ioredis-toolkit 0.0.9 → 0.5.0

package/dist/session/config.js

@@ -0,0 +1,101 @@
+import { z } from "zod";
+import { SessionConfigurationError } from "./errors.js";
+/** Runtime schema for session configuration and security invariants. */
+export const SessionConfigSchema = z
+    .object({
+    enabled: z.boolean().default(false),
+    namespace: z
+        .string()
+        .min(1)
+        .max(128)
+        .regex(/^[A-Za-z0-9:_-]+$/)
+        .default("app"),
+    tokenBytes: z.number().int().min(32).max(128).default(32),
+    ttl: z
+        .number()
+        .int()
+        .positive()
+        .default(60 * 60 * 24 * 30),
+    idleTimeout: z.number().int().positive().optional(),
+    absoluteTimeout: z.number().int().positive().optional(),
+    touchInterval: z.number().int().nonnegative().default(60),
+    rolling: z.boolean().default(true),
+    securityVersionEnabled: z.boolean().default(false),
+    maxSessionsPerUser: z.number().int().nonnegative().max(1_000).default(20),
+    maxMetadataBytes: z
+        .number()
+        .int()
+        .positive()
+        .max(64 * 1024)
+        .default(8 * 1024),
+    maxBatchSize: z.number().int().positive().max(1_000).default(200),
+    maxConcurrency: z.number().int().positive().max(64).default(8),
+    storeIpAddress: z.boolean().default(false),
+    storeUserAgent: z.boolean().default(false),
+    storeDeviceId: z.boolean().default(false),
+    encryption: z
+        .object({ enabled: z.boolean().default(false) })
+        .default({ enabled: false }),
+    circuitBreaker: z
+        .object({
+        enabled: z.boolean().default(false),
+        failureThreshold: z.number().int().positive().default(5),
+        resetTimeoutMs: z.number().int().positive().default(10_000),
+        halfOpenMaxRequests: z.number().int().positive().default(1),
+    })
+        .default({
+        enabled: false,
+        failureThreshold: 5,
+        resetTimeoutMs: 10_000,
+        halfOpenMaxRequests: 1,
+    }),
+    cookie: z
+        .object({
+        name: z.string().min(1).max(256).default("session"),
+        httpOnly: z.boolean().default(true),
+        secure: z.boolean().default(true),
+        sameSite: z.enum(["strict", "lax", "none"]).default("lax"),
+        domain: z.string().optional(),
+        path: z.string().default("/"),
+        maxAge: z.number().int().positive().optional(),
+    })
+        .default({
+        name: "session",
+        httpOnly: true,
+        secure: true,
+        sameSite: "lax",
+        path: "/",
+    }),
+})
+    .superRefine((c, ctx) => {
+    if (c.absoluteTimeout !== undefined &&
+        c.idleTimeout !== undefined &&
+        c.idleTimeout > c.absoluteTimeout)
+        ctx.addIssue({
+            code: "custom",
+            path: ["idleTimeout"],
+            message: "idleTimeout must not exceed absoluteTimeout",
+        });
+    if (c.absoluteTimeout !== undefined && c.ttl > c.absoluteTimeout)
+        ctx.addIssue({
+            code: "custom",
+            path: ["ttl"],
+            message: "ttl must not exceed absoluteTimeout",
+        });
+    if (c.cookie.sameSite === "none" && !c.cookie.secure)
+        ctx.addIssue({
+            code: "custom",
+            path: ["cookie", "secure"],
+            message: "SameSite=None requires Secure",
+        });
+});
+/** Validates and applies secure defaults to session configuration. */
+export function parseSessionConfig(input) {
+    const result = SessionConfigSchema.safeParse(input ?? {});
+    if (!result.success)
+        throw new SessionConfigurationError(result.error.issues
+            .map((i) => `${i.path.join(".")}: ${i.message}`)
+            .join("; "));
+    return result.data;
+}
+//# sourceMappingURL=config.js.map

package/dist/session/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/session/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD,wEAAwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,mBAAmB,CAAC;SAC1B,OAAO,CAAC,KAAK,CAAC;IACjB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzE,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC;SACd,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,UAAU,EAAE,CAAC;SACV,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;SAC/C,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,cAAc,EAAE,CAAC;SACd,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QAC3D,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;KAC5D,CAAC;SACD,OAAO,CAAC;QACP,OAAO,EAAE,KAAK;QACd,gBAAgB,EAAE,CAAC;QACnB,cAAc,EAAE,MAAM;QACtB,mBAAmB,EAAE,CAAC;KACvB,CAAC;IACJ,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACnC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAC/C,CAAC;SACD,OAAO,CAAC;QACP,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,GAAG;KACV,CAAC;CACL,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,IACE,CAAC,CAAC,eAAe,KAAK,SAAS;QAC/B,CAAC,CAAC,WAAW,KAAK,SAAS;QAC3B,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,eAAe;QAEjC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,6CAA6C;SACvD,CAAC,CAAC;IACL,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,eAAe;QAC9D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAC;IACL,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAC1B,OAAO,EAAE,+BAA+B;SACzC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAGL,sEAAsE;AACtE,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO;QACjB,MAAM,IAAI,yBAAyB,CACjC,MAAM,CAAC,KAAK,CAAC,MAAM;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;IACJ,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/session/cookie.d.ts

@@ -0,0 +1,16 @@
+/** Options used to serialize a Set-Cookie header. Values are intentionally narrow to avoid malformed headers. */
+export interface CookieOptions {
+    name: string;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    domain?: string;
+    path?: string;
+    maxAge?: number;
+    expires?: Date;
+}
+/** Serializes a cookie value and options into a Set-Cookie-compatible header value. */
+export declare function serializeCookie(value: string, options: CookieOptions): string;
+/** Serializes an expired cookie that instructs a browser to remove the named cookie. */
+export declare function serializeDeletionCookie(options: CookieOptions): string;
+//# sourceMappingURL=cookie.d.ts.map

package/dist/session/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../src/session/cookie.ts"],"names":[],"mappings":"AAAA,iHAAiH;AACjH,MAAM,WAAW,aAAa;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,IAAI,CAAC;CAAE;AAC7L,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAe7E;AACD,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAAiF"}

package/dist/session/cookie.js

@@ -0,0 +1,28 @@
+/** Serializes a cookie value and options into a Set-Cookie-compatible header value. */
+export function serializeCookie(value, options) {
+    if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(options.name))
+        throw new Error('Invalid cookie name');
+    if (options.sameSite === 'none' && options.secure === false)
+        throw new Error('SameSite=None requires Secure');
+    // options.name is validated against the RFC 6265 cookie-name token charset above, so it is
+    // already header-safe and must be emitted as-is: encodeURIComponent would percent-encode
+    // several characters that charset permits (# $ & + ^ | ~), silently changing the cookie name.
+    const parts = [`${options.name}=${encodeURIComponent(value)}`];
+    if (options.maxAge !== undefined)
+        parts.push(`Max-Age=${Math.floor(options.maxAge)}`);
+    if (options.expires)
+        parts.push(`Expires=${options.expires.toUTCString()}`);
+    if (options.domain)
+        parts.push(`Domain=${options.domain}`);
+    parts.push(`Path=${options.path ?? '/'}`);
+    if (options.httpOnly !== false)
+        parts.push('HttpOnly');
+    if (options.secure !== false)
+        parts.push('Secure');
+    if (options.sameSite)
+        parts.push(`SameSite=${options.sameSite[0].toUpperCase()}${options.sameSite.slice(1)}`);
+    return parts.join('; ');
+}
+/** Serializes an expired cookie that instructs a browser to remove the named cookie. */
+export function serializeDeletionCookie(options) { return serializeCookie('', { ...options, maxAge: 0, expires: new Date(0) }); }
+//# sourceMappingURL=cookie.js.map

package/dist/session/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/session/cookie.ts"],"names":[],"mappings":"AAEA,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,OAAsB;IACnE,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAChG,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC9G,2FAA2F;IAC3F,yFAAyF;IACzF,8FAA8F;IAC9F,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/G,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AACD,wFAAwF;AACxF,MAAM,UAAU,uBAAuB,CAAC,OAAsB,IAAY,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC"}

package/dist/session/errors.d.ts

@@ -0,0 +1,56 @@
+/** Stable machine-readable error codes emitted by the session subsystem. */
+export type SessionErrorCode = 'SESSION_NOT_FOUND' | 'SESSION_EXPIRED' | 'SESSION_REVOKED' | 'SESSION_INVALID' | 'SESSION_REPLAY' | 'SESSION_ROTATION' | 'SESSION_CONFLICT' | 'SESSION_STORAGE' | 'SESSION_SERIALIZATION' | 'SESSION_CONFIGURATION' | 'SESSION_INPUT' | 'SESSION_LIMIT';
+/** Base typed error for session validation, lifecycle, storage, and configuration failures. */
+export declare class SessionError extends Error {
+    readonly code: SessionErrorCode;
+    constructor(code: SessionErrorCode, message: string, options?: ErrorOptions);
+}
+/** Thrown when an authoritative session record cannot be found. */
+export declare class SessionNotFoundError extends SessionError {
+    constructor();
+}
+/** Thrown when a session is outside its configured lifetime. */
+export declare class SessionExpiredError extends SessionError {
+    constructor();
+}
+/** Thrown when a session has been explicitly revoked. */
+export declare class SessionRevokedError extends SessionError {
+    constructor();
+}
+/** Thrown when session input or state fails validation. */
+export declare class SessionInvalidError extends SessionError {
+    constructor();
+}
+/** Thrown when a consumed session credential is replayed. */
+export declare class SessionReplayError extends SessionError {
+    constructor();
+}
+/** Thrown when rotation cannot complete safely. */
+export declare class SessionRotationError extends SessionError {
+    constructor(message?: string, cause?: unknown);
+}
+/** Thrown when optimistic session concurrency detects a conflict. */
+export declare class SessionConflictError extends SessionError {
+    constructor();
+}
+/** Thrown when Redis-backed session persistence cannot be completed or read. */
+export declare class SessionStorageError extends SessionError {
+    constructor(message: string, cause?: unknown);
+}
+/** Thrown when a session envelope cannot be serialized or validated. */
+export declare class SessionSerializationError extends SessionError {
+    constructor(message?: string, cause?: unknown);
+}
+/** Thrown when session configuration is invalid or incomplete. */
+export declare class SessionConfigurationError extends SessionError {
+    constructor(message: string);
+}
+/** Thrown when token or other session input is malformed. */
+export declare class SessionInputError extends SessionError {
+    constructor(message: string);
+}
+/** Thrown when a configured session limit prevents an operation. */
+export declare class SessionLimitError extends SessionError {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/session/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/session/errors.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,MAAM,gBAAgB,GACxB,mBAAmB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,iBAAiB,GAC/E,gBAAgB,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,iBAAiB,GAC9E,uBAAuB,GAAG,uBAAuB,GAAG,eAAe,GAAG,eAAe,CAAC;AAE1F,+FAA+F;AAC/F,qBAAa,YAAa,SAAQ,KAAK;aACT,IAAI,EAAE,gBAAgB;gBAAtB,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAG5F;AACD,mEAAmE;AACnE,qBAAa,oBAAqB,SAAQ,YAAY;;CAAuE;AAC7H,gEAAgE;AAChE,qBAAa,mBAAoB,SAAQ,YAAY;;CAAmE;AACxH,yDAAyD;AACzD,qBAAa,mBAAoB,SAAQ,YAAY;;CAAmE;AACxH,2DAA2D;AAC3D,qBAAa,mBAAoB,SAAQ,YAAY;;CAAmE;AACxH,6DAA6D;AAC7D,qBAAa,kBAAmB,SAAQ,YAAY;;CAA0E;AAC9H,mDAAmD;AACnD,qBAAa,oBAAqB,SAAQ,YAAY;gBAAe,OAAO,SAA4B,EAAE,KAAK,CAAC,EAAE,OAAO;CAAsD;AAC/K,qEAAqE;AACrE,qBAAa,oBAAqB,SAAQ,YAAY;;CAA6E;AACnI,gFAAgF;AAChF,qBAAa,mBAAoB,SAAQ,YAAY;gBAAe,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAAqD;AACzJ,wEAAwE;AACxE,qBAAa,yBAA0B,SAAQ,YAAY;gBAAe,OAAO,SAAiC,EAAE,KAAK,CAAC,EAAE,OAAO;CAA2D;AAC9L,kEAAkE;AAClE,qBAAa,yBAA0B,SAAQ,YAAY;gBAAe,OAAO,EAAE,MAAM;CAAgD;AACzI,6DAA6D;AAC7D,qBAAa,iBAAkB,SAAQ,YAAY;gBAAe,OAAO,EAAE,MAAM;CAAwC;AACzH,oEAAoE;AACpE,qBAAa,iBAAkB,SAAQ,YAAY;gBAAe,OAAO,EAAE,MAAM;CAAwC"}

package/dist/session/errors.js

@@ -0,0 +1,58 @@
+/** Base typed error for session validation, lifecycle, storage, and configuration failures. */
+export class SessionError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.code = code;
+        this.name = 'SessionError';
+    }
+}
+/** Thrown when an authoritative session record cannot be found. */
+export class SessionNotFoundError extends SessionError {
+    constructor() { super('SESSION_NOT_FOUND', 'Session not found'); }
+}
+/** Thrown when a session is outside its configured lifetime. */
+export class SessionExpiredError extends SessionError {
+    constructor() { super('SESSION_EXPIRED', 'Session expired'); }
+}
+/** Thrown when a session has been explicitly revoked. */
+export class SessionRevokedError extends SessionError {
+    constructor() { super('SESSION_REVOKED', 'Session revoked'); }
+}
+/** Thrown when session input or state fails validation. */
+export class SessionInvalidError extends SessionError {
+    constructor() { super('SESSION_INVALID', 'Session invalid'); }
+}
+/** Thrown when a consumed session credential is replayed. */
+export class SessionReplayError extends SessionError {
+    constructor() { super('SESSION_REPLAY', 'Session replay detected'); }
+}
+/** Thrown when rotation cannot complete safely. */
+export class SessionRotationError extends SessionError {
+    constructor(message = 'Session rotation failed', cause) { super('SESSION_ROTATION', message, { cause }); }
+}
+/** Thrown when optimistic session concurrency detects a conflict. */
+export class SessionConflictError extends SessionError {
+    constructor() { super('SESSION_CONFLICT', 'Session version conflict'); }
+}
+/** Thrown when Redis-backed session persistence cannot be completed or read. */
+export class SessionStorageError extends SessionError {
+    constructor(message, cause) { super('SESSION_STORAGE', message, { cause }); }
+}
+/** Thrown when a session envelope cannot be serialized or validated. */
+export class SessionSerializationError extends SessionError {
+    constructor(message = 'Session serialization failed', cause) { super('SESSION_SERIALIZATION', message, { cause }); }
+}
+/** Thrown when session configuration is invalid or incomplete. */
+export class SessionConfigurationError extends SessionError {
+    constructor(message) { super('SESSION_CONFIGURATION', message); }
+}
+/** Thrown when token or other session input is malformed. */
+export class SessionInputError extends SessionError {
+    constructor(message) { super('SESSION_INPUT', message); }
+}
+/** Thrown when a configured session limit prevents an operation. */
+export class SessionLimitError extends SessionError {
+    constructor(message) { super('SESSION_LIMIT', message); }
+}
+//# sourceMappingURL=errors.js.map

package/dist/session/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/session/errors.ts"],"names":[],"mappings":"AAMA,+FAA+F;AAC/F,MAAM,OAAO,YAAa,SAAQ,KAAK;IACT;IAA5B,YAA4B,IAAsB,EAAE,OAAe,EAAE,OAAsB;QACzF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QADE,SAAI,GAAJ,IAAI,CAAkB;QACvB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IACtD,CAAC;CACF;AACD,mEAAmE;AACnE,MAAM,OAAO,oBAAqB,SAAQ,YAAY;IAAG,gBAAgB,KAAK,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;CAAE;AAC7H,gEAAgE;AAChE,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IAAG,gBAAgB,KAAK,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;CAAE;AACxH,yDAAyD;AACzD,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IAAG,gBAAgB,KAAK,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;CAAE;AACxH,2DAA2D;AAC3D,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IAAG,gBAAgB,KAAK,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;CAAE;AACxH,6DAA6D;AAC7D,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IAAG,gBAAgB,KAAK,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC;CAAE;AAC9H,mDAAmD;AACnD,MAAM,OAAO,oBAAqB,SAAQ,YAAY;IAAG,YAAY,OAAO,GAAG,yBAAyB,EAAE,KAAe,IAAI,KAAK,CAAC,kBAAkB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;CAAE;AAC/K,qEAAqE;AACrE,MAAM,OAAO,oBAAqB,SAAQ,YAAY;IAAG,gBAAgB,KAAK,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC,CAAC,CAAC;CAAE;AACnI,gFAAgF;AAChF,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IAAG,YAAY,OAAe,EAAE,KAAe,IAAI,KAAK,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;CAAE;AACzJ,wEAAwE;AACxE,MAAM,OAAO,yBAA0B,SAAQ,YAAY;IAAG,YAAY,OAAO,GAAG,8BAA8B,EAAE,KAAe,IAAI,KAAK,CAAC,uBAAuB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;CAAE;AAC9L,kEAAkE;AAClE,MAAM,OAAO,yBAA0B,SAAQ,YAAY;IAAG,YAAY,OAAe,IAAI,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAAE;AACzI,6DAA6D;AAC7D,MAAM,OAAO,iBAAkB,SAAQ,YAAY;IAAG,YAAY,OAAe,IAAI,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAAE;AACzH,oEAAoE;AACpE,MAAM,OAAO,iBAAkB,SAAQ,YAAY;IAAG,YAAY,OAAe,IAAI,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAAE"}

package/dist/session/factory.d.ts

@@ -0,0 +1,21 @@
+import type { RedisClientWrapper } from '../redis/wrapper.js';
+import type { RedisConfig } from '../redis/types.js';
+import { type SessionConfig } from './config.js';
+import { SessionManager } from './manager.js';
+import type { KeyManager, SessionMetrics } from './types.js';
+/** Dependencies and configuration required to construct a session manager. */
+export interface CreateSessionManagerOptions {
+    redis: RedisClientWrapper;
+    config: SessionConfig;
+    encryptionKeyManager?: KeyManager;
+    metrics?: SessionMetrics;
+}
+/** Creates the session subsystem on top of an already-created shared Redis client. */
+export declare function createSessionManager(options: CreateSessionManagerOptions): SessionManager;
+/** Creates a session manager and shared Redis wrapper from separate configuration objects. */
+export declare function createSessionManagerFromRedis(redisConfig: RedisConfig, sessionConfig: unknown): {
+    manager: SessionManager;
+    redis: RedisClientWrapper;
+    config: SessionConfig;
+};
+//# sourceMappingURL=factory.d.ts.map

package/dist/session/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/session/factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAMrE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI7D,8EAA8E;AAC9E,MAAM,WAAW,2BAA2B;IAAG,KAAK,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,oBAAoB,CAAC,EAAE,UAAU,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAC;CAAE;AAE/J,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,cAAc,CAQzF;AAED,8FAA8F;AAC9F,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAI7K"}

package/dist/session/factory.js

@@ -0,0 +1,30 @@
+import { createRedisConnection } from '../redis/client.js';
+import { parseSessionConfig } from './config.js';
+import { SessionKeyStrategy } from './keys.js';
+import { SessionSerializer } from './serializer.js';
+import { SessionScriptRegistry } from './scripts.js';
+import { SessionRepository } from './repository.js';
+import { SessionService } from './service.js';
+import { SessionManager } from './manager.js';
+import { SessionTokenManager } from './token.js';
+import { SessionConfigurationError } from './errors.js';
+import { RedisClientWrapper as Wrapper } from '../redis/wrapper.js';
+/** Creates the session subsystem on top of an already-created shared Redis client. */
+export function createSessionManager(options) {
+    if (!options.config.enabled)
+        throw new SessionConfigurationError('Sessions are disabled');
+    const keys = new SessionKeyStrategy(options.config.namespace);
+    if (options.config.encryption.enabled && !options.encryptionKeyManager)
+        throw new SessionConfigurationError('Encryption is enabled but no key manager was supplied');
+    const serializer = new SessionSerializer(options.config.encryption.enabled ? options.encryptionKeyManager : undefined);
+    const scripts = new SessionScriptRegistry(options.redis);
+    const repository = new SessionRepository({ redis: options.redis, keys, serializer, scripts, config: options.config });
+    return new SessionManager(new SessionService({ repository, tokens: new SessionTokenManager(options.config.tokenBytes), redis: options.redis, config: options.config, ...(options.metrics ? { metrics: options.metrics } : {}) }));
+}
+/** Creates a session manager and shared Redis wrapper from separate configuration objects. */
+export function createSessionManagerFromRedis(redisConfig, sessionConfig) {
+    const config = parseSessionConfig(sessionConfig);
+    const redis = new Wrapper(createRedisConnection(redisConfig));
+    return { manager: createSessionManager({ redis, config }), redis, config };
+}
+//# sourceMappingURL=factory.js.map

package/dist/session/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/session/factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,kBAAkB,EAAsB,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,kBAAkB,IAAI,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAKpE,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,OAAoC;IACvE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB;QAAE,MAAM,IAAI,yBAAyB,CAAC,uDAAuD,CAAC,CAAC;IACrK,MAAM,UAAU,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvH,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtH,OAAO,IAAI,cAAc,CAAC,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACpO,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,6BAA6B,CAAC,WAAwB,EAAE,aAAsB;IAC5F,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9D,OAAO,EAAE,OAAO,EAAE,oBAAoB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC7E,CAAC"}

package/dist/session/health.d.ts

@@ -0,0 +1,12 @@
+import type { RedisClientWrapper } from '../redis/wrapper.js';
+import type { SessionHealth } from './types.js';
+/** Performs a lightweight Redis health check for session infrastructure. */
+export declare class SessionHealthProvider {
+    private readonly redis;
+    private readonly degradedMs;
+    /** Creates a health provider. `degradedMs` is the latency threshold for degraded status. */
+    constructor(redis: RedisClientWrapper, degradedMs?: number);
+    /** Performs one cheap Redis PING and classifies latency or availability. */
+    check(): Promise<SessionHealth>;
+}
+//# sourceMappingURL=health.d.ts.map

package/dist/session/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/session/health.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,4EAA4E;AAC5E,qBAAa,qBAAqB;IAEpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAsB,OAAO,CAAC,QAAQ,CAAC,UAAU;IADnF,4FAA4F;gBAC/D,KAAK,EAAE,kBAAkB,EAAmB,UAAU,SAAM;IACzF,4EAA4E;IACtE,KAAK,IAAI,OAAO,CAAC,aAAa,CAAC;CAUtC"}

package/dist/session/health.js

@@ -0,0 +1,23 @@
+/** Performs a lightweight Redis health check for session infrastructure. */
+export class SessionHealthProvider {
+    redis;
+    degradedMs;
+    /** Creates a health provider. `degradedMs` is the latency threshold for degraded status. */
+    constructor(redis, degradedMs = 100) {
+        this.redis = redis;
+        this.degradedMs = degradedMs;
+    }
+    /** Performs one cheap Redis PING and classifies latency or availability. */
+    async check() {
+        const started = performance.now();
+        try {
+            const response = await this.redis.ping();
+            const latencyMs = performance.now() - started;
+            return { status: latencyMs > this.degradedMs ? 'degraded' : 'healthy', latencyMs, errorRate: 0, redisStatus: response };
+        }
+        catch {
+            return { status: 'unhealthy', latencyMs: performance.now() - started, errorRate: 1, redisStatus: 'unavailable' };
+        }
+    }
+}
+//# sourceMappingURL=health.js.map

package/dist/session/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/session/health.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,MAAM,OAAO,qBAAqB;IAEH;IAA4C;IADzE,4FAA4F;IAC5F,YAA6B,KAAyB,EAAmB,aAAa,GAAG;QAA5D,UAAK,GAAL,KAAK,CAAoB;QAAmB,eAAU,GAAV,UAAU,CAAM;IAAG,CAAC;IAC7F,4EAA4E;IAC5E,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;QAC1H,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;QACnH,CAAC;IACH,CAAC;CACF"}

package/dist/session/keys.d.ts

@@ -0,0 +1,23 @@
+/** Centralizes session Redis key construction and user hash-tagging. */
+export declare class SessionKeyStrategy {
+    private readonly namespace;
+    /** Creates a key strategy for a single logical session namespace. */
+    constructor(namespace: string);
+    /** Returns the configured logical namespace. */
+    getNamespace(): string;
+    /** Returns a deterministic SHA-256 tag suitable for Redis Cluster hash-tagging. */
+    userTag(userId: string): string;
+    /** Builds an authoritative session key for a user and token hash. */
+    session(userId: string, tokenHash: string): string;
+    /** Builds the same session key when the precomputed user tag is already available. */
+    sessionByTag(userTag: string, tokenHash: string): string;
+    /** Builds the per-user sorted-set index key. */
+    userIndex(userId: string): string;
+    /** Builds the per-user security-version key. */
+    securityVersion(userId: string): string;
+    /** Builds the secondary token-hash locator key. */
+    tokenIndex(tokenHash: string): string;
+    /** Builds a user-scoped SHA-256 idempotency key without storing the raw idempotency value. */
+    idempotency(userId: string, key: string): string;
+}
+//# sourceMappingURL=keys.d.ts.map

package/dist/session/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/session/keys.ts"],"names":[],"mappings":"AAGA,wEAAwE;AACxE,qBAAa,kBAAkB;IAEjB,OAAO,CAAC,QAAQ,CAAC,SAAS;IADtC,qEAAqE;gBACxC,SAAS,EAAE,MAAM;IAC9C,gDAAgD;IAChD,YAAY,IAAI,MAAM;IACtB,mFAAmF;IACnF,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAC/B,qEAAqE;IACrE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAClD,sFAAsF;IACtF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IACxD,gDAAgD;IAChD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IACjC,gDAAgD;IAChD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IACvC,mDAAmD;IACnD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IACrC,8FAA8F;IAC9F,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM;CACjD"}

package/dist/session/keys.js

@@ -0,0 +1,27 @@
+import { createHash } from 'node:crypto';
+import { safeUserTag } from '../redis/cluster.js';
+/** Centralizes session Redis key construction and user hash-tagging. */
+export class SessionKeyStrategy {
+    namespace;
+    /** Creates a key strategy for a single logical session namespace. */
+    constructor(namespace) {
+        this.namespace = namespace;
+    }
+    /** Returns the configured logical namespace. */
+    getNamespace() { return this.namespace; }
+    /** Returns a deterministic SHA-256 tag suitable for Redis Cluster hash-tagging. */
+    userTag(userId) { return safeUserTag(userId); }
+    /** Builds an authoritative session key for a user and token hash. */
+    session(userId, tokenHash) { return `${this.namespace}:session:{${this.userTag(userId)}}:${tokenHash}`; }
+    /** Builds the same session key when the precomputed user tag is already available. */
+    sessionByTag(userTag, tokenHash) { return `${this.namespace}:session:{${userTag}}:${tokenHash}`; }
+    /** Builds the per-user sorted-set index key. */
+    userIndex(userId) { return `${this.namespace}:user-sessions:{${this.userTag(userId)}}`; }
+    /** Builds the per-user security-version key. */
+    securityVersion(userId) { return `${this.namespace}:security-version:{${this.userTag(userId)}}`; }
+    /** Builds the secondary token-hash locator key. */
+    tokenIndex(tokenHash) { return `${this.namespace}:token-index:${tokenHash}`; }
+    /** Builds a user-scoped SHA-256 idempotency key without storing the raw idempotency value. */
+    idempotency(userId, key) { const h = createHash('sha256').update(key).digest('hex'); return `${this.namespace}:idem:{${this.userTag(userId)}}:${h}`; }
+}
+//# sourceMappingURL=keys.js.map

package/dist/session/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/session/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,wEAAwE;AACxE,MAAM,OAAO,kBAAkB;IAEA;IAD7B,qEAAqE;IACrE,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAClD,gDAAgD;IAChD,YAAY,KAAa,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,mFAAmF;IACnF,OAAO,CAAC,MAAc,IAAY,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/D,qEAAqE;IACrE,OAAO,CAAC,MAAc,EAAE,SAAiB,IAAY,OAAO,GAAG,IAAI,CAAC,SAAS,aAAa,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC;IACjI,sFAAsF;IACtF,YAAY,CAAC,OAAe,EAAE,SAAiB,IAAY,OAAO,GAAG,IAAI,CAAC,SAAS,aAAa,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1H,gDAAgD;IAChD,SAAS,CAAC,MAAc,IAAY,OAAO,GAAG,IAAI,CAAC,SAAS,mBAAmB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACzG,gDAAgD;IAChD,eAAe,CAAC,MAAc,IAAY,OAAO,GAAG,IAAI,CAAC,SAAS,sBAAsB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClH,mDAAmD;IACnD,UAAU,CAAC,SAAiB,IAAY,OAAO,GAAG,IAAI,CAAC,SAAS,gBAAgB,SAAS,EAAE,CAAC,CAAC,CAAC;IAC9F,8FAA8F;IAC9F,WAAW,CAAC,MAAc,EAAE,GAAW,IAAY,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;CAC/K"}

package/dist/session/manager.d.ts

@@ -0,0 +1,34 @@
+import type { SessionService } from './service.js';
+import type { CreateSessionInput, CreatedSession, RotationResult, SessionPatch, SessionRecord, ValidationResult } from './types.js';
+/** Stable, framework-independent facade for session lifecycle operations. */
+export declare class SessionManager {
+    private readonly service;
+    /** Creates a manager backed by the supplied service. */
+    constructor(service: SessionService);
+    /** Creates a new opaque session and returns its raw token exactly once. */
+    create(input: CreateSessionInput): Promise<CreatedSession>;
+    /** Validates a raw session token and returns a discriminated authentication result. */
+    validate(token: string): Promise<ValidationResult>;
+    /** Gets an active authoritative session or throws a typed session error. */
+    get(token: string): Promise<SessionRecord>;
+    /** Applies configured rolling idle-expiration behavior to an active session. */
+    touch(token: string): Promise<void>;
+    /** Updates mutable session metadata with optional optimistic concurrency control. */
+    update(token: string, patch: SessionPatch, expectedVersion?: number): Promise<SessionRecord>;
+    /** Atomically consumes a predecessor and creates a successor token. */
+    rotate(token: string): Promise<RotationResult>;
+    /** Permanently removes the session's stored record and derived indexes. */
+    destroy(token: string): Promise<void>;
+    /** Marks a session unusable for authentication. */
+    revoke(token: string): Promise<void>;
+    /** Sets the user's security version used by session validation when enabled. */
+    setSecurityVersion(userId: string, version: number): Promise<void>;
+    /** Revokes a bounded number of sessions for a user and reports remaining indexed sessions. */
+    revokeAll(userId: string, limit?: number): Promise<{
+        affected: number;
+        remaining: number;
+    }>;
+    /** Lists a bounded page of sessions for a user. */
+    list(userId: string, offset?: number, limit?: number): Promise<SessionRecord[]>;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/session/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/session/manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEpI,6EAA6E;AAC7E,qBAAa,cAAc;IAEb,OAAO,CAAC,QAAQ,CAAC,OAAO;IADpC,wDAAwD;gBAC3B,OAAO,EAAE,cAAc;IACpD,2EAA2E;IAC3E,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1D,uFAAuF;IACvF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAClD,4EAA4E;IAC5E,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAC1C,gFAAgF;IAChF,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACnC,qFAAqF;IACrF,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5F,uEAAuE;IACvE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAC9C,2EAA2E;IAC3E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACrC,mDAAmD;IACnD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACpC,gFAAgF;IAChF,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAClE,8FAA8F;IAC9F,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3F,mDAAmD;IACnD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAChF"}

package/dist/session/manager.js

@@ -0,0 +1,31 @@
+/** Stable, framework-independent facade for session lifecycle operations. */
+export class SessionManager {
+    service;
+    /** Creates a manager backed by the supplied service. */
+    constructor(service) {
+        this.service = service;
+    }
+    /** Creates a new opaque session and returns its raw token exactly once. */
+    create(input) { return this.service.create(input); }
+    /** Validates a raw session token and returns a discriminated authentication result. */
+    validate(token) { return this.service.validate(token); }
+    /** Gets an active authoritative session or throws a typed session error. */
+    get(token) { return this.service.get(token); }
+    /** Applies configured rolling idle-expiration behavior to an active session. */
+    touch(token) { return this.service.touch(token); }
+    /** Updates mutable session metadata with optional optimistic concurrency control. */
+    update(token, patch, expectedVersion) { return this.service.update(token, patch, expectedVersion); }
+    /** Atomically consumes a predecessor and creates a successor token. */
+    rotate(token) { return this.service.rotate(token); }
+    /** Permanently removes the session's stored record and derived indexes. */
+    destroy(token) { return this.service.destroy(token); }
+    /** Marks a session unusable for authentication. */
+    revoke(token) { return this.service.revoke(token); }
+    /** Sets the user's security version used by session validation when enabled. */
+    setSecurityVersion(userId, version) { return this.service.setSecurityVersion(userId, version); }
+    /** Revokes a bounded number of sessions for a user and reports remaining indexed sessions. */
+    revokeAll(userId, limit) { return this.service.revokeAll(userId, limit); }
+    /** Lists a bounded page of sessions for a user. */
+    list(userId, offset, limit) { return this.service.list(userId, offset, limit); }
+}
+//# sourceMappingURL=manager.js.map

package/dist/session/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/session/manager.ts"],"names":[],"mappings":"AAGA,6EAA6E;AAC7E,MAAM,OAAO,cAAc;IAEI;IAD7B,wDAAwD;IACxD,YAA6B,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IACxD,2EAA2E;IAC3E,MAAM,CAAC,KAAyB,IAA6B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjG,uFAAuF;IACvF,QAAQ,CAAC,KAAa,IAA+B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3F,4EAA4E;IAC5E,GAAG,CAAC,KAAa,IAA4B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9E,gFAAgF;IAChF,KAAK,CAAC,KAAa,IAAmB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzE,qFAAqF;IACrF,MAAM,CAAC,KAAa,EAAE,KAAmB,EAAE,eAAwB,IAA4B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAC3J,uEAAuE;IACvE,MAAM,CAAC,KAAa,IAA6B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrF,2EAA2E;IAC3E,OAAO,CAAC,KAAa,IAAmB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7E,mDAAmD;IACnD,MAAM,CAAC,KAAa,IAAmB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3E,gFAAgF;IAChF,kBAAkB,CAAC,MAAc,EAAE,OAAe,IAAmB,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/H,8FAA8F;IAC9F,SAAS,CAAC,MAAc,EAAE,KAAc,IAAsD,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7I,mDAAmD;IACnD,IAAI,CAAC,MAAc,EAAE,MAAe,EAAE,KAAc,IAA8B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;CACrI"}

package/dist/session/metrics.d.ts

@@ -0,0 +1,11 @@
+import type { SessionMetrics } from './types.js';
+/** No-op metrics sink for applications that do not configure instrumentation. */
+export declare class NoopMetrics implements SessionMetrics {
+    /** Ignores counter increments. */
+    increment(): void;
+    /** Ignores observations. */
+    observe(): void;
+    /** Ignores gauge updates. */
+    gauge(): void;
+}
+//# sourceMappingURL=metrics.d.ts.map

package/dist/session/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/session/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,iFAAiF;AACjF,qBAAa,WAAY,YAAW,cAAc;IAChD,kCAAkC;IAClC,SAAS,IAAI,IAAI;IACjB,4BAA4B;IAC5B,OAAO,IAAI,IAAI;IACf,6BAA6B;IAC7B,KAAK,IAAI,IAAI;CACd"}

package/dist/session/metrics.js

@@ -0,0 +1,10 @@
+/** No-op metrics sink for applications that do not configure instrumentation. */
+export class NoopMetrics {
+    /** Ignores counter increments. */
+    increment() { }
+    /** Ignores observations. */
+    observe() { }
+    /** Ignores gauge updates. */
+    gauge() { }
+}
+//# sourceMappingURL=metrics.js.map

package/dist/session/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/session/metrics.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,MAAM,OAAO,WAAW;IACtB,kCAAkC;IAClC,SAAS,KAAU,CAAC;IACpB,4BAA4B;IAC5B,OAAO,KAAU,CAAC;IAClB,6BAA6B;IAC7B,KAAK,KAAU,CAAC;CACjB"}