@web-ts-toolkit/oidc-vault-dpop-client 0.51.0 → 0.52.0

package/index.mjs

@@ -13,21 +13,54 @@ var OidcVaultDpopClientError = class extends Error {
 };
 var keyLost = () => new OidcVaultDpopClientError("DPOP_KEY_LOST", "The browser login key is missing or changed. Sign in again.", true);
 var loginRequired = () => new OidcVaultDpopClientError("LOGIN_REQUIRED", "Sign in to continue.", true);
-var SERVER_MESSAGES = Object.freeze({
+var vaultRequestTimeout = () => new OidcVaultDpopClientError("DPOP_REQUEST_TIMEOUT", "The vault request timed out.");
+var vaultResponseTooLarge = () => new OidcVaultDpopClientError("DPOP_RESPONSE_TOO_LARGE", "The vault response exceeded the size limit.");
+var TERMINAL_SERVER_MESSAGES = Object.freeze({
   OIDC_VAULT_FINGERPRINT_REAUTH_REQUIRED: "Browser recognition changed; sign in again.",
+  OIDC_VAULT_DEVICE_BINDING_REQUIRED: "A device-bound login is required.",
+  OIDC_VAULT_INVALID_BROWSER_BINDING: "Login browser binding validation failed.",
+  OIDC_VAULT_INVALID_SESSION: "Session is missing or expired.",
+  OIDC_VAULT_MISSING_SESSION_ID: "Session handle is missing.",
+  OIDC_VAULT_MALFORMED_SESSION_COOKIE: "Session cookie is malformed.",
+  OIDC_VAULT_INVALID_EXCHANGE_CODE: "Exchange code is invalid or expired."
+});
+var NON_TERMINAL_SERVER_MESSAGES = Object.freeze({
   OIDC_VAULT_INVALID_FINGERPRINT: "Fingerprint signal is invalid.",
   OIDC_VAULT_USE_DPOP_NONCE: "A fresh DPoP nonce is required.",
   OIDC_VAULT_INVALID_DPOP_PROOF: "DPoP proof validation failed.",
   OIDC_VAULT_DPOP_REQUIRED: "DPoP authentication is required.",
-  OIDC_VAULT_DEVICE_BINDING_REQUIRED: "A device-bound login is required.",
-  OIDC_VAULT_INVALID_BROWSER_BINDING: "Login browser binding validation failed.",
-  OIDC_VAULT_INVALID_SESSION: "Session is missing or expired.",
-  OIDC_VAULT_DPOP_REPLAY_UNAVAILABLE: "DPoP replay protection is unavailable."
+  OIDC_VAULT_DPOP_REPLAY_UNAVAILABLE: "DPoP replay protection is unavailable.",
+  OIDC_VAULT_UNTRUSTED_ORIGIN: "The request origin is not trusted.",
+  OIDC_VAULT_INVALID_RETURN_TO: "The login return target is invalid.",
+  OIDC_VAULT_MISSING_EXCHANGE_CODE: "The exchange request is missing a code.",
+  OIDC_VAULT_REQUEST_BODY_TOO_LARGE: "The vault request body exceeds the size limit.",
+  OIDC_VAULT_REQUEST_BODY_PARAMETER_LIMIT_EXCEEDED: "The vault request has too many parameters.",
+  OIDC_VAULT_UNSUPPORTED_REQUEST_BODY_ENCODING: "The vault request body encoding is unsupported.",
+  OIDC_VAULT_UNSUPPORTED_REQUEST_BODY_TYPE: "The vault request body type is unsupported.",
+  OIDC_VAULT_MALFORMED_REQUEST_BODY: "The vault request body is malformed.",
+  OIDC_VAULT_INVALID_REQUEST_BODY: "The vault request body is invalid.",
+  OIDC_VAULT_INTERNAL_ERROR: "The OIDC request failed.",
+  OIDC_VAULT_INVALID_CONFIG: "The OIDC configuration is invalid.",
+  OIDC_VAULT_MISSING_CLIENT_ID: "The OIDC client configuration is incomplete.",
+  OIDC_VAULT_MISSING_JWKS_URI: "The OIDC signing-key configuration is incomplete.",
+  OIDC_VAULT_DISCOVERY_FAILED: "OIDC discovery failed.",
+  OIDC_VAULT_DISCOVERY_INVALID: "OIDC discovery metadata is invalid.",
+  OIDC_VAULT_JWKS_FAILED: "OIDC signing keys are unavailable.",
+  OIDC_VAULT_TOKEN_REQUEST_FAILED: "OIDC token request failed.",
+  OIDC_VAULT_INVALID_TOKEN_RESPONSE: "OIDC token response is invalid.",
+  OIDC_VAULT_INVALID_ID_TOKEN: "OIDC ID token validation failed.",
+  OIDC_VAULT_USERINFO_FAILED: "OIDC userinfo request failed.",
+  OIDC_VAULT_INVALID_USERINFO: "OIDC userinfo response is invalid."
 });
 var serverError = (status, value) => {
-  const code = typeof value === "object" && value !== null && "code" in value && typeof value.code === "string" ? value.code : "OIDC_REQUEST_FAILED";
-  const requiresLogin = status === 401 || code === "OIDC_VAULT_FINGERPRINT_REAUTH_REQUIRED" || code === "OIDC_VAULT_INVALID_BROWSER_BINDING";
-  return new OidcVaultDpopClientError(code, SERVER_MESSAGES[code] ?? "The OIDC request failed.", requiresLogin, status);
+  const code = typeof value === "object" && value !== null && !Array.isArray(value) ? Object.getOwnPropertyDescriptor(value, "code")?.value : void 0;
+  if (typeof code === "string") {
+    if (Object.hasOwn(TERMINAL_SERVER_MESSAGES, code))
+      return new OidcVaultDpopClientError(code, TERMINAL_SERVER_MESSAGES[code], true, status);
+    if (Object.hasOwn(NON_TERMINAL_SERVER_MESSAGES, code))
+      return new OidcVaultDpopClientError(code, NON_TERMINAL_SERVER_MESSAGES[code], false, status);
+  }
+  return new OidcVaultDpopClientError("OIDC_REQUEST_FAILED", "The OIDC request failed.", false, status);
 };
 
 // src/key-database.ts
@@ -58,9 +91,93 @@ var withDpopDatabase = async (operation) => {
   }
 };
 var readCookieSessionVersion = (scopeId) => withDpopDatabase((db) => db.get("cookieSessions", scopeId));
-var writeCookieSessionVersion = (scopeId, value) => withDpopDatabase(async (db) => {
-  await db.put("cookieSessions", value, scopeId);
-});
+var guardDpopTransaction = async (transaction, authority, run) => {
+  let aborted = false;
+  const abort = () => {
+    if (aborted) return;
+    aborted = true;
+    try {
+      transaction.abort();
+    } catch {
+    }
+  };
+  authority?.signal.addEventListener("abort", abort, { once: true });
+  try {
+    const [result] = await Promise.all([
+      Promise.resolve().then(() => {
+        authority?.assertCurrent();
+        return run();
+      }),
+      transaction.done
+    ]);
+    authority?.assertCurrent();
+    return result;
+  } catch (error) {
+    abort();
+    throw error;
+  } finally {
+    authority?.signal.removeEventListener("abort", abort);
+  }
+};
+var writeCookieSessionVersion = async (scopeId, value, authority) => {
+  authority.assertCurrent();
+  await withDpopDatabase(async (db) => {
+    authority.assertCurrent();
+    const transaction = db.transaction("cookieSessions", "readwrite");
+    await guardDpopTransaction(transaction, authority, () => transaction.store.put(value, scopeId));
+  });
+};
+var scopeState = async (transaction, scopeId) => {
+  const keys = transaction.objectStore("keys");
+  const cookies = transaction.objectStore("cookieSessions");
+  const [keyId, key, cookieId, cookie] = await Promise.all([
+    Promise.resolve().then(() => keys.getKey(scopeId)),
+    Promise.resolve().then(() => keys.get(scopeId)),
+    Promise.resolve().then(() => cookies.getKey(scopeId)),
+    Promise.resolve().then(() => cookies.get(scopeId))
+  ]);
+  return {
+    keyPresent: keyId !== void 0,
+    keyJkt: typeof key?.jkt === "string" ? key.jkt : void 0,
+    cookiePresent: cookieId !== void 0,
+    version: cookie && typeof cookie.jkt === "string" && typeof cookie.generation === "string" && typeof cookie.active === "boolean" ? { jkt: cookie.jkt, generation: cookie.generation, active: cookie.active } : void 0
+  };
+};
+var readDpopScopeState = async (scopeId, authority) => {
+  authority.assertCurrent();
+  return withDpopDatabase(async (db) => {
+    authority.assertCurrent();
+    const transaction = db.transaction(["keys", "cookieSessions"], "readonly");
+    return guardDpopTransaction(transaction, authority, () => scopeState(transaction, scopeId));
+  });
+};
+var removeDpopScope = async (scopeId, authority) => {
+  authority.assertCurrent();
+  try {
+    return await withDpopDatabase(async (db) => {
+      authority.assertCurrent();
+      const transaction = db.transaction(["keys", "cookieSessions"], "readwrite");
+      return guardDpopTransaction(transaction, authority, async () => {
+        const previous = await scopeState(transaction, scopeId);
+        authority.assertCurrent();
+        const remove = async (store) => {
+          authority.assertCurrent();
+          await transaction.objectStore(store).delete(scopeId);
+        };
+        await Promise.all([remove("keys"), remove("cookieSessions")]);
+        return previous;
+      });
+    });
+  } catch (error) {
+    authority.assertCurrent();
+    if (error instanceof OidcVaultDpopClientError) throw error;
+    throw new OidcVaultDpopClientError(
+      "DPOP_KEY_STORAGE_UNAVAILABLE",
+      "IndexedDB key persistence is unavailable.",
+      true
+    );
+  }
+};
 
 // src/scope.ts
 var invalidTarget = () => new OidcVaultDpopClientError("INVALID_DPOP_TARGET", "A pinned absolute HTTP(S) target is required.");
@@ -93,12 +210,21 @@ var normalizeDpopTarget = (value) => {
 var normalizeStaticOrigin = (value) => {
   const target = normalizeDpopTarget(value);
   const url = new URL(value);
-  if (url.pathname !== "/" || url.search || url.hash || target !== `${url.origin}/`) throw invalidTarget();
+  if (!/^https?:\/\/[^/\\?#]+\/?$/i.test(value) || url.pathname !== "/" || url.search || url.hash || target !== `${url.origin}/`) {
+    throw invalidTarget();
+  }
   if (url.protocol !== "https:" && !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) {
     throw new OidcVaultDpopClientError("INSECURE_DPOP_ORIGIN", "DPoP requires HTTPS or loopback development.");
   }
   return url.origin;
 };
+var normalizeDpopPathPrefix = (origin, value) => {
+  if (value === void 0) return "/";
+  if (typeof value !== "string" || value.startsWith("//") || /[?#]/.test(value)) throw invalidTarget();
+  const path = normalizePath(origin, value);
+  if (path.startsWith("//")) throw invalidTarget();
+  return path.replace(/\/+$/g, "") || "/";
+};
 var resolveDpopScope = (scope) => {
   const frontendOrigin = normalizeStaticOrigin(scope.frontendOrigin);
   const backendOrigin = normalizeStaticOrigin(scope.backendOrigin);
@@ -139,15 +265,26 @@ var validateKey = async (value, scopeId) => {
     throw keyLost();
   return Object.freeze({ privateKey: value.privateKey, publicJwk: Object.freeze({ ...jwk }), jkt: value.jkt, scopeId });
 };
-var getOrCreateDpopKey = async (input, options = {}) => {
+var readOrCreateKey = async (input, create, authority) => {
+  authority?.assertCurrent();
   assertDpopBrowserFeatures();
   const { id } = resolveDpopScope(input);
   try {
-    const existing = await withDpopDatabase((db) => db.get("keys", id));
-    if (existing) return await validateKey(existing, id);
-    if (options.create === false) throw keyLost();
+    const existing = await withDpopDatabase((db) => {
+      authority?.assertCurrent();
+      return db.get("keys", id);
+    });
+    authority?.assertCurrent();
+    if (existing) {
+      const key2 = await validateKey(existing, id);
+      authority?.assertCurrent();
+      return key2;
+    }
+    if (!create) throw keyLost();
     const pair = await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, false, ["sign", "verify"]);
+    authority?.assertCurrent();
     const exported = await crypto.subtle.exportKey("jwk", pair.publicKey);
+    authority?.assertCurrent();
     if (!exported.x || !exported.y) throw keyLost();
     const publicJwk = { kty: "EC", crv: "P-256", x: exported.x, y: exported.y };
     const candidate = {
@@ -157,15 +294,22 @@ var getOrCreateDpopKey = async (input, options = {}) => {
       publicJwk,
       jkt: await calculateJwkThumbprint(publicJwk)
     };
+    authority?.assertCurrent();
     const winner = await withDpopDatabase(async (db) => {
+      authority?.assertCurrent();
       const transaction = db.transaction("keys", "readwrite");
-      const stored = await transaction.store.get(id);
-      if (!stored) await transaction.store.add(candidate, id);
-      await transaction.done;
-      return stored ?? candidate;
+      return guardDpopTransaction(transaction, authority, async () => {
+        const stored = await transaction.store.get(id);
+        authority?.assertCurrent();
+        if (!stored) await transaction.store.add(candidate, id);
+        return stored ?? candidate;
+      });
     });
-    return await validateKey(winner, id);
+    const key = await validateKey(winner, id);
+    authority?.assertCurrent();
+    return key;
   } catch (error) {
+    authority?.assertCurrent();
     if (error instanceof OidcVaultDpopClientError) throw error;
     throw new OidcVaultDpopClientError(
       "DPOP_KEY_STORAGE_UNAVAILABLE",
@@ -174,11 +318,56 @@ var getOrCreateDpopKey = async (input, options = {}) => {
     );
   }
 };
+var getOrCreateLoginDpopKey = (input, authority) => readOrCreateKey(input, true, authority);
+var getOrCreateDpopKey = (input, options = {}) => readOrCreateKey(input, options.create !== false);
 
 // src/dpop-proof.ts
 import { base64url, SignJWT } from "jose";
+
+// src/abort.ts
+var bestEffort = (cleanup) => {
+  try {
+    void Promise.resolve(cleanup()).catch(() => {
+    });
+  } catch {
+  }
+};
+var cancelResponse = (response) => bestEffort(() => response.body?.cancel());
+var assertNotAborted = (signal) => {
+  if (signal?.aborted) throw signal.reason;
+};
+var abortable = (signal, start, discard) => new Promise((resolve, reject) => {
+  const detach = () => signal?.removeEventListener("abort", onAbort);
+  const onAbort = () => {
+    detach();
+    reject(signal.reason);
+  };
+  if (signal?.aborted) {
+    reject(signal.reason);
+    return;
+  }
+  signal?.addEventListener("abort", onAbort, { once: true });
+  const failed = (error) => {
+    detach();
+    reject(signal?.aborted ? signal.reason : error);
+  };
+  try {
+    void Promise.resolve(start()).then((value) => {
+      detach();
+      if (signal?.aborted) {
+        if (discard) bestEffort(() => discard(value));
+        reject(signal.reason);
+      } else resolve(value);
+    }, failed);
+  } catch (error) {
+    failed(error);
+  }
+});
+
+// src/dpop-proof.ts
 var createDpopProof = async (key, input) => {
-  const { method, url, accessToken, nonce, now = Date.now } = input;
+  const { method, url, accessToken, nonce, now = Date.now, signal } = input;
+  assertNotAborted(signal);
   if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(method) || method !== method.toUpperCase()) {
     throw new OidcVaultDpopClientError("INVALID_DPOP_METHOD", "Use the exact uppercase request method.");
   }
@@ -193,83 +382,103 @@ var createDpopProof = async (key, input) => {
     if (!/^[\x21-\x7e]+$/.test(accessToken))
       throw new OidcVaultDpopClientError("INVALID_DPOP_TOKEN", "The access token is invalid.");
     ath = base64url.encode(
-      new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(accessToken)))
+      new Uint8Array(
+        await abortable(signal, () => crypto.subtle.digest("SHA-256", new TextEncoder().encode(accessToken)))
+      )
     );
   }
+  assertNotAborted(signal);
   const jti = base64url.encode(crypto.getRandomValues(new Uint8Array(16)));
-  return new SignJWT({
-    htm: method,
-    htu: normalizeDpopTarget(url),
-    iat,
-    jti,
-    ...ath === void 0 ? {} : { ath },
-    ...nonce === void 0 ? {} : { nonce }
-  }).setProtectedHeader({ typ: "dpop+jwt", alg: "ES256", jwk: { ...key.publicJwk } }).sign(key.privateKey);
+  return abortable(
+    signal,
+    () => new SignJWT({
+      htm: method,
+      htu: normalizeDpopTarget(url),
+      iat,
+      jti,
+      ...ath === void 0 ? {} : { ath },
+      ...nonce === void 0 ? {} : { nonce }
+    }).setProtectedHeader({ typ: "dpop+jwt", alg: "ES256", jwk: { ...key.publicJwk } }).sign(key.privateKey)
+  );
 };
 
 // src/auth-session.ts
-import { base64url as base64url2 } from "jose";
+import { base64url as base64url3 } from "jose";
 
 // src/credentials.ts
-import { decodeJwt, decodeProtectedHeader } from "jose";
+import { base64url as base64url2, decodeJwt, decodeProtectedHeader } from "jose";
 var invalidCredentials = () => new OidcVaultDpopClientError(
   "INVALID_BOUND_CREDENTIAL_RESPONSE",
   "A matching DPoP JWT response is required. Sign in again.",
   true
 );
-var parseDpopCredentials = (value, transport, jkt, now) => {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) throw invalidCredentials();
-  const { accessToken, tokenType, expiresIn, sessionId, user } = value;
-  if (typeof accessToken !== "string" || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(accessToken) || tokenType !== "DPoP" || typeof expiresIn !== "number" || !Number.isSafeInteger(expiresIn) || expiresIn < 0 || transport === "body" && (typeof sessionId !== "string" || sessionId.length === 0) || transport === "cookie" && "sessionId" in value)
-    throw invalidCredentials();
-  let expiration;
+var isSafeNonnegativeInteger = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+var decodeBoundJwtExpiration = (accessToken, jkt) => {
   try {
+    const parts = accessToken.split(".");
+    if (parts.length !== 3 || !parts.every((part) => /^[A-Za-z0-9_-]+$/.test(part) && base64url2.encode(base64url2.decode(part)) === part))
+      throw invalidCredentials();
     const header = decodeProtectedHeader(accessToken);
     const claims = decodeJwt(accessToken);
     const cnf = claims.cnf;
-    if (!header.alg || header.alg === "none" || header.b64 === false || typeof cnf !== "object" || cnf === null || Array.isArray(cnf) || !("jkt" in cnf) || cnf.jkt !== jkt || typeof claims.exp !== "number" || !Number.isSafeInteger(claims.exp) || claims.exp < 0)
+    if (typeof header.alg !== "string" || header.alg.length === 0 || header.alg === "none" || header.b64 === false || typeof jkt !== "string" || jkt.length !== 43 || !/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/.test(jkt) || typeof cnf !== "object" || cnf === null || Array.isArray(cnf) || Reflect.ownKeys(cnf).length !== 1 || !Object.hasOwn(cnf, "jkt") || !("jkt" in cnf) || cnf.jkt !== jkt || !isSafeNonnegativeInteger(claims.exp))
       throw invalidCredentials();
-    expiration = Math.min(now + expiresIn * 1e3, claims.exp * 1e3);
-    if (!Number.isSafeInteger(expiration)) throw invalidCredentials();
+    const expiration = claims.exp * 1e3;
+    if (!isSafeNonnegativeInteger(expiration)) throw invalidCredentials();
+    return expiration;
   } catch {
     throw invalidCredentials();
   }
+};
+var createToken = (accessToken, expiresAt, jkt, generation, user) => {
   if (user !== void 0 && (typeof user !== "object" || user === null || Array.isArray(user) || !("sub" in user) || typeof user.sub !== "string"))
     throw invalidCredentials();
-  const token = Object.freeze({
+  return Object.freeze({
     accessToken,
-    tokenType,
-    expiresAt: expiration,
+    tokenType: "DPoP",
+    expiresAt,
     jkt,
-    generation: crypto.randomUUID(),
+    generation,
     ...user === void 0 ? {} : { user: structuredClone(user) }
   });
+};
+var parseDpopCredentials = (value, transport, jkt, now) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw invalidCredentials();
+  const { accessToken, tokenType, expiresIn, sessionId, user } = value;
+  if (typeof accessToken !== "string" || tokenType !== "DPoP" || !isSafeNonnegativeInteger(expiresIn) || !isSafeNonnegativeInteger(now) || transport === "body" && (typeof sessionId !== "string" || sessionId.length === 0) || transport === "cookie" && "sessionId" in value)
+    throw invalidCredentials();
+  const lifetimeMs = expiresIn * 1e3;
+  if (!isSafeNonnegativeInteger(lifetimeMs)) throw invalidCredentials();
+  const responseDeadline = now + lifetimeMs;
+  if (!isSafeNonnegativeInteger(responseDeadline)) throw invalidCredentials();
+  const expiration = Math.min(responseDeadline, decodeBoundJwtExpiration(accessToken, jkt));
+  const token = createToken(accessToken, expiration, jkt, crypto.randomUUID(), user);
   return { token, ...transport === "body" ? { sessionId } : {} };
 };
 var readPeerToken = (value, jkt, generation, now) => {
-  if (typeof value !== "object" || value === null) return void 0;
-  const candidate = value;
-  if (candidate.jkt !== jkt || candidate.generation !== generation || candidate.tokenType !== "DPoP" || !Number.isSafeInteger(candidate.expiresAt) || candidate.expiresAt <= now)
+  if (!isSafeNonnegativeInteger(now) || typeof value !== "object" || value === null || Array.isArray(value) || "sessionId" in value)
     return void 0;
   try {
-    const { token } = parseDpopCredentials(
-      {
-        accessToken: candidate.accessToken,
-        tokenType: candidate.tokenType,
-        expiresIn: Math.ceil((candidate.expiresAt - now) / 1e3),
-        user: candidate.user
-      },
-      "cookie",
-      jkt,
-      now
-    );
-    return Object.freeze({ ...token, expiresAt: Math.min(token.expiresAt, candidate.expiresAt), generation });
+    const {
+      accessToken,
+      tokenType,
+      expiresAt,
+      jkt: peerJkt,
+      generation: peerGeneration,
+      user
+    } = value;
+    if (typeof accessToken !== "string" || peerJkt !== jkt || peerGeneration !== generation || tokenType !== "DPoP" || !isSafeNonnegativeInteger(expiresAt) || expiresAt <= now)
+      return void 0;
+    const expiration = Math.min(expiresAt, decodeBoundJwtExpiration(accessToken, jkt));
+    if (expiration <= now) return void 0;
+    return createToken(accessToken, expiration, jkt, generation, user);
   } catch {
     return void 0;
   }
 };
 
 // src/nonce-cache.ts
+var MAX_ENTRIES = 64;
 var DpopNonceCache = class {
   constructor() {
     this.nonces = /* @__PURE__ */ new Map();
@@ -277,16 +486,147 @@ var DpopNonceCache = class {
   get(space, jkt) {
     return this.nonces.get(JSON.stringify([space, jkt]));
   }
+  /**
+   * Accept one 1..512-character visible-ASCII value, excluding whitespace,
+   * double quotes, backslashes and commas (including coalesced duplicate header
+   * values). Invalid input returns false without overwriting or changing order.
+   */
   remember(space, jkt, nonce) {
-    if (!nonce || nonce.length > 512 || !/^[\x20-\x7e]+$/.test(nonce)) return false;
-    this.nonces.set(JSON.stringify([space, jkt]), nonce);
+    if (typeof nonce !== "string" || nonce.length > 512 || !/^[\x21\x23-\x2b\x2d-\x5b\x5d-\x7e]+$/.test(nonce))
+      return false;
+    const id = JSON.stringify([space, jkt]);
+    this.nonces.delete(id);
+    if (this.nonces.size === MAX_ENTRIES) this.nonces.delete(this.nonces.keys().next().value);
+    this.nonces.set(id, nonce);
     return true;
   }
+  /** Forget every tuple in this cache; does not invalidate credentials or server nonce state. */
   clear() {
     this.nonces.clear();
   }
 };
 
+// src/session-lifecycle.ts
+var superseded = () => new OidcVaultDpopClientError("DPOP_OPERATION_SUPERSEDED", "This browser auth operation was superseded.");
+var closed = () => new OidcVaultDpopClientError("DPOP_SESSION_DISPOSED", "This browser auth context is closed.");
+var createSessionLifecycle = () => {
+  let disposed = false;
+  let controller = new AbortController();
+  let tail = Promise.resolve();
+  const assertLive = () => {
+    if (disposed) throw closed();
+  };
+  const capture = (current = () => true) => {
+    assertLive();
+    const { signal } = controller;
+    return {
+      signal,
+      isCurrent: () => !disposed && !signal.aborted && current(),
+      assertCurrent() {
+        assertLive();
+        if (signal.aborted || !current()) throw superseded();
+      }
+    };
+  };
+  return {
+    capture,
+    isLive: () => !disposed,
+    invalidate() {
+      assertLive();
+      const previous = controller;
+      controller = new AbortController();
+      previous.abort(superseded());
+      return capture();
+    },
+    enqueue(authority, run) {
+      const pending = tail.then(() => {
+        authority.assertCurrent();
+        return run();
+      });
+      tail = pending.then(
+        () => {
+        },
+        () => {
+        }
+      );
+      return pending;
+    },
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      controller.abort(closed());
+    }
+  };
+};
+
+// src/vault-http.ts
+var requestVaultJson = async (request, url, init, { signal, requestTimeoutMs, maxResponseBytes }) => {
+  assertNotAborted(signal);
+  const controller = new AbortController();
+  const onAbort = () => controller.abort(signal.reason);
+  signal.addEventListener("abort", onAbort, { once: true });
+  const started = performance.now();
+  const timeout = setTimeout(() => controller.abort(vaultRequestTimeout()), requestTimeoutMs);
+  const assertActive = () => {
+    if (!controller.signal.aborted && performance.now() - started >= requestTimeoutMs)
+      controller.abort(vaultRequestTimeout());
+    assertNotAborted(controller.signal);
+  };
+  let response;
+  let reader;
+  let bodyDone = false;
+  try {
+    response = await abortable(
+      controller.signal,
+      () => request(url, { ...init, signal: controller.signal }),
+      cancelResponse
+    );
+    assertActive();
+    const status = response.status;
+    const nonce = response.headers.get("DPoP-Nonce");
+    let value;
+    try {
+      if (response.body) {
+        const bodyReader = response.body.getReader();
+        reader = bodyReader;
+        const decoder = new TextDecoder();
+        let bytes = 0;
+        let text = "";
+        for (; ; ) {
+          assertActive();
+          const chunk = await abortable(controller.signal, () => bodyReader.read());
+          assertActive();
+          if (chunk.done) {
+            bodyDone = true;
+            break;
+          }
+          if (!ArrayBuffer.isView(chunk.value)) throw new TypeError("Invalid vault response body.");
+          if (chunk.value.byteLength > maxResponseBytes - bytes) {
+            controller.abort(vaultResponseTooLarge());
+            assertActive();
+          }
+          bytes += chunk.value.byteLength;
+          text += decoder.decode(chunk.value, { stream: true });
+        }
+        value = JSON.parse(text + decoder.decode());
+      }
+    } catch {
+      assertActive();
+      value = void 0;
+    }
+    assertActive();
+    return { status, nonce, value };
+  } finally {
+    clearTimeout(timeout);
+    signal.removeEventListener("abort", onAbort);
+    if (reader) {
+      const bodyReader = reader;
+      if (!bodyDone) bestEffort(() => bodyReader.cancel());
+      bestEffort(() => bodyReader.releaseLock());
+    } else if (response) cancelResponse(response);
+  }
+};
+
 // src/auth-session.ts
 var createOidcVaultDpopSession = (options) => {
   const {
@@ -294,11 +634,17 @@ var createOidcVaultDpopSession = (options) => {
     basePath = "/auth/oidc",
     sessionTransport = "body",
     fingerprint,
+    requestTimeoutMs = 15e3,
+    maxResponseBytes = 1048576,
     fetch: request = globalThis.fetch.bind(globalThis),
     navigate = (url) => location.assign(url),
     now = Date.now
   } = options;
   if (sessionTransport !== "body" && sessionTransport !== "cookie") throw new TypeError("Unknown session transport.");
+  if (!Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 1 || requestTimeoutMs > 2147483647)
+    throw new TypeError("requestTimeoutMs must be an integer from 1 to 2147483647 milliseconds.");
+  if (!Number.isSafeInteger(maxResponseBytes) || maxResponseBytes < 1)
+    throw new TypeError("maxResponseBytes must be a positive safe integer.");
   assertDpopBrowserFeatures(sessionTransport === "cookie");
   const scope = resolveDpopScope({ frontendOrigin: location.origin, backendOrigin, basePath });
   const storageKey = `oidc-vault-dpop:handle:${scope.id}`;
@@ -309,9 +655,13 @@ var createOidcVaultDpopSession = (options) => {
   const channel = sessionTransport === "cookie" ? new BroadcastChannel(lockName) : void 0;
   let token;
   let tokenRecognition;
+  const cookieBindings = /* @__PURE__ */ new WeakMap();
   let refreshPromise;
-  let disposed = false;
-  let epoch = 0;
+  let resetPromise;
+  const lifecycle = createSessionLifecycle();
+  let publication = 0;
+  let loginIntent = 0;
+  let acceptPeerTokens = true;
   const peerWaiters = /* @__PURE__ */ new Set();
   const readStorage = (key) => {
     try {
@@ -341,39 +691,69 @@ var createOidcVaultDpopSession = (options) => {
   const clearLocal = (clearPendingLogin = true) => {
     token = void 0;
     tokenRecognition = void 0;
-    epoch++;
+    acceptPeerTokens = false;
+    publication++;
+    for (const waiter of peerWaiters) waiter.finish();
     nonces.clear();
     store(storageKey);
     if (clearPendingLogin) store(pendingKey);
   };
-  const assertLive = () => {
-    if (disposed) throw new OidcVaultDpopClientError("DPOP_SESSION_DISPOSED", "This browser auth context is closed.");
+  const invalidateLocal = (clearPendingLogin = true) => {
+    const authority = lifecycle.invalidate();
+    refreshPromise = void 0;
+    resetPromise = void 0;
+    clearLocal(clearPendingLogin);
+    return authority;
   };
   const withCookieLock = (operation2) => sessionTransport === "cookie" ? navigator.locks.request(lockName, { mode: "exclusive" }, operation2) : operation2();
-  const invalidate = async () => {
-    const oldJkt = token?.jkt;
-    clearLocal();
+  const invalidateCookie = async (authority, oldJkt, expected) => {
+    authority.assertCurrent();
     if (channel) {
-      const previous = await readCookieSessionVersion(scope.id);
+      let previous;
+      if (expected !== void 0) {
+        const current = await readDpopScopeState(scope.id, authority);
+        authority.assertCurrent();
+        if (!expected || !current.keyPresent && !current.cookiePresent || current.keyJkt !== void 0 && current.keyJkt !== expected.jkt || current.version && (expected.generation !== void 0 && current.version.generation !== expected.generation || current.version.active && current.version.jkt !== expected.jkt))
+          return;
+        previous = current.version;
+      } else previous = await readCookieSessionVersion(scope.id);
+      authority.assertCurrent();
       const jkt = oldJkt ?? previous?.jkt ?? "";
       const generation = crypto.randomUUID();
-      await writeCookieSessionVersion(scope.id, { jkt, generation, active: false });
+      const next = { jkt, generation, active: false };
+      await writeCookieSessionVersion(scope.id, next, authority);
+      authority.assertCurrent();
+      cookieBindings.set(authority, next);
       channel.postMessage({ type: "clear", sender, jkt, generation });
     }
   };
-  const existingKey = async (expectedJkt) => {
-    assertLive();
+  const existingKey = async (authority, expectedJkt) => {
+    authority.assertCurrent();
+    if (channel && expectedJkt !== void 0)
+      cookieBindings.set(authority, {
+        ...cookieBindings.get(authority),
+        jkt: expectedJkt
+      });
     const key = await getOrCreateDpopKey(scope, { create: false });
+    authority.assertCurrent();
     if (expectedJkt !== void 0 && expectedJkt !== key.jkt) throw keyLost();
     return key;
   };
-  const authenticatedKey = async () => {
-    const expected = token?.jkt ?? (sessionTransport === "body" ? readStorage(storageKey)?.jkt : (await readCookieSessionVersion(scope.id))?.jkt);
-    const key = await existingKey(expected);
+  const authenticatedKey = async (authority) => {
+    authority.assertCurrent();
+    let version;
+    if (!token && channel) {
+      version = await readCookieSessionVersion(scope.id);
+      authority.assertCurrent();
+      if (version) cookieBindings.set(authority, { ...version });
+    }
+    const expected = token?.jkt ?? (sessionTransport === "body" ? readStorage(storageKey)?.jkt : version?.jkt);
+    const key = await existingKey(authority, expected);
+    authority.assertCurrent();
     if (!expected) throw loginRequired();
     return key;
   };
-  const recognitionMarker = async (headers) => base64url2.encode(
+  const recognitionMarker = async (headers) => base64url3.encode(
     new Uint8Array(
       await crypto.subtle.digest(
         "SHA-256",
@@ -385,49 +765,83 @@ var createOidcVaultDpopSession = (options) => {
       )
     )
   );
-  const currentRecognition = async () => recognitionMarker(await fingerprint?.headers() ?? {});
-  const post = async (route, body, key) => {
+  const currentRecognition = async (authority) => {
+    authority.assertCurrent();
+    const headers = await fingerprint?.headers() ?? {};
+    authority.assertCurrent();
+    const marker = await recognitionMarker(headers);
+    authority.assertCurrent();
+    return marker;
+  };
+  const post = async (authority, route, body, key) => {
     const url = `${scope.backendOrigin}${scope.basePath === "/" ? "" : scope.basePath}/${route}`;
-    for (let attempt = 0; attempt < 2; attempt++) {
+    const { jkt } = key;
+    let nonceRetried = false;
+    for (; ; ) {
+      authority.assertCurrent();
       const recognition = route === "logout" ? {} : await fingerprint?.headers() ?? {};
-      const currentKey = await existingKey(key.jkt);
+      const currentKey = await existingKey(authority, jkt);
+      authority.assertCurrent();
       const proof = await createDpopProof(currentKey, {
         method: "POST",
         url,
         now,
-        nonce: nonces.get(scope.id, key.jkt)
-      });
-      const response = await request(url, {
-        method: "POST",
-        credentials: route === "login" || route === "exchange" || sessionTransport === "cookie" ? "include" : "omit",
-        redirect: "error",
-        cache: "no-store",
-        headers: { "Content-Type": "application/json", ...recognition, DPoP: proof },
-        body: JSON.stringify(body)
+        nonce: nonces.get(scope.id, jkt),
+        signal: authority.signal
       });
-      let value;
-      try {
-        value = await response.json();
-      } catch {
-        value = void 0;
+      authority.assertCurrent();
+      const { status, nonce, value } = await requestVaultJson(
+        request,
+        url,
+        {
+          method: "POST",
+          credentials: route === "login" || route === "exchange" || sessionTransport === "cookie" ? "include" : "omit",
+          redirect: "error",
+          cache: "no-store",
+          headers: { "Content-Type": "application/json", ...recognition, DPoP: proof },
+          body: JSON.stringify(body)
+        },
+        { signal: authority.signal, requestTimeoutMs, maxResponseBytes }
+      );
+      authority.assertCurrent();
+      const learnedNonce = nonces.remember(scope.id, jkt, nonce);
+      if (status >= 200 && status < 300) {
+        const marker = await recognitionMarker(recognition);
+        authority.assertCurrent();
+        return { value, recognition: marker };
+      }
+      const error = serverError(status, value);
+      if (error.code === "OIDC_VAULT_USE_DPOP_NONCE" && (status === 400 || status === 401)) {
+        if (nonceRetried)
+          throw new OidcVaultDpopClientError(
+            "DPOP_NONCE_RETRY_EXHAUSTED",
+            "The DPoP nonce challenge was repeated.",
+            false,
+            status
+          );
+        if (learnedNonce) {
+          nonceRetried = true;
+          continue;
+        }
       }
-      if (response.ok) return { value, recognition: await recognitionMarker(recognition) };
-      const error = serverError(response.status, value);
-      if (error.code === "OIDC_VAULT_USE_DPOP_NONCE" && (response.status === 400 || response.status === 401) && attempt === 0 && nonces.remember(scope.id, key.jkt, response.headers.get("DPoP-Nonce")))
-        continue;
       throw error;
     }
-    throw new OidcVaultDpopClientError("DPOP_NONCE_RETRY_EXHAUSTED", "The DPoP nonce challenge was repeated.");
   };
-  const publish = async (next, recognition, operationEpoch) => {
-    await existingKey(next.jkt);
-    if (epoch !== operationEpoch || disposed) throw loginRequired();
+  const publish = async (next, recognition, authority, sessionId) => {
+    await existingKey(authority, next.jkt);
+    authority.assertCurrent();
     if (channel) {
-      await writeCookieSessionVersion(scope.id, { jkt: next.jkt, generation: next.generation, active: true });
+      const version = { jkt: next.jkt, generation: next.generation, active: true };
+      await writeCookieSessionVersion(scope.id, version, authority);
+      authority.assertCurrent();
+      cookieBindings.set(authority, version);
     }
-    if (epoch !== operationEpoch || disposed) throw loginRequired();
+    authority.assertCurrent();
+    if (sessionTransport === "body") store(storageKey, { sessionId, jkt: next.jkt });
     token = next;
     tokenRecognition = recognition;
+    acceptPeerTokens = true;
+    publication++;
     channel?.postMessage({
       type: "token",
       sender,
@@ -438,52 +852,101 @@ var createOidcVaultDpopSession = (options) => {
     });
     return next;
   };
-  const acceptResponse = async (response, key, operationEpoch) => {
-    if (epoch !== operationEpoch || disposed) throw loginRequired();
+  const acceptResponse = async (response, key, authority) => {
+    authority.assertCurrent();
     const parsed = parseDpopCredentials(response.value, sessionTransport, key.jkt, now());
-    if (sessionTransport === "body") store(storageKey, { sessionId: parsed.sessionId, jkt: key.jkt });
-    return publish(parsed.token, response.recognition, operationEpoch);
+    return publish(parsed.token, response.recognition, authority, parsed.sessionId);
+  };
+  const stateAuthority = (current = () => true) => {
+    const captured = publication;
+    return lifecycle.capture(() => publication === captured && current());
+  };
+  const peerAuthority = (current = () => true) => {
+    const intent = loginIntent;
+    return stateAuthority(() => loginIntent === intent && current());
   };
-  const adoptPeer = async (message, expectedRecognition) => {
-    if (disposed || message.type !== "token") return void 0;
-    const operationEpoch = epoch;
-    const recognition = expectedRecognition ?? await currentRecognition();
+  const onPeerKeyFailure = (error, authority, jkt) => {
+    if (!authority.isCurrent() || token?.jkt !== jkt || !(error instanceof OidcVaultDpopClientError) || !error.requiresLogin)
+      return;
+    try {
+      invalidateLocal(false);
+    } catch {
+    }
+  };
+  const adoptPeer = async (message, authority, expectedRecognition) => {
+    authority.assertCurrent();
+    const unsolicited = expectedRecognition === void 0;
+    if (message.type !== "token" || !acceptPeerTokens && unsolicited) return void 0;
+    const recognition = expectedRecognition ?? await currentRecognition(authority);
+    authority.assertCurrent();
     if (message.recognition !== recognition) return void 0;
     const current = await readCookieSessionVersion(scope.id);
+    authority.assertCurrent();
     if (!current?.active || current.jkt !== message.jkt || current.generation !== message.generation) return void 0;
     const peer = readPeerToken(message.token, current.jkt, current.generation, now());
     if (!peer) return void 0;
-    await existingKey(current.jkt);
+    try {
+      await existingKey(authority, current.jkt);
+    } catch (error) {
+      if (unsolicited) onPeerKeyFailure(error, authority, current.jkt);
+      throw error;
+    }
+    authority.assertCurrent();
     const latest = await readCookieSessionVersion(scope.id);
-    if (epoch !== operationEpoch || disposed || !latest?.active || latest.generation !== current.generation)
+    authority.assertCurrent();
+    if (!latest?.active || latest.jkt !== current.jkt || latest.generation !== current.generation || peer.expiresAt <= now())
       return void 0;
+    if (token?.generation === peer.generation && token.accessToken === peer.accessToken && token.expiresAt === peer.expiresAt && tokenRecognition === recognition)
+      return token;
     token = peer;
     tokenRecognition = recognition;
+    acceptPeerTokens = true;
+    publication++;
     return peer;
   };
-  const requestPeer = (jkt, generation, recognition, rejectedToken) => new Promise((resolve) => {
+  const requestPeer = (authority, jkt, generation, recognition, rejectedToken) => new Promise((resolve, reject) => {
+    authority.assertCurrent();
     let settled = false;
+    let adopting = false;
     const finish = (value) => {
       if (settled) return;
       settled = true;
       clearTimeout(timeout);
+      authority.signal.removeEventListener("abort", onInvalidation);
       peerWaiters.delete(waiter);
       resolve(value);
     };
-    const waiter = (message) => {
-      if (message.jkt !== jkt || message.generation !== generation) return;
-      void adoptPeer(message, recognition).then((peer) => {
-        if (peer && peer.accessToken !== rejectedToken) finish(peer);
-      }).catch(() => finish());
+    const onInvalidation = () => finish();
+    const waiter = {
+      finish: () => finish(),
+      receive(message) {
+        if (settled || adopting || message.jkt !== jkt || message.generation !== generation) return;
+        adopting = true;
+        void adoptPeer(
+          message,
+          peerAuthority(() => !settled && authority.isCurrent()),
+          recognition
+        ).then((peer) => {
+          adopting = false;
+          if (peer && peer.accessToken !== rejectedToken) finish(peer);
+        }).catch(() => finish());
+      }
     };
     const timeout = setTimeout(() => finish(), 180);
     peerWaiters.add(waiter);
-    channel?.postMessage({ type: "request-token", sender, jkt, generation, recognition });
+    authority.signal.addEventListener("abort", onInvalidation, { once: true });
+    try {
+      channel?.postMessage({ type: "request-token", sender, jkt, generation, recognition });
+    } catch (error) {
+      reject(error);
+      finish();
+    }
   });
   if (channel)
     channel.onmessage = (event) => {
+      if (!lifecycle.isLive()) return;
       const message = event.data;
-      if (!message || message.sender === sender || typeof message.sender !== "string" || typeof message.jkt !== "string" || typeof message.generation !== "string" || !["token", "request-token", "clear"].includes(message.type ?? ""))
+      if (!message || message.sender === sender || typeof message.sender !== "string" || typeof message.jkt !== "string" || typeof message.generation !== "string" || message.keyJkt !== void 0 && typeof message.keyJkt !== "string" || !["token", "request-token", "clear", "reset-key"].includes(message.type ?? ""))
         return;
       const captured = message;
       if (captured.type === "request-token") {
@@ -498,38 +961,83 @@ var createOidcVaultDpopSession = (options) => {
             recognition: tokenRecognition
           });
         }
-      } else if (captured.type === "clear") {
-        void withCookieLock(async () => {
-          const version = await readCookieSessionVersion(scope.id);
-          if (!version?.active && version?.generation === captured.generation) clearLocal(false);
-        }).catch(() => clearLocal(false));
+      } else if (captured.type === "clear" || captured.type === "reset-key") {
+        const authority = peerAuthority();
+        void lifecycle.enqueue(
+          authority,
+          () => withCookieLock(async () => {
+            authority.assertCurrent();
+            if (captured.type === "clear") {
+              const version = await readCookieSessionVersion(scope.id);
+              authority.assertCurrent();
+              if (!version?.active && version?.generation === captured.generation && version.jkt === captured.jkt)
+                invalidateLocal(false);
+              return;
+            }
+            const current = await readDpopScopeState(scope.id, authority);
+            authority.assertCurrent();
+            if (current.keyPresent || current.cookiePresent) return;
+            const matchesKey = (jkt) => jkt === captured.jkt || jkt === captured.keyJkt;
+            const pending = readStorage(pendingKey);
+            if (pending && !matchesKey(pending.jkt)) return;
+            if (token && !matchesKey(token.jkt) && token.generation !== captured.generation) return;
+            invalidateLocal();
+          })
+        ).catch(() => {
+        });
       } else {
-        for (const waiter of peerWaiters) waiter(captured);
-        void adoptPeer(captured).catch(() => clearLocal(false));
+        if (peerWaiters.size) for (const waiter of peerWaiters) waiter.receive(captured);
+        else {
+          const authority = peerAuthority();
+          void adoptPeer(captured, authority).catch(() => {
+          });
+        }
       }
     };
-  const onFailure = async (error) => {
-    if (!disposed && error instanceof OidcVaultDpopClientError && error.requiresLogin) await invalidate();
+  const onFailure = async (error, authority) => {
+    authority.assertCurrent();
+    if (error instanceof OidcVaultDpopClientError && error.requiresLogin) {
+      const oldJkt = token?.jkt;
+      const expected = token ? { jkt: token.jkt, generation: token.generation } : cookieBindings.get(authority) ?? null;
+      const invalidation = invalidateLocal();
+      await invalidateCookie(invalidation, oldJkt, expected);
+      invalidation.assertCurrent();
+    }
     throw error;
   };
-  const operation = (run) => withCookieLock(async () => {
-    try {
-      return await run();
-    } catch (error) {
-      return onFailure(error);
-    }
-  });
+  const operation = (authority, run) => lifecycle.enqueue(
+    authority,
+    () => withCookieLock(async () => {
+      authority.assertCurrent();
+      try {
+        const result = await run();
+        authority.assertCurrent();
+        return result;
+      } catch (error) {
+        return onFailure(error, authority);
+      }
+    })
+  );
   const session = {
     scopeId: scope.id,
     sessionTransport,
     async login(returnTo) {
-      assertLive();
-      await operation(async () => {
-        await invalidate();
-        const key = await getOrCreateDpopKey(scope);
+      const authority = lifecycle.capture();
+      loginIntent++;
+      refreshPromise = void 0;
+      resetPromise = void 0;
+      await operation(authority, async () => {
+        const oldJkt = token?.jkt;
+        clearLocal();
+        await invalidateCookie(authority, oldJkt);
+        authority.assertCurrent();
+        const key = await getOrCreateLoginDpopKey(scope, authority);
+        authority.assertCurrent();
         store(pendingKey, { jkt: key.jkt });
+        publication++;
         const body = returnTo === void 0 ? {} : { returnTo };
-        const { value } = await post("login", body, key);
+        const { value } = await post(authority, "login", body, key);
+        authority.assertCurrent();
         if (typeof value !== "object" || value === null || !("authorizationUrl" in value) || typeof value.authorizationUrl !== "string") {
           throw new OidcVaultDpopClientError(
             "INVALID_LOGIN_RESPONSE",
@@ -554,56 +1062,69 @@ var createOidcVaultDpopSession = (options) => {
             true
           );
         }
+        authority.assertCurrent();
         navigate(url.href);
       });
     },
     async exchange(code) {
-      assertLive();
-      return operation(async () => {
+      const authority = lifecycle.capture();
+      refreshPromise = void 0;
+      resetPromise = void 0;
+      return operation(authority, async () => {
         const pending = readStorage(pendingKey);
-        const key = await existingKey(pending?.jkt);
+        const key = await existingKey(authority, pending?.jkt);
+        authority.assertCurrent();
         if (!pending?.jkt || typeof code !== "string" || code.length === 0) throw loginRequired();
-        const operationEpoch = epoch;
-        const result = await acceptResponse(await post("exchange", { code }, key), key, operationEpoch);
+        const result = await acceptResponse(await post(authority, "exchange", { code }, key), key, authority);
+        authority.assertCurrent();
         store(pendingKey);
         return result;
       });
     },
     refresh(refreshOptions = {}) {
-      assertLive();
+      const authority = lifecycle.capture();
+      resetPromise = void 0;
       if (refreshPromise) return refreshPromise;
-      const run = async () => {
-        const hadToken = token !== void 0;
-        const baseline = token?.generation ?? (channel ? (await readCookieSessionVersion(scope.id))?.generation : void 0);
-        return operation(async () => {
-          const key = await authenticatedKey();
-          if (channel) {
-            const recognition = await currentRecognition();
-            const version = await readCookieSessionVersion(scope.id);
-            if (!version?.active || version.jkt !== key.jkt) throw loginRequired();
-            const current = token;
-            if (refreshOptions.rejectedToken && current && current.accessToken !== refreshOptions.rejectedToken && current.expiresAt > now() && current.generation === version.generation && tokenRecognition === recognition)
-              return current;
-            if ((!hadToken || current?.generation !== baseline) && current && current.expiresAt > now() && current.accessToken !== refreshOptions.rejectedToken && current.generation === version.generation && tokenRecognition === recognition)
-              return current;
-            if (!hadToken || version.generation !== baseline) {
-              const peer = await requestPeer(key.jkt, version.generation, recognition, refreshOptions.rejectedToken);
-              if (peer) return peer;
-            }
+      const { rejectedToken } = refreshOptions;
+      const hadToken = token !== void 0;
+      const baseline = token?.generation;
+      const pending = operation(authority, async () => {
+        const key = await authenticatedKey(authority);
+        authority.assertCurrent();
+        if (channel) {
+          const recognition = await currentRecognition(authority);
+          authority.assertCurrent();
+          const version = await readCookieSessionVersion(scope.id);
+          authority.assertCurrent();
+          if (!version?.active || version.jkt !== key.jkt) throw loginRequired();
+          const reusable = () => {
+            const current2 = token;
+            if (current2?.jkt === key.jkt && current2.accessToken !== rejectedToken && current2.expiresAt > now() && current2.generation === version.generation && tokenRecognition === recognition)
+              return current2;
+          };
+          const current = reusable();
+          if (current && (rejectedToken || !hadToken || current.generation !== baseline)) return current;
+          if (!hadToken || version.generation !== baseline) {
+            const peer = await requestPeer(authority, key.jkt, version.generation, recognition, rejectedToken);
+            authority.assertCurrent();
+            if (peer) return peer;
+            const winner = reusable();
+            if (winner) return winner;
           }
-          if (!channel && refreshOptions.rejectedToken && token && token.accessToken !== refreshOptions.rejectedToken && token.expiresAt > now() && tokenRecognition === await currentRecognition())
-            return token;
-          const handle = sessionTransport === "body" ? readStorage(storageKey) : void 0;
-          if (sessionTransport === "body" && (!handle?.sessionId || handle.jkt !== key.jkt)) throw loginRequired();
-          const operationEpoch = epoch;
-          return acceptResponse(
-            await post("refresh", handle ? { sessionId: handle.sessionId } : {}, key),
-            key,
-            operationEpoch
-          );
-        });
-      };
-      const pending = run();
+        }
+        if (!channel && rejectedToken && token && token.accessToken !== rejectedToken && token.expiresAt > now() && tokenRecognition === await currentRecognition(authority)) {
+          authority.assertCurrent();
+          return token;
+        }
+        authority.assertCurrent();
+        const handle = sessionTransport === "body" ? readStorage(storageKey) : void 0;
+        if (sessionTransport === "body" && (!handle?.sessionId || handle.jkt !== key.jkt)) throw loginRequired();
+        return acceptResponse(
+          await post(authority, "refresh", handle ? { sessionId: handle.sessionId } : {}, key),
+          key,
+          authority
+        );
+      });
       refreshPromise = pending;
       void pending.finally(() => {
         if (refreshPromise === pending) refreshPromise = void 0;
@@ -612,34 +1133,198 @@ var createOidcVaultDpopSession = (options) => {
       return pending;
     },
     async logout() {
-      assertLive();
-      await operation(async () => {
-        const key = await authenticatedKey();
+      const authority = lifecycle.capture();
+      refreshPromise = void 0;
+      resetPromise = void 0;
+      await operation(authority, async () => {
+        const key = await authenticatedKey(authority);
+        authority.assertCurrent();
         const handle = sessionTransport === "body" ? readStorage(storageKey) : void 0;
         if (sessionTransport === "body" && !handle?.sessionId) throw loginRequired();
-        const { value } = await post("logout", handle ? { sessionId: handle.sessionId } : {}, key);
+        const { value } = await post(authority, "logout", handle ? { sessionId: handle.sessionId } : {}, key);
+        authority.assertCurrent();
         if (typeof value !== "object" || value === null || !("loggedOut" in value) || value.loggedOut !== true) {
           throw new OidcVaultDpopClientError("INVALID_LOGOUT_RESPONSE", "The logout response is invalid.");
         }
-        await invalidate();
+        clearLocal();
+        await invalidateCookie(authority, key.jkt);
       });
     },
     getAccessToken: () => token,
-    getKey: () => operation(authenticatedKey),
-    clear: () => withCookieLock(invalidate),
+    async getKey() {
+      const authority = stateAuthority();
+      try {
+        const pending = !token ? readStorage(pendingKey) : void 0;
+        if (pending) {
+          await existingKey(authority, pending.jkt);
+          authority.assertCurrent();
+          throw loginRequired();
+        }
+        return await authenticatedKey(authority);
+      } catch (error) {
+        authority.assertCurrent();
+        if (error instanceof OidcVaultDpopClientError && error.code === "LOGIN_REQUIRED") throw error;
+        return operation(authority, async () => {
+          throw error;
+        });
+      }
+    },
+    async clear() {
+      const oldJkt = token?.jkt;
+      const authority = invalidateLocal();
+      if (!channel) return;
+      await lifecycle.enqueue(authority, () => withCookieLock(() => invalidateCookie(authority, oldJkt)));
+    },
+    async resetKey() {
+      if (resetPromise) return resetPromise;
+      const oldJkt = token?.jkt;
+      const authority = invalidateLocal();
+      const pending = lifecycle.enqueue(
+        authority,
+        () => withCookieLock(async () => {
+          authority.assertCurrent();
+          const previous = await removeDpopScope(scope.id, authority);
+          authority.assertCurrent();
+          if (previous.keyPresent || previous.cookiePresent)
+            channel?.postMessage({
+              type: "reset-key",
+              sender,
+              jkt: previous.version?.jkt ?? oldJkt ?? "",
+              generation: previous.version?.generation ?? "",
+              keyJkt: previous.keyJkt
+            });
+        })
+      );
+      resetPromise = pending;
+      void pending.finally(() => {
+        if (resetPromise === pending) resetPromise = void 0;
+      }).catch(() => {
+      });
+      await pending;
+    },
     dispose() {
-      disposed = true;
-      epoch++;
+      lifecycle.dispose();
+      publication++;
+      refreshPromise = void 0;
+      resetPromise = void 0;
       token = void 0;
       tokenRecognition = void 0;
+      nonces.clear();
+      for (const waiter of peerWaiters) waiter.finish();
+      if (channel) channel.onmessage = null;
       channel?.close();
-      peerWaiters.clear();
     }
   };
   return Object.freeze(session);
 };
 
+// src/auth-challenge.ts
+var TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var TOKEN68 = /^[A-Za-z0-9._~+/-]+=*$/;
+var PARAMETER = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+)[ \t]*=[ \t]*(.*)$/;
+var CHALLENGE = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+)(?: +(.+))?$/;
+var partsOf = (header) => {
+  const parts = [];
+  let start = 0;
+  const addPart = (end) => {
+    while (start < end && (header[start] === " " || header[start] === "	")) start++;
+    while (end > start && (header[end - 1] === " " || header[end - 1] === "	")) end--;
+    parts.push(header.slice(start, end));
+  };
+  let quoted = false;
+  let escaped = false;
+  for (let index = 0; index < header.length; index++) {
+    const character = header[index];
+    if (escaped) escaped = false;
+    else if (quoted && character === "\\") escaped = true;
+    else if (character === '"') quoted = !quoted;
+    else if (!quoted && character === ",") {
+      addPart(index);
+      start = index + 1;
+    }
+  }
+  if (quoted || escaped) return void 0;
+  addPart(header.length);
+  return parts;
+};
+var parameterOf = (part) => {
+  const match = PARAMETER.exec(part);
+  if (!match) return void 0;
+  const name = match[1].toLowerCase();
+  const raw = match[2];
+  if (TOKEN.test(raw)) return [name, raw];
+  if (raw[0] !== '"') return void 0;
+  let value = "";
+  for (let index = 1; index < raw.length; index++) {
+    const character = raw[index];
+    if (character === '"') return index === raw.length - 1 ? [name, value] : void 0;
+    if (character === "\\") {
+      if (++index === raw.length) return void 0;
+      value += raw[index];
+    } else value += character;
+  }
+  return void 0;
+};
+var readDpopChallengeError = (header) => {
+  if (typeof header !== "string" || header.length > 8192 || !/^[\t\x20-\x7e\x80-\xff]*$/.test(header)) return void 0;
+  const parts = partsOf(header);
+  if (!parts) return void 0;
+  let parameters;
+  let dpopParameters;
+  let seenDpop = false;
+  for (const part of parts) {
+    const parameter = parameterOf(part);
+    if (parameter) {
+      if (!parameters || parameters.has(parameter[0])) return void 0;
+      parameters.set(...parameter);
+      continue;
+    }
+    const challenge = CHALLENGE.exec(part);
+    if (!challenge) return void 0;
+    const isDpop = challenge[1].toLowerCase() === "dpop";
+    if (isDpop && seenDpop) return void 0;
+    if (isDpop) seenDpop = true;
+    parameters = void 0;
+    const credentials = challenge[2];
+    if (credentials !== void 0) {
+      const first = parameterOf(credentials);
+      if (first) parameters = new Map([first]);
+      else if (!TOKEN68.test(credentials)) return void 0;
+    }
+    if (isDpop) dpopParameters = parameters;
+  }
+  const error = dpopParameters?.get("error");
+  return error === "use_dpop_nonce" || error === "invalid_token" ? error : void 0;
+};
+
 // src/auth-fetch.ts
+var invalidApiConfig = () => new OidcVaultDpopClientError("INVALID_DPOP_API_CONFIG", "The API auth scope configuration is invalid or ambiguous.");
+var selectApi = (apis, origin, pathname) => {
+  if (!Array.isArray(apis)) throw invalidApiConfig();
+  const scopes = /* @__PURE__ */ new Set();
+  let selected;
+  for (const candidate of apis) {
+    if (!candidate || typeof candidate !== "object") throw invalidApiConfig();
+    const { origin: configuredOrigin, pathPrefix: configuredPath, replayNamespace, credentials = "omit" } = candidate;
+    if (typeof configuredOrigin !== "string" || typeof replayNamespace !== "string" || !/^[\x20-\x7e]{1,128}$/.test(replayNamespace) || credentials !== "omit" && credentials !== "include")
+      throw invalidApiConfig();
+    const normalizedOrigin = normalizeStaticOrigin(configuredOrigin);
+    const pathPrefix = normalizeDpopPathPrefix(normalizedOrigin, configuredPath);
+    const scope = JSON.stringify([normalizedOrigin, pathPrefix]);
+    if (scopes.has(scope)) throw invalidApiConfig();
+    scopes.add(scope);
+    if (normalizedOrigin !== origin || pathPrefix !== "/" && pathname !== pathPrefix && !pathname.startsWith(`${pathPrefix}/`)) {
+      continue;
+    }
+    if (!selected || pathPrefix.length > selected.pathPrefix.length) {
+      selected = { origin: normalizedOrigin, pathPrefix, replayNamespace, credentials };
+    }
+  }
+  if (!selected) {
+    throw new OidcVaultDpopClientError("DPOP_API_OUT_OF_SCOPE", "The API target is outside the configured auth scope.");
+  }
+  return selected;
+};
 var defaultNonces = /* @__PURE__ */ new WeakMap();
 var nonceCache = (context) => {
   if (context.nonces) return context.nonces;
@@ -678,14 +1363,24 @@ var replayableBody = (body) => {
   }
   throw new OidcVaultDpopClientError("DPOP_BODY_NOT_REPLAYABLE", "Retry requires a replayable request body.");
 };
-var challengeError = (response) => response.status === 401 ? /(?:^|,\s*)DPoP\s+error="([a-z_]+)"(?:,|$)/i.exec(response.headers.get("WWW-Authenticate") ?? "")?.[1] : void 0;
+var assertLiveAccessToken = (expiresAt, now) => {
+  if (!Number.isSafeInteger(now) || now < 0)
+    throw new OidcVaultDpopClientError("INVALID_DPOP_TIME", "The proof clock is invalid.");
+  if (!Number.isSafeInteger(expiresAt) || expiresAt <= now)
+    throw new OidcVaultDpopClientError(
+      "DPOP_ACCESS_TOKEN_EXPIRED",
+      "The DPoP access token has expired. Refresh before retrying."
+    );
+};
 var fetchWithDpop = async (context, input, options = {}) => {
-  const target = normalizeDpopTarget(input);
-  const url = new URL(typeof input === "string" ? input : input.href);
-  const api = context.apis.find((candidate) => normalizeStaticOrigin(candidate.origin) === url.origin);
-  if (!api || !api.replayNamespace || api.replayNamespace.length > 128 || !/^[\x20-\x7e]+$/.test(api.replayNamespace)) {
-    throw new OidcVaultDpopClientError("DPOP_API_OUT_OF_SCOPE", "The API target is outside the configured auth scope.");
-  }
+  const { signal } = options;
+  assertNotAborted(signal);
+  const inputUrl = typeof input === "string" ? input : input.href;
+  const target = normalizeDpopTarget(inputUrl);
+  const url = new URL(inputUrl);
+  url.pathname = new URL(target).pathname;
+  const { href, origin, pathname } = url;
+  const api = selectApi(context.apis, origin, pathname);
   const { session, fetch: request = globalThis.fetch.bind(globalThis), now = Date.now } = context;
   const { retry, ...init } = options;
   const method = (init.method ?? "GET").toUpperCase();
@@ -698,58 +1393,80 @@ var fetchWithDpop = async (context, input, options = {}) => {
     if (headers.has(name))
       throw new OidcVaultDpopClientError("DPOP_AUTH_HEADER_OVERRIDE", "The DPoP helper owns authentication headers.");
   }
-  const space = JSON.stringify(["api", url.origin, api.replayNamespace]);
+  const space = JSON.stringify(["api", api.origin, api.replayNamespace]);
   const nonces = nonceCache(context);
   let nonceRetried = false;
   let refreshed = false;
   let credential = session.getAccessToken();
   if (!credential || credential.expiresAt <= now()) {
-    credential = await session.refresh();
+    credential = await abortable(signal, () => session.refresh());
     refreshed = true;
   }
   for (; ; ) {
-    if (options.signal?.aborted) throw options.signal.reason;
+    assertNotAborted(signal);
     if (credential.tokenType !== "DPoP") {
-      await session.clear();
+      await abortable(signal, () => session.clear());
+      assertNotAborted(signal);
       throw new OidcVaultDpopClientError(
         "DPOP_TOKEN_TYPE_REQUIRED",
         "A DPoP access token is required. Sign in again.",
         true
       );
     }
-    const key = await session.getKey();
-    if (key.jkt !== credential.jkt) {
-      await session.clear();
+    assertLiveAccessToken(credential.expiresAt, now());
+    const accessToken = credential.accessToken;
+    const key = await abortable(signal, () => session.getKey());
+    assertNotAborted(signal);
+    const { jkt } = key;
+    if (jkt !== credential.jkt) {
+      await abortable(signal, () => session.clear());
+      assertNotAborted(signal);
       throw loginRequired();
     }
-    const proof = await createDpopProof(key, {
-      method,
-      url: target,
-      accessToken: credential.accessToken,
-      nonce: nonces.get(space, key.jkt),
-      now
-    });
+    const proof = await abortable(
+      signal,
+      () => createDpopProof(key, {
+        method,
+        url: target,
+        accessToken,
+        nonce: nonces.get(space, jkt),
+        now,
+        signal: signal ?? void 0
+      })
+    );
+    assertNotAborted(signal);
+    assertLiveAccessToken(credential.expiresAt, now());
     const attemptHeaders = new Headers(headers);
-    attemptHeaders.set("Authorization", `DPoP ${credential.accessToken}`);
+    attemptHeaders.set("Authorization", `DPoP ${accessToken}`);
     attemptHeaders.set("DPoP", proof);
-    const response = await request(url.href, {
-      ...init,
-      method,
-      body: body(),
-      headers: attemptHeaders,
-      credentials: api.credentials ?? "omit",
-      redirect: "error",
-      cache: "no-store"
-    });
-    if (challengeError(response) === "use_dpop_nonce" && canRetry && !nonceRetried && nonces.remember(space, key.jkt, response.headers.get("DPoP-Nonce"))) {
+    const response = await abortable(
+      signal,
+      () => request(href, {
+        ...init,
+        method,
+        body: body(),
+        headers: attemptHeaders,
+        credentials: api.credentials,
+        redirect: "error",
+        cache: "no-store"
+      }),
+      cancelResponse
+    );
+    if (signal?.aborted) {
+      cancelResponse(response);
+      assertNotAborted(signal);
+    }
+    const challenge = response.status === 401 ? readDpopChallengeError(response.headers.get("WWW-Authenticate")) : void 0;
+    const learnedNonce = nonces.remember(space, jkt, response.headers.get("DPoP-Nonce"));
+    if (challenge === "use_dpop_nonce" && canRetry && !nonceRetried && learnedNonce) {
       nonceRetried = true;
-      await response.body?.cancel();
+      cancelResponse(response);
       continue;
     }
-    if (challengeError(response) === "invalid_token" && canRetry && !refreshed) {
+    if (challenge === "invalid_token" && canRetry && !refreshed) {
       refreshed = true;
-      await response.body?.cancel();
-      credential = await session.refresh({ rejectedToken: credential.accessToken });
+      cancelResponse(response);
+      credential = await abortable(signal, () => session.refresh({ rejectedToken: accessToken }));
       continue;
     }
     return response;