ioredis-toolkit 0.0.10 → 0.5.0

package/dist/session/session-config.js

@@ -1,171 +0,0 @@
-import { z } from 'zod';
-import { SessionConfigurationError } from './session-errors.js';
-/* -------------------------------------------------------------------------- */
-/* Session configuration.                                                      */
-/*                                                                             */
-/* The public types below (SessionConfig + nested configs) are documented      */
-/* interfaces: they are what editors show in intellisense. The Zod schemas     */
-/* are the runtime validator; a compile-time shape guard (see bottom) keeps    */
-/* the interfaces and schemas in sync.                                         */
-/*                                                                             */
-/* Secrets (encryption keys, Redis credentials) NEVER live in this config.     */
-/* Encryption keys are injected via a SessionKeyProvider at construction.      */
-/* -------------------------------------------------------------------------- */
-/** Default absolute session lifetime: 7 days. */
-export const TTL = 7 * 24 * 60 * 60;
-/** Default idle timeout: 24 hours. */
-export const IDLE_TIMEOUT = 24 * 60 * 60;
-/** Default touch throttle interval: 5 minutes. */
-export const TOUCH_INTERVAL = 5 * 60;
-export const SessionStatusSchema = z.enum(['active', 'consumed', 'revoked']);
-/** How strictly session binding metadata (IP/UA/device) is enforced. */
-export const SessionBindingPolicySchema = z.enum(['disabled', 'advisory', 'strict']);
-export const SessionCircuitBreakerConfigSchema = z
-    .object({
-    enabled: z.boolean().default(false),
-    failureThreshold: z.number().int().min(1).default(10),
-    resetTimeoutMs: z.number().int().min(1000).default(30_000),
-    halfOpenMaxRequests: z.number().int().min(1).default(5),
-})
-    .prefault({});
-export const SessionEncryptionConfigSchema = z.object({
-    enabled: z.boolean().default(false),
-    reEncryptOnWrite: z.boolean().default(true),
-});
-export const SessionMetricsConfigSchema = z.object({
-    enabled: z.boolean().default(true),
-});
-export const SessionHealthConfigSchema = z.object({
-    latencyThresholdMs: z.number().int().min(1).default(200),
-    errorRateThreshold: z.number().min(0).max(1).default(0.1),
-    errorWindowSize: z.number().int().min(1).default(100),
-});
-export const SessionCookieConfigSchema = z
-    .object({
-    name: z.string().min(1).max(128).default('sid'),
-    path: z.string().min(1).default('/'),
-    domain: z.string().optional(),
-    httpOnly: z.boolean().default(true),
-    secure: z.boolean().default(true),
-    sameSite: z.enum(['strict', 'lax', 'none']).default('lax'),
-    maxAge: z.number().int().min(1).optional(),
-})
-    .superRefine((data, ctx) => {
-    // SameSite=None is rejected by browsers unless Secure is set.
-    if (data.sameSite === 'none' && !data.secure) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: 'SameSite=None requires secure: true',
-            path: ['sameSite'],
-        });
-    }
-});
-export const SessionLimitsConfigSchema = z.object({
-    maxMetadataSize: z.number().int().min(0).default(4096),
-    maxListPageSize: z.number().int().min(1).default(100),
-    maxBatchSize: z.number().int().min(1).max(500).default(100),
-    maxFanOutConcurrency: z.number().int().min(1).max(64).default(8),
-    maxEvictionsPerCall: z.number().int().min(1).max(5000).default(1000),
-    maxSessionsPerUserHardCap: z.number().int().min(0).default(10_000),
-});
-export const SessionConfigSchema = z
-    .object({
-    enabled: z.boolean().default(false),
-    namespace: z.string().min(1).max(64).default('authcore'),
-    tokenBytes: z.number().int().min(16).max(64).default(32),
-    ttl: z.number().int().min(1).default(TTL),
-    idleTimeout: z.number().int().min(1).nullable().default(IDLE_TIMEOUT),
-    rolling: z.boolean().default(true),
-    touchInterval: z.number().int().min(0).default(TOUCH_INTERVAL),
-    maxSessionsPerUser: z.number().int().min(0).default(20),
-    storeDeviceId: z.boolean().default(false),
-    storeIpAddress: z.boolean().default(false),
-    storeUserAgent: z.boolean().default(false),
-    bindingPolicy: SessionBindingPolicySchema.default('disabled'),
-    securityVersion: z
-        .object({
-        enabled: z.boolean().default(false),
-    })
-        .prefault({}),
-    jtiIndex: z
-        .object({
-        enabled: z.boolean().default(false),
-    })
-        .prefault({}),
-    checkRevocationStore: z.boolean().default(false),
-    encryption: SessionEncryptionConfigSchema.prefault({}),
-    circuitBreaker: SessionCircuitBreakerConfigSchema,
-    metrics: SessionMetricsConfigSchema.prefault({}),
-    health: SessionHealthConfigSchema.prefault({}),
-    cookie: SessionCookieConfigSchema.prefault({}),
-    limits: SessionLimitsConfigSchema.prefault({}),
-    enableCreateIdempotency: z.boolean().default(false),
-    retainConsumedTombstones: z.boolean().default(true),
-    revokeFamilyOnReplay: z.boolean().default(false),
-})
-    .superRefine((data, ctx) => {
-    if (data.idleTimeout !== null && data.idleTimeout > data.ttl) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: 'idleTimeout must not exceed ttl (absolute lifetime)',
-            path: ['idleTimeout'],
-        });
-    }
-    if (data.touchInterval > data.ttl) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: 'touchInterval must not exceed ttl',
-            path: ['touchInterval'],
-        });
-    }
-    if (data.revokeFamilyOnReplay && !data.retainConsumedTombstones) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: 'revokeFamilyOnReplay requires retainConsumedTombstones: replay can only be ' +
-                'detected while a consumed tombstone still exists to be replayed against.',
-            path: ['revokeFamilyOnReplay'],
-        });
-    }
-});
-/**
- * Parses and validates session configuration.
- *
- * @throws {SessionConfigurationError} with a safe message on invalid config.
- */
-export function parseSessionConfig(input = {}) {
-    try {
-        return SessionConfigSchema.parse(input);
-    }
-    catch (error) {
-        if (error instanceof z.ZodError) {
-            const first = error.issues[0];
-            const where = first?.path.length ? ` at "${first.path.join('.')}"` : '';
-            throw new SessionConfigurationError(`Invalid session configuration${where}: ${first?.message ?? 'unknown error'}`);
-        }
-        throw error;
-    }
-}
-/**
- * Returns a redacted copy of the config suitable for logging.
- * Strips nothing by default (no secrets are allowed in config), but the
- * serializer is explicit so future secret-bearing fields cannot leak.
- */
-export function redactSessionConfig(config) {
-    return {
-        enabled: config.enabled,
-        namespace: config.namespace,
-        tokenBytes: config.tokenBytes,
-        ttl: config.ttl,
-        idleTimeout: config.idleTimeout,
-        rolling: config.rolling,
-        touchInterval: config.touchInterval,
-        maxSessionsPerUser: config.maxSessionsPerUser,
-        bindingPolicy: config.bindingPolicy,
-        securityVersion: config.securityVersion.enabled,
-        jtiIndex: config.jtiIndex.enabled,
-        checkRevocationStore: config.checkRevocationStore,
-        encryption: { enabled: config.encryption.enabled },
-        circuitBreaker: { enabled: config.circuitBreaker.enabled },
-        cookie: { name: config.cookie.name, secure: config.cookie.secure },
-    };
-}

package/dist/session/session-cookie.d.ts

@@ -1,72 +0,0 @@
-import type { SessionCookieConfig } from './session-config.js';
-export interface SerializeCookieOptions {
-    /** Overrides the Max-Age (seconds). Defaults to config.maxAge. */
-    maxAge?: number;
-    /** Overrides the Path attribute. */
-    path?: string;
-}
-/** Structured Set-Cookie attributes, mirroring the serialized header. */
-export interface SerializedCookieAttributes {
-    path: string;
-    domain?: string;
-    httpOnly: boolean;
-    secure: boolean;
-    sameSite: 'strict' | 'lax' | 'none';
-    maxAge?: number;
-}
-/**
- * A serialized cookie: the `Set-Cookie` header string plus the same
- * attributes as structured fields for frameworks that need the pieces
- * (or for tests asserting the exact shape).
- */
-export interface SerializedCookie {
-    /** The full `Set-Cookie` header value. */
-    header: string;
-    /** The cookie name. */
-    name: string;
-    /** The cookie value — the raw session token. */
-    value: string;
-    /** Structured attributes mirroring the header. */
-    attributes: SerializedCookieAttributes;
-}
-/**
- * Builds Set-Cookie values and reads Cookie headers for session tokens.
- */
-export declare class SessionCookieManager {
-    private readonly config;
-    constructor(config: SessionCookieConfig);
-    /** The configured cookie name. */
-    get name(): string;
-    /**
-     * Builds the `Set-Cookie` header value for a freshly created session.
-     *
-     * @example
-     * ```ts
-     * const header = cookies.serialize(token, { maxAge: ttlSeconds });
-     * res.setHeader('Set-Cookie', header);
-     * ```
-     */
-    serialize(token: string, options?: SerializeCookieOptions): string;
-    /**
-     * Like {@link serialize}, but returns the header string together with the
-     * structured cookie object.
-     *
-     * @example
-     * ```ts
-     * const cookie = cookies.serializeWithAttributes(token, { maxAge: ttlSeconds });
-     * res.setHeader('Set-Cookie', cookie.header);
-     * console.log(cookie.attributes.sameSite);
-     * ```
-     */
-    serializeWithAttributes(token: string, options?: SerializeCookieOptions): SerializedCookie;
-    private buildHeader;
-    /**
-     * Builds the `Set-Cookie` header value that expires the cookie immediately.
-     */
-    clear(options?: SerializeCookieOptions): string;
-    /**
-     * Extracts the session token from a `Cookie` request header, or null when
-     * the cookie is absent or its value is empty.
-     */
-    parse(header: string | null | undefined): string | null;
-}

package/dist/session/session-cookie.js

@@ -1,101 +0,0 @@
-/**
- * Builds Set-Cookie values and reads Cookie headers for session tokens.
- */
-export class SessionCookieManager {
-    config;
-    constructor(config) {
-        this.config = config;
-    }
-    /** The configured cookie name. */
-    get name() {
-        return this.config.name;
-    }
-    /**
-     * Builds the `Set-Cookie` header value for a freshly created session.
-     *
-     * @example
-     * ```ts
-     * const header = cookies.serialize(token, { maxAge: ttlSeconds });
-     * res.setHeader('Set-Cookie', header);
-     * ```
-     */
-    serialize(token, options = {}) {
-        return this.serializeWithAttributes(token, options).header;
-    }
-    /**
-     * Like {@link serialize}, but returns the header string together with the
-     * structured cookie object.
-     *
-     * @example
-     * ```ts
-     * const cookie = cookies.serializeWithAttributes(token, { maxAge: ttlSeconds });
-     * res.setHeader('Set-Cookie', cookie.header);
-     * console.log(cookie.attributes.sameSite);
-     * ```
-     */
-    serializeWithAttributes(token, options = {}) {
-        const path = options.path ?? this.config.path;
-        const maxAge = options.maxAge ?? this.config.maxAge;
-        const header = this.buildHeader(token, path, maxAge);
-        const attributes = {
-            path,
-            httpOnly: this.config.httpOnly,
-            secure: this.config.secure,
-            sameSite: this.config.sameSite,
-        };
-        if (this.config.domain)
-            attributes.domain = this.config.domain;
-        if (maxAge !== undefined)
-            attributes.maxAge = Math.max(0, Math.floor(maxAge));
-        return { header, name: this.config.name, value: token, attributes };
-    }
-    buildHeader(token, path, maxAge) {
-        const parts = [`${this.config.name}=${token}`];
-        parts.push(`Path=${path}`);
-        if (this.config.domain) {
-            parts.push(`Domain=${this.config.domain}`);
-        }
-        if (this.config.httpOnly)
-            parts.push('HttpOnly');
-        if (this.config.secure)
-            parts.push('Secure');
-        parts.push(`SameSite=${capitalize(this.config.sameSite)}`);
-        if (maxAge !== undefined) {
-            parts.push(`Max-Age=${Math.max(0, Math.floor(maxAge))}`);
-        }
-        return parts.join('; ');
-    }
-    /**
-     * Builds the `Set-Cookie` header value that expires the cookie immediately.
-     */
-    clear(options = {}) {
-        const parts = [`${this.config.name}=`];
-        parts.push(`Path=${options.path ?? this.config.path}`);
-        if (this.config.domain) {
-            parts.push(`Domain=${this.config.domain}`);
-        }
-        parts.push('Max-Age=0');
-        parts.push('Expires=Thu, 01 Jan 1970 00:00:00 GMT');
-        return parts.join('; ');
-    }
-    /**
-     * Extracts the session token from a `Cookie` request header, or null when
-     * the cookie is absent or its value is empty.
-     */
-    parse(header) {
-        if (!header)
-            return null;
-        const prefix = `${this.config.name}=`;
-        for (const part of header.split(';')) {
-            const trimmed = part.trim();
-            if (trimmed.startsWith(prefix)) {
-                const value = trimmed.slice(prefix.length);
-                return value.length > 0 ? value : null;
-            }
-        }
-        return null;
-    }
-}
-function capitalize(value) {
-    return value.charAt(0).toUpperCase() + value.slice(1);
-}

package/dist/session/session-encryption.d.ts

@@ -1,87 +0,0 @@
-import type { EncryptedSessionEnvelope } from './session-types.js';
-/**
- * Key management abstraction. Applications provide their own implementation
- * (KMS, secret store, env-based rotation), or a simple in-memory map of
- * versions to 32-byte keys for single-process deployments.
- */
-export interface SessionKeyProvider {
-    /**
-     * Returns the encryption key used for all WRITES (new sessions, updates,
-     * re-encryption on touch). Called on every encryption.
-     *
-     * The version labels which key produced the ciphertext: it is stored in
-     * the session envelope (`k` field) so the corresponding key can be looked
-     * up later on read. Always return the current key here — never an
-     * arbitrary one.
-     *
-     * The key may be a 32-byte Buffer or a string (see {@link toKeyBuffer} for
-     * the accepted encodings). Whatever form is returned here must also be
-     * resolvable via {@link getKey} for the same version.
-     */
-    getCurrentKey(): {
-        keyVersion: number;
-        key: Buffer | string;
-    };
-    /**
-     * Returns the key for a specific version, or null when that version is no
-     * longer available. Called on every READ (decryption).
-     *
-     * Every session records the version it was encrypted with; this lookup
-     * resolves it. Returning null makes sessions encrypted with that version
-     * undecryptable — they surface as {@link SessionSerializationError}.
-     *
-     * This is what enables safe key rotation: when the current key changes,
-     * old keys must stay available here so previously written sessions keep
-     * decrypting. Only drop a version once every session using it has expired
-     * or been re-encrypted with the current key.
-     */
-    getKey(keyVersion: number): Buffer | string | null;
-}
-/**
- * Normalizes a key to a Buffer for use with AES-256-GCM.
- *
- * Buffers are returned as-is. Strings are decoded in priority order:
- *  - 64 hex characters        -> hex
- *  - base64 / base64url text that decodes to exactly 32 bytes -> base64
- *  - anything else            -> utf8 (a 32-character passphrase)
- *
- * The decoded key must be 32 bytes (AES-256) for Node's crypto to accept
- * it; {@link StaticSessionKeyProvider} validates this at construction.
- */
-export declare function toKeyBuffer(key: Buffer | string): Buffer;
-/** A simple key provider for single-process deployments (env/CLI injection). */
-export declare class StaticSessionKeyProvider implements SessionKeyProvider {
-    private readonly currentVersion;
-    private readonly keys;
-    constructor(keys: ReadonlyMap<number, Buffer | string>, currentVersion: number);
-    getCurrentKey(): {
-        keyVersion: number;
-        key: Buffer;
-    };
-    getKey(keyVersion: number): Buffer | null;
-}
-/**
- * Creates a {@link StaticSessionKeyProvider} with one freshly generated
- * 32-byte key. Convenience for local development and tests; production
- * deployments should derive keys from a KMS/vault instead.
- *
- * @param keyVersion - Version label for the generated key (default 1).
- */
-export declare function createRandomSessionKeyProvider(keyVersion?: number): StaticSessionKeyProvider;
-/**
- * Encrypts a plaintext payload with AES-256-GCM using the current key.
- * Returns a fresh random IV + auth tag per call.
- */
-export declare function encryptPayload(plaintext: Buffer, provider: SessionKeyProvider): Pick<EncryptedSessionEnvelope, 'k' | 'i' | 't' | 'c'>;
-/**
- * Decrypts an envelope, verifying the GCM auth tag.
- *
- * @throws {SessionSerializationError} when the key version is unknown, the
- *   IV/auth tag/ciphertext are malformed, or authentication fails (tampered
- *   or corrupt data).
- */
-export declare function decryptPayload(envelope: Pick<EncryptedSessionEnvelope, 'k' | 'i' | 't' | 'c'>, provider: SessionKeyProvider): Buffer;
-/** Encrypts a JSON string into an encrypted envelope body. */
-export declare function encryptJson(json: string, provider: SessionKeyProvider): Pick<EncryptedSessionEnvelope, 'k' | 'i' | 't' | 'c'>;
-/** Decrypts an envelope body and parses the JSON inside. */
-export declare function decryptJson<T>(envelope: Pick<EncryptedSessionEnvelope, 'k' | 'i' | 't' | 'c'>, provider: SessionKeyProvider): T;

package/dist/session/session-encryption.js

@@ -1,139 +0,0 @@
-import { createCipheriv, createDecipheriv, randomBytes, } from 'node:crypto';
-import { SessionConfigurationError, SessionSerializationError } from './session-errors.js';
-/**
- * Normalizes a key to a Buffer for use with AES-256-GCM.
- *
- * Buffers are returned as-is. Strings are decoded in priority order:
- *  - 64 hex characters        -> hex
- *  - base64 / base64url text that decodes to exactly 32 bytes -> base64
- *  - anything else            -> utf8 (a 32-character passphrase)
- *
- * The decoded key must be 32 bytes (AES-256) for Node's crypto to accept
- * it; {@link StaticSessionKeyProvider} validates this at construction.
- */
-export function toKeyBuffer(key) {
-    if (Buffer.isBuffer(key))
-        return key;
-    const trimmed = key.trim();
-    if (/^[0-9a-fA-F]{64}$/.test(trimmed)) {
-        return Buffer.from(trimmed, 'hex');
-    }
-    if (/^[A-Za-z0-9+/_-]+={0,2}$/.test(trimmed)) {
-        const decoded = Buffer.from(trimmed.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
-        if (decoded.length === 32)
-            return decoded;
-    }
-    return Buffer.from(key, 'utf8');
-}
-/** A simple key provider for single-process deployments (env/CLI injection). */
-export class StaticSessionKeyProvider {
-    currentVersion;
-    keys;
-    constructor(keys, currentVersion) {
-        this.currentVersion = currentVersion;
-        if (keys.size === 0) {
-            throw new SessionConfigurationError('At least one encryption key is required.');
-        }
-        if (!keys.has(currentVersion)) {
-            throw new SessionConfigurationError('currentVersion must be present in the key map.');
-        }
-        const normalized = new Map();
-        for (const [version, raw] of keys) {
-            const key = toKeyBuffer(raw);
-            if (key.length !== 32) {
-                throw new SessionConfigurationError(`Encryption key version ${version} must be exactly 32 bytes (AES-256).`);
-            }
-            normalized.set(version, key);
-        }
-        this.keys = normalized;
-    }
-    getCurrentKey() {
-        return { keyVersion: this.currentVersion, key: this.keys.get(this.currentVersion) };
-    }
-    getKey(keyVersion) {
-        return this.keys.get(keyVersion) ?? null;
-    }
-}
-/**
- * Creates a {@link StaticSessionKeyProvider} with one freshly generated
- * 32-byte key. Convenience for local development and tests; production
- * deployments should derive keys from a KMS/vault instead.
- *
- * @param keyVersion - Version label for the generated key (default 1).
- */
-export function createRandomSessionKeyProvider(keyVersion = 1) {
-    return new StaticSessionKeyProvider(new Map([[keyVersion, randomBytes(32)]]), keyVersion);
-}
-const IV_BYTES = 12;
-const TAG_BYTES = 16;
-/**
- * Encrypts a plaintext payload with AES-256-GCM using the current key.
- * Returns a fresh random IV + auth tag per call.
- */
-export function encryptPayload(plaintext, provider) {
-    const { keyVersion, key } = provider.getCurrentKey();
-    const iv = randomBytes(IV_BYTES);
-    const cipher = createCipheriv('aes-256-gcm', toKeyBuffer(key), iv);
-    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-    const authTag = cipher.getAuthTag();
-    return {
-        k: keyVersion,
-        i: iv.toString('base64url'),
-        t: authTag.toString('base64url'),
-        c: ciphertext.toString('base64url'),
-    };
-}
-/**
- * Decrypts an envelope, verifying the GCM auth tag.
- *
- * @throws {SessionSerializationError} when the key version is unknown, the
- *   IV/auth tag/ciphertext are malformed, or authentication fails (tampered
- *   or corrupt data).
- */
-export function decryptPayload(envelope, provider) {
-    const raw = provider.getKey(envelope.k);
-    if (!raw) {
-        throw new SessionSerializationError({
-            reason: 'unknown_key_version',
-            keyVersion: envelope.k,
-        });
-    }
-    const key = toKeyBuffer(raw);
-    let iv;
-    let tag;
-    let ciphertext;
-    try {
-        iv = Buffer.from(envelope.i, 'base64url');
-        tag = Buffer.from(envelope.t, 'base64url');
-        ciphertext = Buffer.from(envelope.c, 'base64url');
-    }
-    catch {
-        throw new SessionSerializationError({ reason: 'malformed_encrypted_fields' });
-    }
-    if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES) {
-        throw new SessionSerializationError({ reason: 'malformed_encrypted_fields' });
-    }
-    try {
-        const decipher = createDecipheriv('aes-256-gcm', key, iv);
-        decipher.setAuthTag(tag);
-        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-    }
-    catch {
-        // GCM auth failure = tampered or corrupted data. Treat as invalid.
-        throw new SessionSerializationError({ reason: 'authentication_failed' });
-    }
-}
-/** Encrypts a JSON string into an encrypted envelope body. */
-export function encryptJson(json, provider) {
-    return encryptPayload(Buffer.from(json, 'utf8'), provider);
-}
-/** Decrypts an envelope body and parses the JSON inside. */
-export function decryptJson(envelope, provider) {
-    const plaintext = decryptPayload(envelope, provider);
-    try {
-        return JSON.parse(plaintext.toString('utf8'));
-    }
-    catch {
-        throw new SessionSerializationError({ reason: 'malformed_plaintext' });
-    }
-}

package/dist/session/session-errors.d.ts

@@ -1,85 +0,0 @@
-import { RedisError } from '../errors.js';
-/**
- * Base class for every session subsystem error.
- * Extends {@link RedisError} so existing Redis error handling keeps working.
- */
-export declare class SessionError extends RedisError {
-    constructor(message: string, code?: string, details?: Record<string, unknown>);
-}
-/** The session does not exist (or no longer exists). */
-export declare class SessionNotFoundError extends SessionError {
-    constructor(details?: Record<string, unknown>);
-}
-/** The session expired (absolute or idle timeout), or was created in the past. */
-export declare class SessionExpiredError extends SessionError {
-    constructor(details?: Record<string, unknown>);
-}
-/** The session was revoked or consumed by a rotation (replay detected). */
-export declare class SessionRevokedError extends SessionError {
-    constructor(details?: Record<string, unknown>);
-}
-/** The session record exists but is invalid (corrupt, tampered, mismatched). */
-export declare class SessionInvalidError extends SessionError {
-    constructor(details?: Record<string, unknown>);
-}
-/** A security-sensitive session transition (rotation) failed. */
-export declare class SessionRotationError extends SessionError {
-    constructor(details?: Record<string, unknown>);
-}
-/** Reuse of an already-consumed session token was detected. */
-export declare class SessionReplayError extends SessionError {
-    constructor(details?: Record<string, unknown>);
-}
-/**
- * Redis (or the session storage backend) is unavailable.
- *
- * Authentication MUST fail closed on this error: never treat it as an
- * invalid session, and never fall back to assuming the session is valid.
- */
-export declare class SessionStorageError extends SessionError {
-    constructor(message?: string, details?: Record<string, unknown>);
-}
-/** Stored session data could not be deserialized/decrypted. */
-export declare class SessionSerializationError extends SessionError {
-    constructor(details?: Record<string, unknown>);
-}
-/** Session configuration is invalid (fails at manager construction). */
-export declare class SessionConfigurationError extends SessionError {
-    constructor(message: string, details?: Record<string, unknown>);
-}
-/** Optimistic-concurrency conflict on a session update. */
-export declare class SessionConcurrencyError extends SessionError {
-    constructor(details?: Record<string, unknown>);
-}
-/** A revocation could not be persisted (fail closed, do not swallow). */
-export declare class RevocationError extends SessionError {
-    constructor(details?: Record<string, unknown>);
-}
-/** A batch revocation partially failed; check `failures` for details. */
-export declare class RevocationBatchError extends SessionError {
-    /** Safe identifiers of the entries whose pipeline command failed. */
-    readonly failures: Array<{
-        jti: string;
-        error: unknown;
-    }>;
-    constructor(failures: Array<{
-        jti: string;
-        error: unknown;
-    }>);
-    /** Compatibility alias: the affected jtis. */
-    get ids(): string[];
-}
-/** The circuit breaker is open; requests fail closed without touching Redis. */
-export declare class CircuitBreakerOpenError extends SessionError {
-    constructor(details?: Record<string, unknown>);
-}
-/**
- * Redacts an identifier for safe inclusion in logs/errors/metrics labels.
- *
- * Only the length and a short opaque suffix are revealed; never the full
- * value. Use for jti/userId/deviceId/ipAddress in structured details.
- *
- * @example
- * redactIdentifier('dG9rZW5oYXNo...') // => 'token#c3V'
- */
-export declare function redactIdentifier(value: string | null | undefined): string;