcVaultHookContext): void | Promise<void>;
@@ -160,12 +259,32 @@ interface IssueTokenInput {
     req: Request;
     res: Response;
 }
+/**
+ * Local application credentials returned by `OidcVaultTokenIssuer.issue`.
+ * Runtime validation copies only these fields into a fresh result; additional
+ * properties are ignored and cannot override the response's session ID/user.
+ */
 interface OidcVaultTokenIssueResult {
+    /** Nonempty opaque token string, returned verbatim without trimming. */
     accessToken: string;
+    /** Token lifetime in seconds: a finite, nonnegative safe integer (zero is valid). */
     expiresIn: number;
+    /** Optional exact literal `Bearer`; omitted/undefined stays absent in JSON. */
     tokenType?: 'Bearer';
 }
+/**
+ * Trusted application token issuer for exchange and refresh. Return a non-null,
+ * non-array object satisfying `OidcVaultTokenIssueResult`; only its declared
+ * credential fields enter the response. This contains accidental extensions,
+ * not arbitrary behavior of trusted issuers/hooks with session/request/response access.
+ */
 interface OidcVaultTokenIssuer {
+    /**
+     * Invalid results fail inside issuance rollback: revoke the session lineage
+     * (including the rotated refresh session), clear a cookie-transport session
+     * cookie, and return sanitized HTTP 500 / `OIDC_VAULT_INTERNAL_ERROR`.
+     * Field diagnostics are available privately through `hooks.onError`.
+     */
     issue(input: IssueTokenInput): Promise<OidcVaultTokenIssueResult>;
 }
 interface OidcVaultAccessTokenValidationResult {
@@ -180,13 +299,38 @@ interface OidcVaultAuthContext extends OidcVaultAccessTokenValidationResult {
 interface OidcVaultAccessTokenValidator {
     validate(token: string): Promise<OidcVaultAccessTokenValidationResult>;
 }
+interface OidcVaultAccessTokenMiddlewareErrorContext {
+    error: unknown;
+    req: Request;
+    res: Response;
+    token?: string;
+    auth?: OidcVaultAuthContext;
+}
 interface OidcVaultAccessTokenMiddlewareOptions {
     validator: OidcVaultAccessTokenValidator;
+    /**
+     * Pre-`next()` veto hook, not a post-commit notification: when it throws,
+     * downstream middleware never runs and `req.auth` is detached before the
+     * error response is sent. A valid bearer credential plus a failing hook
+     * never surfaces as an invalid-token 401: an `OidcVaultHttpError` from the
+     * hook keeps its own status/code/client message (a 401 keeps the `Bearer`
+     * challenge, other statuses carry no challenge), while any other hook
+     * error becomes a sanitized `500 OIDC_VAULT_AUTH_CONTEXT_FAILED` without
+     * leaking the original message. The original error is observable via
+     * `onError` for private server-side logs.
+     */
     onAuthContext?(input: {
         req: Request;
         res: Response;
         auth: OidcVaultAuthContext;
     }): void | Promise<void>;
+    /**
+     * Observes the original error for every bearer-middleware failure
+     * (extraction, validator, and `onAuthContext` failures) without affecting
+     * the sanitized client response. Failures thrown by this observer are
+     * swallowed so the original error response is preserved.
+     */
+    onError?(context: OidcVaultAccessTokenMiddlewareErrorContext): void | Promise<void>;
 }
 interface OidcVaultAuthenticatedRequest extends Request {
     auth?: OidcVaultAuthContext;
@@ -204,6 +348,19 @@ declare module 'express-serve-static-core' {
     }
 }
 interface OidcVaultConfig {
+    /**
+     * OIDC issuer identifier, preserved exactly after surrounding-whitespace
+     * trimming (no trailing slash is added, so `/tenant`, `/tenant/`, and
+     * `/tenant//` remain distinct). Must be an absolute http(s) URL without
+     * userinfo, query, or fragment; `http` is accepted for local-test
+     * providers. Required alongside `clientId` in discovery and manual modes.
+     * Any nonempty endpoint, including `userInfoEndpoint`/`endSessionEndpoint`,
+     * selects manual mode: supply `authorizationEndpoint`, `tokenEndpoint`, and
+     * `jwksUri`; no discovery or partial overrides. Blank strings are absent
+     * after trimming. Discovery responses
+     * must carry an exactly equal issuer, and ID/logout tokens are validated
+     * against this exact identifier.
+     */
     issuer?: string;
     authorizationEndpoint?: string;
     tokenEndpoint?: string;
@@ -215,6 +372,19 @@ interface OidcVaultConfig {
     scopes?: string;
 }
 interface OidcVaultLogoutResult {
+    /**
+     * Successful live-session logout commits revocation before upstream work
+     * (and clears the session cookie under cookie transport). Known foreign
+     * live sessions instead fail with 401. Without a live session, success means
+     * stale-alias deletion was attempted; an expired alias may no longer revoke
+     * a live lineage. Stateless application access tokens are not invalidated.
+     * Local-only logout (`redirect` unset or `false`) never contacts the provider.
+     * Redirected logout (`redirect: true`)
+     * treats the upstream end-session redirect as best-effort: when provider
+     * discovery fails or no `endSessionEndpoint` is available, the route still
+     * returns this local success. Discovery errors reach `onError` without
+     * undoing revocation or skipping the live session's `onLogout` notification.
+     */
     loggedOut: true;
 }
 interface OidcVaultBackchannelLogoutResult {
@@ -222,19 +392,51 @@ interface OidcVaultBackchannelLogoutResult {
     revokedSessions: number;
 }
 interface OidcVaultExchangeResult extends Partial<OidcVaultTokenIssueResult> {
+    /** Authoritative vault handle in body transport; omitted from cookie-transport JSON. */
     sessionId?: string;
+    /** Session profile; extra token-issuer result properties cannot override it. */
     user?: OidcVaultUserProfile;
 }
 type OidcVaultSessionTransport = 'body' | 'cookie';
 type OidcVaultCookieDeploymentMode = 'same-origin' | 'same-site' | 'cross-site';
 type OidcVaultCookieSameSite = 'lax' | 'strict' | 'none';
 interface OidcVaultCookieOptions {
+    /**
+     * Session cookie name. Must be a valid HTTP cookie name (printable ASCII
+     * token). Names with the `__Secure-` prefix require an effectively Secure
+     * cookie; names with the `__Host-` prefix additionally require no
+     * `cookie.domain` and `cookie.path: '/'`. Checked against effective
+     * serialized values, so `sameSite: 'none'` counts as Secure.
+     */
     name?: string;
     deploymentMode?: OidcVaultCookieDeploymentMode;
     sameSite?: OidcVaultCookieSameSite;
+    /**
+     * Explicit `Secure` override. When omitted, defaults to `true` for HTTPS
+     * `backendOrigin`, `sameSite: 'none'`, or `deploymentMode: 'cross-site'`;
+     * otherwise `false` as an intentional HTTP local-development policy
+     * (plaintext backends must opt into `secure: true` when served over HTTPS
+     * behind a proxy that reports an `http` origin). `SameSite=None` is always
+     * serialized with `Secure` regardless of this flag because browsers reject
+     * `SameSite=None` without it.
+     */
     secure?: boolean;
+    /**
+     * Optional cookie `Domain`. Must be a valid cookie domain when set. Must be
+     * omitted for `__Host-` prefixed names (host-only requirement).
+     */
     domain?: string;
+    /**
+     * Cookie `Path`. Must start with `/` and contain only header-safe printable
+     * ASCII (no CTLs, DEL, non-ASCII/Unicode, or `;`). `__Host-` prefixed names
+     * require exactly `'/'`.
+     */
     path?: string;
+    /**
+     * Must be `true` or omitted. Middleware creation rejects
+     * `httpOnly: false` for cookie session transport; there is no unsafe
+     * compatibility switch.
+     */
     httpOnly?: boolean;
 }
 interface OidcVaultOptions {
@@ -242,18 +444,84 @@ interface OidcVaultOptions {
     backendOrigin: string;
     storeProvider: OidcVaultStoreProvider;
     config?: OidcVaultConfig;
+    /**
+     * Lifecycle hooks shared by reference (not cloned): pre-commit hooks run
+     * before durable state changes and can veto by throwing, while
+     * `onSessionCreated`/`onSessionRefreshed`/`onLogout` are post-commit
+     * notifications whose failures reach `onError` without undoing state.
+     * Replacing the caller options object after middleware creation has no
+     * effect; the `hooks` service object itself is retained live.
+     */
     hooks?: OidcVaultHooks;
+    /** Optional local issuer; when omitted, exchange/refresh return no local token fields. */
     tokenIssuer?: OidcVaultTokenIssuer;
+    /**
+     * Default browser return target after backend callback completion. Required
+     * if login accepts a custom `returnTo`. Remains optional at middleware
+     * creation because non-callback routes do not need it; the callback route
+     * instead validates its destination (transaction `returnTo` or this value)
+     * before any provider call or durable session/code creation and fails with
+     * `500 OIDC_VAULT_MISSING_FRONTEND_REDIRECT_URI` when neither is configured.
+     */
     frontendRedirectUri?: string;
+    /**
+     * Optional provider-registered HTTP(S) URL used in the upstream end-session
+     * redirect. Only consulted for redirected logout (`redirect: true`); local
+     * logout never contacts the provider, and redirected logout treats upstream
+     * discovery failures or an absent endpoint as best-effort (local
+     * `200 { loggedOut: true }`, with `onLogout` still delivered for a live
+     * session). Discovery errors also reach `onError`.
+     */
     postLogoutRedirectUri?: string;
     fetchUserInfo?: boolean;
+    /**
+     * Authorization transaction lifetime in milliseconds (default: 10 minutes).
+     * Must be a positive safe integer; construction and creation require
+     * `now() + TTL` to be an integer within JavaScript Date's epoch range.
+     */
     authorizationTransactionTtlMs?: number;
+    /**
+     * One-time exchange code lifetime in milliseconds (default: 30 seconds).
+     * Same positive-safe-integer and computed-epoch checks as
+     * `authorizationTransactionTtlMs`.
+     */
     exchangeCodeTtlMs?: number;
+    /**
+     * Opt-in absolute server-side session lifetime in milliseconds, measured
+     * from callback session creation, not login start. Must be a positive safe
+     * integer producing an integer epoch within JavaScript Date's range;
+     * checked at construction and again at creation using `now` (or Date.now).
+     *
+     * Sets `expiresAt` before `onBeforeSessionCreate` and caps it after the hook:
+     * hooks may shorten the expiry but cannot extend/remove the maximum (invalid
+     * timestamps also restore the cap). Refresh preserves the stored expiry.
+     * Independent of upstream OAuth `expires_in`. Unset retains application/
+     * store-owned lifetime behavior; no default session expiry is assigned.
+     */
+    sessionTtlMs?: number;
     sessionTransport?: OidcVaultSessionTransport;
     cookie?: OidcVaultCookieOptions;
     trustedOrigins?: string[];
     requestBodyLimit?: string | number;
+    /**
+     * Overall deadline in milliseconds for a single upstream provider HTTP
+     * exchange, covering DNS/connect/TLS, response headers, and complete
+     * success/error body consumption. Cancellation is attempted promptly but
+     * never awaited: completion does not guarantee cleanup of custom streams.
+     * Defaults to 5000; must be a positive finite integer.
+     *
+     * Successful discovery metadata is shared across timeout policies, while
+     * in-flight fetches are isolated by `(issuer, providerRequestTimeoutMs)`.
+     * Remote JWKS resolvers are isolated by
+     * `(jwks_uri, providerRequestTimeoutMs)` because JOSE fixes the fetch
+     * timeout at resolver creation; the package JWKS transport additionally
+     * bounds JWKS bodies (1 MiB, 100 keys) that JOSE leaves unbounded.
+     * Network/reset failures are sanitized endpoint-specific 502s; original
+     * transport diagnostics are available privately via `hooks.onError`'s
+     * `error.cause`. JOSE timeouts retain `ERR_JWKS_TIMEOUT`.
+     */
     providerRequestTimeoutMs?: number;
+    /** Epoch-millisecond clock, also sampled during construction to validate TTLs. Defaults to Date.now. */
     now?: () => number;
 }
 
@@ -275,8 +543,20 @@ interface OidcVaultEnv {
     OIDC_SCOPES?: string;
 }
 /**
- * Resolve OIDC configuration from application input. If an issuer URL is
- * present, explicit endpoint fields are ignored and discovery mode wins.
+ * Resolve OIDC configuration from application input.
+ *
+ * Issuer discovery mode is selected only when an issuer is configured without
+ * any nonempty manual endpoint fields. Any such field, including optional
+ * `userInfoEndpoint` or `endSessionEndpoint`, selects manual mode: discovery
+ * is not used, and `issuer`, `authorizationEndpoint`, `tokenEndpoint`, and
+ * `jwksUri` are all required. Blank strings are treated as absent after trimming.
+ * `issuer` keeps ID tokens and logout tokens issuer-bound.
+ *
+ * The issuer identifier is syntax-validated (absolute http/https URL without
+ * userinfo, query, or fragment) but otherwise preserved exactly as configured
+ * after surrounding-whitespace trimming: no trailing slash is added and path
+ * variants such as `/tenant`, `/tenant/`, and `/tenant//` remain distinct.
+ * Endpoint URLs are normalized separately with `URL.toString()`.
  */
 declare function resolveOidcVaultConfig(config?: OidcVaultConfig): OidcVaultResolvedConfig;
 /**
@@ -303,7 +583,18 @@ declare function createOidcVaultJwtAccessTokenValidator(options: OidcVaultJwtAcc
 declare function normalizeOidcVaultBasePath(value?: string): string;
 /**
  * Create the core OIDC vault middleware.
+ *
+ * Construction takes an internal resolved snapshot of `options` without
+ * mutating the caller object: normalized values (such as
+ * `frontendRedirectUri`) are stored on the snapshot, plain-data containers
+ * (`cookie`, `trustedOrigins`, `config`) are shallow-copied, and service
+ * references (`storeProvider`, `hooks`, `tokenIssuer`, `now`) are retained
+ * by reference, never deep-cloned. Mutating or replacing the caller options
+ * after this call has no effect on the created router. Post-commit hooks
+ * (`onSessionCreated`, `onSessionRefreshed`, `onLogout`) are notifications
+ * whose failures are reported to `onError` without undoing committed state;
+ * other hooks run pre-commit and can veto the operation by throwing.
  */
 declare function createOidcVaultMiddleware(options: OidcVaultOptions): Router;
 
-export { type AuthorizationTransaction, type AuthorizationTransactionInput, type ConsumeBackchannelLogoutTokenJtiInput, DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS, DEFAULT_EXCHANGE_CODE_TTL_MS, DEFAULT_OIDC_SCOPES, DEFAULT_OIDC_VAULT_BASE_PATH, DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT, type DeleteSessionsByLogicalSessionIdInput, type DeleteSessionsByProviderSessionIdInput, type DeleteSessionsBySubjectInput, type ExchangeCodeRecord, type ExchangeCodeRecordInput, type IssueTokenInput, OIDC_VAULT_ROUTE_PATHS, OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT, type OidcVaultAccessTokenMiddlewareOptions, type OidcVaultAccessTokenValidationResult, type OidcVaultAccessTokenValidator, type OidcVaultAuthContext, type OidcVaultAuthenticatedRequest, type OidcVaultBackchannelLogoutResult, type OidcVaultConfig, type OidcVaultConfigMode, type OidcVaultCookieDeploymentMode, type OidcVaultCookieOptions, type OidcVaultCookieSameSite, type OidcVaultEnv, type OidcVaultErrorContext, type OidcVaultExchangeResult, type OidcVaultHookContext, type OidcVaultHooks, type OidcVaultJwtAccessTokenValidatorOptions, type OidcVaultLogoutResult, type OidcVaultOptions, type OidcVaultProviderMetadata, type OidcVaultResolvedConfig, type OidcVaultRouteName, type OidcVaultSession, type OidcVaultSessionInput, type OidcVaultSessionTransport, OidcVaultStoreConflictError, type OidcVaultStoreProvider, type OidcVaultTokenIssueResult, type OidcVaultTokenIssuer, type OidcVaultUserProfile, type RotateSessionInput, createOidcVaultAccessTokenMiddleware, createOidcVaultJwtAccessTokenValidator, createOidcVaultMiddleware, normalizeOidcVaultBasePath, resolveOidcVaultConfig, resolveOidcVaultConfigFromEnv };
+export { type AuthorizationTransaction, type AuthorizationTransactionInput, type ConsumeBackchannelLogoutTokenJtiInput, DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS, DEFAULT_EXCHANGE_CODE_TTL_MS, DEFAULT_OIDC_SCOPES, DEFAULT_OIDC_VAULT_BASE_PATH, DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT, type DeleteSessionsByLogicalSessionIdInput, type DeleteSessionsByProviderSessionIdInput, type DeleteSessionsBySubjectInput, type ExchangeCodeRecord, type ExchangeCodeRecordInput, type IssueTokenInput, OIDC_VAULT_ROUTE_PATHS, OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT, type OidcVaultAccessTokenMiddlewareErrorContext, type OidcVaultAccessTokenMiddlewareOptions, type OidcVaultAccessTokenValidationResult, type OidcVaultAccessTokenValidator, type OidcVaultAuthContext, type OidcVaultAuthenticatedRequest, type OidcVaultBackchannelLogoutResult, type OidcVaultConfig, type OidcVaultConfigMode, type OidcVaultCookieDeploymentMode, type OidcVaultCookieOptions, type OidcVaultCookieSameSite, type OidcVaultEnv, type OidcVaultErrorContext, type OidcVaultExchangeResult, type OidcVaultHookContext, type OidcVaultHooks, type OidcVaultJwtAccessTokenValidatorOptions, type OidcVaultLogoutResult, type OidcVaultOptions, type OidcVaultProviderMetadata, type OidcVaultResolvedConfig, type OidcVaultRouteName, type OidcVaultSession, type OidcVaultSessionInput, type OidcVaultSessionTransport, OidcVaultStoreConflictError, type OidcVaultStoreProvider, type OidcVaultTokenIssueResult, type OidcVaultTokenIssuer, type OidcVaultUserProfile, type RotateSessionInput, createOidcVaultAccessTokenMiddleware, createOidcVaultJwtAccessTokenValidator, createOidcVaultMiddleware, normalizeOidcVaultBasePath, resolveOidcVaultConfig, resolveOidcVaultConfigFromEnv };