@web-ts-toolkit/oidc-vault-dpop-client 0.48.0

package/llms.txt

@@ -0,0 +1,45 @@
+@web-ts-toolkit/oidc-vault-dpop-client: browser-only DPoP client for
+@web-ts-toolkit/express-oidc-vault vault flows (body + cookie transports).
+Vanilla TS, no framework, no default export. Full guide: README.md.
+
+Install: pnpm add @web-ts-toolkit/oidc-vault-dpop-client
+(jose + idb ride as dependencies; no separate install needed.)
+
+Imports (named root only):
+  import { createOidcVaultDpopSession, fetchWithDpop } from
+    '@web-ts-toolkit/oidc-vault-dpop-client';
+Also root-exported: getOrCreateDpopKey, createDpopProof, DpopNonceCache,
+createDeviceFingerprint, fingerprintJsSignalSource, OidcVaultDpopClientError,
+plus DpopKey/Scope, DpopAccessToken, DpopFetchContext/Options/Api,
+OidcVaultDpopSession/Options, DeviceFingerprint types.
+
+Workflow 1 — vault session lifecycle:
+  session = createOidcVaultDpopSession({ backendOrigin, basePath,
+    sessionTransport: 'body' | 'cookie' });  // basePath = exact mount
+  login(returnTo?) -> exchange(code) -> getAccessToken/refresh -> logout.
+  login/exchange always credentials:include; refresh/logout body=omit+sessionId,
+  cookie=include+{} (never sessionId in cookie JSON). Vault nonce failures are
+  HTTP 400 OIDC_VAULT_USE_DPOP_NONCE with one retry. Key loss (DPOP_KEY_LOST)
+  requires fresh login; never fall back to Bearer or ephemeral keys.
+  Access JWT: memory only. Body handle: tab-local sessionStorage. Cookie
+  handle: backend HttpOnly. Keys: IndexedDB scoped
+  [frontendOrigin, backendOrigin, basePath]. Cookie mode also needs Web Locks
+  + BroadcastChannel. Cross-site HTTPS needs transactionCookie sameSite none,
+  trustedOrigins, credentialed CORS exposing DPoP-Nonce/WWW-Authenticate.
+
+Workflow 2 — bound API fetch:
+  fetchWithDpop({ session, apis: [{ origin, replayNamespace }] }, url, opts?).
+  Owns Authorization/DPoP, redirect:error, no-store; fresh proof+ath per
+  attempt. API nonce failures are 401 use_dpop_nonce with one retry; only
+  invalid_token triggers one refresh. GET/HEAD/OPTIONS retryable; mutations
+  single-attempt unless retry:'idempotent' with a server idempotency contract.
+
+Workflow 3 — optional recognition (opt-in change detection, never PoP):
+  fingerprint = createDeviceFingerprint(async () => signal | undefined);
+  Pass { fingerprint } to session options. 403
+  OIDC_VAULT_FINGERPRINT_REAUTH_REQUIRED -> clear auth, fresh login.
+
+Limits: Chromium 151 + Firefox 153 evidenced (same-site loopback); Safari/
+WebKit uncertified; third-party-cookie policy is deployment-specific.
+Backend wire tables stay authoritative in express-oidc-vault README.
+Live example: apps/oidc-vault-dpop-example (both transports + browsers).

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@web-ts-toolkit/oidc-vault-dpop-client",
+  "description": "DPoP browser client for @web-ts-toolkit/express-oidc-vault with body+cookie transports",
+  "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/oidc-vault-dpop-client",
+  "version": "0.48.0",
+  "sideEffects": false,
+  "keywords": [
+    "oidc",
+    "dpop",
+    "browser",
+    "authentication",
+    "proof-of-possession"
+  ],
+  "main": "./index.js",
+  "module": "./index.mjs",
+  "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "types": {
+        "import": "./index.d.mts",
+        "require": "./index.d.ts"
+      },
+      "import": "./index.mjs",
+      "require": "./index.js"
+    }
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "browserslist": [
+    "chrome >= 94",
+    "edge >= 94",
+    "firefox >= 93",
+    "safari >= 16"
+  ],
+  "dependencies": {
+    "idb": "^8.0.3",
+    "jose": "^6.1.0"
+  },
+  "files": [
+    "**/*",
+    "!**/*.map"
+  ],
+  "author": "Junmin Ahn",
+  "bugs": {
+    "url": "https://github.com/egose/web-ts-toolkit/issues"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/egose/web-ts-toolkit.git",
+    "directory": "packages/oidc-vault-dpop-client"
+  }
+}