ioredis-toolkit 0.0.9 → 0.5.0

package/dist/session/repository.d.ts

@@ -0,0 +1,49 @@
+import type { RedisClientWrapper } from '../redis/wrapper.js';
+import type { SessionConfig } from './config.js';
+import type { SessionKeyStrategy } from './keys.js';
+import type { SessionRecord } from './types.js';
+import { SessionScriptRegistry } from './scripts.js';
+import { SessionSerializer } from './serializer.js';
+/** Dependencies required by the session repository. */
+export interface SessionRepositoryOptions {
+    redis: RedisClientWrapper;
+    keys: SessionKeyStrategy;
+    serializer: SessionSerializer;
+    scripts: SessionScriptRegistry;
+    config: SessionConfig;
+}
+/** Persistence boundary for authoritative session state and derived indexes. */
+export declare class SessionRepository {
+    private readonly o;
+    /** Creates the repository using shared Redis infrastructure and versioned serializers/scripts. */
+    constructor(o: SessionRepositoryOptions);
+    /** Persists a session and its derived indexes using the repository's authoritative write semantics. */
+    create(record: SessionRecord): Promise<void>;
+    /** Resolves a token hash through the secondary locator and then reads the authoritative session record. */
+    resolve(tokenHash: string): Promise<SessionRecord | null>;
+    /** Persists the current security version for a user. */
+    setSecurityVersion(userId: string, version: number): Promise<void>;
+    /** Reads a user's security version. */
+    getSecurityVersion(userId: string): Promise<string | null>;
+    /** Checks whether the session remains present in the user's derived index. */
+    isIndexed(record: SessionRecord): Promise<boolean>;
+    /** Atomically updates rolling idle expiration when the touch interval permits it. */
+    touch(record: SessionRecord, now: number): Promise<'updated' | 'skipped' | 'invalid'>;
+    /** Atomically consumes a predecessor session for rotation. */
+    consume(record: SessionRecord, now: number, tombstoneTtl: number): Promise<void>;
+    /** Applies a version-checked replacement to an authoritative session record. */
+    update(record: SessionRecord, replacement: SessionRecord, expectedVersion: number, now: number): Promise<void>;
+    /** Atomically marks a session revoked. */
+    revoke(record: SessionRecord, now: number, tombstoneTtl: number): Promise<void>;
+    /** Removes the authoritative record and derived index entries. */
+    destroy(record: SessionRecord): Promise<void>;
+    /** Loads a bounded page of sessions and cleans stale derived-index members. */
+    list(userId: string, offset: number, limit: number): Promise<SessionRecord[]>;
+    /** Revokes a bounded batch and returns the number of indexed sessions remaining. */
+    revokeAll(userId: string, limit: number): Promise<{
+        affected: number;
+        remaining: number;
+    }>;
+    private safeDel;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/session/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/session/repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,uDAAuD;AACvD,MAAM,WAAW,wBAAwB;IAAG,KAAK,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,UAAU,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;CAAE;AAExL,gFAAgF;AAChF,qBAAa,iBAAiB;IAEhB,OAAO,CAAC,QAAQ,CAAC,CAAC;IAD9B,kGAAkG;gBACrE,CAAC,EAAE,wBAAwB;IAExD,uGAAuG;IACjG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBlD,2GAA2G;IACrG,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAa/D,wDAAwD;IAClD,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxE,uCAAuC;IACjC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKhE,8EAA8E;IACxE,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAKxD,qFAAqF;IAC/E,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAW3F,8DAA8D;IACxD,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAStF,gFAAgF;IAC1E,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpH,0CAA0C;IACpC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQrF,kEAAkE;IAC5D,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnD,+EAA+E;IACzE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAenF,oFAAoF;IAC9E,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;YAkBlF,OAAO;CACtB"}

package/dist/session/repository.js

@@ -0,0 +1,203 @@
+import { SessionRotationError, SessionStorageError } from './errors.js';
+import { SessionScriptRegistry } from './scripts.js';
+import { SessionSerializer } from './serializer.js';
+/** Persistence boundary for authoritative session state and derived indexes. */
+export class SessionRepository {
+    o;
+    /** Creates the repository using shared Redis infrastructure and versioned serializers/scripts. */
+    constructor(o) {
+        this.o = o;
+    }
+    /** Persists a session and its derived indexes using the repository's authoritative write semantics. */
+    async create(record) {
+        const ttl = Math.max(1, Math.ceil(record.expiresAt - record.createdAt));
+        const result = await this.o.scripts.eval('create_session', [this.o.keys.session(record.userId, record.id), this.o.keys.userIndex(record.userId)], [this.o.serializer.serialize(record), String(ttl), String(record.createdAt), record.id, String(this.o.config.maxSessionsPerUser), this.o.keys.getNamespace(), this.o.keys.userTag(record.userId)]);
+        const code = Number(result[0]);
+        if (code !== 1)
+            throw new SessionStorageError('Session creation failed');
+        let indexed;
+        try {
+            indexed = await this.o.redis.set(this.o.keys.tokenIndex(record.id), this.o.keys.userTag(record.userId), 'EX', String(ttl), 'NX');
+        }
+        catch (error) {
+            throw new SessionStorageError('Session token index write failed', error);
+        }
+        if (indexed !== 'OK') {
+            await this.safeDel(this.o.keys.session(record.userId, record.id));
+            try {
+                await this.o.redis.zrem(this.o.keys.userIndex(record.userId), record.id);
+            }
+            catch { /* best effort */ }
+            throw new SessionStorageError('Session token index already occupied');
+        }
+    }
+    /** Resolves a token hash through the secondary locator and then reads the authoritative session record. */
+    async resolve(tokenHash) {
+        let userTag;
+        try {
+            userTag = await this.o.redis.get(this.o.keys.tokenIndex(tokenHash));
+        }
+        catch (error) {
+            throw new SessionStorageError('Session token index unavailable', error);
+        }
+        if (!userTag)
+            return null;
+        let raw;
+        try {
+            raw = await this.o.redis.get(this.o.keys.sessionByTag(userTag, tokenHash));
+        }
+        catch (error) {
+            throw new SessionStorageError('Session record unavailable', error);
+        }
+        if (!raw) {
+            await this.safeDel(this.o.keys.tokenIndex(tokenHash));
+            return null;
+        }
+        try {
+            return this.o.serializer.deserialize(raw);
+        }
+        catch (error) {
+            await this.safeDel(this.o.keys.sessionByTag(userTag, tokenHash));
+            throw error;
+        }
+    }
+    /** Persists the current security version for a user. */
+    async setSecurityVersion(userId, version) {
+        try {
+            await this.o.redis.set(this.o.keys.securityVersion(userId), String(version));
+        }
+        catch (error) {
+            throw new SessionStorageError('Security version update failed', error);
+        }
+    }
+    /** Reads a user's security version. */
+    async getSecurityVersion(userId) {
+        try {
+            return await this.o.redis.get(this.o.keys.securityVersion(userId));
+        }
+        catch (error) {
+            throw new SessionStorageError('Security version unavailable', error);
+        }
+    }
+    /** Checks whether the session remains present in the user's derived index. */
+    async isIndexed(record) {
+        try {
+            return (await this.o.redis.zscore(this.o.keys.userIndex(record.userId), record.id)) !== null;
+        }
+        catch (error) {
+            throw new SessionStorageError('Session index unavailable', error);
+        }
+    }
+    /** Atomically updates rolling idle expiration when the touch interval permits it. */
+    async touch(record, now) {
+        const idleDuration = record.idleTimeoutSeconds ?? this.o.config.idleTimeout ?? this.o.config.ttl;
+        const idle = record.idleExpiresAt === null ? 0 : Math.min(record.absoluteExpiresAt ?? Number.MAX_SAFE_INTEGER, now + idleDuration);
+        const absolute = record.absoluteExpiresAt ?? 0;
+        const result = await this.o.scripts.eval('touch_session', [this.o.keys.session(record.userId, record.id)], [String(now), String(this.o.config.touchInterval), String(idle), String(absolute)]);
+        const code = Number(result[0]);
+        if (code === 1)
+            return 'updated';
+        if (code === 2)
+            return 'skipped';
+        return 'invalid';
+    }
+    /** Atomically consumes a predecessor session for rotation. */
+    async consume(record, now, tombstoneTtl) {
+        const result = await this.o.scripts.eval('consume_session', [this.o.keys.session(record.userId, record.id)], [String(now), String(Math.max(1, tombstoneTtl))]);
+        const code = Number(result[0]);
+        if (code === -1)
+            throw new SessionRotationError('Session already consumed');
+        if (code !== 1)
+            throw new SessionRotationError('Session cannot be rotated');
+        try {
+            await this.o.redis.zrem(this.o.keys.userIndex(record.userId), record.id);
+        }
+        catch (error) {
+            throw new SessionStorageError('Session index cleanup failed', error);
+        }
+    }
+    /** Applies a version-checked replacement to an authoritative session record. */
+    async update(record, replacement, expectedVersion, now) {
+        const result = await this.o.scripts.eval('update_session', [this.o.keys.session(record.userId, record.id)], [String(expectedVersion), String(now), this.o.serializer.serialize(replacement)]);
+        const code = Number(result[0]);
+        if (code === -2)
+            throw new SessionStorageError('Session version conflict');
+        if (code !== 1)
+            throw new SessionStorageError('Session update failed');
+    }
+    /** Atomically marks a session revoked. */
+    async revoke(record, now, tombstoneTtl) {
+        const result = await this.o.scripts.eval('revoke_session', [this.o.keys.session(record.userId, record.id)], [String(now), String(Math.max(0, tombstoneTtl))]);
+        const code = Number(result[0]);
+        if (code !== 1 && code !== 2 && code !== 0)
+            throw new SessionStorageError('Session revocation failed');
+        try {
+            await this.o.redis.zrem(this.o.keys.userIndex(record.userId), record.id);
+        }
+        catch (error) {
+            throw new SessionStorageError('Session index cleanup failed', error);
+        }
+    }
+    /** Removes the authoritative record and derived index entries. */
+    async destroy(record) {
+        try {
+            await this.o.redis.del(this.o.keys.session(record.userId, record.id));
+            await this.o.redis.zrem(this.o.keys.userIndex(record.userId), record.id);
+            await this.o.redis.del(this.o.keys.tokenIndex(record.id));
+        }
+        catch (error) {
+            throw new SessionStorageError('Session deletion failed', error);
+        }
+    }
+    /** Loads a bounded page of sessions and cleans stale derived-index members. */
+    async list(userId, offset, limit) {
+        const members = await this.o.redis.zrange(this.o.keys.userIndex(userId), offset, offset + limit - 1);
+        if (!members.length)
+            return [];
+        const keys = members.map(tokenHash => this.o.keys.sessionByTag(this.o.keys.userTag(userId), tokenHash));
+        const raw = await this.o.redis.mgetClusterAware(keys, { concurrency: this.o.config.maxConcurrency });
+        const records = [];
+        const stale = [];
+        raw.forEach((value, i) => {
+            if (!value) {
+                stale.push(members[i]);
+                return;
+            }
+            try {
+                records.push(this.o.serializer.deserialize(value));
+            }
+            catch {
+                stale.push(members[i]);
+            }
+        });
+        if (stale.length)
+            await this.o.redis.zrem(this.o.keys.userIndex(userId), ...stale);
+        return records;
+    }
+    /** Revokes a bounded batch and returns the number of indexed sessions remaining. */
+    async revokeAll(userId, limit) {
+        const bounded = Math.min(Math.max(1, limit), this.o.config.maxBatchSize);
+        const members = await this.o.redis.zrange(this.o.keys.userIndex(userId), 0, bounded - 1);
+        if (!members.length)
+            return { affected: 0, remaining: 0 };
+        const userTag = this.o.keys.userTag(userId);
+        const pipeline = this.o.redis.pipeline();
+        for (const tokenHash of members) {
+            pipeline.del(this.o.keys.sessionByTag(userTag, tokenHash));
+            pipeline.del(this.o.keys.tokenIndex(tokenHash));
+        }
+        const results = await pipeline.exec();
+        if (!results)
+            throw new SessionStorageError('Redis pipeline unavailable');
+        if (results.some(([error]) => error))
+            throw new SessionStorageError('One or more revokeAll operations failed');
+        await this.o.redis.zrem(this.o.keys.userIndex(userId), ...members);
+        const remaining = await this.o.redis.zcard(this.o.keys.userIndex(userId));
+        return { affected: members.length, remaining };
+    }
+    async safeDel(key) { try {
+        await this.o.redis.del(key);
+    }
+    catch { /* derived cleanup is best effort */ } }
+}
+//# sourceMappingURL=repository.js.map

package/dist/session/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/session/repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAIxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAKpD,gFAAgF;AAChF,MAAM,OAAO,iBAAiB;IAEC;IAD7B,kGAAkG;IAClG,YAA6B,CAA2B;QAA3B,MAAC,GAAD,CAAC,CAA0B;IAAG,CAAC;IAE5D,uGAAuG;IACvG,KAAK,CAAC,MAAM,CAAC,MAAqB;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CACtC,gBAAgB,EAChB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EACrF,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAClM,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAE,MAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;QACzE,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YAAC,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACzI,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAC3F,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC7G,MAAM,IAAI,mBAAmB,CAAC,sCAAsC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,2GAA2G;IAC3G,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YAAC,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAAC,CAAC;QAC5E,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAC1F,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAAC,CAAC;QACnF,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QACrF,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACjF,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAClD,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IAClG,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,OAAe;QACtD,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAAC,CAAC;QACrF,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;IAC3F,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,IAAI,CAAC;YAAC,OAAO,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAC3E,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;IACzF,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,SAAS,CAAC,MAAqB;QACnC,IAAI,CAAC;YAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAC,CAAC;QACrG,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;IACtF,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,KAAK,CAAC,MAAqB,EAAE,GAAW;QAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACjG,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,gBAAgB,EAAE,GAAG,GAAG,YAAY,CAAC,CAAC;QACnI,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/L,MAAM,IAAI,GAAG,MAAM,CAAE,MAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACjC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,OAAO,CAAC,MAAqB,EAAE,GAAW,EAAE,YAAoB;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/J,MAAM,IAAI,GAAG,MAAM,CAAE,MAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;QAC5E,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,CAAC,CAAC;QAC5E,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QACjF,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;IACzF,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,WAA0B,EAAE,eAAuB,EAAE,GAAW;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC9L,MAAM,IAAI,GAAG,MAAM,CAAE,MAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC3E,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,GAAW,EAAE,YAAoB;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9J,MAAM,IAAI,GAAG,MAAM,CAAE,MAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;QACvG,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QACjF,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;IACzF,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,OAAO,CAAC,MAAqB;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;IACtF,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,MAAc,EAAE,KAAa;QACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QACxG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;QACrG,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAChD,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;YAAC,CAAC;QAChG,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;QACnF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,KAAa;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACzC,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;YAChC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;YAC3D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,yCAAyC,CAAC,CAAC;QAC/G,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAW,IAAmB,IAAI,CAAC;QAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC;CAC1I"}

package/dist/session/revocation.d.ts

@@ -0,0 +1,22 @@
+import type { RedisClientWrapper } from '../redis/wrapper.js';
+import type { SessionKeyStrategy } from './keys.js';
+/**
+ * Stores short-lived JTI revocation records.
+ *
+ * This is a standalone utility for credentials whose authorization model is
+ * JTI-based (e.g. externally issued JWTs) — see docs/README-API.md. It is
+ * intentionally *not* wired into {@link SessionService}: this package's own
+ * opaque sessions treat session state itself as the source of truth, and
+ * deliberately avoid an extra revocation-key lookup on every `validate()` call.
+ */
+export declare class RedisRevocationStore {
+    private readonly redis;
+    private readonly keys;
+    /** Creates a revocation store using the shared Redis client and session key strategy. */
+    constructor(redis: RedisClientWrapper, keys: SessionKeyStrategy);
+    /** Stores a bounded-TTL JTI revocation tombstone. `now` should be sourced from the same clock as the caller's other session operations (e.g. Redis server time) to avoid skew. */
+    revoke(jti: string, now: number, expiresAt: number, reason?: string): Promise<void>;
+    /** Checks whether a JTI currently has a revocation tombstone. */
+    isRevoked(jti: string): Promise<boolean>;
+}
+//# sourceMappingURL=revocation.d.ts.map

package/dist/session/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/session/revocation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAEnB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAsB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAD7E,yFAAyF;gBAC5D,KAAK,EAAE,kBAAkB,EAAmB,IAAI,EAAE,kBAAkB;IACjG,kLAAkL;IAC5K,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5F,iEAAiE;IAC3D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI/C"}

package/dist/session/revocation.js

@@ -0,0 +1,41 @@
+import { SessionStorageError } from './errors.js';
+/**
+ * Stores short-lived JTI revocation records.
+ *
+ * This is a standalone utility for credentials whose authorization model is
+ * JTI-based (e.g. externally issued JWTs) — see docs/README-API.md. It is
+ * intentionally *not* wired into {@link SessionService}: this package's own
+ * opaque sessions treat session state itself as the source of truth, and
+ * deliberately avoid an extra revocation-key lookup on every `validate()` call.
+ */
+export class RedisRevocationStore {
+    redis;
+    keys;
+    /** Creates a revocation store using the shared Redis client and session key strategy. */
+    constructor(redis, keys) {
+        this.redis = redis;
+        this.keys = keys;
+    }
+    /** Stores a bounded-TTL JTI revocation tombstone. `now` should be sourced from the same clock as the caller's other session operations (e.g. Redis server time) to avoid skew. */
+    async revoke(jti, now, expiresAt, reason = 'revoked') {
+        const ttl = Math.ceil(expiresAt - now);
+        if (ttl <= 0)
+            return;
+        try {
+            await this.redis.set(`${this.keys.getNamespace()}:revoked:${jti}`, reason, 'EX', String(ttl), 'NX');
+        }
+        catch (error) {
+            throw new SessionStorageError('Unable to persist revocation', error);
+        }
+    }
+    /** Checks whether a JTI currently has a revocation tombstone. */
+    async isRevoked(jti) {
+        try {
+            return (await this.redis.exists(`${this.keys.getNamespace()}:revoked:${jti}`)) === 1;
+        }
+        catch (error) {
+            throw new SessionStorageError('Unable to read revocation state', error);
+        }
+    }
+}
+//# sourceMappingURL=revocation.js.map

package/dist/session/revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/session/revocation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IAEF;IAA4C;IADzE,yFAAyF;IACzF,YAA6B,KAAyB,EAAmB,IAAwB;QAApE,UAAK,GAAL,KAAK,CAAoB;QAAmB,SAAI,GAAJ,IAAI,CAAoB;IAAG,CAAC;IACrG,kLAAkL;IAClL,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,GAAW,EAAE,SAAiB,EAAE,MAAM,GAAG,SAAS;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;QACvC,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO;QACrB,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAC5G,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;IACzF,CAAC;IACD,iEAAiE;IACjE,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,IAAI,CAAC;YAAC,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAC7F,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;IAC5F,CAAC;CACF"}

package/dist/session/script-sources.d.ts

@@ -0,0 +1,11 @@
+export declare const SCRIPT_SOURCES: {
+    readonly create_session: "-- KEYS[1] session key\n-- KEYS[2] user index\n-- ARGV[1] serialized record\n-- ARGV[2] ttl seconds\n-- ARGV[3] createdAt score\n-- ARGV[4] tokenHash\n-- ARGV[5] max sessions (0 = unlimited)\n-- ARGV[6] namespace\n-- ARGV[7] userTag\nlocal created = redis.call('SET', KEYS[1], ARGV[1], 'NX', 'EX', ARGV[2])\nif not created then return {-1} end\nredis.call('ZADD', KEYS[2], ARGV[3], ARGV[4])\nif tonumber(ARGV[5]) > 0 then\n  local count = redis.call('ZCARD', KEYS[2])\n  if count > tonumber(ARGV[5]) then\n    local excess = count - tonumber(ARGV[5])\n    local old = redis.call('ZRANGE', KEYS[2], 0, excess - 1)\n    for _, evictedHash in ipairs(old) do\n      redis.call('ZREM', KEYS[2], evictedHash)\n      redis.call('DEL', ARGV[6] .. ':session:{' .. ARGV[7] .. '}:' .. evictedHash)\n      redis.call('DEL', ARGV[6] .. ':token-index:' .. evictedHash)\n    end\n    return {1, excess}\n  end\nend\nreturn {1}\n";
+    readonly touch_session: "-- KEYS[1] session key\n-- ARGV[1] now epoch seconds\n-- ARGV[2] touch interval\n-- ARGV[3] new idle expiry epoch seconds (0 = no idle timeout)\n-- ARGV[4] new absolute expiry epoch seconds (0 = no absolute timeout)\nlocal raw = redis.call('GET', KEYS[1])\nif not raw then return {0} end\nlocal ok, s = pcall(cjson.decode, raw)\nif not ok or not s.data then return {-4} end\nlocal r = s.data\nif r.status ~= 'active' then return {-1} end\nlocal now = tonumber(ARGV[1])\nif tonumber(r.expiresAt) <= now then return {-2} end\nif r.absoluteExpiresAt and r.absoluteExpiresAt ~= cjson.null and tonumber(r.absoluteExpiresAt) > 0 and tonumber(r.absoluteExpiresAt) <= now then return {-2} end\nif r.idleExpiresAt and tonumber(r.idleExpiresAt) > 0 and tonumber(r.idleExpiresAt) <= now then return {-3} end\nif now - tonumber(r.lastAccessedAt) < tonumber(ARGV[2]) then return {2} end\nlocal idle = tonumber(ARGV[3])\nlocal absolute = tonumber(ARGV[4])\nif absolute > 0 and idle > absolute then idle = absolute end\nr.lastAccessedAt = now\nr.idleExpiresAt = idle > 0 and idle or cjson.null\nr.version = tonumber(r.version) + 1\nlocal wrapper = {v=1, data=r}\nlocal encoded = cjson.encode(wrapper)\nlocal ttl = tonumber(r.expiresAt) - now\nif ttl <= 0 then return {-2} end\nredis.call('SET', KEYS[1], encoded, 'XX', 'EX', ttl)\nreturn {1, r.version, idle}\n";
+    readonly consume_session: "-- KEYS[1] session key\n-- ARGV[1] now epoch seconds\n-- ARGV[2] tombstone ttl seconds\nlocal raw = redis.call('GET', KEYS[1])\nif not raw then return {0} end\nlocal ok, s = pcall(cjson.decode, raw)\nif not ok or not s.data then return {-4} end\nlocal r = s.data\nif r.status == 'consumed' then return {-1} end\nif r.status == 'revoked' then return {-3} end\nlocal now = tonumber(ARGV[1])\nif tonumber(r.expiresAt) <= now then return {-2} end\nif r.absoluteExpiresAt and r.absoluteExpiresAt ~= cjson.null and tonumber(r.absoluteExpiresAt) > 0 and tonumber(r.absoluteExpiresAt) <= now then return {-2} end\nif r.idleExpiresAt and tonumber(r.idleExpiresAt) > 0 and tonumber(r.idleExpiresAt) <= now then return {-2} end\nr.status = 'consumed'\nr.consumedAt = now\nr.version = tonumber(r.version) + 1\nlocal ttl = tonumber(ARGV[2])\nlocal encoded = cjson.encode({v=1, data=r})\nredis.call('SET', KEYS[1], encoded, 'XX', 'EX', ttl)\nreturn {1, r.userId, r.jti, r.version}\n";
+    readonly revoke_session: "-- KEYS[1] session key\n-- ARGV[1] now\n-- ARGV[2] tombstone ttl\nlocal raw = redis.call('GET', KEYS[1])\nif not raw then return {0} end\nlocal ok, s = pcall(cjson.decode, raw)\nif not ok or not s.data then return {-4} end\nlocal r=s.data\nif r.status == 'revoked' then return {2} end\nr.status='revoked'; r.version=tonumber(r.version)+1\nlocal ttl=tonumber(ARGV[2])\nif ttl < 1 then redis.call('DEL', KEYS[1]) else redis.call('SET', KEYS[1], cjson.encode({v=1,data=r}), 'XX', 'EX', ttl) end\nreturn {1}\n";
+    readonly update_session: "-- KEYS[1] session key\n-- ARGV[1] expected version\n-- ARGV[2] now\n-- ARGV[3] serialized replacement\nlocal raw = redis.call('GET', KEYS[1])\nif not raw then return {0} end\nlocal ok, s = pcall(cjson.decode, raw)\nif not ok or not s.data then return {-4} end\nif s.data.status ~= 'active' then return {-3} end\nif tonumber(s.data.version) ~= tonumber(ARGV[1]) then return {-2, s.data.version} end\nlocal replacement = ARGV[3]\nlocal ok2, parsed = pcall(cjson.decode, replacement)\nif not ok2 or not parsed.data then return {-4} end\nif parsed.data.userId ~= s.data.userId or parsed.data.jti ~= s.data.jti or parsed.data.id ~= s.data.id or parsed.data.createdAt ~= s.data.createdAt or parsed.data.absoluteExpiresAt ~= s.data.absoluteExpiresAt then return {-5} end\nlocal ttl = tonumber(s.data.expiresAt) - tonumber(ARGV[2])\nif ttl <= 0 then return {-1} end\nredis.call('SET', KEYS[1], replacement, 'XX', 'EX', ttl)\nreturn {1}\n";
+    readonly delete: "-- KEYS[1] session key\nreturn redis.call('DEL', KEYS[1])\n";
+    readonly enforce_limit: "-- Bounded helper. The application must pass session keys to delete as KEYS.\n-- KEYS[1] user index; KEYS[2..N] session keys corresponding to the oldest members.\n-- ARGV[1] max sessions; ARGV[2] number of candidate keys.\nlocal max=tonumber(ARGV[1])\nlocal candidateCount=tonumber(ARGV[2])\nlocal count=redis.call('ZCARD', KEYS[1])\nif max <= 0 or count <= max then return {0} end\nlocal excess=math.min(count-max, candidateCount)\nlocal removed=0\nfor i=1,excess do\n  local tokenHash=redis.call('ZRANGE', KEYS[1], 0, 0)[1]\n  if not tokenHash then break end\n  redis.call('ZREM', KEYS[1], tokenHash)\n  redis.call('DEL', KEYS[i+1])\n  removed=removed+1\nend\nreturn {removed}\n";
+    readonly cleanup_index: "-- KEYS[1] user index\n-- ARGV[1..N] stale token hashes (user-index ZSET members, not JTIs)\nfor i=1,#ARGV do redis.call('ZREM', KEYS[1], ARGV[i]) end\nreturn #ARGV\n";
+};
+//# sourceMappingURL=script-sources.d.ts.map

package/dist/session/script-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"script-sources.d.ts","sourceRoot":"","sources":["../../src/session/script-sources.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc;;;;;;;;;CA0IjB,CAAC"}

package/dist/session/script-sources.js

@@ -0,0 +1,140 @@
+export const SCRIPT_SOURCES = {
+    'create_session': `-- KEYS[1] session key
+-- KEYS[2] user index
+-- ARGV[1] serialized record
+-- ARGV[2] ttl seconds
+-- ARGV[3] createdAt score
+-- ARGV[4] tokenHash
+-- ARGV[5] max sessions (0 = unlimited)
+-- ARGV[6] namespace
+-- ARGV[7] userTag
+local created = redis.call('SET', KEYS[1], ARGV[1], 'NX', 'EX', ARGV[2])
+if not created then return {-1} end
+redis.call('ZADD', KEYS[2], ARGV[3], ARGV[4])
+if tonumber(ARGV[5]) > 0 then
+  local count = redis.call('ZCARD', KEYS[2])
+  if count > tonumber(ARGV[5]) then
+    local excess = count - tonumber(ARGV[5])
+    local old = redis.call('ZRANGE', KEYS[2], 0, excess - 1)
+    for _, evictedHash in ipairs(old) do
+      redis.call('ZREM', KEYS[2], evictedHash)
+      redis.call('DEL', ARGV[6] .. ':session:{' .. ARGV[7] .. '}:' .. evictedHash)
+      redis.call('DEL', ARGV[6] .. ':token-index:' .. evictedHash)
+    end
+    return {1, excess}
+  end
+end
+return {1}
+`,
+    'touch_session': `-- KEYS[1] session key
+-- ARGV[1] now epoch seconds
+-- ARGV[2] touch interval
+-- ARGV[3] new idle expiry epoch seconds (0 = no idle timeout)
+-- ARGV[4] new absolute expiry epoch seconds (0 = no absolute timeout)
+local raw = redis.call('GET', KEYS[1])
+if not raw then return {0} end
+local ok, s = pcall(cjson.decode, raw)
+if not ok or not s.data then return {-4} end
+local r = s.data
+if r.status ~= 'active' then return {-1} end
+local now = tonumber(ARGV[1])
+if tonumber(r.expiresAt) <= now then return {-2} end
+if r.absoluteExpiresAt and r.absoluteExpiresAt ~= cjson.null and tonumber(r.absoluteExpiresAt) > 0 and tonumber(r.absoluteExpiresAt) <= now then return {-2} end
+if r.idleExpiresAt and tonumber(r.idleExpiresAt) > 0 and tonumber(r.idleExpiresAt) <= now then return {-3} end
+if now - tonumber(r.lastAccessedAt) < tonumber(ARGV[2]) then return {2} end
+local idle = tonumber(ARGV[3])
+local absolute = tonumber(ARGV[4])
+if absolute > 0 and idle > absolute then idle = absolute end
+r.lastAccessedAt = now
+r.idleExpiresAt = idle > 0 and idle or cjson.null
+r.version = tonumber(r.version) + 1
+local wrapper = {v=1, data=r}
+local encoded = cjson.encode(wrapper)
+local ttl = tonumber(r.expiresAt) - now
+if ttl <= 0 then return {-2} end
+redis.call('SET', KEYS[1], encoded, 'XX', 'EX', ttl)
+return {1, r.version, idle}
+`,
+    'consume_session': `-- KEYS[1] session key
+-- ARGV[1] now epoch seconds
+-- ARGV[2] tombstone ttl seconds
+local raw = redis.call('GET', KEYS[1])
+if not raw then return {0} end
+local ok, s = pcall(cjson.decode, raw)
+if not ok or not s.data then return {-4} end
+local r = s.data
+if r.status == 'consumed' then return {-1} end
+if r.status == 'revoked' then return {-3} end
+local now = tonumber(ARGV[1])
+if tonumber(r.expiresAt) <= now then return {-2} end
+if r.absoluteExpiresAt and r.absoluteExpiresAt ~= cjson.null and tonumber(r.absoluteExpiresAt) > 0 and tonumber(r.absoluteExpiresAt) <= now then return {-2} end
+if r.idleExpiresAt and tonumber(r.idleExpiresAt) > 0 and tonumber(r.idleExpiresAt) <= now then return {-2} end
+r.status = 'consumed'
+r.consumedAt = now
+r.version = tonumber(r.version) + 1
+local ttl = tonumber(ARGV[2])
+local encoded = cjson.encode({v=1, data=r})
+redis.call('SET', KEYS[1], encoded, 'XX', 'EX', ttl)
+return {1, r.userId, r.jti, r.version}
+`,
+    'revoke_session': `-- KEYS[1] session key
+-- ARGV[1] now
+-- ARGV[2] tombstone ttl
+local raw = redis.call('GET', KEYS[1])
+if not raw then return {0} end
+local ok, s = pcall(cjson.decode, raw)
+if not ok or not s.data then return {-4} end
+local r=s.data
+if r.status == 'revoked' then return {2} end
+r.status='revoked'; r.version=tonumber(r.version)+1
+local ttl=tonumber(ARGV[2])
+if ttl < 1 then redis.call('DEL', KEYS[1]) else redis.call('SET', KEYS[1], cjson.encode({v=1,data=r}), 'XX', 'EX', ttl) end
+return {1}
+`,
+    'update_session': `-- KEYS[1] session key
+-- ARGV[1] expected version
+-- ARGV[2] now
+-- ARGV[3] serialized replacement
+local raw = redis.call('GET', KEYS[1])
+if not raw then return {0} end
+local ok, s = pcall(cjson.decode, raw)
+if not ok or not s.data then return {-4} end
+if s.data.status ~= 'active' then return {-3} end
+if tonumber(s.data.version) ~= tonumber(ARGV[1]) then return {-2, s.data.version} end
+local replacement = ARGV[3]
+local ok2, parsed = pcall(cjson.decode, replacement)
+if not ok2 or not parsed.data then return {-4} end
+if parsed.data.userId ~= s.data.userId or parsed.data.jti ~= s.data.jti or parsed.data.id ~= s.data.id or parsed.data.createdAt ~= s.data.createdAt or parsed.data.absoluteExpiresAt ~= s.data.absoluteExpiresAt then return {-5} end
+local ttl = tonumber(s.data.expiresAt) - tonumber(ARGV[2])
+if ttl <= 0 then return {-1} end
+redis.call('SET', KEYS[1], replacement, 'XX', 'EX', ttl)
+return {1}
+`,
+    'delete': `-- KEYS[1] session key
+return redis.call('DEL', KEYS[1])
+`,
+    'enforce_limit': `-- Bounded helper. The application must pass session keys to delete as KEYS.
+-- KEYS[1] user index; KEYS[2..N] session keys corresponding to the oldest members.
+-- ARGV[1] max sessions; ARGV[2] number of candidate keys.
+local max=tonumber(ARGV[1])
+local candidateCount=tonumber(ARGV[2])
+local count=redis.call('ZCARD', KEYS[1])
+if max <= 0 or count <= max then return {0} end
+local excess=math.min(count-max, candidateCount)
+local removed=0
+for i=1,excess do
+  local tokenHash=redis.call('ZRANGE', KEYS[1], 0, 0)[1]
+  if not tokenHash then break end
+  redis.call('ZREM', KEYS[1], tokenHash)
+  redis.call('DEL', KEYS[i+1])
+  removed=removed+1
+end
+return {removed}
+`,
+    'cleanup_index': `-- KEYS[1] user index
+-- ARGV[1..N] stale token hashes (user-index ZSET members, not JTIs)
+for i=1,#ARGV do redis.call('ZREM', KEYS[1], ARGV[i]) end
+return #ARGV
+`
+};
+//# sourceMappingURL=script-sources.js.map

package/dist/session/script-sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"script-sources.js","sourceRoot":"","sources":["../../src/session/script-sources.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,gBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BnB;IACC,eAAe,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BlB;IACC,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBpB;IACC,gBAAgB,EAAE;;;;;;;;;;;;;CAanB;IACC,gBAAgB,EAAE;;;;;;;;;;;;;;;;;;CAkBnB;IACC,QAAQ,EAAE;;CAEX;IACC,eAAe,EAAE;;;;;;;;;;;;;;;;;CAiBlB;IACC,eAAe,EAAE;;;;CAIlB;CACS,CAAC"}

package/dist/session/scripts.d.ts

@@ -0,0 +1,15 @@
+import type { RedisClientWrapper } from '../redis/wrapper.js';
+import { SCRIPT_SOURCES } from './script-sources.js';
+/** Names of versioned Lua scripts used by the session repository. */
+export type ScriptName = keyof typeof SCRIPT_SOURCES;
+/** Loads and executes versioned session Lua scripts. */
+export declare class SessionScriptRegistry {
+    private readonly redis;
+    private readonly shas;
+    /** Creates a script registry backed by the shared Redis client. */
+    constructor(redis: RedisClientWrapper);
+    private sha;
+    /** Executes a named script with explicit KEYS and ARGV, recovering from NOSCRIPT. */
+    eval(name: ScriptName, keys: string[], args: string[]): Promise<unknown>;
+}
+//# sourceMappingURL=scripts.d.ts.map

package/dist/session/scripts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scripts.d.ts","sourceRoot":"","sources":["../../src/session/scripts.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,qEAAqE;AACrE,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,cAAc,CAAC;AACrD,wDAAwD;AACxD,qBAAa,qBAAqB;IAGpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;IACtD,mEAAmE;gBACtC,KAAK,EAAE,kBAAkB;IACtD,OAAO,CAAC,GAAG;IAKX,qFAAqF;IAC/E,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAY/E"}

package/dist/session/scripts.js

@@ -0,0 +1,41 @@
+import { createHash } from 'node:crypto';
+import { SessionStorageError } from './errors.js';
+import { SCRIPT_SOURCES } from './script-sources.js';
+/** Loads and executes versioned session Lua scripts. */
+export class SessionScriptRegistry {
+    redis;
+    shas = new Map();
+    /** Creates a script registry backed by the shared Redis client. */
+    constructor(redis) {
+        this.redis = redis;
+    }
+    sha(name) {
+        let sha = this.shas.get(name);
+        if (sha === undefined) {
+            sha = createHash('sha1').update(SCRIPT_SOURCES[name]).digest('hex');
+            this.shas.set(name, sha);
+        }
+        return sha;
+    }
+    /** Executes a named script with explicit KEYS and ARGV, recovering from NOSCRIPT. */
+    async eval(name, keys, args) {
+        if (!keys.length)
+            throw new SessionStorageError('Lua script requires at least one key');
+        const sha = this.sha(name);
+        try {
+            return await this.redis.evalsha(sha, keys.length, ...keys, ...args);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : '';
+            if (!message.includes('NOSCRIPT'))
+                throw new SessionStorageError('Redis script execution failed', error);
+            try {
+                return await this.redis.eval(SCRIPT_SOURCES[name], keys.length, ...keys, ...args);
+            }
+            catch (fallbackError) {
+                throw new SessionStorageError('Redis script execution failed', fallbackError);
+            }
+        }
+    }
+}
+//# sourceMappingURL=scripts.js.map

package/dist/session/scripts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scripts.js","sourceRoot":"","sources":["../../src/session/scripts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrD,wDAAwD;AACxD,MAAM,OAAO,qBAAqB;IAGH;IAFZ,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtD,mEAAmE;IACnE,YAA6B,KAAyB;QAAzB,UAAK,GAAL,KAAK,CAAoB;IAAG,CAAC;IAClD,GAAG,CAAC,IAAgB;QAC1B,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAAC,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;QACzH,OAAO,GAAG,CAAC;IACb,CAAC;IACD,qFAAqF;IACrF,KAAK,CAAC,IAAI,CAAC,IAAgB,EAAE,IAAc,EAAE,IAAc;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,sCAAsC,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YACzG,IAAI,CAAC;gBAAC,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;YAAC,CAAC;YAC1F,OAAO,aAAa,EAAE,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,EAAE,aAAa,CAAC,CAAC;YAAC,CAAC;QAC1G,CAAC;IACH,CAAC;CACF"}

package/dist/session/serializer.d.ts

@@ -0,0 +1,12 @@
+import type { KeyManager, SessionRecord } from './types.js';
+/** Versioned serializer with optional authenticated encryption for session records. */
+export declare class SessionSerializer {
+    private readonly keyManager?;
+    /** Creates a serializer. Supplying a key manager enables AES-256-GCM envelopes. */
+    constructor(keyManager?: KeyManager | undefined);
+    /** Serializes and optionally encrypts a validated session record. */
+    serialize(session: SessionRecord): string;
+    /** Parses, optionally decrypts, validates, and returns a session record. */
+    deserialize(serialized: string): SessionRecord;
+}
+//# sourceMappingURL=serializer.d.ts.map

package/dist/session/serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../../src/session/serializer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI5D,uFAAuF;AACvF,qBAAa,iBAAiB;IAEhB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IADxC,mFAAmF;gBACtD,UAAU,CAAC,EAAE,UAAU,YAAA;IAEpD,qEAAqE;IACrE,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM;IAkBzC,4EAA4E;IAC5E,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa;CAoB/C"}