@aooth/auth 0.1.77 → 0.1.79

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { a as AuthContext, d as RefreshConfig, f as RefreshResult, i as DenylistStore, l as EnrichedSession, m as SessionInfo, n as defaultClock, o as CredentialMetadata, p as SessionEnricher, r as CredentialStore, s as CredentialState, t as Clock, u as IssueResult } from "./clock-C0O0FCCN.cjs";
-import { i as RefreshCallOptions, n as AuthCredentialOptions, r as IssueOptions, t as AuthCredential } from "./auth-credential-CU4vsKhu.cjs";
-import { n as RateLimitStoreMemory, t as RateLimitStore } from "./store-3YN2hfss.cjs";
+import { a as AuthContext, d as RefreshConfig, f as RefreshResult, i as DenylistStore, l as EnrichedSession, m as SessionInfo, n as defaultClock, o as CredentialMetadata, p as SessionEnricher, r as CredentialStore, s as CredentialState, t as Clock, u as IssueResult } from "./clock-CyjqzLxc.cjs";
+import { i as RefreshCallOptions, n as AuthCredentialOptions, r as IssueOptions, t as AuthCredential } from "./auth-credential-GRAK230V.cjs";
+import { n as RateLimitStoreMemory, t as RateLimitStore } from "./store-ClQnA8yh.cjs";
 import { CryptoKey } from "jose";
 //#region src/errors.d.ts
 type AuthErrorType = "INVALID_TOKEN" | "TOKEN_EXPIRED" | "TOKEN_REVOKED" | "REFRESH_REUSE_DETECTED" | "STATELESS_OPERATION_UNSUPPORTED" | "MAX_CONCURRENT_REACHED" | "INVALID_CONFIG";
@@ -32,7 +32,7 @@ declare class CredentialStoreMemory<TPayload extends object = object> implements
   consume(token: string): Promise<(CredentialState & TPayload) | null>;
   update(token: string, state: CredentialState & TPayload): Promise<string>;
   revoke(token: string): Promise<void>;
-  touch(token: string, at: number): Promise<void>;
+  touch(token: string, at: number, _state?: CredentialState & TPayload): Promise<void>;
   revokeAllForUser(userId: string): Promise<number>;
   listForUser(userId: string): Promise<Array<CredentialState & TPayload & {
     token: string;
@@ -46,19 +46,23 @@ declare class CredentialStoreMemory<TPayload extends object = object> implements
  * In-memory denylist for stateless revocation.
  *
  * Stores a map from JTI (or any opaque identifier) to absolute expiry timestamp.
- * `has` returns false for entries whose TTL has elapsed and lazily removes them.
- * `cleanup` performs a sweep across the map and returns the number of entries
- * removed, useful for periodic compaction in long-lived processes.
+ * `has` returns false for entries whose TTL has elapsed and lazily removes them;
+ * `add` sweeps expired entries as the map grows (amortized, each time it
+ * doubles). `cleanup` performs a sweep on demand and returns the number of
+ * entries removed.
  */
 declare class DenylistStoreMemory implements DenylistStore {
   private readonly entries;
   private readonly clock;
+  /** Map size at which `add` next sweeps expired entries (amortized; doubles). */
+  private sweepAt;
   constructor(opts?: {
     clock?: Clock;
   });
   add(jti: string, expiresAt: number): Promise<void>;
   has(jti: string): Promise<boolean>;
   cleanup(): Promise<number>;
+  private sweep;
 }
 //#endregion
 //#region src/stores/jwt.d.ts
@@ -98,6 +102,12 @@ declare class CredentialStoreJwt<TPayload extends object = object> implements Cr
   private readonly algorithm;
   private readonly signingKey;
   private readonly verifyingKey;
+  /**
+   * HS* with raw secret bytes: the HMAC `CryptoKey` imported once (lazily) and
+   * reused for every sign / verify — jose would otherwise re-import the raw
+   * bytes per call. `signingKey` keeps the bytes for `deriveSubkey`.
+   */
+  private hmacKey?;
   private readonly issuer?;
   private readonly audience?;
   private readonly denylist?;
@@ -131,6 +141,12 @@ declare class CredentialStoreJwt<TPayload extends object = object> implements Cr
    */
   private passesEpoch;
   private verify;
+  /**
+   * The key jose gets: raw HS* secret bytes as their HMAC `CryptoKey`
+   * (imported once — usable for both sign and verify, its hash pinned to the
+   * configured algorithm), anything else as given.
+   */
+  private keyFor;
   private payloadToState;
 }
 //#endregion

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { a as AuthContext, d as RefreshConfig, f as RefreshResult, i as DenylistStore, l as EnrichedSession, m as SessionInfo, n as defaultClock, o as CredentialMetadata, p as SessionEnricher, r as CredentialStore, s as CredentialState, t as Clock, u as IssueResult } from "./clock-C0O0FCCN.mjs";
-import { i as RefreshCallOptions, n as AuthCredentialOptions, r as IssueOptions, t as AuthCredential } from "./auth-credential-C5DiSbb2.mjs";
-import { n as RateLimitStoreMemory, t as RateLimitStore } from "./store-BUIC0iCK.mjs";
+import { a as AuthContext, d as RefreshConfig, f as RefreshResult, i as DenylistStore, l as EnrichedSession, m as SessionInfo, n as defaultClock, o as CredentialMetadata, p as SessionEnricher, r as CredentialStore, s as CredentialState, t as Clock, u as IssueResult } from "./clock-CyjqzLxc.mjs";
+import { i as RefreshCallOptions, n as AuthCredentialOptions, r as IssueOptions, t as AuthCredential } from "./auth-credential-CLAQgjCS.mjs";
+import { n as RateLimitStoreMemory, t as RateLimitStore } from "./store-CVD1nd2j.mjs";
 import { CryptoKey } from "jose";
 //#region src/errors.d.ts
 type AuthErrorType = "INVALID_TOKEN" | "TOKEN_EXPIRED" | "TOKEN_REVOKED" | "REFRESH_REUSE_DETECTED" | "STATELESS_OPERATION_UNSUPPORTED" | "MAX_CONCURRENT_REACHED" | "INVALID_CONFIG";
@@ -32,7 +32,7 @@ declare class CredentialStoreMemory<TPayload extends object = object> implements
   consume(token: string): Promise<(CredentialState & TPayload) | null>;
   update(token: string, state: CredentialState & TPayload): Promise<string>;
   revoke(token: string): Promise<void>;
-  touch(token: string, at: number): Promise<void>;
+  touch(token: string, at: number, _state?: CredentialState & TPayload): Promise<void>;
   revokeAllForUser(userId: string): Promise<number>;
   listForUser(userId: string): Promise<Array<CredentialState & TPayload & {
     token: string;
@@ -46,19 +46,23 @@ declare class CredentialStoreMemory<TPayload extends object = object> implements
  * In-memory denylist for stateless revocation.
  *
  * Stores a map from JTI (or any opaque identifier) to absolute expiry timestamp.
- * `has` returns false for entries whose TTL has elapsed and lazily removes them.
- * `cleanup` performs a sweep across the map and returns the number of entries
- * removed, useful for periodic compaction in long-lived processes.
+ * `has` returns false for entries whose TTL has elapsed and lazily removes them;
+ * `add` sweeps expired entries as the map grows (amortized, each time it
+ * doubles). `cleanup` performs a sweep on demand and returns the number of
+ * entries removed.
  */
 declare class DenylistStoreMemory implements DenylistStore {
   private readonly entries;
   private readonly clock;
+  /** Map size at which `add` next sweeps expired entries (amortized; doubles). */
+  private sweepAt;
   constructor(opts?: {
     clock?: Clock;
   });
   add(jti: string, expiresAt: number): Promise<void>;
   has(jti: string): Promise<boolean>;
   cleanup(): Promise<number>;
+  private sweep;
 }
 //#endregion
 //#region src/stores/jwt.d.ts
@@ -98,6 +102,12 @@ declare class CredentialStoreJwt<TPayload extends object = object> implements Cr
   private readonly algorithm;
   private readonly signingKey;
   private readonly verifyingKey;
+  /**
+   * HS* with raw secret bytes: the HMAC `CryptoKey` imported once (lazily) and
+   * reused for every sign / verify — jose would otherwise re-import the raw
+   * bytes per call. `signingKey` keeps the bytes for `deriveSubkey`.
+   */
+  private hmacKey?;
   private readonly issuer?;
   private readonly audience?;
   private readonly denylist?;
@@ -131,6 +141,12 @@ declare class CredentialStoreJwt<TPayload extends object = object> implements Cr
    */
   private passesEpoch;
   private verify;
+  /**
+   * The key jose gets: raw HS* secret bytes as their HMAC `CryptoKey`
+   * (imported once — usable for both sign and verify, its hash pinned to the
+   * configured algorithm), anything else as given.
+   */
+  private keyFor;
   private payloadToState;
 }
 //#endregion

package/dist/index.mjs

@@ -80,7 +80,7 @@ var CredentialStoreMemory = class {
 		this.states.delete(token);
 		this.indexRemove(state.userId, token);
 	}
-	async touch(token, at) {
+	async touch(token, at, _state) {
 		const state = this.states.get(token);
 		if (!state) return;
 		state.lastSeenAt = at;
@@ -142,17 +142,24 @@ var CredentialStoreMemory = class {
 * In-memory denylist for stateless revocation.
 *
 * Stores a map from JTI (or any opaque identifier) to absolute expiry timestamp.
-* `has` returns false for entries whose TTL has elapsed and lazily removes them.
-* `cleanup` performs a sweep across the map and returns the number of entries
-* removed, useful for periodic compaction in long-lived processes.
+* `has` returns false for entries whose TTL has elapsed and lazily removes them;
+* `add` sweeps expired entries as the map grows (amortized, each time it
+* doubles). `cleanup` performs a sweep on demand and returns the number of
+* entries removed.
 */
 var DenylistStoreMemory = class {
 	entries = /* @__PURE__ */ new Map();
 	clock;
+	/** Map size at which `add` next sweeps expired entries (amortized; doubles). */
+	sweepAt = MIN_SWEEP_SIZE$2;
 	constructor(opts) {
 		this.clock = opts?.clock ?? defaultClock;
 	}
 	async add(jti, expiresAt) {
+		if (this.entries.size >= this.sweepAt && !this.entries.has(jti)) {
+			this.sweep(this.clock.now());
+			this.sweepAt = Math.max(MIN_SWEEP_SIZE$2, this.entries.size * 2);
+		}
 		this.entries.set(jti, expiresAt);
 	}
 	async has(jti) {
@@ -165,7 +172,9 @@ var DenylistStoreMemory = class {
 		return true;
 	}
 	async cleanup() {
-		const now = this.clock.now();
+		return this.sweep(this.clock.now());
+	}
+	sweep(now) {
 		let removed = 0;
 		for (const [jti, expiresAt] of this.entries) if (expiresAt <= now) {
 			this.entries.delete(jti);
@@ -174,6 +183,8 @@ var DenylistStoreMemory = class {
 		return removed;
 	}
 };
+/** Smallest map size an amortized expiry sweep runs at. */
+const MIN_SWEEP_SIZE$2 = 1024;
 //#endregion
 //#region src/stores/derive-subkey.ts
 const SUBKEY_SALT = Buffer.from("aooth/credential-store/subkey-v1");
@@ -200,6 +211,12 @@ var CredentialStoreJwt = class {
 	algorithm;
 	signingKey;
 	verifyingKey;
+	/**
+	* HS* with raw secret bytes: the HMAC `CryptoKey` imported once (lazily) and
+	* reused for every sign / verify — jose would otherwise re-import the raw
+	* bytes per call. `signingKey` keeps the bytes for `deriveSubkey`.
+	*/
+	hmacKey;
 	issuer;
 	audience;
 	denylist;
@@ -248,7 +265,7 @@ var CredentialStoreJwt = class {
 		const builder = new SignJWT({ state: stateClaim }).setProtectedHeader({ alg: this.algorithm }).setSubject(state.userId).setIssuedAt(Math.floor(state.issuedAt / 1e3)).setExpirationTime(Math.floor(expiresAtMs / 1e3)).setJti(jti);
 		if (this.issuer) builder.setIssuer(this.issuer);
 		if (this.audience) builder.setAudience(this.audience);
-		return builder.sign(this.signingKey);
+		return builder.sign(await this.keyFor(this.signingKey));
 	}
 	async retrieve(token) {
 		const verified = await this.verify(token);
@@ -314,7 +331,7 @@ var CredentialStoreJwt = class {
 	}
 	async verify(token) {
 		try {
-			return { payload: (await jwtVerify(token, this.verifyingKey, {
+			return { payload: (await jwtVerify(token, await this.keyFor(this.verifyingKey), {
 				algorithms: [this.algorithm],
 				issuer: this.issuer,
 				audience: this.audience,
@@ -324,6 +341,19 @@ var CredentialStoreJwt = class {
 			return null;
 		}
 	}
+	/**
+	* The key jose gets: raw HS* secret bytes as their HMAC `CryptoKey`
+	* (imported once — usable for both sign and verify, its hash pinned to the
+	* configured algorithm), anything else as given.
+	*/
+	keyFor(key) {
+		if (!(key instanceof Uint8Array) || !HS_ALGS.has(this.algorithm)) return key;
+		this.hmacKey ??= crypto.subtle.importKey("raw", key, {
+			name: "HMAC",
+			hash: `SHA-${this.algorithm.slice(2)}`
+		}, false, ["sign", "verify"]);
+		return this.hmacKey;
+	}
 	payloadToState(payload) {
 		if (typeof payload.sub !== "string") return null;
 		if (typeof payload.iat !== "number" || typeof payload.exp !== "number") return null;
@@ -510,6 +540,63 @@ function fingerprint(token) {
 	return createHash("sha256").update(token).digest("hex");
 }
 /**
+* Turn `ctx.credentialId` (already in place, so key order is kept) into a
+* lazily computed, memoized, still writable property.
+*/
+function lazyCredentialId(ctx, token) {
+	let value;
+	Object.defineProperty(ctx, "credentialId", {
+		enumerable: true,
+		configurable: true,
+		get: () => value ??= fingerprint(token),
+		set: (next) => {
+			value = next;
+		}
+	});
+}
+/** Smallest map size an amortized expiry sweep runs at. */
+const MIN_SWEEP_SIZE$1 = 1024;
+/**
+* The opt-in `validateCache`: token → validated state for `ttlMs`, bounded
+* (oldest dropped first). `epoch` moves on every eviction so a validation
+* racing a revocation never re-caches the revoked token.
+*/
+var ValidateCache = class {
+	ttlMs;
+	max;
+	entries = /* @__PURE__ */ new Map();
+	epoch = 0;
+	constructor(ttlMs, max) {
+		this.ttlMs = ttlMs;
+		this.max = max;
+	}
+	get(token, now) {
+		const entry = this.entries.get(token);
+		if (!entry) return void 0;
+		if (entry.until > now) return entry.state;
+		this.entries.delete(token);
+	}
+	set(token, state, now) {
+		this.entries.delete(token);
+		if (this.entries.size >= this.max) {
+			const oldest = this.entries.keys().next();
+			if (!oldest.done) this.entries.delete(oldest.value);
+		}
+		this.entries.set(token, {
+			state,
+			until: now + this.ttlMs
+		});
+	}
+	delete(token) {
+		this.epoch++;
+		this.entries.delete(token);
+	}
+	deleteUser(userId) {
+		this.epoch++;
+		for (const [token, entry] of this.entries) if (entry.state.userId === userId) this.entries.delete(token);
+	}
+};
+/**
 * Merge a credential's typed payload under the fixed {@link CredentialState}
 * envelope, asserting the `CredentialState & TPayload` shape in ONE place. The
 * payload is spread first so an envelope field always wins a name clash. Every
@@ -570,6 +657,10 @@ var AuthCredential = class {
 	* access; bounded by refresh TTL.
 	*/
 	consumedRefreshes = /* @__PURE__ */ new Map();
+	/** Map size at which `consumedRefreshes` next sweeps its expired entries. */
+	consumedSweepAt = MIN_SWEEP_SIZE$1;
+	/** Opt-in validated-state cache (`validateCache`). */
+	validated;
 	constructor(opts) {
 		this.store = opts.store;
 		this.method = opts.method ?? "token";
@@ -580,6 +671,10 @@ var AuthCredential = class {
 		this.onLimit = opts.onLimit ?? "reject";
 		this.trackLastSeen = opts.trackLastSeen ?? false;
 		this.clock = opts.clock ?? defaultClock;
+		if (opts.validateCache) {
+			if (!(opts.validateCache.ttlMs > 0)) throw new AuthError("INVALID_CONFIG", `validateCache.ttlMs must be > 0 (got ${opts.validateCache.ttlMs})`);
+			this.validated = new ValidateCache(opts.validateCache.ttlMs, opts.validateCache.max ?? 1e4);
+		}
 		if (this.accessTtl <= 0) throw new AuthError("INVALID_CONFIG", `accessTtl must be > 0 (got ${this.accessTtl})`);
 		if (this.refreshConfig && this.refreshConfig.ttl <= 0) throw new AuthError("INVALID_CONFIG", `refresh.ttl must be > 0 (got ${this.refreshConfig.ttl})`);
 		const graceMs = this.refreshConfig?.rotationGraceMs;
@@ -642,20 +737,42 @@ var AuthCredential = class {
 		};
 	}
 	async validate(accessToken) {
-		if (this.denylist && await this.denylist.has(accessToken)) return null;
-		const state = await this.store.retrieve(accessToken);
-		if (!state) return null;
-		if (state.expiresAt <= this.clock.now()) return null;
-		if (state.kind === "refresh") return null;
-		if (this.trackLastSeen === "validate" && this.store.touch) await this.store.touch(accessToken, this.clock.now());
-		return {
+		let state = this.validated?.get(accessToken, this.clock.now());
+		let fresh = false;
+		if (!state) {
+			fresh = true;
+			const epoch = this.validated?.epoch;
+			state = await this.retrieveUnlessDenied(accessToken);
+			if (!state) return null;
+			if (state.expiresAt <= this.clock.now()) return null;
+			if (state.kind === "refresh") return null;
+			if (this.validated && this.validated.epoch === epoch) this.validated.set(accessToken, state, this.clock.now());
+		} else if (state.expiresAt <= this.clock.now()) {
+			this.validated.delete(accessToken);
+			return null;
+		}
+		if (this.trackLastSeen === "validate" && this.store.touch) await this.store.touch(accessToken, this.clock.now(), fresh ? state : void 0);
+		const ctx = {
 			...credentialPayloadOf(state),
 			userId: state.userId,
 			method: this.method,
-			credentialId: fingerprint(accessToken),
+			credentialId: "",
 			sessionId: this.sessionIdOf(state.sessionId, accessToken),
 			expiresAt: state.expiresAt
 		};
+		lazyCredentialId(ctx, accessToken);
+		return ctx;
+	}
+	/**
+	* The stored state of `accessToken` unless the orchestrator's denylist has
+	* it — both looked up concurrently (one round trip on remote stores).
+	*/
+	async retrieveUnlessDenied(accessToken) {
+		const retrieving = this.store.retrieve(accessToken);
+		if (!this.denylist) return await retrieving;
+		retrieving.catch(() => {});
+		if (await this.denylist.has(accessToken)) return null;
+		return await retrieving;
 	}
 	async refresh(refreshToken, opts) {
 		const now = this.clock.now();
@@ -706,6 +823,7 @@ var AuthCredential = class {
 	async refreshAlways(oldState, refreshToken, now) {
 		if (!this.store.listForUser) {
 			await this.store.consume(refreshToken);
+			this.sweepConsumedRefreshes();
 			this.consumedRefreshes.set(refreshToken, {
 				userId: oldState.userId,
 				iat: oldState.issuedAt,
@@ -762,10 +880,20 @@ var AuthCredential = class {
 		};
 	}
 	async revoke(token) {
-		await this.store.revoke(token);
+		this.validated?.delete(token);
+		try {
+			await this.store.revoke(token);
+		} finally {
+			this.validated?.delete(token);
+		}
 	}
 	async revokeAllForUser(userId) {
-		return await this.store.revokeAllForUser(userId);
+		this.validated?.deleteUser(userId);
+		try {
+			return await this.store.revokeAllForUser(userId);
+		} finally {
+			this.validated?.deleteUser(userId);
+		}
 	}
 	async listForUser(userId) {
 		if (!this.store.listForUser) return [];
@@ -849,7 +977,7 @@ var AuthCredential = class {
 	async revokeSession(userId, sessionId) {
 		if (!this.store.listForUser) return;
 		const all = await this.store.listForUser(userId);
-		await Promise.all(all.filter((entry) => this.sessionKeyOf(entry) === sessionId).map((entry) => this.store.revoke(entry.token)));
+		await Promise.all(all.filter((entry) => this.sessionKeyOf(entry) === sessionId).map((entry) => this.revoke(entry.token)));
 	}
 	/**
 	* Revoke every session for the user EXCEPT `keepSessionId` ("log out
@@ -865,7 +993,7 @@ var AuthCredential = class {
 			const key = this.sessionKeyOf(entry);
 			if (key === keepSessionId) continue;
 			revokedSessions.add(key);
-			revokes.push(this.store.revoke(entry.token));
+			revokes.push(this.revoke(entry.token));
 		}
 		await Promise.all(revokes);
 		return revokedSessions.size;
@@ -892,7 +1020,7 @@ var AuthCredential = class {
 		});
 		const sorted = accessOnly.toSorted((a, b) => a.issuedAt - b.issuedAt);
 		const toEvict = accessOnly.length - this.maxConcurrent + 1;
-		for (let i = 0; i < toEvict && i < sorted.length; i++) await this.store.revoke(sorted[i].token);
+		for (let i = 0; i < toEvict && i < sorted.length; i++) await this.revoke(sorted[i].token);
 	}
 	async issueAccessFromRefresh(refreshState, now) {
 		const accessTtl = refreshState.metadata?.accessTtl ?? this.accessTtl;
@@ -955,6 +1083,13 @@ var AuthCredential = class {
 			userId: oldRefreshState.userId
 		};
 	}
+	/** Amortized sweep of expired `consumedRefreshes` entries (each size doubling). */
+	sweepConsumedRefreshes() {
+		if (this.consumedRefreshes.size < this.consumedSweepAt) return;
+		const now = this.clock.now();
+		for (const [token, entry] of this.consumedRefreshes) if (entry.exp <= now) this.consumedRefreshes.delete(token);
+		this.consumedSweepAt = Math.max(MIN_SWEEP_SIZE$1, this.consumedRefreshes.size * 2);
+	}
 	lookupConsumedRefresh(token) {
 		const entry = this.consumedRefreshes.get(token);
 		if (!entry) return null;
@@ -991,7 +1126,7 @@ var AuthCredential = class {
 			...reuse.rotatedAt !== void 0 && { rotatedAt: reuse.rotatedAt }
 		});
 		if ((this.refreshConfig?.reuseResponse ?? "session") === "session" && reuse.sessionId !== void 0 && this.store.listForUser) await this.revokeSession(reuse.userId, reuse.sessionId);
-		else await this.store.revokeAllForUser(reuse.userId);
+		else await this.revokeAllForUser(reuse.userId);
 		throw new AuthError("REFRESH_REUSE_DETECTED", void 0, {
 			userId: reuse.userId,
 			...reuse.sessionId !== void 0 && { sessionId: reuse.sessionId },
@@ -1081,13 +1216,15 @@ function renderRateLimitMessage(template, rule, retryAfterMs) {
 //#region src/rate-limit/store.ts
 /**
 * In-memory `RateLimitStore` — the zero-config default (single process only).
-* Lazy-evicts expired counters on access; `cleanup()` sweeps the whole map for
-* periodic compaction in long-lived processes (same pattern as
-* `DenylistStoreMemory`).
+* Lazy-evicts expired counters on access, and sweeps expired counters itself
+* as the map grows (amortized, each time it doubles); `cleanup()` sweeps the
+* whole map on demand (same pattern as `DenylistStoreMemory`).
 */
 var RateLimitStoreMemory = class {
 	entries = /* @__PURE__ */ new Map();
 	clock;
+	/** Map size at which `hit` next sweeps expired counters (amortized; doubles). */
+	sweepAt = MIN_SWEEP_SIZE;
 	constructor(opts) {
 		this.clock = opts?.clock ?? defaultClock;
 	}
@@ -1095,6 +1232,10 @@ var RateLimitStoreMemory = class {
 		const now = this.clock.now();
 		const entry = this.entries.get(key);
 		if (!entry || entry.expiresAt <= now) {
+			if (!entry && this.entries.size >= this.sweepAt) {
+				this.sweep(now);
+				this.sweepAt = Math.max(MIN_SWEEP_SIZE, this.entries.size * 2);
+			}
 			this.entries.set(key, {
 				count: 1,
 				expiresAt: now + ttlMs
@@ -1112,7 +1253,9 @@ var RateLimitStoreMemory = class {
 		this.entries.clear();
 	}
 	async cleanup() {
-		const now = this.clock.now();
+		return this.sweep(this.clock.now());
+	}
+	sweep(now) {
 		let removed = 0;
 		for (const [key, entry] of this.entries) if (entry.expiresAt <= now) {
 			this.entries.delete(key);
@@ -1121,6 +1264,8 @@ var RateLimitStoreMemory = class {
 		return removed;
 	}
 };
+/** Smallest map size an amortized expiry sweep runs at. */
+const MIN_SWEEP_SIZE = 1024;
 //#endregion
 //#region src/rate-limit/rate-limiter.ts
 /**

package/dist/redis.cjs

@@ -74,10 +74,14 @@ var CredentialStoreRedis = class {
 		await this.redis.del(this.tokenKey(token));
 		await this.redis.srem(this.userKey(state.userId), token);
 	}
-	async touch(token, at) {
-		const raw = await this.redis.get(this.tokenKey(token));
-		if (raw === null) return;
-		const state = JSON.parse(raw);
+	async touch(token, at, current) {
+		let state;
+		if (current) state = { ...current };
+		else {
+			const raw = await this.redis.get(this.tokenKey(token));
+			if (raw === null) return;
+			state = JSON.parse(raw);
+		}
 		state.lastSeenAt = at;
 		const ttlMs = Math.max(0, state.expiresAt - Date.now());
 		if (ttlMs <= 0) return;

package/dist/redis.d.cts

@@ -1,5 +1,5 @@
-import { i as DenylistStore, r as CredentialStore, s as CredentialState } from "./clock-C0O0FCCN.cjs";
-import { t as RateLimitStore } from "./store-3YN2hfss.cjs";
+import { i as DenylistStore, r as CredentialStore, s as CredentialState } from "./clock-CyjqzLxc.cjs";
+import { t as RateLimitStore } from "./store-ClQnA8yh.cjs";
 //#region src/redis/index.d.ts
 /**
  * Structural Redis client. Covers the exact set of commands used by
@@ -101,7 +101,7 @@ declare class CredentialStoreRedis<TPayload extends object = object> implements
   consume(token: string): Promise<(CredentialState & TPayload) | null>;
   update(token: string, state: CredentialState & TPayload): Promise<string>;
   revoke(token: string): Promise<void>;
-  touch(token: string, at: number): Promise<void>;
+  touch(token: string, at: number, current?: CredentialState & TPayload): Promise<void>;
   revokeAllForUser(userId: string): Promise<number>;
   listForUser(userId: string): Promise<Array<CredentialState & TPayload & {
     token: string;

package/dist/redis.d.mts

@@ -1,5 +1,5 @@
-import { i as DenylistStore, r as CredentialStore, s as CredentialState } from "./clock-C0O0FCCN.mjs";
-import { t as RateLimitStore } from "./store-BUIC0iCK.mjs";
+import { i as DenylistStore, r as CredentialStore, s as CredentialState } from "./clock-CyjqzLxc.mjs";
+import { t as RateLimitStore } from "./store-CVD1nd2j.mjs";
 //#region src/redis/index.d.ts
 /**
  * Structural Redis client. Covers the exact set of commands used by
@@ -101,7 +101,7 @@ declare class CredentialStoreRedis<TPayload extends object = object> implements
   consume(token: string): Promise<(CredentialState & TPayload) | null>;
   update(token: string, state: CredentialState & TPayload): Promise<string>;
   revoke(token: string): Promise<void>;
-  touch(token: string, at: number): Promise<void>;
+  touch(token: string, at: number, current?: CredentialState & TPayload): Promise<void>;
   revokeAllForUser(userId: string): Promise<number>;
   listForUser(userId: string): Promise<Array<CredentialState & TPayload & {
     token: string;

package/dist/redis.mjs

@@ -73,10 +73,14 @@ var CredentialStoreRedis = class {
 		await this.redis.del(this.tokenKey(token));
 		await this.redis.srem(this.userKey(state.userId), token);
 	}
-	async touch(token, at) {
-		const raw = await this.redis.get(this.tokenKey(token));
-		if (raw === null) return;
-		const state = JSON.parse(raw);
+	async touch(token, at, current) {
+		let state;
+		if (current) state = { ...current };
+		else {
+			const raw = await this.redis.get(this.tokenKey(token));
+			if (raw === null) return;
+			state = JSON.parse(raw);
+		}
 		state.lastSeenAt = at;
 		const ttlMs = Math.max(0, state.expiresAt - Date.now());
 		if (ttlMs <= 0) return;

package/dist/{store-3YN2hfss.d.cts → store-CVD1nd2j.d.mts}

@@ -1,4 +1,4 @@
-import { t as Clock } from "./clock-C0O0FCCN.cjs";
+import { t as Clock } from "./clock-CyjqzLxc.mjs";
 //#region src/rate-limit/store.d.ts
 /**
  * Storage contract for the fixed-window limiter (RL.spec.md §4.3).
@@ -18,13 +18,15 @@ interface RateLimitStore {
 }
 /**
  * In-memory `RateLimitStore` — the zero-config default (single process only).
- * Lazy-evicts expired counters on access; `cleanup()` sweeps the whole map for
- * periodic compaction in long-lived processes (same pattern as
- * `DenylistStoreMemory`).
+ * Lazy-evicts expired counters on access, and sweeps expired counters itself
+ * as the map grows (amortized, each time it doubles); `cleanup()` sweeps the
+ * whole map on demand (same pattern as `DenylistStoreMemory`).
  */
 declare class RateLimitStoreMemory implements RateLimitStore {
   private readonly entries;
   private readonly clock;
+  /** Map size at which `hit` next sweeps expired counters (amortized; doubles). */
+  private sweepAt;
   constructor(opts?: {
     clock?: Clock;
   });
@@ -33,6 +35,7 @@ declare class RateLimitStoreMemory implements RateLimitStore {
   /** Drop every counter — test-harness reset between cases. */
   clear(): void;
   cleanup(): Promise<number>;
+  private sweep;
 }
 //#endregion
 export { RateLimitStoreMemory as n, RateLimitStore as t };

package/dist/{store-BUIC0iCK.d.mts → store-ClQnA8yh.d.cts}

@@ -1,4 +1,4 @@
-import { t as Clock } from "./clock-C0O0FCCN.mjs";
+import { t as Clock } from "./clock-CyjqzLxc.cjs";
 //#region src/rate-limit/store.d.ts
 /**
  * Storage contract for the fixed-window limiter (RL.spec.md §4.3).
@@ -18,13 +18,15 @@ interface RateLimitStore {
 }
 /**
  * In-memory `RateLimitStore` — the zero-config default (single process only).
- * Lazy-evicts expired counters on access; `cleanup()` sweeps the whole map for
- * periodic compaction in long-lived processes (same pattern as
- * `DenylistStoreMemory`).
+ * Lazy-evicts expired counters on access, and sweeps expired counters itself
+ * as the map grows (amortized, each time it doubles); `cleanup()` sweeps the
+ * whole map on demand (same pattern as `DenylistStoreMemory`).
  */
 declare class RateLimitStoreMemory implements RateLimitStore {
   private readonly entries;
   private readonly clock;
+  /** Map size at which `hit` next sweeps expired counters (amortized; doubles). */
+  private sweepAt;
   constructor(opts?: {
     clock?: Clock;
   });
@@ -33,6 +35,7 @@ declare class RateLimitStoreMemory implements RateLimitStore {
   /** Drop every counter — test-harness reset between cases. */
   clear(): void;
   cleanup(): Promise<number>;
+  private sweep;
 }
 //#endregion
 export { RateLimitStoreMemory as n, RateLimitStore as t };