@hexok/auth-redis 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,76 @@
-# Temporary Holding Version
+# @hexok/auth-redis
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Redis sessions for the `SessionStore` port of `@hexok/auth`. Install with `npm i @hexok/auth @hexok/auth-redis ioredis`. Connections run on `@hexok/ioredis-lifecycle`.
+
+## Use
+
+```ts
+import { OpaqueSessionToken, Sessions, sessionConfig } from '@hexok/auth';
+import { RedisSessionStore } from '@hexok/auth-redis';
+import { z } from 'zod';
+
+const store = new RedisSessionStore({
+  redis: env.REDIS_URL,
+  identity: z.object({ organizationId: z.string(), userId: z.string() }),
+  ...sessionConfig(env),
+});
+await store.start();
+
+const sessions = new Sessions({ store, token: new OpaqueSessionToken() });
+```
+
+`identity` is a Standard Schema of the identity's JSON form. It types the store, so `open` takes that shape and `resolve` returns it. `open` refuses an identity the schema refuses with a `VALIDATION` error. Every read is checked again. Use plain JSON values. A `Date` does not survive the round trip.
+
+Start the store before the first call and stop it on shutdown. `Sessions` does not start or stop it.
+
+## Records
+
+Each session is one hash at `keyPrefix` plus a SHA-256 of the session id. Redis never holds the id a token carries, so read access to Redis does not yield a live credential.
+
+| Field | Value |
+| --- | --- |
+| `i` | The identity as JSON. |
+| `c` | When the session opened, in ms since the epoch. |
+| `e` | The absolute end, in ms since the epoch. |
+| `v` | The record version, `1`. |
+
+The key's TTL is the idle window, never past the absolute end.
+
+- `open` writes the hash and its TTL in one script. The id is 32 random bytes.
+- `resolve` runs one script. A missing key is `ended`. A record past `e` is deleted and is `expired`. Otherwise the TTL becomes the lesser of the idle window and the time left, and the identity is returned.
+- `resolve` compares `e` with the app clock, not the Redis clock. A Redis clock that runs ahead expires keys early. That reads as `ended`.
+- A record that cannot be read, such as bad JSON, an identity the schema refuses, or a key of another type, is deleted, logged at `warn` with its key, and is `ended`.
+- `close` deletes the key.
+
+To debug a session, hash its id with `sessionKey(id, keyPrefix)`, then use `HGETALL`, `PTTL`, and `DEL`. A `PTTL` of `-2` means the key is gone. Redis cannot tell a deleted key from an expired one.
+
+## Configuration
+
+| Option | Default | Meaning |
+| --- | --- | --- |
+| `redis` | required | A Redis URL or ioredis options. The store opens its own client. |
+| `identity` | required | The identity's Standard Schema. |
+| `idleSeconds`, `absoluteSeconds` | required | Both clocks. `sessionConfig(env)` from `@hexok/auth` reads them. |
+| `keyPrefix` | `hexok:session:` | Every key starts with it. |
+| `logger` | silent | A `LogSink`, such as `@hexok/logger` or `console`. |
+| `startTimeoutMs` | unset | Rejects `start()` when Redis is not ready in time. |
+| `stopTimeoutMs` | `5000` | The total time `stop()` may take. |
+
+`state` is `ready` from `start()` until `stop()`, even while Redis is down. Use it to gate traffic, not as a Redis health check. A call outside that window rejects with a `LifecycleError`, which this package re-exports.
+
+## ACL
+
+This is the least-privilege user for this adapter. Replace `CHANGE_ME`.
+
+```text
+ACL SETUSER hexok-session on >CHANGE_ME resetchannels ~hexok:session:* -@all +hset +hmget +pexpire +del +eval +info +client|setinfo
+```
+
+The key pattern follows `keyPrefix`. `open` and `resolve` are scripts, and scripts run with this user's rights. So they need `+eval`, plus the `+hset`, `+hmget`, `+pexpire`, and `+del` they send. `close` sends `+del`.
+
+- `+info` is the ioredis ready check, on every connection. `+client|setinfo` is the ioredis client tag. ioredis ignores a refused `CLIENT SETINFO`, but `ACL LOG` records each refusal.
+- Redis 7.0 rejects `+client|setinfo` in `ACL SETUSER`, because it has no such subcommand. Remove that rule on 7.0.
+- `HELLO`, `AUTH`, and `QUIT` need no rule. Redis does not check them against the ACL.
+- Add `+select` when the URL names a database, and `+client|setname` when `connectionName` is set.
+
+An integration test runs this line as a real user and fails if `ACL LOG` records a refusal.

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { LifecycleError, type LogSink } from '@hexok/ioredis-lifecycle';
+export { RedisSessionStore, type RedisSessionStoreConfig, sessionKey, } from './redis-session-store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EACL,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,UAAU,GACX,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { LifecycleError } from '@hexok/ioredis-lifecycle';
+export { RedisSessionStore, sessionKey, } from './redis-session-store.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAgB,MAAM,0BAA0B,CAAC;AACxE,OAAO,EACL,iBAAiB,EAEjB,UAAU,GACX,MAAM,0BAA0B,CAAC"}

package/dist/redis-session-store.d.ts

@@ -0,0 +1,59 @@
+import { type OpenedSession, type SessionConfig, SessionStore } from '@hexok/auth';
+import { type LifecycleState, type LogSink } from '@hexok/ioredis-lifecycle';
+import { type Infer, type Result, type StandardSchemaV1 } from 'hexok';
+import type { RedisOptions } from 'ioredis';
+export interface RedisSessionStoreConfig<S extends StandardSchemaV1> extends SessionConfig {
+    /** A Redis URL or ioredis options. The store opens its own client. */
+    readonly redis: string | RedisOptions;
+    /**
+     * The identity a session holds, as its JSON form. It types the store and
+     * checks every identity on `open` and on every read.
+     */
+    readonly identity: S;
+    /** Default `hexok:session:`. Every key is this prefix and a SHA-256 of the session id. */
+    readonly keyPrefix?: string | undefined;
+    readonly logger?: LogSink | undefined;
+    /** Rejects `start()` when Redis is not ready in time. Unset, `start()` waits. */
+    readonly startTimeoutMs?: number | undefined;
+    /** The total time `stop()` may take. Default 5000. */
+    readonly stopTimeoutMs?: number | undefined;
+    /** Milliseconds since the epoch. Tests pass a fake clock. Default `Date.now`. */
+    readonly now?: (() => number) | undefined;
+}
+/**
+ * The Redis key of a session id, for debugging with `HGETALL`, `PTTL`, and
+ * `DEL`. The key is a hash, so Redis never holds the id a token carries.
+ */
+export declare function sessionKey(id: string, keyPrefix?: string): string;
+declare const RedisSessionStore_base: (abstract new (...args: any[]) => {
+    start(): Promise<void>;
+    stop(): Promise<void>;
+}) & typeof SessionStore;
+/**
+ * Sessions in Redis. One hash per session holds the identity JSON (`i`), the
+ * open time (`c`), the absolute end (`e`), and the record version (`v`). The
+ * key's TTL is the idle window, never past the absolute end. `resolve` checks
+ * the absolute end and slides the TTL in one script, against the app clock.
+ *
+ * ```ts
+ * const store = new RedisSessionStore({
+ *   redis: process.env.REDIS_URL,
+ *   identity: z.object({ organizationId: z.string(), userId: z.string() }),
+ *   ...sessionConfig(process.env),
+ * })
+ * await store.start()
+ * ```
+ */
+export declare class RedisSessionStore<S extends StandardSchemaV1> extends RedisSessionStore_base<Infer<S>> {
+    #private;
+    constructor(config: RedisSessionStoreConfig<S>);
+    /** `ready` from `start()` until `stop()`, even while Redis is down. Use it to gate traffic, not as a Redis health check. */
+    get state(): LifecycleState;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    open(identity: Infer<S>): Promise<OpenedSession>;
+    resolve(id: string): Promise<Result<Infer<S>, 'ended' | 'expired'>>;
+    close(id: string): Promise<void>;
+}
+export {};
+//# sourceMappingURL=redis-session-store.d.ts.map

package/dist/redis-session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-session-store.d.ts","sourceRoot":"","sources":["../src/redis-session-store.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,YAAY,EACb,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,OAAO,EAGb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,KAAK,EACV,KAAK,MAAM,EACX,KAAK,gBAAgB,EAGtB,MAAM,OAAO,CAAC;AACf,OAAO,KAAK,EAAS,YAAY,EAAE,MAAM,SAAS,CAAC;AA8CnD,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,gBAAgB,CACjE,SAAQ,aAAa;IACrB,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrB,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,iFAAiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,sDAAsD;IACtD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,iFAAiF;IACjF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,SAAqB,GAAG,MAAM,CAE7E;;;;;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAiB,CAAC,CAAC,SAAS,gBAAgB,CAAE,SAAQ,uBAEjE,KAAK,CAAC,CAAC,CAAC,CAAC;;gBAUG,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAkB9C,4HAA4H;IAC5H,IAAI,KAAK,IAAI,cAAc,CAE1B;IAEQ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIf,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IA0BhD,OAAO,CACpB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC;IAgBlC,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAwBhD"}

package/dist/redis-session-store.js

@@ -0,0 +1,150 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { assertSessionConfig, SessionStore, } from '@hexok/auth';
+import { openRedis, RedisLifecycle, } from '@hexok/ioredis-lifecycle';
+import { Adapter, fail, validate, validationError, } from 'hexok';
+const ADAPTER = 'auth-session';
+const DEFAULT_KEY_PREFIX = 'hexok:session:';
+const RECORD_VERSION = '1';
+const silent = {
+    debug() { },
+    info() { },
+    warn() { },
+    error() { },
+};
+// KEYS[1] the session key. ARGV: identity JSON, created ms, absolute end ms, version, TTL ms.
+const openScript = `
+redis.call('HSET', KEYS[1], 'i', ARGV[1], 'c', ARGV[2], 'e', ARGV[3], 'v', ARGV[4])
+redis.call('PEXPIRE', KEYS[1], ARGV[5])
+return 1
+`;
+// KEYS[1] the session key. ARGV: now ms (the app clock), idle ms.
+// Returns {'live', identity JSON}, {'ended'}, {'expired'}, or {'corrupt'}. Expired and corrupt records are deleted.
+const resolveScript = `
+local fields = redis.pcall('HMGET', KEYS[1], 'i', 'e')
+if type(fields) == 'table' and fields.err then
+  redis.call('DEL', KEYS[1])
+  return {'corrupt'}
+end
+local identity, raw = fields[1], fields[2]
+if not identity and not raw then return {'ended'} end
+local absoluteEnd = tonumber(raw)
+if not identity or not absoluteEnd then
+  redis.call('DEL', KEYS[1])
+  return {'corrupt'}
+end
+local now, idle = tonumber(ARGV[1]), tonumber(ARGV[2])
+if absoluteEnd <= now then
+  redis.call('DEL', KEYS[1])
+  return {'expired'}
+end
+redis.call('PEXPIRE', KEYS[1], math.min(idle, absoluteEnd - now))
+return {'live', identity}
+`;
+/**
+ * The Redis key of a session id, for debugging with `HGETALL`, `PTTL`, and
+ * `DEL`. The key is a hash, so Redis never holds the id a token carries.
+ */
+export function sessionKey(id, keyPrefix = DEFAULT_KEY_PREFIX) {
+    return `${keyPrefix}${createHash('sha256').update(id).digest('base64url')}`;
+}
+/**
+ * Sessions in Redis. One hash per session holds the identity JSON (`i`), the
+ * open time (`c`), the absolute end (`e`), and the record version (`v`). The
+ * key's TTL is the idle window, never past the absolute end. `resolve` checks
+ * the absolute end and slides the TTL in one script, against the app clock.
+ *
+ * ```ts
+ * const store = new RedisSessionStore({
+ *   redis: process.env.REDIS_URL,
+ *   identity: z.object({ organizationId: z.string(), userId: z.string() }),
+ *   ...sessionConfig(process.env),
+ * })
+ * await store.start()
+ * ```
+ */
+export class RedisSessionStore extends Adapter(SessionStore) {
+    #redis;
+    #identity;
+    #keyPrefix;
+    #idleMs;
+    #absoluteMs;
+    #logger;
+    #now;
+    #lifecycle;
+    constructor(config) {
+        super();
+        assertSessionConfig(config);
+        this.#redis = config.redis;
+        this.#identity = config.identity;
+        this.#keyPrefix = config.keyPrefix ?? DEFAULT_KEY_PREFIX;
+        this.#idleMs = config.idleSeconds * 1000;
+        this.#absoluteMs = config.absoluteSeconds * 1000;
+        this.#logger = config.logger ?? silent;
+        this.#now = config.now ?? Date.now;
+        this.#lifecycle = new RedisLifecycle({
+            adapter: ADAPTER,
+            stopTimeoutMs: config.stopTimeoutMs ?? 5000,
+            startTimeoutMs: config.startTimeoutMs,
+            logger: config.logger,
+        });
+    }
+    /** `ready` from `start()` until `stop()`, even while Redis is down. Use it to gate traffic, not as a Redis health check. */
+    get state() {
+        return this.#lifecycle.state;
+    }
+    start() {
+        return this.#lifecycle.start(() => ({ commands: openRedis(this.#redis) }));
+    }
+    stop() {
+        return this.#lifecycle.stop();
+    }
+    async open(identity) {
+        const checked = validate(this.#identity, identity);
+        if (!checked.ok) {
+            throw validationError('auth-session: the identity does not match its schema', checked.issues);
+        }
+        const id = randomBytes(32).toString('base64url');
+        const now = this.#now();
+        const absoluteEnd = now + this.#absoluteMs;
+        await this.#lifecycle.run('open', ({ commands }) => commands.eval(openScript, 1, sessionKey(id, this.#keyPrefix), JSON.stringify(identity), now, absoluteEnd, RECORD_VERSION, Math.min(this.#idleMs, this.#absoluteMs)));
+        return { id, expiresAt: new Date(absoluteEnd) };
+    }
+    async resolve(id) {
+        const key = sessionKey(id, this.#keyPrefix);
+        const reply = await this.#lifecycle.run('resolve', ({ commands }) => commands.eval(resolveScript, 1, key, this.#now(), this.#idleMs));
+        const [status, json] = Array.isArray(reply) ? reply : [];
+        if (status === 'ended')
+            return fail('ended');
+        if (status === 'expired')
+            return fail('expired');
+        if (status === 'live' && typeof json === 'string') {
+            const identity = this.#parse(json);
+            if (identity.ok)
+                return identity;
+        }
+        await this.#discard(key);
+        return fail('ended');
+    }
+    async close(id) {
+        await this.#lifecycle.run('close', ({ commands }) => commands.del(sessionKey(id, this.#keyPrefix)));
+    }
+    #parse(json) {
+        let value;
+        try {
+            value = JSON.parse(json);
+        }
+        catch {
+            return fail('VALIDATION');
+        }
+        return validate(this.#identity, value);
+    }
+    // A record this store cannot read proves nothing. It is deleted and logged by its key, which is not a credential.
+    async #discard(key) {
+        await this.#lifecycle.run('resolve', ({ commands }) => commands.del(key));
+        this.#logger.warn('auth-session: deleted an unreadable session record', {
+            adapter: ADAPTER,
+            key,
+        });
+    }
+}
+//# sourceMappingURL=redis-session-store.js.map

package/dist/redis-session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-session-store.js","sourceRoot":"","sources":["../src/redis-session-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,mBAAmB,EAGnB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,SAAS,EACT,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,OAAO,EACP,IAAI,EAIJ,QAAQ,EACR,eAAe,GAChB,MAAM,OAAO,CAAC;AAKf,MAAM,OAAO,GAAG,cAAc,CAAC;AAC/B,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAC5C,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,MAAM,GAAY;IACtB,KAAK,KAAI,CAAC;IACV,IAAI,KAAI,CAAC;IACT,IAAI,KAAI,CAAC;IACT,KAAK,KAAI,CAAC;CACX,CAAC;AAEF,8FAA8F;AAC9F,MAAM,UAAU,GAAG;;;;CAIlB,CAAC;AAEF,kEAAkE;AAClE,oHAAoH;AACpH,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;CAoBrB,CAAC;AAsBF;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,EAAU,EAAE,SAAS,GAAG,kBAAkB;IACnE,OAAO,GAAG,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,iBAA8C,SAAQ,OAAO,CACxE,YAAY,CACH;IACA,MAAM,CAAwB;IAC9B,SAAS,CAAI;IACb,UAAU,CAAS;IACnB,OAAO,CAAS;IAChB,WAAW,CAAS;IACpB,OAAO,CAAU;IACjB,IAAI,CAAe;IACnB,UAAU,CAA0B;IAE7C,YAAY,MAAkC;QAC5C,KAAK,EAAE,CAAC;QACR,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,IAAI,cAAc,CAAC;YACnC,OAAO,EAAE,OAAO;YAChB,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;YAC3C,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,4HAA4H;IAC5H,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC/B,CAAC;IAEQ,KAAK;QACZ,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IAEQ,IAAI;QACX,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,QAAkB;QACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,eAAe,CACnB,sDAAsD,EACtD,OAAO,CAAC,MAAM,CACf,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;QAC3C,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CACjD,QAAQ,CAAC,IAAI,CACX,UAAU,EACV,CAAC,EACD,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,EAC/B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EACxB,GAAG,EACH,WAAW,EACX,cAAc,EACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CACzC,CACF,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;IAClD,CAAC;IAEQ,KAAK,CAAC,OAAO,CACpB,EAAU;QAEV,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAClE,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAChE,CAAC;QACF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO,QAAQ,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAEQ,KAAK,CAAC,KAAK,CAAC,EAAU;QAC7B,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAClD,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAY;QACjB,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,kHAAkH;IAClH,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oDAAoD,EAAE;YACtE,OAAO,EAAE,OAAO;YAChB,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;CACF"}

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@hexok/auth-redis",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Redis session store for the @hexok/auth SessionStore port.",
+  "type": "module",
+  "license": "MIT",
+  "sideEffects": false,
+  "keywords": [
+    "hexok",
+    "auth",
+    "session",
+    "redis"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/crobinson42/hexok.git",
+    "directory": "packages/auth-redis"
+  },
+  "homepage": "https://crobinson42.github.io/hexok/",
+  "bugs": {
+    "url": "https://github.com/crobinson42/hexok/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -b",
+    "test": "vitest run",
+    "type-check": "tsc --noEmit -p tsconfig.check.json",
+    "lint": "biome check .",
+    "clean": "rm -rf dist *.tsbuildinfo"
+  },
+  "dependencies": {
+    "@hexok/auth": "^0.1.0",
+    "@hexok/ioredis-lifecycle": "^1.0.0",
+    "hexok": "^2.2.6",
+    "ioredis": "^6"
+  },
+  "devDependencies": {
+    "@hexok/test-redis": "0.0.0",
+    "zod": "^4.1.5"
+  }
+}