@aooth/auth 0.1.77 → 0.1.78

package/dist/atscript-db.cjs

@@ -273,7 +273,15 @@ var CredentialStoreAtscriptDb = class {
 	async revoke(token) {
 		await this.table.deleteOne(token);
 	}
-	async touch(token, at) {
+	async touch(token, at, state) {
+		if (state && this.table.updateOne) {
+			if (state.expiresAt <= Date.now()) return;
+			await this.table.updateOne({
+				token,
+				lastSeenAt: at
+			});
+			return;
+		}
 		const row = await this.table.findOne({ filter: { token } });
 		if (!row) return;
 		if (row.expiresAt <= Date.now()) return;

package/dist/atscript-db.d.cts

@@ -1,5 +1,5 @@
-import { c as CredentialSuccessorRef, r as CredentialStore, s as CredentialState, t as Clock } from "./clock-C0O0FCCN.cjs";
-import { c as AuthCodeStore, d as NewAuthCode, h as PendingAuthorizationStore, m as PendingAuthorization, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient } from "./dynamic-client-store-CafYRhI4.cjs";
+import { c as CredentialSuccessorRef, r as CredentialStore, s as CredentialState, t as Clock } from "./clock-CyjqzLxc.cjs";
+import { c as AuthCodeStore, d as NewAuthCode, h as PendingAuthorizationStore, m as PendingAuthorization, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient } from "./dynamic-client-store-HLfcl2FJ.cjs";
 //#region src/atscript-db/authz-stores.d.ts
 /**
  * atscript-db-backed durable implementations of the two short-lived
@@ -255,6 +255,14 @@ interface AuthCredentialTable<TPayload extends object = object> {
   deleteMany(filter: Record<string, unknown>): Promise<{
     deletedCount: number;
   }>;
+  /**
+   * Optional PK-addressed patch (atscript-db's `updateOne`): lets `touch`
+   * stamp `lastSeenAt` without re-reading the row. Never inserts.
+   */
+  updateOne?(patch: {
+    token: string;
+    lastSeenAt: number;
+  }): Promise<unknown>;
 }
 interface CredentialStoreAtscriptDbOptions<TPayload extends object> {
   table: AuthCredentialTable<TPayload>;
@@ -290,7 +298,7 @@ declare class CredentialStoreAtscriptDb<TPayload extends object = object> implem
   consume(token: string): Promise<(CredentialState & TPayload) | null>;
   update(token: string, state: CredentialState & TPayload): Promise<string>;
   revoke(token: string): Promise<void>;
-  touch(token: string, at: number): Promise<void>;
+  touch(token: string, at: number, state?: CredentialState & TPayload): Promise<void>;
   revokeAllForUser(userId: string): Promise<number>;
   listForUser(userId: string): Promise<Array<CredentialState & TPayload & {
     token: string;

package/dist/atscript-db.d.mts

@@ -1,5 +1,5 @@
-import { c as CredentialSuccessorRef, r as CredentialStore, s as CredentialState, t as Clock } from "./clock-C0O0FCCN.mjs";
-import { c as AuthCodeStore, d as NewAuthCode, h as PendingAuthorizationStore, m as PendingAuthorization, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient } from "./dynamic-client-store-BCAqzG0Y.mjs";
+import { c as CredentialSuccessorRef, r as CredentialStore, s as CredentialState, t as Clock } from "./clock-CyjqzLxc.mjs";
+import { c as AuthCodeStore, d as NewAuthCode, h as PendingAuthorizationStore, m as PendingAuthorization, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient } from "./dynamic-client-store-BF4nXMK2.mjs";
 //#region src/atscript-db/authz-stores.d.ts
 /**
  * atscript-db-backed durable implementations of the two short-lived
@@ -255,6 +255,14 @@ interface AuthCredentialTable<TPayload extends object = object> {
   deleteMany(filter: Record<string, unknown>): Promise<{
     deletedCount: number;
   }>;
+  /**
+   * Optional PK-addressed patch (atscript-db's `updateOne`): lets `touch`
+   * stamp `lastSeenAt` without re-reading the row. Never inserts.
+   */
+  updateOne?(patch: {
+    token: string;
+    lastSeenAt: number;
+  }): Promise<unknown>;
 }
 interface CredentialStoreAtscriptDbOptions<TPayload extends object> {
   table: AuthCredentialTable<TPayload>;
@@ -290,7 +298,7 @@ declare class CredentialStoreAtscriptDb<TPayload extends object = object> implem
   consume(token: string): Promise<(CredentialState & TPayload) | null>;
   update(token: string, state: CredentialState & TPayload): Promise<string>;
   revoke(token: string): Promise<void>;
-  touch(token: string, at: number): Promise<void>;
+  touch(token: string, at: number, state?: CredentialState & TPayload): Promise<void>;
   revokeAllForUser(userId: string): Promise<number>;
   listForUser(userId: string): Promise<Array<CredentialState & TPayload & {
     token: string;

package/dist/atscript-db.mjs

@@ -272,7 +272,15 @@ var CredentialStoreAtscriptDb = class {
 	async revoke(token) {
 		await this.table.deleteOne(token);
 	}
-	async touch(token, at) {
+	async touch(token, at, state) {
+		if (state && this.table.updateOne) {
+			if (state.expiresAt <= Date.now()) return;
+			await this.table.updateOne({
+				token,
+				lastSeenAt: at
+			});
+			return;
+		}
 		const row = await this.table.findOne({ filter: { token } });
 		if (!row) return;
 		if (row.expiresAt <= Date.now()) return;

package/dist/{auth-credential-C5DiSbb2.d.mts → auth-credential-CLAQgjCS.d.mts}

@@ -1,4 +1,4 @@
-import { a as AuthContext, d as RefreshConfig, f as RefreshResult, i as DenylistStore, l as EnrichedSession, m as SessionInfo, o as CredentialMetadata, p as SessionEnricher, r as CredentialStore, s as CredentialState, t as Clock, u as IssueResult } from "./clock-C0O0FCCN.mjs";
+import { a as AuthContext, d as RefreshConfig, f as RefreshResult, i as DenylistStore, l as EnrichedSession, m as SessionInfo, o as CredentialMetadata, p as SessionEnricher, r as CredentialStore, s as CredentialState, t as Clock, u as IssueResult } from "./clock-CyjqzLxc.mjs";
 //#region src/credential/auth-credential.d.ts
 interface AuthCredentialOptions<TPayload extends object = object> {
   /** Pluggable credential store (Memory, JWT, Encapsulated, ...). */
@@ -32,6 +32,22 @@ interface AuthCredentialOptions<TPayload extends object = object> {
    *   store that implements `touch`; a no-op on stores that don't.
    */
   trackLastSeen?: "refresh" | "validate" | false;
+  /**
+   * OPT-IN process-local cache of validated access-token state (token →
+   * state), reused by `validate()` for `ttlMs` instead of a store / denylist
+   * round trip. Off by default. A hit still re-checks expiry and kind; this
+   * instance's `revoke`, `revokeAllForUser`, `revokeSession`,
+   * `revokeOtherSessions`, the concurrency eviction and refresh-reuse
+   * responses evict their tokens at once. A revocation made elsewhere (another
+   * process / instance, or a direct store / denylist write) is seen within
+   * `ttlMs` — keep it short (seconds).
+   *
+   * @since 0.1.78
+   */
+  validateCache?: {
+    ttlMs: number;
+    max?: number;
+  };
   /** Optional clock for testability. */
   clock?: Clock;
 }
@@ -148,9 +164,18 @@ declare class AuthCredential<TPayload extends object = object> {
    * access; bounded by refresh TTL.
    */
   private readonly consumedRefreshes;
+  /** Map size at which `consumedRefreshes` next sweeps its expired entries. */
+  private consumedSweepAt;
+  /** Opt-in validated-state cache (`validateCache`). */
+  private readonly validated?;
   constructor(opts: AuthCredentialOptions<TPayload>);
   issue(userId: string, options?: IssueOptions<TPayload>): Promise<IssueResult>;
   validate(accessToken: string): Promise<AuthContext<TPayload> | null>;
+  /**
+   * The stored state of `accessToken` unless the orchestrator's denylist has
+   * it — both looked up concurrently (one round trip on remote stores).
+   */
+  private retrieveUnlessDenied;
   refresh(refreshToken: string, opts?: RefreshCallOptions<TPayload>): Promise<RefreshResult>;
   private refreshNone;
   /**
@@ -240,6 +265,8 @@ declare class AuthCredential<TPayload extends object = object> {
    * rotated (keeping it valid through the grace window) instead of consuming it.
    */
   private issueRotatedPair;
+  /** Amortized sweep of expired `consumedRefreshes` entries (each size doubling). */
+  private sweepConsumedRefreshes;
   private lookupConsumedRefresh;
   private fireRefreshReuseTheftResponse;
   /**

package/dist/{auth-credential-CU4vsKhu.d.cts → auth-credential-GRAK230V.d.cts}

@@ -1,4 +1,4 @@
-import { a as AuthContext, d as RefreshConfig, f as RefreshResult, i as DenylistStore, l as EnrichedSession, m as SessionInfo, o as CredentialMetadata, p as SessionEnricher, r as CredentialStore, s as CredentialState, t as Clock, u as IssueResult } from "./clock-C0O0FCCN.cjs";
+import { a as AuthContext, d as RefreshConfig, f as RefreshResult, i as DenylistStore, l as EnrichedSession, m as SessionInfo, o as CredentialMetadata, p as SessionEnricher, r as CredentialStore, s as CredentialState, t as Clock, u as IssueResult } from "./clock-CyjqzLxc.cjs";
 //#region src/credential/auth-credential.d.ts
 interface AuthCredentialOptions<TPayload extends object = object> {
   /** Pluggable credential store (Memory, JWT, Encapsulated, ...). */
@@ -32,6 +32,22 @@ interface AuthCredentialOptions<TPayload extends object = object> {
    *   store that implements `touch`; a no-op on stores that don't.
    */
   trackLastSeen?: "refresh" | "validate" | false;
+  /**
+   * OPT-IN process-local cache of validated access-token state (token →
+   * state), reused by `validate()` for `ttlMs` instead of a store / denylist
+   * round trip. Off by default. A hit still re-checks expiry and kind; this
+   * instance's `revoke`, `revokeAllForUser`, `revokeSession`,
+   * `revokeOtherSessions`, the concurrency eviction and refresh-reuse
+   * responses evict their tokens at once. A revocation made elsewhere (another
+   * process / instance, or a direct store / denylist write) is seen within
+   * `ttlMs` — keep it short (seconds).
+   *
+   * @since 0.1.78
+   */
+  validateCache?: {
+    ttlMs: number;
+    max?: number;
+  };
   /** Optional clock for testability. */
   clock?: Clock;
 }
@@ -148,9 +164,18 @@ declare class AuthCredential<TPayload extends object = object> {
    * access; bounded by refresh TTL.
    */
   private readonly consumedRefreshes;
+  /** Map size at which `consumedRefreshes` next sweeps its expired entries. */
+  private consumedSweepAt;
+  /** Opt-in validated-state cache (`validateCache`). */
+  private readonly validated?;
   constructor(opts: AuthCredentialOptions<TPayload>);
   issue(userId: string, options?: IssueOptions<TPayload>): Promise<IssueResult>;
   validate(accessToken: string): Promise<AuthContext<TPayload> | null>;
+  /**
+   * The stored state of `accessToken` unless the orchestrator's denylist has
+   * it — both looked up concurrently (one round trip on remote stores).
+   */
+  private retrieveUnlessDenied;
   refresh(refreshToken: string, opts?: RefreshCallOptions<TPayload>): Promise<RefreshResult>;
   private refreshNone;
   /**
@@ -240,6 +265,8 @@ declare class AuthCredential<TPayload extends object = object> {
    * rotated (keeping it valid through the grace window) instead of consuming it.
    */
   private issueRotatedPair;
+  /** Amortized sweep of expired `consumedRefreshes` entries (each size doubling). */
+  private sweepConsumedRefreshes;
   private lookupConsumedRefresh;
   private fireRefreshReuseTheftResponse;
   /**

package/dist/authz.d.cts

@@ -1,5 +1,5 @@
-import { t as Clock } from "./clock-C0O0FCCN.cjs";
-import { _ as PendingAuthorizationStoreMemoryOptions, a as DynamicClientStoreMemoryOptions, b as tokenPolicyToIssueOptions, c as AuthCodeStore, d as NewAuthCode, f as DEFAULT_PENDING_TTL_MS, g as PendingAuthorizationStoreMemory, h as PendingAuthorizationStore, i as DynamicClientStoreMemory, l as AuthCodeStoreMemory, m as PendingAuthorization, n as DynamicClientAuthMethod, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient, u as AuthCodeStoreMemoryOptions, v as DEFAULT_AUTHZ_REFRESH_TTL_MS, y as TokenPolicy } from "./dynamic-client-store-CafYRhI4.cjs";
+import { t as Clock } from "./clock-CyjqzLxc.cjs";
+import { _ as PendingAuthorizationStoreMemoryOptions, a as DynamicClientStoreMemoryOptions, b as tokenPolicyToIssueOptions, c as AuthCodeStore, d as NewAuthCode, f as DEFAULT_PENDING_TTL_MS, g as PendingAuthorizationStoreMemory, h as PendingAuthorizationStore, i as DynamicClientStoreMemory, l as AuthCodeStoreMemory, m as PendingAuthorization, n as DynamicClientAuthMethod, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient, u as AuthCodeStoreMemoryOptions, v as DEFAULT_AUTHZ_REFRESH_TTL_MS, y as TokenPolicy } from "./dynamic-client-store-HLfcl2FJ.cjs";
 import { JWK } from "jose";
 //#region src/authz/authz-errors.d.ts
 /**

package/dist/authz.d.mts

@@ -1,5 +1,5 @@
-import { t as Clock } from "./clock-C0O0FCCN.mjs";
-import { _ as PendingAuthorizationStoreMemoryOptions, a as DynamicClientStoreMemoryOptions, b as tokenPolicyToIssueOptions, c as AuthCodeStore, d as NewAuthCode, f as DEFAULT_PENDING_TTL_MS, g as PendingAuthorizationStoreMemory, h as PendingAuthorizationStore, i as DynamicClientStoreMemory, l as AuthCodeStoreMemory, m as PendingAuthorization, n as DynamicClientAuthMethod, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient, u as AuthCodeStoreMemoryOptions, v as DEFAULT_AUTHZ_REFRESH_TTL_MS, y as TokenPolicy } from "./dynamic-client-store-BCAqzG0Y.mjs";
+import { t as Clock } from "./clock-CyjqzLxc.mjs";
+import { _ as PendingAuthorizationStoreMemoryOptions, a as DynamicClientStoreMemoryOptions, b as tokenPolicyToIssueOptions, c as AuthCodeStore, d as NewAuthCode, f as DEFAULT_PENDING_TTL_MS, g as PendingAuthorizationStoreMemory, h as PendingAuthorizationStore, i as DynamicClientStoreMemory, l as AuthCodeStoreMemory, m as PendingAuthorization, n as DynamicClientAuthMethod, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient, u as AuthCodeStoreMemoryOptions, v as DEFAULT_AUTHZ_REFRESH_TTL_MS, y as TokenPolicy } from "./dynamic-client-store-BF4nXMK2.mjs";
 import { JWK } from "jose";
 //#region src/authz/authz-errors.d.ts
 /**

package/dist/{clock-C0O0FCCN.d.cts → clock-CyjqzLxc.d.cts}

@@ -328,9 +328,10 @@ interface CredentialStore<TPayload extends object = object> {
    * Optional last-activity stamp. Set `state.lastSeenAt = at` for the token if
    * it exists; no-op otherwise. Backs `AuthCredential`'s
    * `trackLastSeen: 'validate'` mode. Stateless stores omit it (the token is
-   * immutable once issued).
+   * immutable once issued). `state` (since 0.1.78) is the state `retrieve`
+   * just returned for the token — a store may use it instead of re-reading.
    */
-  touch?(token: string, at: number): Promise<void>;
+  touch?(token: string, at: number, state?: CredentialState & TPayload): Promise<void>;
   /**
    * Derive a stable, domain-separated 32-byte subkey from this store's
    * symmetric secret via HKDF-SHA256. Used so other subsystems (e.g. the

package/dist/{clock-C0O0FCCN.d.mts → clock-CyjqzLxc.d.mts}

@@ -328,9 +328,10 @@ interface CredentialStore<TPayload extends object = object> {
    * Optional last-activity stamp. Set `state.lastSeenAt = at` for the token if
    * it exists; no-op otherwise. Backs `AuthCredential`'s
    * `trackLastSeen: 'validate'` mode. Stateless stores omit it (the token is
-   * immutable once issued).
+   * immutable once issued). `state` (since 0.1.78) is the state `retrieve`
+   * just returned for the token — a store may use it instead of re-reading.
    */
-  touch?(token: string, at: number): Promise<void>;
+  touch?(token: string, at: number, state?: CredentialState & TPayload): Promise<void>;
   /**
    * Derive a stable, domain-separated 32-byte subkey from this store's
    * symmetric secret via HKDF-SHA256. Used so other subsystems (e.g. the

package/dist/{dynamic-client-store-BCAqzG0Y.d.mts → dynamic-client-store-BF4nXMK2.d.mts}

@@ -1,5 +1,5 @@
-import { t as Clock } from "./clock-C0O0FCCN.mjs";
-import { r as IssueOptions } from "./auth-credential-C5DiSbb2.mjs";
+import { t as Clock } from "./clock-CyjqzLxc.mjs";
+import { r as IssueOptions } from "./auth-credential-CLAQgjCS.mjs";
 //#region src/authz/token-policy.d.ts
 /**
  * What the authorization server mints for a completed grant — forwarded verbatim

package/dist/{dynamic-client-store-CafYRhI4.d.cts → dynamic-client-store-HLfcl2FJ.d.cts}

@@ -1,5 +1,5 @@
-import { t as Clock } from "./clock-C0O0FCCN.cjs";
-import { r as IssueOptions } from "./auth-credential-CU4vsKhu.cjs";
+import { t as Clock } from "./clock-CyjqzLxc.cjs";
+import { r as IssueOptions } from "./auth-credential-GRAK230V.cjs";
 //#region src/authz/token-policy.d.ts
 /**
  * What the authorization server mints for a completed grant — forwarded verbatim

package/dist/index.cjs

@@ -81,7 +81,7 @@ var CredentialStoreMemory = class {
 		this.states.delete(token);
 		this.indexRemove(state.userId, token);
 	}
-	async touch(token, at) {
+	async touch(token, at, _state) {
 		const state = this.states.get(token);
 		if (!state) return;
 		state.lastSeenAt = at;
@@ -143,17 +143,24 @@ var CredentialStoreMemory = class {
 * In-memory denylist for stateless revocation.
 *
 * Stores a map from JTI (or any opaque identifier) to absolute expiry timestamp.
-* `has` returns false for entries whose TTL has elapsed and lazily removes them.
-* `cleanup` performs a sweep across the map and returns the number of entries
-* removed, useful for periodic compaction in long-lived processes.
+* `has` returns false for entries whose TTL has elapsed and lazily removes them;
+* `add` sweeps expired entries as the map grows (amortized, each time it
+* doubles). `cleanup` performs a sweep on demand and returns the number of
+* entries removed.
 */
 var DenylistStoreMemory = class {
 	entries = /* @__PURE__ */ new Map();
 	clock;
+	/** Map size at which `add` next sweeps expired entries (amortized; doubles). */
+	sweepAt = MIN_SWEEP_SIZE$2;
 	constructor(opts) {
 		this.clock = opts?.clock ?? require_clock.defaultClock;
 	}
 	async add(jti, expiresAt) {
+		if (this.entries.size >= this.sweepAt && !this.entries.has(jti)) {
+			this.sweep(this.clock.now());
+			this.sweepAt = Math.max(MIN_SWEEP_SIZE$2, this.entries.size * 2);
+		}
 		this.entries.set(jti, expiresAt);
 	}
 	async has(jti) {
@@ -166,7 +173,9 @@ var DenylistStoreMemory = class {
 		return true;
 	}
 	async cleanup() {
-		const now = this.clock.now();
+		return this.sweep(this.clock.now());
+	}
+	sweep(now) {
 		let removed = 0;
 		for (const [jti, expiresAt] of this.entries) if (expiresAt <= now) {
 			this.entries.delete(jti);
@@ -175,6 +184,8 @@ var DenylistStoreMemory = class {
 		return removed;
 	}
 };
+/** Smallest map size an amortized expiry sweep runs at. */
+const MIN_SWEEP_SIZE$2 = 1024;
 //#endregion
 //#region src/stores/derive-subkey.ts
 const SUBKEY_SALT = Buffer.from("aooth/credential-store/subkey-v1");
@@ -201,6 +212,12 @@ var CredentialStoreJwt = class {
 	algorithm;
 	signingKey;
 	verifyingKey;
+	/**
+	* HS* with raw secret bytes: the HMAC `CryptoKey` imported once (lazily) and
+	* reused for every sign / verify — jose would otherwise re-import the raw
+	* bytes per call. `signingKey` keeps the bytes for `deriveSubkey`.
+	*/
+	hmacKey;
 	issuer;
 	audience;
 	denylist;
@@ -249,7 +266,7 @@ var CredentialStoreJwt = class {
 		const builder = new jose.SignJWT({ state: stateClaim }).setProtectedHeader({ alg: this.algorithm }).setSubject(state.userId).setIssuedAt(Math.floor(state.issuedAt / 1e3)).setExpirationTime(Math.floor(expiresAtMs / 1e3)).setJti(jti);
 		if (this.issuer) builder.setIssuer(this.issuer);
 		if (this.audience) builder.setAudience(this.audience);
-		return builder.sign(this.signingKey);
+		return builder.sign(await this.keyFor(this.signingKey));
 	}
 	async retrieve(token) {
 		const verified = await this.verify(token);
@@ -315,7 +332,7 @@ var CredentialStoreJwt = class {
 	}
 	async verify(token) {
 		try {
-			return { payload: (await (0, jose.jwtVerify)(token, this.verifyingKey, {
+			return { payload: (await (0, jose.jwtVerify)(token, await this.keyFor(this.verifyingKey), {
 				algorithms: [this.algorithm],
 				issuer: this.issuer,
 				audience: this.audience,
@@ -325,6 +342,19 @@ var CredentialStoreJwt = class {
 			return null;
 		}
 	}
+	/**
+	* The key jose gets: raw HS* secret bytes as their HMAC `CryptoKey`
+	* (imported once — usable for both sign and verify, its hash pinned to the
+	* configured algorithm), anything else as given.
+	*/
+	keyFor(key) {
+		if (!(key instanceof Uint8Array) || !HS_ALGS.has(this.algorithm)) return key;
+		this.hmacKey ??= crypto.subtle.importKey("raw", key, {
+			name: "HMAC",
+			hash: `SHA-${this.algorithm.slice(2)}`
+		}, false, ["sign", "verify"]);
+		return this.hmacKey;
+	}
 	payloadToState(payload) {
 		if (typeof payload.sub !== "string") return null;
 		if (typeof payload.iat !== "number" || typeof payload.exp !== "number") return null;
@@ -511,6 +541,63 @@ function fingerprint(token) {
 	return (0, node_crypto.createHash)("sha256").update(token).digest("hex");
 }
 /**
+* Turn `ctx.credentialId` (already in place, so key order is kept) into a
+* lazily computed, memoized, still writable property.
+*/
+function lazyCredentialId(ctx, token) {
+	let value;
+	Object.defineProperty(ctx, "credentialId", {
+		enumerable: true,
+		configurable: true,
+		get: () => value ??= fingerprint(token),
+		set: (next) => {
+			value = next;
+		}
+	});
+}
+/** Smallest map size an amortized expiry sweep runs at. */
+const MIN_SWEEP_SIZE$1 = 1024;
+/**
+* The opt-in `validateCache`: token → validated state for `ttlMs`, bounded
+* (oldest dropped first). `epoch` moves on every eviction so a validation
+* racing a revocation never re-caches the revoked token.
+*/
+var ValidateCache = class {
+	ttlMs;
+	max;
+	entries = /* @__PURE__ */ new Map();
+	epoch = 0;
+	constructor(ttlMs, max) {
+		this.ttlMs = ttlMs;
+		this.max = max;
+	}
+	get(token, now) {
+		const entry = this.entries.get(token);
+		if (!entry) return void 0;
+		if (entry.until > now) return entry.state;
+		this.entries.delete(token);
+	}
+	set(token, state, now) {
+		this.entries.delete(token);
+		if (this.entries.size >= this.max) {
+			const oldest = this.entries.keys().next();
+			if (!oldest.done) this.entries.delete(oldest.value);
+		}
+		this.entries.set(token, {
+			state,
+			until: now + this.ttlMs
+		});
+	}
+	delete(token) {
+		this.epoch++;
+		this.entries.delete(token);
+	}
+	deleteUser(userId) {
+		this.epoch++;
+		for (const [token, entry] of this.entries) if (entry.state.userId === userId) this.entries.delete(token);
+	}
+};
+/**
 * Merge a credential's typed payload under the fixed {@link CredentialState}
 * envelope, asserting the `CredentialState & TPayload` shape in ONE place. The
 * payload is spread first so an envelope field always wins a name clash. Every
@@ -571,6 +658,10 @@ var AuthCredential = class {
 	* access; bounded by refresh TTL.
 	*/
 	consumedRefreshes = /* @__PURE__ */ new Map();
+	/** Map size at which `consumedRefreshes` next sweeps its expired entries. */
+	consumedSweepAt = MIN_SWEEP_SIZE$1;
+	/** Opt-in validated-state cache (`validateCache`). */
+	validated;
 	constructor(opts) {
 		this.store = opts.store;
 		this.method = opts.method ?? "token";
@@ -581,6 +672,10 @@ var AuthCredential = class {
 		this.onLimit = opts.onLimit ?? "reject";
 		this.trackLastSeen = opts.trackLastSeen ?? false;
 		this.clock = opts.clock ?? require_clock.defaultClock;
+		if (opts.validateCache) {
+			if (!(opts.validateCache.ttlMs > 0)) throw new AuthError("INVALID_CONFIG", `validateCache.ttlMs must be > 0 (got ${opts.validateCache.ttlMs})`);
+			this.validated = new ValidateCache(opts.validateCache.ttlMs, opts.validateCache.max ?? 1e4);
+		}
 		if (this.accessTtl <= 0) throw new AuthError("INVALID_CONFIG", `accessTtl must be > 0 (got ${this.accessTtl})`);
 		if (this.refreshConfig && this.refreshConfig.ttl <= 0) throw new AuthError("INVALID_CONFIG", `refresh.ttl must be > 0 (got ${this.refreshConfig.ttl})`);
 		const graceMs = this.refreshConfig?.rotationGraceMs;
@@ -643,20 +738,42 @@ var AuthCredential = class {
 		};
 	}
 	async validate(accessToken) {
-		if (this.denylist && await this.denylist.has(accessToken)) return null;
-		const state = await this.store.retrieve(accessToken);
-		if (!state) return null;
-		if (state.expiresAt <= this.clock.now()) return null;
-		if (state.kind === "refresh") return null;
-		if (this.trackLastSeen === "validate" && this.store.touch) await this.store.touch(accessToken, this.clock.now());
-		return {
+		let state = this.validated?.get(accessToken, this.clock.now());
+		let fresh = false;
+		if (!state) {
+			fresh = true;
+			const epoch = this.validated?.epoch;
+			state = await this.retrieveUnlessDenied(accessToken);
+			if (!state) return null;
+			if (state.expiresAt <= this.clock.now()) return null;
+			if (state.kind === "refresh") return null;
+			if (this.validated && this.validated.epoch === epoch) this.validated.set(accessToken, state, this.clock.now());
+		} else if (state.expiresAt <= this.clock.now()) {
+			this.validated.delete(accessToken);
+			return null;
+		}
+		if (this.trackLastSeen === "validate" && this.store.touch) await this.store.touch(accessToken, this.clock.now(), fresh ? state : void 0);
+		const ctx = {
 			...require_payload.credentialPayloadOf(state),
 			userId: state.userId,
 			method: this.method,
-			credentialId: fingerprint(accessToken),
+			credentialId: "",
 			sessionId: this.sessionIdOf(state.sessionId, accessToken),
 			expiresAt: state.expiresAt
 		};
+		lazyCredentialId(ctx, accessToken);
+		return ctx;
+	}
+	/**
+	* The stored state of `accessToken` unless the orchestrator's denylist has
+	* it — both looked up concurrently (one round trip on remote stores).
+	*/
+	async retrieveUnlessDenied(accessToken) {
+		const retrieving = this.store.retrieve(accessToken);
+		if (!this.denylist) return await retrieving;
+		retrieving.catch(() => {});
+		if (await this.denylist.has(accessToken)) return null;
+		return await retrieving;
 	}
 	async refresh(refreshToken, opts) {
 		const now = this.clock.now();
@@ -707,6 +824,7 @@ var AuthCredential = class {
 	async refreshAlways(oldState, refreshToken, now) {
 		if (!this.store.listForUser) {
 			await this.store.consume(refreshToken);
+			this.sweepConsumedRefreshes();
 			this.consumedRefreshes.set(refreshToken, {
 				userId: oldState.userId,
 				iat: oldState.issuedAt,
@@ -763,10 +881,20 @@ var AuthCredential = class {
 		};
 	}
 	async revoke(token) {
-		await this.store.revoke(token);
+		this.validated?.delete(token);
+		try {
+			await this.store.revoke(token);
+		} finally {
+			this.validated?.delete(token);
+		}
 	}
 	async revokeAllForUser(userId) {
-		return await this.store.revokeAllForUser(userId);
+		this.validated?.deleteUser(userId);
+		try {
+			return await this.store.revokeAllForUser(userId);
+		} finally {
+			this.validated?.deleteUser(userId);
+		}
 	}
 	async listForUser(userId) {
 		if (!this.store.listForUser) return [];
@@ -850,7 +978,7 @@ var AuthCredential = class {
 	async revokeSession(userId, sessionId) {
 		if (!this.store.listForUser) return;
 		const all = await this.store.listForUser(userId);
-		await Promise.all(all.filter((entry) => this.sessionKeyOf(entry) === sessionId).map((entry) => this.store.revoke(entry.token)));
+		await Promise.all(all.filter((entry) => this.sessionKeyOf(entry) === sessionId).map((entry) => this.revoke(entry.token)));
 	}
 	/**
 	* Revoke every session for the user EXCEPT `keepSessionId` ("log out
@@ -866,7 +994,7 @@ var AuthCredential = class {
 			const key = this.sessionKeyOf(entry);
 			if (key === keepSessionId) continue;
 			revokedSessions.add(key);
-			revokes.push(this.store.revoke(entry.token));
+			revokes.push(this.revoke(entry.token));
 		}
 		await Promise.all(revokes);
 		return revokedSessions.size;
@@ -893,7 +1021,7 @@ var AuthCredential = class {
 		});
 		const sorted = accessOnly.toSorted((a, b) => a.issuedAt - b.issuedAt);
 		const toEvict = accessOnly.length - this.maxConcurrent + 1;
-		for (let i = 0; i < toEvict && i < sorted.length; i++) await this.store.revoke(sorted[i].token);
+		for (let i = 0; i < toEvict && i < sorted.length; i++) await this.revoke(sorted[i].token);
 	}
 	async issueAccessFromRefresh(refreshState, now) {
 		const accessTtl = refreshState.metadata?.accessTtl ?? this.accessTtl;
@@ -956,6 +1084,13 @@ var AuthCredential = class {
 			userId: oldRefreshState.userId
 		};
 	}
+	/** Amortized sweep of expired `consumedRefreshes` entries (each size doubling). */
+	sweepConsumedRefreshes() {
+		if (this.consumedRefreshes.size < this.consumedSweepAt) return;
+		const now = this.clock.now();
+		for (const [token, entry] of this.consumedRefreshes) if (entry.exp <= now) this.consumedRefreshes.delete(token);
+		this.consumedSweepAt = Math.max(MIN_SWEEP_SIZE$1, this.consumedRefreshes.size * 2);
+	}
 	lookupConsumedRefresh(token) {
 		const entry = this.consumedRefreshes.get(token);
 		if (!entry) return null;
@@ -992,7 +1127,7 @@ var AuthCredential = class {
 			...reuse.rotatedAt !== void 0 && { rotatedAt: reuse.rotatedAt }
 		});
 		if ((this.refreshConfig?.reuseResponse ?? "session") === "session" && reuse.sessionId !== void 0 && this.store.listForUser) await this.revokeSession(reuse.userId, reuse.sessionId);
-		else await this.store.revokeAllForUser(reuse.userId);
+		else await this.revokeAllForUser(reuse.userId);
 		throw new AuthError("REFRESH_REUSE_DETECTED", void 0, {
 			userId: reuse.userId,
 			...reuse.sessionId !== void 0 && { sessionId: reuse.sessionId },
@@ -1082,13 +1217,15 @@ function renderRateLimitMessage(template, rule, retryAfterMs) {
 //#region src/rate-limit/store.ts
 /**
 * In-memory `RateLimitStore` — the zero-config default (single process only).
-* Lazy-evicts expired counters on access; `cleanup()` sweeps the whole map for
-* periodic compaction in long-lived processes (same pattern as
-* `DenylistStoreMemory`).
+* Lazy-evicts expired counters on access, and sweeps expired counters itself
+* as the map grows (amortized, each time it doubles); `cleanup()` sweeps the
+* whole map on demand (same pattern as `DenylistStoreMemory`).
 */
 var RateLimitStoreMemory = class {
 	entries = /* @__PURE__ */ new Map();
 	clock;
+	/** Map size at which `hit` next sweeps expired counters (amortized; doubles). */
+	sweepAt = MIN_SWEEP_SIZE;
 	constructor(opts) {
 		this.clock = opts?.clock ?? require_clock.defaultClock;
 	}
@@ -1096,6 +1233,10 @@ var RateLimitStoreMemory = class {
 		const now = this.clock.now();
 		const entry = this.entries.get(key);
 		if (!entry || entry.expiresAt <= now) {
+			if (!entry && this.entries.size >= this.sweepAt) {
+				this.sweep(now);
+				this.sweepAt = Math.max(MIN_SWEEP_SIZE, this.entries.size * 2);
+			}
 			this.entries.set(key, {
 				count: 1,
 				expiresAt: now + ttlMs
@@ -1113,7 +1254,9 @@ var RateLimitStoreMemory = class {
 		this.entries.clear();
 	}
 	async cleanup() {
-		const now = this.clock.now();
+		return this.sweep(this.clock.now());
+	}
+	sweep(now) {
 		let removed = 0;
 		for (const [key, entry] of this.entries) if (entry.expiresAt <= now) {
 			this.entries.delete(key);
@@ -1122,6 +1265,8 @@ var RateLimitStoreMemory = class {
 		return removed;
 	}
 };
+/** Smallest map size an amortized expiry sweep runs at. */
+const MIN_SWEEP_SIZE = 1024;
 //#endregion
 //#region src/rate-limit/rate-limiter.ts
 /**