/** Enforce concurrent session limits, returning sessions to revoke if any. */
export function enforceSessionLimits(activeSessions, config) {
    if (activeSessions.length < config.maxConcurrentSessions) {
        return { allowed: true, sessionsToRevoke: [] };
    }
    if (config.strategy === 'deny_new') {
        return { allowed: false, sessionsToRevoke: [] };
    }
    const sorted = [...activeSessions].sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());
    const excess = sorted.length - config.maxConcurrentSessions + 1;
    const toRevoke = sorted.slice(0, excess).map((s) => s.sessionId);
    return { allowed: true, sessionsToRevoke: toRevoke };
}
//# sourceMappingURL=session-limits.js.map