@denizsvnc/ai-rag-engine 0.0.0-stage → 2.2.1

package/dist/config/default.d.ts

@@ -0,0 +1,22 @@
+export declare const ENGINE_DEFAULTS: {
+    SERVER: {
+        PORT: number;
+        HOST: string;
+    };
+    SML: {
+        DEFAULT_MODEL: string;
+        MATCH_THRESHOLD: number;
+    };
+    VECTOR_SEARCH: {
+        TOP_K: number;
+    };
+    CACHE: {
+        MIN_HITS_TO_PERSIST: number;
+        MAX_ITEMS_IN_RAM: number;
+        TTL_MS: number;
+    };
+    PATHS: {
+        CACHE_FILE: string;
+        TOOLS_REGISTRY: string;
+    };
+};

package/dist/config/ingestion-runtime.d.ts

@@ -0,0 +1,11 @@
+import { PostgresVectorAdapter } from '../adapters/vector/postgres-vector.adapter.js';
+import { QueuedIngestionService } from '../core/ingestion/queued-ingestion.service.js';
+import { IngestionWorker } from '../core/ingestion/ingestion-worker.js';
+export declare function positiveEnv(name: string, fallback: number): number;
+/** API and worker share configuration, never a process-local model/vector store. */
+export declare function createIngestionRuntime(vectors: PostgresVectorAdapter): Promise<{
+    backend: QueuedIngestionService;
+    worker: IngestionWorker;
+    close(): Promise<void>;
+}>;
+export declare function persistentVectorsFromEnv(): PostgresVectorAdapter;

package/dist/core/cache-manager.d.ts

@@ -0,0 +1,29 @@
+import type { ICacheAdapter } from '../interfaces/cache.interface.js';
+export declare class CacheManager implements ICacheAdapter {
+    private filePath;
+    private minHitsToPersist;
+    private memoryCache;
+    private hitCounters;
+    private isPersisting;
+    private defaultTtlMs;
+    constructor(filePath?: string, minHitsToPersist?: number, maxItemsInRAM?: number, defaultTtlMs?: number);
+    init(): Promise<void>;
+    get(query: string): Promise<any | null>;
+    set(query: string, value: any, ttlMs?: number): Promise<void>;
+    /**
+     * Delete a single entry by query key and synchronize disk storage
+     */
+    delete(query: string): Promise<boolean>;
+    /**
+     * Invalidate cache entries by exact key or regular expression.
+     * Useful for webhook cache eviction when product prices or warehouse inventory change.
+     */
+    invalidate(patternOrKey: string | RegExp): Promise<number>;
+    /**
+     * Evict all cached queries from memory and reset persistent disk storage
+     */
+    clear(): Promise<void>;
+    has(query: string): boolean;
+    size(): number;
+    private persistToDisk;
+}

package/dist/core/engine.d.ts

@@ -0,0 +1,75 @@
+import type { EngineConfig, RAGResponse } from '../interfaces/engine-config.interface.js';
+import { TokenTracker, type EngineMetricsSummary } from './metrics/token-tracker.js';
+import { DocumentIngestionService, type DocumentUploadPayload } from '../services/document-ingestion.service.js';
+import type { Job } from './queue/job-queue.interface.js';
+import type { QueryContext } from '../interfaces/query-context.interface.js';
+import type { ToolAuditLog } from '../interfaces/tool.interface.js';
+import type { ICacheAdapter } from '../interfaces/cache.interface.js';
+export declare class RAGEngine {
+    private config;
+    private confirmationService;
+    private cacheManager;
+    private smlEngine;
+    private toolRegistry;
+    private tokenTracker;
+    private ingestionService;
+    private isInitialized;
+    private initPromise;
+    private auditLogs;
+    private readonly maxAuditLogs;
+    constructor(config: EngineConfig);
+    /**
+     * Records a tool audit log entry into a bounded ring buffer (max 1000 items)
+     * and redacts sensitive field values.
+     */
+    recordAuditLog(entry: ToolAuditLog): void;
+    /**
+     * Initializes the engine, loads models into memory, and hydrates persistent caches.
+     * Thread-safe: Parallel concurrent invocations await the exact same mutex Promise.
+     * Resilient: Resets initPromise on failure so subsequent retries can succeed.
+     */
+    init(): Promise<void>;
+    registerTool(tool: any): Promise<void>;
+    /**
+     * Executes the query lifecycle:
+     * Security Guardrail -> Cache -> SML Routing -> Retrieval -> Untrusted Boundary Framing -> LLM Generation.
+     */
+    query(userPrompt: string, context?: QueryContext): Promise<RAGResponse>;
+    /**
+     * Retrieve structured audit logs for tool executions (supports tenant-level filtering).
+     */
+    getAuditLogs(tenantId?: string): ToolAuditLog[];
+    /**
+     * Clear recorded audit logs.
+     */
+    clearAuditLogs(): void;
+    /**
+     * Invalidate cached queries matching a specific key or regular expression.
+     * Call this when catalog prices, warehouse stock, or corporate policies change.
+     */
+    invalidateCache(patternOrQuery: string | RegExp): Promise<number>;
+    /**
+     * Clear all cached queries from RAM and persistent disk storage.
+     */
+    clearCache(): Promise<void>;
+    getCacheManager(): ICacheAdapter;
+    /**
+     * Returns cumulative FinOps token usage, cost savings, and latency metrics.
+     */
+    getMetrics(): EngineMetricsSummary;
+    getTokenTracker(): TokenTracker;
+    /**
+     * Submits a document (PDF, TXT, MD, CSV, JSON) for background ingestion.
+     * Enforces magic byte security and enqueues heavy chunking and PII masking.
+     */
+    ingestDocument(payload: DocumentUploadPayload): Promise<{
+        jobId: string;
+        status: string;
+    }>;
+    /**
+     * Retrieves the status of an ongoing or completed document ingestion job.
+     */
+    getIngestionStatus(jobId: string, tenantId?: string): Promise<Job | null>;
+    retryIngestion(jobId: string, tenantId: string): Promise<void>;
+    getIngestionService(): DocumentIngestionService;
+}

package/dist/core/ingestion/ingestion-worker.d.ts

@@ -0,0 +1,19 @@
+import type { PostgresVectorAdapter } from '../../adapters/vector/postgres-vector.adapter.js';
+import { QueuedIngestionService } from './queued-ingestion.service.js';
+/** Runs in a separate Node process. No HTTP server or LLM provider is needed here. */
+export declare class IngestionWorker {
+    private readonly service;
+    private readonly vectors;
+    private readonly options;
+    private timer;
+    private pump;
+    private stopped;
+    constructor(service: QueuedIngestionService, vectors: Pick<PostgresVectorAdapter, 'replaceDocument'>, options?: {
+        pollMs?: number;
+        onError?: (error: unknown) => void;
+    });
+    start(): Promise<void>;
+    private tick;
+    private process;
+    close(): Promise<void>;
+}

package/dist/core/ingestion/postgres-ingestion-store.d.ts

@@ -0,0 +1,56 @@
+import type { Pool } from 'pg';
+import type { JobStatus } from '../queue/job-queue.interface.js';
+import type { IngestionSettings } from '../../interfaces/ingestion.interface.js';
+export interface StoredUpload {
+    id: string;
+    tenantId: string;
+    userId: string;
+    documentId: string;
+    filename: string;
+    version: number;
+    digest: string;
+    settings: IngestionSettings;
+    content: Buffer | null;
+    status: JobStatus;
+    result: Record<string, unknown> | null;
+    error: string | null;
+    createdAt: number;
+    updatedAt: number;
+}
+export declare class IngestionQuotaError extends Error {
+}
+export declare class IngestionConflictError extends Error {
+}
+/** Shared blobs, document revisions and a durable outbox. No process-local file references. */
+export declare class PostgresIngestionStore {
+    readonly pool: Pool;
+    private readonly table;
+    private readonly heads;
+    private readonly tableName;
+    constructor(pool: Pool, tableName?: string);
+    migrate(): Promise<void>;
+    ready(): Promise<void>;
+    put(input: {
+        tenantId: string;
+        userId: string;
+        documentId: string;
+        filename: string;
+        content: Buffer;
+        settings: IngestionSettings;
+        idempotencyKey?: string | undefined;
+    }, limits: {
+        maxPending: number;
+        maxStoredBytes: number;
+    }): Promise<StoredUpload>;
+    get(id: string, tenantId?: string): Promise<StoredUpload | null>;
+    dispatchable(limit?: number): Promise<Array<{
+        id: string;
+        tenantId: string;
+    }>>;
+    mark(id: string, status: 'queued' | 'processing' | 'failed', error?: string): Promise<void>;
+    complete(id: string, result: Record<string, unknown>): Promise<void>;
+    resetFailed(id: string, tenantId: string): Promise<void>;
+    expireFailedBlobs(retentionDays?: number): Promise<void>;
+    private row;
+    private transaction;
+}

package/dist/core/ingestion/queued-ingestion.service.d.ts

@@ -0,0 +1,35 @@
+import type { DocumentUploadPayload } from '../../services/document-ingestion.service.js';
+import type { IIngestionBackend } from '../../interfaces/ingestion.interface.js';
+import type { Job, JobStatus } from '../queue/job-queue.interface.js';
+import type { BullMQJobQueue } from '../queue/bullmq-queue.js';
+import { PostgresIngestionStore } from './postgres-ingestion-store.js';
+export type IngestionQueue = Pick<BullMQJobQueue<IngestionReference>, 'add' | 'getJob' | 'ready' | 'process' | 'retry' | 'close'>;
+export interface IngestionReference {
+    id: string;
+    tenantId: string;
+}
+export interface QueuedIngestionOptions {
+    maxUploadBytes?: number | undefined;
+    maxPendingPerTenant?: number | undefined;
+    maxStoredBytesPerTenant?: number | undefined;
+    chunkSize?: number | undefined;
+    chunkOverlap?: number | undefined;
+}
+/** API-side producer. PostgreSQL commits the upload before Redis dispatch; a worker reconciles the outbox. */
+export declare class QueuedIngestionService implements IIngestionBackend {
+    readonly store: PostgresIngestionStore;
+    readonly queue: IngestionQueue;
+    private readonly options;
+    private readonly settings;
+    private readonly maxBytes;
+    constructor(store: PostgresIngestionStore, queue: IngestionQueue, options?: QueuedIngestionOptions);
+    submitDocument(payload: DocumentUploadPayload): Promise<{
+        jobId: string;
+        status: JobStatus;
+    }>;
+    flushOutbox(): Promise<void>;
+    private dispatch;
+    getJobStatus(id: string, tenantId?: string): Promise<Job | null>;
+    retryJob(id: string, tenantId: string): Promise<void>;
+    private bytes;
+}

package/dist/core/metrics/prometheus-exporter.d.ts

@@ -0,0 +1,12 @@
+import type { EngineMetricsSummary } from './token-tracker.js';
+export interface PrometheusMetricOptions {
+    circuitBreakerState?: 'CLOSED' | 'OPEN' | 'HALF_OPEN' | undefined;
+    activeCacheSize?: number | undefined;
+}
+/**
+ * Formats engine FinOps and runtime telemetry into OpenMetrics / Prometheus exposition format.
+ * Can be scraped directly by Prometheus or Datadog agents via GET /api/metrics?format=prometheus.
+ */
+export declare class PrometheusExporter {
+    static exportMetrics(summary: EngineMetricsSummary, options?: PrometheusMetricOptions): string;
+}

package/dist/core/metrics/rag-evaluator.d.ts

@@ -0,0 +1,63 @@
+export interface RetrievalEvalResult {
+    k: number;
+    precisionAtK: number;
+    recallAtK: number;
+    hitRate: number;
+    reciprocalRank: number;
+}
+export interface FaithfulnessEvalResult {
+    score: number;
+    lexicalGroundingScore: number;
+    totalSentences: number;
+    groundedSentences: number;
+    contradictionsDetected: string[];
+    ungroundedClaims: string[];
+}
+export interface FullRAGEvaluationReport {
+    retrieval: RetrievalEvalResult;
+    faithfulness: FaithfulnessEvalResult;
+    overallPass: boolean;
+}
+/**
+ * Pure TypeScript RAG Evaluation Engine.
+ * Evaluates retrieval quality (Precision@K, Recall@K, MRR) and generation faithfulness
+ * (hallucination detection) without calling external paid LLMs.
+ */
+export declare class RAGEvaluator {
+    /**
+     * Measures Retrieval Precision@K:
+     * Proportion of retrieved documents in the top-K that are genuinely relevant.
+     */
+    static precisionAtK(retrievedIds: string[], relevantIds: string[], k?: number): number;
+    /**
+     * Measures Retrieval Recall@K:
+     * Proportion of all existing relevant documents that were captured in the top-K.
+     */
+    static recallAtK(retrievedIds: string[], relevantIds: string[], k?: number): number;
+    /**
+     * Measures Mean Reciprocal Rank (MRR):
+     * 1 / rank of the first relevant document retrieved.
+     */
+    static reciprocalRank(retrievedIds: string[], relevantIds: string[]): number;
+    /**
+     * Evaluates Answer Faithfulness / Hallucination Rate:
+     * Deconstructs the generated response into discrete sentences/claims,
+     * and checks whether the salient terms in each sentence are grounded
+     * in the retrieved context documents.
+     */
+    static evaluateGrounding(answer: string, context: string | string[]): FaithfulnessEvalResult & {
+        grounded: boolean;
+        groundingScore: number;
+    };
+    static evaluateFaithfulness(answer: string, contextTexts: string[]): FaithfulnessEvalResult;
+    /**
+     * Conducts a full RAG evaluation given a query, generated answer, retrieved docs, and ground truth IDs.
+     */
+    static evaluate(options: {
+        retrievedIds: string[];
+        relevantIds: string[];
+        answer: string;
+        contextTexts: string[];
+        k?: number;
+    }): FullRAGEvaluationReport;
+}

package/dist/core/metrics/token-tracker.d.ts

@@ -0,0 +1,69 @@
+export interface ResponseMetrics {
+    tokensConsumed: number;
+    tokensSaved: number;
+    estimatedCostSavedUsd: number;
+    latencyMs: number;
+    source: 'CACHE' | 'FAQ' | 'TOOL_EXECUTION' | 'LLM_RAG' | 'SECURITY_BLOCKED';
+}
+export interface EngineMetricsSummary {
+    totalQueries: number;
+    cacheHits: number;
+    faqHits: number;
+    smlToolHits: number;
+    llmCalls: number;
+    securityBlocked: number;
+    zeroTokenRate: string;
+    tokensConsumed: number;
+    tokensSaved: number;
+    estimatedCostUsd: number;
+    estimatedCostSavedUsd: number;
+    latency: {
+        avgMs: number;
+        minMs: number;
+        maxMs: number;
+        p50Ms: number;
+        p95Ms: number;
+        p99Ms: number;
+        sumMs: number;
+        count: number;
+        buckets: Array<{
+            leMs: number;
+            count: number;
+        }>;
+    };
+}
+export interface TokenTrackerOptions {
+    costPerThousandTokensUsd?: number;
+    baselineTokensPerQuery?: number;
+}
+export declare class TokenTracker {
+    private readonly costPerThousand;
+    private readonly baselineTokensPerQuery;
+    private totalQueries;
+    private cacheHits;
+    private faqHits;
+    private smlToolHits;
+    private llmCalls;
+    private securityBlocked;
+    private totalTokensConsumed;
+    private totalTokensSaved;
+    private latencies;
+    private latencySumMs;
+    private readonly latencyBoundsMs;
+    private latencyBucketCounts;
+    constructor(options?: TokenTrackerOptions);
+    estimateTokens(text: string): number;
+    trackQuery(event: {
+        source: ResponseMetrics['source'];
+        userPrompt: string;
+        answer?: string | undefined;
+        usage?: {
+            promptTokens: number;
+            completionTokens: number;
+        } | undefined;
+        latencyMs: number;
+    }): ResponseMetrics;
+    recordFullQuery(promptTokens: number, completionTokens: number, latencyMs: number): void;
+    getSummary(): EngineMetricsSummary;
+    reset(): void;
+}

package/dist/core/prompt-builder.d.ts

@@ -0,0 +1,20 @@
+import type { VectorDocument } from '../interfaces/vector.interface.js';
+export interface PromptContext {
+    basePrompt?: string | undefined;
+    rules?: string[] | undefined;
+    documents?: VectorDocument[] | undefined;
+    toolResults?: Array<{
+        toolName: string;
+        result: any;
+    }> | undefined;
+    caller?: {
+        tenantId?: string | undefined;
+        userId?: string | undefined;
+        roles?: string[] | undefined;
+    } | undefined;
+}
+export declare class PromptBuilder {
+    static buildSystemPrompt(context: PromptContext): string;
+    private static escapeData;
+    static formatVisitorPrompt(sanitizedInput: string): string;
+}

package/dist/core/queue/bullmq-queue.d.ts

@@ -0,0 +1,39 @@
+import type { IJobQueue, Job, JobHandler } from './job-queue.interface.js';
+export interface BullMQQueueOptions {
+    queueName?: string | undefined;
+    redisUrl?: string | undefined;
+    connection?: {
+        host?: string | undefined;
+        port?: number | undefined;
+        password?: string | undefined;
+    } | undefined;
+    concurrency?: number | undefined;
+    globalConcurrency?: number | undefined;
+    attempts?: number | undefined;
+    backoffMs?: number | undefined;
+    lockDurationMs?: number | undefined;
+    stalledIntervalMs?: number | undefined;
+    onError?: ((error: Error) => void) | undefined;
+}
+/** Redis-backed producer; a consumer starts only when process() is explicitly called. */
+export declare class BullMQJobQueue<TData = any, TResult = any> implements IJobQueue<TData, TResult> {
+    private readonly options;
+    private readonly queue;
+    private readonly producer;
+    private consumer;
+    private worker;
+    private processingType;
+    private closed;
+    private readonly name;
+    private readonly attempts;
+    constructor(options?: BullMQQueueOptions);
+    private connection;
+    private report;
+    ready(): Promise<void>;
+    add(type: string, data: TData, jobId?: string): Promise<Job<TData, TResult>>;
+    getJob(id: string): Promise<Job<TData, TResult> | null>;
+    process(type: string, handler: JobHandler<TData, TResult>): Promise<void>;
+    retry(id: string): Promise<void>;
+    close(): Promise<void>;
+    private map;
+}

package/dist/core/queue/in-memory-queue.d.ts

@@ -0,0 +1,24 @@
+import type { IJobQueue, Job, JobHandler } from './job-queue.interface.js';
+export interface InMemoryQueueOptions {
+    concurrency?: number | undefined;
+    maxPendingJobs?: number | undefined;
+    maxRetainedJobs?: number | undefined;
+}
+export declare class InMemoryJobQueue<TData = any, TResult = any> implements IJobQueue<TData, TResult> {
+    private jobs;
+    private handlers;
+    private pendingQueue;
+    private activeJobsCount;
+    private isClosed;
+    private readonly maxPendingJobs;
+    private drainWaiters;
+    private readonly concurrency;
+    private readonly maxRetainedJobs;
+    constructor(options?: InMemoryQueueOptions);
+    add(type: string, data: TData, customJobId?: string): Promise<Job<TData, TResult>>;
+    getJob(id: string): Promise<Job<TData, TResult> | null>;
+    process(type: string, handler: JobHandler<TData, TResult>): void;
+    close(): Promise<void>;
+    private dispatch;
+    private pruneOldJobs;
+}

package/dist/core/queue/job-queue.interface.d.ts

@@ -0,0 +1,22 @@
+export type JobStatus = 'pending' | 'queued' | 'processing' | 'completed' | 'failed';
+export interface Job<TData = any, TResult = any> {
+    attemptsMade?: number | undefined;
+    maxAttempts?: number | undefined;
+    id: string;
+    type: string;
+    data: TData;
+    status: JobStatus;
+    progress: number;
+    result?: TResult | undefined;
+    error?: string | undefined;
+    createdAt: number;
+    updatedAt: number;
+    completedAt?: number | undefined;
+}
+export type JobHandler<TData = any, TResult = any> = (job: Job<TData, TResult>, updateProgress: (progress: number) => Promise<void> | void) => Promise<TResult>;
+export interface IJobQueue<TData = any, TResult = any> {
+    add(type: string, data: TData, jobId?: string): Promise<Job<TData, TResult>>;
+    getJob(id: string): Promise<Job<TData, TResult> | null>;
+    process(type: string, handler: JobHandler<TData, TResult>): void | Promise<void>;
+    close(): Promise<void>;
+}

package/dist/core/queue/queue-factory.d.ts

@@ -0,0 +1,12 @@
+import type { IJobQueue } from './job-queue.interface.js';
+export interface QueueConfig {
+    driver?: 'memory' | 'bullmq' | undefined;
+    redisUrl?: string | undefined;
+    concurrency?: number | undefined;
+    queueName?: string | undefined;
+}
+/**
+ * Creates the appropriate job queue based on configuration.
+ * Uses zero-dependency InMemoryJobQueue by default, or BullMQJobQueue when Redis is configured.
+ */
+export declare function createJobQueue<TData = any, TResult = any>(config?: QueueConfig): IJobQueue<TData, TResult>;

package/dist/core/security/confirmation.d.ts

@@ -0,0 +1,64 @@
+import { type ConfirmationNonceStore } from './nonce-store.js';
+import type { QueryContext } from '../../interfaces/query-context.interface.js';
+export interface ConfirmationTicketPayload {
+    toolName: string;
+    argsHash: string;
+    tenantId?: string | undefined;
+    userId?: string | undefined;
+    nonce: string;
+    expiresAt: number;
+}
+export interface TicketTargetOptions {
+    toolName: string;
+    args: any;
+    tenantId?: string | undefined;
+    userId?: string | undefined;
+}
+export declare class ConfirmationService {
+    private secret;
+    private ttlMs;
+    private nonceStore;
+    private static readonly memoryStore;
+    private static readonly DEFAULT_TTL_MS;
+    constructor(secret?: string, ttlMs?: number, nonceStore?: ConfirmationNonceStore);
+    /**
+     * Instance method to issue a ticket using the configured secret and TTL.
+     */
+    issueTicket(options: TicketTargetOptions): string;
+    issueTicket(toolName: string, args: any, context?: QueryContext): string;
+    /**
+     * Instance method to verify a ticket. Throws an Error on verification failure.
+     */
+    verifyTicket(ticket: string, options: TicketTargetOptions): Promise<{
+        valid: boolean;
+        payload?: ConfirmationTicketPayload;
+    }>;
+    verifyTicket(ticket: string, toolName: string, args: any, context?: QueryContext): Promise<{
+        valid: boolean;
+        payload?: ConfirmationTicketPayload;
+    }>;
+    /**
+     * Produces a deterministic canonical JSON string for arguments regardless of key order.
+     */
+    static canonicalize(data: any): string;
+    /**
+     * Computes SHA-256 hash of canonicalized tool arguments.
+     */
+    static hashArgs(args: any): string;
+    /**
+     * Issues a cryptographically signed, short-lived, single-use ticket for a proposed mutating tool invocation.
+     */
+    static issueTicket(toolName: string, args: any, context?: QueryContext, ttlMs?: number, secret?: string): string;
+    /**
+     * Validates that the provided confirmation ticket:
+     * 1. Possesses a valid HMAC signature.
+     * 2. Has not expired.
+     * 3. Has not been replayed (single-use enforcement).
+     * 4. Matches the exact tool name and SHA-256 hash of the submitted arguments.
+     * 5. Matches the caller tenantId/userId if specified.
+     */
+    static verifyTicket(ticket: string, toolName: string, args: any, context?: QueryContext, secret?: string, nonceStore?: ConfirmationNonceStore): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+}

package/dist/core/security/injection-detector.d.ts

@@ -0,0 +1,25 @@
+import type { RiskLevel } from './security.types.js';
+export interface DetectionResult {
+    isRisk: boolean;
+    riskLevel: RiskLevel;
+    matchedPatterns: string[];
+}
+/**
+ * Scans user inputs for heuristic patterns and known signatures of prompt injection,
+ * jailbreaks, role hijacking, and prompt extraction attempts.
+ */
+export declare class InjectionDetector {
+    /**
+     * High-confidence, critical injection patterns (bilingual: Turkish & English).
+     * Any match here immediately triggers HIGH risk classification.
+     */
+    private static readonly HIGH_RISK_PATTERNS;
+    /**
+     * Medium-confidence suspicious patterns.
+     */
+    private static readonly MEDIUM_RISK_PATTERNS;
+    /**
+     * Analyzes input text and classifies prompt injection risk.
+     */
+    static detect(input: string, customPatterns?: RegExp[]): DetectionResult;
+}

package/dist/core/security/nonce-store.d.ts

@@ -0,0 +1,21 @@
+/** Implementations must atomically reserve a nonce until expiry, with no fallback on errors. */
+export interface ConfirmationNonceStore {
+    readonly distributed: boolean;
+    consume(nonce: string, expiresAt: number): Promise<boolean>;
+}
+export declare class MemoryConfirmationNonceStore implements ConfirmationNonceStore {
+    readonly distributed = false;
+    private used;
+    consume(nonce: string, expiresAt: number): Promise<boolean>;
+}
+export interface ConfirmationRedisClient {
+    set(key: string, value: string, px: 'PX', ttl: number, nx: 'NX'): Promise<unknown>;
+}
+/** All instances must use the same Redis database and prefix; nonce keys must not be evicted. */
+export declare class RedisConfirmationNonceStore implements ConfirmationNonceStore {
+    private client;
+    private prefix;
+    readonly distributed = true;
+    constructor(client: ConfirmationRedisClient, prefix?: string);
+    consume(nonce: string, expiresAt: number): Promise<boolean>;
+}