@web-ts-toolkit/express-oidc-vault 0.47.1 → 0.49.0

package/index.mjs

@@ -1,139 +1,7 @@
 // src/index.ts
-import { createHash, randomBytes } from "crypto";
+import { createHash as createHash6, randomBytes as randomBytes3 } from "crypto";
 import express from "express";
 
-// src/config.ts
-var DEFAULT_OIDC_SCOPES = "openid email profile";
-var MANUAL_CONFIG_REQUIREMENTS = ["issuer", "authorizationEndpoint", "tokenEndpoint", "jwksUri"];
-var MANUAL_CONFIG_SELECTORS = ["authorizationEndpoint", "tokenEndpoint", "jwksUri", "userInfoEndpoint", "endSessionEndpoint"];
-var normalizeOptionalString = (value) => {
-  const trimmed = value?.trim();
-  return trimmed ? trimmed : void 0;
-};
-var normalizeHttpUrl = (value, optionName) => {
-  if (value === void 0) {
-    return void 0;
-  }
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error(`${optionName} must be an absolute HTTP(S) URL.`);
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:" || url.origin === "null") {
-    throw new Error(`${optionName} must use http or https.`);
-  }
-  return url.toString();
-};
-var normalizeIssuerIdentifier = (value, optionName) => {
-  if (value === void 0) {
-    return void 0;
-  }
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error(`${optionName} must be an absolute HTTP(S) URL.`);
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:" || url.origin === "null") {
-    throw new Error(`${optionName} must use http or https.`);
-  }
-  if (url.username !== "" || url.password !== "") {
-    throw new Error(`${optionName} must not include userinfo.`);
-  }
-  if (url.search !== "" || url.hash !== "") {
-    throw new Error(`${optionName} must not include query or fragment.`);
-  }
-  return value;
-};
-var withOptionalValue = (target, key, value) => {
-  if (value !== void 0) {
-    target[key] = value;
-  }
-};
-function resolveOidcVaultConfig(config = {}) {
-  const issuer = normalizeIssuerIdentifier(normalizeOptionalString(config.issuer), "config.issuer");
-  const clientId = normalizeOptionalString(config.clientId);
-  const clientSecret = normalizeOptionalString(config.clientSecret);
-  const scopes = normalizeOptionalString(config.scopes) ?? DEFAULT_OIDC_SCOPES;
-  const hasManualEndpoints = MANUAL_CONFIG_SELECTORS.some((key) => normalizeOptionalString(config[key]));
-  if (!clientId) {
-    throw new Error("OIDC clientId is required.");
-  }
-  if (issuer && !hasManualEndpoints) {
-    const resolved2 = {
-      mode: "issuer",
-      issuer,
-      scopes
-    };
-    withOptionalValue(resolved2, "clientId", clientId);
-    withOptionalValue(resolved2, "clientSecret", clientSecret);
-    return resolved2;
-  }
-  const resolved = {
-    mode: "manual",
-    scopes
-  };
-  withOptionalValue(resolved, "issuer", issuer);
-  withOptionalValue(
-    resolved,
-    "authorizationEndpoint",
-    normalizeHttpUrl(normalizeOptionalString(config.authorizationEndpoint), "config.authorizationEndpoint")
-  );
-  withOptionalValue(
-    resolved,
-    "tokenEndpoint",
-    normalizeHttpUrl(normalizeOptionalString(config.tokenEndpoint), "config.tokenEndpoint")
-  );
-  withOptionalValue(
-    resolved,
-    "userInfoEndpoint",
-    normalizeHttpUrl(normalizeOptionalString(config.userInfoEndpoint), "config.userInfoEndpoint")
-  );
-  withOptionalValue(resolved, "jwksUri", normalizeHttpUrl(normalizeOptionalString(config.jwksUri), "config.jwksUri"));
-  withOptionalValue(
-    resolved,
-    "endSessionEndpoint",
-    normalizeHttpUrl(normalizeOptionalString(config.endSessionEndpoint), "config.endSessionEndpoint")
-  );
-  withOptionalValue(resolved, "clientId", clientId);
-  withOptionalValue(resolved, "clientSecret", clientSecret);
-  const missing = MANUAL_CONFIG_REQUIREMENTS.filter((key) => !resolved[key]);
-  if (missing.length > 0) {
-    throw new Error(`Missing required OIDC configuration for manual mode: ${missing.join(", ")}`);
-  }
-  return resolved;
-}
-function resolveOidcVaultConfigFromEnv(env = process.env) {
-  return resolveOidcVaultConfig({
-    issuer: env.OIDC_ISSUER,
-    authorizationEndpoint: env.OIDC_AUTHORIZATION_ENDPOINT,
-    tokenEndpoint: env.OIDC_TOKEN_ENDPOINT,
-    userInfoEndpoint: env.OIDC_USERINFO_ENDPOINT,
-    jwksUri: env.OIDC_JWKS_URI,
-    endSessionEndpoint: env.OIDC_END_SESSION_ENDPOINT,
-    clientId: env.OIDC_CLIENT_ID,
-    clientSecret: env.OIDC_CLIENT_SECRET,
-    scopes: env.OIDC_SCOPES
-  });
-}
-
-// src/constants.ts
-var DEFAULT_OIDC_VAULT_BASE_PATH = "/auth/oidc";
-var DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS = 10 * 60 * 1e3;
-var DEFAULT_EXCHANGE_CODE_TTL_MS = 30 * 1e3;
-var DEFAULT_SESSION_COOKIE_NAME = "oidc_vault_session";
-var DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT = "16kb";
-var OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT = 16;
-var OIDC_VAULT_ROUTE_PATHS = {
-  login: "/login",
-  callback: "/callback",
-  exchange: "/exchange",
-  refresh: "/refresh",
-  logout: "/logout",
-  "backchannel-logout": "/backchannel-logout"
-};
-
 // src/errors.ts
 var OidcVaultHttpError = class extends Error {
   constructor(status, code, message, clientMessage = message) {
@@ -213,6 +81,25 @@ var getRequiredFiniteNonNegativeInteger = (value, message, code, status = 502) =
   return value;
 };
 
+// src/fingerprint-recognition.ts
+import { createHash as createHash3 } from "crypto";
+
+// src/constants.ts
+var DEFAULT_OIDC_VAULT_BASE_PATH = "/auth/oidc";
+var DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS = 10 * 60 * 1e3;
+var DEFAULT_EXCHANGE_CODE_TTL_MS = 30 * 1e3;
+var DEFAULT_SESSION_COOKIE_NAME = "oidc_vault_session";
+var DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT = "16kb";
+var OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT = 16;
+var OIDC_VAULT_ROUTE_PATHS = {
+  login: "/login",
+  callback: "/callback",
+  exchange: "/exchange",
+  refresh: "/refresh",
+  logout: "/logout",
+  "backchannel-logout": "/backchannel-logout"
+};
+
 // src/cookies.ts
 var getSessionTransport = (options) => options.sessionTransport ?? "body";
 var usesCookieTransport = (options) => getSessionTransport(options) === "cookie";
@@ -243,6 +130,7 @@ var isHttpsBackendOrigin = (options) => {
   }
 };
 var COOKIE_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var isValidCookieName = (value) => typeof value === "string" && COOKIE_NAME_PATTERN.test(value) && !hasUnsafeCookieValueCharacters(value);
 var COOKIE_DOMAIN_PATTERN = /^\.?[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
 var hasUnsafeCookieValueCharacters = (value) => {
   for (let index = 0; index < value.length; index += 1) {
@@ -258,7 +146,7 @@ var validateCookieOptions = (options) => {
     return;
   }
   const cookieOptions = resolveCookieOptions(options);
-  if (!COOKIE_NAME_PATTERN.test(cookieOptions.name)) {
+  if (!isValidCookieName(cookieOptions.name)) {
     throw new Error("cookie.name must be a valid HTTP cookie name.");
   }
   if (hasUnsafeCookieValueCharacters(cookieOptions.path) || !cookieOptions.path.startsWith("/")) {
@@ -352,6 +240,527 @@ var parseSelectedCookieValue = (headerValue, selectedName) => {
   return void 0;
 };
 
+// src/device-binding-policy.ts
+import { isIP } from "net";
+var isPlainRecord = (value) => {
+  if (typeof value !== "object" || value === null) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+};
+var isDpopAlgorithm = (value) => value === "ES256" || value === "PS256" || value === "RS256";
+var resolveInteger = (value, fallback, min, max, name) => {
+  const resolved = value === void 0 ? fallback : value;
+  if (typeof resolved !== "number" || !Number.isInteger(resolved) || resolved < min || resolved > max) {
+    throw new Error(`${name} must be an integer from ${min} through ${max}.`);
+  }
+  return resolved;
+};
+var resolveDeviceBindingOptions = (value) => {
+  if (value === void 0) return void 0;
+  if (!isPlainRecord(value)) throw new Error("deviceBinding must be a plain options object.");
+  const { mode, algorithms, proofMaxAgeSeconds, clockSkewSeconds, nonce } = value;
+  if (mode !== void 0 && mode !== "optional" && mode !== "required") {
+    throw new Error("deviceBinding.mode must be optional or required.");
+  }
+  const configuredAlgorithms = algorithms === void 0 ? ["ES256"] : algorithms;
+  if (!Array.isArray(configuredAlgorithms) || configuredAlgorithms.length === 0) {
+    throw new Error("deviceBinding.algorithms must be a nonempty allowlist of ES256, PS256, or RS256.");
+  }
+  const allowlist = Array.from(configuredAlgorithms);
+  if (!allowlist.every(isDpopAlgorithm)) {
+    throw new Error("deviceBinding.algorithms must be a nonempty allowlist of ES256, PS256, or RS256.");
+  }
+  let resolvedNonce = false;
+  if (nonce !== void 0 && nonce !== false) {
+    if (!isPlainRecord(nonce)) throw new Error("deviceBinding.nonce must be false or a plain nonce options object.");
+    const { secret, lifetimeSeconds } = nonce;
+    if (!(secret instanceof Uint8Array) || secret.byteLength < 32) {
+      throw new Error("deviceBinding.nonce.secret must be a Uint8Array of at least 32 bytes.");
+    }
+    resolvedNonce = Object.freeze({
+      // Uint8Array.from also copies Buffer/subarray inputs instead of retaining
+      // a shared view. Nonempty typed arrays cannot be Object.freeze'd; these
+      // owned bytes stay private while the plain nonce container is frozen.
+      secret: Uint8Array.from(secret),
+      lifetimeSeconds: resolveInteger(lifetimeSeconds, 60, 1, 300, "deviceBinding.nonce.lifetimeSeconds")
+    });
+  }
+  return Object.freeze({
+    mode: mode ?? "optional",
+    algorithms: Object.freeze([...new Set(allowlist)]),
+    proofMaxAgeSeconds: resolveInteger(proofMaxAgeSeconds, 60, 1, 300, "deviceBinding.proofMaxAgeSeconds"),
+    clockSkewSeconds: resolveInteger(clockSkewSeconds, 5, 0, 30, "deviceBinding.clockSkewSeconds"),
+    nonce: resolvedNonce
+  });
+};
+var DEVICE_BINDING_STORE_CAPABILITIES = [
+  "getAuthorizationTransaction",
+  "consumeAuthorizationTransactionIfMatches",
+  "getExchangeCode",
+  "consumeExchangeCodeIfMatches",
+  "getSessionRevocationContext",
+  "reserveDpopProof"
+];
+function assertDeviceBindingStoreCapabilities(store, feature = "deviceBinding") {
+  for (const name of DEVICE_BINDING_STORE_CAPABILITIES) {
+    if (typeof store?.[name] !== "function") {
+      throw new Error(`${feature} requires storeProvider.${name}.`);
+    }
+  }
+}
+var resolveDeviceBindingOrigin = (value, name = "backendOrigin") => {
+  if (typeof value !== "string") throw new Error(`${name} must be a static HTTP(S) origin for deviceBinding.`);
+  const raw = value.trim();
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error(`${name} must be a static HTTP(S) origin for deviceBinding.`);
+  }
+  if (!/^https?:\/\/[^/\\?#]+\/?$/i.test(raw) || /\s/.test(raw) || raw.includes("@") || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.origin === "null") {
+    throw new Error(
+      `${name} must be a static HTTP(S) origin without userinfo, path, query, or fragment for deviceBinding.`
+    );
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "[::1]" || isIP(url.hostname) === 4 && url.hostname.startsWith("127.");
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new Error(`${name} must use HTTPS except for loopback HTTP development when deviceBinding is enabled.`);
+  }
+  return url.origin;
+};
+var isCanonicalDpopJkt = (value) => typeof value === "string" && value.length === 43 && /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/.test(value);
+var invalidBinding = (diagnostic) => new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_DPOP_PROOF", diagnostic, "DPoP proof validation failed.");
+var snapshotDpopBinding = (value) => {
+  if (value === void 0) return void 0;
+  if (!isPlainRecord(value)) throw invalidBinding("Stored device binding must be a plain dpop binding object.");
+  const { type, jkt } = value;
+  if (type !== "dpop" || !isCanonicalDpopJkt(jkt)) {
+    throw invalidBinding("Stored device binding must contain type dpop and a canonical SHA-256 JWK thumbprint.");
+  }
+  return Object.freeze({ type, jkt });
+};
+var assertDeviceBindingPolicy = (policy, binding) => {
+  const stored = snapshotDpopBinding(binding);
+  if (stored !== void 0 && policy === void 0) {
+    throw new OidcVaultHttpError(401, "OIDC_VAULT_DPOP_REQUIRED", "DPoP authentication is required.");
+  }
+  if (stored === void 0 && policy?.mode === "required") {
+    throw new OidcVaultHttpError(401, "OIDC_VAULT_DEVICE_BINDING_REQUIRED", "A device-bound login is required.");
+  }
+};
+var resolveVerifiedDeviceBinding = (policy, binding, verified) => {
+  const stored = snapshotDpopBinding(binding);
+  assertDeviceBindingPolicy(policy, stored);
+  if (verified === void 0) {
+    if (stored !== void 0) {
+      throw new OidcVaultHttpError(401, "OIDC_VAULT_DPOP_REQUIRED", "DPoP authentication is required.");
+    }
+    return void 0;
+  }
+  const proofBinding = snapshotDpopBinding(verified);
+  const alg = verified.alg;
+  if (proofBinding === void 0 || !isDpopAlgorithm(alg) || !policy?.algorithms.includes(alg)) {
+    throw invalidBinding("Verified DPoP context must use a currently allowed asymmetric proof algorithm.");
+  }
+  if (stored === void 0) return void 0;
+  if (stored.jkt !== proofBinding.jkt) throw invalidBinding("Verified DPoP key does not match the original binding.");
+  return Object.freeze({ type: "dpop", jkt: stored.jkt, alg });
+};
+var withSessionDeviceBinding = (session, binding) => {
+  const restored = {};
+  for (const key of Reflect.ownKeys(session)) {
+    if (key !== "deviceBinding" && Object.prototype.propertyIsEnumerable.call(session, key))
+      Object.defineProperty(restored, key, {
+        value: Reflect.get(session, key),
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+  }
+  const stored = snapshotDpopBinding(binding);
+  if (stored !== void 0) restored.deviceBinding = stored;
+  return restored;
+};
+
+// src/dpop-proof.ts
+import { createHash as createHash2 } from "crypto";
+import { calculateJwkThumbprint, compactVerify, importJWK } from "jose";
+
+// src/dpop-nonce.ts
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+var NONCE_VERSION = "v1";
+var HMAC_DOMAIN = "@web-ts-toolkit/express-oidc-vault/dpop-nonce/v1\0";
+var DPOP_NONCE_MAX_BYTES = 512;
+var isEpochMs = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+var decodeBase64url = (value, byteLength) => {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) return null;
+  const bytes = Buffer.from(value, "base64url");
+  if (bytes.toString("base64url") !== value || byteLength !== void 0 && bytes.length !== byteLength) return null;
+  return bytes;
+};
+var createDpopNoncePolicy = (options) => {
+  const { secret: configuredSecret, lifetimeSeconds: configuredLifetime, namespace } = options;
+  if (!(configuredSecret instanceof Uint8Array) || configuredSecret.byteLength < 32) {
+    throw new TypeError("DPoP nonce secret must be a Uint8Array of at least 32 bytes.");
+  }
+  const lifetimeSeconds = configuredLifetime === void 0 ? 60 : configuredLifetime;
+  if (!Number.isInteger(lifetimeSeconds) || lifetimeSeconds < 1 || lifetimeSeconds > 300) {
+    throw new TypeError("DPoP nonce lifetime must be an integer from 1 through 300 seconds.");
+  }
+  if (typeof namespace !== "string" || namespace.length === 0) {
+    throw new TypeError("DPoP nonce requires a resolved protection-space namespace.");
+  }
+  const secret = Uint8Array.from(configuredSecret);
+  const namespaceDigest = createHash("sha256").update(namespace, "utf8").digest("base64url");
+  const lifetimeMs = lifetimeSeconds * 1e3;
+  const sign = (encodedPayload) => createHmac("sha256", secret).update(HMAC_DOMAIN, "utf8").update(`${NONCE_VERSION}.${encodedPayload}`, "ascii").digest();
+  return Object.freeze({
+    issue(jkt, now) {
+      const expiresAt = now + lifetimeMs;
+      if (!isCanonicalDpopJkt(jkt) || !isEpochMs(now) || !isEpochMs(expiresAt) || expiresAt <= now) {
+        throw new TypeError("DPoP nonce issuance requires a canonical key thumbprint and a safe live epoch window.");
+      }
+      const payload = JSON.stringify([randomBytes(16).toString("base64url"), now, expiresAt, namespaceDigest, jkt]);
+      const encodedPayload = Buffer.from(payload, "utf8").toString("base64url");
+      const nonce = `${NONCE_VERSION}.${encodedPayload}.${sign(encodedPayload).toString("base64url")}`;
+      if (Buffer.byteLength(nonce, "utf8") > DPOP_NONCE_MAX_BYTES) {
+        throw new TypeError("DPoP nonce issuance exceeded its fixed wire bound.");
+      }
+      return nonce;
+    },
+    verify(nonce, jkt, now) {
+      if (!isCanonicalDpopJkt(jkt) || !isEpochMs(now) || typeof nonce !== "string" || nonce.length > DPOP_NONCE_MAX_BYTES || Buffer.byteLength(nonce, "utf8") > DPOP_NONCE_MAX_BYTES)
+        return false;
+      const [version, encodedPayload, encodedMac, extra] = nonce.split(".");
+      if (version !== NONCE_VERSION || !encodedPayload || !encodedMac || extra !== void 0) return false;
+      const mac = decodeBase64url(encodedMac, 32);
+      const bytes = decodeBase64url(encodedPayload);
+      if (!mac || !bytes || !timingSafeEqual(mac, sign(encodedPayload))) return false;
+      let payload;
+      try {
+        payload = JSON.parse(bytes.toString("utf8"));
+      } catch {
+        return false;
+      }
+      if (!Array.isArray(payload) || payload.length !== 5 || !bytes.equals(Buffer.from(JSON.stringify(payload), "utf8")))
+        return false;
+      const [random, issuedAt, expiresAt, context, key] = payload;
+      if (typeof random !== "string" || !decodeBase64url(random, 16) || !isEpochMs(issuedAt) || !isEpochMs(expiresAt) || context !== namespaceDigest || key !== jkt)
+        return false;
+      const declaredLifetime = expiresAt - issuedAt;
+      return declaredLifetime >= 1e3 && declaredLifetime <= lifetimeMs && declaredLifetime % 1e3 === 0 && issuedAt <= now && now < expiresAt;
+    }
+  });
+};
+
+// src/dpop-target.ts
+var invalidTarget = () => new OidcVaultHttpError(
+  401,
+  "OIDC_VAULT_INVALID_DPOP_PROOF",
+  "DPoP target must be a valid pinned HTTP(S) URL/path.",
+  "DPoP proof validation failed."
+);
+var hasControl = (value) => {
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code < 32 || code === 127) return true;
+  }
+  return false;
+};
+var normalizePath = (origin, path) => {
+  if (!path.startsWith("/") || /[\s\\]/.test(path) || hasControl(path) || /%(?![0-9a-f]{2})/i.test(path))
+    throw invalidTarget();
+  const decoded = path.replace(/%([0-9a-f]{2})/gi, (_, hex) => {
+    const character = String.fromCharCode(Number.parseInt(hex, 16));
+    return /^[A-Za-z0-9._~-]$/.test(character) ? character : `%${hex.toUpperCase()}`;
+  });
+  return new URL(`${origin}${decoded}`).pathname;
+};
+var createDpopRequestTargetResolver = (options) => {
+  const { publicOrigin, publicPathPrefix } = options;
+  const origin = resolveDeviceBindingOrigin(publicOrigin, "publicOrigin");
+  let prefix = "";
+  if (publicPathPrefix !== void 0 && publicPathPrefix !== "") {
+    if (typeof publicPathPrefix !== "string" || /[?#]/.test(publicPathPrefix)) {
+      throw new TypeError("deviceBinding.publicPathPrefix must be an absolute path prefix without query or fragment.");
+    }
+    try {
+      prefix = normalizePath(origin, publicPathPrefix).replace(/\/+$/g, "");
+    } catch {
+      throw new TypeError("deviceBinding.publicPathPrefix must be a valid absolute path prefix.");
+    }
+  }
+  return (originalUrl) => {
+    if (typeof originalUrl !== "string") throw invalidTarget();
+    const path = originalUrl.split(/[?#]/, 1)[0];
+    if (!path.startsWith("/")) throw invalidTarget();
+    return `${origin}${normalizePath(origin, `${prefix}${path}`)}`;
+  };
+};
+var normalizeDpopProofTarget = (value) => {
+  if (typeof value !== "string" || /[\s\\]/.test(value) || hasControl(value) || !/^https?:\/\/[^/\\?#]+/i.test(value))
+    throw invalidTarget();
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw invalidTarget();
+  }
+  const queryFree = value.split(/[?#]/, 1)[0];
+  const authority = queryFree.slice(queryFree.indexOf("://") + 3).split("/", 1)[0];
+  if (url.username || url.password || url.origin === "null" || authority.includes("@")) throw invalidTarget();
+  const authorityEnd = queryFree.indexOf("/", queryFree.indexOf("://") + 3);
+  const path = authorityEnd === -1 ? "/" : queryFree.slice(authorityEnd);
+  return `${url.origin}${normalizePath(url.origin, path)}`;
+};
+
+// src/dpop-proof.ts
+var DPOP_PROOF_MAX_BYTES = 8192;
+var DPOP_PROTECTED_HEADER_MAX_BYTES = 2048;
+var readDpopRawHeader = (req, name) => {
+  const normalizedName = name.toLowerCase();
+  let count = 0;
+  let value;
+  for (let index = 0; index < req.rawHeaders.length; index += 2) {
+    if (req.rawHeaders[index].toLowerCase() !== normalizedName) continue;
+    if (++count === 1) value = req.rawHeaders[index + 1];
+    if (count === 2) break;
+  }
+  return Object.freeze({ count, value });
+};
+var invalidProof = (diagnostic, cause) => {
+  const error = new OidcVaultHttpError(
+    401,
+    "OIDC_VAULT_INVALID_DPOP_PROOF",
+    diagnostic,
+    "DPoP proof validation failed."
+  );
+  if (cause !== void 0) Object.defineProperty(error, "cause", { value: cause, configurable: true });
+  return error;
+};
+var extractDpopProof = (header) => {
+  if (header.count === 0) return void 0;
+  const { value } = header;
+  if (header.count !== 1 || typeof value !== "string" || value.length === 0 || value.length > DPOP_PROOF_MAX_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) {
+    throw invalidProof("DPoP header must contain one bounded compact signed proof.");
+  }
+  return value;
+};
+var decodeBase64url2 = (value, maxBytes) => {
+  if (!value || value.length > Math.ceil(maxBytes * 4 / 3) || !/^[A-Za-z0-9_-]+$/.test(value)) {
+    throw invalidProof("DPoP base64url input exceeds its bound or has invalid encoding.");
+  }
+  const bytes = Buffer.from(value, "base64url");
+  if (bytes.length > maxBytes || bytes.toString("base64url") !== value)
+    throw invalidProof("DPoP base64url input is not canonical.");
+  return bytes;
+};
+var isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+var parseObject = (bytes) => {
+  try {
+    const json = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    const value = JSON.parse(json);
+    if (!isPlainObject(value)) throw new TypeError("DPoP JSON must be an object.");
+    const stack = [];
+    for (let index = 0; index < json.length; index++) {
+      const character = json[index];
+      if (character === "{" || character === "[") {
+        stack.push({ keys: character === "{" ? /* @__PURE__ */ new Set() : null, expectsKey: character === "{" });
+      } else if (character === "}" || character === "]") {
+        stack.pop();
+      } else if (character === ",") {
+        const container = stack[stack.length - 1];
+        if (container?.keys) container.expectsKey = true;
+      } else if (character === '"') {
+        const start = index++;
+        for (; index < json.length; index++) {
+          if (json[index] === "\\") index++;
+          else if (json[index] === '"') break;
+        }
+        const container = stack[stack.length - 1];
+        if (container?.keys && container.expectsKey) {
+          const key = JSON.parse(json.slice(start, index + 1));
+          if (container.keys.has(key)) throw new TypeError("DPoP JSON has duplicate member names.");
+          container.keys.add(key);
+          container.expectsKey = false;
+        }
+      }
+    }
+    return value;
+  } catch (cause) {
+    throw invalidProof("DPoP JSON encoding or object shape is invalid.", cause);
+  }
+};
+var publicJwk = (value, alg) => {
+  if (!isPlainObject(value) || Buffer.byteLength(JSON.stringify(value), "utf8") > DPOP_PROTECTED_HEADER_MAX_BYTES) {
+    throw invalidProof("DPoP JWK must be a bounded public object.");
+  }
+  const allowed = alg === "ES256" ? ["kty", "crv", "x", "y", "alg", "use", "key_ops", "kid"] : ["kty", "n", "e", "alg", "use", "key_ops", "kid"];
+  if (Object.keys(value).some((key) => !allowed.includes(key)) || value.alg !== void 0 && value.alg !== alg || value.use !== void 0 && value.use !== "sig" || value.kid !== void 0 && typeof value.kid !== "string" || value.key_ops !== void 0 && (!Array.isArray(value.key_ops) || value.key_ops.length !== 1 || value.key_ops[0] !== "verify")) {
+    throw invalidProof("DPoP JWK contains private, remote, unsupported or incompatible key parameters.");
+  }
+  if (alg === "ES256") {
+    if (value.kty !== "EC" || value.crv !== "P-256" || typeof value.x !== "string" || typeof value.y !== "string" || decodeBase64url2(value.x, 32).length !== 32 || decodeBase64url2(value.y, 32).length !== 32) {
+      throw invalidProof("DPoP ES256 requires a public P-256 key with canonical coordinates.");
+    }
+  } else {
+    if (value.kty !== "RSA" || typeof value.n !== "string" || typeof value.e !== "string") {
+      throw invalidProof("DPoP RSA requires public modulus and exponent.");
+    }
+    const modulus = decodeBase64url2(value.n, 512);
+    const exponent = decodeBase64url2(value.e, 512);
+    const bits = (modulus.length - 1) * 8 + 32 - Math.clz32(modulus[0]);
+    if (modulus[0] === 0 || bits < 2048 || bits > 4096 || exponent[0] === 0 || (exponent[exponent.length - 1] & 1) === 0 || exponent.length === 1 && exponent[0] < 3 || exponent.length > modulus.length || exponent.length === modulus.length && Buffer.compare(exponent, modulus) >= 0) {
+      throw invalidProof(
+        "DPoP RSA public parameters must use a 2048\u20134096-bit modulus and a valid bounded odd exponent."
+      );
+    }
+  }
+  return value;
+};
+var verifyDpopProof = async (input) => {
+  const { proof, method, targetUrl, proofOptions, expectedJkt, accessToken } = input;
+  const algorithms = [...proofOptions.algorithms];
+  extractDpopProof({ count: 1, value: proof });
+  const [encodedHeader, encodedPayload, encodedSignature] = proof.split(".");
+  const header = parseObject(decodeBase64url2(encodedHeader, DPOP_PROTECTED_HEADER_MAX_BYTES));
+  decodeBase64url2(encodedPayload, DPOP_PROOF_MAX_BYTES);
+  const signature = decodeBase64url2(encodedSignature, 512);
+  const { alg } = header;
+  if (header.typ !== "dpop+jwt" || !isDpopAlgorithm(alg) || !algorithms.includes(alg) || ["crit", "b64", "jku", "x5u", "x5c", "x5t", "x5t#S256"].some((key) => Object.hasOwn(header, key))) {
+    throw invalidProof("DPoP protected header has an unsupported type, algorithm or key/critical extension.");
+  }
+  const jwk = publicJwk(header.jwk, alg);
+  const signatureBytes = alg === "ES256" ? 64 : decodeBase64url2(jwk.n, 512).length;
+  if (signature.length !== signatureBytes)
+    throw invalidProof("DPoP signature length does not match the allowed key profile.");
+  let payload;
+  try {
+    const key = await importJWK(jwk, alg);
+    ({ payload } = await compactVerify(proof, key, { algorithms }));
+  } catch (cause) {
+    throw invalidProof("DPoP public-key import or signature verification failed.", cause);
+  }
+  const claims = parseObject(payload);
+  const { htm, htu, iat, jti, nonce, ath } = claims;
+  if (typeof iat !== "number" || !Number.isSafeInteger(iat) || iat < 0 || typeof jti !== "string" || jti.length < 1 || jti.length > 128 || /[^\x20-\x7e]/.test(jti)) {
+    throw invalidProof("DPoP signed iat/JTI must be nonnegative integer time and bounded printable ASCII.");
+  }
+  if (htm !== method || typeof method !== "string" || method.length === 0 || normalizeDpopProofTarget(htu) !== targetUrl) {
+    throw invalidProof("DPoP signed method or normalized public target does not match this request.");
+  }
+  if (typeof nonce === "string" && (nonce.length > DPOP_NONCE_MAX_BYTES || Buffer.byteLength(nonce, "utf8") > DPOP_NONCE_MAX_BYTES)) {
+    throw invalidProof("DPoP signed nonce exceeds its byte bound.");
+  }
+  if (accessToken !== void 0 && (typeof accessToken !== "string" || !/^[\x21-\x7e]+$/.test(accessToken) || !isCanonicalDpopJkt(ath) || ath !== createHash2("sha256").update(accessToken, "ascii").digest("base64url"))) {
+    throw invalidProof("DPoP signed access-token hash does not match the presented API token.");
+  }
+  const jkt = await calculateJwkThumbprint(jwk, "sha256");
+  if (expectedJkt !== void 0 && (!isCanonicalDpopJkt(expectedJkt) || jkt !== expectedJkt)) {
+    throw invalidProof("DPoP verified public key does not match the original credential confirmation.");
+  }
+  return Object.freeze({
+    binding: Object.freeze({ type: "dpop", jkt, alg }),
+    iat,
+    jti,
+    ...nonce === void 0 ? {} : { nonce }
+  });
+};
+
+// src/fingerprint-recognition.ts
+var FINGERPRINT_RECOGNITION_METADATA_KEY = "oidcVaultFingerprintRecognition";
+var isPlainRecord2 = (value) => typeof value === "object" && value !== null && [Object.prototype, null].includes(Object.getPrototypeOf(value));
+var COLLIDING_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "www-authenticate",
+  "proxy-authenticate",
+  "authentication-info",
+  "proxy-authentication-info",
+  "dpop",
+  "dpop-nonce",
+  "cookie",
+  "set-cookie",
+  "origin",
+  "referer",
+  "host",
+  "forwarded",
+  "accept",
+  "accept-charset",
+  "accept-encoding",
+  "accept-language",
+  "connection",
+  "keep-alive",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var resolveFingerprintRecognitionOptions = (value) => {
+  if (value === void 0) return void 0;
+  if (!isPlainRecord2(value)) throw new Error("fingerprintRecognition must be a plain options object.");
+  const { headerName } = value;
+  const name = headerName === void 0 ? "X-Device-Fingerprint" : headerName;
+  if (!isValidCookieName(name)) throw new Error("fingerprintRecognition.headerName must be a valid HTTP field name.");
+  const normalized = name.toLowerCase();
+  if (COLLIDING_HEADERS.has(normalized) || ["content-", "x-forwarded-", "access-control-", "sec-fetch-"].some((prefix) => normalized.startsWith(prefix))) {
+    throw new Error(
+      "fingerprintRecognition.headerName must not collide with authentication, cookie, origin, content, or transport headers."
+    );
+  }
+  return Object.freeze({ headerName: name });
+};
+var invalidFingerprint = () => new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_FINGERPRINT", "Fingerprint signal is invalid.");
+var captureFingerprintRecognition = (req, policy) => {
+  if (policy === void 0) return void 0;
+  const { count, value } = readDpopRawHeader(req, policy.headerName);
+  if (count === 0) return void 0;
+  if (count !== 1 || typeof value !== "string" || value.length === 0 || value.length > 256) throw invalidFingerprint();
+  for (let index = 0; index < value.length; index++) {
+    const byte = value.charCodeAt(index);
+    if (byte < 32 || byte > 126) throw invalidFingerprint();
+  }
+  return Object.freeze({ version: 1, hash: createHash3("sha256").update(value, "ascii").digest("base64url") });
+};
+var snapshotFingerprintRecognition = (metadata) => {
+  if (metadata === void 0 || !Object.hasOwn(metadata, FINGERPRINT_RECOGNITION_METADATA_KEY)) return void 0;
+  const value = metadata?.[FINGERPRINT_RECOGNITION_METADATA_KEY];
+  if (value === void 0) return void 0;
+  if (!isPlainRecord2(value)) throw new TypeError("Stored fingerprint recognition metadata is invalid.");
+  const { version, hash } = value;
+  if (Object.keys(value).length !== 2 || !Object.hasOwn(value, "version") || !Object.hasOwn(value, "hash") || version !== 1 || !isCanonicalDpopJkt(hash)) {
+    throw new TypeError("Stored fingerprint recognition metadata is invalid.");
+  }
+  return Object.freeze({ version, hash });
+};
+var fingerprintRecognitionMatches = (actual, original) => actual?.hash === original?.hash;
+var assertFingerprintRecognition = (policy, original, supplied) => {
+  if (policy !== void 0 && original !== void 0 && !fingerprintRecognitionMatches(supplied, original)) {
+    throw new OidcVaultHttpError(
+      403,
+      "OIDC_VAULT_FINGERPRINT_REAUTH_REQUIRED",
+      "Browser recognition changed; sign in again."
+    );
+  }
+};
+var withFingerprintRecognitionMetadata = (metadata, original) => {
+  if (metadata === void 0 && original === void 0) return void 0;
+  if (original === void 0 && metadata !== void 0 && !Object.hasOwn(metadata, FINGERPRINT_RECOGNITION_METADATA_KEY))
+    return metadata;
+  const restored = {};
+  for (const name of Object.keys(metadata ?? {})) {
+    if (name !== FINGERPRINT_RECOGNITION_METADATA_KEY)
+      Object.defineProperty(restored, name, {
+        value: Reflect.get(metadata, name),
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+  }
+  if (original !== void 0) restored[FINGERPRINT_RECOGNITION_METADATA_KEY] = { version: 1, hash: original.hash };
+  return restored;
+};
+
 // src/lifetime-policy.ts
 var MAX_EPOCH_MS = 864e13;
 var isUsableEpochMs = (value) => typeof value === "number" && Number.isSafeInteger(value) && Math.abs(value) <= MAX_EPOCH_MS;
@@ -381,6 +790,283 @@ var validateLifetimeOptions = (options, now) => {
   }
 };
 
+// src/transaction-cookie.ts
+import { createHash as createHash4, randomBytes as randomBytes2 } from "crypto";
+var invalidBrowserBinding = () => new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_BROWSER_BINDING", "Login browser binding validation failed.");
+var resolveTransactionCookieOptions = (options, backendOrigin) => {
+  const value = options.transactionCookie;
+  if (value !== void 0 && (typeof value !== "object" || value === null || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))) {
+    throw new Error("transactionCookie must be a plain options object.");
+  }
+  if (value !== void 0 && Object.keys(value).some((key) => key !== "name" && key !== "sameSite")) {
+    throw new Error(
+      "transactionCookie supports only name and sameSite; browser-binding cookie security cannot be overridden."
+    );
+  }
+  const { name, sameSite } = value ?? {};
+  const secure = new URL(backendOrigin).protocol === "https:";
+  const resolvedName = name === void 0 ? secure ? "__Host-oidc_vault_transaction" : "oidc_vault_transaction" : name;
+  if (!isValidCookieName(resolvedName)) throw new Error("transactionCookie.name must be a valid HTTP cookie name.");
+  if (sameSite !== void 0 && sameSite !== "lax" && sameSite !== "none") {
+    throw new Error("transactionCookie.sameSite must be lax or none.");
+  }
+  if (!secure && sameSite === "none") throw new Error("transactionCookie.sameSite none requires HTTPS.");
+  if (!secure && (resolvedName.startsWith("__Host-") || resolvedName.startsWith("__Secure-"))) {
+    throw new Error("transactionCookie.name with the __Host- or __Secure- prefix requires HTTPS.");
+  }
+  if ((options.deviceBinding !== void 0 || options.fingerprintRecognition !== void 0 || value !== void 0) && resolvedName === resolveCookieOptions(options).name) {
+    throw new Error("transactionCookie.name must be distinct from cookie.name.");
+  }
+  return Object.freeze({ name: resolvedName, sameSite: sameSite ?? "lax", secure, path: "/", httpOnly: true });
+};
+var hashSecret = (secret) => createHash4("sha256").update(secret, "ascii").digest("base64url");
+var createTransactionBrowserBinding = () => {
+  const secret = randomBytes2(32).toString("base64url");
+  return Object.freeze({ secret, browserBindingHash: hashSecret(secret) });
+};
+var parseTransactionCookie = (header, selectedName) => {
+  if (header === void 0) return void 0;
+  if (typeof header !== "string") throw invalidBrowserBinding();
+  let selected;
+  for (let start = 0; start < header.length; ) {
+    const delimiter = header.indexOf(";", start);
+    const end = delimiter === -1 ? header.length : delimiter;
+    let separator = start;
+    while (separator < end && header[separator] !== "=") separator += 1;
+    const hasValue = separator < end;
+    let nameStart = start;
+    let nameEnd = hasValue ? separator : end;
+    while (nameStart < nameEnd && (header[nameStart] === " " || header[nameStart] === "	")) nameStart += 1;
+    while (nameEnd > nameStart && (header[nameEnd - 1] === " " || header[nameEnd - 1] === "	")) nameEnd -= 1;
+    if (nameEnd - nameStart === selectedName.length && header.startsWith(selectedName, nameStart)) {
+      if (selected !== void 0 || !hasValue) throw invalidBrowserBinding();
+      if (end - separator - 1 !== 43) throw invalidBrowserBinding();
+      const value = header.slice(separator + 1, end);
+      if (!isCanonicalDpopJkt(value)) throw invalidBrowserBinding();
+      selected = value;
+    }
+    start = end + 1;
+  }
+  return selected;
+};
+var snapshotRecordBindingMatch = (record) => {
+  const { deviceBinding, browserBindingHash } = record;
+  const binding = snapshotDpopBinding(deviceBinding);
+  if (binding !== void 0 && Object.keys(deviceBinding).length !== 2) {
+    throw new OidcVaultHttpError(
+      401,
+      "OIDC_VAULT_INVALID_DPOP_PROOF",
+      "Stored device binding contains unsupported fields.",
+      "DPoP proof validation failed."
+    );
+  }
+  if (browserBindingHash !== void 0 && !isCanonicalDpopJkt(browserBindingHash) || binding !== void 0 && browserBindingHash === void 0)
+    throw invalidBrowserBinding();
+  return Object.freeze({ deviceBinding: binding ?? null, browserBindingHash: browserBindingHash ?? null });
+};
+var recordBindingMatches = (actual, expected) => actual.deviceBinding?.jkt === expected.deviceBinding?.jkt && actual.browserBindingHash === expected.browserBindingHash;
+var authenticateTransactionCookie = (header, cookie, match) => {
+  if (match.browserBindingHash === null) return void 0;
+  const secret = parseTransactionCookie(header, cookie.name);
+  if (secret === void 0 || hashSecret(secret) !== match.browserBindingHash) throw invalidBrowserBinding();
+  return secret;
+};
+var setTransactionCookie = (res, cookie, secret, expiresAt, now) => {
+  if (!isCanonicalDpopJkt(secret) || !isUsableEpochMs(expiresAt) || !isUsableEpochMs(now)) {
+    throw new TypeError("OIDC vault transaction cookie requires a canonical secret and usable deadline/clock.");
+  }
+  res.append(
+    "Set-Cookie",
+    serializeCookie(cookie.name, secret, cookie, {
+      maxAge: Math.max(0, Math.floor((expiresAt - now) / 1e3)),
+      expires: new Date(Math.floor(expiresAt / 1e3) * 1e3)
+    })
+  );
+};
+var clearTransactionCookie = (res, cookie) => {
+  res.append("Set-Cookie", serializeCookie(cookie.name, "", cookie, { maxAge: 0, expires: /* @__PURE__ */ new Date(0) }));
+};
+
+// src/authorization-transaction.ts
+var PROVIDER_METADATA_KEY = "oidcVaultTransactionProvider";
+var invalidAuthorizationState = () => new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_STATE", "OIDC state is invalid or expired.");
+var createTransactionProviderMetadata = (config) => ({
+  [PROVIDER_METADATA_KEY]: { issuer: config.issuer, clientId: config.clientId }
+});
+var snapshotAuthorizationTransaction = (record, state, now) => {
+  const { state: storedState, nonce, pkceVerifier, codeChallenge, returnTo, createdAt, expiresAt, metadata } = record;
+  if (storedState !== state || typeof nonce !== "string" || typeof pkceVerifier !== "string" || typeof codeChallenge !== "string" || returnTo !== void 0 && typeof returnTo !== "string" || !isUsableEpochMs(createdAt) || !isUsableEpochMs(expiresAt) || !isUsableEpochMs(now) || expiresAt <= now) {
+    throw invalidAuthorizationState();
+  }
+  const match = snapshotRecordBindingMatch(record);
+  let fingerprintRecognition;
+  try {
+    fingerprintRecognition = snapshotFingerprintRecognition(metadata);
+  } catch {
+    throw invalidAuthorizationState();
+  }
+  if (fingerprintRecognition !== void 0 && match.browserBindingHash === null) throw invalidAuthorizationState();
+  const value = metadata?.[PROVIDER_METADATA_KEY];
+  let provider;
+  if (value !== void 0) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) throw invalidAuthorizationState();
+    const { issuer, clientId } = value;
+    if (issuer !== void 0 && typeof issuer !== "string" || clientId !== void 0 && typeof clientId !== "string") {
+      throw invalidAuthorizationState();
+    }
+    provider = Object.freeze({
+      ...issuer === void 0 ? {} : { issuer },
+      ...clientId === void 0 ? {} : { clientId }
+    });
+  }
+  return Object.freeze({
+    state,
+    nonce,
+    pkceVerifier,
+    codeChallenge,
+    returnTo,
+    createdAt,
+    expiresAt,
+    ...metadata === void 0 ? {} : {
+      metadata: Object.freeze({
+        ...withFingerprintRecognitionMetadata(metadata, fingerprintRecognition),
+        ...provider === void 0 ? {} : { [PROVIDER_METADATA_KEY]: provider },
+        ...fingerprintRecognition === void 0 ? {} : { [FINGERPRINT_RECOGNITION_METADATA_KEY]: fingerprintRecognition }
+      })
+    },
+    ...match.deviceBinding === null ? {} : { deviceBinding: match.deviceBinding },
+    ...match.browserBindingHash === null ? {} : { browserBindingHash: match.browserBindingHash },
+    match,
+    ...provider === void 0 ? {} : { provider },
+    ...fingerprintRecognition === void 0 ? {} : { fingerprintRecognition }
+  });
+};
+var assertAuthorizationTransactionIdentity = (transaction, config) => {
+  if (transaction.provider?.issuer !== void 0 && transaction.provider.issuer !== config.issuer || transaction.provider?.clientId !== void 0 && transaction.provider.clientId !== config.clientId) {
+    throw invalidAuthorizationState();
+  }
+};
+var assertAuthorizationTransactionMatches = (actual, original) => {
+  if (actual.state !== original.state || actual.nonce !== original.nonce || actual.pkceVerifier !== original.pkceVerifier || actual.codeChallenge !== original.codeChallenge || actual.returnTo !== original.returnTo || actual.createdAt !== original.createdAt || actual.expiresAt !== original.expiresAt || actual.provider?.issuer !== original.provider?.issuer || actual.provider?.clientId !== original.provider?.clientId || !fingerprintRecognitionMatches(actual.fingerprintRecognition, original.fingerprintRecognition) || !recordBindingMatches(actual.match, original.match))
+    throw invalidAuthorizationState();
+};
+
+// src/config.ts
+var DEFAULT_OIDC_SCOPES = "openid email profile";
+var MANUAL_CONFIG_REQUIREMENTS = ["issuer", "authorizationEndpoint", "tokenEndpoint", "jwksUri"];
+var MANUAL_CONFIG_SELECTORS = ["authorizationEndpoint", "tokenEndpoint", "jwksUri", "userInfoEndpoint", "endSessionEndpoint"];
+var normalizeOptionalString = (value) => {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : void 0;
+};
+var normalizeHttpUrl = (value, optionName) => {
+  if (value === void 0) {
+    return void 0;
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${optionName} must be an absolute HTTP(S) URL.`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.origin === "null") {
+    throw new Error(`${optionName} must use http or https.`);
+  }
+  return url.toString();
+};
+var normalizeIssuerIdentifier = (value, optionName) => {
+  if (value === void 0) {
+    return void 0;
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${optionName} must be an absolute HTTP(S) URL.`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.origin === "null") {
+    throw new Error(`${optionName} must use http or https.`);
+  }
+  if (url.username !== "" || url.password !== "") {
+    throw new Error(`${optionName} must not include userinfo.`);
+  }
+  if (url.search !== "" || url.hash !== "") {
+    throw new Error(`${optionName} must not include query or fragment.`);
+  }
+  return value;
+};
+var withOptionalValue = (target, key, value) => {
+  if (value !== void 0) {
+    target[key] = value;
+  }
+};
+function resolveOidcVaultConfig(config = {}) {
+  const issuer = normalizeIssuerIdentifier(normalizeOptionalString(config.issuer), "config.issuer");
+  const clientId = normalizeOptionalString(config.clientId);
+  const clientSecret = normalizeOptionalString(config.clientSecret);
+  const scopes = normalizeOptionalString(config.scopes) ?? DEFAULT_OIDC_SCOPES;
+  const hasManualEndpoints = MANUAL_CONFIG_SELECTORS.some((key) => normalizeOptionalString(config[key]));
+  if (!clientId) {
+    throw new Error("OIDC clientId is required.");
+  }
+  if (issuer && !hasManualEndpoints) {
+    const resolved2 = {
+      mode: "issuer",
+      issuer,
+      scopes
+    };
+    withOptionalValue(resolved2, "clientId", clientId);
+    withOptionalValue(resolved2, "clientSecret", clientSecret);
+    return resolved2;
+  }
+  const resolved = {
+    mode: "manual",
+    scopes
+  };
+  withOptionalValue(resolved, "issuer", issuer);
+  withOptionalValue(
+    resolved,
+    "authorizationEndpoint",
+    normalizeHttpUrl(normalizeOptionalString(config.authorizationEndpoint), "config.authorizationEndpoint")
+  );
+  withOptionalValue(
+    resolved,
+    "tokenEndpoint",
+    normalizeHttpUrl(normalizeOptionalString(config.tokenEndpoint), "config.tokenEndpoint")
+  );
+  withOptionalValue(
+    resolved,
+    "userInfoEndpoint",
+    normalizeHttpUrl(normalizeOptionalString(config.userInfoEndpoint), "config.userInfoEndpoint")
+  );
+  withOptionalValue(resolved, "jwksUri", normalizeHttpUrl(normalizeOptionalString(config.jwksUri), "config.jwksUri"));
+  withOptionalValue(
+    resolved,
+    "endSessionEndpoint",
+    normalizeHttpUrl(normalizeOptionalString(config.endSessionEndpoint), "config.endSessionEndpoint")
+  );
+  withOptionalValue(resolved, "clientId", clientId);
+  withOptionalValue(resolved, "clientSecret", clientSecret);
+  const missing = MANUAL_CONFIG_REQUIREMENTS.filter((key) => !resolved[key]);
+  if (missing.length > 0) {
+    throw new Error(`Missing required OIDC configuration for manual mode: ${missing.join(", ")}`);
+  }
+  return resolved;
+}
+function resolveOidcVaultConfigFromEnv(env = process.env) {
+  return resolveOidcVaultConfig({
+    issuer: env.OIDC_ISSUER,
+    authorizationEndpoint: env.OIDC_AUTHORIZATION_ENDPOINT,
+    tokenEndpoint: env.OIDC_TOKEN_ENDPOINT,
+    userInfoEndpoint: env.OIDC_USERINFO_ENDPOINT,
+    jwksUri: env.OIDC_JWKS_URI,
+    endSessionEndpoint: env.OIDC_END_SESSION_ENDPOINT,
+    clientId: env.OIDC_CLIENT_ID,
+    clientSecret: env.OIDC_CLIENT_SECRET,
+    scopes: env.OIDC_SCOPES
+  });
+}
+
 // src/utils.ts
 var isRecord = (value) => typeof value === "object" && value !== null;
 var isString = (value) => typeof value === "string" && value.length > 0;
@@ -463,16 +1149,36 @@ var getRequestSourceOrigin = (req) => {
   }
 };
 var assertTrustedOrigin = (req, options, trustedOrigins, action) => {
-  if (!usesCookieTransport(options)) {
-    return;
+  captureTrustedOriginGuard(req, options, trustedOrigins, action)();
+};
+var captureTrustedOriginGuard = (req, options, trustedOrigins, action) => {
+  const guarded = action === "login" || action === "exchange";
+  if (!guarded && !usesCookieTransport(options)) {
+    return () => {
+    };
   }
-  const origin = getRequestSourceOrigin(req);
-  if (!origin || !trustedOrigins.has(origin)) {
-    throw new OidcVaultHttpError(
-      403,
-      "OIDC_VAULT_UNTRUSTED_ORIGIN",
-      `${action === "refresh" ? "Refresh" : "Logout"} request origin is not trusted.`
-    );
+  const origin = guarded ? getGuardedRequestSourceOrigin(req) : getRequestSourceOrigin(req);
+  return () => {
+    if (!origin || !trustedOrigins.has(origin)) {
+      throw new OidcVaultHttpError(
+        403,
+        "OIDC_VAULT_UNTRUSTED_ORIGIN",
+        `${action.charAt(0).toUpperCase()}${action.slice(1)} request origin is not trusted.`
+      );
+    }
+  };
+};
+var getGuardedRequestSourceOrigin = (req) => {
+  const origin = readDpopRawHeader(req, "origin");
+  if (origin.count !== 0) return origin.count === 1 && isString(origin.value) ? origin.value : void 0;
+  const referer = readDpopRawHeader(req, "referer");
+  if (referer.count !== 1 || !isString(referer.value)) return void 0;
+  if (!/^https?:\/\//i.test(referer.value) || /[\s\\]/.test(referer.value)) return void 0;
+  try {
+    const url = new URL(referer.value);
+    return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password ? url.origin : void 0;
+  } catch {
+    return void 0;
   }
 };
 
@@ -1038,8 +1744,243 @@ async function fetchUserInfo(metadata, accessToken, options = {}) {
   }
 }
 
+// src/token-issuance.ts
+import { decodeJwt, decodeProtectedHeader } from "jose";
+
+// src/vault-session.ts
+var invalidVaultSession = () => new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_SESSION", "Session is missing or expired.");
+var invalidExchangeCode = () => new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_EXCHANGE_CODE", "Exchange code is invalid or expired.");
+var isPlainObject2 = (value) => typeof value === "object" && value !== null && [Object.prototype, null].includes(Object.getPrototypeOf(value));
+var copyPortableData = (value, omitRecognition = false) => {
+  const copies = /* @__PURE__ */ new Map();
+  const pending = [];
+  const copy = (item) => {
+    if (!Array.isArray(item) && !isPlainObject2(item)) return item;
+    const existing = copies.get(item);
+    if (existing) return existing;
+    const target = Array.isArray(item) ? new Array(item.length) : Object.create(Object.getPrototypeOf(item));
+    copies.set(item, target);
+    pending.push({ source: item, target });
+    return target;
+  };
+  const result = copy(value);
+  for (let index = 0; index < pending.length; index++) {
+    const { source, target } = pending[index];
+    for (const key of Object.keys(source)) {
+      if (omitRecognition && key === FINGERPRINT_RECOGNITION_METADATA_KEY) continue;
+      Object.defineProperty(target, key, {
+        value: copy(Reflect.get(source, key)),
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    }
+  }
+  return result;
+};
+var copyVaultSession = (session, omitRecognition = false) => copyPortableData(session, omitRecognition);
+var copyVaultUserProfile = (user) => copyPortableData(user, true);
+var snapshotProvider = (value) => {
+  if (value === void 0) return void 0;
+  if (!isPlainObject2(value)) throw invalidVaultSession();
+  const { issuer, clientId } = value;
+  if (issuer !== void 0 && typeof issuer !== "string" || clientId !== void 0 && typeof clientId !== "string") {
+    throw invalidVaultSession();
+  }
+  return Object.freeze({
+    ...issuer === void 0 ? {} : { issuer },
+    ...clientId === void 0 ? {} : { clientId }
+  });
+};
+var assertVaultSessionIdentity = (session, config) => {
+  if (session.provider?.issuer !== void 0 && session.provider.issuer !== config.issuer || session.provider?.clientId !== void 0 && session.provider.clientId !== config.clientId)
+    throw invalidVaultSession();
+};
+var snapshotVaultSession = (record, expectedSessionId, now) => {
+  const {
+    sessionId,
+    logicalSessionId,
+    subject,
+    providerSessionId,
+    provider: rawProvider,
+    deviceBinding: rawBinding,
+    refreshToken,
+    idToken,
+    accessToken,
+    scope,
+    expiresAt,
+    createdAt,
+    updatedAt,
+    user,
+    metadata
+  } = record;
+  if (sessionId !== expectedSessionId || typeof sessionId !== "string" || !sessionId || typeof subject !== "string" || !subject || logicalSessionId !== void 0 && (typeof logicalSessionId !== "string" || !logicalSessionId) || providerSessionId !== void 0 && typeof providerSessionId !== "string" || typeof refreshToken !== "string" || typeof idToken !== "string" || accessToken !== void 0 && typeof accessToken !== "string" || scope !== void 0 && typeof scope !== "string" || !isUsableEpochMs(createdAt) || !isUsableEpochMs(updatedAt) || !isUsableEpochMs(now) || expiresAt !== void 0 && (!isUsableEpochMs(expiresAt) || expiresAt <= now))
+    throw invalidVaultSession();
+  const provider = snapshotProvider(rawProvider);
+  const binding = snapshotDpopBinding(rawBinding);
+  if (binding !== void 0 && Object.keys(rawBinding).length !== 2) throw invalidVaultSession();
+  return Object.freeze({
+    sessionId,
+    logicalSessionId,
+    subject,
+    providerSessionId,
+    provider,
+    ...binding === void 0 ? {} : { deviceBinding: binding },
+    refreshToken,
+    idToken,
+    accessToken,
+    scope,
+    expiresAt,
+    createdAt,
+    updatedAt,
+    ...user === void 0 ? {} : { user: copyPortableData(user) },
+    ...metadata === void 0 ? {} : { metadata: copyPortableData(metadata) }
+  });
+};
+var assertVaultSessionMatches = (actual, original) => {
+  if (actual.sessionId !== original.sessionId || actual.logicalSessionId !== original.logicalSessionId || actual.subject !== original.subject || actual.providerSessionId !== original.providerSessionId || actual.provider?.issuer !== original.provider?.issuer || actual.provider?.clientId !== original.provider?.clientId || actual.deviceBinding?.jkt !== original.deviceBinding?.jkt || actual.expiresAt !== original.expiresAt || actual.createdAt !== original.createdAt || actual.updatedAt !== original.updatedAt || actual.refreshToken !== original.refreshToken || actual.idToken !== original.idToken || actual.accessToken !== original.accessToken || actual.scope !== original.scope)
+    throw invalidVaultSession();
+};
+var snapshotVaultExchangeCode = (record, expectedCode, now) => {
+  const { code, sessionId, returnTo, createdAt, expiresAt } = record;
+  if (code !== expectedCode || typeof sessionId !== "string" || !sessionId || returnTo !== void 0 && typeof returnTo !== "string" || !isUsableEpochMs(createdAt) || !isUsableEpochMs(expiresAt) || !isUsableEpochMs(now) || expiresAt <= now)
+    throw invalidExchangeCode();
+  const match = snapshotRecordBindingMatch(record);
+  return Object.freeze({
+    code,
+    sessionId,
+    returnTo,
+    createdAt,
+    expiresAt,
+    match,
+    ...match.deviceBinding === null ? {} : { deviceBinding: match.deviceBinding },
+    ...match.browserBindingHash === null ? {} : { browserBindingHash: match.browserBindingHash }
+  });
+};
+var assertVaultExchangeCodeMatches = (actual, original) => {
+  if (actual.code !== original.code || actual.sessionId !== original.sessionId || actual.returnTo !== original.returnTo || actual.createdAt !== original.createdAt || actual.expiresAt !== original.expiresAt || !recordBindingMatches(actual.match, original.match))
+    throw invalidExchangeCode();
+};
+var assertVaultExchangeSessionBinding = (code, session) => {
+  if (code.sessionId !== session.sessionId || code.deviceBinding?.jkt !== session.deviceBinding?.jkt)
+    throw invalidVaultSession();
+};
+var snapshotVaultRevocationContext = (context) => {
+  const { logicalSessionId, provider, deviceBinding } = context;
+  if (typeof logicalSessionId !== "string" || !logicalSessionId) throw invalidVaultSession();
+  const identity = snapshotProvider(provider);
+  const binding = snapshotDpopBinding(deviceBinding);
+  if (binding !== void 0 && Object.keys(deviceBinding).length !== 2) throw invalidVaultSession();
+  return Object.freeze({
+    logicalSessionId,
+    ...identity === void 0 ? {} : { provider: identity },
+    ...binding === void 0 ? {} : { deviceBinding: binding }
+  });
+};
+var assertVaultRevocationContextMatches = (actual, original) => {
+  if (actual.logicalSessionId !== original.logicalSessionId || actual.provider?.issuer !== original.provider?.issuer || actual.provider?.clientId !== original.provider?.clientId || actual.deviceBinding?.jkt !== original.deviceBinding?.jkt) {
+    throw invalidVaultSession();
+  }
+};
+
+// src/token-issuance.ts
+var createExchangeResponse = (options, session, issuedToken) => ({
+  sessionId: usesCookieTransport(options) ? void 0 : session.sessionId,
+  user: copyVaultUserProfile(session.user),
+  accessToken: issuedToken.accessToken,
+  expiresIn: issuedToken.expiresIn,
+  tokenType: issuedToken.tokenType
+});
+var isCompactSignedJwt = (token) => {
+  const parts = token.split(".");
+  return parts.length === 3 && parts.every(
+    (part) => /^[A-Za-z0-9_-]+$/.test(part) ? Buffer.from(part, "base64url").toString("base64url") === part : false
+  );
+};
+var assertIssuedTokenConfirmation = (accessToken, jkt) => {
+  if (!isCompactSignedJwt(accessToken)) {
+    throw new TypeError("tokenIssuer.issue accessToken must be a compact signed JWT for bound issuance.");
+  }
+  let header;
+  let claims;
+  try {
+    header = decodeProtectedHeader(accessToken);
+    claims = decodeJwt(accessToken);
+  } catch {
+    throw new TypeError("tokenIssuer.issue accessToken must be a compact signed JWT for bound issuance.");
+  }
+  if (typeof header.alg !== "string" || header.alg.length === 0 || header.alg === "none" || header.b64 === false) {
+    throw new TypeError("tokenIssuer.issue accessToken must use a signed JWT algorithm for bound issuance.");
+  }
+  const cnf = claims.cnf;
+  if (typeof cnf !== "object" || cnf === null || Array.isArray(cnf) || cnf.jkt !== jkt) {
+    throw new TypeError("tokenIssuer.issue accessToken cnf.jkt must match the verified device binding.");
+  }
+};
+var withIssuedToken = async (req, res, options, session, verifiedBinding) => {
+  const binding = resolveVerifiedDeviceBinding(options.deviceBinding, session.deviceBinding, verifiedBinding);
+  if (!options.tokenIssuer) return {};
+  const logicalSessionId = session.logicalSessionId ?? session.sessionId;
+  try {
+    const issuerSession = withSessionDeviceBinding(copyVaultSession(session, true), binding);
+    const result = await options.tokenIssuer.issue({
+      req,
+      res,
+      session: issuerSession,
+      ...binding === void 0 ? {} : { deviceBinding: Object.freeze({ ...binding }) }
+    });
+    if (typeof result !== "object" || result === null || Array.isArray(result)) {
+      throw new TypeError("tokenIssuer.issue must return a token result object.");
+    }
+    const { accessToken, expiresIn, tokenType } = result;
+    if (typeof accessToken !== "string" || accessToken.length === 0) {
+      throw new TypeError("tokenIssuer.issue accessToken must be a nonempty string.");
+    }
+    if (typeof expiresIn !== "number" || !Number.isSafeInteger(expiresIn) || expiresIn < 0) {
+      throw new TypeError("tokenIssuer.issue expiresIn must be a finite nonnegative safe integer.");
+    }
+    if (tokenType !== void 0 && tokenType !== "Bearer" && tokenType !== "DPoP") {
+      throw new TypeError("tokenIssuer.issue tokenType must be the exact Bearer or DPoP literal when provided.");
+    }
+    if (binding === void 0) {
+      if (tokenType !== void 0 && tokenType !== "Bearer") {
+        throw new TypeError("tokenIssuer.issue tokenType must be Bearer when provided for unbound issuance.");
+      }
+    } else {
+      if (tokenType !== "DPoP") throw new TypeError("tokenIssuer.issue tokenType must be DPoP for bound issuance.");
+      assertIssuedTokenConfirmation(accessToken, binding.jkt);
+    }
+    return { accessToken, expiresIn, ...tokenType === void 0 ? {} : { tokenType } };
+  } catch (error) {
+    await options.storeProvider.deleteSessionsByLogicalSessionId({ logicalSessionId });
+    if (usesCookieTransport(options)) clearSessionCookie(res, options);
+    throw error;
+  }
+};
+
 // src/token-validation.ts
 import { jwtVerify } from "jose";
+
+// src/access-token-confirmation.ts
+var invalidAccessToken = (diagnostic) => new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_ACCESS_TOKEN", diagnostic, "Access token validation failed.");
+var snapshotJkt = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw invalidAccessToken("Access token confirmation must be a plain jkt object.");
+  }
+  const prototype = Object.getPrototypeOf(value);
+  const keys = Reflect.ownKeys(value);
+  if (prototype !== Object.prototype && prototype !== null || keys.length !== 1 || keys[0] !== "jkt") {
+    throw invalidAccessToken("Access token confirmation contains unsupported fields.");
+  }
+  const { jkt } = value;
+  if (!isCanonicalDpopJkt(jkt))
+    throw invalidAccessToken("Access token confirmation is not a canonical SHA-256 thumbprint.");
+  return Object.freeze({ jkt });
+};
+var snapshotVerifiedJwtConfirmation = (claims) => Object.hasOwn(claims, "cnf") ? snapshotJkt(claims.cnf) : null;
+var snapshotAccessTokenConfirmation = (value) => value === null ? null : snapshotJkt(value);
+
+// src/token-validation.ts
 var BACKCHANNEL_LOGOUT_EVENT_CLAIM = "http://schemas.openid.net/event/backchannel-logout";
 var validateBackchannelLogoutTokenTyp = (typ) => {
   if (typ !== void 0 && (typeof typ !== "string" || typ.toLowerCase() !== "logout+jwt")) {
@@ -1187,17 +2128,35 @@ async function verifyBackchannelLogoutToken(metadata, logoutToken, options = {})
   return claims;
 }
 function createOidcVaultJwtAccessTokenValidator(options) {
-  return {
+  const {
+    key: configuredKey,
+    issuer,
+    audience: configuredAudience,
+    algorithms: configuredAlgorithms,
+    mapClaims
+  } = options;
+  const key = configuredKey instanceof Uint8Array ? Uint8Array.from(configuredKey) : "kty" in configuredKey ? { ...configuredKey, ...configuredKey.key_ops ? { key_ops: [...configuredKey.key_ops] } : {} } : configuredKey;
+  const audience = Array.isArray(configuredAudience) ? [...configuredAudience] : configuredAudience;
+  const algorithms = configuredAlgorithms === void 0 ? void 0 : [...configuredAlgorithms];
+  const validateJwt = async (token) => {
+    const result = await jwtVerify(token, key, { issuer, audience, algorithms });
+    const claims = result.payload;
+    const confirmation = snapshotVerifiedJwtConfirmation(claims);
+    const mapped = mapClaims ? mapClaims(claims) : defaultJwtClaimsMapper(claims);
+    const { subject, sessionId, scope, claims: mappedClaims } = mapped;
+    return { subject, sessionId, scope, claims: mappedClaims, confirmation };
+  };
+  return Object.freeze({
     async validate(token) {
-      const result = await jwtVerify(token, options.key, {
-        issuer: options.issuer,
-        audience: options.audience,
-        algorithms: options.algorithms
-      });
-      const claims = result.payload;
-      return options.mapClaims ? options.mapClaims(claims) : defaultJwtClaimsMapper(claims);
+      const { confirmation, ...mapped } = await validateJwt(token);
+      return confirmation === null ? mapped : { ...mapped, confirmation };
+    },
+    async validateWithRequest({
+      token
+    }) {
+      return validateJwt(token);
     }
-  };
+  });
 }
 
 // src/types.ts
@@ -1207,6 +2166,235 @@ var OidcVaultStoreConflictError = class extends Error {
     this.name = "OidcVaultStoreConflictError";
   }
 };
+var OidcVaultDpopReplayCapacityError = class extends Error {
+  constructor(message = "OIDC vault DPoP replay store capacity is exhausted.") {
+    super(message);
+    this.name = "OidcVaultDpopReplayCapacityError";
+  }
+};
+
+// src/dpop-replay.ts
+import { createHash as createHash5 } from "crypto";
+var isPrintableIdentifier = (value) => typeof value === "string" && /^[\x20-\x7e]{1,128}$/.test(value);
+var normalizeNamespaceBasePath = (origin, value) => {
+  if (value !== void 0 && typeof value !== "string")
+    throw new TypeError("DPoP vault basePath must be a static path.");
+  const mounted = !value || value === "/" ? DEFAULT_OIDC_VAULT_BASE_PATH : `/${value.replace(/^\/+|\/+$/g, "")}`;
+  if (/[\s\\?#]/.test(mounted) || /%(?![0-9a-f]{2})/i.test(mounted)) {
+    throw new TypeError("DPoP vault basePath must be a static path without query, fragment or malformed escapes.");
+  }
+  const path = mounted.replace(/%([0-9a-f]{2})/gi, (_, hex) => {
+    const character = String.fromCharCode(Number.parseInt(hex, 16));
+    return /^[A-Za-z0-9._~-]$/.test(character) ? character : `%${hex.toUpperCase()}`;
+  });
+  const normalized = new URL(`${origin}${path}`).pathname;
+  return normalized.replace(/\/+$/g, "") || "/";
+};
+var resolveDpopEffectiveNamespace = (space) => {
+  if (space?.type === "vault") {
+    const { backendOrigin, basePath, issuer, clientId } = space;
+    const origin = resolveDeviceBindingOrigin(backendOrigin);
+    if (typeof issuer !== "string" || issuer.length === 0 || typeof clientId !== "string" || clientId.length === 0) {
+      throw new TypeError("DPoP vault namespace requires resolved issuer and clientId.");
+    }
+    return Object.freeze(["vault", origin, normalizeNamespaceBasePath(origin, basePath), issuer, clientId]);
+  }
+  if (space?.type === "api") {
+    const { publicOrigin, replayNamespace } = space;
+    if (!isPrintableIdentifier(replayNamespace)) {
+      throw new TypeError("DPoP replayNamespace must contain 1 through 128 printable ASCII bytes.");
+    }
+    return Object.freeze(["api", resolveDeviceBindingOrigin(publicOrigin, "publicOrigin"), replayNamespace]);
+  }
+  throw new TypeError("DPoP replay policy requires a vault or API protection space.");
+};
+var createDpopReplayKey = (effectiveNamespace, jkt, jti) => {
+  if (!isCanonicalDpopJkt(jkt) || !isPrintableIdentifier(jti)) {
+    throw new TypeError("DPoP replay key requires a canonical thumbprint and a bounded printable JTI.");
+  }
+  return `dpop:v1:${createHash5("sha256").update(JSON.stringify([effectiveNamespace, jkt, jti]), "utf8").digest("base64url")}`;
+};
+var getDpopReplayExpiresAt = (input) => {
+  const { iat, now, proofMaxAgeSeconds: age, clockSkewSeconds: skew } = input;
+  if (typeof iat !== "number" || !Number.isSafeInteger(iat) || iat < 0 || !Number.isSafeInteger(now) || now < 0 || !Number.isInteger(age) || age < 1 || age > 300 || !Number.isInteger(skew) || skew < 0 || skew > 30)
+    return null;
+  const issuedAt = iat * 1e3;
+  const expiresAt = (iat + age + skew) * 1e3;
+  if (!Number.isSafeInteger(issuedAt) || !Number.isSafeInteger(expiresAt) || issuedAt - now > skew * 1e3 || expiresAt <= now || expiresAt - now > 36e4)
+    return null;
+  return expiresAt;
+};
+var invalidProof2 = (diagnostic) => new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_DPOP_PROOF", diagnostic, "DPoP proof validation failed.");
+var replayUnavailable = (cause) => {
+  const error = new OidcVaultHttpError(
+    503,
+    "OIDC_VAULT_DPOP_REPLAY_UNAVAILABLE",
+    "DPoP replay admission failed.",
+    "DPoP replay protection is unavailable."
+  );
+  Object.defineProperty(error, "cause", { value: cause, configurable: true });
+  return error;
+};
+var createDpopReplayPolicy = (options) => {
+  const { protectionSpace, proofOptions, replayStore, now: configuredNow } = options;
+  const policy = resolveDeviceBindingOptions(proofOptions);
+  if (!policy) throw new TypeError("DPoP replay policy requires enabled proof options.");
+  if (typeof replayStore?.reserveDpopProof !== "function")
+    throw new TypeError("DPoP replay policy requires a replay store.");
+  if (configuredNow !== void 0 && typeof configuredNow !== "function")
+    throw new TypeError("DPoP replay clock must be callable.");
+  const now = configuredNow ?? Date.now;
+  const effectiveNamespace = resolveDpopEffectiveNamespace(protectionSpace);
+  const noncePolicy = policy.nonce === false ? void 0 : createDpopNoncePolicy({
+    ...policy.nonce,
+    namespace: JSON.stringify(effectiveNamespace)
+  });
+  return Object.freeze({
+    effectiveNamespace,
+    async verifyAndReserve(verifyBeforeReplay) {
+      const verified = await verifyBeforeReplay();
+      if (typeof verified !== "object" || verified === null || Array.isArray(verified)) {
+        throw invalidProof2("DPoP verifier did not return a proof verification result.");
+      }
+      const { binding: verifiedBinding, iat, jti, nonce } = verified;
+      if (typeof verifiedBinding !== "object" || verifiedBinding === null || Array.isArray(verifiedBinding)) {
+        throw invalidProof2("DPoP verifier did not return a verified key binding.");
+      }
+      const { type, jkt, alg } = verifiedBinding;
+      if (type !== "dpop" || !isCanonicalDpopJkt(jkt) || !isDpopAlgorithm(alg) || !policy.algorithms.includes(alg) || !isPrintableIdentifier(jti)) {
+        throw invalidProof2("DPoP verified key/algorithm or signed JTI shape is invalid.");
+      }
+      const binding = Object.freeze({ type, jkt, alg });
+      let checkedNow;
+      try {
+        checkedNow = now();
+        if (!Number.isSafeInteger(checkedNow) || checkedNow < 0) throw new TypeError("DPoP replay clock is invalid.");
+      } catch (error) {
+        throw replayUnavailable(error);
+      }
+      const expiresAt = getDpopReplayExpiresAt({ ...policy, iat, now: checkedNow });
+      if (expiresAt === null) throw invalidProof2("DPoP signed iat is outside the bounded replay window.");
+      if (noncePolicy) {
+        if (!noncePolicy.verify(nonce, jkt, checkedNow)) {
+          return Object.freeze({ type: "nonce-challenge", nonce: noncePolicy.issue(jkt, checkedNow) });
+        }
+      } else if (nonce !== void 0 && (typeof nonce !== "string" || nonce.length > DPOP_NONCE_MAX_BYTES || Buffer.byteLength(nonce, "utf8") > DPOP_NONCE_MAX_BYTES)) {
+        throw invalidProof2("DPoP signed nonce claim exceeds its string/byte bound.");
+      }
+      let reserved;
+      try {
+        reserved = await replayStore.reserveDpopProof({
+          replayKey: createDpopReplayKey(effectiveNamespace, jkt, jti),
+          expiresAt
+        });
+        if (typeof reserved !== "boolean")
+          throw new TypeError("DPoP replay store returned a non-boolean admission result.");
+      } catch (error) {
+        throw replayUnavailable(error);
+      }
+      if (!reserved) throw invalidProof2("DPoP replay reservation was duplicate or no longer live.");
+      return Object.freeze({ type: "accepted", binding, expiresAt });
+    }
+  });
+};
+var challenge = (error, algorithms) => {
+  if (algorithms.length === 0 || !algorithms.every(isDpopAlgorithm))
+    throw new TypeError("DPoP challenge requires a resolved algorithm allowlist.");
+  return `DPoP error="${error}", algs="${[...new Set(algorithms)].join(" ")}"`;
+};
+var toDpopReplayErrorResponse = (error, algorithms) => {
+  const { status, code, message } = toErrorPayload(error);
+  return Object.freeze({
+    status,
+    body: Object.freeze({ code, message }),
+    headers: Object.freeze({
+      "Cache-Control": "no-store",
+      ...status === 401 && (code === "OIDC_VAULT_INVALID_DPOP_PROOF" || code === "OIDC_VAULT_DPOP_REQUIRED") ? { "WWW-Authenticate": challenge("invalid_dpop_proof", algorithms) } : {}
+    })
+  });
+};
+var toDpopNonceChallengeResponse = (result, endpoint, algorithms) => {
+  const nonce = result?.nonce;
+  if (result?.type !== "nonce-challenge" || typeof nonce !== "string" || nonce.length > DPOP_NONCE_MAX_BYTES || !/^v1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{43}$/.test(nonce))
+    throw new TypeError("DPoP nonce response requires a bounded server-issued challenge.");
+  if (endpoint !== "vault-post" && endpoint !== "api")
+    throw new TypeError("DPoP nonce response requires an API or vault POST endpoint.");
+  return Object.freeze({
+    status: endpoint === "api" ? 401 : 400,
+    body: Object.freeze({ code: "OIDC_VAULT_USE_DPOP_NONCE", message: "A fresh DPoP nonce is required." }),
+    headers: Object.freeze({
+      "Cache-Control": "no-store",
+      "DPoP-Nonce": nonce,
+      ...endpoint === "api" ? { "WWW-Authenticate": challenge("use_dpop_nonce", algorithms) } : {}
+    })
+  });
+};
+
+// src/vault-route-proof.ts
+var captureVaultRouteProof = (req) => Object.freeze({
+  header: readDpopRawHeader(req, "dpop"),
+  method: req.method,
+  originalUrl: req.originalUrl
+});
+var VaultDpopNonceChallengeError = class extends OidcVaultHttpError {
+  constructor(response) {
+    super(400, "OIDC_VAULT_USE_DPOP_NONCE", "A fresh DPoP nonce is required.");
+    this.response = response;
+  }
+};
+var createVaultRouteProofVerifier = (options, config, backendOrigin, basePath) => {
+  const policy = options.deviceBinding;
+  if (policy === void 0) return void 0;
+  assertDeviceBindingStoreCapabilities(options.storeProvider);
+  const targetFor = createDpopRequestTargetResolver({ publicOrigin: backendOrigin });
+  const replay = createDpopReplayPolicy({
+    // The config resolver requires both identifiers in manual/discovery modes.
+    protectionSpace: { type: "vault", backendOrigin, basePath, issuer: config.issuer, clientId: config.clientId },
+    proofOptions: policy,
+    replayStore: options.storeProvider,
+    now: options.now
+  });
+  const admit = async (request, proof, expectedJkt) => {
+    const targetUrl = targetFor(request.originalUrl);
+    const result = await replay.verifyAndReserve(
+      () => verifyDpopProof({
+        proof,
+        method: request.method,
+        targetUrl,
+        proofOptions: policy,
+        expectedJkt
+      })
+    );
+    if (result.type === "nonce-challenge") {
+      throw new VaultDpopNonceChallengeError(toDpopNonceChallengeResponse(result, "vault-post", policy.algorithms));
+    }
+    return result.binding;
+  };
+  return Object.freeze({
+    async initiate(request) {
+      const proof = extractDpopProof(request.header);
+      if (proof === void 0) {
+        assertDeviceBindingPolicy(policy, void 0);
+        return void 0;
+      }
+      return admit(request, proof);
+    },
+    async verify(request, originalBinding) {
+      const binding = snapshotDpopBinding(originalBinding);
+      assertDeviceBindingPolicy(policy, binding);
+      const proof = extractDpopProof(request.header);
+      const verified = proof === void 0 ? void 0 : await admit(request, proof, binding?.jkt);
+      return resolveVerifiedDeviceBinding(policy, binding, verified);
+    }
+  });
+};
+var toVaultRouteErrorResponse = (error, policy) => error instanceof VaultDpopNonceChallengeError ? error.response : toDpopReplayErrorResponse(error, policy?.algorithms ?? ["ES256"]);
+var sendVaultRoutePolicyResponse = (res, response) => {
+  res.removeHeader("WWW-Authenticate");
+  res.removeHeader("DPoP-Nonce");
+  for (const [name, value] of Object.entries(response.headers)) res.setHeader(name, value);
+  res.status(response.status).json(response.body);
+};
 
 // src/access-token-middleware.ts
 var extractBearerToken = (authorizationHeader) => {
@@ -1223,72 +2411,212 @@ var extractBearerToken = (authorizationHeader) => {
   }
   return token;
 };
-var setBearerChallengeHeader = (res) => {
-  res.setHeader("WWW-Authenticate", "Bearer");
-};
-var notifyBearerMiddlewareError = async (options, context) => {
+var notifyMiddlewareError = async (onError, context) => {
   try {
-    await options.onError?.(context);
+    await onError?.(context);
   } catch {
   }
 };
+var schemeOf = (value) => {
+  const scheme = value?.trim().split(/\s+/, 1)[0]?.toLowerCase();
+  return scheme === "bearer" ? "Bearer" : scheme === "dpop" ? "DPoP" : void 0;
+};
+var mappedFields = (result) => {
+  if (typeof result !== "object" || result === null || Array.isArray(result))
+    throw invalidAccessToken("Access token validator result is invalid.");
+  const { subject, sessionId, scope, claims } = result;
+  if (typeof subject !== "string" || subject.length === 0)
+    throw invalidAccessToken("Access token validator result is missing subject.");
+  return { subject, sessionId, scope, claims };
+};
 function createOidcVaultAccessTokenMiddleware(options) {
+  const { validator, deviceBinding: configuredBinding, onAuthContext, onError } = options;
+  const policy = resolveDeviceBindingOptions(configuredBinding);
+  const validate = validator.validate.bind(validator);
+  const requestAware = policy ? validator.validateWithRequest : void 0;
+  if (policy && typeof requestAware !== "function")
+    throw new TypeError("deviceBinding requires validator.validateWithRequest.");
+  const validateWithRequest = requestAware?.bind(validator);
+  const apiOptions = policy ? (() => {
+    const { publicOrigin, publicPathPrefix, replayNamespace, replayStore, now } = configuredBinding;
+    return {
+      publicOrigin: resolveDeviceBindingOrigin(publicOrigin, "publicOrigin"),
+      publicPathPrefix,
+      replayNamespace,
+      replayStore,
+      now
+    };
+  })() : void 0;
+  const targetFor = apiOptions ? createDpopRequestTargetResolver(apiOptions) : void 0;
+  const replay = policy ? createDpopReplayPolicy({
+    protectionSpace: {
+      type: "api",
+      publicOrigin: apiOptions.publicOrigin,
+      replayNamespace: apiOptions.replayNamespace
+    },
+    proofOptions: policy,
+    replayStore: apiOptions.replayStore,
+    now: apiOptions.now
+  }) : void 0;
+  const algorithms = policy?.algorithms ?? ["ES256"];
+  const algs = algorithms.join(" ");
+  const dpopChallenge = (error) => `DPoP${error ? ` error="${error}",` : ""} algs="${algs}"`;
+  const proofChallenge = dpopChallenge("invalid_dpop_proof");
   return async (req, res, next) => {
     let token;
+    let scheme;
+    let nonceResponse;
+    const authenticatedRequest = req;
+    delete authenticatedRequest.auth;
+    if (!res.headersSent) res.setHeader("Cache-Control", "no-store");
+    const prepareError = (error, hookFailure = false) => {
+      const response = nonceResponse ?? (error instanceof OidcVaultHttpError ? toDpopReplayErrorResponse(error, algorithms) : {
+        status: hookFailure ? 500 : 401,
+        body: hookFailure ? { code: "OIDC_VAULT_AUTH_CONTEXT_FAILED", message: "Auth context hook failed." } : { code: "OIDC_VAULT_INVALID_ACCESS_TOKEN", message: "Access token validation failed." },
+        headers: { "Cache-Control": "no-store" }
+      });
+      const headers = { ...response.headers };
+      if (response.status === 401 && headers["WWW-Authenticate"] === void 0) {
+        const code = response.body.code;
+        const challenge2 = code === "OIDC_VAULT_DPOP_REQUIRED" || code === "OIDC_VAULT_INVALID_DPOP_PROOF" ? proofChallenge : !policy ? "Bearer" : code === "OIDC_VAULT_MISSING_ACCESS_TOKEN" ? policy.mode === "required" ? dpopChallenge() : `Bearer, ${dpopChallenge()}` : scheme === "DPoP" || !scheme && policy.mode === "required" ? dpopChallenge("invalid_token") : 'Bearer error="invalid_token"';
+        headers["WWW-Authenticate"] = challenge2;
+      }
+      return Object.freeze({
+        status: response.status,
+        body: Object.freeze({ ...response.body }),
+        headers: Object.freeze(headers)
+      });
+    };
+    const sendError = (response) => {
+      res.removeHeader("WWW-Authenticate");
+      res.removeHeader("DPoP-Nonce");
+      for (const [name, value] of Object.entries(response.headers)) res.setHeader(name, value);
+      res.status(response.status).json(response.body);
+    };
     try {
-      token = extractBearerToken(req.get("authorization"));
-      const validationResult = await options.validator.validate(token);
+      let result;
+      let confirmation;
+      let deviceBinding;
+      if (!policy) {
+        token = extractBearerToken(req.get("authorization"));
+        scheme = "Bearer";
+        result = await validate(token);
+        delete authenticatedRequest.auth;
+        const reported = result?.confirmation;
+        confirmation = reported === void 0 ? void 0 : snapshotAccessTokenConfirmation(reported);
+        result = mappedFields(result);
+        delete authenticatedRequest.auth;
+        if (confirmation)
+          throw new OidcVaultHttpError(401, "OIDC_VAULT_DPOP_REQUIRED", "DPoP authentication is required.");
+      } else {
+        const authorization = readDpopRawHeader(req, "authorization");
+        scheme = schemeOf(authorization.value);
+        if (authorization.count === 0 || authorization.count === 1 && !authorization.value?.trim()) {
+          throw new OidcVaultHttpError(401, "OIDC_VAULT_MISSING_ACCESS_TOKEN", "Missing access token.");
+        }
+        const credential = authorization.value?.trim().split(/\s+/);
+        if (authorization.count !== 1 || !scheme || credential?.length !== 2 || !credential[1] || !/^[\x21-\x7e]+$/.test(credential[1]) || credential[1].includes(",")) {
+          throw new OidcVaultHttpError(
+            401,
+            "OIDC_VAULT_INVALID_AUTHORIZATION_HEADER",
+            "Authorization header must use one Bearer or DPoP credential."
+          );
+        }
+        token = credential[1];
+        const proofHeader = readDpopRawHeader(req, "dpop");
+        const { method, originalUrl } = req;
+        result = await validateWithRequest(Object.freeze({ token, scheme, req }));
+        delete authenticatedRequest.auth;
+        confirmation = snapshotAccessTokenConfirmation(result?.confirmation);
+        result = mappedFields(result);
+        delete authenticatedRequest.auth;
+        if (confirmation && scheme !== "DPoP")
+          throw new OidcVaultHttpError(401, "OIDC_VAULT_DPOP_REQUIRED", "DPoP authentication is required.");
+        if (!confirmation && scheme === "DPoP")
+          throw invalidAccessToken("DPoP presentation of a verified unbound token is invalid.");
+        if (!confirmation && policy.mode === "required") {
+          throw new OidcVaultHttpError(401, "OIDC_VAULT_DEVICE_BINDING_REQUIRED", "A device-bound login is required.");
+        }
+        const proof = extractDpopProof(proofHeader);
+        if (!proof && confirmation)
+          throw new OidcVaultHttpError(401, "OIDC_VAULT_DPOP_REQUIRED", "DPoP authentication is required.");
+        if (proof) {
+          const targetUrl = targetFor(originalUrl);
+          const admission = await replay.verifyAndReserve(
+            () => verifyDpopProof({
+              proof,
+              method,
+              targetUrl,
+              proofOptions: policy,
+              accessToken: token,
+              expectedJkt: confirmation?.jkt
+            })
+          );
+          if (admission.type === "nonce-challenge") {
+            nonceResponse = toDpopNonceChallengeResponse(admission, "api", policy.algorithms);
+            throw new OidcVaultHttpError(401, "OIDC_VAULT_USE_DPOP_NONCE", "A fresh DPoP nonce is required.");
+          }
+          if (confirmation) deviceBinding = admission.binding;
+        }
+      }
+      const authenticatedToken = token;
       const auth = {
-        token,
-        ...validationResult
+        ...result,
+        token: authenticatedToken,
+        ...confirmation === void 0 ? {} : { confirmation },
+        ...deviceBinding ? { deviceBinding } : {}
+      };
+      const restoreAuth = () => {
+        const { subject, sessionId, scope, claims } = auth;
+        return {
+          subject,
+          sessionId,
+          scope,
+          claims,
+          token: authenticatedToken,
+          ...confirmation === void 0 ? {} : { confirmation },
+          ...deviceBinding ? { deviceBinding } : {}
+        };
       };
-      const authenticatedRequest = req;
       authenticatedRequest.auth = auth;
       try {
-        await options.onAuthContext?.({ req: authenticatedRequest, res, auth });
+        await onAuthContext?.({ req: authenticatedRequest, res, auth });
+        authenticatedRequest.auth = restoreAuth();
       } catch (hookError) {
+        const response = prepareError(hookError, true);
+        delete authenticatedRequest.auth;
+        let errorAuth;
+        try {
+          errorAuth = restoreAuth();
+        } catch {
+          errorAuth = {
+            ...result,
+            token: authenticatedToken,
+            ...confirmation === void 0 ? {} : { confirmation },
+            ...deviceBinding ? { deviceBinding } : {}
+          };
+        }
+        await notifyMiddlewareError(onError, { error: hookError, req, res, token, auth: errorAuth });
         delete authenticatedRequest.auth;
-        await notifyBearerMiddlewareError(options, { error: hookError, req, res, token, auth });
         if (res.headersSent) {
           next(hookError);
           return;
         }
-        if (hookError instanceof OidcVaultHttpError) {
-          if (hookError.status === 401) {
-            setBearerChallengeHeader(res);
-          }
-          res.status(hookError.status).json({
-            code: hookError.code,
-            message: hookError.clientMessage
-          });
-          return;
-        }
-        res.status(500).json({
-          code: "OIDC_VAULT_AUTH_CONTEXT_FAILED",
-          message: "Auth context hook failed."
-        });
+        sendError(response);
         return;
       }
+      if (!res.headersSent) res.setHeader("Cache-Control", "no-store");
       next();
     } catch (error) {
-      await notifyBearerMiddlewareError(options, { error, req, res, ...token ? { token } : {} });
+      const response = prepareError(error);
+      delete authenticatedRequest.auth;
+      await notifyMiddlewareError(onError, { error, req, res, ...token ? { token } : {} });
+      delete authenticatedRequest.auth;
       if (res.headersSent) {
         next(error);
         return;
       }
-      if (error instanceof OidcVaultHttpError) {
-        setBearerChallengeHeader(res);
-        res.status(error.status).json({
-          code: error.code,
-          message: error.clientMessage
-        });
-        return;
-      }
-      setBearerChallengeHeader(res);
-      res.status(401).json({
-        code: "OIDC_VAULT_INVALID_ACCESS_TOKEN",
-        message: "Access token validation failed."
-      });
+      sendError(response);
     }
   };
 }
@@ -1305,39 +2633,58 @@ var CREDENTIAL_RESPONSE_CACHE_CONTROL = "no-store";
 var applyCredentialResponseCachePolicy = (res) => {
   res.setHeader("Cache-Control", CREDENTIAL_RESPONSE_CACHE_CONTROL);
 };
-var createOpaqueId = (prefix) => `${prefix}_${randomBytes(16).toString("base64url")}`;
-var createPkceVerifier = () => randomBytes(32).toString("base64url");
-var createPkceChallenge = (verifier) => createHash("sha256").update(verifier).digest("base64url");
+var createOpaqueId = (prefix) => `${prefix}_${randomBytes3(16).toString("base64url")}`;
+var createPkceVerifier = () => randomBytes3(32).toString("base64url");
+var createPkceChallenge = (verifier) => createHash6("sha256").update(verifier).digest("base64url");
 var getCallbackUri = (backendOrigin, basePath) => `${backendOrigin}${basePath}${OIDC_VAULT_ROUTE_PATHS.callback}`;
 var validateOidcVaultOptions = (options) => {
+  const {
+    deviceBinding: configuredDeviceBinding,
+    fingerprintRecognition: configuredFingerprintRecognition,
+    transactionCookie: configuredTransactionCookie,
+    ...otherOptions
+  } = options;
+  const cookie = otherOptions.cookie ? { ...otherOptions.cookie } : void 0;
+  const cookieOptions = { ...otherOptions, cookie };
   validateLifetimeOptions(options, getNow(options));
-  const backendOrigin = resolveBackendOrigin(options);
+  const deviceBinding = resolveDeviceBindingOptions(configuredDeviceBinding);
+  const fingerprintRecognition = resolveFingerprintRecognitionOptions(configuredFingerprintRecognition);
+  const backendOrigin = deviceBinding === void 0 ? resolveBackendOrigin(options) : resolveDeviceBindingOrigin(options.backendOrigin);
+  if (deviceBinding !== void 0) assertDeviceBindingStoreCapabilities(options.storeProvider);
+  if (fingerprintRecognition !== void 0)
+    assertDeviceBindingStoreCapabilities(options.storeProvider, "fingerprintRecognition");
   const frontendRedirectUri = resolveFrontendRedirectUri(options);
   validatePostLogoutRedirectUri(options);
-  validateCookieOptions(options);
+  validateCookieOptions(cookieOptions);
+  const transactionCookie = resolveTransactionCookieOptions(
+    {
+      ...cookieOptions,
+      deviceBinding: configuredDeviceBinding,
+      fingerprintRecognition,
+      transactionCookie: configuredTransactionCookie
+    },
+    backendOrigin
+  );
   const config = resolveOidcVaultConfig(options.config ? { ...options.config } : void 0);
   const configuredTrustedOrigins = resolveTrustedOrigins(options);
-  if (usesCrossSiteCookieTransport(options) && configuredTrustedOrigins.size === 0) {
+  if (usesCrossSiteCookieTransport(cookieOptions) && configuredTrustedOrigins.size === 0) {
     throw new Error("trustedOrigins is required when using cross-site cookie transport.");
   }
   const trustedOrigins = new Set(configuredTrustedOrigins);
   trustedOrigins.add(backendOrigin);
   const resolvedOptions = {
-    ...options,
+    ...otherOptions,
+    deviceBinding,
+    fingerprintRecognition,
+    transactionCookie,
     ...frontendRedirectUri !== void 0 ? { frontendRedirectUri } : {},
     ...options.trustedOrigins ? { trustedOrigins: [...options.trustedOrigins] } : {},
-    ...options.cookie ? { cookie: { ...options.cookie } } : {},
+    ...cookie === void 0 ? {} : { cookie },
     ...options.config ? { config: { ...options.config } } : {}
   };
   return { backendOrigin, config, trustedOrigins, resolvedOptions };
 };
 var isStoreConflictError = (error) => error instanceof OidcVaultStoreConflictError || typeof error === "object" && error !== null && "name" in error && error.name === "OidcVaultStoreConflictError";
-var assertSessionIdentity = (session, config) => {
-  const provider = session.provider;
-  if (provider?.issuer !== void 0 && provider.issuer !== config.issuer || provider?.clientId !== void 0 && provider.clientId !== config.clientId) {
-    throw new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_SESSION", "Session is missing or expired.");
-  }
-};
 var getSessionIdFromRequest = (req, options, action) => {
   if (usesCookieTransport(options)) {
     const cookieSessionId = getSessionIdFromCookie(req, options);
@@ -1357,13 +2704,6 @@ var getSessionIdFromRequest = (req, options, action) => {
     "OIDC_VAULT_MISSING_SESSION_ID"
   );
 };
-var createExchangeResponse = (options, session, issuedToken) => ({
-  sessionId: usesCookieTransport(options) ? void 0 : session.sessionId,
-  user: session.user,
-  accessToken: issuedToken.accessToken,
-  expiresIn: issuedToken.expiresIn,
-  tokenType: issuedToken.tokenType
-});
 var appendQueryParam = (url, name, value) => {
   if (value) {
     url.searchParams.set(name, value);
@@ -1400,8 +2740,7 @@ var buildBackchannelLogoutReplayKey = (input) => {
   return `v2:${encode(input.issuer ?? "")}:${encode(input.clientId ?? "")}:${encode(input.jti)}`;
 };
 var createHookContext = (route, req, res, session, metadata) => ({ route, req, res, session, metadata });
-var resolveReturnTo = (req, options) => {
-  const rawReturnTo = req.query.returnTo;
+var resolveLoginReturnTo = (rawReturnTo, options) => {
   if (!isString(rawReturnTo)) {
     return void 0;
   }
@@ -1429,31 +2768,12 @@ var resolveReturnTo = (req, options) => {
   }
   return resolvedUrl.toString();
 };
+var resolveReturnTo = (req, options) => resolveLoginReturnTo(req.query.returnTo, options);
 var appendCodeToRedirectUri = (redirectUri, code) => {
   const url = new URL(redirectUri);
   url.searchParams.set("code", code);
   return url.toString();
 };
-var withIssuedToken = async (req, res, options, session) => {
-  if (!options.tokenIssuer) {
-    return {};
-  }
-  const result = await options.tokenIssuer.issue({ req, res, session });
-  if (typeof result !== "object" || result === null || Array.isArray(result)) {
-    throw new TypeError("tokenIssuer.issue must return a token result object.");
-  }
-  const { accessToken, expiresIn, tokenType } = result;
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new TypeError("tokenIssuer.issue accessToken must be a nonempty string.");
-  }
-  if (typeof expiresIn !== "number" || !Number.isSafeInteger(expiresIn) || expiresIn < 0) {
-    throw new TypeError("tokenIssuer.issue expiresIn must be a finite nonnegative safe integer.");
-  }
-  if (tokenType !== void 0 && tokenType !== "Bearer") {
-    throw new TypeError("tokenIssuer.issue tokenType must be Bearer when provided.");
-  }
-  return { accessToken, expiresIn, ...tokenType === void 0 ? {} : { tokenType } };
-};
 var resolveFrontendRedirectUri2 = (transaction, options) => {
   const redirectUri = transaction.returnTo ?? options.frontendRedirectUri;
   if (!redirectUri) {
@@ -1489,6 +2809,7 @@ async function callPostCommitHook(route, options, hook, req, res, session, metad
   }
 }
 async function handleRouteError(route, req, res, next, options, error) {
+  const response = toVaultRouteErrorResponse(error, options.deviceBinding);
   try {
     await options.hooks?.onError?.({
       ...createHookContext(route, req, res),
@@ -1500,12 +2821,7 @@ async function handleRouteError(route, req, res, next, options, error) {
     next(error);
     return;
   }
-  applyCredentialResponseCachePolicy(res);
-  const payload = toErrorPayload(error);
-  res.status(payload.status).json({
-    code: payload.code,
-    message: payload.message
-  });
+  sendVaultRoutePolicyResponse(res, response);
 }
 function createAsyncHandler(route, options, handler) {
   return async (req, res, next) => {
@@ -1531,6 +2847,7 @@ function createBodyParserErrorHandler() {
   };
 }
 var createLoginHandler = (options, config, backendOrigin, basePath) => createAsyncHandler("login", options, async (req, res) => {
+  assertDeviceBindingPolicy(options.deviceBinding, void 0);
   const metadata = await resolveProviderMetadata(config, options);
   await callHook("login", options.hooks?.onLoginStart, req, res, void 0, { provider: metadata });
   const now = getNow(options);
@@ -1556,143 +2873,330 @@ var createLoginHandler = (options, config, backendOrigin, basePath) => createAsy
   });
   res.redirect(302, authorizationUrl);
 });
-var createCallbackHandler = (options, config, backendOrigin, basePath) => createAsyncHandler("callback", options, async (req, res) => {
-  if (isString(req.query.error)) {
-    throw new OidcVaultHttpError(400, "OIDC_VAULT_CALLBACK_ERROR", req.query.error);
+var createLoginInitiationHandler = (options, config, trustedOrigins, backendOrigin, basePath, proofVerifier) => createAsyncHandler("login", options, async (req, res) => {
+  const capturedProof = captureVaultRouteProof(req);
+  const fingerprintRecognition = captureFingerprintRecognition(req, options.fingerprintRecognition);
+  assertLoginInitiationRequest(req, options, trustedOrigins);
+  const body = getBody(req);
+  if (Array.isArray(req.body) || body.returnTo !== void 0 && !isString(body.returnTo)) {
+    throw new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_REQUEST_BODY", "Login initiation request body is invalid.");
   }
-  const code = getRequiredString(
-    req.query.code,
-    "OIDC callback is missing the authorization code.",
-    "OIDC_VAULT_MISSING_CODE"
-  );
-  const state = getRequiredString(req.query.state, "OIDC callback is missing state.", "OIDC_VAULT_MISSING_STATE");
-  const transaction = await options.storeProvider.consumeAuthorizationTransaction(state);
-  if (!transaction) {
-    throw new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_STATE", "OIDC state is invalid or expired.");
+  const returnTo = resolveLoginReturnTo(body.returnTo, options);
+  if (proofVerifier === void 0 && capturedProof.header.count !== 0) {
+    throw new OidcVaultHttpError(
+      401,
+      "OIDC_VAULT_INVALID_DPOP_PROOF",
+      "DPoP login initiation is not enabled.",
+      "DPoP proof validation failed."
+    );
   }
-  const frontendDestination = resolveFrontendRedirectUri2(transaction, options);
+  const verifiedBinding = await proofVerifier?.initiate(capturedProof);
+  const binding = snapshotDpopBinding(verifiedBinding);
   const metadata = await resolveProviderMetadata(config, options);
-  const tokenResponse = await requestToken(
-    metadata,
-    {
-      grant_type: "authorization_code",
-      code,
-      code_verifier: transaction.pkceVerifier,
-      redirect_uri: getCallbackUri(backendOrigin, basePath)
-    },
-    options
-  );
-  validateCallbackTokenResponse(tokenResponse);
-  await callHook("callback", options.hooks?.onCallbackTokens, req, res, void 0, {
-    hasAccessToken: Boolean(tokenResponse.access_token),
-    hasRefreshToken: true,
-    hasIdToken: true
-  });
-  const claims = await verifyIdToken(metadata, tokenResponse.id_token, transaction.nonce, options);
-  const subject = getRequiredString(claims.sub, "OIDC id_token is missing sub.", "OIDC_VAULT_INVALID_ID_TOKEN", 502);
-  const userInfo = shouldFetchUserInfo(options, metadata) && isString(tokenResponse.access_token) ? await fetchUserInfo(metadata, tokenResponse.access_token, options) : void 0;
-  if (userInfo !== void 0) {
-    assertUserInfoSubject(userInfo, subject);
-  }
-  if (userInfo !== void 0) {
-    await callHook("callback", options.hooks?.onUserInfo, req, res, void 0, { subject });
-  }
+  await callHook("login", options.hooks?.onLoginStart, req, res, void 0, { provider: { ...metadata } });
   const now = getNow(options);
-  const sessionExpiresAt = options.sessionTtlMs === void 0 ? void 0 : computeExpiresAt(now, options.sessionTtlMs, "sessionTtlMs");
-  const exchangeExpiresAt = computeExpiresAt(
-    now,
-    options.exchangeCodeTtlMs ?? DEFAULT_EXCHANGE_CODE_TTL_MS,
-    "exchangeCodeTtlMs"
-  );
-  const sessionId = createOpaqueId("sess");
-  const session = {
-    sessionId,
-    logicalSessionId: sessionId,
-    subject,
-    providerSessionId: typeof claims.sid === "string" ? claims.sid : void 0,
-    provider: {
-      issuer: metadata.issuer ?? (typeof claims.iss === "string" ? claims.iss : void 0),
-      clientId: metadata.clientId
-    },
-    refreshToken: tokenResponse.refresh_token,
-    idToken: tokenResponse.id_token,
-    accessToken: isString(tokenResponse.access_token) ? tokenResponse.access_token : void 0,
-    scope: typeof tokenResponse.scope === "string" ? tokenResponse.scope : metadata.scopes,
+  const browserBinding = createTransactionBrowserBinding();
+  const pkceVerifier = createPkceVerifier();
+  const transaction = {
+    state: createOpaqueId("state"),
+    nonce: createOpaqueId("nonce"),
+    pkceVerifier,
+    codeChallenge: createPkceChallenge(pkceVerifier),
+    returnTo,
+    ...binding === void 0 ? {} : { deviceBinding: binding },
+    browserBindingHash: browserBinding.browserBindingHash,
     createdAt: now,
-    updatedAt: now,
-    ...sessionExpiresAt === void 0 ? {} : { expiresAt: sessionExpiresAt },
-    user: mergeUserProfile(subject, claims, userInfo),
-    metadata: {
-      tokenType: tokenResponse.token_type
-    }
+    expiresAt: computeExpiresAt(
+      now,
+      options.authorizationTransactionTtlMs ?? DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS,
+      "authorizationTransactionTtlMs"
+    ),
+    metadata: Object.freeze({
+      ...createTransactionProviderMetadata(config),
+      ...fingerprintRecognition === void 0 ? {} : { [FINGERPRINT_RECOGNITION_METADATA_KEY]: fingerprintRecognition }
+    })
   };
-  await callHook("callback", options.hooks?.onBeforeSessionCreate, req, res, session, { subject });
-  if (sessionExpiresAt !== void 0) {
-    session.expiresAt = isUsableEpochMs(session.expiresAt) ? Math.min(session.expiresAt, sessionExpiresAt) : sessionExpiresAt;
+  const authorizationUrl = buildAuthorizationUrl(metadata, transaction, getCallbackUri(backendOrigin, basePath));
+  const { state, expiresAt } = transaction;
+  await options.storeProvider.createAuthorizationTransaction(transaction);
+  await callHook("login", options.hooks?.onAuthorizationUrl, req, res, void 0, { authorizationUrl, state });
+  setTransactionCookie(res, options.transactionCookie, browserBinding.secret, expiresAt, getNow(options));
+  applyCredentialResponseCachePolicy(res);
+  res.status(200).json({ authorizationUrl });
+});
+var createCallbackHandler = (options, config, backendOrigin, basePath) => createAsyncHandler("callback", options, async (req, res) => {
+  const providerError = isString(req.query.error) ? req.query.error : void 0;
+  const code = providerError === void 0 ? getRequiredString(
+    req.query.code,
+    "OIDC callback is missing the authorization code.",
+    "OIDC_VAULT_MISSING_CODE"
+  ) : void 0;
+  const state = getRequiredString(req.query.state, "OIDC callback is missing state.", "OIDC_VAULT_MISSING_STATE");
+  const cookieHeader = req.headers.cookie;
+  const store = options.storeProvider;
+  const preflight = typeof store.getAuthorizationTransaction === "function" ? await store.getAuthorizationTransaction(state) : await store.consumeAuthorizationTransaction(state);
+  if (!preflight) throw invalidAuthorizationState();
+  const transaction = snapshotAuthorizationTransaction(preflight, state, getNow(options));
+  assertAuthorizationTransactionIdentity(transaction, config);
+  assertDeviceBindingPolicy(options.deviceBinding, transaction.deviceBinding);
+  const cookie = options.transactionCookie;
+  const cookieSecret = authenticateTransactionCookie(cookieHeader, cookie, transaction.match);
+  const frontendDestination = providerError === void 0 ? resolveFrontendRedirectUri2(transaction, options) : void 0;
+  if (typeof store.getAuthorizationTransaction === "function") {
+    let consumed;
+    if (typeof store.consumeAuthorizationTransactionIfMatches === "function") {
+      consumed = await store.consumeAuthorizationTransactionIfMatches({ state, match: transaction.match });
+    } else {
+      if (transaction.browserBindingHash !== void 0) {
+        throw new TypeError("Guarded callbacks require storeProvider.consumeAuthorizationTransactionIfMatches.");
+      }
+      consumed = await store.consumeAuthorizationTransaction(state);
+    }
+    if (!consumed) throw invalidAuthorizationState();
+    const returned = snapshotAuthorizationTransaction(consumed, state, getNow(options));
+    assertAuthorizationTransactionIdentity(returned, config);
+    assertDeviceBindingPolicy(options.deviceBinding, returned.deviceBinding);
+    assertAuthorizationTransactionMatches(returned, transaction);
   }
-  const createdSession = await options.storeProvider.createSession(session);
-  const exchangeCode = createOpaqueId("code");
   try {
-    await options.storeProvider.createExchangeCode({
-      code: exchangeCode,
-      sessionId: createdSession.sessionId,
-      returnTo: transaction.returnTo,
-      createdAt: now,
-      expiresAt: exchangeExpiresAt
+    if (providerError !== void 0) {
+      throw new OidcVaultHttpError(400, "OIDC_VAULT_CALLBACK_ERROR", providerError, "OIDC callback failed.");
+    }
+    const metadata = await resolveProviderMetadata(config, options);
+    const tokenResponse = await requestToken(
+      metadata,
+      {
+        grant_type: "authorization_code",
+        code,
+        code_verifier: transaction.pkceVerifier,
+        redirect_uri: getCallbackUri(backendOrigin, basePath)
+      },
+      options
+    );
+    validateCallbackTokenResponse(tokenResponse);
+    await callHook("callback", options.hooks?.onCallbackTokens, req, res, void 0, {
+      hasAccessToken: Boolean(tokenResponse.access_token),
+      hasRefreshToken: true,
+      hasIdToken: true
     });
-  } catch (error) {
-    await options.storeProvider.deleteSessionsByLogicalSessionId({
-      logicalSessionId: createdSession.logicalSessionId ?? createdSession.sessionId
+    const claims = await verifyIdToken(metadata, tokenResponse.id_token, transaction.nonce, options);
+    const subject = getRequiredString(
+      claims.sub,
+      "OIDC id_token is missing sub.",
+      "OIDC_VAULT_INVALID_ID_TOKEN",
+      502
+    );
+    const userInfo = shouldFetchUserInfo(options, metadata) && isString(tokenResponse.access_token) ? await fetchUserInfo(metadata, tokenResponse.access_token, options) : void 0;
+    if (userInfo !== void 0) {
+      assertUserInfoSubject(userInfo, subject);
+      await callHook("callback", options.hooks?.onUserInfo, req, res, void 0, { subject });
+    }
+    const now = getNow(options);
+    const sessionExpiresAt = options.sessionTtlMs === void 0 ? void 0 : computeExpiresAt(now, options.sessionTtlMs, "sessionTtlMs");
+    const exchangeExpiresAt = computeExpiresAt(
+      now,
+      options.exchangeCodeTtlMs ?? DEFAULT_EXCHANGE_CODE_TTL_MS,
+      "exchangeCodeTtlMs"
+    );
+    const sessionId = createOpaqueId("sess");
+    const provider = Object.freeze({
+      issuer: metadata.issuer ?? (typeof claims.iss === "string" ? claims.iss : void 0),
+      clientId: metadata.clientId
     });
+    const sessionBinding = transaction.deviceBinding;
+    const recognition = transaction.fingerprintRecognition;
+    const session = {
+      sessionId,
+      logicalSessionId: sessionId,
+      subject,
+      providerSessionId: typeof claims.sid === "string" ? claims.sid : void 0,
+      provider: { ...provider },
+      ...sessionBinding === void 0 ? {} : { deviceBinding: { ...sessionBinding } },
+      refreshToken: tokenResponse.refresh_token,
+      idToken: tokenResponse.id_token,
+      accessToken: isString(tokenResponse.access_token) ? tokenResponse.access_token : void 0,
+      scope: typeof tokenResponse.scope === "string" ? tokenResponse.scope : metadata.scopes,
+      createdAt: now,
+      updatedAt: now,
+      ...sessionExpiresAt === void 0 ? {} : { expiresAt: sessionExpiresAt },
+      user: copyVaultUserProfile(mergeUserProfile(subject, claims, userInfo)),
+      metadata: withFingerprintRecognitionMetadata({ tokenType: tokenResponse.token_type }, recognition)
+    };
+    await callHook("callback", options.hooks?.onBeforeSessionCreate, req, res, session, { subject });
+    if (sessionExpiresAt !== void 0) {
+      session.expiresAt = isUsableEpochMs(session.expiresAt) ? Math.min(session.expiresAt, sessionExpiresAt) : sessionExpiresAt;
+    }
+    const guarded = transaction.browserBindingHash !== void 0;
+    const restoredBinding = guarded ? withSessionDeviceBinding(
+      {
+        ...copySessionApplicationFields(session),
+        sessionId,
+        logicalSessionId: sessionId,
+        provider: { ...provider }
+      },
+      sessionBinding
+    ) : withSessionDeviceBinding(session, sessionBinding);
+    const restored = {
+      ...restoredBinding,
+      user: copyVaultUserProfile(restoredBinding.user),
+      metadata: withFingerprintRecognitionMetadata(restoredBinding.metadata, recognition)
+    };
+    const createdSession = await store.createSession(restored);
+    const createdSessionId = guarded ? sessionId : createdSession.sessionId;
+    const logicalSessionId = guarded ? sessionId : createdSession.logicalSessionId ?? createdSessionId;
+    const exchangeCode = createOpaqueId("code");
+    try {
+      const returnedBinding = snapshotDpopBinding(createdSession.deviceBinding);
+      if (returnedBinding?.jkt !== sessionBinding?.jkt) throw invalidAuthorizationState();
+      if (!fingerprintRecognitionMatches(snapshotFingerprintRecognition(createdSession.metadata), recognition))
+        throw invalidAuthorizationState();
+      if (guarded && (createdSession.sessionId !== sessionId || createdSession.logicalSessionId !== sessionId || createdSession.provider?.issuer !== provider.issuer || createdSession.provider?.clientId !== provider.clientId)) {
+        throw invalidAuthorizationState();
+      }
+      await store.createExchangeCode({
+        code: exchangeCode,
+        sessionId: createdSessionId,
+        returnTo: transaction.returnTo,
+        ...sessionBinding === void 0 ? {} : { deviceBinding: sessionBinding },
+        ...transaction.browserBindingHash === void 0 ? {} : { browserBindingHash: transaction.browserBindingHash },
+        createdAt: now,
+        expiresAt: exchangeExpiresAt
+      });
+    } catch (error) {
+      await store.deleteSessionsByLogicalSessionId({ logicalSessionId });
+      throw error;
+    }
+    await callPostCommitHook(
+      "callback",
+      options,
+      options.hooks?.onSessionCreated,
+      req,
+      res,
+      withSessionDeviceBinding(copyVaultSession(createdSession), sessionBinding),
+      { subject }
+    );
+    if (cookieSecret !== void 0) {
+      setTransactionCookie(res, cookie, cookieSecret, exchangeExpiresAt, getNow(options));
+    }
+    applyCredentialResponseCachePolicy(res);
+    res.redirect(302, appendCodeToRedirectUri(frontendDestination, exchangeCode));
+  } catch (error) {
+    if (cookieSecret !== void 0) clearTransactionCookie(res, cookie);
     throw error;
   }
-  await callPostCommitHook("callback", options, options.hooks?.onSessionCreated, req, res, createdSession, {
-    subject
-  });
-  res.redirect(302, appendCodeToRedirectUri(frontendDestination, exchangeCode));
 });
-var createExchangeHandler = (options, config) => createAsyncHandler("exchange", options, async (req, res) => {
-  const body = getBody(req);
-  const code = getRequiredString(body.code, "Exchange request is missing code.", "OIDC_VAULT_MISSING_EXCHANGE_CODE");
-  const exchangeRecord = await options.storeProvider.consumeExchangeCode(code);
-  if (!exchangeRecord) {
-    throw new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_EXCHANGE_CODE", "Exchange code is invalid or expired.");
+var assertLoginInitiationRequest = (req, options, trustedOrigins) => {
+  assertTrustedOrigin(req, options, trustedOrigins, "login");
+  if (!req.is("application/json")) {
+    throw new OidcVaultHttpError(
+      415,
+      "OIDC_VAULT_UNSUPPORTED_REQUEST_BODY_TYPE",
+      "Login initiation requires a JSON request body."
+    );
   }
-  const session = await options.storeProvider.getSession(exchangeRecord.sessionId);
-  if (!session) {
-    throw new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_SESSION", "Session is missing or expired.");
+};
+var copySessionApplicationFields = (session) => {
+  const result = {};
+  for (const key of Object.keys(session)) {
+    if (["deviceBinding", "browserBindingHash", "sessionId", "logicalSessionId", "provider"].includes(key)) continue;
+    Object.defineProperty(result, key, {
+      value: Reflect.get(session, key),
+      enumerable: true,
+      configurable: true,
+      writable: true
+    });
   }
-  assertSessionIdentity(session, config);
-  let issuedToken;
+  return result;
+};
+var createExchangeHandler = (options, config, trustedOrigins, proofVerifier) => createAsyncHandler("exchange", options, async (req, res) => {
+  const capturedProof = proofVerifier === void 0 ? void 0 : captureVaultRouteProof(req);
+  const capturedRecognition = captureFingerprintRecognition(req, options.fingerprintRecognition);
+  const assertExchangeOrigin = captureTrustedOriginGuard(req, options, trustedOrigins, "exchange");
+  const cookieHeader = req.headers.cookie;
+  const body = getBody(req);
+  const code = getRequiredString(body.code, "Exchange request is missing code.", "OIDC_VAULT_MISSING_EXCHANGE_CODE");
+  const store = options.storeProvider;
+  const canPreflight = typeof store.getExchangeCode === "function";
+  if ((proofVerifier !== void 0 || options.fingerprintRecognition !== void 0) && (!canPreflight || typeof store.consumeExchangeCodeIfMatches !== "function")) {
+    throw new TypeError("Device-bound exchange requires guarded store reads and atomic consumption.");
+  }
+  const rawCode = canPreflight ? await store.getExchangeCode(code) : await store.consumeExchangeCode(code);
+  if (!rawCode) throw invalidExchangeCode();
+  const record = snapshotVaultExchangeCode(rawCode, code, getNow(options));
+  const guarded = record.browserBindingHash !== void 0;
+  if (guarded) assertExchangeOrigin();
+  assertDeviceBindingPolicy(options.deviceBinding, record.deviceBinding);
+  const rawSession = await store.getSession(record.sessionId);
+  if (!rawSession) throw invalidVaultSession();
+  const session = snapshotVaultSession(rawSession, record.sessionId, getNow(options));
+  assertDeviceBindingPolicy(options.deviceBinding, session.deviceBinding);
+  assertVaultExchangeSessionBinding(record, session);
+  const protectedExchange = proofVerifier !== void 0 || options.fingerprintRecognition !== void 0 || guarded;
+  if (protectedExchange && typeof store.consumeExchangeCodeIfMatches !== "function") {
+    throw new TypeError("Guarded exchange requires storeProvider.consumeExchangeCodeIfMatches.");
+  }
+  if (protectedExchange) assertVaultSessionIdentity(session, config);
+  const cookieSecret = authenticateTransactionCookie(cookieHeader, options.transactionCookie, record.match);
+  const recognition = options.fingerprintRecognition === void 0 ? void 0 : snapshotFingerprintRecognition(session.metadata);
+  assertFingerprintRecognition(options.fingerprintRecognition, recognition, capturedRecognition);
+  const verifiedBinding = proofVerifier === void 0 ? void 0 : await proofVerifier.verify(capturedProof, session.deviceBinding);
+  if (canPreflight) {
+    const consumed = protectedExchange ? await store.consumeExchangeCodeIfMatches({
+      code,
+      expectedSessionId: record.sessionId,
+      match: record.match
+    }) : await store.consumeExchangeCode(code);
+    if (!consumed) throw invalidExchangeCode();
+    const returned = snapshotVaultExchangeCode(consumed, code, getNow(options));
+    assertVaultExchangeCodeMatches(returned, record);
+    const returnedSession = await store.getSession(record.sessionId);
+    if (!returnedSession) throw invalidVaultSession();
+    const checkedSession = snapshotVaultSession(returnedSession, record.sessionId, getNow(options));
+    assertVaultSessionIdentity(checkedSession, config);
+    assertVaultExchangeSessionBinding(returned, checkedSession);
+    assertVaultSessionMatches(checkedSession, session);
+    if (options.fingerprintRecognition !== void 0 && !fingerprintRecognitionMatches(snapshotFingerprintRecognition(checkedSession.metadata), recognition))
+      throw invalidVaultSession();
+  }
+  assertVaultSessionIdentity(session, config);
   try {
-    issuedToken = await withIssuedToken(req, res, options, session);
+    const issuedToken = await withIssuedToken(req, res, options, session, verifiedBinding);
+    if (usesCookieTransport(options)) setSessionCookie(res, options, session.sessionId);
+    if (cookieSecret !== void 0) clearTransactionCookie(res, options.transactionCookie);
+    applyCredentialResponseCachePolicy(res);
+    res.status(200).json(createExchangeResponse(options, session, issuedToken));
   } catch (error) {
-    await options.storeProvider.deleteSessionsByLogicalSessionId({
-      logicalSessionId: session.logicalSessionId ?? session.sessionId
-    });
-    if (usesCookieTransport(options)) {
-      clearSessionCookie(res, options);
-    }
+    if (cookieSecret !== void 0) clearTransactionCookie(res, options.transactionCookie);
     throw error;
   }
-  if (usesCookieTransport(options)) {
-    setSessionCookie(res, options, session.sessionId);
-  }
-  const response = createExchangeResponse(options, session, issuedToken);
-  res.status(200).json(response);
 });
-var createRefreshHandler = (options, config, trustedOrigins) => createAsyncHandler("refresh", options, async (req, res) => {
+var createRefreshHandler = (options, config, trustedOrigins, proofVerifier) => createAsyncHandler("refresh", options, async (req, res) => {
+  const capturedRecognition = captureFingerprintRecognition(req, options.fingerprintRecognition);
   assertTrustedOrigin(req, options, trustedOrigins, "refresh");
+  const capturedProof = proofVerifier === void 0 ? void 0 : captureVaultRouteProof(req);
   const sessionId = getSessionIdFromRequest(req, options, "refresh");
-  const currentSession = await options.storeProvider.getSession(sessionId);
-  if (!currentSession) {
+  const currentRecord = await options.storeProvider.getSession(sessionId);
+  if (!currentRecord) {
     if (usesCookieTransport(options)) {
       clearSessionCookie(res, options);
     }
     throw new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_SESSION", "Session is missing or expired.");
   }
-  assertSessionIdentity(currentSession, config);
+  const currentSession = snapshotVaultSession(currentRecord, sessionId, getNow(options));
+  assertVaultSessionIdentity(currentSession, config);
+  assertDeviceBindingPolicy(options.deviceBinding, currentSession.deviceBinding);
+  const recognition = options.fingerprintRecognition === void 0 ? void 0 : snapshotFingerprintRecognition(currentSession.metadata);
+  assertFingerprintRecognition(options.fingerprintRecognition, recognition, capturedRecognition);
+  const verifiedBinding = proofVerifier === void 0 ? void 0 : await proofVerifier.verify(capturedProof, currentSession.deviceBinding);
   const metadata = await resolveProviderMetadata(config, options);
+  if (proofVerifier !== void 0 || options.fingerprintRecognition !== void 0) {
+    const latest = await options.storeProvider.getSession(sessionId);
+    if (!latest) throw invalidVaultSession();
+    const latestSession = snapshotVaultSession(latest, sessionId, getNow(options));
+    assertVaultSessionMatches(latestSession, currentSession);
+    if (options.fingerprintRecognition !== void 0 && !fingerprintRecognitionMatches(snapshotFingerprintRecognition(latestSession.metadata), recognition))
+      throw invalidVaultSession();
+  }
   const tokenResponse = await requestToken(
     metadata,
     {
@@ -1716,7 +3220,7 @@ var createRefreshHandler = (options, config, trustedOrigins) => createAsyncHandl
   const now = getNow(options);
   const logicalSessionId = currentSession.logicalSessionId ?? currentSession.sessionId;
   const nextSession = {
-    ...currentSession,
+    ...copyVaultSession(currentSession),
     sessionId: createOpaqueId("sess"),
     logicalSessionId,
     subject,
@@ -1727,13 +3231,14 @@ var createRefreshHandler = (options, config, trustedOrigins) => createAsyncHandl
     scope: typeof tokenResponse.scope === "string" ? tokenResponse.scope : currentSession.scope,
     expiresAt: currentSession.expiresAt,
     updatedAt: now,
-    user: composeRefreshedUserProfile(subject, currentSession.user, freshClaims, userInfo)
+    user: copyVaultUserProfile(composeRefreshedUserProfile(subject, currentSession.user, freshClaims, userInfo))
   };
-  let rotatedSession;
+  const expectedSession = snapshotVaultSession(nextSession, nextSession.sessionId, getNow(options));
+  let rotatedRecord;
   try {
-    rotatedSession = await options.storeProvider.rotateSession({
+    rotatedRecord = await options.storeProvider.rotateSession({
       sessionId: currentSession.sessionId,
-      nextSession
+      nextSession: copyVaultSession(expectedSession)
     });
   } catch (error) {
     if (isStoreConflictError(error)) {
@@ -1744,51 +3249,109 @@ var createRefreshHandler = (options, config, trustedOrigins) => createAsyncHandl
     }
     throw error;
   }
-  let issuedToken;
   try {
-    issuedToken = await withIssuedToken(req, res, options, rotatedSession);
+    const returnedSession = snapshotVaultSession(rotatedRecord, expectedSession.sessionId, getNow(options));
+    assertVaultSessionIdentity(returnedSession, config);
+    assertVaultSessionMatches(returnedSession, expectedSession);
+    if (options.fingerprintRecognition !== void 0 && !fingerprintRecognitionMatches(snapshotFingerprintRecognition(returnedSession.metadata), recognition))
+      throw invalidVaultSession();
   } catch (error) {
-    await options.storeProvider.deleteSessionsByLogicalSessionId({
-      logicalSessionId: rotatedSession.logicalSessionId ?? rotatedSession.sessionId
-    });
-    if (usesCookieTransport(options)) {
-      clearSessionCookie(res, options);
-    }
+    await options.storeProvider.deleteSessionsByLogicalSessionId({ logicalSessionId });
+    if (usesCookieTransport(options)) clearSessionCookie(res, options);
     throw error;
   }
-  await callPostCommitHook("refresh", options, options.hooks?.onSessionRefreshed, req, res, rotatedSession, {
-    previousSessionId: currentSession.sessionId
-  });
+  const rotatedSession = expectedSession;
+  const issuedToken = await withIssuedToken(req, res, options, rotatedSession, verifiedBinding);
+  await callPostCommitHook(
+    "refresh",
+    options,
+    options.hooks?.onSessionRefreshed,
+    req,
+    res,
+    copyVaultSession(rotatedSession),
+    {
+      previousSessionId: currentSession.sessionId
+    }
+  );
   if (usesCookieTransport(options)) {
     setSessionCookie(res, options, rotatedSession.sessionId);
   }
   const response = createExchangeResponse(options, rotatedSession, issuedToken);
+  applyCredentialResponseCachePolicy(res);
   res.status(200).json(response);
 });
-var createLogoutHandler = (options, config, trustedOrigins) => createAsyncHandler("logout", options, async (req, res) => {
+var createLogoutHandler = (options, config, trustedOrigins, proofVerifier) => createAsyncHandler("logout", options, async (req, res) => {
   assertTrustedOrigin(req, options, trustedOrigins, "logout");
+  const capturedProof = proofVerifier === void 0 ? void 0 : captureVaultRouteProof(req);
   const body = getBody(req);
   const sessionId = getSessionIdFromRequest(req, options, "logout");
   const redirect = body.redirect === true;
-  const session = await options.storeProvider.getSession(sessionId);
-  if (!session) {
-    await options.storeProvider.deleteSession(sessionId);
-    if (usesCookieTransport(options)) {
-      clearSessionCookie(res, options);
-    }
+  const store = options.storeProvider;
+  const hasContext = typeof store.getSessionRevocationContext === "function";
+  if (proofVerifier !== void 0 && !hasContext) {
+    throw new TypeError("Device-bound logout requires storeProvider.getSessionRevocationContext.");
+  }
+  const rawContext = hasContext ? await store.getSessionRevocationContext(sessionId) : void 0;
+  const context = rawContext ? snapshotVaultRevocationContext(rawContext) : void 0;
+  const rawSession = await store.getSession(sessionId);
+  const session = rawSession ? snapshotVaultSession(rawSession, sessionId, getNow(options)) : void 0;
+  const finishLocalLogout = () => {
+    if (usesCookieTransport(options)) clearSessionCookie(res, options);
+    applyCredentialResponseCachePolicy(res);
     res.status(200).json({ loggedOut: true });
+  };
+  if (hasContext && context === void 0) {
+    if (session !== void 0) {
+      assertDeviceBindingPolicy(options.deviceBinding, session.deviceBinding);
+      throw invalidVaultSession();
+    }
+    finishLocalLogout();
     return;
   }
-  assertSessionIdentity(session, config);
-  await callHook("logout", options.hooks?.onBeforeLogout, req, res, session, void 0);
-  await options.storeProvider.deleteSessionsByLogicalSessionId({
-    logicalSessionId: session.logicalSessionId ?? session.sessionId
-  });
+  const authority = context ?? (session === void 0 ? void 0 : snapshotVaultRevocationContext({
+    logicalSessionId: session.logicalSessionId ?? session.sessionId,
+    provider: session.provider,
+    deviceBinding: session.deviceBinding
+  }));
+  if (authority === void 0) {
+    await store.deleteSession(sessionId);
+    finishLocalLogout();
+    return;
+  }
+  assertVaultSessionIdentity(authority, config);
+  assertDeviceBindingPolicy(options.deviceBinding, authority.deviceBinding);
+  if (session !== void 0)
+    assertVaultRevocationContextMatches(
+      snapshotVaultRevocationContext({
+        logicalSessionId: session.logicalSessionId ?? session.sessionId,
+        provider: session.provider,
+        deviceBinding: session.deviceBinding
+      }),
+      authority
+    );
+  if (proofVerifier !== void 0) await proofVerifier.verify(capturedProof, authority.deviceBinding);
+  if (hasContext) {
+    const latest = await store.getSessionRevocationContext(sessionId);
+    if (!latest) {
+      finishLocalLogout();
+      return;
+    }
+    assertVaultRevocationContextMatches(snapshotVaultRevocationContext(latest), authority);
+  }
+  if (session !== void 0)
+    await callHook("logout", options.hooks?.onBeforeLogout, req, res, copyVaultSession(session));
+  await store.deleteSessionsByLogicalSessionId({ logicalSessionId: authority.logicalSessionId });
   if (usesCookieTransport(options)) {
     clearSessionCookie(res, options);
   }
+  if (session === void 0) {
+    applyCredentialResponseCachePolicy(res);
+    res.status(200).json({ loggedOut: true });
+    return;
+  }
   if (!redirect) {
-    await callPostCommitHook("logout", options, options.hooks?.onLogout, req, res, session);
+    await callPostCommitHook("logout", options, options.hooks?.onLogout, req, res, copyVaultSession(session));
+    applyCredentialResponseCachePolicy(res);
     res.status(200).json({ loggedOut: true });
     return;
   }
@@ -1799,13 +3362,14 @@ var createLogoutHandler = (options, config, trustedOrigins) => createAsyncHandle
   } catch (error) {
     try {
       await options.hooks?.onError?.({
-        ...createHookContext("logout", req, res, session),
+        ...createHookContext("logout", req, res, copyVaultSession(session)),
         error
       });
     } catch {
     }
   }
-  await callPostCommitHook("logout", options, options.hooks?.onLogout, req, res, session);
+  await callPostCommitHook("logout", options, options.hooks?.onLogout, req, res, copyVaultSession(session));
+  applyCredentialResponseCachePolicy(res);
   if (redirect && upstreamLogoutUrl) {
     res.redirect(302, upstreamLogoutUrl);
     return;
@@ -1863,11 +3427,18 @@ var createBackchannelLogoutHandler = (options, config) => createAsyncHandler("ba
   });
 });
 function registerRoutes(router, options, config, trustedOrigins, backendOrigin, basePath) {
+  const proofVerifier = createVaultRouteProofVerifier(options, config, backendOrigin, basePath);
   router.get(OIDC_VAULT_ROUTE_PATHS.login, createLoginHandler(options, config, backendOrigin, basePath));
+  if (proofVerifier !== void 0 || options.fingerprintRecognition !== void 0) {
+    router.post(
+      OIDC_VAULT_ROUTE_PATHS.login,
+      createLoginInitiationHandler(options, config, trustedOrigins, backendOrigin, basePath, proofVerifier)
+    );
+  }
   router.get(OIDC_VAULT_ROUTE_PATHS.callback, createCallbackHandler(options, config, backendOrigin, basePath));
-  router.post(OIDC_VAULT_ROUTE_PATHS.exchange, createExchangeHandler(options, config));
-  router.post(OIDC_VAULT_ROUTE_PATHS.refresh, createRefreshHandler(options, config, trustedOrigins));
-  router.post(OIDC_VAULT_ROUTE_PATHS.logout, createLogoutHandler(options, config, trustedOrigins));
+  router.post(OIDC_VAULT_ROUTE_PATHS.exchange, createExchangeHandler(options, config, trustedOrigins, proofVerifier));
+  router.post(OIDC_VAULT_ROUTE_PATHS.refresh, createRefreshHandler(options, config, trustedOrigins, proofVerifier));
+  router.post(OIDC_VAULT_ROUTE_PATHS.logout, createLogoutHandler(options, config, trustedOrigins, proofVerifier));
   router.post(OIDC_VAULT_ROUTE_PATHS["backchannel-logout"], createBackchannelLogoutHandler(options, config));
 }
 function createOidcVaultMiddleware(options) {
@@ -1880,6 +3451,15 @@ function createOidcVaultMiddleware(options) {
     applyCredentialResponseCachePolicy(res);
     next();
   });
+  if (resolvedOptions.deviceBinding !== void 0 || resolvedOptions.fingerprintRecognition !== void 0) {
+    baseRouter.post(
+      OIDC_VAULT_ROUTE_PATHS.login,
+      createAsyncHandler("login", resolvedOptions, async (req, res, next) => {
+        assertLoginInitiationRequest(req, resolvedOptions, trustedOrigins);
+        next();
+      })
+    );
+  }
   baseRouter.use(express.json({ limit: requestBodyLimit }));
   baseRouter.use(
     express.urlencoded({
@@ -1901,6 +3481,7 @@ export {
   DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT,
   OIDC_VAULT_ROUTE_PATHS,
   OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT,
+  OidcVaultDpopReplayCapacityError,
   OidcVaultStoreConflictError,
   createOidcVaultAccessTokenMiddleware,
   createOidcVaultJwtAccessTokenValidator,