@web-ts-toolkit/express-oidc-vault 0.50.0 → 0.52.0

package/index.d.mts

@@ -1,6 +1,8 @@
 import { Request, Response, RequestHandler, Router } from 'express';
 import { KeyObject } from 'node:crypto';
 import { JWK } from 'jose';
+import { OidcVaultUserProfile, OidcVaultTokenIssueResult, OidcVaultSessionTransport } from './wire.mjs';
+export { OidcVaultExchangeResult, OidcVaultLoginInitiationInput, OidcVaultLoginInitiationResult, OidcVaultLogoutResult } from './wire.mjs';
 
 type OidcVaultRouteName = 'login' | 'callback' | 'exchange' | 'refresh' | 'logout' | 'backchannel-logout';
 /** Enabling the option defaults to `optional`; omitting it keeps bearer behavior. */
@@ -41,6 +43,8 @@ interface OidcVaultDpopNonceOptions {
  * Signature verification precedes claims; strict iat validity is
  * nowSeconds - age - skew < iat <= nowSeconds + skew. APIs additionally match
  * original verified cnf.jkt and SHA-256 ath of the ASCII access token.
+ * Independent failure overrides below run their checks and log to console.warn
+ * before continuing. Environment defaults are captured at middleware construction.
  */
 interface OidcVaultDpopProofOptions {
     /** Nonempty asymmetric allowlist; default `['ES256']` (P-256). RSA proofs require 2048–4096 bits. */
@@ -51,6 +55,24 @@ interface OidcVaultDpopProofOptions {
     clockSkewSeconds?: number;
     /** Off by default. Challenges are at most 512 bytes; retry once with a fresh proof, never reuse its JTI. */
     nonce?: false | OidcVaultDpopNonceOptions;
+    /**
+     * Step 6: log failed method/normalized URL checks and continue.
+     * Defaults to OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE === 'true'; otherwise false.
+     * An explicit boolean overrides the environment for this vault/API policy.
+     */
+    ignoreTargetFailure?: boolean;
+    /**
+     * Step 7: log failed proof age/skew checks and continue, retaining replay tracking
+     * with a bounded expiry from the current time. A failed clock uses Date.now.
+     * Defaults to OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE === 'true'; otherwise false.
+     */
+    ignoreFreshnessFailure?: boolean;
+    /**
+     * Step 8: attempt atomic replay reservation, log duplicate/admission/provider
+     * failures, and continue. Successful reservations retain their normal lifetime.
+     * Defaults to OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE === 'true'; otherwise false.
+     */
+    ignoreReplayFailure?: boolean;
 }
 /**
  * Opt-in sender constraint. `optional` permits legacy unbound records without
@@ -94,13 +116,6 @@ interface OidcVaultApiDeviceBindingOptions extends OidcVaultDeviceBindingOptions
     /** Epoch-millisecond clock for proof age/nonce/replay; default Date.now. Shared instances need synchronized clocks. */
     now?: () => number;
 }
-interface OidcVaultUserProfile {
-    sub: string;
-    email?: string;
-    name?: string;
-    preferredUsername?: string;
-    [key: string]: unknown;
-}
 /**
  * Stored session identity. Exchange, refresh, and logout compare each defined
  * field verbatim against resolved middleware config before use. Opt-in/guarded
@@ -273,10 +288,11 @@ interface OidcVaultDpopReplayStore {
     /**
      * Reserve once through expiry. Duplicate/invalid/expired input returns false
      * without extending expiry or allocating state. Capacity/provider failures
-     * throw; callers must fail closed, never evict live reservations. Built-ins
+     * throw; callers fail closed by default, never evict live reservations. Built-ins
      * default to 100000 entries per shared namespace. Expired entries awaiting
      * bounded cleanup may conservatively occupy capacity. Duplicate detection
      * precedes capacity rejection; capacity throws `OidcVaultDpopReplayCapacityError`.
+     * A proof policy with ignoreReplayFailure logs a failed admission and continues.
      */
     reserveDpopProof(input: ReserveDpopProofInput): Promise<boolean>;
 }
@@ -494,19 +510,6 @@ interface IssueTokenInput {
      */
     deviceBinding?: Readonly<OidcVaultVerifiedDpopBinding>;
 }
-/**
- * Local application credentials returned by `OidcVaultTokenIssuer.issue`.
- * Runtime validation copies only these fields into a fresh result; additional
- * properties are ignored and cannot override the response's session ID/user.
- */
-interface OidcVaultTokenIssueResult {
-    /** Nonempty opaque token for unbound issuance; bound issuance requires a compact signed JWT with matching `cnf.jkt`. */
-    accessToken: string;
-    /** Token lifetime in seconds: a finite, nonnegative safe integer (zero is valid). */
-    expiresIn: number;
-    /** Exact `DPoP` is required when bound. Unbound permits only `Bearer` or omission; omitted/undefined stays absent in JSON. */
-    tokenType?: 'Bearer' | 'DPoP';
-}
 /**
  * Trusted application token issuer for exchange and refresh. Return a non-null,
  * non-array object satisfying `OidcVaultTokenIssueResult`; only its declared
@@ -533,7 +536,7 @@ interface OidcVaultAccessTokenValidationResult {
     /** Verified sender constraint. Legacy adapters may omit it only for genuinely unbound credentials. */
     confirmation?: OidcVaultAccessTokenConfirmation | null;
 }
-/** Canonical RFC 7638 SHA-256 thumbprint derived from verified token/introspection data, never from a proof alone. */
+/** Exact one-field confirmation: canonical RFC 7638 SHA-256 thumbprint from verified token/introspection data, never from a proof alone. */
 interface OidcVaultAccessTokenConfirmation {
     jkt: string;
 }
@@ -607,13 +610,18 @@ interface OidcVaultAccessTokenMiddlewareOptions {
 interface OidcVaultAuthenticatedRequest extends Request {
     auth?: OidcVaultAuthContext;
 }
-/** Local JWT verification options, independent of the asymmetric DPoP proof policy; captured at construction. */
+/**
+ * Local JWT verification options, independent of the asymmetric DPoP proof
+ * policy; captured at construction. JWTs with cnf require the supported exact
+ * jkt profile and a nonnegative safe-integer exp with safe milliseconds in both
+ * validator methods. Unbound JWTs retain JOSE's optional-exp behavior.
+ */
 interface OidcVaultJwtAccessTokenValidatorOptions {
     key: CryptoKey | KeyObject | JWK | Uint8Array;
     issuer?: string;
     audience?: string | string[];
     algorithms?: string[];
-    /** Verified cnf is snapshotted before this mapper; mapper-supplied confirmation/deviceBinding is ignored. */
+    /** JOSE verification and bound-JWT profile/expiry checks precede this mapper. Original cnf is snapshotted; mapper-supplied confirmation/deviceBinding is ignored. */
     mapClaims?(claims: Record<string, unknown>): OidcVaultAccessTokenValidationResult;
 }
 declare module 'express-serve-static-core' {
@@ -645,50 +653,10 @@ interface OidcVaultConfig {
     clientSecret?: string;
     scopes?: string;
 }
-interface OidcVaultLogoutResult {
-    /**
-     * Successful logout commits revocation before upstream work and clears the
-     * session cookie under cookie transport. Built-in live handles and unexpired
-     * aliases authenticate the surviving lineage's provider/original binding;
-     * wrong identity, missing/wrong/stale/replayed proof, or disabled acceptance
-     * of a bound lineage fails without deleting or clearing. No currently live
-     * target is idempotent success without deletion or proof reservation. Aliases
-     * grant revocation only, not refresh authentication or upstream redirects.
-     * Old custom bearer stores without revocation context retain legacy alias
-     * deletion behavior. Stateless application access tokens are not invalidated.
-     * Local-only logout (`redirect` unset or `false`) never contacts the provider.
-     * Redirected logout (`redirect: true`)
-     * treats the upstream end-session redirect as best-effort: when provider
-     * discovery fails or no `endSessionEndpoint` is available, the route still
-     * returns this local success. Discovery errors reach `onError` without
-     * undoing revocation or skipping the live session's `onLogout` notification.
-     */
-    loggedOut: true;
-}
 interface OidcVaultBackchannelLogoutResult {
     loggedOut: true;
     revokedSessions: number;
 }
-interface OidcVaultExchangeResult extends Partial<OidcVaultTokenIssueResult> {
-    /** Authoritative vault handle in body transport; omitted from cookie-transport JSON. */
-    sessionId?: string;
-    /** Session profile; extra token-issuer result properties cannot override it. */
-    user?: OidcVaultUserProfile;
-}
-/** JSON body for opt-in `POST <basePath>/login`; proof/key and recognition signals belong in their configured headers, not the body. */
-interface OidcVaultLoginInitiationInput {
-    /** Optional destination on the configured frontend origin. Query-string returnTo is ignored by POST login. */
-    returnTo?: string;
-}
-/**
- * Exact successful POST-login JSON. Navigate to this URL after storing a proof
- * key when DPoP is enabled. Use credentials: 'include' even with body session
- * transport: initiation sets a temporary HttpOnly transaction cookie.
- */
-interface OidcVaultLoginInitiationResult {
-    authorizationUrl: string;
-}
-type OidcVaultSessionTransport = 'body' | 'cookie';
 type OidcVaultCookieDeploymentMode = 'same-origin' | 'same-site' | 'cross-site';
 type OidcVaultCookieSameSite = 'lax' | 'strict' | 'none';
 /**
@@ -937,6 +905,10 @@ declare const OIDC_VAULT_ROUTE_PATHS: Record<OidcVaultRouteName, string>;
  * callbacks/validator methods, URLs, algorithms and secret bytes; the replay
  * store remains the shared atomic service. Responses carry no-store and fixed
  * errors; onError privately observes originals and cannot override failures.
+ * The independent OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE,
+ * OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE and OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE
+ * environment defaults are captured at construction; ignored failures log to
+ * console.warn. Explicit deviceBinding booleans override those defaults.
  */
 declare function createOidcVaultAccessTokenMiddleware(options: OidcVaultAccessTokenMiddlewareOptions): RequestHandler;
 
@@ -946,6 +918,10 @@ declare function createOidcVaultAccessTokenMiddleware(options: OidcVaultAccessTo
  * the sender constraint. The request-aware result always has confirmation
  * (null only for genuinely unbound JWTs). Legacy unbound results omit it;
  * bound results report it so binding-disabled vault middleware refuses downgrade.
+ * Bound JWTs additionally require canonical compact encoding and a nonnegative
+ * safe-integer exp with safe milliseconds, checked before mapClaims in both
+ * methods. JOSE verifies signature/expiry and configured issuer/audience first. Unbound
+ * JWTs retain JOSE's generic optional-exp contract.
  * Proof/target/ath/nonce/replay enforcement belongs to the API middleware.
  * Construction captures options and copies secret/JWK/allowlist containers.
  */
@@ -985,7 +961,11 @@ declare function normalizeOidcVaultBasePath(value?: string): string;
  * an enabled nonce secret is copied into private owned storage. Separate opt-in
  * `fingerprintRecognition` settings are detached/frozen; recognition enrolls
  * only at POST login and checks exchange/refresh before credential mutation.
+ * The independent OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE,
+ * OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE and OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE
+ * environment defaults are captured with the proof policy. Ignored failures
+ * log to console.warn; explicit deviceBinding booleans override those defaults.
  */
 declare function createOidcVaultMiddleware(options: OidcVaultOptions): Router;
 
-export { type AuthorizationTransaction, type AuthorizationTransactionInput, type ConsumeAuthorizationTransactionIfMatchesInput, type ConsumeBackchannelLogoutTokenJtiInput, type ConsumeExchangeCodeIfMatchesInput, DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS, DEFAULT_EXCHANGE_CODE_TTL_MS, DEFAULT_OIDC_SCOPES, DEFAULT_OIDC_VAULT_BASE_PATH, DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT, type DeleteSessionsByLogicalSessionIdInput, type DeleteSessionsByProviderSessionIdInput, type DeleteSessionsBySubjectInput, type ExchangeCodeRecord, type ExchangeCodeRecordInput, type IssueTokenInput, OIDC_VAULT_ROUTE_PATHS, OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT, type OidcVaultAccessTokenConfirmation, type OidcVaultAccessTokenMiddlewareErrorContext, type OidcVaultAccessTokenMiddlewareOptions, type OidcVaultAccessTokenRequestInput, type OidcVaultAccessTokenValidationResult, type OidcVaultAccessTokenValidator, type OidcVaultApiDeviceBindingOptions, type OidcVaultAuthContext, type OidcVaultAuthenticatedRequest, type OidcVaultBackchannelLogoutResult, type OidcVaultConfig, type OidcVaultConfigMode, type OidcVaultCookieDeploymentMode, type OidcVaultCookieOptions, type OidcVaultCookieSameSite, type OidcVaultDeviceBindingMode, type OidcVaultDeviceBindingOptions, type OidcVaultDeviceBindingStoreProvider, type OidcVaultDpopAlgorithm, type OidcVaultDpopBinding, type OidcVaultDpopNonceOptions, type OidcVaultDpopProofOptions, OidcVaultDpopReplayCapacityError, type OidcVaultDpopReplayStore, type OidcVaultEnv, type OidcVaultErrorContext, type OidcVaultExchangeResult, type OidcVaultFingerprintRecognitionOptions, type OidcVaultHookContext, type OidcVaultHooks, type OidcVaultJwtAccessTokenValidatorOptions, type OidcVaultLoginInitiationInput, type OidcVaultLoginInitiationResult, type OidcVaultLogoutResult, type OidcVaultOptions, type OidcVaultProviderMetadata, type OidcVaultRecordBindingMatch, type OidcVaultRequestAwareAccessTokenValidationResult, type OidcVaultRequestAwareAccessTokenValidator, type OidcVaultResolvedConfig, type OidcVaultRouteName, type OidcVaultSession, type OidcVaultSessionInput, type OidcVaultSessionRevocationContext, type OidcVaultSessionTransport, OidcVaultStoreConflictError, type OidcVaultStoreProvider, type OidcVaultTokenIssueResult, type OidcVaultTokenIssuer, type OidcVaultTransactionCookieOptions, type OidcVaultUserProfile, type OidcVaultVerifiedDpopBinding, type ReserveDpopProofInput, type RotateSessionInput, createOidcVaultAccessTokenMiddleware, createOidcVaultJwtAccessTokenValidator, createOidcVaultMiddleware, normalizeOidcVaultBasePath, resolveOidcVaultConfig, resolveOidcVaultConfigFromEnv };
+export { type AuthorizationTransaction, type AuthorizationTransactionInput, type ConsumeAuthorizationTransactionIfMatchesInput, type ConsumeBackchannelLogoutTokenJtiInput, type ConsumeExchangeCodeIfMatchesInput, DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS, DEFAULT_EXCHANGE_CODE_TTL_MS, DEFAULT_OIDC_SCOPES, DEFAULT_OIDC_VAULT_BASE_PATH, DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT, type DeleteSessionsByLogicalSessionIdInput, type DeleteSessionsByProviderSessionIdInput, type DeleteSessionsBySubjectInput, type ExchangeCodeRecord, type ExchangeCodeRecordInput, type IssueTokenInput, OIDC_VAULT_ROUTE_PATHS, OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT, type OidcVaultAccessTokenConfirmation, type OidcVaultAccessTokenMiddlewareErrorContext, type OidcVaultAccessTokenMiddlewareOptions, type OidcVaultAccessTokenRequestInput, type OidcVaultAccessTokenValidationResult, type OidcVaultAccessTokenValidator, type OidcVaultApiDeviceBindingOptions, type OidcVaultAuthContext, type OidcVaultAuthenticatedRequest, type OidcVaultBackchannelLogoutResult, type OidcVaultConfig, type OidcVaultConfigMode, type OidcVaultCookieDeploymentMode, type OidcVaultCookieOptions, type OidcVaultCookieSameSite, type OidcVaultDeviceBindingMode, type OidcVaultDeviceBindingOptions, type OidcVaultDeviceBindingStoreProvider, type OidcVaultDpopAlgorithm, type OidcVaultDpopBinding, type OidcVaultDpopNonceOptions, type OidcVaultDpopProofOptions, OidcVaultDpopReplayCapacityError, type OidcVaultDpopReplayStore, type OidcVaultEnv, type OidcVaultErrorContext, type OidcVaultFingerprintRecognitionOptions, type OidcVaultHookContext, type OidcVaultHooks, type OidcVaultJwtAccessTokenValidatorOptions, type OidcVaultOptions, type OidcVaultProviderMetadata, type OidcVaultRecordBindingMatch, type OidcVaultRequestAwareAccessTokenValidationResult, type OidcVaultRequestAwareAccessTokenValidator, type OidcVaultResolvedConfig, type OidcVaultRouteName, type OidcVaultSession, type OidcVaultSessionInput, type OidcVaultSessionRevocationContext, OidcVaultSessionTransport, OidcVaultStoreConflictError, type OidcVaultStoreProvider, OidcVaultTokenIssueResult, type OidcVaultTokenIssuer, type OidcVaultTransactionCookieOptions, OidcVaultUserProfile, type OidcVaultVerifiedDpopBinding, type ReserveDpopProofInput, type RotateSessionInput, createOidcVaultAccessTokenMiddleware, createOidcVaultJwtAccessTokenValidator, createOidcVaultMiddleware, normalizeOidcVaultBasePath, resolveOidcVaultConfig, resolveOidcVaultConfigFromEnv };

package/index.d.ts

@@ -1,6 +1,8 @@
 import { Request, Response, RequestHandler, Router } from 'express';
 import { KeyObject } from 'node:crypto';
 import { JWK } from 'jose';
+import { OidcVaultUserProfile, OidcVaultTokenIssueResult, OidcVaultSessionTransport } from './wire.js';
+export { OidcVaultExchangeResult, OidcVaultLoginInitiationInput, OidcVaultLoginInitiationResult, OidcVaultLogoutResult } from './wire.js';
 
 type OidcVaultRouteName = 'login' | 'callback' | 'exchange' | 'refresh' | 'logout' | 'backchannel-logout';
 /** Enabling the option defaults to `optional`; omitting it keeps bearer behavior. */
@@ -41,6 +43,8 @@ interface OidcVaultDpopNonceOptions {
  * Signature verification precedes claims; strict iat validity is
  * nowSeconds - age - skew < iat <= nowSeconds + skew. APIs additionally match
  * original verified cnf.jkt and SHA-256 ath of the ASCII access token.
+ * Independent failure overrides below run their checks and log to console.warn
+ * before continuing. Environment defaults are captured at middleware construction.
  */
 interface OidcVaultDpopProofOptions {
     /** Nonempty asymmetric allowlist; default `['ES256']` (P-256). RSA proofs require 2048–4096 bits. */
@@ -51,6 +55,24 @@ interface OidcVaultDpopProofOptions {
     clockSkewSeconds?: number;
     /** Off by default. Challenges are at most 512 bytes; retry once with a fresh proof, never reuse its JTI. */
     nonce?: false | OidcVaultDpopNonceOptions;
+    /**
+     * Step 6: log failed method/normalized URL checks and continue.
+     * Defaults to OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE === 'true'; otherwise false.
+     * An explicit boolean overrides the environment for this vault/API policy.
+     */
+    ignoreTargetFailure?: boolean;
+    /**
+     * Step 7: log failed proof age/skew checks and continue, retaining replay tracking
+     * with a bounded expiry from the current time. A failed clock uses Date.now.
+     * Defaults to OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE === 'true'; otherwise false.
+     */
+    ignoreFreshnessFailure?: boolean;
+    /**
+     * Step 8: attempt atomic replay reservation, log duplicate/admission/provider
+     * failures, and continue. Successful reservations retain their normal lifetime.
+     * Defaults to OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE === 'true'; otherwise false.
+     */
+    ignoreReplayFailure?: boolean;
 }
 /**
  * Opt-in sender constraint. `optional` permits legacy unbound records without
@@ -94,13 +116,6 @@ interface OidcVaultApiDeviceBindingOptions extends OidcVaultDeviceBindingOptions
     /** Epoch-millisecond clock for proof age/nonce/replay; default Date.now. Shared instances need synchronized clocks. */
     now?: () => number;
 }
-interface OidcVaultUserProfile {
-    sub: string;
-    email?: string;
-    name?: string;
-    preferredUsername?: string;
-    [key: string]: unknown;
-}
 /**
  * Stored session identity. Exchange, refresh, and logout compare each defined
  * field verbatim against resolved middleware config before use. Opt-in/guarded
@@ -273,10 +288,11 @@ interface OidcVaultDpopReplayStore {
     /**
      * Reserve once through expiry. Duplicate/invalid/expired input returns false
      * without extending expiry or allocating state. Capacity/provider failures
-     * throw; callers must fail closed, never evict live reservations. Built-ins
+     * throw; callers fail closed by default, never evict live reservations. Built-ins
      * default to 100000 entries per shared namespace. Expired entries awaiting
      * bounded cleanup may conservatively occupy capacity. Duplicate detection
      * precedes capacity rejection; capacity throws `OidcVaultDpopReplayCapacityError`.
+     * A proof policy with ignoreReplayFailure logs a failed admission and continues.
      */
     reserveDpopProof(input: ReserveDpopProofInput): Promise<boolean>;
 }
@@ -494,19 +510,6 @@ interface IssueTokenInput {
      */
     deviceBinding?: Readonly<OidcVaultVerifiedDpopBinding>;
 }
-/**
- * Local application credentials returned by `OidcVaultTokenIssuer.issue`.
- * Runtime validation copies only these fields into a fresh result; additional
- * properties are ignored and cannot override the response's session ID/user.
- */
-interface OidcVaultTokenIssueResult {
-    /** Nonempty opaque token for unbound issuance; bound issuance requires a compact signed JWT with matching `cnf.jkt`. */
-    accessToken: string;
-    /** Token lifetime in seconds: a finite, nonnegative safe integer (zero is valid). */
-    expiresIn: number;
-    /** Exact `DPoP` is required when bound. Unbound permits only `Bearer` or omission; omitted/undefined stays absent in JSON. */
-    tokenType?: 'Bearer' | 'DPoP';
-}
 /**
  * Trusted application token issuer for exchange and refresh. Return a non-null,
  * non-array object satisfying `OidcVaultTokenIssueResult`; only its declared
@@ -533,7 +536,7 @@ interface OidcVaultAccessTokenValidationResult {
     /** Verified sender constraint. Legacy adapters may omit it only for genuinely unbound credentials. */
     confirmation?: OidcVaultAccessTokenConfirmation | null;
 }
-/** Canonical RFC 7638 SHA-256 thumbprint derived from verified token/introspection data, never from a proof alone. */
+/** Exact one-field confirmation: canonical RFC 7638 SHA-256 thumbprint from verified token/introspection data, never from a proof alone. */
 interface OidcVaultAccessTokenConfirmation {
     jkt: string;
 }
@@ -607,13 +610,18 @@ interface OidcVaultAccessTokenMiddlewareOptions {
 interface OidcVaultAuthenticatedRequest extends Request {
     auth?: OidcVaultAuthContext;
 }
-/** Local JWT verification options, independent of the asymmetric DPoP proof policy; captured at construction. */
+/**
+ * Local JWT verification options, independent of the asymmetric DPoP proof
+ * policy; captured at construction. JWTs with cnf require the supported exact
+ * jkt profile and a nonnegative safe-integer exp with safe milliseconds in both
+ * validator methods. Unbound JWTs retain JOSE's optional-exp behavior.
+ */
 interface OidcVaultJwtAccessTokenValidatorOptions {
     key: CryptoKey | KeyObject | JWK | Uint8Array;
     issuer?: string;
     audience?: string | string[];
     algorithms?: string[];
-    /** Verified cnf is snapshotted before this mapper; mapper-supplied confirmation/deviceBinding is ignored. */
+    /** JOSE verification and bound-JWT profile/expiry checks precede this mapper. Original cnf is snapshotted; mapper-supplied confirmation/deviceBinding is ignored. */
     mapClaims?(claims: Record<string, unknown>): OidcVaultAccessTokenValidationResult;
 }
 declare module 'express-serve-static-core' {
@@ -645,50 +653,10 @@ interface OidcVaultConfig {
     clientSecret?: string;
     scopes?: string;
 }
-interface OidcVaultLogoutResult {
-    /**
-     * Successful logout commits revocation before upstream work and clears the
-     * session cookie under cookie transport. Built-in live handles and unexpired
-     * aliases authenticate the surviving lineage's provider/original binding;
-     * wrong identity, missing/wrong/stale/replayed proof, or disabled acceptance
-     * of a bound lineage fails without deleting or clearing. No currently live
-     * target is idempotent success without deletion or proof reservation. Aliases
-     * grant revocation only, not refresh authentication or upstream redirects.
-     * Old custom bearer stores without revocation context retain legacy alias
-     * deletion behavior. Stateless application access tokens are not invalidated.
-     * Local-only logout (`redirect` unset or `false`) never contacts the provider.
-     * Redirected logout (`redirect: true`)
-     * treats the upstream end-session redirect as best-effort: when provider
-     * discovery fails or no `endSessionEndpoint` is available, the route still
-     * returns this local success. Discovery errors reach `onError` without
-     * undoing revocation or skipping the live session's `onLogout` notification.
-     */
-    loggedOut: true;
-}
 interface OidcVaultBackchannelLogoutResult {
     loggedOut: true;
     revokedSessions: number;
 }
-interface OidcVaultExchangeResult extends Partial<OidcVaultTokenIssueResult> {
-    /** Authoritative vault handle in body transport; omitted from cookie-transport JSON. */
-    sessionId?: string;
-    /** Session profile; extra token-issuer result properties cannot override it. */
-    user?: OidcVaultUserProfile;
-}
-/** JSON body for opt-in `POST <basePath>/login`; proof/key and recognition signals belong in their configured headers, not the body. */
-interface OidcVaultLoginInitiationInput {
-    /** Optional destination on the configured frontend origin. Query-string returnTo is ignored by POST login. */
-    returnTo?: string;
-}
-/**
- * Exact successful POST-login JSON. Navigate to this URL after storing a proof
- * key when DPoP is enabled. Use credentials: 'include' even with body session
- * transport: initiation sets a temporary HttpOnly transaction cookie.
- */
-interface OidcVaultLoginInitiationResult {
-    authorizationUrl: string;
-}
-type OidcVaultSessionTransport = 'body' | 'cookie';
 type OidcVaultCookieDeploymentMode = 'same-origin' | 'same-site' | 'cross-site';
 type OidcVaultCookieSameSite = 'lax' | 'strict' | 'none';
 /**
@@ -937,6 +905,10 @@ declare const OIDC_VAULT_ROUTE_PATHS: Record<OidcVaultRouteName, string>;
  * callbacks/validator methods, URLs, algorithms and secret bytes; the replay
  * store remains the shared atomic service. Responses carry no-store and fixed
  * errors; onError privately observes originals and cannot override failures.
+ * The independent OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE,
+ * OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE and OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE
+ * environment defaults are captured at construction; ignored failures log to
+ * console.warn. Explicit deviceBinding booleans override those defaults.
  */
 declare function createOidcVaultAccessTokenMiddleware(options: OidcVaultAccessTokenMiddlewareOptions): RequestHandler;
 
@@ -946,6 +918,10 @@ declare function createOidcVaultAccessTokenMiddleware(options: OidcVaultAccessTo
  * the sender constraint. The request-aware result always has confirmation
  * (null only for genuinely unbound JWTs). Legacy unbound results omit it;
  * bound results report it so binding-disabled vault middleware refuses downgrade.
+ * Bound JWTs additionally require canonical compact encoding and a nonnegative
+ * safe-integer exp with safe milliseconds, checked before mapClaims in both
+ * methods. JOSE verifies signature/expiry and configured issuer/audience first. Unbound
+ * JWTs retain JOSE's generic optional-exp contract.
  * Proof/target/ath/nonce/replay enforcement belongs to the API middleware.
  * Construction captures options and copies secret/JWK/allowlist containers.
  */
@@ -985,7 +961,11 @@ declare function normalizeOidcVaultBasePath(value?: string): string;
  * an enabled nonce secret is copied into private owned storage. Separate opt-in
  * `fingerprintRecognition` settings are detached/frozen; recognition enrolls
  * only at POST login and checks exchange/refresh before credential mutation.
+ * The independent OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE,
+ * OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE and OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE
+ * environment defaults are captured with the proof policy. Ignored failures
+ * log to console.warn; explicit deviceBinding booleans override those defaults.
  */
 declare function createOidcVaultMiddleware(options: OidcVaultOptions): Router;
 
-export { type AuthorizationTransaction, type AuthorizationTransactionInput, type ConsumeAuthorizationTransactionIfMatchesInput, type ConsumeBackchannelLogoutTokenJtiInput, type ConsumeExchangeCodeIfMatchesInput, DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS, DEFAULT_EXCHANGE_CODE_TTL_MS, DEFAULT_OIDC_SCOPES, DEFAULT_OIDC_VAULT_BASE_PATH, DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT, type DeleteSessionsByLogicalSessionIdInput, type DeleteSessionsByProviderSessionIdInput, type DeleteSessionsBySubjectInput, type ExchangeCodeRecord, type ExchangeCodeRecordInput, type IssueTokenInput, OIDC_VAULT_ROUTE_PATHS, OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT, type OidcVaultAccessTokenConfirmation, type OidcVaultAccessTokenMiddlewareErrorContext, type OidcVaultAccessTokenMiddlewareOptions, type OidcVaultAccessTokenRequestInput, type OidcVaultAccessTokenValidationResult, type OidcVaultAccessTokenValidator, type OidcVaultApiDeviceBindingOptions, type OidcVaultAuthContext, type OidcVaultAuthenticatedRequest, type OidcVaultBackchannelLogoutResult, type OidcVaultConfig, type OidcVaultConfigMode, type OidcVaultCookieDeploymentMode, type OidcVaultCookieOptions, type OidcVaultCookieSameSite, type OidcVaultDeviceBindingMode, type OidcVaultDeviceBindingOptions, type OidcVaultDeviceBindingStoreProvider, type OidcVaultDpopAlgorithm, type OidcVaultDpopBinding, type OidcVaultDpopNonceOptions, type OidcVaultDpopProofOptions, OidcVaultDpopReplayCapacityError, type OidcVaultDpopReplayStore, type OidcVaultEnv, type OidcVaultErrorContext, type OidcVaultExchangeResult, type OidcVaultFingerprintRecognitionOptions, type OidcVaultHookContext, type OidcVaultHooks, type OidcVaultJwtAccessTokenValidatorOptions, type OidcVaultLoginInitiationInput, type OidcVaultLoginInitiationResult, type OidcVaultLogoutResult, type OidcVaultOptions, type OidcVaultProviderMetadata, type OidcVaultRecordBindingMatch, type OidcVaultRequestAwareAccessTokenValidationResult, type OidcVaultRequestAwareAccessTokenValidator, type OidcVaultResolvedConfig, type OidcVaultRouteName, type OidcVaultSession, type OidcVaultSessionInput, type OidcVaultSessionRevocationContext, type OidcVaultSessionTransport, OidcVaultStoreConflictError, type OidcVaultStoreProvider, type OidcVaultTokenIssueResult, type OidcVaultTokenIssuer, type OidcVaultTransactionCookieOptions, type OidcVaultUserProfile, type OidcVaultVerifiedDpopBinding, type ReserveDpopProofInput, type RotateSessionInput, createOidcVaultAccessTokenMiddleware, createOidcVaultJwtAccessTokenValidator, createOidcVaultMiddleware, normalizeOidcVaultBasePath, resolveOidcVaultConfig, resolveOidcVaultConfigFromEnv };
+export { type AuthorizationTransaction, type AuthorizationTransactionInput, type ConsumeAuthorizationTransactionIfMatchesInput, type ConsumeBackchannelLogoutTokenJtiInput, type ConsumeExchangeCodeIfMatchesInput, DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS, DEFAULT_EXCHANGE_CODE_TTL_MS, DEFAULT_OIDC_SCOPES, DEFAULT_OIDC_VAULT_BASE_PATH, DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT, type DeleteSessionsByLogicalSessionIdInput, type DeleteSessionsByProviderSessionIdInput, type DeleteSessionsBySubjectInput, type ExchangeCodeRecord, type ExchangeCodeRecordInput, type IssueTokenInput, OIDC_VAULT_ROUTE_PATHS, OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT, type OidcVaultAccessTokenConfirmation, type OidcVaultAccessTokenMiddlewareErrorContext, type OidcVaultAccessTokenMiddlewareOptions, type OidcVaultAccessTokenRequestInput, type OidcVaultAccessTokenValidationResult, type OidcVaultAccessTokenValidator, type OidcVaultApiDeviceBindingOptions, type OidcVaultAuthContext, type OidcVaultAuthenticatedRequest, type OidcVaultBackchannelLogoutResult, type OidcVaultConfig, type OidcVaultConfigMode, type OidcVaultCookieDeploymentMode, type OidcVaultCookieOptions, type OidcVaultCookieSameSite, type OidcVaultDeviceBindingMode, type OidcVaultDeviceBindingOptions, type OidcVaultDeviceBindingStoreProvider, type OidcVaultDpopAlgorithm, type OidcVaultDpopBinding, type OidcVaultDpopNonceOptions, type OidcVaultDpopProofOptions, OidcVaultDpopReplayCapacityError, type OidcVaultDpopReplayStore, type OidcVaultEnv, type OidcVaultErrorContext, type OidcVaultFingerprintRecognitionOptions, type OidcVaultHookContext, type OidcVaultHooks, type OidcVaultJwtAccessTokenValidatorOptions, type OidcVaultOptions, type OidcVaultProviderMetadata, type OidcVaultRecordBindingMatch, type OidcVaultRequestAwareAccessTokenValidationResult, type OidcVaultRequestAwareAccessTokenValidator, type OidcVaultResolvedConfig, type OidcVaultRouteName, type OidcVaultSession, type OidcVaultSessionInput, type OidcVaultSessionRevocationContext, OidcVaultSessionTransport, OidcVaultStoreConflictError, type OidcVaultStoreProvider, OidcVaultTokenIssueResult, type OidcVaultTokenIssuer, type OidcVaultTransactionCookieOptions, OidcVaultUserProfile, type OidcVaultVerifiedDpopBinding, type ReserveDpopProofInput, type RotateSessionInput, createOidcVaultAccessTokenMiddleware, createOidcVaultJwtAccessTokenValidator, createOidcVaultMiddleware, normalizeOidcVaultBasePath, resolveOidcVaultConfig, resolveOidcVaultConfigFromEnv };