@c9up/ream 0.2.26 → 0.2.28

package/src/profiler/render.ts

@@ -0,0 +1,173 @@
+/**
+ * The profiler's own pages, and the bar injected into yours.
+ *
+ * Plain HTML and one inline stylesheet. A dev tool that needed a build step,
+ * or pulled a framework into the page it is inspecting, would be a worse
+ * neighbour than the problem it reports — and the bar lives in a shadow root
+ * for the same reason: your stylesheet must not reach it, and it must not
+ * reach yours.
+ *
+ * EVERY value that came from a request is escaped. A profiler renders the
+ * URL someone asked for, the SQL a query ran and the message an error carried
+ * — all attacker-reachable in exactly the case you most want to look at, and a
+ * tool that turned a crafted URL into script in your own browser would be a
+ * hole with a friendly face.
+ */
+
+import type { Profile, ProfileSummary } from './types.js'
+
+/** `<`, `&` and the quotes. Everything below goes through it. */
+export function escapeHtml(value: unknown): string {
+  return String(value)
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;')
+}
+
+const STYLE = `
+  :root { color-scheme: dark }
+  body { margin: 0; background: #14161a; color: #e6e6e6;
+         font: 13px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace }
+  a { color: #6cb6ff; text-decoration: none }
+  a:hover { text-decoration: underline }
+  header { padding: 16px 20px; border-bottom: 1px solid #262a31 }
+  h1 { margin: 0; font-size: 15px; font-weight: 600 }
+  .meta { color: #8b949e; margin-top: 4px }
+  main { padding: 20px }
+  section { margin-bottom: 28px }
+  h2 { font-size: 13px; text-transform: uppercase; letter-spacing: .08em;
+       color: #8b949e; margin: 0 0 10px }
+  table { width: 100%; border-collapse: collapse }
+  td, th { text-align: left; padding: 6px 10px; border-bottom: 1px solid #21252c;
+           vertical-align: top }
+  th { color: #8b949e; font-weight: 500 }
+  .num { text-align: right; white-space: nowrap; color: #8b949e }
+  .sql { white-space: pre-wrap; word-break: break-word }
+  .slow { color: #f0883e }
+  .bad { color: #ff7b72 }
+  pre { white-space: pre-wrap; word-break: break-word; margin: 0; color: #c9d1d9 }
+  .pill { display: inline-block; padding: 1px 8px; border-radius: 999px;
+          background: #21262d; color: #8b949e; margin-right: 6px }
+`
+
+/** A whole page, so the profiler needs nothing served alongside it. */
+function page(title: string, body: string): string {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<title>${escapeHtml(title)}</title><style>${STYLE}</style></head><body>${body}</body></html>`
+}
+
+/** The history: what a developer lands on with no token in hand. */
+export function renderProfileList(profiles: readonly ProfileSummary[], missing?: string): string {
+  const warning =
+    missing === undefined
+      ? ''
+      : `<p class="bad">No profile for <code>${escapeHtml(missing)}</code> — it may have aged out.</p>`
+
+  const rows = profiles
+    .map(
+      (profile) => `<tr>
+      <td><a href="/__ream/profiler/${escapeHtml(profile.token)}">${escapeHtml(profile.token)}</a></td>
+      <td>${escapeHtml(profile.method)}</td>
+      <td class="sql">${escapeHtml(profile.url)}</td>
+      <td class="${profile.status >= 500 ? 'bad' : ''}">${escapeHtml(profile.status)}</td>
+      <td class="num">${escapeHtml(profile.duration.toFixed(1))} ms</td>
+      <td>${Object.values(profile.badges)
+        .map((badge) => `<span class="pill">${escapeHtml(badge)}</span>`)
+        .join('')}</td>
+    </tr>`,
+    )
+    .join('')
+
+  return page(
+    'Profiler',
+    `<header><h1>Profiler</h1><div class="meta">${profiles.length} request${
+      profiles.length === 1 ? '' : 's'
+    } kept</div></header><main>${warning}
+     <table><tr><th>Token</th><th>Method</th><th>URL</th><th>Status</th>
+     <th class="num">Time</th><th>Collected</th></tr>${rows}</table></main>`,
+  )
+}
+
+/** One request, every panel. */
+export function renderProfilePage(profile: Profile, badges: Record<string, string>): string {
+  const sections: string[] = []
+
+  const exception = profile.data.exception
+  if (exception !== undefined && typeof exception.message === 'string') {
+    sections.push(`<section><h2 class="bad">Exception</h2>
+      <p class="bad">${escapeHtml(exception.name ?? 'Error')}: ${escapeHtml(exception.message)}</p>
+      ${typeof exception.stack === 'string' ? `<pre>${escapeHtml(exception.stack)}</pre>` : ''}
+    </section>`)
+  }
+
+  sections.push(renderQueries(profile))
+
+  for (const [name, data] of Object.entries(profile.data)) {
+    if (name === 'database' || name === 'exception') continue
+    if (Object.keys(data).length === 0) continue
+    sections.push(`<section><h2>${escapeHtml(name)}</h2>
+      <pre>${escapeHtml(JSON.stringify(data, null, 2))}</pre></section>`)
+  }
+
+  return page(
+    `${profile.method} ${profile.url}`,
+    `<header>
+       <h1>${escapeHtml(profile.method)} ${escapeHtml(profile.url)}</h1>
+       <div class="meta">
+         ${escapeHtml(profile.status)} · ${escapeHtml(profile.duration.toFixed(1))} ms ·
+         ${escapeHtml(new Date(profile.time).toISOString())} ·
+         <a href="/__ream/profiler">all requests</a>
+       </div>
+       <div class="meta">${Object.values(badges)
+         .map((badge) => `<span class="pill">${escapeHtml(badge)}</span>`)
+         .join('')}</div>
+     </header><main>${sections.join('')}</main>`,
+  )
+}
+
+/** The panel the whole thing exists for. */
+function renderQueries(profile: Profile): string {
+  const database = profile.data.database
+  if (database === undefined) return ''
+  const queries = Array.isArray(database.queries) ? database.queries : []
+  const total = typeof database.total === 'number' ? database.total : 0
+
+  if (total === 0) return '<section><h2>Database</h2><p class="meta">No query.</p></section>'
+
+  const rows = queries
+    .map((entry) => {
+      const query = asRecord(entry)
+      const duration = typeof query.duration === 'number' ? query.duration : 0
+      const bindings = Array.isArray(query.bindings) ? query.bindings : []
+      return `<tr>
+        <td class="num ${duration >= 50 ? 'slow' : ''}">${escapeHtml(duration.toFixed(2))} ms</td>
+        <td class="sql">${escapeHtml(query.sql)}${
+          bindings.length === 0
+            ? ''
+            : `<div class="meta">${escapeHtml(JSON.stringify(bindings))}</div>`
+        }${
+          typeof query.error === 'string' ? `<div class="bad">${escapeHtml(query.error)}</div>` : ''
+        }</td>
+        <td class="meta">${escapeHtml(query.model ?? '')}${
+          query.inTransaction === true ? ' <span class="pill">tx</span>' : ''
+        }</td>
+      </tr>`
+    })
+    .join('')
+
+  const capped =
+    database.capped === true
+      ? `<p class="meta">Listing stopped at ${queries.length}; ${escapeHtml(total)} ran.</p>`
+      : ''
+
+  return `<section><h2>Database</h2>${capped}
+    <table><tr><th class="num">Time</th><th>Query</th><th>Model</th></tr>${rows}</table></section>`
+}
+
+function asRecord(value: unknown): Record<string, unknown> {
+  return typeof value === 'object' && value !== null
+    ? Object.fromEntries(Object.entries(value))
+    : {}
+}

package/src/profiler/toolbar.ts

@@ -0,0 +1,106 @@
+/**
+ * The bar at the bottom of the page.
+ *
+ * It carries its own token inline rather than reading `X-Debug-Token` off the
+ * response: a script in a page cannot see the headers of the navigation that
+ * delivered it. Symfony injects the token for the same reason.
+ *
+ * Everything lives in a shadow root — your stylesheet must not reach the bar,
+ * and the bar must not reach your page. It fetches its numbers once, on load,
+ * and then does nothing: a dev tool that polls is a dev tool that shows up in
+ * its own history.
+ *
+ * A string rather than a stringified function, as the hot-reload script is:
+ * this package compiles without the DOM library, deliberately — it is a server
+ * — so browser code here is text, and its only inputs are escaped below.
+ *
+ * It styles its nodes through the CSSOM — `node.style.cssText` — rather than
+ * with a `<style>` element. Under a CSP with `style-src 'self'` (or only a
+ * `default-src`, which is the common case) a stylesheet inserted at runtime is
+ * inline style and is dropped, with no error anywhere: the bar renders as a
+ * stack of grey text and nothing says why. Setting properties on an element is
+ * not inline style and is never blocked, which is also how the host below has
+ * always been positioned.
+ */
+
+import { PROFILER_PATH } from './Profiler.js'
+
+/**
+ * The `<script>` to append to an HTML response.
+ *
+ * `token` is generated by the profiler (hex) and `nonce` by the response, so
+ * neither is user input; both are still put through `JSON.stringify` rather
+ * than interpolated raw, because "cannot contain a quote" is an invariant that
+ * holds until someone changes how one of them is made.
+ */
+export function toolbarScript(token: string, nonce?: string): string {
+  const attribute = nonce === undefined ? '' : ` nonce="${nonce.replace(/"/g, '&quot;')}"`
+  const config = JSON.stringify({ token, path: PROFILER_PATH })
+  return `<script${attribute}>(${BAR})(${config})</script>`
+}
+
+/**
+ * The bar, as it runs in the browser.
+ *
+ * Kept on one indented block so what ships is readable in a page's source —
+ * someone will open the inspector and find this, and a minified blob would
+ * tell them nothing about where it came from.
+ */
+const BAR = `function(c){
+  var host=document.createElement('div');
+  host.style.cssText='position:fixed;left:0;right:0;bottom:0;z-index:2147483000';
+  var root=host.attachShadow({mode:'closed'});
+  document.body.appendChild(host);
+  var bar=document.createElement('div');
+  bar.style.cssText='display:flex;align-items:stretch;background:#14161a;color:#e6e6e6;'
+    +'font:12px/1 ui-monospace,Menlo,monospace;border-top:1px solid #262a31;'
+    +'box-shadow:0 -2px 8px rgba(0,0,0,.4)';
+  root.appendChild(bar);
+  var page=c.path+'/'+c.token;
+  var COLOR={bad:'#ff7b72',warn:'#f0883e',ok:'#7ee787'};
+  function cell(label,value,tone,plain){
+    var node=document.createElement('div');
+    node.style.cssText='padding:7px 11px;white-space:nowrap;'
+      +(plain?'flex:1;overflow:hidden;text-overflow:ellipsis;cursor:default'
+             :'border-right:1px solid #21252c;cursor:pointer');
+    if(label){
+      var tag=document.createElement('span');
+      tag.style.cssText='color:#8b949e;margin-right:6px';
+      tag.textContent=label;
+      node.appendChild(tag);
+    }
+    var text=document.createElement('span');
+    if(tone){text.style.color=COLOR[tone];}
+    text.textContent=value;
+    node.appendChild(text);
+    if(!plain){
+      node.addEventListener('mouseenter',function(){node.style.background='#1b1f25'});
+      node.addEventListener('mouseleave',function(){node.style.background=''});
+      node.addEventListener('click',function(){window.open(page,'_blank')});
+    }
+    bar.appendChild(node);
+  }
+  function panel(data,name){
+    var value=data&&data[name];
+    return (value&&typeof value==='object')?value:null;
+  }
+  fetch(page+'.json',{headers:{accept:'application/json'}})
+    .then(function(r){return r.ok?r.json():null})
+    .then(function(p){
+      if(!p){host.remove();return}
+      var status=Number(p.status||0);
+      cell('',String(status),status>=500?'bad':status>=400?'warn':'ok');
+      cell('time',Number(p.duration||0).toFixed(1)+' ms');
+      var db=panel(p.data,'database');
+      if(db){
+        var total=Number(db.total||0);
+        cell('db',total+' \u00b7 '+Number(db.duration||0).toFixed(1)+' ms',total>=50?'warn':'');
+      }
+      var mem=panel(p.data,'memory');
+      if(mem){cell('mem',Number(mem.usedMb||0).toFixed(1)+' MB');}
+      var err=panel(p.data,'exception');
+      if(err&&typeof err.message==='string'){cell('',err.message,'bad');}
+      cell('',String(p.url||''),'',true);
+    })
+    .catch(function(){host.remove()});
+}`

package/src/profiler/types.ts

@@ -0,0 +1,75 @@
+/**
+ * What the profiler keeps about one request.
+ *
+ * Shaped after Symfony's profiler rather than Laravel's debugbar, which is a
+ * decision about where the data lives: a token per request, an endpoint that
+ * serves it, and a history. Inlining it in the page is simpler until the
+ * request you need to look at was a POST that redirected — and then the data
+ * is gone, which is exactly when you wanted it.
+ */
+
+/** One collector's contribution to a profile. Plain data: it crosses a wire. */
+export type CollectedData = Record<string, unknown>
+
+/**
+ * Everything kept about one request.
+ *
+ * `token` identifies it. It travels back on `X-Debug-Token`, so a client — the
+ * toolbar, curl, a test — can ask for the profile of a request it just made.
+ */
+export interface Profile {
+  token: string
+  /** When the request arrived, epoch milliseconds. */
+  time: number
+  method: string
+  url: string
+  status: number
+  /** Wall-clock milliseconds, first middleware to serialised response. */
+  duration: number
+  /** Keyed by collector name. */
+  data: Record<string, CollectedData>
+}
+
+/** A profile without its data — what a listing shows. */
+export type ProfileSummary = Omit<Profile, 'data'> & {
+  /** The headline each collector wants on the bar: `{ database: '12 queries' }`. */
+  badges: Record<string, string>
+}
+
+/**
+ * What a collector is handed while a request runs.
+ *
+ * Deliberately not the HttpContext: a collector observes, and handing it the
+ * context would let it answer the request. What it needs is a place to put
+ * what it saw and the ability to know when the request ends.
+ */
+export interface CollectionScope {
+  token: string
+  /** Called by the framework when the request is done. */
+  readonly startedAt: number
+}
+
+/**
+ * A source of data about a request.
+ *
+ * `start` runs when the request begins and answers a bag the collector will
+ * fill; `finish` turns that bag into what is stored. Two methods rather than
+ * one, because the interesting collectors — queries, logs, events — are fed by
+ * things happening DURING the request, not by looking at it afterwards.
+ */
+export interface ProfilerCollector<Bag = unknown> {
+  /** Unique. It keys the data and names the panel. */
+  readonly name: string
+  /** Shown on the bar, or nothing when there is nothing worth a badge. */
+  badge?: (data: CollectedData) => string | undefined
+  start(scope: CollectionScope): Bag
+  finish(bag: Bag, scope: CollectionScope): CollectedData
+}
+
+/** Where profiles are kept. Bounded: a dev session is not an archive. */
+export interface ProfileStore {
+  save(profile: Profile): void
+  find(token: string): Profile | undefined
+  recent(limit?: number): ProfileSummary[]
+  clear(): void
+}

package/src/router/Router.ts

@@ -1361,6 +1361,22 @@ export class Router extends Macroable {
     return manifest
   }
 
+  /**
+   * Every NAMED route with its path pattern AND the HTTP methods it answers,
+   * e.g. `{ 'users.update': { path: '/users/:id', methods: ['PUT'] } }` — what
+   * a client needs to follow a route by name and pick its verb, the way
+   * AdonisJS's Tuyau registry gives `route` + `methods`. `namedManifest()`
+   * stays the lighter name → path map.
+   */
+  namedRoutes(): Record<string, { path: string; methods: string[] }> {
+    if (this.#indexDirty) this.#buildIndex()
+    const routes: Record<string, { path: string; methods: string[] }> = {}
+    for (const [name, route] of this.#nameIndex) {
+      routes[name] = { path: route.path, methods: [route.method] }
+    }
+    return routes
+  }
+
   /**
    * Generate a TypeScript source string typing every named route and its
    * params (AdonisJS `generateTypes`) — a `RouteName` union plus a

package/src/server/Server.ts

@@ -6,6 +6,7 @@
  * - server.errorHandler(() => import('#exceptions/handler')) — custom exception handler
  */
 
+import { ReamError } from '../errors/ReamError.js'
 import type { ExceptionHandler } from '../http/Exception.js'
 import type { HttpContext } from '../http/HttpContext.js'
 import type { MiddlewareFunction } from '../middleware/Pipeline.js'
@@ -32,12 +33,30 @@ export type MiddlewareClassConstructor = new (...args: never[]) => MiddlewareCla
 /** What server.use() and router.use() accept: lazy imports or direct functions. */
 export type MiddlewareEntry = LazyImport<MiddlewareClassConstructor> | MiddlewareFunction
 
+/** One unary gRPC call, as the native server hands it over. */
+export interface GrpcCall {
+  /** `/package.Service/Method`, as it arrived. */
+  path: string
+  /** Request metadata, header names lowercased. */
+  metadata: Record<string, string>
+  /** The request message, still encoded. */
+  message: Uint8Array
+  /** Resolved client IP, by the same trusted-proxy rules as `request.ip()`. */
+  ip: string
+}
+
+/** A reply message, still encoded — or a gRPC status code instead of one. */
+export type GrpcReply = { message: Uint8Array } | { code: number; details: string }
+
+export type GrpcHandler = (call: GrpcCall) => Promise<GrpcReply>
+
 export class Server {
   #router: Router
   #serverMiddleware: MiddlewareFunction[] = []
   #errorHandlerImporter?: LazyImport<ErrorHandlerClass>
   #resolvedErrorHandler?: ExceptionHandler
   #trustedProxies: string[] = []
+  #grpcHandler?: GrpcHandler
 
   constructor(router: Router) {
     this.#router = router
@@ -65,6 +84,36 @@ export class Server {
     return this.#trustedProxies
   }
 
+  /**
+   * Serve gRPC on the HTTP port. Once a handler is set, a request whose
+   * content-type is `application/grpc*` is a gRPC call handed to it — ahead
+   * of the router and the middleware, which never see it. The native server
+   * still applies its rate limiter and security filter first. Without a
+   * handler such a request stays an ordinary HTTP request.
+   *
+   * No AdonisJS counterpart: it serves on Node's `http.Server`, where gRPC
+   * would attach a library of its own. Here the native server owns the
+   * socket, so the gRPC branch is part of it, and this is how a package
+   * reaches it — `@c9up/neutrino` registers its dispatcher here.
+   *
+   * One handler per server: a second one throws. Two packages both serving
+   * gRPC is a conflict to resolve, not to settle by load order.
+   */
+  grpc(handler: GrpcHandler): this {
+    if (this.#grpcHandler) {
+      throw new ReamError('E_SERVER_GRPC_ALREADY_SET', 'A gRPC handler is already registered.', {
+        hint: 'Only one package can serve gRPC on the HTTP port.',
+      })
+    }
+    this.#grpcHandler = handler
+    return this
+  }
+
+  /** The gRPC handler, if one is set (consumed by Ignitor at boot). */
+  getGrpcHandler(): GrpcHandler | undefined {
+    return this.#grpcHandler
+  }
+
   /**
    * Register global server middleware.
    * Accepts lazy imports of middleware classes (AdonisJS pattern):

package/src/session/Session.ts

@@ -11,7 +11,11 @@
  */
 
 import type { SessionRedisClientSource } from './drivers/RedisDriver.js'
-import { E_SESSION_NOT_READY, E_SESSION_TAGGING_NOT_SUPPORTED } from './errors.js'
+import {
+  E_SESSION_NOT_READY,
+  E_SESSION_STORE_NOT_CONDITIONAL,
+  E_SESSION_TAGGING_NOT_SUPPORTED,
+} from './errors.js'
 import { ReadOnlyValuesStore } from './ReadOnlyValuesStore.js'
 
 export interface SessionDriver {
@@ -26,8 +30,27 @@ export interface SessionDriver {
    */
   read(sessionId: string): Promise<Record<string, unknown> | null>
   write(sessionId: string, data: Record<string, unknown>, ttl: number): Promise<void>
+  /**
+   * Write only over an entry that is still there, in one step; `false` when it
+   * is gone, and nothing written.
+   *
+   * What `commit()` uses for a session that existed when the request came in.
+   * A request still running when the same session was logged out, rotated or
+   * destroyed everywhere would otherwise write its stale copy back — the user
+   * id included — and undo the logout. Upstream writes unconditionally and has
+   * that race; this is the named deviation that closes it.
+   *
+   * Required, and checked when the store is attached: a read followed by a
+   * write leaves the race open between the two calls.
+   */
+  update(sessionId: string, data: Record<string, unknown>, ttl: number): Promise<boolean>
   destroy(sessionId: string): Promise<void>
   touch(sessionId: string, ttl: number): Promise<void>
+  /**
+   * The session lives with the client, not here: nothing on the server can
+   * delete a copy of it. Only the cookie store sets it.
+   */
+  readonly stateless?: boolean
 }
 
 /** One session belonging to a tagged user (AdonisJS `TaggedSession`). */
@@ -179,6 +202,8 @@ export class Session {
   #ttl = 0
   /** Whether {@link initiate} already ran, so a second call is a no-op. */
   #initiated = false
+  /** The entry vanished while this request ran — see {@link wasLost}. */
+  #lost = false
 
   constructor(sessionId: string, data: Record<string, unknown> = {}) {
     this.#sessionId = sessionId
@@ -228,6 +253,15 @@ export class Session {
     return this.#regenerated
   }
 
+  /**
+   * @internal — the stored entry was gone by the time {@link commit} ran: it
+   * was logged out, rotated or destroyed by another request meanwhile. Nothing
+   * was written, and the middleware must not hand the browser this id again.
+   */
+  wasLost(): boolean {
+    return this.#lost
+  }
+
   /** @internal — the id captured at request arrival; used to destroy the old driver entry post-regenerate. */
   originalSessionId(): string {
     return this.#originalSessionId
@@ -554,6 +588,11 @@ export class Session {
    * {@link initiate} / {@link commit} then have nothing to do.
    */
   setStore(driver: SessionDriver, options: { fresh: boolean; ttl: number }): void {
+    // A store written in JavaScript, or against the older contract, reaches
+    // here without the method the type requires.
+    if (typeof Reflect.get(driver, 'update') !== 'function') {
+      throw new E_SESSION_STORE_NOT_CONDITIONAL()
+    }
     this.#driver = driver
     this.#fresh = options.fresh
     this.#ttl = options.ttl
@@ -600,12 +639,27 @@ export class Session {
       return
     }
     if (this.#dirty) {
-      await driver.write(this.#sessionId, this.toJSON(), this.#ttl)
+      if (this.#fresh) {
+        await driver.write(this.#sessionId, this.toJSON(), this.#ttl)
+        return
+      }
+      this.#lost = !(await driver.update(this.#sessionId, this.toJSON(), this.#ttl))
       return
     }
     if (!this.#fresh) await driver.touch(this.#sessionId, this.#ttl)
   }
 
+  /**
+   * Whether ending this session on the server ends every copy of it.
+   *
+   * False under the cookie store, where the session travels with the client:
+   * a logout replaces the cookie in one browser and cannot reach a copy. What
+   * an auth guard reads to refuse signing in on a store it cannot revoke.
+   */
+  get revocable(): boolean {
+    return this.#driver !== undefined && this.#driver.stateless !== true
+  }
+
   /**
    * Whether the store behind this session can tag sessions with a user
    * (AdonisJS `supportsTagging`). False under the cookie and file drivers.

package/src/session/SessionMiddleware.ts

@@ -79,7 +79,7 @@ export default class SessionMiddleware {
           'Cookie session driver requires a secret. Set session.secret in your config.',
         )
       }
-      this.#cookieDriver = new CookieDriver(config.secret)
+      this.#cookieDriver = new CookieDriver(config.secret, this.#config.cookieName)
       this.#driver = this.#cookieDriver
     } else if (this.#config.driver === 'memory') {
       this.#driver = new MemoryDriver()
@@ -136,6 +136,9 @@ export default class SessionMiddleware {
 
     // Cookie driver: the cookie value IS the session data (encrypted)
     if (this.#cookieDriver) {
+      // When the data this request carries was last vouched for. See the
+      // re-emission below.
+      const readAt = Date.now()
       const data = await this.#driver.read(sessionId ?? '')
       sessionId = sessionId ?? generateSessionId()
       // `null` means the cookie carried nothing readable — an empty session,
@@ -162,8 +165,20 @@ export default class SessionMiddleware {
       // the cookie maxAge window slides forward (active users don't time out
       // mid-session). Caller opts in via SessionConfig.rolling.
       const shouldEmit = session.isDirty() || (rolling && hadIncomingCookie)
-      if (shouldEmit) {
-        const encoded = this.#cookieDriver.encode(session.toJSON())
+      // The re-emitted cookie lives `maxAge` from when this request READ the
+      // session, not from its response. Counted from the response, a request
+      // that outlasted a logout re-issued the signed-in data with a full new
+      // lifetime — past the window a revocation is kept for, after which the
+      // sign-in it carried was accepted again. Counted from the read, no cookie
+      // carrying a sign-in outlives the logout by more than `maxAge`. A session
+      // regenerated during the request (a login) is new data, so it counts from
+      // now; so does a session that came in with no cookie.
+      const issuedAt = hadIncomingCookie && !session.wasRegenerated() ? readAt : Date.now()
+      const remaining = issuedAt + maxAge * 1000 - Date.now()
+      // Expired while the request ran: nothing to hand back, and the browser
+      // keeps whatever cookie it was given since.
+      if (shouldEmit && remaining > 0) {
+        const encoded = this.#cookieDriver.encode(session.toJSON(), remaining / 1000)
         if (encoded.length > 4096) {
           process.stderr.write(
             `[session] Cookie session exceeds 4096 bytes (${encoded.length}). ` +
@@ -174,7 +189,7 @@ export default class SessionMiddleware {
           // Already encrypted by the cookie driver; packing it again would
           // only make the cookie bigger and change nothing.
           encode: false,
-          maxAge: this.#config.clearWithBrowser ? undefined : maxAge,
+          maxAge: this.#config.clearWithBrowser ? undefined : Math.ceil(remaining / 1000),
           path: '/',
           httpOnly: true,
           sameSite: 'lax',
@@ -216,6 +231,10 @@ export default class SessionMiddleware {
     // no server-side row (touch() is a no-op without a backing entry),
     // defeats HTTP caching, and leaks a Set-Cookie to CDNs. This mirrors
     // the cookie-driver path above (which already omits `isNew`).
+    // A session logged out or rotated by another request while this one ran
+    // was not written back (see `Session.wasLost`); handing the browser its id
+    // again would only point it at nothing, over the cookie it got since.
+    if (session.wasLost()) return
     if (session.isDirty() || regenerated || (rolling && hadIncomingCookie)) {
       // SIGNED, as AdonisJS signs it (`response.cookie(cookieName, id, …)`).
       // The id is 192 bits of entropy, so it was never guessable — what the