@web-ts-toolkit/oidc-vault-dpop-client 0.48.0

package/index.d.mts

@@ -0,0 +1,269 @@
+/**
+ * Browser-only DPoP client (CLIENT-02 port of apps/oidc-vault-dpop-example/src/auth/*).
+ * No `node:*` or `express` imports. Browser globals (crypto.subtle, indexedDB,
+ * sessionStorage, navigator.locks, BroadcastChannel) only behind
+ * assertDpopBrowserFeatures / lazy factory calls, never at module top-level.
+ */
+
+interface PublicDpopJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+}
+interface DpopKey {
+    readonly privateKey: CryptoKey;
+    readonly publicJwk: Readonly<PublicDpopJwk>;
+    readonly jkt: string;
+    readonly scopeId: string;
+}
+
+interface DpopKeyScope {
+    frontendOrigin: string;
+    backendOrigin: string;
+    basePath: string;
+}
+
+/**
+ * Read (or, at fresh login, atomically create) the non-extractable ES256/P-256
+ * browser key scoped to `[frontendOrigin, backendOrigin, basePath]`.
+ *
+ * Call with the default `create=true` ONLY at fresh login (`session.login()`
+ * does this for you). All credential-bearing operations use `create=false`,
+ * so losing IndexedDB cannot silently rebind a login: a missing or changed
+ * key throws `DPOP_KEY_LOST` and the caller must start a fresh login. There is
+ * no ephemeral-key or Bearer fallback.
+ *
+ * Candidate crypto work happens outside the readwrite transaction. IndexedDB
+ * serializes the final read/add across tabs, making exactly one candidate win.
+ *
+ * Canonical import: `import { getOrCreateDpopKey } from
+ * '@web-ts-toolkit/oidc-vault-dpop-client'` (named root import).
+ */
+declare const getOrCreateDpopKey: (input: DpopKeyScope, options?: {
+    create?: boolean;
+}) => Promise<DpopKey>;
+
+interface DpopProofInput {
+    method: string;
+    url: string | URL;
+    /** API only. Vault login/exchange/refresh/logout present no access token. */
+    accessToken?: string;
+    nonce?: string;
+    now?: () => number;
+}
+/**
+ * Mint a fresh DPoP proof for exactly one request attempt with the scoped key.
+ *
+ * Every invocation signs a new proof: exact uppercase `htm`, canonical absolute
+ * `htu` without query/fragment (see `normalizeDpopTarget`), current integer
+ * `iat`, fresh 128-bit random `jti`, API-only `ath`, and the optional server
+ * `nonce`. The protected header is `{ typ: 'dpop+jwt', alg: 'ES256', jwk:
+ * <public P-256 JWK> }`. Call again — with a new `jti`/`iat`/signature — for
+ * every nonce or refresh retry; never reuse a proof across attempts.
+ *
+ * Canonical import: `import { createDpopProof } from
+ * '@web-ts-toolkit/oidc-vault-dpop-client'` (named root import).
+ */
+declare const createDpopProof: (key: DpopKey, input: DpopProofInput) => Promise<string>;
+
+/** DPoP proof algorithms, independent of the app-local access token's signing algorithm. */
+type OidcVaultDpopAlgorithm = 'ES256' | 'PS256' | 'RS256';
+/**
+ * Immutable persisted sender constraint. `jkt` is the canonical RFC 7638
+ * SHA-256 JWK thumbprint (43 base64url characters). Store no JWK, private key,
+ * proof algorithm, or historical enforcement mode in this record.
+ */
+interface OidcVaultDpopBinding {
+    type: 'dpop';
+    jkt: string;
+}
+/** Verified request context; `alg` is checked against the current proof policy. */
+interface OidcVaultVerifiedDpopBinding extends OidcVaultDpopBinding {
+    alg: OidcVaultDpopAlgorithm;
+}
+interface OidcVaultUserProfile {
+    sub: string;
+    email?: string;
+    name?: string;
+    preferredUsername?: string;
+    [key: string]: unknown;
+}
+interface OidcVaultAccessTokenValidationResult {
+    subject: string;
+    sessionId?: string;
+    scope?: string;
+    claims?: Record<string, unknown>;
+    /** Verified sender constraint. Legacy adapters may omit it only for genuinely unbound credentials. */
+    confirmation?: OidcVaultAccessTokenConfirmation | null;
+}
+/** Canonical RFC 7638 SHA-256 thumbprint derived from verified token/introspection data, never from a proof alone. */
+interface OidcVaultAccessTokenConfirmation {
+    jkt: string;
+}
+interface OidcVaultAuthContext extends OidcVaultAccessTokenValidationResult {
+    token: string;
+    /** Present only after original-key proof, API ath, nonce and shared replay admission all pass. */
+    deviceBinding?: Readonly<OidcVaultVerifiedDpopBinding>;
+}
+declare module 'express-serve-static-core' {
+    interface Request {
+        auth?: OidcVaultAuthContext;
+    }
+}
+type OidcVaultSessionTransport = 'body' | 'cookie';
+
+interface DpopAccessToken {
+    readonly accessToken: string;
+    readonly tokenType: 'DPoP';
+    readonly expiresAt: number;
+    readonly jkt: string;
+    readonly generation: string;
+    readonly user?: OidcVaultUserProfile;
+}
+
+/**
+ * Browser-only DPoP client (CLIENT-02 port of apps/oidc-vault-dpop-example/src/auth/*).
+ * No `node:*` or `express` imports. Browser globals (crypto.subtle, indexedDB,
+ * sessionStorage, navigator.locks, BroadcastChannel) only behind
+ * assertDpopBrowserFeatures / lazy factory calls, never at module top-level.
+ */
+/** Copyable private example helper. Recognition is NOT proof of possession or an API sender constraint. */
+type DeviceFingerprintSignalSource = () => Promise<string | undefined>;
+interface DeviceFingerprintOptions {
+    /** Must match the backend's fingerprintRecognition.headerName; default X-Device-Fingerprint. */
+    headerName?: string;
+}
+interface DeviceFingerprint {
+    /**
+     * Obtain the current signal for POST login/exchange/refresh only. No signal is
+     * persisted or cached here. Undefined deliberately means unenrolled; collection
+     * failures throw rather than silently disabling an enrolled session's check.
+     * Call only after the application's collection/disclosure choice and scope
+     * these headers to its configured vault origin. Logout/API need no signal.
+     */
+    headers(): Promise<Readonly<Record<string, string>>>;
+}
+/** Generic injected source: no browser collection, vendor import, storage, or network activity at construction. */
+declare const createDeviceFingerprint: (source: DeviceFingerprintSignalSource, options?: DeviceFingerprintOptions) => DeviceFingerprint;
+/** Structural adapter for optional frontend FingerprintJS; no package dependency is required by this helper. */
+interface FingerprintJsAgent {
+    get(): Promise<{
+        visitorId: string;
+    }>;
+}
+/**
+ * Inject () => FingerprintJS.load() if the frontend opts into that dependency.
+ * Only the agent load is shared; get() runs for each operation, so the helper
+ * never pins an old identifier through a recognition change. Failed load can
+ * be retried explicitly. Wrap with createDeviceFingerprint for bounded signals
+ * and fixed errors that do not echo vendor diagnostics/identifiers.
+ */
+declare const fingerprintJsSignalSource: (load: () => Promise<FingerprintJsAgent>) => DeviceFingerprintSignalSource;
+
+interface OidcVaultDpopSessionOptions {
+    backendOrigin: string;
+    basePath?: string;
+    sessionTransport?: OidcVaultSessionTransport;
+    /** Current signal on login/exchange/refresh only; optional recognition, never PoP. */
+    fingerprint?: DeviceFingerprint;
+    fetch?: typeof globalThis.fetch;
+    navigate?: (authorizationUrl: string) => void;
+    now?: () => number;
+}
+interface OidcVaultDpopSession {
+    readonly scopeId: string;
+    readonly sessionTransport: OidcVaultSessionTransport;
+    login(returnTo?: string): Promise<void>;
+    exchange(code: string): Promise<DpopAccessToken>;
+    /** Single-flight; no Authorization/ath even if the old JWT expired. */
+    refresh(options?: {
+        rejectedToken?: string;
+    }): Promise<DpopAccessToken>;
+    logout(): Promise<void>;
+    getAccessToken(): DpopAccessToken | undefined;
+    /** Existing key only. Missing/changed persistence clears auth and requires login. */
+    getKey(): Promise<DpopKey>;
+    clear(): Promise<void>;
+    dispose(): void;
+}
+/**
+ * Create a browser DPoP session for one vault mount (`backendOrigin` + `basePath`).
+ * Canonical import: `import { createOidcVaultDpopSession } from
+ * '@web-ts-toolkit/oidc-vault-dpop-client'` (named root import, no default export).
+ * Lifecycle: `login` → `exchange(code)` → `getAccessToken`/`fetchWithDpop` →
+ * `refresh` → `logout`. Cookie transport additionally needs Web Locks +
+ * `BroadcastChannel` at runtime (see `assertDpopBrowserFeatures`).
+ * Copyable app helper. It is not an export of the Express package.
+ */
+declare const createOidcVaultDpopSession: (options: OidcVaultDpopSessionOptions) => OidcVaultDpopSession;
+
+/**
+ * Browser-only DPoP client (CLIENT-02 port of apps/oidc-vault-dpop-example/src/auth/*).
+ * No `node:*` or `express` imports. Browser globals (crypto.subtle, indexedDB,
+ * sessionStorage, navigator.locks, BroadcastChannel) only behind
+ * assertDpopBrowserFeatures / lazy factory calls, never at module top-level.
+ */
+declare class DpopNonceCache {
+    private readonly nonces;
+    get(space: string, jkt: string): string | undefined;
+    remember(space: string, jkt: string, nonce: string | null): boolean;
+    clear(): void;
+}
+
+/**
+ * Browser-only DPoP client (CLIENT-02 port of apps/oidc-vault-dpop-example/src/auth/*).
+ * No `node:*` or `express` imports. Browser globals (crypto.subtle, indexedDB,
+ * sessionStorage, navigator.locks, BroadcastChannel) only behind
+ * assertDpopBrowserFeatures / lazy factory calls, never at module top-level.
+ */
+
+interface DpopApi {
+    /** Exact origin receiving the proof/Authorization. No wildcard or redirects. */
+    origin: string;
+    /** Backend API replayNamespace (the nonce protection space), not a route. */
+    replayNamespace: string;
+    /** Usually omit for JWT APIs; include only for an explicitly cookie-using API. */
+    credentials?: 'omit' | 'include';
+}
+interface DpopFetchContext {
+    session: OidcVaultDpopSession;
+    apis: readonly DpopApi[];
+    fetch?: typeof globalThis.fetch;
+    nonces?: DpopNonceCache;
+    now?: () => number;
+}
+interface DpopFetchOptions extends Omit<RequestInit, 'redirect' | 'credentials'> {
+    /**
+     * GET/HEAD/OPTIONS may retry. All other methods default to one attempt.
+     * Explicitly authorize idempotent retries only for a server operation whose
+     * contract supports them (e.g. PUT or POST with a server idempotency key).
+     */
+    retry?: 'never' | 'idempotent';
+}
+/**
+ * Scoped DPoP `fetch` for one configured API origin: mints a fresh proof per
+ * attempt, sends `Authorization: DPoP`, then retries once on a DPoP nonce
+ * challenge and at most once via `session.refresh()` on `invalid_token`.
+ * Canonical import: `import { fetchWithDpop } from
+ * '@web-ts-toolkit/oidc-vault-dpop-client'` (named root import). Only origins
+ * listed in `context.apis` are called; authentication headers are owned by the
+ * helper and must not be set by callers.
+ */
+declare const fetchWithDpop: (context: DpopFetchContext, input: string | URL, options?: DpopFetchOptions) => Promise<Response>;
+
+/**
+ * Browser-only DPoP client (CLIENT-02 port of apps/oidc-vault-dpop-example/src/auth/*).
+ * No `node:*` or `express` imports. Browser globals (crypto.subtle, indexedDB,
+ * sessionStorage, navigator.locks, BroadcastChannel) only behind
+ * assertDpopBrowserFeatures / lazy factory calls, never at module top-level.
+ */
+/** Fixed local failures; never include keys, credentials, fingerprints or URLs. */
+declare class OidcVaultDpopClientError extends Error {
+    readonly code: string;
+    readonly requiresLogin: boolean;
+    readonly status?: number;
+    constructor(code: string, message: string, requiresLogin?: boolean, status?: number);
+}
+
+export { type DeviceFingerprint, type DeviceFingerprintOptions, type DeviceFingerprintSignalSource, type DpopAccessToken, type DpopApi, type DpopFetchContext, type DpopFetchOptions, type DpopKey, type DpopKeyScope, DpopNonceCache, type DpopProofInput, type FingerprintJsAgent, OidcVaultDpopClientError, type OidcVaultDpopSession, type OidcVaultDpopSessionOptions, createDeviceFingerprint, createDpopProof, createOidcVaultDpopSession, fetchWithDpop, fingerprintJsSignalSource, getOrCreateDpopKey };

package/index.d.ts

@@ -0,0 +1,269 @@
+/**
+ * Browser-only DPoP client (CLIENT-02 port of apps/oidc-vault-dpop-example/src/auth/*).
+ * No `node:*` or `express` imports. Browser globals (crypto.subtle, indexedDB,
+ * sessionStorage, navigator.locks, BroadcastChannel) only behind
+ * assertDpopBrowserFeatures / lazy factory calls, never at module top-level.
+ */
+
+interface PublicDpopJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+}
+interface DpopKey {
+    readonly privateKey: CryptoKey;
+    readonly publicJwk: Readonly<PublicDpopJwk>;
+    readonly jkt: string;
+    readonly scopeId: string;
+}
+
+interface DpopKeyScope {
+    frontendOrigin: string;
+    backendOrigin: string;
+    basePath: string;
+}
+
+/**
+ * Read (or, at fresh login, atomically create) the non-extractable ES256/P-256
+ * browser key scoped to `[frontendOrigin, backendOrigin, basePath]`.
+ *
+ * Call with the default `create=true` ONLY at fresh login (`session.login()`
+ * does this for you). All credential-bearing operations use `create=false`,
+ * so losing IndexedDB cannot silently rebind a login: a missing or changed
+ * key throws `DPOP_KEY_LOST` and the caller must start a fresh login. There is
+ * no ephemeral-key or Bearer fallback.
+ *
+ * Candidate crypto work happens outside the readwrite transaction. IndexedDB
+ * serializes the final read/add across tabs, making exactly one candidate win.
+ *
+ * Canonical import: `import { getOrCreateDpopKey } from
+ * '@web-ts-toolkit/oidc-vault-dpop-client'` (named root import).
+ */
+declare const getOrCreateDpopKey: (input: DpopKeyScope, options?: {
+    create?: boolean;
+}) => Promise<DpopKey>;
+
+interface DpopProofInput {
+    method: string;
+    url: string | URL;
+    /** API only. Vault login/exchange/refresh/logout present no access token. */
+    accessToken?: string;
+    nonce?: string;
+    now?: () => number;
+}
+/**
+ * Mint a fresh DPoP proof for exactly one request attempt with the scoped key.
+ *
+ * Every invocation signs a new proof: exact uppercase `htm`, canonical absolute
+ * `htu` without query/fragment (see `normalizeDpopTarget`), current integer
+ * `iat`, fresh 128-bit random `jti`, API-only `ath`, and the optional server
+ * `nonce`. The protected header is `{ typ: 'dpop+jwt', alg: 'ES256', jwk:
+ * <public P-256 JWK> }`. Call again — with a new `jti`/`iat`/signature — for
+ * every nonce or refresh retry; never reuse a proof across attempts.
+ *
+ * Canonical import: `import { createDpopProof } from
+ * '@web-ts-toolkit/oidc-vault-dpop-client'` (named root import).
+ */
+declare const createDpopProof: (key: DpopKey, input: DpopProofInput) => Promise<string>;
+
+/** DPoP proof algorithms, independent of the app-local access token's signing algorithm. */
+type OidcVaultDpopAlgorithm = 'ES256' | 'PS256' | 'RS256';
+/**
+ * Immutable persisted sender constraint. `jkt` is the canonical RFC 7638
+ * SHA-256 JWK thumbprint (43 base64url characters). Store no JWK, private key,
+ * proof algorithm, or historical enforcement mode in this record.
+ */
+interface OidcVaultDpopBinding {
+    type: 'dpop';
+    jkt: string;
+}
+/** Verified request context; `alg` is checked against the current proof policy. */
+interface OidcVaultVerifiedDpopBinding extends OidcVaultDpopBinding {
+    alg: OidcVaultDpopAlgorithm;
+}
+interface OidcVaultUserProfile {
+    sub: string;
+    email?: string;
+    name?: string;
+    preferredUsername?: string;
+    [key: string]: unknown;
+}
+interface OidcVaultAccessTokenValidationResult {
+    subject: string;
+    sessionId?: string;
+    scope?: string;
+    claims?: Record<string, unknown>;
+    /** Verified sender constraint. Legacy adapters may omit it only for genuinely unbound credentials. */
+    confirmation?: OidcVaultAccessTokenConfirmation | null;
+}
+/** Canonical RFC 7638 SHA-256 thumbprint derived from verified token/introspection data, never from a proof alone. */
+interface OidcVaultAccessTokenConfirmation {
+    jkt: string;
+}
+interface OidcVaultAuthContext extends OidcVaultAccessTokenValidationResult {
+    token: string;
+    /** Present only after original-key proof, API ath, nonce and shared replay admission all pass. */
+    deviceBinding?: Readonly<OidcVaultVerifiedDpopBinding>;
+}
+declare module 'express-serve-static-core' {
+    interface Request {
+        auth?: OidcVaultAuthContext;
+    }
+}
+type OidcVaultSessionTransport = 'body' | 'cookie';
+
+interface DpopAccessToken {
+    readonly accessToken: string;
+    readonly tokenType: 'DPoP';
+    readonly expiresAt: number;
+    readonly jkt: string;
+    readonly generation: string;
+    readonly user?: OidcVaultUserProfile;
+}
+
+/**
+ * Browser-only DPoP client (CLIENT-02 port of apps/oidc-vault-dpop-example/src/auth/*).
+ * No `node:*` or `express` imports. Browser globals (crypto.subtle, indexedDB,
+ * sessionStorage, navigator.locks, BroadcastChannel) only behind
+ * assertDpopBrowserFeatures / lazy factory calls, never at module top-level.
+ */
+/** Copyable private example helper. Recognition is NOT proof of possession or an API sender constraint. */
+type DeviceFingerprintSignalSource = () => Promise<string | undefined>;
+interface DeviceFingerprintOptions {
+    /** Must match the backend's fingerprintRecognition.headerName; default X-Device-Fingerprint. */
+    headerName?: string;
+}
+interface DeviceFingerprint {
+    /**
+     * Obtain the current signal for POST login/exchange/refresh only. No signal is
+     * persisted or cached here. Undefined deliberately means unenrolled; collection
+     * failures throw rather than silently disabling an enrolled session's check.
+     * Call only after the application's collection/disclosure choice and scope
+     * these headers to its configured vault origin. Logout/API need no signal.
+     */
+    headers(): Promise<Readonly<Record<string, string>>>;
+}
+/** Generic injected source: no browser collection, vendor import, storage, or network activity at construction. */
+declare const createDeviceFingerprint: (source: DeviceFingerprintSignalSource, options?: DeviceFingerprintOptions) => DeviceFingerprint;
+/** Structural adapter for optional frontend FingerprintJS; no package dependency is required by this helper. */
+interface FingerprintJsAgent {
+    get(): Promise<{
+        visitorId: string;
+    }>;
+}
+/**
+ * Inject () => FingerprintJS.load() if the frontend opts into that dependency.
+ * Only the agent load is shared; get() runs for each operation, so the helper
+ * never pins an old identifier through a recognition change. Failed load can
+ * be retried explicitly. Wrap with createDeviceFingerprint for bounded signals
+ * and fixed errors that do not echo vendor diagnostics/identifiers.
+ */
+declare const fingerprintJsSignalSource: (load: () => Promise<FingerprintJsAgent>) => DeviceFingerprintSignalSource;
+
+interface OidcVaultDpopSessionOptions {
+    backendOrigin: string;
+    basePath?: string;
+    sessionTransport?: OidcVaultSessionTransport;
+    /** Current signal on login/exchange/refresh only; optional recognition, never PoP. */
+    fingerprint?: DeviceFingerprint;
+    fetch?: typeof globalThis.fetch;
+    navigate?: (authorizationUrl: string) => void;
+    now?: () => number;
+}
+interface OidcVaultDpopSession {
+    readonly scopeId: string;
+    readonly sessionTransport: OidcVaultSessionTransport;
+    login(returnTo?: string): Promise<void>;
+    exchange(code: string): Promise<DpopAccessToken>;
+    /** Single-flight; no Authorization/ath even if the old JWT expired. */
+    refresh(options?: {
+        rejectedToken?: string;
+    }): Promise<DpopAccessToken>;
+    logout(): Promise<void>;
+    getAccessToken(): DpopAccessToken | undefined;
+    /** Existing key only. Missing/changed persistence clears auth and requires login. */
+    getKey(): Promise<DpopKey>;
+    clear(): Promise<void>;
+    dispose(): void;
+}
+/**
+ * Create a browser DPoP session for one vault mount (`backendOrigin` + `basePath`).
+ * Canonical import: `import { createOidcVaultDpopSession } from
+ * '@web-ts-toolkit/oidc-vault-dpop-client'` (named root import, no default export).
+ * Lifecycle: `login` → `exchange(code)` → `getAccessToken`/`fetchWithDpop` →
+ * `refresh` → `logout`. Cookie transport additionally needs Web Locks +
+ * `BroadcastChannel` at runtime (see `assertDpopBrowserFeatures`).
+ * Copyable app helper. It is not an export of the Express package.
+ */
+declare const createOidcVaultDpopSession: (options: OidcVaultDpopSessionOptions) => OidcVaultDpopSession;
+
+/**
+ * Browser-only DPoP client (CLIENT-02 port of apps/oidc-vault-dpop-example/src/auth/*).
+ * No `node:*` or `express` imports. Browser globals (crypto.subtle, indexedDB,
+ * sessionStorage, navigator.locks, BroadcastChannel) only behind
+ * assertDpopBrowserFeatures / lazy factory calls, never at module top-level.
+ */
+declare class DpopNonceCache {
+    private readonly nonces;
+    get(space: string, jkt: string): string | undefined;
+    remember(space: string, jkt: string, nonce: string | null): boolean;
+    clear(): void;
+}
+
+/**
+ * Browser-only DPoP client (CLIENT-02 port of apps/oidc-vault-dpop-example/src/auth/*).
+ * No `node:*` or `express` imports. Browser globals (crypto.subtle, indexedDB,
+ * sessionStorage, navigator.locks, BroadcastChannel) only behind
+ * assertDpopBrowserFeatures / lazy factory calls, never at module top-level.
+ */
+
+interface DpopApi {
+    /** Exact origin receiving the proof/Authorization. No wildcard or redirects. */
+    origin: string;
+    /** Backend API replayNamespace (the nonce protection space), not a route. */
+    replayNamespace: string;
+    /** Usually omit for JWT APIs; include only for an explicitly cookie-using API. */
+    credentials?: 'omit' | 'include';
+}
+interface DpopFetchContext {
+    session: OidcVaultDpopSession;
+    apis: readonly DpopApi[];
+    fetch?: typeof globalThis.fetch;
+    nonces?: DpopNonceCache;
+    now?: () => number;
+}
+interface DpopFetchOptions extends Omit<RequestInit, 'redirect' | 'credentials'> {
+    /**
+     * GET/HEAD/OPTIONS may retry. All other methods default to one attempt.
+     * Explicitly authorize idempotent retries only for a server operation whose
+     * contract supports them (e.g. PUT or POST with a server idempotency key).
+     */
+    retry?: 'never' | 'idempotent';
+}
+/**
+ * Scoped DPoP `fetch` for one configured API origin: mints a fresh proof per
+ * attempt, sends `Authorization: DPoP`, then retries once on a DPoP nonce
+ * challenge and at most once via `session.refresh()` on `invalid_token`.
+ * Canonical import: `import { fetchWithDpop } from
+ * '@web-ts-toolkit/oidc-vault-dpop-client'` (named root import). Only origins
+ * listed in `context.apis` are called; authentication headers are owned by the
+ * helper and must not be set by callers.
+ */
+declare const fetchWithDpop: (context: DpopFetchContext, input: string | URL, options?: DpopFetchOptions) => Promise<Response>;
+
+/**
+ * Browser-only DPoP client (CLIENT-02 port of apps/oidc-vault-dpop-example/src/auth/*).
+ * No `node:*` or `express` imports. Browser globals (crypto.subtle, indexedDB,
+ * sessionStorage, navigator.locks, BroadcastChannel) only behind
+ * assertDpopBrowserFeatures / lazy factory calls, never at module top-level.
+ */
+/** Fixed local failures; never include keys, credentials, fingerprints or URLs. */
+declare class OidcVaultDpopClientError extends Error {
+    readonly code: string;
+    readonly requiresLogin: boolean;
+    readonly status?: number;
+    constructor(code: string, message: string, requiresLogin?: boolean, status?: number);
+}
+
+export { type DeviceFingerprint, type DeviceFingerprintOptions, type DeviceFingerprintSignalSource, type DpopAccessToken, type DpopApi, type DpopFetchContext, type DpopFetchOptions, type DpopKey, type DpopKeyScope, DpopNonceCache, type DpopProofInput, type FingerprintJsAgent, OidcVaultDpopClientError, type OidcVaultDpopSession, type OidcVaultDpopSessionOptions, createDeviceFingerprint, createDpopProof, createOidcVaultDpopSession, fetchWithDpop, fingerprintJsSignalSource, getOrCreateDpopKey };