oidc-spa is a production-grade OpenID Connect (OIDC) client library designed for browser-first single-page applications. It implements the Authorization Code + PKCE flow with security-first defaults including in-memory token storage, DPoP (Demonstration of Proof-of-Possession) support, token substitution to prevent token leakage, and browser runtime freezing to resist monkey-patching attacks. The library provides framework-specific adapters for React, Angular, Next.js, Nuxt, TanStack Start, and React Router, each offering hooks, guards, and middleware for seamless authentication integration. It also includes a Vite plugin for build-time injection, a mock OIDC adapter for testing, and server-side utilities for access token validation (RFC 9068). The core is framework-agnostic, with a custom reactive event system (Evt) for state management and cross-tab synchronization via BroadcastChannel. The repository contains extensive example applications demonstrating login/logout, protected routes, role-based access, and auto-logout overlays across multiple frameworks.