ioredis-toolkit 0.0.9 → 0.5.0

package/dist/session/serializer.js

@@ -0,0 +1,77 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import { SessionSerializationError } from './errors.js';
+/** Versioned serializer with optional authenticated encryption for session records. */
+export class SessionSerializer {
+    keyManager;
+    /** Creates a serializer. Supplying a key manager enables AES-256-GCM envelopes. */
+    constructor(keyManager) {
+        this.keyManager = keyManager;
+    }
+    /** Serializes and optionally encrypts a validated session record. */
+    serialize(session) {
+        try {
+            const sessionJson = JSON.stringify(session);
+            if (!this.keyManager)
+                return JSON.stringify({ v: 1, data: sessionJson });
+            const { version, key } = this.keyManager.current();
+            if (key.length !== 32)
+                throw new SessionSerializationError('AES-256-GCM key must be 32 bytes');
+            const iv = randomBytes(12);
+            const cipher = createCipheriv('aes-256-gcm', key, iv);
+            const ciphertext = Buffer.concat([cipher.update(sessionJson, 'utf8'), cipher.final()]);
+            const tag = cipher.getAuthTag();
+            const envelope = { v: 1, enc: 1, keyVersion: version, iv: iv.toString('base64url'), tag: tag.toString('base64url'), data: ciphertext.toString('base64url') };
+            return JSON.stringify(envelope);
+        }
+        catch (error) {
+            if (error instanceof SessionSerializationError)
+                throw error;
+            throw new SessionSerializationError(undefined, error);
+        }
+    }
+    /** Parses, optionally decrypts, validates, and returns a session record. */
+    deserialize(serialized) {
+        try {
+            const outer = JSON.parse(serialized);
+            if (!isRecord(outer) || outer.v !== 1 || typeof outer.data !== 'string')
+                throw new Error('invalid envelope');
+            let payload = outer.data;
+            if (outer.enc === 1) {
+                if (!this.keyManager || typeof outer.keyVersion !== 'string' || typeof outer.iv !== 'string' || typeof outer.tag !== 'string')
+                    throw new Error('encryption unavailable');
+                const key = this.keyManager.get(outer.keyVersion);
+                if (!key || key.length !== 32)
+                    throw new Error('unknown encryption key');
+                const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(outer.iv, 'base64url'));
+                decipher.setAuthTag(Buffer.from(outer.tag, 'base64url'));
+                payload = Buffer.concat([decipher.update(Buffer.from(payload, 'base64url')), decipher.final()]).toString('utf8');
+            }
+            const session = JSON.parse(payload);
+            if (!isSessionRecord(session))
+                throw new Error('invalid session schema');
+            return session;
+        }
+        catch (error) {
+            throw new SessionSerializationError(undefined, error);
+        }
+    }
+}
+function isRecord(value) { return typeof value === 'object' && value !== null && !Array.isArray(value); }
+function isOptionalString(value) { return value === undefined || typeof value === 'string'; }
+function isOptionalSafeInteger(value) { return value === undefined || Number.isSafeInteger(value); }
+function isSessionRecord(value) {
+    if (!isRecord(value))
+        return false;
+    return typeof value.id === 'string' && typeof value.jti === 'string' && typeof value.userId === 'string' &&
+        Number.isSafeInteger(value.createdAt) && Number.isSafeInteger(value.lastAccessedAt) && Number.isSafeInteger(value.expiresAt) &&
+        (value.idleExpiresAt === null || Number.isSafeInteger(value.idleExpiresAt)) &&
+        (value.absoluteExpiresAt === null || Number.isSafeInteger(value.absoluteExpiresAt)) &&
+        (value.status === 'active' || value.status === 'consumed' || value.status === 'revoked') && Number.isSafeInteger(value.version) &&
+        (value.securityVersion === null || Number.isSafeInteger(value.securityVersion)) &&
+        isOptionalSafeInteger(value.idleTimeoutSeconds) &&
+        isOptionalString(value.deviceId) && isOptionalString(value.ipAddress) && isOptionalString(value.userAgent) &&
+        isOptionalString(value.rotatedFrom) && isOptionalString(value.successorJti) && isOptionalString(value.rotationId) &&
+        isOptionalSafeInteger(value.consumedAt) &&
+        (value.metadata === undefined || isRecord(value.metadata));
+}
+//# sourceMappingURL=serializer.js.map

package/dist/session/serializer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializer.js","sourceRoot":"","sources":["../../src/session/serializer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAKxD,uFAAuF;AACvF,MAAM,OAAO,iBAAiB;IAEC;IAD7B,mFAAmF;IACnF,YAA6B,UAAuB;QAAvB,eAAU,GAAV,UAAU,CAAa;IAAG,CAAC;IAExD,qEAAqE;IACrE,SAAS,CAAC,OAAsB;QAC9B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YACzE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACnD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,yBAAyB,CAAC,kCAAkC,CAAC,CAAC;YAC/F,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACvF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAa,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACvK,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB;gBAAE,MAAM,KAAK,CAAC;YAC5D,MAAM,IAAI,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,WAAW,CAAC,UAAkB;QAC5B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAY,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC7G,IAAI,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;YACzB,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;gBACzK,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAClD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;gBACzE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;gBAC1F,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;gBACzD,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnH,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;YAC/C,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc,IAAsC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpJ,SAAS,gBAAgB,CAAC,KAAc,IAAa,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC;AAC/G,SAAS,qBAAqB,CAAC,KAAc,IAAa,OAAO,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACtH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QACtG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;QAC5H,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3E,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACnF,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/H,CAAC,KAAK,CAAC,eAAe,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/E,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAC/C,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC;QAC1G,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QACjH,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC;QACvC,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/session/service.d.ts

@@ -0,0 +1,48 @@
+import type { SessionConfig } from './config.js';
+import type { SessionRepository } from './repository.js';
+import type { SessionTokenManager } from './token.js';
+import type { CreateSessionInput, CreatedSession, RotationResult, SessionMetrics, SessionPatch, SessionRecord, ValidationResult } from './types.js';
+import type { RedisClientWrapper } from '../redis/wrapper.js';
+/** Dependencies required by {@link SessionService}. */
+export interface SessionServiceOptions {
+    repository: SessionRepository;
+    tokens: SessionTokenManager;
+    redis: RedisClientWrapper;
+    config: SessionConfig;
+    metrics?: SessionMetrics;
+}
+/** Domain service enforcing session lifecycle and authentication invariants. */
+export declare class SessionService {
+    private readonly o;
+    private readonly metrics;
+    /** Creates the domain service from repository, token, Redis-clock, and normalized configuration dependencies. */
+    constructor(o: SessionServiceOptions);
+    /** Creates a new session and returns its raw credential exactly once. */
+    create(input: CreateSessionInput): Promise<CreatedSession>;
+    /** Validates an opaque credential and returns a discriminated authentication result. */
+    validate(token: string): Promise<ValidationResult>;
+    private validateInternal;
+    /** Validates and returns an active session, throwing a typed error for invalid state. */
+    get(token: string): Promise<SessionRecord>;
+    /** Applies rolling idle-expiration rules with repository-level touch throttling. */
+    touch(token: string): Promise<void>;
+    /** Updates mutable session fields with optional optimistic-concurrency protection. */
+    update(token: string, patch: SessionPatch, expectedVersion?: number): Promise<SessionRecord>;
+    /** Consumes the predecessor credential and creates a successor credential with explicit partial-failure semantics. */
+    rotate(token: string): Promise<RotationResult>;
+    /** Best-effort idempotently removes a session and its derived indexes. */
+    destroy(token: string): Promise<void>;
+    /** Marks a session revoked and persists a bounded revocation tombstone when applicable. */
+    revoke(token: string): Promise<void>;
+    /** Sets the user's security version used to invalidate older sessions. */
+    setSecurityVersion(userId: string, version: number): Promise<void>;
+    /** Revokes a bounded batch of the user's indexed sessions without unbounded memory use. */
+    revokeAll(userId: string, limit?: number): Promise<{
+        affected: number;
+        remaining: number;
+    }>;
+    /** Returns a bounded page of authoritative sessions for a user. */
+    list(userId: string, offset?: number, limit?: number): Promise<SessionRecord[]>;
+    private now;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/session/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/session/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpJ,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,uDAAuD;AACvD,MAAM,WAAW,qBAAqB;IAAG,UAAU,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAC;CAAE;AAElL,gFAAgF;AAChF,qBAAa,cAAc;IAGb,OAAO,CAAC,QAAQ,CAAC,CAAC;IAF9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,iHAAiH;gBACpF,CAAC,EAAE,qBAAqB;IAErD,yEAAyE;IACnE,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC;IAiChE,wFAAwF;IAClF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAM1C,gBAAgB;IAmB9B,yFAAyF;IACnF,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAMhD,oFAAoF;IAC9E,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzC,sFAAsF;IAChF,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAalG,sHAAsH;IAChH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAwBpD,0EAA0E;IACpE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS3C,2FAA2F;IACrF,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU1C,0EAA0E;IACpE,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxE,2FAA2F;IACrF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAA6B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAKrH,mEAAmE;IAC7D,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAI,EAAE,KAAK,SAA6B,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YAOtF,GAAG;CAIlB"}

package/dist/session/service.js

@@ -0,0 +1,235 @@
+import { SessionConflictError, SessionExpiredError, SessionInvalidError, SessionLimitError, SessionNotFoundError, SessionReplayError, SessionRotationError, SessionStorageError, SessionRevokedError } from './errors.js';
+import { NoopMetrics } from './metrics.js';
+/** Domain service enforcing session lifecycle and authentication invariants. */
+export class SessionService {
+    o;
+    metrics;
+    /** Creates the domain service from repository, token, Redis-clock, and normalized configuration dependencies. */
+    constructor(o) {
+        this.o = o;
+        this.metrics = o.metrics ?? new NoopMetrics();
+    }
+    /** Creates a new session and returns its raw credential exactly once. */
+    async create(input) {
+        validateUserId(input.userId);
+        validateMetadata(input.metadata, this.o.config.maxMetadataBytes);
+        validateOptionalString(input.deviceId, 256);
+        validateOptionalString(input.ipAddress, 128);
+        validateOptionalString(input.userAgent, 1024);
+        if (this.o.config.securityVersionEnabled && input.securityVersion === undefined)
+            throw new SessionInvalidError();
+        const now = await this.now();
+        const ttl = input.ttl ?? this.o.config.ttl;
+        const absoluteDuration = input.absoluteTimeout ?? this.o.config.absoluteTimeout;
+        const idleDuration = input.idleTimeout ?? this.o.config.idleTimeout;
+        if (ttl <= 0 || (absoluteDuration !== undefined && absoluteDuration <= 0) || (idleDuration !== undefined && idleDuration <= 0))
+            throw new SessionInvalidError();
+        if (absoluteDuration !== undefined && ttl > absoluteDuration)
+            throw new SessionInvalidError();
+        const tokenData = this.o.tokens.generate();
+        const tokenHash = this.o.tokens.hash(tokenData.token);
+        const absoluteExpiresAt = absoluteDuration === undefined ? null : now + absoluteDuration;
+        const expiresAt = absoluteExpiresAt === null ? now + ttl : Math.min(now + ttl, absoluteExpiresAt);
+        const idleExpiresAt = idleDuration === undefined ? null : Math.min(now + idleDuration, expiresAt);
+        const session = {
+            id: tokenHash, jti: tokenData.jti, userId: input.userId, createdAt: now, lastAccessedAt: now,
+            expiresAt, idleExpiresAt, absoluteExpiresAt, status: 'active', version: 1,
+            securityVersion: input.securityVersion ?? null,
+            ...(idleDuration !== undefined ? { idleTimeoutSeconds: idleDuration } : {}),
+            ...(this.o.config.storeDeviceId && input.deviceId !== undefined ? { deviceId: input.deviceId } : {}),
+            ...(this.o.config.storeIpAddress && input.ipAddress !== undefined ? { ipAddress: input.ipAddress } : {}),
+            ...(this.o.config.storeUserAgent && input.userAgent !== undefined ? { userAgent: input.userAgent } : {}),
+            ...(input.metadata ? { metadata: input.metadata } : {})
+        };
+        await this.o.repository.create(session);
+        this.metrics.increment('session.created');
+        return { token: tokenData.token, session };
+    }
+    /** Validates an opaque credential and returns a discriminated authentication result. */
+    async validate(token) {
+        const result = await this.validateInternal(token);
+        this.metrics.increment('session.validate', 1, result.valid ? { result: 'valid' } : { result: 'invalid', reason: result.reason });
+        return result;
+    }
+    async validateInternal(token) {
+        if (!this.o.tokens.validateFormat(token))
+            return { valid: false, reason: 'invalid' };
+        const tokenHash = this.o.tokens.hash(token);
+        const session = await this.o.repository.resolve(tokenHash);
+        if (!session)
+            return { valid: false, reason: 'not_found' };
+        const now = await this.now();
+        if (session.status === 'revoked')
+            return { valid: false, reason: 'revoked' };
+        if (session.status === 'consumed')
+            return { valid: false, reason: 'consumed' };
+        if (session.expiresAt <= now)
+            return { valid: false, reason: 'expired' };
+        if (session.absoluteExpiresAt !== null && session.absoluteExpiresAt <= now)
+            return { valid: false, reason: 'absolute_timeout' };
+        if (session.idleExpiresAt !== null && session.idleExpiresAt <= now)
+            return { valid: false, reason: 'idle_timeout' };
+        if (!(await this.o.repository.isIndexed(session)))
+            return { valid: false, reason: 'invalid' };
+        if (this.o.config.securityVersionEnabled) {
+            const current = await this.o.repository.getSecurityVersion(session.userId);
+            if (current === null || session.securityVersion !== Number(current))
+                return { valid: false, reason: 'invalid' };
+        }
+        return { valid: true, session };
+    }
+    /** Validates and returns an active session, throwing a typed error for invalid state. */
+    async get(token) {
+        const result = await this.validate(token);
+        if (!result.valid)
+            throw errorForReason(result.reason);
+        return result.session;
+    }
+    /** Applies rolling idle-expiration rules with repository-level touch throttling. */
+    async touch(token) {
+        const session = await this.get(token);
+        if (!this.o.config.rolling)
+            return;
+        const result = await this.o.repository.touch(session, await this.now());
+        if (result === 'invalid')
+            throw new SessionExpiredError();
+    }
+    /** Updates mutable session fields with optional optimistic-concurrency protection. */
+    async update(token, patch, expectedVersion) {
+        const session = await this.get(token);
+        validateMetadata(patch.metadata, this.o.config.maxMetadataBytes);
+        const replacement = { ...session, version: session.version + 1 };
+        if (patch.metadata !== undefined)
+            replacement.metadata = patch.metadata;
+        if (patch.deviceId !== undefined) {
+            if (patch.deviceId === null)
+                delete replacement.deviceId;
+            else
+                replacement.deviceId = patch.deviceId;
+        }
+        if (patch.ipAddress !== undefined) {
+            if (patch.ipAddress === null)
+                delete replacement.ipAddress;
+            else
+                replacement.ipAddress = patch.ipAddress;
+        }
+        if (patch.userAgent !== undefined) {
+            if (patch.userAgent === null)
+                delete replacement.userAgent;
+            else
+                replacement.userAgent = patch.userAgent;
+        }
+        if (expectedVersion !== undefined && expectedVersion !== session.version)
+            throw new SessionConflictError();
+        await this.o.repository.update(session, replacement, expectedVersion ?? session.version, await this.now());
+        return replacement;
+    }
+    /** Consumes the predecessor credential and creates a successor credential with explicit partial-failure semantics. */
+    async rotate(token) {
+        const current = await this.get(token);
+        if (current.status !== 'active')
+            throw new SessionReplayError();
+        const now = await this.now();
+        const remaining = current.expiresAt - now;
+        if (remaining <= 0)
+            throw new SessionExpiredError();
+        const tokenData = this.o.tokens.generate();
+        const successorHash = this.o.tokens.hash(tokenData.token);
+        const absoluteExpiresAt = current.absoluteExpiresAt;
+        const expiresAt = absoluteExpiresAt === null ? current.expiresAt : Math.min(current.expiresAt, absoluteExpiresAt);
+        const idleExpiresAt = current.idleExpiresAt === null ? null : Math.min(expiresAt, now + (current.idleTimeoutSeconds ?? this.o.config.idleTimeout ?? Math.max(1, current.idleExpiresAt - current.lastAccessedAt)));
+        const successor = {
+            ...current, id: successorHash, jti: tokenData.jti, createdAt: now, lastAccessedAt: now,
+            expiresAt, idleExpiresAt, status: 'active', version: 1, rotatedFrom: current.jti
+        };
+        // Cross-slot successor creation is deliberately two-phase. Consuming the predecessor
+        // is authoritative and atomic; failure afterwards can only deny access, never create two valid successors.
+        await this.o.repository.consume(current, now, Math.min(300, Math.max(1, remaining)));
+        try {
+            await this.o.repository.create(successor);
+        }
+        catch (error) {
+            throw new SessionRotationError('Rotation consumed the predecessor but successor creation failed', error);
+        }
+        this.metrics.increment('session.rotated');
+        return { token: tokenData.token, session: successor, previousJti: current.jti };
+    }
+    /** Best-effort idempotently removes a session and its derived indexes. */
+    async destroy(token) {
+        if (!this.o.tokens.validateFormat(token))
+            return;
+        const hash = this.o.tokens.hash(token);
+        const session = await this.o.repository.resolve(hash);
+        if (!session)
+            return;
+        await this.o.repository.destroy(session);
+        this.metrics.increment('session.destroyed');
+    }
+    /** Marks a session revoked and persists a bounded revocation tombstone when applicable. */
+    async revoke(token) {
+        if (!this.o.tokens.validateFormat(token))
+            return;
+        const hash = this.o.tokens.hash(token);
+        const session = await this.o.repository.resolve(hash);
+        if (!session)
+            return;
+        const now = await this.now();
+        await this.o.repository.revoke(session, now, Math.min(300, Math.max(1, session.expiresAt - now)));
+        this.metrics.increment('session.revoked');
+    }
+    /** Sets the user's security version used to invalidate older sessions. */
+    async setSecurityVersion(userId, version) {
+        validateUserId(userId);
+        if (!Number.isSafeInteger(version) || version < 0)
+            throw new SessionInvalidError();
+        await this.o.repository.setSecurityVersion(userId, version);
+    }
+    /** Revokes a bounded batch of the user's indexed sessions without unbounded memory use. */
+    async revokeAll(userId, limit = this.o.config.maxBatchSize) {
+        validateUserId(userId);
+        return this.o.repository.revokeAll(userId, limit);
+    }
+    /** Returns a bounded page of authoritative sessions for a user. */
+    async list(userId, offset = 0, limit = this.o.config.maxBatchSize) {
+        validateUserId(userId);
+        if (!Number.isInteger(offset) || offset < 0 || !Number.isInteger(limit) || limit < 1)
+            throw new SessionInvalidError();
+        if (limit > this.o.config.maxBatchSize)
+            throw new SessionLimitError(`limit must not exceed maxBatchSize (${this.o.config.maxBatchSize})`);
+        return this.o.repository.list(userId, offset, limit);
+    }
+    async now() {
+        try {
+            const [seconds] = await this.o.redis.time();
+            return Number(seconds);
+        }
+        catch (error) {
+            throw new SessionStorageError('Redis time unavailable', error);
+        }
+    }
+}
+function validateUserId(value) { if (typeof value !== 'string' || value.length < 1 || value.length > 256)
+    throw new SessionInvalidError(); }
+function validateOptionalString(value, max) { if (value !== undefined && (typeof value !== 'string' || value.length > max))
+    throw new SessionInvalidError(); }
+function validateMetadata(value, maxBytes) { if (value === undefined)
+    return; try {
+    const encoded = JSON.stringify(value);
+    if (encoded === undefined || Buffer.byteLength(encoded, 'utf8') > maxBytes)
+        throw new SessionInvalidError();
+}
+catch (error) {
+    if (error instanceof SessionInvalidError)
+        throw error;
+    throw new SessionInvalidError();
+} }
+function errorForReason(reason) {
+    if (reason === 'not_found')
+        return new SessionNotFoundError();
+    if (reason === 'expired' || reason === 'idle_timeout' || reason === 'absolute_timeout')
+        return new SessionExpiredError();
+    if (reason === 'revoked')
+        return new SessionRevokedError();
+    return new SessionInvalidError();
+}
+//# sourceMappingURL=service.js.map

package/dist/session/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/session/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1N,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAS3C,gFAAgF;AAChF,MAAM,OAAO,cAAc;IAGI;IAFZ,OAAO,CAAiB;IACzC,iHAAiH;IACjH,YAA6B,CAAwB;QAAxB,MAAC,GAAD,CAAC,CAAuB;QAAI,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,IAAI,WAAW,EAAE,CAAC;IAAC,CAAC;IAEzG,yEAAyE;IACzE,KAAK,CAAC,MAAM,CAAC,KAAyB;QACpC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACjE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5C,sBAAsB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7C,sBAAsB,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,sBAAsB,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;YAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACjH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC3C,MAAM,gBAAgB,GAAG,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;QAChF,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QACpE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,YAAY,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAChK,IAAI,gBAAgB,KAAK,SAAS,IAAI,GAAG,GAAG,gBAAgB;YAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,iBAAiB,GAAG,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,gBAAgB,CAAC;QACzF,MAAM,SAAS,GAAG,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAClG,MAAM,aAAa,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,YAAY,EAAE,SAAS,CAAC,CAAC;QAClG,MAAM,OAAO,GAAkB;YAC7B,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG;YAC5F,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACzE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;YAC9C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;QACF,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACjI,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAC1C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACrF,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC/E,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACzE,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,IAAI,OAAO,CAAC,iBAAiB,IAAI,GAAG;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAChI,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,CAAC,aAAa,IAAI,GAAG;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACpH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9F,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,KAAK,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACxE,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;IAC5D,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAmB,EAAE,eAAwB;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,WAAW,GAAkB,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAChF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACxE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,WAAW,CAAC,QAAQ,CAAC;;gBAAM,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAAC,CAAC;QAC3I,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;gBAAE,OAAO,WAAW,CAAC,SAAS,CAAC;;gBAAM,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAAC,CAAC;QAChJ,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;gBAAE,OAAO,WAAW,CAAC,SAAS,CAAC;;gBAAM,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAAC,CAAC;QAChJ,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC3G,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3G,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,sHAAsH;IACtH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,kBAAkB,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1C,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACpD,MAAM,SAAS,GAAG,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAClH,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAClN,MAAM,SAAS,GAAkB;YAC/B,GAAG,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG;YACtF,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG;SACjF,CAAC;QACF,qFAAqF;QACrF,2GAA2G;QAC3G,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAClD,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,oBAAoB,CAAC,iEAAiE,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAC3H,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAClF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,OAAO;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC9C,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,OAAO;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC5C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,OAAe;QACtD,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACnF,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY;QAChE,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY;QACvE,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACtH,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY;YAAE,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;QAC1I,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,IAAI,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAC5E,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;IACnF,CAAC;CACF;AAED,SAAS,cAAc,CAAC,KAAa,IAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;IAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC;AAC1J,SAAS,sBAAsB,CAAC,KAAyB,EAAE,GAAW,IAAU,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;IAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC;AAChM,SAAS,gBAAgB,CAAC,KAA+B,EAAE,QAAgB,IAAU,IAAI,KAAK,KAAK,SAAS;IAAE,OAAO,CAAC,IAAI,CAAC;IAAC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAAC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,QAAQ;QAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;AAAC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IAAC,IAAI,KAAK,YAAY,mBAAmB;QAAE,MAAM,KAAK,CAAC;IAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;AAAC,CAAC,CAAC,CAAC;AAC7X,SAAS,cAAc,CAAC,MAA4D;IAClF,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,oBAAoB,EAAE,CAAC;IAC9D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,IAAI,mBAAmB,EAAE,CAAC;IACzH,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,mBAAmB,EAAE,CAAC;IAC3D,OAAO,IAAI,mBAAmB,EAAE,CAAC;AACnC,CAAC"}

package/dist/session/token.d.ts

@@ -0,0 +1,16 @@
+/** Generates, hashes, and validates opaque session credentials. */
+export declare class SessionTokenManager {
+    private readonly bytes;
+    /** Creates a token manager; `bytes` controls random secret entropy and must be at least 32. */
+    constructor(bytes?: number);
+    /** Generates an opaque token containing a random JTI and random secret. */
+    generate(): {
+        token: string;
+        jti: string;
+    };
+    /** Returns the SHA-256 digest used as the Redis lookup identifier. */
+    hash(token: string): string;
+    /** Checks the token's non-secret syntactic structure without contacting Redis. */
+    validateFormat(token: string): boolean;
+}
+//# sourceMappingURL=token.d.ts.map

package/dist/session/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/session/token.ts"],"names":[],"mappings":"AAGA,mEAAmE;AACnE,qBAAa,mBAAmB;IAElB,OAAO,CAAC,QAAQ,CAAC,KAAK;IADlC,+FAA+F;gBAClE,KAAK,SAAK;IAGvC,2EAA2E;IAC3E,QAAQ,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAK1C,sEAAsE;IACtE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI3B,kFAAkF;IAClF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAKvC"}

package/dist/session/token.js

@@ -0,0 +1,32 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { SessionInputError } from './errors.js';
+/** Generates, hashes, and validates opaque session credentials. */
+export class SessionTokenManager {
+    bytes;
+    /** Creates a token manager; `bytes` controls random secret entropy and must be at least 32. */
+    constructor(bytes = 32) {
+        this.bytes = bytes;
+        if (!Number.isInteger(bytes) || bytes < 32)
+            throw new SessionInputError('Token entropy must be at least 256 bits');
+    }
+    /** Generates an opaque token containing a random JTI and random secret. */
+    generate() {
+        const jti = randomBytes(16).toString('base64url');
+        const secret = randomBytes(this.bytes).toString('base64url');
+        return { token: `${jti}.${secret}`, jti };
+    }
+    /** Returns the SHA-256 digest used as the Redis lookup identifier. */
+    hash(token) {
+        if (!this.validateFormat(token))
+            throw new SessionInputError('Invalid session token format');
+        return createHash('sha256').update(token, 'utf8').digest('hex');
+    }
+    /** Checks the token's non-secret syntactic structure without contacting Redis. */
+    validateFormat(token) {
+        if (typeof token !== 'string' || token.length < 45 || token.length > 512)
+            return false;
+        const dot = token.indexOf('.');
+        return dot > 0 && dot === token.lastIndexOf('.') && dot < token.length - 1 && /^[A-Za-z0-9_-]+$/.test(token.slice(0, dot)) && /^[A-Za-z0-9_-]+$/.test(token.slice(dot + 1));
+    }
+}
+//# sourceMappingURL=token.js.map

package/dist/session/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/session/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,mEAAmE;AACnE,MAAM,OAAO,mBAAmB;IAED;IAD7B,+FAA+F;IAC/F,YAA6B,QAAQ,EAAE;QAAV,UAAK,GAAL,KAAK,CAAK;QACrC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,CAAC,CAAC;IACrH,CAAC;IACD,2EAA2E;IAC3E,QAAQ;QACN,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC;IAC5C,CAAC;IACD,sEAAsE;IACtE,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;QAC7F,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,kFAAkF;IAClF,cAAc,CAAC,KAAa;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACvF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9K,CAAC;CACF"}

package/dist/session/types.d.ts

@@ -0,0 +1,134 @@
+/** Lifecycle states that may be persisted for a session. */
+export type SessionStatus = 'active' | 'consumed' | 'revoked';
+/** Authoritative session state stored by the repository. Raw credentials are deliberately absent. */
+export interface SessionRecord {
+    /** Stable identifier derived from the token hash. */
+    id: string;
+    /** Public token identifier used for rotation/revocation bookkeeping; it is not the raw token. */
+    jti: string;
+    /** Application user identifier that owns the session. */
+    userId: string;
+    /** Unix timestamp in seconds at which the session was created. */
+    createdAt: number;
+    /** Unix timestamp in seconds of the last accepted access/touch. */
+    lastAccessedAt: number;
+    /** Hard storage/authentication expiration timestamp in Unix seconds. */
+    expiresAt: number;
+    /** Rolling idle expiration boundary, or `null` when idle expiry is disabled. */
+    idleExpiresAt: number | null;
+    /** Originally configured rolling idle-timeout duration in seconds, absent when idle expiry is disabled. Preserved across touch and rotation so the idle window does not drift from its configured value. */
+    idleTimeoutSeconds?: number;
+    /** Absolute application expiration boundary, or `null` when disabled. */
+    absoluteExpiresAt: number | null;
+    /** Current lifecycle state. Only `active` sessions can authenticate. */
+    status: SessionStatus;
+    /** Monotonically increasing optimistic-concurrency version. */
+    version: number;
+    /** User security version captured at creation, or `null` when disabled. */
+    securityVersion: number | null;
+    /** Optional application device identifier. */
+    deviceId?: string;
+    /** Optional source IP address when configured for storage. */
+    ipAddress?: string;
+    /** Optional user-agent string when configured for storage. */
+    userAgent?: string;
+    /** Bounded JSON-compatible application metadata. */
+    metadata?: Record<string, string | number | boolean | null>;
+    /** JTI of the predecessor session when this record came from rotation. */
+    rotatedFrom?: string;
+    /** Unix timestamp at which this session was consumed by rotation. */
+    consumedAt?: number;
+    /** Successor JTI when rotation recorded it. */
+    successorJti?: string;
+    /** Optional application-level rotation correlation ID. */
+    rotationId?: string;
+}
+/** Input used to create a new authentication session. */
+export interface CreateSessionInput {
+    /** Owning application user ID. */
+    userId: string;
+    /** Optional hard TTL override in seconds. */
+    ttl?: number;
+    /** Optional rolling idle timeout in seconds. */
+    idleTimeout?: number;
+    /** Optional absolute timeout in seconds. */
+    absoluteTimeout?: number;
+    /** Optional user security version to capture. */
+    securityVersion?: number;
+    /** Optional device identifier. */
+    deviceId?: string;
+    /** Optional source IP address. */
+    ipAddress?: string;
+    /** Optional user-agent string. */
+    userAgent?: string;
+    /** Optional bounded metadata. */
+    metadata?: Record<string, string | number | boolean | null>;
+}
+/** Mutable fields accepted by a session update. */
+export interface SessionPatch {
+    /** Replaces the complete metadata object when supplied. */
+    metadata?: Record<string, string | number | boolean | null>;
+    /** Replaces or clears the device identifier. */
+    deviceId?: string | null;
+    /** Replaces or clears the IP address. */
+    ipAddress?: string | null;
+    /** Replaces or clears the user-agent string. */
+    userAgent?: string | null;
+}
+/** Newly created session plus the raw credential, which is returned only to the caller. */
+export interface CreatedSession {
+    /** Raw opaque session token. Never persist or log this value. */
+    token: string;
+    /** Authoritative persisted session representation. */
+    session: SessionRecord;
+}
+/** Reasons returned when a raw session token cannot authenticate. */
+export type InvalidReason = 'not_found' | 'expired' | 'idle_timeout' | 'absolute_timeout' | 'revoked' | 'consumed' | 'invalid';
+/** Discriminated authentication result that separates invalid credentials from infrastructure failures. */
+export type ValidationResult = {
+    valid: true;
+    session: SessionRecord;
+} | {
+    valid: false;
+    reason: InvalidReason;
+};
+/** Result of a successful session rotation. */
+export interface RotationResult {
+    /** Raw successor token; replace the predecessor credential with this value. */
+    token: string;
+    /** Newly created authoritative successor session. */
+    session: SessionRecord;
+    /** JTI of the consumed predecessor. */
+    previousJti: string;
+}
+/** Lightweight result from the Redis-backed session health probe. */
+export interface SessionHealth {
+    /** Aggregate health classification. */
+    status: 'healthy' | 'degraded' | 'unhealthy';
+    /** Round-trip latency measured by the probe. */
+    latencyMs: number;
+    /** Error-rate signal supplied by the health implementation. */
+    errorRate: number;
+    /** Redis client status string. */
+    redisStatus: string;
+}
+/** Minimal metrics sink accepted by the session subsystem. */
+export interface SessionMetrics {
+    /** Increments a counter metric. */
+    increment(name: string, value?: number, labels?: Record<string, string>): void;
+    /** Records an observation such as latency. */
+    observe(name: string, value: number, labels?: Record<string, string>): void;
+    /** Sets a gauge value. */
+    gauge(name: string, value: number, labels?: Record<string, string>): void;
+}
+/** Supplies versioned 32-byte encryption keys to the optional session serializer. */
+export interface KeyManager {
+    /** Returns the current encryption key and its version identifier. */
+    current(): {
+        version: string;
+        key: Buffer;
+    };
+    /** Returns a historical key by version for decryption, or `undefined` if unavailable. */
+    get(version: string): Buffer | undefined;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/session/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/session/types.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,qGAAqG;AACrG,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4MAA4M;IAC5M,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,wEAAwE;IACxE,MAAM,EAAE,aAAa,CAAC;IACtB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IAC5D,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CAC7D;AAED,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IAC5D,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,qEAAqE;AACrE,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,cAAc,GAAG,kBAAkB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE/H,2GAA2G;AAC3G,MAAM,MAAM,gBAAgB,GACxB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACvC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5C,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,OAAO,EAAE,aAAa,CAAC;IACvB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IAC7C,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC/E,8CAA8C;IAC9C,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC5E,0BAA0B;IAC1B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC3E;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,OAAO,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,yFAAyF;IACzF,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAC1C"}

package/dist/session/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/session/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/session/types.ts"],"names":[],"mappings":""}

package/dist/streams/config.d.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+import type { StreamsConfig } from './types.js';
+/** Runtime schema for Redis Streams configuration. */
+export declare const StreamsConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    keyPrefix: z.ZodDefault<z.ZodString>;
+    maxEntries: z.ZodDefault<z.ZodNumber>;
+    blockMs: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+/** Validates and normalizes Streams configuration. */
+export declare function parseStreamsConfig(input: unknown): StreamsConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/streams/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/streams/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,sDAAsD;AACtD,eAAO,MAAM,mBAAmB;;;;;iBAA2P,CAAC;AAC5R,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAAoE"}

package/dist/streams/config.js

@@ -0,0 +1,6 @@
+import { z } from 'zod';
+/** Runtime schema for Redis Streams configuration. */
+export const StreamsConfigSchema = z.object({ enabled: z.boolean().default(false), keyPrefix: z.string().min(1).max(128).default('stream'), maxEntries: z.number().int().positive().max(10_000_000).default(100_000), blockMs: z.number().int().nonnegative().max(300_000).default(5000) });
+/** Validates and normalizes Streams configuration. */
+export function parseStreamsConfig(input) { return StreamsConfigSchema.parse(input ?? {}); }
+//# sourceMappingURL=config.js.map