@web-ts-toolkit/oidc-vault-dpop-client 0.48.0

package/index.mjs

@@ -0,0 +1,842 @@
+// src/dpop-key-store.ts
+import { calculateJwkThumbprint } from "jose";
+
+// src/errors.ts
+var OidcVaultDpopClientError = class extends Error {
+  constructor(code, message, requiresLogin = false, status) {
+    super(message);
+    this.code = code;
+    this.requiresLogin = requiresLogin;
+    this.status = status;
+    this.name = "OidcVaultDpopClientError";
+  }
+};
+var keyLost = () => new OidcVaultDpopClientError("DPOP_KEY_LOST", "The browser login key is missing or changed. Sign in again.", true);
+var loginRequired = () => new OidcVaultDpopClientError("LOGIN_REQUIRED", "Sign in to continue.", true);
+var SERVER_MESSAGES = Object.freeze({
+  OIDC_VAULT_FINGERPRINT_REAUTH_REQUIRED: "Browser recognition changed; sign in again.",
+  OIDC_VAULT_INVALID_FINGERPRINT: "Fingerprint signal is invalid.",
+  OIDC_VAULT_USE_DPOP_NONCE: "A fresh DPoP nonce is required.",
+  OIDC_VAULT_INVALID_DPOP_PROOF: "DPoP proof validation failed.",
+  OIDC_VAULT_DPOP_REQUIRED: "DPoP authentication is required.",
+  OIDC_VAULT_DEVICE_BINDING_REQUIRED: "A device-bound login is required.",
+  OIDC_VAULT_INVALID_BROWSER_BINDING: "Login browser binding validation failed.",
+  OIDC_VAULT_INVALID_SESSION: "Session is missing or expired.",
+  OIDC_VAULT_DPOP_REPLAY_UNAVAILABLE: "DPoP replay protection is unavailable."
+});
+var serverError = (status, value) => {
+  const code = typeof value === "object" && value !== null && "code" in value && typeof value.code === "string" ? value.code : "OIDC_REQUEST_FAILED";
+  const requiresLogin = status === 401 || code === "OIDC_VAULT_FINGERPRINT_REAUTH_REQUIRED" || code === "OIDC_VAULT_INVALID_BROWSER_BINDING";
+  return new OidcVaultDpopClientError(code, SERVER_MESSAGES[code] ?? "The OIDC request failed.", requiresLogin, status);
+};
+
+// src/key-database.ts
+import { openDB } from "idb";
+var DPOP_DATABASE_NAME = "oidc-vault-dpop-example-v1";
+var withDpopDatabase = async (operation) => {
+  let db;
+  try {
+    db = await openDB(DPOP_DATABASE_NAME, 1, {
+      upgrade(database) {
+        database.createObjectStore("keys");
+        database.createObjectStore("cookieSessions");
+      },
+      blocked() {
+      }
+    });
+  } catch {
+    throw new OidcVaultDpopClientError(
+      "DPOP_KEY_STORAGE_UNAVAILABLE",
+      "IndexedDB key persistence is unavailable.",
+      true
+    );
+  }
+  try {
+    return await operation(db);
+  } finally {
+    db.close();
+  }
+};
+var readCookieSessionVersion = (scopeId) => withDpopDatabase((db) => db.get("cookieSessions", scopeId));
+var writeCookieSessionVersion = (scopeId, value) => withDpopDatabase(async (db) => {
+  await db.put("cookieSessions", value, scopeId);
+});
+
+// src/scope.ts
+var invalidTarget = () => new OidcVaultDpopClientError("INVALID_DPOP_TARGET", "A pinned absolute HTTP(S) target is required.");
+var hasControl = (value) => [...value].some((c) => c.charCodeAt(0) < 32 || c.charCodeAt(0) === 127);
+var normalizePath = (origin, path) => {
+  if (!path.startsWith("/") || /[\s\\]/.test(path) || hasControl(path) || /%(?![0-9a-f]{2})/i.test(path))
+    throw invalidTarget();
+  const decoded = path.replace(/%([0-9a-f]{2})/gi, (_, hex) => {
+    const character = String.fromCharCode(Number.parseInt(hex, 16));
+    return /^[A-Za-z0-9._~-]$/.test(character) ? character : `%${hex.toUpperCase()}`;
+  });
+  return new URL(`${origin}${decoded}`).pathname;
+};
+var normalizeDpopTarget = (value) => {
+  const input = typeof value === "string" ? value : value.href;
+  if (/[\s\\]/.test(input) || hasControl(input) || !/^https?:\/\/[^/\\?#]+/i.test(input)) throw invalidTarget();
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    throw invalidTarget();
+  }
+  const queryFree = input.split(/[?#]/, 1)[0];
+  const authority = queryFree.slice(queryFree.indexOf("://") + 3).split("/", 1)[0];
+  if (url.username || url.password || url.origin === "null" || authority.includes("@")) throw invalidTarget();
+  const authorityEnd = queryFree.indexOf("/", queryFree.indexOf("://") + 3);
+  const path = authorityEnd === -1 ? "/" : queryFree.slice(authorityEnd);
+  return `${url.origin}${normalizePath(url.origin, path)}`;
+};
+var normalizeStaticOrigin = (value) => {
+  const target = normalizeDpopTarget(value);
+  const url = new URL(value);
+  if (url.pathname !== "/" || url.search || url.hash || target !== `${url.origin}/`) throw invalidTarget();
+  if (url.protocol !== "https:" && !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) {
+    throw new OidcVaultDpopClientError("INSECURE_DPOP_ORIGIN", "DPoP requires HTTPS or loopback development.");
+  }
+  return url.origin;
+};
+var resolveDpopScope = (scope) => {
+  const frontendOrigin = normalizeStaticOrigin(scope.frontendOrigin);
+  const backendOrigin = normalizeStaticOrigin(scope.backendOrigin);
+  if (!scope.basePath.startsWith("/") || /[?#]/.test(scope.basePath)) throw invalidTarget();
+  const basePath = normalizePath(backendOrigin, scope.basePath).replace(/\/+$/g, "") || "/";
+  return Object.freeze({
+    frontendOrigin,
+    backendOrigin,
+    basePath,
+    id: JSON.stringify(["oidc-vault-dpop-v1", frontendOrigin, backendOrigin, basePath])
+  });
+};
+var assertDpopBrowserFeatures = (cookieTransport = false) => {
+  if (globalThis.isSecureContext !== true || !globalThis.crypto?.subtle || typeof globalThis.crypto.randomUUID !== "function" || typeof globalThis.CryptoKey !== "function" || !globalThis.indexedDB) {
+    throw new OidcVaultDpopClientError(
+      "DPOP_BROWSER_UNSUPPORTED",
+      "A secure context, Web Crypto and IndexedDB are required."
+    );
+  }
+  if (cookieTransport && (!globalThis.navigator?.locks?.request || typeof globalThis.BroadcastChannel !== "function")) {
+    throw new OidcVaultDpopClientError(
+      "DPOP_TAB_COORDINATION_UNSUPPORTED",
+      "Cookie sessions require Web Locks and BroadcastChannel."
+    );
+  }
+};
+
+// src/dpop-key-store.ts
+var validateKey = async (value, scopeId) => {
+  const algorithm = value?.privateKey?.algorithm;
+  const jwk = value?.publicJwk;
+  if (value?.version !== 1 || value.scopeId !== scopeId || !(value.privateKey instanceof CryptoKey) || value.privateKey.type !== "private" || value.privateKey.extractable || value.privateKey.usages.length !== 1 || value.privateKey.usages[0] !== "sign" || algorithm?.name !== "ECDSA" || algorithm.namedCurve !== "P-256" || jwk?.kty !== "EC" || jwk.crv !== "P-256" || Object.keys(jwk).length !== 4 || !/^[A-Za-z0-9_-]{43}$/.test(jwk.x) || !/^[A-Za-z0-9_-]{43}$/.test(jwk.y) || await calculateJwkThumbprint(jwk) !== value.jkt)
+    throw keyLost();
+  const challenge = new TextEncoder().encode("oidc-vault-dpop-key-pair-v1");
+  const publicKey = await crypto.subtle.importKey("jwk", jwk, { name: "ECDSA", namedCurve: "P-256" }, true, ["verify"]);
+  const signature = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, value.privateKey, challenge);
+  if (!await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, publicKey, signature, challenge))
+    throw keyLost();
+  return Object.freeze({ privateKey: value.privateKey, publicJwk: Object.freeze({ ...jwk }), jkt: value.jkt, scopeId });
+};
+var getOrCreateDpopKey = async (input, options = {}) => {
+  assertDpopBrowserFeatures();
+  const { id } = resolveDpopScope(input);
+  try {
+    const existing = await withDpopDatabase((db) => db.get("keys", id));
+    if (existing) return await validateKey(existing, id);
+    if (options.create === false) throw keyLost();
+    const pair = await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, false, ["sign", "verify"]);
+    const exported = await crypto.subtle.exportKey("jwk", pair.publicKey);
+    if (!exported.x || !exported.y) throw keyLost();
+    const publicJwk = { kty: "EC", crv: "P-256", x: exported.x, y: exported.y };
+    const candidate = {
+      version: 1,
+      scopeId: id,
+      privateKey: pair.privateKey,
+      publicJwk,
+      jkt: await calculateJwkThumbprint(publicJwk)
+    };
+    const winner = await withDpopDatabase(async (db) => {
+      const transaction = db.transaction("keys", "readwrite");
+      const stored = await transaction.store.get(id);
+      if (!stored) await transaction.store.add(candidate, id);
+      await transaction.done;
+      return stored ?? candidate;
+    });
+    return await validateKey(winner, id);
+  } catch (error) {
+    if (error instanceof OidcVaultDpopClientError) throw error;
+    throw new OidcVaultDpopClientError(
+      "DPOP_KEY_STORAGE_UNAVAILABLE",
+      "Non-extractable IndexedDB key persistence is unavailable.",
+      true
+    );
+  }
+};
+
+// src/dpop-proof.ts
+import { base64url, SignJWT } from "jose";
+var createDpopProof = async (key, input) => {
+  const { method, url, accessToken, nonce, now = Date.now } = input;
+  if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(method) || method !== method.toUpperCase()) {
+    throw new OidcVaultDpopClientError("INVALID_DPOP_METHOD", "Use the exact uppercase request method.");
+  }
+  const iat = Math.floor(now() / 1e3);
+  if (!Number.isSafeInteger(iat) || iat < 0)
+    throw new OidcVaultDpopClientError("INVALID_DPOP_TIME", "The proof clock is invalid.");
+  if (nonce !== void 0 && (nonce.length === 0 || nonce.length > 512 || !/^[\x20-\x7e]+$/.test(nonce))) {
+    throw new OidcVaultDpopClientError("INVALID_DPOP_NONCE", "The DPoP nonce is invalid.");
+  }
+  let ath;
+  if (accessToken !== void 0) {
+    if (!/^[\x21-\x7e]+$/.test(accessToken))
+      throw new OidcVaultDpopClientError("INVALID_DPOP_TOKEN", "The access token is invalid.");
+    ath = base64url.encode(
+      new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(accessToken)))
+    );
+  }
+  const jti = base64url.encode(crypto.getRandomValues(new Uint8Array(16)));
+  return new SignJWT({
+    htm: method,
+    htu: normalizeDpopTarget(url),
+    iat,
+    jti,
+    ...ath === void 0 ? {} : { ath },
+    ...nonce === void 0 ? {} : { nonce }
+  }).setProtectedHeader({ typ: "dpop+jwt", alg: "ES256", jwk: { ...key.publicJwk } }).sign(key.privateKey);
+};
+
+// src/auth-session.ts
+import { base64url as base64url2 } from "jose";
+
+// src/credentials.ts
+import { decodeJwt, decodeProtectedHeader } from "jose";
+var invalidCredentials = () => new OidcVaultDpopClientError(
+  "INVALID_BOUND_CREDENTIAL_RESPONSE",
+  "A matching DPoP JWT response is required. Sign in again.",
+  true
+);
+var parseDpopCredentials = (value, transport, jkt, now) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw invalidCredentials();
+  const { accessToken, tokenType, expiresIn, sessionId, user } = value;
+  if (typeof accessToken !== "string" || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(accessToken) || tokenType !== "DPoP" || typeof expiresIn !== "number" || !Number.isSafeInteger(expiresIn) || expiresIn < 0 || transport === "body" && (typeof sessionId !== "string" || sessionId.length === 0) || transport === "cookie" && "sessionId" in value)
+    throw invalidCredentials();
+  let expiration;
+  try {
+    const header = decodeProtectedHeader(accessToken);
+    const claims = decodeJwt(accessToken);
+    const cnf = claims.cnf;
+    if (!header.alg || header.alg === "none" || header.b64 === false || typeof cnf !== "object" || cnf === null || Array.isArray(cnf) || !("jkt" in cnf) || cnf.jkt !== jkt || typeof claims.exp !== "number" || !Number.isSafeInteger(claims.exp) || claims.exp < 0)
+      throw invalidCredentials();
+    expiration = Math.min(now + expiresIn * 1e3, claims.exp * 1e3);
+    if (!Number.isSafeInteger(expiration)) throw invalidCredentials();
+  } catch {
+    throw invalidCredentials();
+  }
+  if (user !== void 0 && (typeof user !== "object" || user === null || Array.isArray(user) || !("sub" in user) || typeof user.sub !== "string"))
+    throw invalidCredentials();
+  const token = Object.freeze({
+    accessToken,
+    tokenType,
+    expiresAt: expiration,
+    jkt,
+    generation: crypto.randomUUID(),
+    ...user === void 0 ? {} : { user: structuredClone(user) }
+  });
+  return { token, ...transport === "body" ? { sessionId } : {} };
+};
+var readPeerToken = (value, jkt, generation, now) => {
+  if (typeof value !== "object" || value === null) return void 0;
+  const candidate = value;
+  if (candidate.jkt !== jkt || candidate.generation !== generation || candidate.tokenType !== "DPoP" || !Number.isSafeInteger(candidate.expiresAt) || candidate.expiresAt <= now)
+    return void 0;
+  try {
+    const { token } = parseDpopCredentials(
+      {
+        accessToken: candidate.accessToken,
+        tokenType: candidate.tokenType,
+        expiresIn: Math.ceil((candidate.expiresAt - now) / 1e3),
+        user: candidate.user
+      },
+      "cookie",
+      jkt,
+      now
+    );
+    return Object.freeze({ ...token, expiresAt: Math.min(token.expiresAt, candidate.expiresAt), generation });
+  } catch {
+    return void 0;
+  }
+};
+
+// src/nonce-cache.ts
+var DpopNonceCache = class {
+  constructor() {
+    this.nonces = /* @__PURE__ */ new Map();
+  }
+  get(space, jkt) {
+    return this.nonces.get(JSON.stringify([space, jkt]));
+  }
+  remember(space, jkt, nonce) {
+    if (!nonce || nonce.length > 512 || !/^[\x20-\x7e]+$/.test(nonce)) return false;
+    this.nonces.set(JSON.stringify([space, jkt]), nonce);
+    return true;
+  }
+  clear() {
+    this.nonces.clear();
+  }
+};
+
+// src/auth-session.ts
+var createOidcVaultDpopSession = (options) => {
+  const {
+    backendOrigin,
+    basePath = "/auth/oidc",
+    sessionTransport = "body",
+    fingerprint,
+    fetch: request = globalThis.fetch.bind(globalThis),
+    navigate = (url) => location.assign(url),
+    now = Date.now
+  } = options;
+  if (sessionTransport !== "body" && sessionTransport !== "cookie") throw new TypeError("Unknown session transport.");
+  assertDpopBrowserFeatures(sessionTransport === "cookie");
+  const scope = resolveDpopScope({ frontendOrigin: location.origin, backendOrigin, basePath });
+  const storageKey = `oidc-vault-dpop:handle:${scope.id}`;
+  const pendingKey = `oidc-vault-dpop:pending:${scope.id}`;
+  const lockName = `oidc-vault-dpop:cookie:${scope.id}`;
+  const sender = crypto.randomUUID();
+  const nonces = new DpopNonceCache();
+  const channel = sessionTransport === "cookie" ? new BroadcastChannel(lockName) : void 0;
+  let token;
+  let tokenRecognition;
+  let refreshPromise;
+  let disposed = false;
+  let epoch = 0;
+  const peerWaiters = /* @__PURE__ */ new Set();
+  const readStorage = (key) => {
+    try {
+      const value = sessionStorage.getItem(key);
+      return value === null ? void 0 : JSON.parse(value);
+    } catch {
+      throw new OidcVaultDpopClientError(
+        "DPOP_SESSION_STORAGE_UNAVAILABLE",
+        "Session storage is unavailable. Sign in again.",
+        true
+      );
+    }
+  };
+  const store = (key, value) => {
+    try {
+      if (value === void 0) sessionStorage.removeItem(key);
+      else sessionStorage.setItem(key, JSON.stringify(value));
+    } catch {
+      throw new OidcVaultDpopClientError(
+        "DPOP_SESSION_STORAGE_UNAVAILABLE",
+        "Session storage is unavailable. Sign in again.",
+        true
+      );
+    }
+  };
+  readStorage(pendingKey);
+  const clearLocal = (clearPendingLogin = true) => {
+    token = void 0;
+    tokenRecognition = void 0;
+    epoch++;
+    nonces.clear();
+    store(storageKey);
+    if (clearPendingLogin) store(pendingKey);
+  };
+  const assertLive = () => {
+    if (disposed) throw new OidcVaultDpopClientError("DPOP_SESSION_DISPOSED", "This browser auth context is closed.");
+  };
+  const withCookieLock = (operation2) => sessionTransport === "cookie" ? navigator.locks.request(lockName, { mode: "exclusive" }, operation2) : operation2();
+  const invalidate = async () => {
+    const oldJkt = token?.jkt;
+    clearLocal();
+    if (channel) {
+      const previous = await readCookieSessionVersion(scope.id);
+      const jkt = oldJkt ?? previous?.jkt ?? "";
+      const generation = crypto.randomUUID();
+      await writeCookieSessionVersion(scope.id, { jkt, generation, active: false });
+      channel.postMessage({ type: "clear", sender, jkt, generation });
+    }
+  };
+  const existingKey = async (expectedJkt) => {
+    assertLive();
+    const key = await getOrCreateDpopKey(scope, { create: false });
+    if (expectedJkt !== void 0 && expectedJkt !== key.jkt) throw keyLost();
+    return key;
+  };
+  const authenticatedKey = async () => {
+    const expected = token?.jkt ?? (sessionTransport === "body" ? readStorage(storageKey)?.jkt : (await readCookieSessionVersion(scope.id))?.jkt);
+    const key = await existingKey(expected);
+    if (!expected) throw loginRequired();
+    return key;
+  };
+  const recognitionMarker = async (headers) => base64url2.encode(
+    new Uint8Array(
+      await crypto.subtle.digest(
+        "SHA-256",
+        new TextEncoder().encode(
+          JSON.stringify(
+            Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value]).sort(([a], [b]) => a.localeCompare(b))
+          )
+        )
+      )
+    )
+  );
+  const currentRecognition = async () => recognitionMarker(await fingerprint?.headers() ?? {});
+  const post = async (route, body, key) => {
+    const url = `${scope.backendOrigin}${scope.basePath === "/" ? "" : scope.basePath}/${route}`;
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const recognition = route === "logout" ? {} : await fingerprint?.headers() ?? {};
+      const currentKey = await existingKey(key.jkt);
+      const proof = await createDpopProof(currentKey, {
+        method: "POST",
+        url,
+        now,
+        nonce: nonces.get(scope.id, key.jkt)
+      });
+      const response = await request(url, {
+        method: "POST",
+        credentials: route === "login" || route === "exchange" || sessionTransport === "cookie" ? "include" : "omit",
+        redirect: "error",
+        cache: "no-store",
+        headers: { "Content-Type": "application/json", ...recognition, DPoP: proof },
+        body: JSON.stringify(body)
+      });
+      let value;
+      try {
+        value = await response.json();
+      } catch {
+        value = void 0;
+      }
+      if (response.ok) return { value, recognition: await recognitionMarker(recognition) };
+      const error = serverError(response.status, value);
+      if (error.code === "OIDC_VAULT_USE_DPOP_NONCE" && (response.status === 400 || response.status === 401) && attempt === 0 && nonces.remember(scope.id, key.jkt, response.headers.get("DPoP-Nonce")))
+        continue;
+      throw error;
+    }
+    throw new OidcVaultDpopClientError("DPOP_NONCE_RETRY_EXHAUSTED", "The DPoP nonce challenge was repeated.");
+  };
+  const publish = async (next, recognition, operationEpoch) => {
+    await existingKey(next.jkt);
+    if (epoch !== operationEpoch || disposed) throw loginRequired();
+    if (channel) {
+      await writeCookieSessionVersion(scope.id, { jkt: next.jkt, generation: next.generation, active: true });
+    }
+    if (epoch !== operationEpoch || disposed) throw loginRequired();
+    token = next;
+    tokenRecognition = recognition;
+    channel?.postMessage({
+      type: "token",
+      sender,
+      jkt: next.jkt,
+      generation: next.generation,
+      token: next,
+      recognition
+    });
+    return next;
+  };
+  const acceptResponse = async (response, key, operationEpoch) => {
+    if (epoch !== operationEpoch || disposed) throw loginRequired();
+    const parsed = parseDpopCredentials(response.value, sessionTransport, key.jkt, now());
+    if (sessionTransport === "body") store(storageKey, { sessionId: parsed.sessionId, jkt: key.jkt });
+    return publish(parsed.token, response.recognition, operationEpoch);
+  };
+  const adoptPeer = async (message, expectedRecognition) => {
+    if (disposed || message.type !== "token") return void 0;
+    const operationEpoch = epoch;
+    const recognition = expectedRecognition ?? await currentRecognition();
+    if (message.recognition !== recognition) return void 0;
+    const current = await readCookieSessionVersion(scope.id);
+    if (!current?.active || current.jkt !== message.jkt || current.generation !== message.generation) return void 0;
+    const peer = readPeerToken(message.token, current.jkt, current.generation, now());
+    if (!peer) return void 0;
+    await existingKey(current.jkt);
+    const latest = await readCookieSessionVersion(scope.id);
+    if (epoch !== operationEpoch || disposed || !latest?.active || latest.generation !== current.generation)
+      return void 0;
+    token = peer;
+    tokenRecognition = recognition;
+    return peer;
+  };
+  const requestPeer = (jkt, generation, recognition, rejectedToken) => new Promise((resolve) => {
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      peerWaiters.delete(waiter);
+      resolve(value);
+    };
+    const waiter = (message) => {
+      if (message.jkt !== jkt || message.generation !== generation) return;
+      void adoptPeer(message, recognition).then((peer) => {
+        if (peer && peer.accessToken !== rejectedToken) finish(peer);
+      }).catch(() => finish());
+    };
+    const timeout = setTimeout(() => finish(), 180);
+    peerWaiters.add(waiter);
+    channel?.postMessage({ type: "request-token", sender, jkt, generation, recognition });
+  });
+  if (channel)
+    channel.onmessage = (event) => {
+      const message = event.data;
+      if (!message || message.sender === sender || typeof message.sender !== "string" || typeof message.jkt !== "string" || typeof message.generation !== "string" || !["token", "request-token", "clear"].includes(message.type ?? ""))
+        return;
+      const captured = message;
+      if (captured.type === "request-token") {
+        const current = token;
+        if (current?.jkt === captured.jkt && current.generation === captured.generation && current.expiresAt > now() && tokenRecognition === captured.recognition) {
+          channel.postMessage({
+            type: "token",
+            sender,
+            jkt: current.jkt,
+            generation: current.generation,
+            token: current,
+            recognition: tokenRecognition
+          });
+        }
+      } else if (captured.type === "clear") {
+        void withCookieLock(async () => {
+          const version = await readCookieSessionVersion(scope.id);
+          if (!version?.active && version?.generation === captured.generation) clearLocal(false);
+        }).catch(() => clearLocal(false));
+      } else {
+        for (const waiter of peerWaiters) waiter(captured);
+        void adoptPeer(captured).catch(() => clearLocal(false));
+      }
+    };
+  const onFailure = async (error) => {
+    if (!disposed && error instanceof OidcVaultDpopClientError && error.requiresLogin) await invalidate();
+    throw error;
+  };
+  const operation = (run) => withCookieLock(async () => {
+    try {
+      return await run();
+    } catch (error) {
+      return onFailure(error);
+    }
+  });
+  const session = {
+    scopeId: scope.id,
+    sessionTransport,
+    async login(returnTo) {
+      assertLive();
+      await operation(async () => {
+        await invalidate();
+        const key = await getOrCreateDpopKey(scope);
+        store(pendingKey, { jkt: key.jkt });
+        const body = returnTo === void 0 ? {} : { returnTo };
+        const { value } = await post("login", body, key);
+        if (typeof value !== "object" || value === null || !("authorizationUrl" in value) || typeof value.authorizationUrl !== "string") {
+          throw new OidcVaultDpopClientError(
+            "INVALID_LOGIN_RESPONSE",
+            "The login initiation response is invalid.",
+            true
+          );
+        }
+        let url;
+        try {
+          url = new URL(value.authorizationUrl);
+        } catch {
+          throw new OidcVaultDpopClientError(
+            "INVALID_LOGIN_RESPONSE",
+            "The login initiation response is invalid.",
+            true
+          );
+        }
+        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) {
+          throw new OidcVaultDpopClientError(
+            "INVALID_LOGIN_RESPONSE",
+            "The login initiation response is invalid.",
+            true
+          );
+        }
+        navigate(url.href);
+      });
+    },
+    async exchange(code) {
+      assertLive();
+      return operation(async () => {
+        const pending = readStorage(pendingKey);
+        const key = await existingKey(pending?.jkt);
+        if (!pending?.jkt || typeof code !== "string" || code.length === 0) throw loginRequired();
+        const operationEpoch = epoch;
+        const result = await acceptResponse(await post("exchange", { code }, key), key, operationEpoch);
+        store(pendingKey);
+        return result;
+      });
+    },
+    refresh(refreshOptions = {}) {
+      assertLive();
+      if (refreshPromise) return refreshPromise;
+      const run = async () => {
+        const hadToken = token !== void 0;
+        const baseline = token?.generation ?? (channel ? (await readCookieSessionVersion(scope.id))?.generation : void 0);
+        return operation(async () => {
+          const key = await authenticatedKey();
+          if (channel) {
+            const recognition = await currentRecognition();
+            const version = await readCookieSessionVersion(scope.id);
+            if (!version?.active || version.jkt !== key.jkt) throw loginRequired();
+            const current = token;
+            if (refreshOptions.rejectedToken && current && current.accessToken !== refreshOptions.rejectedToken && current.expiresAt > now() && current.generation === version.generation && tokenRecognition === recognition)
+              return current;
+            if ((!hadToken || current?.generation !== baseline) && current && current.expiresAt > now() && current.accessToken !== refreshOptions.rejectedToken && current.generation === version.generation && tokenRecognition === recognition)
+              return current;
+            if (!hadToken || version.generation !== baseline) {
+              const peer = await requestPeer(key.jkt, version.generation, recognition, refreshOptions.rejectedToken);
+              if (peer) return peer;
+            }
+          }
+          if (!channel && refreshOptions.rejectedToken && token && token.accessToken !== refreshOptions.rejectedToken && token.expiresAt > now() && tokenRecognition === await currentRecognition())
+            return token;
+          const handle = sessionTransport === "body" ? readStorage(storageKey) : void 0;
+          if (sessionTransport === "body" && (!handle?.sessionId || handle.jkt !== key.jkt)) throw loginRequired();
+          const operationEpoch = epoch;
+          return acceptResponse(
+            await post("refresh", handle ? { sessionId: handle.sessionId } : {}, key),
+            key,
+            operationEpoch
+          );
+        });
+      };
+      const pending = run();
+      refreshPromise = pending;
+      void pending.finally(() => {
+        if (refreshPromise === pending) refreshPromise = void 0;
+      }).catch(() => {
+      });
+      return pending;
+    },
+    async logout() {
+      assertLive();
+      await operation(async () => {
+        const key = await authenticatedKey();
+        const handle = sessionTransport === "body" ? readStorage(storageKey) : void 0;
+        if (sessionTransport === "body" && !handle?.sessionId) throw loginRequired();
+        const { value } = await post("logout", handle ? { sessionId: handle.sessionId } : {}, key);
+        if (typeof value !== "object" || value === null || !("loggedOut" in value) || value.loggedOut !== true) {
+          throw new OidcVaultDpopClientError("INVALID_LOGOUT_RESPONSE", "The logout response is invalid.");
+        }
+        await invalidate();
+      });
+    },
+    getAccessToken: () => token,
+    getKey: () => operation(authenticatedKey),
+    clear: () => withCookieLock(invalidate),
+    dispose() {
+      disposed = true;
+      epoch++;
+      token = void 0;
+      tokenRecognition = void 0;
+      channel?.close();
+      peerWaiters.clear();
+    }
+  };
+  return Object.freeze(session);
+};
+
+// src/auth-fetch.ts
+var defaultNonces = /* @__PURE__ */ new WeakMap();
+var nonceCache = (context) => {
+  if (context.nonces) return context.nonces;
+  let cache = defaultNonces.get(context.session);
+  if (!cache) {
+    cache = new DpopNonceCache();
+    defaultNonces.set(context.session, cache);
+  }
+  return cache;
+};
+var replayableBody = (body) => {
+  if (body === void 0 || body === null || typeof body === "string") return () => body;
+  if (body instanceof URLSearchParams) {
+    const snapshot = body.toString();
+    return () => new URLSearchParams(snapshot);
+  }
+  if (body instanceof Blob) {
+    const snapshot = body.slice();
+    return () => snapshot.slice();
+  }
+  if (body instanceof ArrayBuffer) {
+    const snapshot = body.slice(0);
+    return () => snapshot.slice(0);
+  }
+  if (ArrayBuffer.isView(body)) {
+    const snapshot = new Uint8Array(body.buffer, body.byteOffset, body.byteLength).slice();
+    return () => snapshot.slice();
+  }
+  if (body instanceof FormData) {
+    const entries = [...body.entries()];
+    return () => {
+      const copy = new FormData();
+      for (const [name, value] of entries) copy.append(name, value);
+      return copy;
+    };
+  }
+  throw new OidcVaultDpopClientError("DPOP_BODY_NOT_REPLAYABLE", "Retry requires a replayable request body.");
+};
+var challengeError = (response) => response.status === 401 ? /(?:^|,\s*)DPoP\s+error="([a-z_]+)"(?:,|$)/i.exec(response.headers.get("WWW-Authenticate") ?? "")?.[1] : void 0;
+var fetchWithDpop = async (context, input, options = {}) => {
+  const target = normalizeDpopTarget(input);
+  const url = new URL(typeof input === "string" ? input : input.href);
+  const api = context.apis.find((candidate) => normalizeStaticOrigin(candidate.origin) === url.origin);
+  if (!api || !api.replayNamespace || api.replayNamespace.length > 128 || !/^[\x20-\x7e]+$/.test(api.replayNamespace)) {
+    throw new OidcVaultDpopClientError("DPOP_API_OUT_OF_SCOPE", "The API target is outside the configured auth scope.");
+  }
+  const { session, fetch: request = globalThis.fetch.bind(globalThis), now = Date.now } = context;
+  const { retry, ...init } = options;
+  const method = (init.method ?? "GET").toUpperCase();
+  if (retry !== void 0 && retry !== "never" && retry !== "idempotent")
+    throw new TypeError("Unknown DPoP retry policy.");
+  const canRetry = retry !== "never" && (["GET", "HEAD", "OPTIONS"].includes(method) || retry === "idempotent");
+  const body = canRetry ? replayableBody(init.body) : () => init.body;
+  const headers = new Headers(init.headers);
+  for (const name of ["Authorization", "DPoP", "Cookie", "Proxy-Authorization"]) {
+    if (headers.has(name))
+      throw new OidcVaultDpopClientError("DPOP_AUTH_HEADER_OVERRIDE", "The DPoP helper owns authentication headers.");
+  }
+  const space = JSON.stringify(["api", url.origin, api.replayNamespace]);
+  const nonces = nonceCache(context);
+  let nonceRetried = false;
+  let refreshed = false;
+  let credential = session.getAccessToken();
+  if (!credential || credential.expiresAt <= now()) {
+    credential = await session.refresh();
+    refreshed = true;
+  }
+  for (; ; ) {
+    if (options.signal?.aborted) throw options.signal.reason;
+    if (credential.tokenType !== "DPoP") {
+      await session.clear();
+      throw new OidcVaultDpopClientError(
+        "DPOP_TOKEN_TYPE_REQUIRED",
+        "A DPoP access token is required. Sign in again.",
+        true
+      );
+    }
+    const key = await session.getKey();
+    if (key.jkt !== credential.jkt) {
+      await session.clear();
+      throw loginRequired();
+    }
+    const proof = await createDpopProof(key, {
+      method,
+      url: target,
+      accessToken: credential.accessToken,
+      nonce: nonces.get(space, key.jkt),
+      now
+    });
+    const attemptHeaders = new Headers(headers);
+    attemptHeaders.set("Authorization", `DPoP ${credential.accessToken}`);
+    attemptHeaders.set("DPoP", proof);
+    const response = await request(url.href, {
+      ...init,
+      method,
+      body: body(),
+      headers: attemptHeaders,
+      credentials: api.credentials ?? "omit",
+      redirect: "error",
+      cache: "no-store"
+    });
+    if (challengeError(response) === "use_dpop_nonce" && canRetry && !nonceRetried && nonces.remember(space, key.jkt, response.headers.get("DPoP-Nonce"))) {
+      nonceRetried = true;
+      await response.body?.cancel();
+      continue;
+    }
+    if (challengeError(response) === "invalid_token" && canRetry && !refreshed) {
+      refreshed = true;
+      await response.body?.cancel();
+      credential = await session.refresh({ rejectedToken: credential.accessToken });
+      continue;
+    }
+    return response;
+  }
+};
+
+// src/device-fingerprint.ts
+var COLLIDING_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "www-authenticate",
+  "proxy-authenticate",
+  "authentication-info",
+  "proxy-authentication-info",
+  "dpop",
+  "dpop-nonce",
+  "cookie",
+  "set-cookie",
+  "origin",
+  "referer",
+  "host",
+  "forwarded",
+  "accept",
+  "accept-charset",
+  "accept-encoding",
+  "accept-language",
+  "connection",
+  "keep-alive",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var isPrintableAscii = (value) => {
+  for (let index = 0; index < value.length; index++) {
+    const byte = value.charCodeAt(index);
+    if (byte < 32 || byte > 126) return false;
+  }
+  return true;
+};
+var createDeviceFingerprint = (source, options = {}) => {
+  const { headerName: configuredHeaderName } = options;
+  const headerName = configuredHeaderName === void 0 ? "X-Device-Fingerprint" : configuredHeaderName;
+  if (typeof headerName !== "string" || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(headerName) || !isPrintableAscii(headerName)) {
+    throw new Error("Fingerprint header name is invalid.");
+  }
+  const normalized = headerName.toLowerCase();
+  if (COLLIDING_HEADERS.has(normalized) || ["content-", "x-forwarded-", "access-control-", "sec-fetch-"].some((prefix) => normalized.startsWith(prefix))) {
+    throw new Error("Fingerprint header name collides with a protocol header.");
+  }
+  return Object.freeze({
+    async headers() {
+      let signal;
+      try {
+        signal = await source();
+      } catch {
+        throw new Error("Browser recognition is unavailable.");
+      }
+      if (signal === void 0) return Object.freeze({});
+      if (typeof signal !== "string" || signal.length === 0 || signal.length > 256 || !isPrintableAscii(signal)) {
+        throw new Error("Fingerprint signal is invalid.");
+      }
+      return Object.freeze({ [headerName]: signal });
+    }
+  });
+};
+var fingerprintJsSignalSource = (load) => {
+  let pendingAgent;
+  return async () => {
+    const pending = pendingAgent ??= Promise.resolve().then(load);
+    let agent;
+    try {
+      agent = await pending;
+    } catch (error) {
+      if (pendingAgent === pending) pendingAgent = void 0;
+      throw error;
+    }
+    return (await agent.get()).visitorId;
+  };
+};
+export {
+  DpopNonceCache,
+  OidcVaultDpopClientError,
+  createDeviceFingerprint,
+  createDpopProof,
+  createOidcVaultDpopSession,
+  fetchWithDpop,
+  fingerprintJsSignalSource,
+  getOrCreateDpopKey
+};