@web-ts-toolkit/express-oidc-vault 0.50.0 → 0.52.0

package/index.js

@@ -290,6 +290,26 @@ var parseSelectedCookieValue = (headerValue, selectedName) => {
 
 // src/device-binding-policy.ts
 var import_node_net = require("net");
+
+// src/dpop-failure-policy.ts
+var CHECKS = {
+  target: { step: 6, option: "ignoreTargetFailure", env: "OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE" },
+  freshness: { step: 7, option: "ignoreFreshnessFailure", env: "OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE" },
+  replay: { step: 8, option: "ignoreReplayFailure", env: "OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE" }
+};
+var resolveDpopFailureOption = (value, check) => {
+  const { option, env } = CHECKS[check];
+  if (value === void 0) return process.env[env] === "true";
+  if (typeof value !== "boolean") throw new TypeError(`deviceBinding.${option} must be a boolean.`);
+  return value;
+};
+var handleDpopCheckFailure = (ignore, check, error) => {
+  if (!ignore) throw error;
+  const { step, option, env } = CHECKS[check];
+  console.warn(`[express-oidc-vault] DPoP step ${step} (${check}) failed; continuing (${option}=true; ${env}).`, error);
+};
+
+// src/device-binding-policy.ts
 var isPlainRecord = (value) => {
   if (typeof value !== "object" || value === null) return false;
   const prototype = Object.getPrototypeOf(value);
@@ -306,7 +326,16 @@ var resolveInteger = (value, fallback, min, max, name) => {
 var resolveDeviceBindingOptions = (value) => {
   if (value === void 0) return void 0;
   if (!isPlainRecord(value)) throw new Error("deviceBinding must be a plain options object.");
-  const { mode, algorithms, proofMaxAgeSeconds, clockSkewSeconds, nonce } = value;
+  const {
+    mode,
+    algorithms,
+    proofMaxAgeSeconds,
+    clockSkewSeconds,
+    nonce,
+    ignoreTargetFailure,
+    ignoreFreshnessFailure,
+    ignoreReplayFailure
+  } = value;
   if (mode !== void 0 && mode !== "optional" && mode !== "required") {
     throw new Error("deviceBinding.mode must be optional or required.");
   }
@@ -338,7 +367,10 @@ var resolveDeviceBindingOptions = (value) => {
     algorithms: Object.freeze([...new Set(allowlist)]),
     proofMaxAgeSeconds: resolveInteger(proofMaxAgeSeconds, 60, 1, 300, "deviceBinding.proofMaxAgeSeconds"),
     clockSkewSeconds: resolveInteger(clockSkewSeconds, 5, 0, 30, "deviceBinding.clockSkewSeconds"),
-    nonce: resolvedNonce
+    nonce: resolvedNonce,
+    ignoreTargetFailure: resolveDpopFailureOption(ignoreTargetFailure, "target"),
+    ignoreFreshnessFailure: resolveDpopFailureOption(ignoreFreshnessFailure, "freshness"),
+    ignoreReplayFailure: resolveDpopFailureOption(ignoreReplayFailure, "replay")
   });
 };
 var DEVICE_BINDING_STORE_CAPABILITIES = [
@@ -669,6 +701,7 @@ var publicJwk = (value, alg) => {
 var verifyDpopProof = async (input) => {
   const { proof, method, targetUrl, proofOptions, expectedJkt, accessToken } = input;
   const algorithms = [...proofOptions.algorithms];
+  const { ignoreTargetFailure } = proofOptions;
   extractDpopProof({ count: 1, value: proof });
   const [encodedHeader, encodedPayload, encodedSignature] = proof.split(".");
   const header = parseObject(decodeBase64url2(encodedHeader, DPOP_PROTECTED_HEADER_MAX_BYTES));
@@ -694,8 +727,13 @@ var verifyDpopProof = async (input) => {
   if (typeof iat !== "number" || !Number.isSafeInteger(iat) || iat < 0 || typeof jti !== "string" || jti.length < 1 || jti.length > 128 || /[^\x20-\x7e]/.test(jti)) {
     throw invalidProof("DPoP signed iat/JTI must be nonnegative integer time and bounded printable ASCII.");
   }
-  if (htm !== method || typeof method !== "string" || method.length === 0 || normalizeDpopProofTarget(htu) !== targetUrl) {
-    throw invalidProof("DPoP signed method or normalized public target does not match this request.");
+  try {
+    const expectedTarget = typeof targetUrl === "function" ? targetUrl() : targetUrl;
+    if (htm !== method || typeof method !== "string" || method.length === 0 || normalizeDpopProofTarget(htu) !== expectedTarget) {
+      throw invalidProof("DPoP signed method or normalized public target does not match this request.");
+    }
+  } catch (error) {
+    handleDpopCheckFailure(ignoreTargetFailure, "target", error);
   }
   if (typeof nonce === "string" && (nonce.length > DPOP_NONCE_MAX_BYTES || Buffer.byteLength(nonce, "utf8") > DPOP_NONCE_MAX_BYTES)) {
     throw invalidProof("DPoP signed nonce exceeds its byte bound.");
@@ -1795,6 +1833,35 @@ async function fetchUserInfo(metadata, accessToken, options = {}) {
 // src/token-issuance.ts
 var import_jose3 = require("jose");
 
+// src/access-token-confirmation.ts
+var invalidAccessToken = (diagnostic) => new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_ACCESS_TOKEN", diagnostic, "Access token validation failed.");
+var snapshotJkt = (value, invalid = invalidAccessToken) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw invalid("Access token confirmation must be a plain jkt object.");
+  }
+  const prototype = Object.getPrototypeOf(value);
+  const keys = Reflect.ownKeys(value);
+  if (prototype !== Object.prototype && prototype !== null || keys.length !== 1 || keys[0] !== "jkt") {
+    throw invalid("Access token confirmation contains unsupported fields.");
+  }
+  const { jkt } = value;
+  if (!isCanonicalDpopJkt(jkt)) throw invalid("Access token confirmation is not a canonical SHA-256 thumbprint.");
+  return Object.freeze({ jkt });
+};
+var isCompactSignedJwt = (token) => {
+  const parts = token.split(".");
+  return parts.length === 3 && parts.every(
+    (part) => /^[A-Za-z0-9_-]+$/.test(part) ? Buffer.from(part, "base64url").toString("base64url") === part : false
+  );
+};
+var readJwtExpirationMs = (exp) => {
+  if (typeof exp !== "number" || !Number.isSafeInteger(exp) || exp < 0) return void 0;
+  const milliseconds = exp * 1e3;
+  return Number.isSafeInteger(milliseconds) ? milliseconds : void 0;
+};
+var snapshotVerifiedJwtConfirmation = (claims) => Object.hasOwn(claims, "cnf") ? snapshotJkt(claims.cnf) : null;
+var snapshotAccessTokenConfirmation = (value) => value === null ? null : snapshotJkt(value);
+
 // src/vault-session.ts
 var invalidVaultSession = () => new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_SESSION", "Session is missing or expired.");
 var invalidExchangeCode = () => new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_EXCHANGE_CODE", "Exchange code is invalid or expired.");
@@ -1939,13 +2006,7 @@ var createExchangeResponse = (options, session, issuedToken) => ({
   expiresIn: issuedToken.expiresIn,
   tokenType: issuedToken.tokenType
 });
-var isCompactSignedJwt = (token) => {
-  const parts = token.split(".");
-  return parts.length === 3 && parts.every(
-    (part) => /^[A-Za-z0-9_-]+$/.test(part) ? Buffer.from(part, "base64url").toString("base64url") === part : false
-  );
-};
-var assertIssuedTokenConfirmation = (accessToken, jkt) => {
+var assertIssuedBoundJwt = (accessToken, jkt) => {
   if (!isCompactSignedJwt(accessToken)) {
     throw new TypeError("tokenIssuer.issue accessToken must be a compact signed JWT for bound issuance.");
   }
@@ -1960,10 +2021,16 @@ var assertIssuedTokenConfirmation = (accessToken, jkt) => {
   if (typeof header.alg !== "string" || header.alg.length === 0 || header.alg === "none" || header.b64 === false) {
     throw new TypeError("tokenIssuer.issue accessToken must use a signed JWT algorithm for bound issuance.");
   }
-  const cnf = claims.cnf;
-  if (typeof cnf !== "object" || cnf === null || Array.isArray(cnf) || cnf.jkt !== jkt) {
+  const confirmation = snapshotJkt(
+    claims.cnf,
+    (diagnostic) => new TypeError(`tokenIssuer.issue accessToken cnf.jkt is invalid. ${diagnostic}`)
+  );
+  if (confirmation.jkt !== jkt) {
     throw new TypeError("tokenIssuer.issue accessToken cnf.jkt must match the verified device binding.");
   }
+  if (readJwtExpirationMs(claims.exp) === void 0) {
+    throw new TypeError("tokenIssuer.issue accessToken exp must be a nonnegative safe integer with safe milliseconds.");
+  }
 };
 var withIssuedToken = async (req, res, options, session, verifiedBinding) => {
   const binding = resolveVerifiedDeviceBinding(options.deviceBinding, session.deviceBinding, verifiedBinding);
@@ -1996,7 +2063,10 @@ var withIssuedToken = async (req, res, options, session, verifiedBinding) => {
       }
     } else {
       if (tokenType !== "DPoP") throw new TypeError("tokenIssuer.issue tokenType must be DPoP for bound issuance.");
-      assertIssuedTokenConfirmation(accessToken, binding.jkt);
+      if (!Number.isSafeInteger(expiresIn * 1e3)) {
+        throw new TypeError("tokenIssuer.issue expiresIn must have safe milliseconds for bound issuance.");
+      }
+      assertIssuedBoundJwt(accessToken, binding.jkt);
     }
     return { accessToken, expiresIn, ...tokenType === void 0 ? {} : { tokenType } };
   } catch (error) {
@@ -2008,27 +2078,6 @@ var withIssuedToken = async (req, res, options, session, verifiedBinding) => {
 
 // src/token-validation.ts
 var import_jose4 = require("jose");
-
-// src/access-token-confirmation.ts
-var invalidAccessToken = (diagnostic) => new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_ACCESS_TOKEN", diagnostic, "Access token validation failed.");
-var snapshotJkt = (value) => {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw invalidAccessToken("Access token confirmation must be a plain jkt object.");
-  }
-  const prototype = Object.getPrototypeOf(value);
-  const keys = Reflect.ownKeys(value);
-  if (prototype !== Object.prototype && prototype !== null || keys.length !== 1 || keys[0] !== "jkt") {
-    throw invalidAccessToken("Access token confirmation contains unsupported fields.");
-  }
-  const { jkt } = value;
-  if (!isCanonicalDpopJkt(jkt))
-    throw invalidAccessToken("Access token confirmation is not a canonical SHA-256 thumbprint.");
-  return Object.freeze({ jkt });
-};
-var snapshotVerifiedJwtConfirmation = (claims) => Object.hasOwn(claims, "cnf") ? snapshotJkt(claims.cnf) : null;
-var snapshotAccessTokenConfirmation = (value) => value === null ? null : snapshotJkt(value);
-
-// src/token-validation.ts
 var BACKCHANNEL_LOGOUT_EVENT_CLAIM = "http://schemas.openid.net/event/backchannel-logout";
 var validateBackchannelLogoutTokenTyp = (typ) => {
   if (typ !== void 0 && (typeof typ !== "string" || typ.toLowerCase() !== "logout+jwt")) {
@@ -2190,6 +2239,14 @@ function createOidcVaultJwtAccessTokenValidator(options) {
     const result = await (0, import_jose4.jwtVerify)(token, key, { issuer, audience, algorithms });
     const claims = result.payload;
     const confirmation = snapshotVerifiedJwtConfirmation(claims);
+    if (confirmation !== null) {
+      if (!isCompactSignedJwt(token)) {
+        throw invalidAccessToken("Bound JWT must use canonical compact signed encoding.");
+      }
+      if (readJwtExpirationMs(claims.exp) === void 0) {
+        throw invalidAccessToken("Bound JWT exp must be a nonnegative safe integer with safe milliseconds.");
+      }
+    }
     const mapped = mapClaims ? mapClaims(claims) : defaultJwtClaimsMapper(claims);
     const { subject, sessionId, scope, claims: mappedClaims } = mapped;
     return { subject, sessionId, scope, claims: mappedClaims, confirmation };
@@ -2309,8 +2366,8 @@ var createDpopReplayPolicy = (options) => {
         throw invalidProof2("DPoP verifier did not return a verified key binding.");
       }
       const { type, jkt, alg } = verifiedBinding;
-      if (type !== "dpop" || !isCanonicalDpopJkt(jkt) || !isDpopAlgorithm(alg) || !policy.algorithms.includes(alg) || !isPrintableIdentifier(jti)) {
-        throw invalidProof2("DPoP verified key/algorithm or signed JTI shape is invalid.");
+      if (type !== "dpop" || !isCanonicalDpopJkt(jkt) || !isDpopAlgorithm(alg) || !policy.algorithms.includes(alg) || !isPrintableIdentifier(jti) || typeof iat !== "number" || !Number.isSafeInteger(iat) || iat < 0) {
+        throw invalidProof2("DPoP verified key/algorithm or signed iat/JTI shape is invalid.");
       }
       const binding = Object.freeze({ type, jkt, alg });
       let checkedNow;
@@ -2318,10 +2375,20 @@ var createDpopReplayPolicy = (options) => {
         checkedNow = now();
         if (!Number.isSafeInteger(checkedNow) || checkedNow < 0) throw new TypeError("DPoP replay clock is invalid.");
       } catch (error) {
-        throw replayUnavailable(error);
+        handleDpopCheckFailure(policy.ignoreFreshnessFailure, "freshness", replayUnavailable(error));
+        checkedNow = Date.now();
+        if (!Number.isSafeInteger(checkedNow) || checkedNow < 0)
+          throw replayUnavailable(new TypeError("DPoP fallback clock is invalid."));
+      }
+      let expiresAt = getDpopReplayExpiresAt({ ...policy, iat, now: checkedNow });
+      if (expiresAt === null) {
+        handleDpopCheckFailure(
+          policy.ignoreFreshnessFailure,
+          "freshness",
+          invalidProof2("DPoP signed iat is outside the bounded replay window.")
+        );
+        expiresAt = checkedNow + (policy.proofMaxAgeSeconds + policy.clockSkewSeconds) * 1e3;
       }
-      const expiresAt = getDpopReplayExpiresAt({ ...policy, iat, now: checkedNow });
-      if (expiresAt === null) throw invalidProof2("DPoP signed iat is outside the bounded replay window.");
       if (noncePolicy) {
         if (!noncePolicy.verify(nonce, jkt, checkedNow)) {
           return Object.freeze({ type: "nonce-challenge", nonce: noncePolicy.issue(jkt, checkedNow) });
@@ -2329,18 +2396,19 @@ var createDpopReplayPolicy = (options) => {
       } else if (nonce !== void 0 && (typeof nonce !== "string" || nonce.length > DPOP_NONCE_MAX_BYTES || Buffer.byteLength(nonce, "utf8") > DPOP_NONCE_MAX_BYTES)) {
         throw invalidProof2("DPoP signed nonce claim exceeds its string/byte bound.");
       }
-      let reserved;
+      let reservationError;
       try {
-        reserved = await replayStore.reserveDpopProof({
+        const reserved = await replayStore.reserveDpopProof({
           replayKey: createDpopReplayKey(effectiveNamespace, jkt, jti),
           expiresAt
         });
         if (typeof reserved !== "boolean")
           throw new TypeError("DPoP replay store returned a non-boolean admission result.");
+        if (!reserved) reservationError = invalidProof2("DPoP replay reservation was duplicate or no longer live.");
       } catch (error) {
-        throw replayUnavailable(error);
+        reservationError = replayUnavailable(error);
       }
-      if (!reserved) throw invalidProof2("DPoP replay reservation was duplicate or no longer live.");
+      if (reservationError) handleDpopCheckFailure(policy.ignoreReplayFailure, "replay", reservationError);
       return Object.freeze({ type: "accepted", binding, expiresAt });
     }
   });
@@ -2403,12 +2471,11 @@ var createVaultRouteProofVerifier = (options, config, backendOrigin, basePath) =
     now: options.now
   });
   const admit = async (request, proof, expectedJkt) => {
-    const targetUrl = targetFor(request.originalUrl);
     const result = await replay.verifyAndReserve(
       () => verifyDpopProof({
         proof,
         method: request.method,
-        targetUrl,
+        targetUrl: () => targetFor(request.originalUrl),
         proofOptions: policy,
         expectedJkt
       })
@@ -2589,12 +2656,11 @@ function createOidcVaultAccessTokenMiddleware(options) {
         if (!proof && confirmation)
           throw new OidcVaultHttpError(401, "OIDC_VAULT_DPOP_REQUIRED", "DPoP authentication is required.");
         if (proof) {
-          const targetUrl = targetFor(originalUrl);
           const admission = await replay.verifyAndReserve(
             () => verifyDpopProof({
               proof,
               method,
-              targetUrl,
+              targetUrl: () => targetFor(originalUrl),
               proofOptions: policy,
               accessToken: token,
               expectedJkt: confirmation?.jkt

package/index.mjs

@@ -242,6 +242,26 @@ var parseSelectedCookieValue = (headerValue, selectedName) => {
 
 // src/device-binding-policy.ts
 import { isIP } from "net";
+
+// src/dpop-failure-policy.ts
+var CHECKS = {
+  target: { step: 6, option: "ignoreTargetFailure", env: "OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE" },
+  freshness: { step: 7, option: "ignoreFreshnessFailure", env: "OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE" },
+  replay: { step: 8, option: "ignoreReplayFailure", env: "OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE" }
+};
+var resolveDpopFailureOption = (value, check) => {
+  const { option, env } = CHECKS[check];
+  if (value === void 0) return process.env[env] === "true";
+  if (typeof value !== "boolean") throw new TypeError(`deviceBinding.${option} must be a boolean.`);
+  return value;
+};
+var handleDpopCheckFailure = (ignore, check, error) => {
+  if (!ignore) throw error;
+  const { step, option, env } = CHECKS[check];
+  console.warn(`[express-oidc-vault] DPoP step ${step} (${check}) failed; continuing (${option}=true; ${env}).`, error);
+};
+
+// src/device-binding-policy.ts
 var isPlainRecord = (value) => {
   if (typeof value !== "object" || value === null) return false;
   const prototype = Object.getPrototypeOf(value);
@@ -258,7 +278,16 @@ var resolveInteger = (value, fallback, min, max, name) => {
 var resolveDeviceBindingOptions = (value) => {
   if (value === void 0) return void 0;
   if (!isPlainRecord(value)) throw new Error("deviceBinding must be a plain options object.");
-  const { mode, algorithms, proofMaxAgeSeconds, clockSkewSeconds, nonce } = value;
+  const {
+    mode,
+    algorithms,
+    proofMaxAgeSeconds,
+    clockSkewSeconds,
+    nonce,
+    ignoreTargetFailure,
+    ignoreFreshnessFailure,
+    ignoreReplayFailure
+  } = value;
   if (mode !== void 0 && mode !== "optional" && mode !== "required") {
     throw new Error("deviceBinding.mode must be optional or required.");
   }
@@ -290,7 +319,10 @@ var resolveDeviceBindingOptions = (value) => {
     algorithms: Object.freeze([...new Set(allowlist)]),
     proofMaxAgeSeconds: resolveInteger(proofMaxAgeSeconds, 60, 1, 300, "deviceBinding.proofMaxAgeSeconds"),
     clockSkewSeconds: resolveInteger(clockSkewSeconds, 5, 0, 30, "deviceBinding.clockSkewSeconds"),
-    nonce: resolvedNonce
+    nonce: resolvedNonce,
+    ignoreTargetFailure: resolveDpopFailureOption(ignoreTargetFailure, "target"),
+    ignoreFreshnessFailure: resolveDpopFailureOption(ignoreFreshnessFailure, "freshness"),
+    ignoreReplayFailure: resolveDpopFailureOption(ignoreReplayFailure, "replay")
   });
 };
 var DEVICE_BINDING_STORE_CAPABILITIES = [
@@ -621,6 +653,7 @@ var publicJwk = (value, alg) => {
 var verifyDpopProof = async (input) => {
   const { proof, method, targetUrl, proofOptions, expectedJkt, accessToken } = input;
   const algorithms = [...proofOptions.algorithms];
+  const { ignoreTargetFailure } = proofOptions;
   extractDpopProof({ count: 1, value: proof });
   const [encodedHeader, encodedPayload, encodedSignature] = proof.split(".");
   const header = parseObject(decodeBase64url2(encodedHeader, DPOP_PROTECTED_HEADER_MAX_BYTES));
@@ -646,8 +679,13 @@ var verifyDpopProof = async (input) => {
   if (typeof iat !== "number" || !Number.isSafeInteger(iat) || iat < 0 || typeof jti !== "string" || jti.length < 1 || jti.length > 128 || /[^\x20-\x7e]/.test(jti)) {
     throw invalidProof("DPoP signed iat/JTI must be nonnegative integer time and bounded printable ASCII.");
   }
-  if (htm !== method || typeof method !== "string" || method.length === 0 || normalizeDpopProofTarget(htu) !== targetUrl) {
-    throw invalidProof("DPoP signed method or normalized public target does not match this request.");
+  try {
+    const expectedTarget = typeof targetUrl === "function" ? targetUrl() : targetUrl;
+    if (htm !== method || typeof method !== "string" || method.length === 0 || normalizeDpopProofTarget(htu) !== expectedTarget) {
+      throw invalidProof("DPoP signed method or normalized public target does not match this request.");
+    }
+  } catch (error) {
+    handleDpopCheckFailure(ignoreTargetFailure, "target", error);
   }
   if (typeof nonce === "string" && (nonce.length > DPOP_NONCE_MAX_BYTES || Buffer.byteLength(nonce, "utf8") > DPOP_NONCE_MAX_BYTES)) {
     throw invalidProof("DPoP signed nonce exceeds its byte bound.");
@@ -1747,6 +1785,35 @@ async function fetchUserInfo(metadata, accessToken, options = {}) {
 // src/token-issuance.ts
 import { decodeJwt, decodeProtectedHeader } from "jose";
 
+// src/access-token-confirmation.ts
+var invalidAccessToken = (diagnostic) => new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_ACCESS_TOKEN", diagnostic, "Access token validation failed.");
+var snapshotJkt = (value, invalid = invalidAccessToken) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw invalid("Access token confirmation must be a plain jkt object.");
+  }
+  const prototype = Object.getPrototypeOf(value);
+  const keys = Reflect.ownKeys(value);
+  if (prototype !== Object.prototype && prototype !== null || keys.length !== 1 || keys[0] !== "jkt") {
+    throw invalid("Access token confirmation contains unsupported fields.");
+  }
+  const { jkt } = value;
+  if (!isCanonicalDpopJkt(jkt)) throw invalid("Access token confirmation is not a canonical SHA-256 thumbprint.");
+  return Object.freeze({ jkt });
+};
+var isCompactSignedJwt = (token) => {
+  const parts = token.split(".");
+  return parts.length === 3 && parts.every(
+    (part) => /^[A-Za-z0-9_-]+$/.test(part) ? Buffer.from(part, "base64url").toString("base64url") === part : false
+  );
+};
+var readJwtExpirationMs = (exp) => {
+  if (typeof exp !== "number" || !Number.isSafeInteger(exp) || exp < 0) return void 0;
+  const milliseconds = exp * 1e3;
+  return Number.isSafeInteger(milliseconds) ? milliseconds : void 0;
+};
+var snapshotVerifiedJwtConfirmation = (claims) => Object.hasOwn(claims, "cnf") ? snapshotJkt(claims.cnf) : null;
+var snapshotAccessTokenConfirmation = (value) => value === null ? null : snapshotJkt(value);
+
 // src/vault-session.ts
 var invalidVaultSession = () => new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_SESSION", "Session is missing or expired.");
 var invalidExchangeCode = () => new OidcVaultHttpError(400, "OIDC_VAULT_INVALID_EXCHANGE_CODE", "Exchange code is invalid or expired.");
@@ -1891,13 +1958,7 @@ var createExchangeResponse = (options, session, issuedToken) => ({
   expiresIn: issuedToken.expiresIn,
   tokenType: issuedToken.tokenType
 });
-var isCompactSignedJwt = (token) => {
-  const parts = token.split(".");
-  return parts.length === 3 && parts.every(
-    (part) => /^[A-Za-z0-9_-]+$/.test(part) ? Buffer.from(part, "base64url").toString("base64url") === part : false
-  );
-};
-var assertIssuedTokenConfirmation = (accessToken, jkt) => {
+var assertIssuedBoundJwt = (accessToken, jkt) => {
   if (!isCompactSignedJwt(accessToken)) {
     throw new TypeError("tokenIssuer.issue accessToken must be a compact signed JWT for bound issuance.");
   }
@@ -1912,10 +1973,16 @@ var assertIssuedTokenConfirmation = (accessToken, jkt) => {
   if (typeof header.alg !== "string" || header.alg.length === 0 || header.alg === "none" || header.b64 === false) {
     throw new TypeError("tokenIssuer.issue accessToken must use a signed JWT algorithm for bound issuance.");
   }
-  const cnf = claims.cnf;
-  if (typeof cnf !== "object" || cnf === null || Array.isArray(cnf) || cnf.jkt !== jkt) {
+  const confirmation = snapshotJkt(
+    claims.cnf,
+    (diagnostic) => new TypeError(`tokenIssuer.issue accessToken cnf.jkt is invalid. ${diagnostic}`)
+  );
+  if (confirmation.jkt !== jkt) {
     throw new TypeError("tokenIssuer.issue accessToken cnf.jkt must match the verified device binding.");
   }
+  if (readJwtExpirationMs(claims.exp) === void 0) {
+    throw new TypeError("tokenIssuer.issue accessToken exp must be a nonnegative safe integer with safe milliseconds.");
+  }
 };
 var withIssuedToken = async (req, res, options, session, verifiedBinding) => {
   const binding = resolveVerifiedDeviceBinding(options.deviceBinding, session.deviceBinding, verifiedBinding);
@@ -1948,7 +2015,10 @@ var withIssuedToken = async (req, res, options, session, verifiedBinding) => {
       }
     } else {
       if (tokenType !== "DPoP") throw new TypeError("tokenIssuer.issue tokenType must be DPoP for bound issuance.");
-      assertIssuedTokenConfirmation(accessToken, binding.jkt);
+      if (!Number.isSafeInteger(expiresIn * 1e3)) {
+        throw new TypeError("tokenIssuer.issue expiresIn must have safe milliseconds for bound issuance.");
+      }
+      assertIssuedBoundJwt(accessToken, binding.jkt);
     }
     return { accessToken, expiresIn, ...tokenType === void 0 ? {} : { tokenType } };
   } catch (error) {
@@ -1960,27 +2030,6 @@ var withIssuedToken = async (req, res, options, session, verifiedBinding) => {
 
 // src/token-validation.ts
 import { jwtVerify } from "jose";
-
-// src/access-token-confirmation.ts
-var invalidAccessToken = (diagnostic) => new OidcVaultHttpError(401, "OIDC_VAULT_INVALID_ACCESS_TOKEN", diagnostic, "Access token validation failed.");
-var snapshotJkt = (value) => {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw invalidAccessToken("Access token confirmation must be a plain jkt object.");
-  }
-  const prototype = Object.getPrototypeOf(value);
-  const keys = Reflect.ownKeys(value);
-  if (prototype !== Object.prototype && prototype !== null || keys.length !== 1 || keys[0] !== "jkt") {
-    throw invalidAccessToken("Access token confirmation contains unsupported fields.");
-  }
-  const { jkt } = value;
-  if (!isCanonicalDpopJkt(jkt))
-    throw invalidAccessToken("Access token confirmation is not a canonical SHA-256 thumbprint.");
-  return Object.freeze({ jkt });
-};
-var snapshotVerifiedJwtConfirmation = (claims) => Object.hasOwn(claims, "cnf") ? snapshotJkt(claims.cnf) : null;
-var snapshotAccessTokenConfirmation = (value) => value === null ? null : snapshotJkt(value);
-
-// src/token-validation.ts
 var BACKCHANNEL_LOGOUT_EVENT_CLAIM = "http://schemas.openid.net/event/backchannel-logout";
 var validateBackchannelLogoutTokenTyp = (typ) => {
   if (typ !== void 0 && (typeof typ !== "string" || typ.toLowerCase() !== "logout+jwt")) {
@@ -2142,6 +2191,14 @@ function createOidcVaultJwtAccessTokenValidator(options) {
     const result = await jwtVerify(token, key, { issuer, audience, algorithms });
     const claims = result.payload;
     const confirmation = snapshotVerifiedJwtConfirmation(claims);
+    if (confirmation !== null) {
+      if (!isCompactSignedJwt(token)) {
+        throw invalidAccessToken("Bound JWT must use canonical compact signed encoding.");
+      }
+      if (readJwtExpirationMs(claims.exp) === void 0) {
+        throw invalidAccessToken("Bound JWT exp must be a nonnegative safe integer with safe milliseconds.");
+      }
+    }
     const mapped = mapClaims ? mapClaims(claims) : defaultJwtClaimsMapper(claims);
     const { subject, sessionId, scope, claims: mappedClaims } = mapped;
     return { subject, sessionId, scope, claims: mappedClaims, confirmation };
@@ -2261,8 +2318,8 @@ var createDpopReplayPolicy = (options) => {
         throw invalidProof2("DPoP verifier did not return a verified key binding.");
       }
       const { type, jkt, alg } = verifiedBinding;
-      if (type !== "dpop" || !isCanonicalDpopJkt(jkt) || !isDpopAlgorithm(alg) || !policy.algorithms.includes(alg) || !isPrintableIdentifier(jti)) {
-        throw invalidProof2("DPoP verified key/algorithm or signed JTI shape is invalid.");
+      if (type !== "dpop" || !isCanonicalDpopJkt(jkt) || !isDpopAlgorithm(alg) || !policy.algorithms.includes(alg) || !isPrintableIdentifier(jti) || typeof iat !== "number" || !Number.isSafeInteger(iat) || iat < 0) {
+        throw invalidProof2("DPoP verified key/algorithm or signed iat/JTI shape is invalid.");
       }
       const binding = Object.freeze({ type, jkt, alg });
       let checkedNow;
@@ -2270,10 +2327,20 @@ var createDpopReplayPolicy = (options) => {
         checkedNow = now();
         if (!Number.isSafeInteger(checkedNow) || checkedNow < 0) throw new TypeError("DPoP replay clock is invalid.");
       } catch (error) {
-        throw replayUnavailable(error);
+        handleDpopCheckFailure(policy.ignoreFreshnessFailure, "freshness", replayUnavailable(error));
+        checkedNow = Date.now();
+        if (!Number.isSafeInteger(checkedNow) || checkedNow < 0)
+          throw replayUnavailable(new TypeError("DPoP fallback clock is invalid."));
+      }
+      let expiresAt = getDpopReplayExpiresAt({ ...policy, iat, now: checkedNow });
+      if (expiresAt === null) {
+        handleDpopCheckFailure(
+          policy.ignoreFreshnessFailure,
+          "freshness",
+          invalidProof2("DPoP signed iat is outside the bounded replay window.")
+        );
+        expiresAt = checkedNow + (policy.proofMaxAgeSeconds + policy.clockSkewSeconds) * 1e3;
       }
-      const expiresAt = getDpopReplayExpiresAt({ ...policy, iat, now: checkedNow });
-      if (expiresAt === null) throw invalidProof2("DPoP signed iat is outside the bounded replay window.");
       if (noncePolicy) {
         if (!noncePolicy.verify(nonce, jkt, checkedNow)) {
           return Object.freeze({ type: "nonce-challenge", nonce: noncePolicy.issue(jkt, checkedNow) });
@@ -2281,18 +2348,19 @@ var createDpopReplayPolicy = (options) => {
       } else if (nonce !== void 0 && (typeof nonce !== "string" || nonce.length > DPOP_NONCE_MAX_BYTES || Buffer.byteLength(nonce, "utf8") > DPOP_NONCE_MAX_BYTES)) {
         throw invalidProof2("DPoP signed nonce claim exceeds its string/byte bound.");
       }
-      let reserved;
+      let reservationError;
       try {
-        reserved = await replayStore.reserveDpopProof({
+        const reserved = await replayStore.reserveDpopProof({
           replayKey: createDpopReplayKey(effectiveNamespace, jkt, jti),
           expiresAt
         });
         if (typeof reserved !== "boolean")
           throw new TypeError("DPoP replay store returned a non-boolean admission result.");
+        if (!reserved) reservationError = invalidProof2("DPoP replay reservation was duplicate or no longer live.");
       } catch (error) {
-        throw replayUnavailable(error);
+        reservationError = replayUnavailable(error);
       }
-      if (!reserved) throw invalidProof2("DPoP replay reservation was duplicate or no longer live.");
+      if (reservationError) handleDpopCheckFailure(policy.ignoreReplayFailure, "replay", reservationError);
       return Object.freeze({ type: "accepted", binding, expiresAt });
     }
   });
@@ -2355,12 +2423,11 @@ var createVaultRouteProofVerifier = (options, config, backendOrigin, basePath) =
     now: options.now
   });
   const admit = async (request, proof, expectedJkt) => {
-    const targetUrl = targetFor(request.originalUrl);
     const result = await replay.verifyAndReserve(
       () => verifyDpopProof({
         proof,
         method: request.method,
-        targetUrl,
+        targetUrl: () => targetFor(request.originalUrl),
         proofOptions: policy,
         expectedJkt
       })
@@ -2541,12 +2608,11 @@ function createOidcVaultAccessTokenMiddleware(options) {
         if (!proof && confirmation)
           throw new OidcVaultHttpError(401, "OIDC_VAULT_DPOP_REQUIRED", "DPoP authentication is required.");
         if (proof) {
-          const targetUrl = targetFor(originalUrl);
           const admission = await replay.verifyAndReserve(
             () => verifyDpopProof({
               proof,
               method,
-              targetUrl,
+              targetUrl: () => targetFor(originalUrl),
               proofOptions: policy,
               accessToken: token,
               expectedJkt: confirmation?.jkt

package/package.json

@@ -2,7 +2,7 @@
   "name": "@web-ts-toolkit/express-oidc-vault",
   "description": "Express OIDC sessions with body or cookie transport, optional DPoP-bound local JWTs, and pluggable vault stores",
   "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/express-oidc-vault",
-  "version": "0.50.0",
+  "version": "0.52.0",
   "sideEffects": false,
   "keywords": [
     "express",
@@ -26,6 +26,16 @@
       "import": "./index.mjs",
       "require": "./index.js",
       "default": "./index.js"
+    },
+    "./wire": {
+      "types": {
+        "import": "./wire.d.mts",
+        "require": "./wire.d.ts",
+        "default": "./wire.d.ts"
+      },
+      "import": "./wire.mjs",
+      "require": "./wire.js",
+      "default": "./wire.js"
     }
   },
   "engines": {