@web-ts-toolkit/express-oidc-vault 0.53.0 → 0.55.0

package/index.d.ts

@@ -2,13 +2,72 @@ import { Request, Response, RequestHandler, Router } from 'express';
 import { KeyObject } from 'node:crypto';
 import { JWK } from 'jose';
 import { OidcVaultUserProfile, OidcVaultTokenIssueResult, OidcVaultSessionTransport } from './wire.js';
-export { OidcVaultExchangeResult, OidcVaultLoginInitiationInput, OidcVaultLoginInitiationResult, OidcVaultLogoutResult } from './wire.js';
+export { OidcVaultExchangeResult, OidcVaultLoginInitiationInput, OidcVaultLoginInitiationResult, OidcVaultLogoutNavigationInput, OidcVaultLogoutNavigationResult, OidcVaultLogoutResult } from './wire.js';
 
 type OidcVaultRouteName = 'login' | 'callback' | 'exchange' | 'refresh' | 'logout' | 'backchannel-logout';
 /** Enabling the option defaults to `optional`; omitting it keeps bearer behavior. */
 type OidcVaultDeviceBindingMode = 'optional' | 'required';
 /** DPoP proof algorithms, independent of the app-local access token's signing algorithm. */
 type OidcVaultDpopAlgorithm = 'ES256' | 'PS256' | 'RS256';
+type OidcVaultDpopOperation = 'login' | 'exchange' | 'refresh' | 'logout' | 'api';
+type OidcVaultDpopDiagnosticStage = 'presentation' | 'preflight' | 'header' | 'key' | 'signature' | 'claims' | 'target' | 'token-hash' | 'binding' | 'freshness' | 'nonce' | 'replay' | 'proof';
+type OidcVaultDpopDiagnosticOutcome = 'accepted' | 'rejected' | 'challenged' | 'ignored';
+type OidcVaultDpopDiagnosticReason = 'check-passed' | 'policy-disabled' | 'proof-absent' | 'proof-required' | 'binding-required' | 'preflight-failed' | 'session-unavailable' | 'target-absent' | 'session-mismatch' | 'origin-rejected' | 'browser-binding-rejected' | 'recognition-rejected' | 'credential-rejected' | 'malformed-proof' | 'unsupported-header' | 'invalid-key' | 'invalid-signature' | 'invalid-claims' | 'target-mismatch' | 'token-hash-mismatch' | 'key-mismatch' | 'invalid-time' | 'proof-too-old' | 'proof-in-future' | 'clock-unavailable' | 'invalid-nonce' | 'nonce-required' | 'nonce-invalid' | 'nonce-disabled' | 'nonce-unavailable' | 'replay-detected' | 'replay-unavailable' | 'proof-accepted';
+/** Opaque correlation only, not authority. SHA-256 of purpose + NUL + identifier; oversized inputs are omitted. */
+interface OidcVaultDiagnosticCorrelation {
+    readonly association: 'candidate-session' | 'verified-token' | 'authenticated';
+    readonly subjectRef?: string;
+    readonly sessionRef?: string;
+}
+/** Each check reports its own provenance, including policy overrides; signature verification alone is not identity authentication. */
+interface OidcVaultDpopVerificationProvenance {
+    readonly signature: 'unchecked' | 'verified' | 'failed';
+    readonly target: 'unchecked' | 'matched' | 'failed' | 'ignored';
+    readonly tokenHash: 'unchecked' | 'not-applicable' | 'matched' | 'failed';
+    readonly credentialBinding: 'unchecked' | 'not-applicable' | 'matched' | 'failed';
+    readonly freshness: 'unchecked' | 'passed' | 'failed' | 'ignored';
+    readonly nonce: 'unchecked' | 'disabled' | 'passed' | 'challenged' | 'failed';
+    readonly replay: 'unchecked' | 'reserved' | 'failed' | 'ignored';
+}
+/** A signed timestamp is a claim, not proof of an accurate physical clock. Unsafe millisecond arithmetic is omitted. */
+interface OidcVaultDpopDiagnosticTiming {
+    readonly provenance: 'signature-verified';
+    readonly iatSeconds: number;
+    readonly clock?: 'configured' | 'system' | 'fallback';
+    readonly checkedAtMs?: number;
+    /** Observed signed-claim age: checkedAtMs - iatSeconds * 1000; negative means a future claim. */
+    readonly observedAgeMs?: number;
+}
+/** Fixed-size, server-only allowlist. No errors, request objects, URLs, credentials, keys, proof IDs or raw session identifiers. */
+interface OidcVaultDpopDiagnosticEvent {
+    readonly operation: OidcVaultDpopOperation;
+    readonly stage: OidcVaultDpopDiagnosticStage;
+    readonly outcome: OidcVaultDpopDiagnosticOutcome;
+    readonly reason: OidcVaultDpopDiagnosticReason;
+    readonly verification: Readonly<OidcVaultDpopVerificationProvenance>;
+    readonly timing?: Readonly<OidcVaultDpopDiagnosticTiming>;
+    readonly correlation?: Readonly<OidcVaultDiagnosticCorrelation>;
+}
+/** Best-effort, non-blocking invocation in check order. At most 32 pending promises per dispatcher; excess/reentrant calls drop without queue/retry. Throws/rejections are swallowed, never sent to onError. */
+type OidcVaultDpopDiagnosticObserver = (event: OidcVaultDpopDiagnosticEvent) => void | Promise<void>;
+type OidcVaultTokenOperation = 'exchange' | 'refresh';
+/** Generated once after output/response validation, committed store work and cookie preparation, before HTTP writing. Not a delivery receipt. */
+type OidcVaultTokenOutcomeEvent = Readonly<{
+    kind: 'token-issued';
+    operation: OidcVaultTokenOperation;
+    correlation: Readonly<OidcVaultDiagnosticCorrelation>;
+    deviceBound: boolean;
+    expiresIn: number;
+    tokenType?: 'Bearer' | 'DPoP';
+}> | Readonly<{
+    kind: 'exchange-succeeded';
+    operation: 'exchange';
+    correlation: Readonly<OidcVaultDiagnosticCorrelation>;
+    deviceBound: boolean;
+    tokenIssued: boolean;
+}>;
+/** Same bounded best-effort delivery contract as DPoP observers; token-issued precedes exchange-succeeded. */
+type OidcVaultTokenOutcomeObserver = (event: OidcVaultTokenOutcomeEvent) => void | Promise<void>;
 /**
  * Immutable persisted sender constraint. `jkt` is the canonical RFC 7638
  * SHA-256 JWK thumbprint (43 base64url characters). Store no JWK, private key,
@@ -318,6 +377,46 @@ declare class OidcVaultStoreConflictError extends Error {
 declare class OidcVaultDpopReplayCapacityError extends Error {
     constructor(message?: string);
 }
+/** Dedicated, short-lived logout continuation. No raw ticket or session is persisted. */
+interface OidcVaultLogoutNavigationTicket {
+    /** `logout-navigation:v1:` followed by a canonical SHA-256 base64url hash of the configured scope. */
+    namespace: string;
+    /** Canonical SHA-256 base64url hash of the entire 256-bit `lnt_` ticket. Never the secret itself. */
+    ticketHash: string;
+    /** Already-built HTTP(S) provider URL, at most 16384 UTF-8 bytes; retained credential material. */
+    upstreamLogoutUrl: string;
+    createdAt: number;
+    expiresAt: number;
+}
+type CreateLogoutNavigationTicketInput = OidcVaultLogoutNavigationTicket;
+interface ConsumeLogoutNavigationTicketInput {
+    namespace: string;
+    ticketHash: string;
+}
+/** Independent physical-store capacity; no live continuation is evicted. */
+declare class OidcVaultLogoutNavigationCapacityError extends Error {
+    constructor(message?: string);
+}
+/** Optional dedicated capability, independent of device binding and replay admission. */
+interface OidcVaultLogoutNavigationStoreProvider extends OidcVaultStoreProvider {
+    /**
+     * Capture only the five scalar fields before yielding. Create-only: a live
+     * collision throws OidcVaultStoreConflictError before capacity rejection,
+     * without replacing or extending it. Invalid/expired input throws TypeError.
+     * Epochs must be safe Date-range integers, original TTL 1000..120000 ms,
+     * and remaining TTL > 0 and <= 120000 ms. Never retry ambiguous backend errors.
+     */
+    createLogoutNavigationTicket(input: CreateLogoutNavigationTicketInput): Promise<void>;
+    /**
+     * Atomically remove and return one detached, valid exact-pair record with
+     * expiresAt > storeNow. Invalid input/unknown/spent/malformed/expired returns
+     * null; selected malformed/expired records are retired. Backend, clock and
+     * accounting failures throw. No read/unconditional-delete implementation.
+     * Built-ins reclaim at most 64 unrelated expiries plus the selected record,
+     * allocate nothing for unknown identities, and free consumed capacity now.
+     */
+    consumeLogoutNavigationTicket(input: ConsumeLogoutNavigationTicketInput): Promise<OidcVaultLogoutNavigationTicket | null>;
+}
 /**
  * Portable store boundary for JSON-compatible plain objects/arrays and scalar
  * values (strings, finite numbers, booleans, null). Built-in providers capture
@@ -376,6 +475,10 @@ interface OidcVaultStoreProvider {
     getSessionRevocationContext?(sessionId: string): Promise<OidcVaultSessionRevocationContext | null>;
     /** Optional opt-in capability; see `OidcVaultDpopReplayStore.reserveDpopProof`. */
     reserveDpopProof?(input: ReserveDpopProofInput): Promise<boolean>;
+    /** Optional dedicated logout capability; see OidcVaultLogoutNavigationStoreProvider. */
+    createLogoutNavigationTicket?(input: CreateLogoutNavigationTicketInput): Promise<void>;
+    /** Optional atomic consume-if-live; not session authentication or revocation. */
+    consumeLogoutNavigationTicket?(input: ConsumeLogoutNavigationTicketInput): Promise<OidcVaultLogoutNavigationTicket | null>;
     /**
      * Atomically replace an existing session with a distinct unused `nextSession.sessionId`.
      *
@@ -499,6 +602,8 @@ interface OidcVaultHooks {
     onError?(context: OidcVaultErrorContext): void | Promise<void>;
 }
 interface IssueTokenInput {
+    /** Explicit operation, independent of mutable request URLs. */
+    operation: OidcVaultTokenOperation;
     /** Owned session data; reserved fingerprint recognition evidence is omitted to keep hashes out of application tokens. */
     session: OidcVaultSession;
     req: Request;
@@ -528,6 +633,33 @@ interface OidcVaultTokenIssuer {
      */
     issue(input: IssueTokenInput): Promise<OidcVaultTokenIssueResult>;
 }
+/** Local JWT signing algorithms, independent of the DPoP proof allowlist. EdDSA uses Ed25519. */
+type OidcVaultJwtSigningAlgorithm = 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'PS256' | 'PS384' | 'PS512' | 'ES256' | 'ES384' | 'ES512' | 'EdDSA';
+/** Application-owned JSON claims only. Reserved fields reject at runtime too, including serializer-produced overrides. */
+type OidcVaultJwtAccessTokenClaims = Record<string, unknown> & {
+    iss?: never;
+    aud?: never;
+    iat?: never;
+    exp?: never;
+    sub?: never;
+    cnf?: never;
+};
+/** Captured at construction. No implicit signing key, vault sid, profile/metadata or upstream-token copying. */
+interface OidcVaultJwtAccessTokenIssuerOptions {
+    /** Secret bytes, secret/private KeyObject, signing CryptoKey, or secret/private JWK. HMAC requires at least hash-size bits; RSA at least 2048. */
+    key: CryptoKey | KeyObject | JWK | Uint8Array;
+    algorithm: OidcVaultJwtSigningAlgorithm;
+    issuer: string;
+    audience: string | string[];
+    /** Nonnegative safe-integer seconds; default 300. Zero issues an already-expired JWT without failing vault rotation. */
+    lifetimeSeconds?: number;
+    /** Nonnegative safe-integer epoch milliseconds; sampled at construction and after mapping before signing. Default Date.now. Arithmetic must remain safe. */
+    now?: () => number;
+    /** Defaults to the session subject captured before callbacks. Runs before mapClaims; must return a nonblank string. */
+    mapSubject?(input: IssueTokenInput): string | Promise<string>;
+    /** Explicit application allowlist. Default scope is captured session.scope; override it or omit with scope: undefined. No reserved security claims. */
+    mapClaims?(input: IssueTokenInput): OidcVaultJwtAccessTokenClaims | Promise<OidcVaultJwtAccessTokenClaims>;
+}
 interface OidcVaultAccessTokenValidationResult {
     subject: string;
     sessionId?: string;
@@ -555,7 +687,7 @@ interface OidcVaultAuthContext extends OidcVaultAccessTokenValidationResult {
     deviceBinding?: Readonly<OidcVaultVerifiedDpopBinding>;
 }
 interface OidcVaultAccessTokenValidator {
-    /** Binding-disabled middleware invokes exactly validate(token), with one argument. Report any known confirmation. */
+    /** Binding-disabled middleware invokes exactly validate(token), with one argument. Report any known confirmation. Throw OidcVaultInvalidAccessTokenError for explicit credential rejection; other exceptions never authorize anonymous fallback. */
     validate(token: string): Promise<OidcVaultAccessTokenValidationResult>;
     /** Required at middleware construction when deviceBinding is enabled; called for both Bearer and DPoP. */
     validateWithRequest?(input: OidcVaultAccessTokenRequestInput): Promise<OidcVaultRequestAwareAccessTokenValidationResult>;
@@ -577,13 +709,20 @@ interface OidcVaultAccessTokenMiddlewareErrorContext {
 }
 interface OidcVaultAccessTokenMiddlewareOptions {
     validator: OidcVaultAccessTokenValidator;
+    /** Redacted server-only per-check observations; cannot veto authentication. */
+    onDpopDiagnostic?: OidcVaultDpopDiagnosticObserver;
+    /** Default required. Optional permits absent credentials, independently of deviceBinding.mode. Empty/malformed/duplicate headers are invalid, not missing. */
+    authentication?: 'required' | 'optional';
+    /** Default reject. Anonymous requires optional authentication and applies only to known credential rejections, never nonce challenges, replay outages, adapter contract/unknown errors or hook vetoes/failures. */
+    invalidCredentials?: 'reject' | 'anonymous';
     /** Opt-in API DPoP enforcement; requires validateWithRequest. Omission preserves the one-argument legacy path. */
     deviceBinding?: OidcVaultApiDeviceBindingOptions;
     /**
      * Pre-`next()` veto hook, not a post-commit notification: when it throws,
      * downstream middleware never runs and `req.auth` is detached before the
      * error response is sent. A valid credential plus a failing hook
-     * never surfaces as an invalid-token 401: a controlled package error from the
+     * never surfaces as an invalid-token 401: OidcVaultAuthDeniedError provides a
+     * public intentional 401/403 denial; a controlled package error from the
      * hook keeps its own status/code/client message (a 401 uses the attempted
      * scheme's challenge, other statuses carry no challenge), while any other hook
      * error becomes a sanitized `500 OIDC_VAULT_AUTH_CONTEXT_FAILED` without
@@ -599,7 +738,8 @@ interface OidcVaultAccessTokenMiddlewareOptions {
     }): void | Promise<void>;
     /**
      * Observes the original error for every API-middleware failure
-     * (extraction, validator, proof/nonce/replay, and `onAuthContext`) without affecting
+     * (extraction, validator, proof/nonce/replay, guards, and `onAuthContext`),
+     * including rejected credentials explicitly falling back anonymously, without affecting
      * the sanitized client response. Failures thrown by this observer are
      * swallowed so the original error response is preserved. Replay failures
      * retain the provider diagnostic in non-enumerable error.cause. No request
@@ -607,6 +747,20 @@ interface OidcVaultAccessTokenMiddlewareOptions {
      */
     onError?(context: OidcVaultAccessTokenMiddlewareErrorContext): void | Promise<void>;
 }
+/**
+ * Mount authenticate exactly once before routes, then use this same instance's
+ * guards. Guards consume private completed Request/Response-scoped evidence;
+ * they never verify, reserve a proof or enrich again. req.auth alone (including
+ * a copy from another request/instance) grants no authority. Re-entry fails
+ * closed. Do not replace/mutate top-level req.auth fields between these handlers;
+ * application enrichment belongs in onAuthContext (or application-owned locals).
+ */
+interface OidcVaultAuthenticator {
+    readonly authenticate: RequestHandler;
+    readonly requireAuth: RequestHandler;
+    /** Requires original bound-token confirmation AND accepted original-key proof; an optional unbound proof does not qualify. */
+    readonly requireDeviceBinding: RequestHandler;
+}
 interface OidcVaultAuthenticatedRequest extends Request {
     auth?: OidcVaultAuthContext;
 }
@@ -714,7 +868,20 @@ interface OidcVaultCookieOptions {
      */
     httpOnly?: boolean;
 }
+/** Opt-in proof-authorized local logout followed by one-time headerless browser navigation. */
+interface OidcVaultLogoutNavigationOptions {
+    /** Static backend/frontend-origin HTTPS destination (loopback HTTP allowed), <=2048 UTF-8 bytes; no userinfo/fragment/unsafe characters or continuation loop. */
+    fallbackRedirectUri: string;
+    /** Integer milliseconds, 1000..120000 inclusive; default 60000. Sampled after discovery. */
+    ticketTtlMs?: number;
+    /** Static printable ASCII deployment label, 1..128 bytes; default default. Effective scope also pins provider, mount and return policy. */
+    namespace?: string;
+}
 interface OidcVaultOptions {
+    /** Redacted server-only per-check observations; cannot veto or change enforcement. */
+    onDpopDiagnostic?: OidcVaultDpopDiagnosticObserver;
+    /** Committed local token/exchange outcomes. No credentials or mutable lifecycle context; observers cannot veto. */
+    onTokenOutcome?: OidcVaultTokenOutcomeObserver;
     /** Public router mount; default /auth/oidc. DPoP vault proxies must preserve this externally visible path. */
     basePath?: string;
     /** Pinned public callback/proof origin. DPoP requires a static HTTPS origin, with loopback HTTP allowed for development. */
@@ -744,6 +911,8 @@ interface OidcVaultOptions {
      * snapshots/freezes plain options and algorithms and copies nonce bytes.
      */
     deviceBinding?: OidcVaultDeviceBindingOptions;
+    /** Requires configured deviceBinding and both ticket-store methods. Snapshots/freeze return policy, TTL and derived namespace. Originally unbound targets must use ordinary logout. */
+    logoutNavigation?: OidcVaultLogoutNavigationOptions;
     /**
      * Separate opt-in recognition policy; omission means no signal capture/check.
      * Enables JSON POST login and its temporary HttpOnly cookie in both session
@@ -769,7 +938,9 @@ interface OidcVaultOptions {
     frontendRedirectUri?: string;
     /**
      * Optional provider-registered HTTP(S) URL used in the upstream end-session
-     * redirect. Only consulted for redirected logout (`redirect: true`); local
+     * redirect. Consulted for redirected logout (`redirect: true`) and opt-in
+     * logout navigation; navigation additionally validates/snapshots its syntax
+     * and 2048-byte bound at construction. Local
      * logout never contacts the provider, and redirected logout treats upstream
      * discovery failures or an absent endpoint as best-effort (local
      * `200 { loggedOut: true }`, with `onLogout` still delivered for a live
@@ -892,8 +1063,10 @@ declare const DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS: number;
 declare const DEFAULT_EXCHANGE_CODE_TTL_MS: number;
 declare const DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT = "16kb";
 declare const OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT = 16;
-declare const OIDC_VAULT_ROUTE_PATHS: Record<OidcVaultRouteName, string>;
+declare const OIDC_VAULT_ROUTE_PATHS: Record<OidcVaultRouteName | 'logout-navigation', string>;
 
+/** The handler-only API; defaults remain strict. Use the authenticator factory to compose reusable guards. */
+declare function createOidcVaultAccessTokenMiddleware(options: OidcVaultAccessTokenMiddlewareOptions): RequestHandler;
 /**
  * API authentication from package-root named imports. With deviceBinding
  * enabled, requires validateWithRequest at construction for BOTH schemes and
@@ -910,7 +1083,23 @@ declare const OIDC_VAULT_ROUTE_PATHS: Record<OidcVaultRouteName, string>;
  * environment defaults are captured at construction; ignored failures log to
  * console.warn. Explicit deviceBinding booleans override those defaults.
  */
-declare function createOidcVaultAccessTokenMiddleware(options: OidcVaultAccessTokenMiddlewareOptions): RequestHandler;
+declare function createOidcVaultAuthenticator(options: OidcVaultAccessTokenMiddlewareOptions): OidcVaultAuthenticator;
+
+declare class OidcVaultHttpError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly clientMessage: string;
+    constructor(status: number, code: string, message: string, clientMessage?: string);
+}
+
+/** Explicit credential rejection from a trusted custom validator; safe to treat as anonymous only with opt-in fallback. */
+declare class OidcVaultInvalidAccessTokenError extends OidcVaultHttpError {
+    constructor(message?: string);
+}
+/** Intentional onAuthContext veto. The message is public; unexpected exceptions remain sanitized server failures. */
+declare class OidcVaultAuthDeniedError extends OidcVaultHttpError {
+    constructor(message?: string, status?: 401 | 403);
+}
 
 /**
  * Verify local JWTs with both legacy validate(token) and validateWithRequest.
@@ -927,6 +1116,9 @@ declare function createOidcVaultAccessTokenMiddleware(options: OidcVaultAccessTo
  */
 declare function createOidcVaultJwtAccessTokenValidator(options: OidcVaultJwtAccessTokenValidatorOptions): OidcVaultRequestAwareAccessTokenValidator;
 
+/** Local signing only. The vault retains output checks/rollback; APIs independently authenticate the result. */
+declare function createOidcVaultJwtAccessTokenIssuer(options: OidcVaultJwtAccessTokenIssuerOptions): OidcVaultTokenIssuer;
+
 /**
  * Normalize the mounted base path for the OIDC router.
  */
@@ -968,4 +1160,4 @@ declare function normalizeOidcVaultBasePath(value?: string): string;
  */
 declare function createOidcVaultMiddleware(options: OidcVaultOptions): Router;
 
-export { type AuthorizationTransaction, type AuthorizationTransactionInput, type ConsumeAuthorizationTransactionIfMatchesInput, type ConsumeBackchannelLogoutTokenJtiInput, type ConsumeExchangeCodeIfMatchesInput, DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS, DEFAULT_EXCHANGE_CODE_TTL_MS, DEFAULT_OIDC_SCOPES, DEFAULT_OIDC_VAULT_BASE_PATH, DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT, type DeleteSessionsByLogicalSessionIdInput, type DeleteSessionsByProviderSessionIdInput, type DeleteSessionsBySubjectInput, type ExchangeCodeRecord, type ExchangeCodeRecordInput, type IssueTokenInput, OIDC_VAULT_ROUTE_PATHS, OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT, type OidcVaultAccessTokenConfirmation, type OidcVaultAccessTokenMiddlewareErrorContext, type OidcVaultAccessTokenMiddlewareOptions, type OidcVaultAccessTokenRequestInput, type OidcVaultAccessTokenValidationResult, type OidcVaultAccessTokenValidator, type OidcVaultApiDeviceBindingOptions, type OidcVaultAuthContext, type OidcVaultAuthenticatedRequest, type OidcVaultBackchannelLogoutResult, type OidcVaultConfig, type OidcVaultConfigMode, type OidcVaultCookieDeploymentMode, type OidcVaultCookieOptions, type OidcVaultCookieSameSite, type OidcVaultDeviceBindingMode, type OidcVaultDeviceBindingOptions, type OidcVaultDeviceBindingStoreProvider, type OidcVaultDpopAlgorithm, type OidcVaultDpopBinding, type OidcVaultDpopNonceOptions, type OidcVaultDpopProofOptions, OidcVaultDpopReplayCapacityError, type OidcVaultDpopReplayStore, type OidcVaultEnv, type OidcVaultErrorContext, type OidcVaultFingerprintRecognitionOptions, type OidcVaultHookContext, type OidcVaultHooks, type OidcVaultJwtAccessTokenValidatorOptions, type OidcVaultOptions, type OidcVaultProviderMetadata, type OidcVaultRecordBindingMatch, type OidcVaultRequestAwareAccessTokenValidationResult, type OidcVaultRequestAwareAccessTokenValidator, type OidcVaultResolvedConfig, type OidcVaultRouteName, type OidcVaultSession, type OidcVaultSessionInput, type OidcVaultSessionRevocationContext, OidcVaultSessionTransport, OidcVaultStoreConflictError, type OidcVaultStoreProvider, OidcVaultTokenIssueResult, type OidcVaultTokenIssuer, type OidcVaultTransactionCookieOptions, OidcVaultUserProfile, type OidcVaultVerifiedDpopBinding, type ReserveDpopProofInput, type RotateSessionInput, createOidcVaultAccessTokenMiddleware, createOidcVaultJwtAccessTokenValidator, createOidcVaultMiddleware, normalizeOidcVaultBasePath, resolveOidcVaultConfig, resolveOidcVaultConfigFromEnv };
+export { type AuthorizationTransaction, type AuthorizationTransactionInput, type ConsumeAuthorizationTransactionIfMatchesInput, type ConsumeBackchannelLogoutTokenJtiInput, type ConsumeExchangeCodeIfMatchesInput, type ConsumeLogoutNavigationTicketInput, type CreateLogoutNavigationTicketInput, DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS, DEFAULT_EXCHANGE_CODE_TTL_MS, DEFAULT_OIDC_SCOPES, DEFAULT_OIDC_VAULT_BASE_PATH, DEFAULT_OIDC_VAULT_REQUEST_BODY_LIMIT, type DeleteSessionsByLogicalSessionIdInput, type DeleteSessionsByProviderSessionIdInput, type DeleteSessionsBySubjectInput, type ExchangeCodeRecord, type ExchangeCodeRecordInput, type IssueTokenInput, OIDC_VAULT_ROUTE_PATHS, OIDC_VAULT_URL_ENCODED_PARAMETER_LIMIT, type OidcVaultAccessTokenConfirmation, type OidcVaultAccessTokenMiddlewareErrorContext, type OidcVaultAccessTokenMiddlewareOptions, type OidcVaultAccessTokenRequestInput, type OidcVaultAccessTokenValidationResult, type OidcVaultAccessTokenValidator, type OidcVaultApiDeviceBindingOptions, type OidcVaultAuthContext, OidcVaultAuthDeniedError, type OidcVaultAuthenticatedRequest, type OidcVaultAuthenticator, type OidcVaultBackchannelLogoutResult, type OidcVaultConfig, type OidcVaultConfigMode, type OidcVaultCookieDeploymentMode, type OidcVaultCookieOptions, type OidcVaultCookieSameSite, type OidcVaultDeviceBindingMode, type OidcVaultDeviceBindingOptions, type OidcVaultDeviceBindingStoreProvider, type OidcVaultDiagnosticCorrelation, type OidcVaultDpopAlgorithm, type OidcVaultDpopBinding, type OidcVaultDpopDiagnosticEvent, type OidcVaultDpopDiagnosticObserver, type OidcVaultDpopDiagnosticOutcome, type OidcVaultDpopDiagnosticReason, type OidcVaultDpopDiagnosticStage, type OidcVaultDpopDiagnosticTiming, type OidcVaultDpopNonceOptions, type OidcVaultDpopOperation, type OidcVaultDpopProofOptions, OidcVaultDpopReplayCapacityError, type OidcVaultDpopReplayStore, type OidcVaultDpopVerificationProvenance, type OidcVaultEnv, type OidcVaultErrorContext, type OidcVaultFingerprintRecognitionOptions, type OidcVaultHookContext, type OidcVaultHooks, OidcVaultInvalidAccessTokenError, type OidcVaultJwtAccessTokenClaims, type OidcVaultJwtAccessTokenIssuerOptions, type OidcVaultJwtAccessTokenValidatorOptions, type OidcVaultJwtSigningAlgorithm, OidcVaultLogoutNavigationCapacityError, type OidcVaultLogoutNavigationOptions, type OidcVaultLogoutNavigationStoreProvider, type OidcVaultLogoutNavigationTicket, type OidcVaultOptions, type OidcVaultProviderMetadata, type OidcVaultRecordBindingMatch, type OidcVaultRequestAwareAccessTokenValidationResult, type OidcVaultRequestAwareAccessTokenValidator, type OidcVaultResolvedConfig, type OidcVaultRouteName, type OidcVaultSession, type OidcVaultSessionInput, type OidcVaultSessionRevocationContext, OidcVaultSessionTransport, OidcVaultStoreConflictError, type OidcVaultStoreProvider, OidcVaultTokenIssueResult, type OidcVaultTokenIssuer, type OidcVaultTokenOperation, type OidcVaultTokenOutcomeEvent, type OidcVaultTokenOutcomeObserver, type OidcVaultTransactionCookieOptions, OidcVaultUserProfile, type OidcVaultVerifiedDpopBinding, type ReserveDpopProofInput, type RotateSessionInput, createOidcVaultAccessTokenMiddleware, createOidcVaultAuthenticator, createOidcVaultJwtAccessTokenIssuer, createOidcVaultJwtAccessTokenValidator, createOidcVaultMiddleware, normalizeOidcVaultBasePath, resolveOidcVaultConfig, resolveOidcVaultConfigFromEnv };