@web-ts-toolkit/express-oidc-vault-redis-store 0.43.0 → 0.47.1

package/README.md

@@ -20,6 +20,7 @@ import { createClient } from 'redis';
 import { createRedisOidcVaultStore } from '@web-ts-toolkit/express-oidc-vault-redis-store';
 
 const redis = createClient({ url: process.env.REDIS_URL });
+redis.on('error', () => console.warn('OIDC vault Redis connection error.'));
 await redis.connect();
 
 const storeProvider = createRedisOidcVaultStore({
@@ -38,6 +39,7 @@ import { createRedisOidcVaultStore } from '@web-ts-toolkit/express-oidc-vault-re
 
 const app = express();
 const redis = createClient({ url: process.env.REDIS_URL });
+redis.on('error', () => console.warn('OIDC vault Redis connection error.'));
 
 await redis.connect();
 
@@ -69,14 +71,32 @@ app.use(
 - one-time records are consumed atomically through Redis commands instead of `get` plus `del`
 - session rotation and session indexes are updated atomically so concurrent refreshes do not fork multiple active sessions
 - rotation requires a distinct unused target session ID; missing-source, same-ID, and existing-target rotation conflicts throw `OidcVaultStoreConflictError` without changing source or target records
-- obsolete rotated session IDs are stored as aliases owned by the logical session; revoking the active logical session, or deleting through any obsolete ID, removes all aliases and the reverse alias index
+- obsolete rotated session IDs are stored as aliases owned by the logical session; scoped/direct deletion preserves unexpired aliases while another live member survives, including another issuer/client scope. Deleting through an obsolete ID still revokes its logical lineage
+- alias cleanup runs inside the delete script alongside the primary mutation. It checks keyed primary membership with Redis TTL authority before removing terminated-lineage aliases; empty logical logout uses the same liveness rule in an atomic cleanup script. Rotation cannot interleave between that check and alias removal. The overall indexed traversal is not a global logout snapshot, so later arrivals can survive
+- **Alias-cleanup compatibility:** scoped/direct logout no longer discards surviving lineage handles. Successful delete scripts no longer repeat application-side alias cleanup. A fixed warmed workload of 12 rotated lineages deleted by subject used 52 client commands before and 16 after on both Redis 6.2 and 7.2 (36 fewer sequential round trips); this measures command count, not latency. Lua still materializes whole logical-member sets, probes primaries until finding a survivor, and materializes/deletes all aliases when inactive; large lineages/alias sets remain scale-dependent server work
 - creating or rotating into a previously obsolete session ID removes that stale alias ownership first, so a reused ID cannot invoke an old logical-session meaning
-- `createAuthorizationTransaction` and `createExchangeCode` are upserts; `createSession` is create-only and duplicate session IDs throw `OidcVaultStoreConflictError` without changing the existing record or indexes
-- session metadata should be JSON-compatible for portability across store providers
+- `createAuthorizationTransaction` and `createExchangeCode` are upserts; `createSession` is create-only and duplicate session IDs throw `OidcVaultStoreConflictError` without changing the existing record or indexes. Portable callers must create sessions with a fresh unused ID and handle `OidcVaultStoreConflictError`: reusing a live ID rejects here but replaces on memory/MongoDB, so only fresh-ID creation is portable
+- portable data consists of strings, finite numbers, booleans, null, arrays, and plain objects; exclude cycles, custom prototypes/serializers, functions, symbols, and undefined properties. This applies to nested provider/user/metadata data, not only top-level metadata
+- portable plain-object/array inputs are captured before asynchronous work, including rotation source reads and scoped deletion scans. Returned session containers are independent from caller input, including nested provider/user/metadata arrays; later caller mutation cannot change the committed portable value or eventual result
+- compatibility: session ownership snapshots do not add a JSON round-trip. The existing JSON serializer still handles native values and `toJSON` hooks (and still rejects unsupported values such as BigInt/cycles). Opaque non-plain objects are not recursively copied and have no portable mutation-isolation guarantee; create/rotate results retain their native values while reads reflect persisted JSON
 - backchannel logout token JTI records are consumed only when `expiresAt` is finite and greater than the store clock at consume time
 - the optional `now` hook controls store-domain timestamps and testable JTI validation only; Redis server time is the authority for Redis key expiry and revocation-index cleanup
 - the client must implement `sendCommand(args)`; official standalone `redis` clients already do, and a Sentinel-wrapped master client or any adapter implementing `OidcVaultRedisClient` does too
 
+## Rotation Aliases And Lifetime
+
+Rotation preserves the source logical ID when the next session omits it. Each old ID becomes a revocation alias for its immediate successor's logical ID and `expiresAt`. With `A -> B (expiresAt=T1) -> C (expiresAt=T2)`, A stops working at T1 even if T2 is later or absent; B uses C's deadline. Later rotations never extend earlier aliases. `getSession(A)` returns `null`: an alias is never a readable/authentication session.
+
+With `A/L1 -> B/L1 -> C/L2`, the new B alias revokes L2; earlier A keeps L1 and its original deadline, never C. Redis does not eagerly retire L1 aliases merely because rotation moves its last member elsewhere (memory does); they can remain until expiry or explicit lineage cleanup. Use distinct logical IDs for unrelated login families rather than relying on retained handles disappearing on reuse.
+
+Without successor `expiresAt`, Redis and memory impose no alias time limit; MongoDB uses a finite fallback (default five minutes). Non-expiring Redis sessions and their aliases can grow without a fixed retention or size bound. Use explicit session lifetimes for portable finite windows. After an alias expires, use the live ID or the appropriate logical/subject/provider-session deletion method; core refresh preserves session expiry.
+
+## Deletion, Counts And Concurrent Arrivals
+
+Deleting a live public ID removes that record; deleting an unexpired alias revokes its logical lineage. Logical deletion and aliases have no issuer/client filter. Subject/provider-session object inputs match each supplied `issuer` and `clientId`; string inputs omit both filters and match across providers. A retained member in another scope keeps its unexpired aliases.
+
+Bulk deletion makes one cursor traversal, rechecks scope in each atomic delete script, and can follow a rotated-away source to matching same-lineage successors. Counts sum primary sessions actually deleted by those scripts, including such successors; expired/missing records, stale membership repair and alias cleanup do not contribute. Duplicate cursor visits or overlapping revocations do not double-count an already deleted primary. A concurrent arrival may survive, and `0` is not proof that the scope is empty. An error can follow earlier committed deletions; the complete traversal is not one transaction. MongoDB instead repeats scoped deletion until an empty query and can count expired documents awaiting TTL cleanup; memory counts live deletions during a synchronous map scan. Vault deletion does not revoke outstanding stateless access tokens or call upstream logout.
+
 ## Redis Version And Topology
 
 - **Minimum Redis version: 6.2.** One-time authorization transactions and exchange codes are consumed with `GETDEL`, which is unavailable before Redis 6.2. Versions 6.2 and 7.2 are exercised in integration tests.
@@ -89,7 +109,7 @@ app.use(
 - **Connect the client yourself.** The store never calls `client.connect()`, `client.quit()`, or `client.disconnect()`. Pass an already-connected client and reuse it across requests.
 - **Own `error` listeners, reconnects, and shutdown.** The store reads and writes commands but does not attach `error` listeners, suppress client errors, or close the client. Always register a client `error` listener on production connections; an unhandled client error can crash the process.
 - **Graceful shutdown.** Draining `createSession`/`rotateSession`/`deleteSessionsBy*` in-flight calls, then `client.quit()`, is the supported shutdown order. The store holds no background timers, so no store-side teardown is required beyond verifying in-flight operations have settled.
-- **Concurrency.** `OidcVaultStoreProvider` methods are safe to call concurrently from one or more processes. Atomic operations are protected by Redis server-side scripts; concurrent duplicate ID creation, concurrent indexed revocation of overlapping indexes, concurrent rotation into the same target ID, and concurrent same-ID rotation conflicting with indexed revocation are all bounded.
+- **Startup and concurrency.** There is no store `ready()` handshake: connect before accepting traffic, and provision permission to execute the documented commands and cached Lua scripts. Server-side scripts protect individual mutations from interleaving; indexed traversal and post-commit maintenance span multiple commands. They do not have a fixed total-work or completion-time bound.
 
 ## Key Namespace And Migration
 
@@ -107,24 +127,32 @@ app.use(
 ## Expiry And Index Cleanup
 
 - expiring session records are stored with Redis `PXAT`, and revocation index scores use the same absolute expiration timestamp
+- authorization transactions and exchange codes also use `PXAT`. Redis key expiry is authoritative for reads/consumes; payload `expiresAt` is structurally validated but is not independently compared to a clock on each read. Valid single-record reads use one `GET` or `GETDEL`, without a separate `TIME` round trip, preserving the split-clock policy above
+- **TTL integrity assumption:** preserve the store-written key TTLs and matching index scores when restoring or migrating data. Externally removing/extending a TTL can make a past-dated payload readable/consumable; changing only a session TTL can also leave it live after its index membership is pruned. Read validation does not audit or repair this external expiry inconsistency. Shortening a key TTL makes the record unavailable as soon as Redis expires it, even if its payload expiry is later
 - stale revocation memberships are pruned with Redis `TIME`, not the application clock, so a skewed application clock cannot remove a still-live Redis session from subject, provider-session, or logical-session indexes
 - indexed revocation also checks the primary session key before deleting or returning a session; expired primary values are not returned and missing primary values remove the stale membership encountered during traversal
-- indexed revocation traverses Redis sorted sets with bounded cursor batches and batched record reads; it revokes sessions present in the cursor scan's view, while sessions added to the same index after the scan starts may be revoked by a later indexed revocation call
-- each successful session create or rotation scans up to 100 prefixed keys and removes Redis-expired members from subject, provider-session, and logical-session indexes; Redis deletes empty sorted sets, so unique expired logical-session index keys are eventually removed even without a logout for that logical session
-- rotated session aliases use the same expiry score as their successor session; non-expiring alias churn is bounded by cleanup on logical-session termination, and malformed stale aliases are deleted when their session ID is reused
-- stale index storage is therefore bounded by active session index entries plus expired entries waiting for Redis expiry and the incremental cleanup scan window; non-expiring sessions use a non-expiring index score and remain until revoked
+- indexed revocation uses `ZSCAN COUNT 250` and one `MGET` for the IDs returned in each batch. `COUNT` is a hint, not a hard batch cap (compact sorted sets can return all members); the batch is not further chunked. Response memory and repair concurrency can grow with the returned batch, while deletion scripts run sequentially
+- each successful session create or rotation attempts one `SCAN MATCH <prefix>:* COUNT 100` step, then `TYPE` and, for each recognized sorted-set index, `TIME`/`ZREMRANGEBYSCORE`. **COUNT 100 is a hint, not “up to 100 keys”**: Redis may return more or fewer keys, and the store processes the whole response. Cleanup includes subject, provider-session, logical-session and rotated-alias indexes. Redis removes empty sorted sets; continued successful writes advance the scan even without a logout for that logical session
+- post-commit index maintenance is best-effort and never masquerades as a failed write: once the atomic create/rotate script commits, `createSession`/`rotateSession` resolve with the committed session even if the follow-up `SCAN`/`TYPE`/`TIME`/`ZREMRANGEBYSCORE` maintenance fails. The failure is reported once via a fixed-text `console.warn` identifying only `createSession` or `rotateSession`; adapter error names, messages, codes, causes, and arbitrary thrown values are never inspected or logged. The incremental scan retries on a later create/rotate. Mutation-script failures still reject, and a successful rotation is never retried merely because maintenance failed
+- **Diagnostic compatibility note:** post-commit maintenance warnings no longer include a `Cause:` suffix or adapter error details, which may contain credentials. Log consumers should use the operation name and fixed maintenance-failure text
+- aliases use their immediate successor's expiry score; malformed stale aliases are deleted when their session ID is reused. Alias/index cleanup can materialize a whole logical-member or alias set inside Lua; neither cursor COUNT value bounds that server work
+- there is no fixed stale-index cleanup deadline or memory cap. Expired entries can remain while writes stop or maintenance fails; non-expiring entries and aliases remain until explicitly revoked/cleaned. The incremental scan is opportunistic, not a retention SLA
 
 ## Stored Data Validation And Corruption Handling
 
-- stored records are JSON payloads validated structurally on read; see _Stored Data Characteristics_ for the schema-migration and plaintext-storage posture
+- stored records are JSON payloads validated structurally on read, with session `sessionId`, authorization transaction `state`, and exchange-code `code` required to match the requested key (including each indexed batch member); see _Stored Data Characteristics_ for the schema-migration and plaintext-storage posture
 - malformed one-time authorization transaction and exchange-code records are consumed atomically and return `null`, preventing reuse while failing closed
 - malformed session records are treated as unreadable, deleted when encountered through session reads or indexed revocation, and never returned as authenticated state
-- indexed revocation removes stale corrupt members and continues processing later valid sessions
+- corruption repair deletes only the observed malformed payload through an atomic server-side compare-and-delete: a fresh same-ID record created after the stale read (session ID reuse is supported) is never destroyed by the repair, and the missing-session logout path applies the same guard instead of an unconditional delete
+- **Identity-validation compatibility note:** shape-valid records stored under the wrong identity now follow the malformed-record policy and return `null`. Session repair targets only the observed lookup key, never the embedded session ID; indexed membership repair retains the same generation guard. One-time mismatches are consumed by the original atomic `GETDEL`, with no follow-up delete that could remove a replacement
+- a stale repair observing corruption therefore preserves a concurrent replacement, while genuine logout of a live session (direct delete or scoped logical/subject/provider-session revocation) still deletes it; indexed revocation removes stale corrupt members and continues processing later valid sessions
 - Redis mutation scripts preflight expected key types before writing so wrong-type keys fail without deterministic partial mutation
-- validation errors and script errors are sanitized and do not include stored refresh tokens, ID tokens, authorization transactions, or exchange codes
+- package-generated validation and deterministic script diagnostics use fixed text without stored records. Arbitrary client/adapter failures can still reject operations with sensitive original errors; they are not generally sanitized for application logs. Use fixed operation names and allowlisted categories, not raw errors, connection URLs, session IDs, state/PKCE values, exchange codes or token-valued metric labels. The secret-independent post-commit warning policy above applies specifically to that warning path
 
 ## Main Exports
 
+Use named imports from the package root; there is no default export or public subpath API. Use Node.js `>=22.12.0` for the core dependency's CJS/ESM runtime support. TypeScript apps also need `@types/node` and `@types/express`.
+
 - `createRedisOidcVaultStore(...)`
 - `OidcVaultRedisStoreRecordError`
 - `type RedisOidcVaultStoreOptions`

package/index.d.mts

@@ -2,7 +2,8 @@ import { OidcVaultStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
 
 /**
  * Thrown when a stored Redis value cannot be parsed or fails structural
- * validation. The message never includes stored token or refresh values.
+ * validation (including identity mismatch with the requested key). The message
+ * never includes stored token or refresh values.
  * Malformed one-time records are consumed atomically and return `null`; they
  * fail closed without throwing this error. Malformed sessions are deleted when
  * encountered through reads or indexed revocation.

package/index.d.ts

@@ -2,7 +2,8 @@ import { OidcVaultStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
 
 /**
  * Thrown when a stored Redis value cannot be parsed or fails structural
- * validation. The message never includes stored token or refresh values.
+ * validation (including identity mismatch with the requested key). The message
+ * never includes stored token or refresh values.
  * Malformed one-time records are consumed atomically and return `null`; they
  * fail closed without throwing this error. Malformed sessions are deleted when
  * encountered through reads or indexed revocation.

package/index.js

@@ -98,10 +98,10 @@ var isOptionalString = (value) => value === void 0 || isString(value);
 var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);
 var isOptionalFiniteNumber = (value) => value === void 0 || isFiniteNumber(value);
 var isStringRecord = (value) => isPlainRecord(value);
-var validateAuthorizationTransaction = (value) => isPlainRecord(value) && isString(value.state) && isString(value.nonce) && isString(value.pkceVerifier) && isString(value.codeChallenge) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt) && (value.metadata === void 0 || isStringRecord(value.metadata));
-var validateExchangeCodeRecord = (value) => isPlainRecord(value) && isString(value.code) && isString(value.sessionId) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt);
+var validateAuthorizationTransaction = (value, state) => isPlainRecord(value) && isString(value.state) && value.state === state && isString(value.nonce) && isString(value.pkceVerifier) && isString(value.codeChallenge) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt) && (value.metadata === void 0 || isStringRecord(value.metadata));
+var validateExchangeCodeRecord = (value, code) => isPlainRecord(value) && isString(value.code) && value.code === code && isString(value.sessionId) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt);
 var validateProviderMetadata = (value) => value === void 0 || isPlainRecord(value) && isOptionalString(value.issuer) && isOptionalString(value.clientId);
-var validateSession = (value) => isPlainRecord(value) && isString(value.sessionId) && isOptionalString(value.logicalSessionId) && isString(value.subject) && isOptionalString(value.providerSessionId) && validateProviderMetadata(value.provider) && isString(value.refreshToken) && isString(value.idToken) && isOptionalString(value.accessToken) && isOptionalString(value.scope) && isOptionalFiniteNumber(value.expiresAt) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.updatedAt) && (value.user === void 0 || isPlainRecord(value.user)) && (value.metadata === void 0 || isPlainRecord(value.metadata));
+var validateSession = (value, sessionId) => isPlainRecord(value) && isString(value.sessionId) && value.sessionId === sessionId && isOptionalString(value.logicalSessionId) && isString(value.subject) && isOptionalString(value.providerSessionId) && validateProviderMetadata(value.provider) && isString(value.refreshToken) && isString(value.idToken) && isOptionalString(value.accessToken) && isOptionalString(value.scope) && isOptionalFiniteNumber(value.expiresAt) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.updatedAt) && (value.user === void 0 || isPlainRecord(value.user)) && (value.metadata === void 0 || isPlainRecord(value.metadata));
 var parseStoredJson = (value, recordKind, validate) => {
   if (value === null) {
     return null;
@@ -267,7 +267,42 @@ end
 
 return 1
 `;
+var LIVE_LINEAGE_HELPER = `
+local function hasLiveMember(logicalIndexKey, sessionKeyPrefix, logicalSessionId, excludedId)
+  local members = redis.call('ZRANGE', logicalIndexKey, 0, -1)
+  for _, memberId in ipairs(members) do
+    if memberId ~= excludedId then
+      local value = redis.call('GET', sessionKeyPrefix .. memberId)
+      if value ~= false then
+        local ok, member = pcall(cjson.decode, value)
+        if ok and type(member) == 'table' and member['sessionId'] == memberId
+          and (member['logicalSessionId'] or memberId) == logicalSessionId then
+          return true
+        end
+      end
+    end
+  end
+  return false
+end
+`;
+var CLEANUP_INACTIVE_ALIASES_SCRIPT = `
+${LIVE_LINEAGE_HELPER}
+if hasLiveMember(KEYS[1], ARGV[1], ARGV[3], nil) then
+  return 0
+end
+local aliases = redis.call('ZRANGE', KEYS[2], 0, -1)
+for _, aliasId in ipairs(aliases) do
+  redis.call('DEL', ARGV[2] .. aliasId)
+end
+return redis.call('DEL', KEYS[2])
+`;
+var buildCleanupInactiveAliasesCommand = (keys, logicalSessionId) => evalCommand(
+  CLEANUP_INACTIVE_ALIASES_SCRIPT,
+  [keys.logicalSessionIndex(logicalSessionId), keys.rotatedSessionAliasIndex(logicalSessionId)],
+  [keys.sessionPrefix(), keys.rotatedSessionAliasPrefix(), logicalSessionId]
+);
 var DELETE_SESSION_SCRIPT = `
+${LIVE_LINEAGE_HELPER}
 local expected = cjson.decode(ARGV[1])
 local scopeKind = ARGV[2]
 local scopeValue = ARGV[3]
@@ -347,7 +382,16 @@ local function deleteRecord(sessionKey, session)
     assertZsetOrMissing(providerIndexKeyPrefix .. session['providerSessionId'])
   end
 
-  local aliasSessionIds = redis.call('ZRANGE', aliasIndexKey, 0, -1)
+  -- Check actual primaries, not just scores: TTL is authoritative and stale
+  -- logical memberships must not keep a terminated lineage's aliases alive.
+  -- This check and deletion share the script's atomic boundary with rotation.
+  local logicalIndexKey = logicalIndexKeyPrefix .. logicalSessionId
+  local hasSurvivor = hasLiveMember(logicalIndexKey, sessionKeyPrefix, logicalSessionId, sessionId)
+
+  local aliasSessionIds = {}
+  if not hasSurvivor then
+    aliasSessionIds = redis.call('ZRANGE', aliasIndexKey, 0, -1)
+  end
 
   if redis.call('DEL', sessionKey) == 0 then
     return 0
@@ -364,7 +408,9 @@ local function deleteRecord(sessionKey, session)
     redis.call('DEL', aliasKeyPrefix .. aliasSessionId)
   end
 
-  redis.call('DEL', aliasIndexKey)
+  if not hasSurvivor then
+    redis.call('DEL', aliasIndexKey)
+  end
 
   return 1
 end
@@ -526,6 +572,30 @@ redis.call('ZADD', aliasIndexKey, newScore, oldSessionId)
 
 return 1
 `;
+var COMPARE_AND_DELETE_SCRIPT = `
+local current = redis.call('GET', KEYS[1])
+
+if current == ARGV[1] then
+  return redis.call('DEL', KEYS[1])
+else
+  return 0
+end
+`;
+var buildCompareAndDeleteCommand = (key, observedValue) => evalCommand(COMPARE_AND_DELETE_SCRIPT, [key], [observedValue]);
+var REPAIR_SESSION_INDEX_SCRIPT = `
+local current = redis.call('GET', KEYS[1])
+
+if current == false or (ARGV[3] == '1' and current == ARGV[2]) then
+  return redis.call('ZREM', KEYS[2], ARGV[1])
+end
+
+return 0
+`;
+var buildRepairSessionIndexCommand = (sessionKey, indexKey, sessionId, observedValue) => evalCommand(
+  REPAIR_SESSION_INDEX_SCRIPT,
+  [sessionKey, indexKey],
+  [sessionId, observedValue ?? "", observedValue === null ? "0" : "1"]
+);
 var buildWriteSessionCommand = (keys, session) => evalCommand(
   WRITE_SESSION_SCRIPT,
   [
@@ -590,11 +660,30 @@ var buildRotateSessionCommand = (keys, previousSession, nextSession) => evalComm
 // src/index.ts
 var INDEX_CLEANUP_SCAN_COUNT = 100;
 var INDEX_REVOCATION_SCAN_COUNT = 250;
+var snapshotInput = (input, seen = /* @__PURE__ */ new WeakMap()) => {
+  if (input === null || typeof input !== "object") return input;
+  const prototype = Object.getPrototypeOf(input);
+  if (!Array.isArray(input) && prototype !== Object.prototype && prototype !== null) return input;
+  if (seen.has(input)) return seen.get(input);
+  const copy = Array.isArray(input) ? new Array(input.length) : Object.create(prototype);
+  seen.set(input, copy);
+  for (const key of Reflect.ownKeys(input)) {
+    if (Object.prototype.propertyIsEnumerable.call(input, key)) {
+      Object.defineProperty(copy, key, {
+        value: snapshotInput(Reflect.get(input, key), seen),
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    }
+  }
+  return copy;
+};
 var isRecord = (value) => typeof value === "object" && value !== null;
 var isUnsupportedClusterClient = (client) => isRecord(client) && typeof client.getSlotMaster === "function" && typeof client.nodeClient === "function" && Array.isArray(client.masters) && Array.isArray(client.slots);
-var toSubjectDeleteInput = (input) => typeof input === "string" ? { subject: input } : input;
-var toProviderSessionDeleteInput = (input) => typeof input === "string" ? { providerSessionId: input } : input;
-var toLogicalSessionDeleteInput = (input) => typeof input === "string" ? { logicalSessionId: input } : input;
+var toSubjectDeleteInput = (input) => typeof input === "string" ? { subject: input } : { ...input };
+var toProviderSessionDeleteInput = (input) => typeof input === "string" ? { providerSessionId: input } : { ...input };
+var toLogicalSessionDeleteInput = (input) => typeof input === "string" ? { logicalSessionId: input } : { ...input };
 var matchesProviderScope = (session, input) => {
   if (input.issuer !== void 0 && session.provider?.issuer !== input.issuer) {
     return false;
@@ -631,16 +720,35 @@ var RedisOidcVaultStore = class {
     return this.consumeJson(
       this.keys.authorizationTransaction(state),
       "authorization transaction",
-      validateAuthorizationTransaction
+      (value) => validateAuthorizationTransaction(value, state)
     );
   }
   async createExchangeCode(input) {
     await this.setJson(this.keys.exchangeCode(input.code), input, input.expiresAt);
   }
   async consumeExchangeCode(code) {
-    return this.consumeJson(this.keys.exchangeCode(code), "exchange code", validateExchangeCodeRecord);
+    return this.consumeJson(
+      this.keys.exchangeCode(code),
+      "exchange code",
+      (value) => validateExchangeCodeRecord(value, code)
+    );
   }
+  /**
+   * Creates a session record atomically, then runs best-effort index
+   * maintenance.
+   *
+   * Result policy (SVH-02): once `writeSessionRecord` reports success the
+   * session is committed and this method resolves with the session even if
+   * post-commit index maintenance (`SCAN`/`TYPE`/`TIME`/`ZREMRANGEBYSCORE`)
+   * fails. A maintenance failure is reported once via a fixed-text
+   * `console.warn` identifying only the operation (no adapter error details,
+   * session IDs, keys, or token material) and is retried opportunistically by
+   * a later `createSession`/`rotateSession` call. Mutation-command failures (the
+   * atomic write script) still reject, and this method never retries a
+   * committed mutation.
+   */
   async createSession(input) {
+    input = snapshotInput({ ...input });
     const timestamp = this.now();
     const session = {
       ...input,
@@ -652,13 +760,16 @@ var RedisOidcVaultStore = class {
     if (!written) {
       throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session already exists.");
     }
-    await this.cleanupStaleIndexKeys();
+    await this.runPostCommitIndexMaintenance("createSession");
     return session;
   }
   async getSession(sessionId) {
-    return this.getJson(this.keys.session(sessionId), "session", validateSession, { deleteMalformed: true });
+    return this.getJson(this.keys.session(sessionId), "session", (value) => validateSession(value, sessionId), {
+      deleteMalformed: true
+    });
   }
   async rotateSession(input) {
+    input = { sessionId: input.sessionId, nextSession: snapshotInput({ ...input.nextSession }) };
     const previousSession = await this.getSession(input.sessionId);
     if (!previousSession) {
       throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
@@ -674,7 +785,7 @@ var RedisOidcVaultStore = class {
     if (!rotated) {
       throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
     }
-    await this.cleanupStaleIndexKeys();
+    await this.runPostCommitIndexMaintenance("rotateSession");
     return nextSession;
   }
   async deleteSession(sessionId) {
@@ -688,13 +799,11 @@ var RedisOidcVaultStore = class {
       );
       if (logicalSessionId) {
         await this.deleteSessionsByLogicalSessionId(logicalSessionId);
-        await this.deleteRotatedSessionAliasesByLogicalSessionId(logicalSessionId);
       }
-      await this.client.del(this.keys.session(sessionId));
+      await this.deleteSessionKeyIfMalformed(sessionId);
       return;
     }
     await this.deleteSessionRecord(session, { kind: "single" });
-    await this.deleteRotatedSessionAliasesByLogicalSessionId(session.logicalSessionId ?? session.sessionId);
   }
   async deleteSessionsByLogicalSessionId(input) {
     const resolved = toLogicalSessionDeleteInput(input);
@@ -724,11 +833,12 @@ var RedisOidcVaultStore = class {
     await this.client.set(key, serialize(value), options);
   }
   async getJson(key, recordKind, validate, options) {
+    const raw = await this.client.get(key);
     try {
-      return parseStoredJson(await this.client.get(key), recordKind, validate);
+      return parseStoredJson(raw, recordKind, validate);
     } catch (error) {
-      if (options?.deleteMalformed && error instanceof OidcVaultRedisStoreRecordError) {
-        await this.client.del(key);
+      if (options?.deleteMalformed && error instanceof OidcVaultRedisStoreRecordError && raw !== null) {
+        await this.deleteMalformedValueIfUnchanged(key, raw);
         return null;
       }
       throw error;
@@ -753,6 +863,43 @@ var RedisOidcVaultStore = class {
     const result = await this.runScript(buildDeleteSessionCommand(this.keys, session, scope));
     return typeof result === "number" ? result : Number(result);
   }
+  /**
+   * Removes a stored value only when it still equals the malformed payload
+   * observed by a prior read (SVH-03). The equality check runs inside the Lua
+   * script, so a concurrent `createSession` reusing the same ID is never
+   * destroyed by a stale repair.
+   */
+  async deleteMalformedValueIfUnchanged(key, observedRaw) {
+    await this.runScript(buildCompareAndDeleteCommand(key, observedRaw));
+  }
+  /**
+   * Best-effort cleanup for the missing-session branch of `deleteSession`.
+   * Re-reads the session key and removes it only when it still holds malformed
+   * data. A missing key needs no cleanup and a freshly created valid session
+   * (same-ID reuse after the earlier read) is preserved; genuine logout of a
+   * live session never reaches this branch.
+   */
+  async deleteSessionKeyIfMalformed(sessionId) {
+    const sessionKey = this.keys.session(sessionId);
+    let raw;
+    try {
+      raw = await this.client.get(sessionKey);
+    } catch {
+      return;
+    }
+    if (raw === null) {
+      return;
+    }
+    try {
+      parseStoredJson(raw, "session", (value) => validateSession(value, sessionId));
+    } catch (error) {
+      if (error instanceof OidcVaultRedisStoreRecordError) {
+        await this.deleteMalformedValueIfUnchanged(sessionKey, raw);
+        return;
+      }
+      throw error;
+    }
+  }
   async rotateSessionRecord(previousSession, nextSession) {
     const result = await this.runScript(buildRotateSessionCommand(this.keys, previousSession, nextSession));
     if (result === 2 || result === "2") {
@@ -766,6 +913,20 @@ var RedisOidcVaultStore = class {
   async cleanupExpiredIndexMembers(indexKey) {
     await this.sendCommand(["ZREMRANGEBYSCORE", indexKey, "-inf", String(await this.redisServerTime())]);
   }
+  /**
+   * Runs optional post-commit index maintenance without letting it masquerade
+   * as a failed mutation. Any failure is reported once via a fixed-text
+   * warning and swallowed so the already-committed session result stands; the
+   * next successful create/rotate retries the incremental scan from the
+   * retained cursor. Never retries the committed mutation itself.
+   */
+  async runPostCommitIndexMaintenance(operation) {
+    try {
+      await this.cleanupStaleIndexKeys();
+    } catch {
+      console.warn(`OIDC vault Redis index maintenance failed after ${operation} and will retry on a later write.`);
+    }
+  }
   async cleanupStaleIndexKeys() {
     const response = await this.sendCommand([
       "SCAN",
@@ -816,10 +977,6 @@ var RedisOidcVaultStore = class {
     }
     return seconds * 1e3 + Math.floor(microseconds / 1e3);
   }
-  async getSessionIdsFromIndex(indexKey) {
-    const response = await this.sendCommand(["ZRANGE", indexKey, "0", "-1"]);
-    return Array.isArray(response) ? response.filter((value) => typeof value === "string") : [];
-  }
   async scanSessionIdsFromIndex(indexKey, cursor) {
     const response = await this.sendCommand(["ZSCAN", indexKey, cursor, "COUNT", String(INDEX_REVOCATION_SCAN_COUNT)]);
     if (!Array.isArray(response) || typeof response[0] !== "string" || !Array.isArray(response[1])) {
@@ -844,21 +1001,25 @@ var RedisOidcVaultStore = class {
       throw new Error("OIDC vault Redis store received an unexpected MGET response.");
     }
     return Promise.all(
-      response.map(async (value, index) => {
+      sessionIds.map(async (sessionId, index) => {
+        const value = response[index];
+        const raw = typeof value === "string" ? value : null;
         try {
-          return typeof value === "string" ? parseStoredJson(value, "session", validateSession) : null;
+          return { session: parseStoredJson(raw, "session", (parsed) => validateSession(parsed, sessionId)), raw };
         } catch (error) {
-          if (error instanceof OidcVaultRedisStoreRecordError) {
-            await this.client.del(this.keys.session(sessionIds[index]));
-            return null;
+          if (error instanceof OidcVaultRedisStoreRecordError && typeof value === "string") {
+            await this.deleteMalformedValueIfUnchanged(this.keys.session(sessionId), value);
+            return { session: null, raw };
           }
           throw error;
         }
       })
     );
   }
-  async removeSessionIdFromIndex(indexKey, sessionId) {
-    await this.sendCommand(["ZREM", indexKey, sessionId]);
+  async removeSessionIdFromIndex(indexKey, sessionId, observedRaw) {
+    await this.runScript(
+      buildRepairSessionIndexCommand(this.keys.session(sessionId), indexKey, sessionId, observedRaw)
+    );
   }
   async deleteSessionsFromIndex(indexKey, scope) {
     await this.cleanupExpiredIndexMembers(indexKey);
@@ -872,21 +1033,21 @@ var RedisOidcVaultStore = class {
       }
       const sessions = await this.getSessionRecords(batch.sessionIds);
       for (const [index, sessionId] of batch.sessionIds.entries()) {
-        const session = sessions[index];
+        const { session, raw } = sessions[index] ?? { session: null, raw: null };
         if (!session) {
-          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          await this.removeSessionIdFromIndex(indexKey, sessionId, raw);
           continue;
         }
         if ("logicalSessionId" in scope && (session.logicalSessionId ?? session.sessionId) !== scope.logicalSessionId) {
-          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          await this.removeSessionIdFromIndex(indexKey, sessionId, raw);
           continue;
         }
         if ("subject" in scope && session.subject !== scope.subject) {
-          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          await this.removeSessionIdFromIndex(indexKey, sessionId, raw);
           continue;
         }
         if ("providerSessionId" in scope && session.providerSessionId !== scope.providerSessionId) {
-          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          await this.removeSessionIdFromIndex(indexKey, sessionId, raw);
           continue;
         }
         if (!("logicalSessionId" in scope) && !matchesProviderScope(session, scope)) {
@@ -894,11 +1055,13 @@ var RedisOidcVaultStore = class {
         }
         const revoked = await this.deleteSessionRecord(session, this.toDeleteScriptScope(scope));
         if (revoked > 0) {
-          await this.deleteRotatedSessionAliasesByLogicalSessionId(session.logicalSessionId ?? session.sessionId);
           deleted += revoked;
         }
       }
     } while (cursor !== "0");
+    if (deleted === 0 && "logicalSessionId" in scope) {
+      await this.runScript(buildCleanupInactiveAliasesCommand(this.keys, scope.logicalSessionId));
+    }
     return deleted;
   }
   toDeleteScriptScope(scope) {
@@ -915,16 +1078,6 @@ var RedisOidcVaultStore = class {
       clientId: scope.clientId
     };
   }
-  async deleteRotatedSessionAliasesByLogicalSessionId(logicalSessionId) {
-    const aliasIndexKey = this.keys.rotatedSessionAliasIndex(logicalSessionId);
-    await this.cleanupExpiredIndexMembers(aliasIndexKey);
-    const aliasSessionIds = await this.getSessionIdsFromIndex(aliasIndexKey);
-    if (aliasSessionIds.length === 0) {
-      return;
-    }
-    await this.client.del(aliasSessionIds.map((sessionId) => this.keys.rotatedSessionAlias(sessionId)));
-    await this.client.del(aliasIndexKey);
-  }
   async sendCommand(args) {
     return this.client.sendCommand(args);
   }

package/index.mjs

@@ -75,10 +75,10 @@ var isOptionalString = (value) => value === void 0 || isString(value);
 var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);
 var isOptionalFiniteNumber = (value) => value === void 0 || isFiniteNumber(value);
 var isStringRecord = (value) => isPlainRecord(value);
-var validateAuthorizationTransaction = (value) => isPlainRecord(value) && isString(value.state) && isString(value.nonce) && isString(value.pkceVerifier) && isString(value.codeChallenge) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt) && (value.metadata === void 0 || isStringRecord(value.metadata));
-var validateExchangeCodeRecord = (value) => isPlainRecord(value) && isString(value.code) && isString(value.sessionId) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt);
+var validateAuthorizationTransaction = (value, state) => isPlainRecord(value) && isString(value.state) && value.state === state && isString(value.nonce) && isString(value.pkceVerifier) && isString(value.codeChallenge) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt) && (value.metadata === void 0 || isStringRecord(value.metadata));
+var validateExchangeCodeRecord = (value, code) => isPlainRecord(value) && isString(value.code) && value.code === code && isString(value.sessionId) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt);
 var validateProviderMetadata = (value) => value === void 0 || isPlainRecord(value) && isOptionalString(value.issuer) && isOptionalString(value.clientId);
-var validateSession = (value) => isPlainRecord(value) && isString(value.sessionId) && isOptionalString(value.logicalSessionId) && isString(value.subject) && isOptionalString(value.providerSessionId) && validateProviderMetadata(value.provider) && isString(value.refreshToken) && isString(value.idToken) && isOptionalString(value.accessToken) && isOptionalString(value.scope) && isOptionalFiniteNumber(value.expiresAt) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.updatedAt) && (value.user === void 0 || isPlainRecord(value.user)) && (value.metadata === void 0 || isPlainRecord(value.metadata));
+var validateSession = (value, sessionId) => isPlainRecord(value) && isString(value.sessionId) && value.sessionId === sessionId && isOptionalString(value.logicalSessionId) && isString(value.subject) && isOptionalString(value.providerSessionId) && validateProviderMetadata(value.provider) && isString(value.refreshToken) && isString(value.idToken) && isOptionalString(value.accessToken) && isOptionalString(value.scope) && isOptionalFiniteNumber(value.expiresAt) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.updatedAt) && (value.user === void 0 || isPlainRecord(value.user)) && (value.metadata === void 0 || isPlainRecord(value.metadata));
 var parseStoredJson = (value, recordKind, validate) => {
   if (value === null) {
     return null;
@@ -244,7 +244,42 @@ end
 
 return 1
 `;
+var LIVE_LINEAGE_HELPER = `
+local function hasLiveMember(logicalIndexKey, sessionKeyPrefix, logicalSessionId, excludedId)
+  local members = redis.call('ZRANGE', logicalIndexKey, 0, -1)
+  for _, memberId in ipairs(members) do
+    if memberId ~= excludedId then
+      local value = redis.call('GET', sessionKeyPrefix .. memberId)
+      if value ~= false then
+        local ok, member = pcall(cjson.decode, value)
+        if ok and type(member) == 'table' and member['sessionId'] == memberId
+          and (member['logicalSessionId'] or memberId) == logicalSessionId then
+          return true
+        end
+      end
+    end
+  end
+  return false
+end
+`;
+var CLEANUP_INACTIVE_ALIASES_SCRIPT = `
+${LIVE_LINEAGE_HELPER}
+if hasLiveMember(KEYS[1], ARGV[1], ARGV[3], nil) then
+  return 0
+end
+local aliases = redis.call('ZRANGE', KEYS[2], 0, -1)
+for _, aliasId in ipairs(aliases) do
+  redis.call('DEL', ARGV[2] .. aliasId)
+end
+return redis.call('DEL', KEYS[2])
+`;
+var buildCleanupInactiveAliasesCommand = (keys, logicalSessionId) => evalCommand(
+  CLEANUP_INACTIVE_ALIASES_SCRIPT,
+  [keys.logicalSessionIndex(logicalSessionId), keys.rotatedSessionAliasIndex(logicalSessionId)],
+  [keys.sessionPrefix(), keys.rotatedSessionAliasPrefix(), logicalSessionId]
+);
 var DELETE_SESSION_SCRIPT = `
+${LIVE_LINEAGE_HELPER}
 local expected = cjson.decode(ARGV[1])
 local scopeKind = ARGV[2]
 local scopeValue = ARGV[3]
@@ -324,7 +359,16 @@ local function deleteRecord(sessionKey, session)
     assertZsetOrMissing(providerIndexKeyPrefix .. session['providerSessionId'])
   end
 
-  local aliasSessionIds = redis.call('ZRANGE', aliasIndexKey, 0, -1)
+  -- Check actual primaries, not just scores: TTL is authoritative and stale
+  -- logical memberships must not keep a terminated lineage's aliases alive.
+  -- This check and deletion share the script's atomic boundary with rotation.
+  local logicalIndexKey = logicalIndexKeyPrefix .. logicalSessionId
+  local hasSurvivor = hasLiveMember(logicalIndexKey, sessionKeyPrefix, logicalSessionId, sessionId)
+
+  local aliasSessionIds = {}
+  if not hasSurvivor then
+    aliasSessionIds = redis.call('ZRANGE', aliasIndexKey, 0, -1)
+  end
 
   if redis.call('DEL', sessionKey) == 0 then
     return 0
@@ -341,7 +385,9 @@ local function deleteRecord(sessionKey, session)
     redis.call('DEL', aliasKeyPrefix .. aliasSessionId)
   end
 
-  redis.call('DEL', aliasIndexKey)
+  if not hasSurvivor then
+    redis.call('DEL', aliasIndexKey)
+  end
 
   return 1
 end
@@ -503,6 +549,30 @@ redis.call('ZADD', aliasIndexKey, newScore, oldSessionId)
 
 return 1
 `;
+var COMPARE_AND_DELETE_SCRIPT = `
+local current = redis.call('GET', KEYS[1])
+
+if current == ARGV[1] then
+  return redis.call('DEL', KEYS[1])
+else
+  return 0
+end
+`;
+var buildCompareAndDeleteCommand = (key, observedValue) => evalCommand(COMPARE_AND_DELETE_SCRIPT, [key], [observedValue]);
+var REPAIR_SESSION_INDEX_SCRIPT = `
+local current = redis.call('GET', KEYS[1])
+
+if current == false or (ARGV[3] == '1' and current == ARGV[2]) then
+  return redis.call('ZREM', KEYS[2], ARGV[1])
+end
+
+return 0
+`;
+var buildRepairSessionIndexCommand = (sessionKey, indexKey, sessionId, observedValue) => evalCommand(
+  REPAIR_SESSION_INDEX_SCRIPT,
+  [sessionKey, indexKey],
+  [sessionId, observedValue ?? "", observedValue === null ? "0" : "1"]
+);
 var buildWriteSessionCommand = (keys, session) => evalCommand(
   WRITE_SESSION_SCRIPT,
   [
@@ -567,11 +637,30 @@ var buildRotateSessionCommand = (keys, previousSession, nextSession) => evalComm
 // src/index.ts
 var INDEX_CLEANUP_SCAN_COUNT = 100;
 var INDEX_REVOCATION_SCAN_COUNT = 250;
+var snapshotInput = (input, seen = /* @__PURE__ */ new WeakMap()) => {
+  if (input === null || typeof input !== "object") return input;
+  const prototype = Object.getPrototypeOf(input);
+  if (!Array.isArray(input) && prototype !== Object.prototype && prototype !== null) return input;
+  if (seen.has(input)) return seen.get(input);
+  const copy = Array.isArray(input) ? new Array(input.length) : Object.create(prototype);
+  seen.set(input, copy);
+  for (const key of Reflect.ownKeys(input)) {
+    if (Object.prototype.propertyIsEnumerable.call(input, key)) {
+      Object.defineProperty(copy, key, {
+        value: snapshotInput(Reflect.get(input, key), seen),
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    }
+  }
+  return copy;
+};
 var isRecord = (value) => typeof value === "object" && value !== null;
 var isUnsupportedClusterClient = (client) => isRecord(client) && typeof client.getSlotMaster === "function" && typeof client.nodeClient === "function" && Array.isArray(client.masters) && Array.isArray(client.slots);
-var toSubjectDeleteInput = (input) => typeof input === "string" ? { subject: input } : input;
-var toProviderSessionDeleteInput = (input) => typeof input === "string" ? { providerSessionId: input } : input;
-var toLogicalSessionDeleteInput = (input) => typeof input === "string" ? { logicalSessionId: input } : input;
+var toSubjectDeleteInput = (input) => typeof input === "string" ? { subject: input } : { ...input };
+var toProviderSessionDeleteInput = (input) => typeof input === "string" ? { providerSessionId: input } : { ...input };
+var toLogicalSessionDeleteInput = (input) => typeof input === "string" ? { logicalSessionId: input } : { ...input };
 var matchesProviderScope = (session, input) => {
   if (input.issuer !== void 0 && session.provider?.issuer !== input.issuer) {
     return false;
@@ -608,16 +697,35 @@ var RedisOidcVaultStore = class {
     return this.consumeJson(
       this.keys.authorizationTransaction(state),
       "authorization transaction",
-      validateAuthorizationTransaction
+      (value) => validateAuthorizationTransaction(value, state)
     );
   }
   async createExchangeCode(input) {
     await this.setJson(this.keys.exchangeCode(input.code), input, input.expiresAt);
   }
   async consumeExchangeCode(code) {
-    return this.consumeJson(this.keys.exchangeCode(code), "exchange code", validateExchangeCodeRecord);
+    return this.consumeJson(
+      this.keys.exchangeCode(code),
+      "exchange code",
+      (value) => validateExchangeCodeRecord(value, code)
+    );
   }
+  /**
+   * Creates a session record atomically, then runs best-effort index
+   * maintenance.
+   *
+   * Result policy (SVH-02): once `writeSessionRecord` reports success the
+   * session is committed and this method resolves with the session even if
+   * post-commit index maintenance (`SCAN`/`TYPE`/`TIME`/`ZREMRANGEBYSCORE`)
+   * fails. A maintenance failure is reported once via a fixed-text
+   * `console.warn` identifying only the operation (no adapter error details,
+   * session IDs, keys, or token material) and is retried opportunistically by
+   * a later `createSession`/`rotateSession` call. Mutation-command failures (the
+   * atomic write script) still reject, and this method never retries a
+   * committed mutation.
+   */
   async createSession(input) {
+    input = snapshotInput({ ...input });
     const timestamp = this.now();
     const session = {
       ...input,
@@ -629,13 +737,16 @@ var RedisOidcVaultStore = class {
     if (!written) {
       throw new OidcVaultStoreConflictError("OIDC vault session already exists.");
     }
-    await this.cleanupStaleIndexKeys();
+    await this.runPostCommitIndexMaintenance("createSession");
     return session;
   }
   async getSession(sessionId) {
-    return this.getJson(this.keys.session(sessionId), "session", validateSession, { deleteMalformed: true });
+    return this.getJson(this.keys.session(sessionId), "session", (value) => validateSession(value, sessionId), {
+      deleteMalformed: true
+    });
   }
   async rotateSession(input) {
+    input = { sessionId: input.sessionId, nextSession: snapshotInput({ ...input.nextSession }) };
     const previousSession = await this.getSession(input.sessionId);
     if (!previousSession) {
       throw new OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
@@ -651,7 +762,7 @@ var RedisOidcVaultStore = class {
     if (!rotated) {
       throw new OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
     }
-    await this.cleanupStaleIndexKeys();
+    await this.runPostCommitIndexMaintenance("rotateSession");
     return nextSession;
   }
   async deleteSession(sessionId) {
@@ -665,13 +776,11 @@ var RedisOidcVaultStore = class {
       );
       if (logicalSessionId) {
         await this.deleteSessionsByLogicalSessionId(logicalSessionId);
-        await this.deleteRotatedSessionAliasesByLogicalSessionId(logicalSessionId);
       }
-      await this.client.del(this.keys.session(sessionId));
+      await this.deleteSessionKeyIfMalformed(sessionId);
       return;
     }
     await this.deleteSessionRecord(session, { kind: "single" });
-    await this.deleteRotatedSessionAliasesByLogicalSessionId(session.logicalSessionId ?? session.sessionId);
   }
   async deleteSessionsByLogicalSessionId(input) {
     const resolved = toLogicalSessionDeleteInput(input);
@@ -701,11 +810,12 @@ var RedisOidcVaultStore = class {
     await this.client.set(key, serialize(value), options);
   }
   async getJson(key, recordKind, validate, options) {
+    const raw = await this.client.get(key);
     try {
-      return parseStoredJson(await this.client.get(key), recordKind, validate);
+      return parseStoredJson(raw, recordKind, validate);
     } catch (error) {
-      if (options?.deleteMalformed && error instanceof OidcVaultRedisStoreRecordError) {
-        await this.client.del(key);
+      if (options?.deleteMalformed && error instanceof OidcVaultRedisStoreRecordError && raw !== null) {
+        await this.deleteMalformedValueIfUnchanged(key, raw);
         return null;
       }
       throw error;
@@ -730,6 +840,43 @@ var RedisOidcVaultStore = class {
     const result = await this.runScript(buildDeleteSessionCommand(this.keys, session, scope));
     return typeof result === "number" ? result : Number(result);
   }
+  /**
+   * Removes a stored value only when it still equals the malformed payload
+   * observed by a prior read (SVH-03). The equality check runs inside the Lua
+   * script, so a concurrent `createSession` reusing the same ID is never
+   * destroyed by a stale repair.
+   */
+  async deleteMalformedValueIfUnchanged(key, observedRaw) {
+    await this.runScript(buildCompareAndDeleteCommand(key, observedRaw));
+  }
+  /**
+   * Best-effort cleanup for the missing-session branch of `deleteSession`.
+   * Re-reads the session key and removes it only when it still holds malformed
+   * data. A missing key needs no cleanup and a freshly created valid session
+   * (same-ID reuse after the earlier read) is preserved; genuine logout of a
+   * live session never reaches this branch.
+   */
+  async deleteSessionKeyIfMalformed(sessionId) {
+    const sessionKey = this.keys.session(sessionId);
+    let raw;
+    try {
+      raw = await this.client.get(sessionKey);
+    } catch {
+      return;
+    }
+    if (raw === null) {
+      return;
+    }
+    try {
+      parseStoredJson(raw, "session", (value) => validateSession(value, sessionId));
+    } catch (error) {
+      if (error instanceof OidcVaultRedisStoreRecordError) {
+        await this.deleteMalformedValueIfUnchanged(sessionKey, raw);
+        return;
+      }
+      throw error;
+    }
+  }
   async rotateSessionRecord(previousSession, nextSession) {
     const result = await this.runScript(buildRotateSessionCommand(this.keys, previousSession, nextSession));
     if (result === 2 || result === "2") {
@@ -743,6 +890,20 @@ var RedisOidcVaultStore = class {
   async cleanupExpiredIndexMembers(indexKey) {
     await this.sendCommand(["ZREMRANGEBYSCORE", indexKey, "-inf", String(await this.redisServerTime())]);
   }
+  /**
+   * Runs optional post-commit index maintenance without letting it masquerade
+   * as a failed mutation. Any failure is reported once via a fixed-text
+   * warning and swallowed so the already-committed session result stands; the
+   * next successful create/rotate retries the incremental scan from the
+   * retained cursor. Never retries the committed mutation itself.
+   */
+  async runPostCommitIndexMaintenance(operation) {
+    try {
+      await this.cleanupStaleIndexKeys();
+    } catch {
+      console.warn(`OIDC vault Redis index maintenance failed after ${operation} and will retry on a later write.`);
+    }
+  }
   async cleanupStaleIndexKeys() {
     const response = await this.sendCommand([
       "SCAN",
@@ -793,10 +954,6 @@ var RedisOidcVaultStore = class {
     }
     return seconds * 1e3 + Math.floor(microseconds / 1e3);
   }
-  async getSessionIdsFromIndex(indexKey) {
-    const response = await this.sendCommand(["ZRANGE", indexKey, "0", "-1"]);
-    return Array.isArray(response) ? response.filter((value) => typeof value === "string") : [];
-  }
   async scanSessionIdsFromIndex(indexKey, cursor) {
     const response = await this.sendCommand(["ZSCAN", indexKey, cursor, "COUNT", String(INDEX_REVOCATION_SCAN_COUNT)]);
     if (!Array.isArray(response) || typeof response[0] !== "string" || !Array.isArray(response[1])) {
@@ -821,21 +978,25 @@ var RedisOidcVaultStore = class {
       throw new Error("OIDC vault Redis store received an unexpected MGET response.");
     }
     return Promise.all(
-      response.map(async (value, index) => {
+      sessionIds.map(async (sessionId, index) => {
+        const value = response[index];
+        const raw = typeof value === "string" ? value : null;
         try {
-          return typeof value === "string" ? parseStoredJson(value, "session", validateSession) : null;
+          return { session: parseStoredJson(raw, "session", (parsed) => validateSession(parsed, sessionId)), raw };
         } catch (error) {
-          if (error instanceof OidcVaultRedisStoreRecordError) {
-            await this.client.del(this.keys.session(sessionIds[index]));
-            return null;
+          if (error instanceof OidcVaultRedisStoreRecordError && typeof value === "string") {
+            await this.deleteMalformedValueIfUnchanged(this.keys.session(sessionId), value);
+            return { session: null, raw };
           }
           throw error;
         }
       })
     );
   }
-  async removeSessionIdFromIndex(indexKey, sessionId) {
-    await this.sendCommand(["ZREM", indexKey, sessionId]);
+  async removeSessionIdFromIndex(indexKey, sessionId, observedRaw) {
+    await this.runScript(
+      buildRepairSessionIndexCommand(this.keys.session(sessionId), indexKey, sessionId, observedRaw)
+    );
   }
   async deleteSessionsFromIndex(indexKey, scope) {
     await this.cleanupExpiredIndexMembers(indexKey);
@@ -849,21 +1010,21 @@ var RedisOidcVaultStore = class {
       }
       const sessions = await this.getSessionRecords(batch.sessionIds);
       for (const [index, sessionId] of batch.sessionIds.entries()) {
-        const session = sessions[index];
+        const { session, raw } = sessions[index] ?? { session: null, raw: null };
         if (!session) {
-          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          await this.removeSessionIdFromIndex(indexKey, sessionId, raw);
           continue;
         }
         if ("logicalSessionId" in scope && (session.logicalSessionId ?? session.sessionId) !== scope.logicalSessionId) {
-          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          await this.removeSessionIdFromIndex(indexKey, sessionId, raw);
           continue;
         }
         if ("subject" in scope && session.subject !== scope.subject) {
-          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          await this.removeSessionIdFromIndex(indexKey, sessionId, raw);
           continue;
         }
         if ("providerSessionId" in scope && session.providerSessionId !== scope.providerSessionId) {
-          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          await this.removeSessionIdFromIndex(indexKey, sessionId, raw);
           continue;
         }
         if (!("logicalSessionId" in scope) && !matchesProviderScope(session, scope)) {
@@ -871,11 +1032,13 @@ var RedisOidcVaultStore = class {
         }
         const revoked = await this.deleteSessionRecord(session, this.toDeleteScriptScope(scope));
         if (revoked > 0) {
-          await this.deleteRotatedSessionAliasesByLogicalSessionId(session.logicalSessionId ?? session.sessionId);
           deleted += revoked;
         }
       }
     } while (cursor !== "0");
+    if (deleted === 0 && "logicalSessionId" in scope) {
+      await this.runScript(buildCleanupInactiveAliasesCommand(this.keys, scope.logicalSessionId));
+    }
     return deleted;
   }
   toDeleteScriptScope(scope) {
@@ -892,16 +1055,6 @@ var RedisOidcVaultStore = class {
       clientId: scope.clientId
     };
   }
-  async deleteRotatedSessionAliasesByLogicalSessionId(logicalSessionId) {
-    const aliasIndexKey = this.keys.rotatedSessionAliasIndex(logicalSessionId);
-    await this.cleanupExpiredIndexMembers(aliasIndexKey);
-    const aliasSessionIds = await this.getSessionIdsFromIndex(aliasIndexKey);
-    if (aliasSessionIds.length === 0) {
-      return;
-    }
-    await this.client.del(aliasSessionIds.map((sessionId) => this.keys.rotatedSessionAlias(sessionId)));
-    await this.client.del(aliasIndexKey);
-  }
   async sendCommand(args) {
     return this.client.sendCommand(args);
   }

package/package.json

@@ -2,7 +2,7 @@
   "name": "@web-ts-toolkit/express-oidc-vault-redis-store",
   "description": "Redis store provider for @web-ts-toolkit/express-oidc-vault",
   "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/express-oidc-vault-redis-store",
-  "version": "0.43.0",
+  "version": "0.47.1",
   "sideEffects": false,
   "keywords": [
     "express",
@@ -29,7 +29,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@web-ts-toolkit/express-oidc-vault": "0.43.0"
+    "@web-ts-toolkit/express-oidc-vault": "0.47.1"
   },
   "files": [
     "**/*",