ioredis-toolkit 0.0.10 → 0.0.12

package/dist/session/scripts/touch.lua

@@ -1,72 +0,0 @@
--- touch.lua (version 1) - plain (v1) envelopes
--- Throttled, monotonic activity refresh for plain sessions.
---
--- The script is authoritative for all state checks (exists, status,
--- absolute expiry, idle expiry, throttle). Timestamps come from Redis
--- server time, so distributed application clocks cannot race each other.
---
--- KEYS[1] = session record key
---
--- ARGV[1] = touchInterval (seconds)
--- ARGV[2] = idleTimeout (seconds, '' when idle timeout disabled)
--- ARGV[3] = force (1 = ignore throttle)
---
--- Returns:
---   1   touched (write performed)
---   2   skipped: inside touchInterval
---   3   skipped: request older than recorded activity (not possible with
---       server time; retained for parity with the encrypted path)
---   0   not found
---   -1  consumed or revoked
---   -2  absolute expiry passed; record deleted
---   -3  idle expired; NOT resurrected
---   4   envelope is encrypted (caller must use the encrypted touch path)
-local raw = redis.call('GET', KEYS[1])
-
-if not raw then
-  return 0
-end
-
-local env = cjson.decode(raw)
-
-if env.v ~= 1 then
-  return 4
-end
-
-local s = env.s
-
-if s.status ~= 'active' then
-  return -1
-end
-
-local now = tonumber(redis.call('TIME')[1])
-
-if tonumber(s.absoluteExpiresAt) <= now then
-  redis.call('DEL', KEYS[1])
-  return -2
-end
-
-if s.idleExpiresAt and s.idleExpiresAt ~= cjson.null and tonumber(s.idleExpiresAt) <= now then
-  return -3
-end
-
-local interval = tonumber(ARGV[1])
-
-if tonumber(ARGV[3]) ~= 1 and now - tonumber(s.lastAccessedAt) < interval then
-  return 2
-end
-
-s.lastAccessedAt = now
-
-if ARGV[2] ~= '' then
-  local idle = now + tonumber(ARGV[2])
-  local abs = tonumber(s.absoluteExpiresAt)
-  -- Rolling extends the idle boundary but NEVER the absolute boundary.
-  s.idleExpiresAt = math.min(idle, abs)
-end
-
-local ttl = math.max(1, tonumber(s.absoluteExpiresAt) - now)
-
-redis.call('SET', KEYS[1], cjson.encode(env), 'EX', ttl)
-
-return 1

package/dist/session/scripts/validate.lua

@@ -1,90 +0,0 @@
--- validate.lua (version 1)
--- Single-round-trip validation read: fetches the session record, the
--- user's security version (when the key exists) and lazily cleans up
--- expired records and their index members, all in one same-slot script.
---
--- The script performs the cheap, non-cryptographic state checks; binding
--- checks and (for encrypted sessions) decryption happen app-side on the
--- returned payload. A missing security-version key means the check is
--- skipped (the version is only enforced once setSecurityVersion has run).
---
--- KEYS[1] = session record key
--- KEYS[2] = user security version key (same slot)
--- KEYS[3] = user session index key (same slot)
---
--- ARGV[1] = jti (used for the lazy index cleanup of encrypted records,
---            whose headers do not carry their own jti)
---
--- Returns:
---   {1, raw, securityVersion?}  record exists and passed script checks;
---                               raw is the stored envelope; securityVersion
---                               is the current user version when set
---   {0}                         not found
---   {-1, status}                not active (consumed/revoked)
---   {-2}                        expired (absolute); record + index entry
---                               removed
---   {-3}                        idle expired; record + index entry removed
---   {-4}                        security version mismatch (plain records)
-local raw = redis.call('GET', KEYS[1])
-
-if not raw then
-  return { 0 }
-end
-
-local currentRaw = redis.call('GET', KEYS[2])
-local currentVersion = nil
-
-if currentRaw then
-  currentVersion = tonumber(currentRaw)
-end
-
-local env = cjson.decode(raw)
-local now = tonumber(redis.call('TIME')[1])
-
-if env.v == 1 then
-  local s = env.s
-
-  if s.status ~= 'active' then
-    return { -1, s.status }
-  end
-
-  if tonumber(s.absoluteExpiresAt) <= now then
-    redis.call('DEL', KEYS[1])
-    redis.call('ZREM', KEYS[3], s.jti)
-    return { -2 }
-  end
-
-  if s.idleExpiresAt and s.idleExpiresAt ~= cjson.null and tonumber(s.idleExpiresAt) <= now then
-    redis.call('DEL', KEYS[1])
-    redis.call('ZREM', KEYS[3], s.jti)
-    return { -3 }
-  end
-
-  if currentVersion and (s.securityVersion == nil or tonumber(s.securityVersion) ~= currentVersion) then
-    return { -4 }
-  end
-elseif env.v == 2 then
-  -- Encrypted envelope: only the plaintext header mirrors are readable in
-  -- Lua. They are the script-level authority for state decisions; the
-  -- ciphertext remains authoritative for the payload (assertHeaderMatches).
-  if env.st ~= 'active' then
-    return { -1, env.st }
-  end
-
-  if tonumber(env.exp) <= now then
-    redis.call('DEL', KEYS[1])
-    redis.call('ZREM', KEYS[3], ARGV[1])
-    return { -2 }
-  end
-
-  if env.idle ~= cjson.null and tonumber(env.idle) <= now then
-    redis.call('DEL', KEYS[1])
-    redis.call('ZREM', KEYS[3], ARGV[1])
-    return { -3 }
-  end
-
-  -- Security version is checked app-side for encrypted records (it lives
-  -- only inside the ciphertext).
-end
-
-return { 1, raw, currentVersion }

package/dist/session/session-circuit-breaker.d.ts

@@ -1,42 +0,0 @@
-import type { SessionCircuitBreakerConfig } from './session-config.js';
-export type CircuitBreakerState = 'closed' | 'open' | 'half_open';
-/**
- * Fail-closed circuit breaker around session storage operations.
- *
- * `run()` executes a function while the circuit is closed or a half-open
- * probe is allowed, and throws {@link CircuitBreakerOpenError} when open.
- * Callers may instead use {@link tryAcquire} / {@link recordSuccess} /
- * {@link recordFailure} explicitly.
- */
-export declare class SessionCircuitBreaker {
-    private readonly config;
-    private readonly circuit;
-    private readonly now;
-    private readonly onTransition;
-    constructor(config: SessionCircuitBreakerConfig, options?: {
-        now?: () => number;
-        onTransition?: (state: CircuitBreakerState) => void;
-    });
-    get state(): CircuitBreakerState;
-    /**
-     * Runs an operation under circuit protection. Records success/failure
-     * based on the promise outcome.
-     *
-     * @throws {CircuitBreakerOpenError} when the circuit is open.
-     */
-    run<T>(fn: () => Promise<T>): Promise<T>;
-    /**
-     * Attempts to acquire a call slot synchronously. Returns false (fail
-     * closed) when the circuit is open and not yet ready for probes.
-     */
-    tryAcquire(): boolean;
-    /** Records a successful operation (closes a half-open circuit). */
-    recordSuccess(): void;
-    /** Records a failed operation (may open the circuit). */
-    recordFailure(): void;
-    /** Evaluates whether the open timer has elapsed, rolling to half-open. */
-    private rollHalfOpen;
-    private transitionTo;
-    /** Resets the breaker to closed (admin/repair). */
-    reset(): void;
-}

package/dist/session/session-circuit-breaker.js

@@ -1,129 +0,0 @@
-import { CircuitBreakerOpenError } from './session-errors.js';
-/**
- * Fail-closed circuit breaker around session storage operations.
- *
- * `run()` executes a function while the circuit is closed or a half-open
- * probe is allowed, and throws {@link CircuitBreakerOpenError} when open.
- * Callers may instead use {@link tryAcquire} / {@link recordSuccess} /
- * {@link recordFailure} explicitly.
- */
-export class SessionCircuitBreaker {
-    config;
-    circuit;
-    now;
-    onTransition;
-    constructor(config, options = {}) {
-        this.config = config;
-        this.now = options.now ?? (() => Date.now());
-        this.onTransition = options.onTransition ?? null;
-        this.circuit = {
-            state: 'closed',
-            consecutiveFailures: 0,
-            openedAt: 0,
-            halfOpenInFlight: 0,
-            halfOpenSucceeded: 0,
-        };
-    }
-    get state() {
-        return this.circuit.state;
-    }
-    /**
-     * Runs an operation under circuit protection. Records success/failure
-     * based on the promise outcome.
-     *
-     * @throws {CircuitBreakerOpenError} when the circuit is open.
-     */
-    async run(fn) {
-        if (!this.tryAcquire()) {
-            throw new CircuitBreakerOpenError();
-        }
-        try {
-            const result = await fn();
-            this.recordSuccess();
-            return result;
-        }
-        catch (error) {
-            this.recordFailure();
-            throw error;
-        }
-    }
-    /**
-     * Attempts to acquire a call slot synchronously. Returns false (fail
-     * closed) when the circuit is open and not yet ready for probes.
-     */
-    tryAcquire() {
-        this.rollHalfOpen();
-        if (this.circuit.state === 'closed')
-            return true;
-        if (this.circuit.state === 'half_open') {
-            if (this.circuit.halfOpenInFlight >= this.config.halfOpenMaxRequests) {
-                return false;
-            }
-            this.circuit.halfOpenInFlight += 1;
-            return true;
-        }
-        return false;
-    }
-    /** Records a successful operation (closes a half-open circuit). */
-    recordSuccess() {
-        if (this.circuit.state === 'closed') {
-            this.circuit.consecutiveFailures = 0;
-            return;
-        }
-        if (this.circuit.state !== 'half_open')
-            return;
-        this.circuit.halfOpenInFlight = Math.max(0, this.circuit.halfOpenInFlight - 1);
-        this.circuit.halfOpenSucceeded += 1;
-        if (this.circuit.halfOpenInFlight === 0 && this.circuit.halfOpenSucceeded >= 1) {
-            this.transitionTo('closed');
-        }
-    }
-    /** Records a failed operation (may open the circuit). */
-    recordFailure() {
-        if (this.circuit.state === 'closed') {
-            this.circuit.consecutiveFailures += 1;
-            if (this.circuit.consecutiveFailures >= this.config.failureThreshold) {
-                this.transitionTo('open');
-            }
-            return;
-        }
-        if (this.circuit.state === 'half_open') {
-            this.circuit.halfOpenInFlight = Math.max(0, this.circuit.halfOpenInFlight - 1);
-            this.transitionTo('open');
-        }
-    }
-    /** Evaluates whether the open timer has elapsed, rolling to half-open. */
-    rollHalfOpen() {
-        if (this.circuit.state === 'open' &&
-            this.now() - this.circuit.openedAt >= this.config.resetTimeoutMs) {
-            this.circuit.state = 'half_open';
-            this.circuit.halfOpenInFlight = 0;
-            this.circuit.halfOpenSucceeded = 0;
-            this.onTransition?.('half_open');
-        }
-    }
-    transitionTo(state) {
-        if (this.circuit.state === state)
-            return;
-        this.circuit.state = state;
-        if (state === 'open') {
-            this.circuit.openedAt = this.now();
-            this.circuit.halfOpenInFlight = 0;
-            this.circuit.halfOpenSucceeded = 0;
-        }
-        if (state === 'half_open') {
-            this.circuit.halfOpenInFlight = 0;
-            this.circuit.halfOpenSucceeded = 0;
-        }
-        if (state === 'closed') {
-            this.circuit.consecutiveFailures = 0;
-            this.circuit.halfOpenInFlight = 0;
-            this.circuit.halfOpenSucceeded = 0;
-        }
-        this.onTransition?.(state);
-    }
-    /** Resets the breaker to closed (admin/repair). */
-    reset() {
-        this.transitionTo('closed');
-    }
-}

package/dist/session/session-config.d.ts

@@ -1,355 +0,0 @@
-import { z } from 'zod';
-/** Default absolute session lifetime: 7 days. */
-export declare const TTL: number;
-/** Default idle timeout: 24 hours. */
-export declare const IDLE_TIMEOUT: number;
-/** Default touch throttle interval: 5 minutes. */
-export declare const TOUCH_INTERVAL: number;
-export declare const SessionStatusSchema: z.ZodEnum<{
-    active: "active";
-    consumed: "consumed";
-    revoked: "revoked";
-}>;
-/** How strictly session binding metadata (IP/UA/device) is enforced. */
-export declare const SessionBindingPolicySchema: z.ZodEnum<{
-    disabled: "disabled";
-    advisory: "advisory";
-    strict: "strict";
-}>;
-/** Optional fail-closed circuit breaker around session operations. */
-export interface SessionCircuitBreakerConfig {
-    /** Enable the fail-closed circuit breaker. Default: false. */
-    enabled: boolean;
-    /** Consecutive failures needed to open the circuit. */
-    failureThreshold: number;
-    /** Milliseconds the circuit stays open before half-open probes. */
-    resetTimeoutMs: number;
-    /** Maximum concurrent probe requests while half-open. */
-    halfOpenMaxRequests: number;
-}
-export declare const SessionCircuitBreakerConfigSchema: z.ZodPrefault<z.ZodObject<{
-    enabled: z.ZodDefault<z.ZodBoolean>;
-    failureThreshold: z.ZodDefault<z.ZodNumber>;
-    resetTimeoutMs: z.ZodDefault<z.ZodNumber>;
-    halfOpenMaxRequests: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip>>;
-/** Optional AES-256-GCM encryption of session data at rest. */
-export interface SessionEncryptionConfig {
-    /**
-     * Enable AES-256-GCM encryption at rest. Default: false.
-     *
-     * Evaluate first whether transport TLS, ACLs, private networking and
-     * infrastructure controls already cover your threat model. Encryption
-     * protects session data against a compromised Redis instance or its
-     * disk; it does NOT protect against a compromised application process.
-     */
-    enabled: boolean;
-    /**
-     * Re-encrypt with the current key version on touch/update (lazy key
-     * rotation). Default: true.
-     */
-    reEncryptOnWrite: boolean;
-}
-export declare const SessionEncryptionConfigSchema: z.ZodObject<{
-    enabled: z.ZodDefault<z.ZodBoolean>;
-    reEncryptOnWrite: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
-/** Metrics collection for session operations. */
-export interface SessionMetricsConfig {
-    /**
-     * Collect internal session metrics through the injected metrics adapter.
-     * When no adapter is provided, metrics are a safe no-op regardless.
-     */
-    enabled: boolean;
-}
-export declare const SessionMetricsConfigSchema: z.ZodObject<{
-    enabled: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
-/** Health check thresholds for the session dependency. */
-export interface SessionHealthConfig {
-    /** PING latency above this (ms) marks the dependency degraded. */
-    latencyThresholdMs: number;
-    /** Recent operation error rate above this marks the dependency degraded. */
-    errorRateThreshold: number;
-    /** Number of recent operations sampled for the error rate. */
-    errorWindowSize: number;
-}
-export declare const SessionHealthConfigSchema: z.ZodObject<{
-    latencyThresholdMs: z.ZodDefault<z.ZodNumber>;
-    errorRateThreshold: z.ZodDefault<z.ZodNumber>;
-    errorWindowSize: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip>;
-/** Cookie defaults for the framework-independent cookie manager. */
-export interface SessionCookieConfig {
-    /** Cookie name. Default: 'sid'. */
-    name: string;
-    /** Cookie Path attribute. Default: '/'. */
-    path: string;
-    /** Cookie Domain attribute (empty = host-only cookie). */
-    domain?: string;
-    /** HttpOnly attribute. Default: true. */
-    httpOnly: boolean;
-    /** Secure attribute. Default: true. */
-    secure: boolean;
-    /** SameSite attribute. Default: 'lax'. */
-    sameSite: 'strict' | 'lax' | 'none';
-    /** Max-Age in seconds (falls back to the session TTL when unset). */
-    maxAge?: number;
-}
-export declare const SessionCookieConfigSchema: z.ZodObject<{
-    name: z.ZodDefault<z.ZodString>;
-    path: z.ZodDefault<z.ZodString>;
-    domain: z.ZodOptional<z.ZodString>;
-    httpOnly: z.ZodDefault<z.ZodBoolean>;
-    secure: z.ZodDefault<z.ZodBoolean>;
-    sameSite: z.ZodDefault<z.ZodEnum<{
-        none: "none";
-        strict: "strict";
-        lax: "lax";
-    }>>;
-    maxAge: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>;
-/** Limits protecting Redis memory, Lua and pipelines. */
-export interface SessionLimitsConfig {
-    /** Maximum serialized metadata size in bytes (reject larger writes). */
-    maxMetadataSize: number;
-    /** Maximum sessions fetched per list page. */
-    maxListPageSize: number;
-    /** Maximum session keys touched by one Lua script invocation. */
-    maxBatchSize: number;
-    /** Maximum concurrent cross-slot pipelines (revokeAll, jti cleanup). */
-    maxFanOutConcurrency: number;
-    /** Maximum sessions evicted by a single enforce-limit script call. */
-    maxEvictionsPerCall: number;
-    /** Maximum session deletions per user-request path (revokeAll/destroy-all). */
-    maxSessionsPerUserHardCap: number;
-}
-export declare const SessionLimitsConfigSchema: z.ZodObject<{
-    maxMetadataSize: z.ZodDefault<z.ZodNumber>;
-    maxListPageSize: z.ZodDefault<z.ZodNumber>;
-    maxBatchSize: z.ZodDefault<z.ZodNumber>;
-    maxFanOutConcurrency: z.ZodDefault<z.ZodNumber>;
-    maxEvictionsPerCall: z.ZodDefault<z.ZodNumber>;
-    maxSessionsPerUserHardCap: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip>;
-/** Full parsed session configuration (defaults applied by the schema). */
-export interface SessionConfig {
-    /**
-     * Master switch. Sessions are NOT enabled implicitly; an application
-     * must explicitly opt in. Default: false.
-     */
-    enabled: boolean;
-    /** Key namespace for all session keys. Default: 'authcore'. */
-    namespace: string;
-    /**
-     * Raw session token entropy in bytes (32 = 256 bits). Minimum 16
-     * (128 bits). Default: 32.
-     */
-    tokenBytes: number;
-    /**
-     * Absolute session lifetime in seconds (the hard maximum). Redis TTL is
-     * derived from this boundary; touch/rolling NEVER extends past it.
-     * Default: 7 days.
-     */
-    ttl: number;
-    /**
-     * Idle timeout in seconds. When null, sessions never expire through
-     * inactivity. Default: 1 day.
-     */
-    idleTimeout: number | null;
-    /**
-     * Rolling sessions: valid activity extends the idle boundary (never the
-     * absolute boundary). Only meaningful when idleTimeout is set.
-     * Default: true.
-     */
-    rolling: boolean;
-    /**
-     * Touch throttling in seconds: touch() performs no write when the last
-     * activity is more recent than this interval. Default: 300.
-     */
-    touchInterval: number;
-    /**
-     * Maximum concurrent sessions per user. 0 disables the limit.
-     * Default: 20.
-     *
-     * Enforcement is atomic per create (same-slot Lua): the create that
-     * pushes the count over the limit evicts the oldest excess sessions in
-     * the same script, so concurrent logins cannot both observe spare
-     * capacity. For extremely large per-user session counts, eviction is
-     * bounded per script call and converges over subsequent creates.
-     */
-    maxSessionsPerUser: number;
-    /** Store the device id on creation (advisory binding). Default: false. */
-    storeDeviceId: boolean;
-    /** Store the IP address on creation (advisory binding). Default: false. */
-    storeIpAddress: boolean;
-    /** Store the user agent on creation (advisory binding). Default: false. */
-    storeUserAgent: boolean;
-    /**
-     * Session binding policy. 'disabled' (default) ignores binding fields;
-     * 'advisory' reports mismatches on validation; 'strict' rejects with
-     * reason 'binding_mismatch'. IP addresses change (NAT, mobile), user
-     * agents are spoofable, device ids may be absent — do not enable strict
-     * binding lightly.
-     */
-    bindingPolicy: 'disabled' | 'advisory' | 'strict';
-    /**
-     * Security versioning. When enabled, validate() requires the session's
-     * securityVersion to match the current version stored at
-     * `{ns}:security-version:{userId}`. Use setSecurityVersion(userId, v)
-     * after password changes / MFA resets to invalidate all older sessions.
-     */
-    securityVersion: {
-        enabled: boolean;
-    };
-    /**
-     * Optional global JTI -> userId lookup index.
-     *
-     * Default: false. Prefer passing userId to validate()/get()/rotate() —
-     * the authentication layer already knows it, and the index adds a write,
-     * a read, a second consistency boundary and a second key family. The
-     * index is NEVER authoritative: the session record is. It has its own
-     * TTL, self-heals on read, and a missing entry is not proof of absence
-     * (see docs/architecture for exact semantics).
-     */
-    jtiIndex: {
-        enabled: boolean;
-    };
-    /**
-     * Check the revocation store during validate(). Off by default:
-     * in-record revocation (status revoked/consumed) already covers rotation
-     * reuse and session-level revoke; the revocation store is for external
-     * JTI revocations (e.g. JWT jti denylists) and adds a second read.
-     */
-    checkRevocationStore: boolean;
-    /** Optional AES-256-GCM encryption at rest. Default: disabled. */
-    encryption: SessionEncryptionConfig;
-    /** Optional fail-closed circuit breaker. Default: disabled. */
-    circuitBreaker: SessionCircuitBreakerConfig;
-    /** Metrics collection. Default: enabled (no-op without an adapter). */
-    metrics: SessionMetricsConfig;
-    /** Health check thresholds. */
-    health: SessionHealthConfig;
-    /** Cookie defaults for the framework-independent cookie manager. */
-    cookie: SessionCookieConfig;
-    /** Operational limits (memory, Lua, pipeline bounds). */
-    limits: SessionLimitsConfig;
-    /**
-     * Idempotent creation: when SessionCreateInput.idempotencyKey is set,
-     * store a short-lived claim so retries return the original session.
-     * Default: false.
-     */
-    enableCreateIdempotency: boolean;
-    /**
-     * Retain a short-lived consumed tombstone after rotation instead of
-     * deleting the old record, enabling replay detection. The tombstone is
-     * bounded by the remaining absolute lifetime. Default: true.
-     */
-    retainConsumedTombstones: boolean;
-    /**
-     * On genuine reuse of an already-rotated-away (consumed) session token -
-     * not a same-nonce idempotent retry of an in-flight rotation - atomically
-     * revoke the entire rotation lineage's current active generation instead
-     * of only rejecting the replayed request. This is the strongest response
-     * to stolen refresh-token reuse (specification ยง5): if an attacker
-     * captured an old token and the legitimate client has since rotated past
-     * it, this kills the session the attacker could otherwise keep riding,
-     * rather than leaving it live while only the stale replay is rejected.
-     *
-     * Has no effect unless retainConsumedTombstones is also true: a replay
-     * can only be detected while a consumed tombstone still exists to be
-     * replayed against. Default: false (opt-in - a false positive here is a
-     * full lineage kill, so it should be turned on deliberately once the
-     * caller's retry semantics are understood; the resulting
-     * SessionReplayError with reason 'family_revoked' should be handled as
-     * a security event, e.g. forcing full re-authentication and logging).
-     */
-    revokeFamilyOnReplay: boolean;
-}
-export declare const SessionConfigSchema: z.ZodObject<{
-    enabled: z.ZodDefault<z.ZodBoolean>;
-    namespace: z.ZodDefault<z.ZodString>;
-    tokenBytes: z.ZodDefault<z.ZodNumber>;
-    ttl: z.ZodDefault<z.ZodNumber>;
-    idleTimeout: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
-    rolling: z.ZodDefault<z.ZodBoolean>;
-    touchInterval: z.ZodDefault<z.ZodNumber>;
-    maxSessionsPerUser: z.ZodDefault<z.ZodNumber>;
-    storeDeviceId: z.ZodDefault<z.ZodBoolean>;
-    storeIpAddress: z.ZodDefault<z.ZodBoolean>;
-    storeUserAgent: z.ZodDefault<z.ZodBoolean>;
-    bindingPolicy: z.ZodDefault<z.ZodEnum<{
-        disabled: "disabled";
-        advisory: "advisory";
-        strict: "strict";
-    }>>;
-    securityVersion: z.ZodPrefault<z.ZodObject<{
-        enabled: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip>>;
-    jtiIndex: z.ZodPrefault<z.ZodObject<{
-        enabled: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip>>;
-    checkRevocationStore: z.ZodDefault<z.ZodBoolean>;
-    encryption: z.ZodPrefault<z.ZodObject<{
-        enabled: z.ZodDefault<z.ZodBoolean>;
-        reEncryptOnWrite: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip>>;
-    circuitBreaker: z.ZodPrefault<z.ZodObject<{
-        enabled: z.ZodDefault<z.ZodBoolean>;
-        failureThreshold: z.ZodDefault<z.ZodNumber>;
-        resetTimeoutMs: z.ZodDefault<z.ZodNumber>;
-        halfOpenMaxRequests: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip>>;
-    metrics: z.ZodPrefault<z.ZodObject<{
-        enabled: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip>>;
-    health: z.ZodPrefault<z.ZodObject<{
-        latencyThresholdMs: z.ZodDefault<z.ZodNumber>;
-        errorRateThreshold: z.ZodDefault<z.ZodNumber>;
-        errorWindowSize: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip>>;
-    cookie: z.ZodPrefault<z.ZodObject<{
-        name: z.ZodDefault<z.ZodString>;
-        path: z.ZodDefault<z.ZodString>;
-        domain: z.ZodOptional<z.ZodString>;
-        httpOnly: z.ZodDefault<z.ZodBoolean>;
-        secure: z.ZodDefault<z.ZodBoolean>;
-        sameSite: z.ZodDefault<z.ZodEnum<{
-            none: "none";
-            strict: "strict";
-            lax: "lax";
-        }>>;
-        maxAge: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>>;
-    limits: z.ZodPrefault<z.ZodObject<{
-        maxMetadataSize: z.ZodDefault<z.ZodNumber>;
-        maxListPageSize: z.ZodDefault<z.ZodNumber>;
-        maxBatchSize: z.ZodDefault<z.ZodNumber>;
-        maxFanOutConcurrency: z.ZodDefault<z.ZodNumber>;
-        maxEvictionsPerCall: z.ZodDefault<z.ZodNumber>;
-        maxSessionsPerUserHardCap: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip>>;
-    enableCreateIdempotency: z.ZodDefault<z.ZodBoolean>;
-    retainConsumedTombstones: z.ZodDefault<z.ZodBoolean>;
-    revokeFamilyOnReplay: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
-/** Recursively makes every config field optional (matches the schema's input shape). */
-export type DeepPartial<T> = {
-    [K in keyof T]?: T[K] extends object ? DeepPartial<T[K]> : T[K];
-};
-/** Raw unparsed config input (all fields optional, nested included). */
-export type SessionConfigInput = DeepPartial<SessionConfig>;
-/** Raw unparsed config (partial, defaults applied). */
-export type PartialSessionConfig = Partial<SessionConfigInput>;
-/**
- * Parses and validates session configuration.
- *
- * @throws {SessionConfigurationError} with a safe message on invalid config.
- */
-export declare function parseSessionConfig(input?: PartialSessionConfig): SessionConfig;
-/**
- * Returns a redacted copy of the config suitable for logging.
- * Strips nothing by default (no secrets are allowed in config), but the
- * serializer is explicit so future secret-bearing fields cannot leak.
- */
-export declare function redactSessionConfig(config: SessionConfig): Record<string, unknown>;