@c9up/ream 0.2.27 → 0.2.29

package/dist/session/SessionMiddleware.js

@@ -13,6 +13,7 @@ import { DatabaseDriver } from './drivers/DatabaseDriver.js';
 import { FileDriver } from './drivers/FileDriver.js';
 import { MemoryDriver } from './drivers/MemoryDriver.js';
 import { RedisDriver } from './drivers/RedisDriver.js';
+import { E_SESSION_COOKIE_NOT_HTTP_ONLY, E_SESSION_STORE_NOT_CONFIGURED } from './errors.js';
 import { quasarConnection } from './quasar.js';
 import { ReadOnlyValuesStore } from './ReadOnlyValuesStore.js';
 import { Session } from './Session.js';
@@ -44,8 +45,17 @@ export default class SessionMiddleware {
         // `{ store: 'redis', stores: { redis: { driver: 'redis' } } }` works.
         const selected = config?.store ?? config?.driver;
         const named = selected ? config?.stores?.[selected] : undefined;
+        // No implicit store, in any environment — AdonisJS' session config
+        // refuses one without `store` too. The memory store lives in one process
+        // and is bounded: a restart, a second replica, or enough anonymous
+        // requests signs every user out, so it is used only when it is chosen
+        // (`store: 'memory'`).
+        if (!selected)
+            throw new E_SESSION_STORE_NOT_CONFIGURED();
+        if (config?.cookie?.httpOnly === false)
+            throw new E_SESSION_COOKIE_NOT_HTTP_ONLY();
         this.#config = {
-            driver: named?.driver ?? selected ?? 'memory',
+            driver: named?.driver ?? selected,
             cookieName: config?.cookieName ?? 'ream_session',
             // `age` is the AdonisJS key and accepts a duration string.
             maxAge: config?.age !== undefined
@@ -53,12 +63,13 @@ export default class SessionMiddleware {
                 : (config?.maxAge ?? 7200),
             clearWithBrowser: config?.clearWithBrowser ?? false,
             rolling: config?.rolling ?? false,
+            cookie: { ...config?.cookie },
         };
         if (this.#config.driver === 'cookie') {
             if (!config?.secret) {
                 throw new Error('Cookie session driver requires a secret. Set session.secret in your config.');
             }
-            this.#cookieDriver = new CookieDriver(config.secret);
+            this.#cookieDriver = new CookieDriver(config.secret, this.#config.cookieName);
             this.#driver = this.#cookieDriver;
         }
         else if (this.#config.driver === 'memory') {
@@ -113,6 +124,9 @@ export default class SessionMiddleware {
         const hadIncomingCookie = sessionId !== null;
         // Cookie driver: the cookie value IS the session data (encrypted)
         if (this.#cookieDriver) {
+            // When the data this request carries was last vouched for. See the
+            // re-emission below.
+            const readAt = Date.now();
             const data = await this.#driver.read(sessionId ?? '');
             sessionId = sessionId ?? generateSessionId();
             // `null` means the cookie carried nothing readable — an empty session,
@@ -137,8 +151,20 @@ export default class SessionMiddleware {
             // the cookie maxAge window slides forward (active users don't time out
             // mid-session). Caller opts in via SessionConfig.rolling.
             const shouldEmit = session.isDirty() || (rolling && hadIncomingCookie);
-            if (shouldEmit) {
-                const encoded = this.#cookieDriver.encode(session.toJSON());
+            // The re-emitted cookie lives `maxAge` from when this request READ the
+            // session, not from its response. Counted from the response, a request
+            // that outlasted a logout re-issued the signed-in data with a full new
+            // lifetime — past the window a revocation is kept for, after which the
+            // sign-in it carried was accepted again. Counted from the read, no cookie
+            // carrying a sign-in outlives the logout by more than `maxAge`. A session
+            // regenerated during the request (a login) is new data, so it counts from
+            // now; so does a session that came in with no cookie.
+            const issuedAt = hadIncomingCookie && !session.wasRegenerated() ? readAt : Date.now();
+            const remaining = issuedAt + maxAge * 1000 - Date.now();
+            // Expired while the request ran: nothing to hand back, and the browser
+            // keeps whatever cookie it was given since.
+            if (shouldEmit && remaining > 0) {
+                const encoded = this.#cookieDriver.encode(session.toJSON(), remaining / 1000);
                 if (encoded.length > 4096) {
                     process.stderr.write(`[session] Cookie session exceeds 4096 bytes (${encoded.length}). ` +
                         'Switch to a server-side driver (memory/redis) or reduce session data.\n');
@@ -147,11 +173,8 @@ export default class SessionMiddleware {
                     // Already encrypted by the cookie driver; packing it again would
                     // only make the cookie bigger and change nothing.
                     encode: false,
-                    maxAge: this.#config.clearWithBrowser ? undefined : maxAge,
-                    path: '/',
-                    httpOnly: true,
-                    sameSite: 'lax',
-                    secure: isProduction,
+                    ...this.#cookieAttributes(isProduction),
+                    maxAge: this.#config.clearWithBrowser ? undefined : Math.ceil(remaining / 1000),
                 });
             }
             return;
@@ -184,6 +207,11 @@ export default class SessionMiddleware {
         // no server-side row (touch() is a no-op without a backing entry),
         // defeats HTTP caching, and leaks a Set-Cookie to CDNs. This mirrors
         // the cookie-driver path above (which already omits `isNew`).
+        // A session logged out or rotated by another request while this one ran
+        // was not written back (see `Session.wasLost`); handing the browser its id
+        // again would only point it at nothing, over the cookie it got since.
+        if (session.wasLost())
+            return;
         if (session.isDirty() || regenerated || (rolling && hadIncomingCookie)) {
             // SIGNED, as AdonisJS signs it (`response.cookie(cookieName, id, …)`).
             // The id is 192 bits of entropy, so it was never guessable — what the
@@ -191,14 +219,25 @@ export default class SessionMiddleware {
             // read, before any store lookup, and that an id from another deployment
             // (a different APP_KEY) cannot be presented here.
             ctx.response.cookie(cookieName, session.sessionId, {
+                ...this.#cookieAttributes(isProduction),
                 maxAge: this.#config.clearWithBrowser ? undefined : maxAge,
-                path: '/',
-                httpOnly: true,
-                sameSite: 'lax',
-                secure: isProduction,
             });
         }
     }
+    /**
+     * The session cookie's attributes: the configured `cookie` over the
+     * defaults. `secure` follows the environment unless the config sets it.
+     */
+    #cookieAttributes(isProduction) {
+        const configured = this.#config.cookie;
+        return {
+            path: '/',
+            sameSite: 'lax',
+            ...configured,
+            httpOnly: true,
+            secure: configured.secure ?? isProduction,
+        };
+    }
 }
 function generateSessionId() {
     return randomBytes(24).toString('base64url');

package/dist/session/SessionMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionMiddleware.js","sourceRoot":"","sources":["../../src/session/SessionMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,cAAc,EAA4B,MAAM,6BAA6B,CAAA;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAkB,MAAM,0BAA0B,CAAA;AAE9E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAUtC,sEAAsE;AACtE,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,UAAU;QACjD,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,UAAU,CACpD,CAAA;AACH,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACpC,OAAO,CAAe;IACtB,aAAa,GAAwB,IAAI,CAAA;IACzC,OAAO,CAAuB;IAE9B,YAAY,iBAAiD,SAAS;QACpE,wEAAwE;QACxE,0EAA0E;QAC1E,4EAA4E;QAC5E,iDAAiD;QACjD,2DAA2D;QAC3D,mEAAmE;QACnE,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,MAAM,GAAG,cAAc,IAAI,gBAAgB,CAAqB,SAAS,CAAC,CAAA;QAChF,yEAAyE;QACzE,4DAA4D;QAC5D,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,CAAA;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,IAAI,CAAC,OAAO,GAAG;YACb,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,QAAQ,IAAI,QAAQ;YAC7C,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,cAAc;YAChD,2DAA2D;YAC3D,MAAM,EACJ,MAAM,EAAE,GAAG,KAAK,SAAS;gBACvB,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC;gBAChD,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;YAC9B,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,IAAI,KAAK;YACnD,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,KAAK;SAClC,CAAA;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAA;YACH,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACpD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,CAAA;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,EAAE,CAAA;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,KAAK,EAAE,QAAQ,CAAA;YACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAA;YACH,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7C,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,EAAE,YAAY,IAAI,KAAK,EAAE,UAAU,CAAA;YAC5D,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAA;YACH,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,CAAC;gBAChC,UAAU;gBACV,SAAS,EAAE,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBAC/E,aAAa,EAAE,OAAO,MAAM,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;aAC5F,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC3C,sEAAsE;YACtE,uEAAuE;YACvE,iEAAiE;YACjE,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YACrE,IAAI,CAAC,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QACnE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,IAAyB;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAA;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAA;QACpC,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,YAAY,GAAG,cAAc,EAAE,KAAK,YAAY,CAAA;QAEtD,gEAAgE;QAChE,EAAE;QACF,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,4DAA4D;QAC5D,IAAI,SAAS,GAAG,IAAI,CAAC,aAAa;YAChC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAS,UAAU,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5E,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAClC,MAAM,iBAAiB,GAAG,SAAS,KAAK,IAAI,CAAA;QAE5C,kEAAkE;QAClE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;YACrD,SAAS,GAAG,SAAS,IAAI,iBAAiB,EAAE,CAAA;YAC5C,uEAAuE;YACvE,oEAAoE;YACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;YAClD,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;YAC1E,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;YACjC,GAAG,CAAC,OAAO,GAAG,OAAO,CAAA;YACrB,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;YACpD,yEAAyE;YACzE,uEAAuE;YACvE,iEAAiE;YACjE,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAElC,MAAM,IAAI,EAAE,CAAA;YAEZ,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,mBAAmB;YACnB,sEAAsE;YACtE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,CAAA;YACtE,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;gBAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;oBAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gDAAgD,OAAO,CAAC,MAAM,KAAK;wBACjE,yEAAyE,CAC5E,CAAA;gBACH,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE;oBAC5C,iEAAiE;oBACjE,kDAAkD;oBAClD,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;oBAC1D,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY;iBACrB,CAAC,CAAA;YACJ,CAAC;YACD,OAAM;QACR,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,iBAAiB,EAAE,CAAA;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,CAAA;QACtC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;QAC1E,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAA;QACxB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACjC,GAAG,CAAC,OAAO,GAAG,OAAO,CAAA;QACrB,wEAAwE;QACxE,iEAAiE;QACjE,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;QACpD,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAElC,MAAM,IAAI,EAAE,CAAA;QAEZ,mEAAmE;QACnE,oEAAoE;QACpE,gCAAgC;QAChC,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAA;QAC5C,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;QAEtB,6DAA6D;QAC7D,iEAAiE;QACjE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,WAAW,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,EAAE,CAAC;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,kDAAkD;YAClD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE;gBACjD,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;gBAC1D,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,YAAY;aACrB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;CACF;AAED,SAAS,iBAAiB;IACxB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,GAAgB,EAAE,OAAgB;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;IAChD,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAM;IACvC,wEAAwE;IACxE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC3C,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;QACf,OAAO,EAAE,IAAI,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/C,aAAa;QACb,2DAA2D;QAC3D,GAAG,EAAE,CAAC,GAAc,EAAE,YAAsB,EAAW,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC;KAC/F,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"SessionMiddleware.js","sourceRoot":"","sources":["../../src/session/SessionMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAI1D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,cAAc,EAA4B,MAAM,6BAA6B,CAAA;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAA;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAkB,MAAM,0BAA0B,CAAA;AAE9E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAWtC,sEAAsE;AACtE,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,UAAU;QACjD,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,UAAU,CACpD,CAAA;AACH,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACpC,OAAO,CAAe;IACtB,aAAa,GAAwB,IAAI,CAAA;IACzC,OAAO,CAAuB;IAE9B,YAAY,iBAAiD,SAAS;QACpE,wEAAwE;QACxE,0EAA0E;QAC1E,4EAA4E;QAC5E,iDAAiD;QACjD,2DAA2D;QAC3D,mEAAmE;QACnE,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,MAAM,GAAG,cAAc,IAAI,gBAAgB,CAAqB,SAAS,CAAC,CAAA;QAChF,yEAAyE;QACzE,4DAA4D;QAC5D,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,CAAA;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,mEAAmE;QACnE,yEAAyE;QACzE,mEAAmE;QACnE,sEAAsE;QACtE,uBAAuB;QACvB,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,8BAA8B,EAAE,CAAA;QACzD,IAAI,MAAM,EAAE,MAAM,EAAE,QAAQ,KAAK,KAAK;YAAE,MAAM,IAAI,8BAA8B,EAAE,CAAA;QAClF,IAAI,CAAC,OAAO,GAAG;YACb,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,QAAQ;YACjC,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,cAAc;YAChD,2DAA2D;YAC3D,MAAM,EACJ,MAAM,EAAE,GAAG,KAAK,SAAS;gBACvB,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC;gBAChD,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;YAC9B,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,IAAI,KAAK;YACnD,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,KAAK;YACjC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE;SAC9B,CAAA;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAA;YACH,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YAC7E,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,CAAA;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,EAAE,CAAA;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,KAAK,EAAE,QAAQ,CAAA;YACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAA;YACH,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7C,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,EAAE,YAAY,IAAI,KAAK,EAAE,UAAU,CAAA;YAC5D,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAA;YACH,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,CAAC;gBAChC,UAAU;gBACV,SAAS,EAAE,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBAC/E,aAAa,EAAE,OAAO,MAAM,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;aAC5F,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC3C,sEAAsE;YACtE,uEAAuE;YACvE,iEAAiE;YACjE,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YACrE,IAAI,CAAC,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QACnE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,IAAyB;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAA;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAA;QACpC,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,YAAY,GAAG,cAAc,EAAE,KAAK,YAAY,CAAA;QAEtD,gEAAgE;QAChE,EAAE;QACF,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,4DAA4D;QAC5D,IAAI,SAAS,GAAG,IAAI,CAAC,aAAa;YAChC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAS,UAAU,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5E,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAClC,MAAM,iBAAiB,GAAG,SAAS,KAAK,IAAI,CAAA;QAE5C,kEAAkE;QAClE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,mEAAmE;YACnE,qBAAqB;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;YACrD,SAAS,GAAG,SAAS,IAAI,iBAAiB,EAAE,CAAA;YAC5C,uEAAuE;YACvE,oEAAoE;YACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;YAClD,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;YAC1E,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;YACjC,GAAG,CAAC,OAAO,GAAG,OAAO,CAAA;YACrB,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;YACpD,yEAAyE;YACzE,uEAAuE;YACvE,iEAAiE;YACjE,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAElC,MAAM,IAAI,EAAE,CAAA;YAEZ,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,mBAAmB;YACnB,sEAAsE;YACtE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,CAAA;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,sDAAsD;YACtD,MAAM,QAAQ,GAAG,iBAAiB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;YACrF,MAAM,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACvD,uEAAuE;YACvE,4CAA4C;YAC5C,IAAI,UAAU,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,GAAG,IAAI,CAAC,CAAA;gBAC7E,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;oBAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gDAAgD,OAAO,CAAC,MAAM,KAAK;wBACjE,yEAAyE,CAC5E,CAAA;gBACH,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE;oBAC5C,iEAAiE;oBACjE,kDAAkD;oBAClD,MAAM,EAAE,KAAK;oBACb,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;oBACvC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;iBAChF,CAAC,CAAA;YACJ,CAAC;YACD,OAAM;QACR,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,iBAAiB,EAAE,CAAA;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,CAAA;QACtC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;QAC1E,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAA;QACxB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACjC,GAAG,CAAC,OAAO,GAAG,OAAO,CAAA;QACrB,wEAAwE;QACxE,iEAAiE;QACjE,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;QACpD,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAElC,MAAM,IAAI,EAAE,CAAA;QAEZ,mEAAmE;QACnE,oEAAoE;QACpE,gCAAgC;QAChC,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAA;QAC5C,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;QAEtB,6DAA6D;QAC7D,iEAAiE;QACjE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,8DAA8D;QAC9D,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,IAAI,OAAO,CAAC,OAAO,EAAE;YAAE,OAAM;QAC7B,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,WAAW,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,EAAE,CAAC;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,kDAAkD;YAClD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE;gBACjD,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBACvC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;aAC3D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,YAAqB;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;QACtC,OAAO;YACL,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,KAAK;YACf,GAAG,UAAU;YACb,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,YAAY;SAC1C,CAAA;IACH,CAAC;CACF;AAED,SAAS,iBAAiB;IACxB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,GAAgB,EAAE,OAAgB;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;IAChD,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAM;IACvC,wEAAwE;IACxE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC3C,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;QACf,OAAO,EAAE,IAAI,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/C,aAAa;QACb,2DAA2D;QAC3D,GAAG,EAAE,CAAC,GAAc,EAAE,YAAsB,EAAW,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC;KAC/F,CAAC,CAAA;AACJ,CAAC"}

package/dist/session/config.d.ts

@@ -21,5 +21,10 @@ export type SessionConfigInput = SessionConfig & {
      */
     secret?: string;
 };
+/**
+ * Validate and return a session config. A config without `store` (or its
+ * older spelling `driver`) is refused here, at load time, as AdonisJS'
+ * `defineConfig` refuses it: there is no implicit store.
+ */
 export declare function defineConfig(config: SessionConfigInput): SessionConfigInput;
 //# sourceMappingURL=config.d.ts.map

package/dist/session/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/session/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEjD,8CAA8C;AAC9C,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG;IAC/C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,kBAAkB,CAE3E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/session/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEjD,8CAA8C;AAC9C,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG;IAC/C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,kBAAkB,CAG3E"}

package/dist/session/config.js

@@ -12,7 +12,15 @@
  *     secret: env.get('APP_KEY'),
  *   })
  */
+import { E_SESSION_STORE_NOT_CONFIGURED } from './errors.js';
+/**
+ * Validate and return a session config. A config without `store` (or its
+ * older spelling `driver`) is refused here, at load time, as AdonisJS'
+ * `defineConfig` refuses it: there is no implicit store.
+ */
 export function defineConfig(config) {
+    if (!config.store && !config.driver)
+        throw new E_SESSION_STORE_NOT_CONFIGURED();
     return config;
 }
 //# sourceMappingURL=config.js.map

package/dist/session/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/session/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAaH,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/session/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAA;AAY5D;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,8BAA8B,EAAE,CAAA;IAC/E,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/session/drivers/CookieDriver.d.ts

@@ -3,15 +3,24 @@ import type { SessionDriver } from '../Session.js';
  * Cookie session driver — stores session data in an encrypted cookie (AES-256-GCM).
  * Stateless on the server. Limited by cookie size (~4KB).
  * Requires a secret for encryption.
+ *
+ * Sealed for the cookie's name, as upstream seals every encrypted cookie, so a
+ * value encrypted for another cookie under the same key cannot be presented as
+ * the session. And sealed with its expiry — the named deviation: upstream
+ * leaves expiry to the browser's `maxAge`, which a copied cookie does not
+ * obey, so a session lifted from a browser stayed valid for as long as the key
+ * did. Here a value older than the session's lifetime opens as nothing.
  */
 export declare class CookieDriver implements SessionDriver {
     #private;
-    constructor(secret: string);
+    readonly stateless = true;
+    constructor(secret: string, cookieName?: string);
     read(sessionId: string): Promise<Record<string, unknown> | null>;
     write(_sessionId: string, _data: Record<string, unknown>, _ttl: number): Promise<void>;
+    update(_sessionId: string, _data: Record<string, unknown>, _ttl: number): Promise<boolean>;
     destroy(_sessionId: string): Promise<void>;
     touch(_sessionId: string, _ttl: number): Promise<void>;
-    /** Encode session data for cookie storage (encrypted). */
-    encode(data: Record<string, unknown>): string;
+    /** Encode session data for cookie storage (encrypted), valid for `ttl` seconds. */
+    encode(data: Record<string, unknown>, ttl: number): string;
 }
 //# sourceMappingURL=CookieDriver.d.ts.map

package/dist/session/drivers/CookieDriver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CookieDriver.d.ts","sourceRoot":"","sources":["../../../src/session/drivers/CookieDriver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD;;;;GAIG;AACH,qBAAa,YAAa,YAAW,aAAa;;gBAGpC,MAAM,EAAE,MAAM;IASpB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAWhE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1C,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,0DAA0D;IAC1D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;CAG9C"}
+{"version":3,"file":"CookieDriver.d.ts","sourceRoot":"","sources":["../../../src/session/drivers/CookieDriver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,YAAW,aAAa;;IAGhD,QAAQ,CAAC,SAAS,QAAO;gBAEb,MAAM,EAAE,MAAM,EAAE,UAAU,SAAiB;IAUjD,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAWhE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1F,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1C,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,mFAAmF;IACnF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM;CAG3D"}

package/dist/session/drivers/CookieDriver.js

@@ -3,20 +3,30 @@ import { CookieSigner } from '../../security/CookieSigner.js';
  * Cookie session driver — stores session data in an encrypted cookie (AES-256-GCM).
  * Stateless on the server. Limited by cookie size (~4KB).
  * Requires a secret for encryption.
+ *
+ * Sealed for the cookie's name, as upstream seals every encrypted cookie, so a
+ * value encrypted for another cookie under the same key cannot be presented as
+ * the session. And sealed with its expiry — the named deviation: upstream
+ * leaves expiry to the browser's `maxAge`, which a copied cookie does not
+ * obey, so a session lifted from a browser stayed valid for as long as the key
+ * did. Here a value older than the session's lifetime opens as nothing.
  */
 export class CookieDriver {
     #signer;
-    constructor(secret) {
+    #purpose;
+    stateless = true;
+    constructor(secret, cookieName = 'ream_session') {
         if (!secret) {
             throw new Error('CookieDriver requires a secret for session encryption. Set session.secret in your config.');
         }
         this.#signer = new CookieSigner(secret);
+        this.#purpose = cookieName;
     }
     async read(sessionId) {
         if (!sessionId)
             return null;
-        const decrypted = this.#signer.decrypt(sessionId);
-        if (!decrypted)
+        const decrypted = this.#signer.decrypt(sessionId, this.#purpose);
+        if (typeof decrypted !== 'string')
             return null;
         try {
             return JSON.parse(decrypted);
@@ -28,15 +38,19 @@ export class CookieDriver {
     async write(_sessionId, _data, _ttl) {
         // Cookie driver writes via the response cookie — handled by middleware
     }
+    async update(_sessionId, _data, _ttl) {
+        // Cookie driver writes via the response cookie — handled by middleware
+        return true;
+    }
     async destroy(_sessionId) {
         // Cookie deletion handled by middleware setting maxAge=0
     }
     async touch(_sessionId, _ttl) {
         // Cookie renewal handled by middleware
     }
-    /** Encode session data for cookie storage (encrypted). */
-    encode(data) {
-        return this.#signer.encrypt(JSON.stringify(data));
+    /** Encode session data for cookie storage (encrypted), valid for `ttl` seconds. */
+    encode(data, ttl) {
+        return this.#signer.encrypt(JSON.stringify(data), ttl * 1000, this.#purpose);
     }
 }
 //# sourceMappingURL=CookieDriver.js.map

package/dist/session/drivers/CookieDriver.js.map

@@ -1 +1 @@
-{"version":3,"file":"CookieDriver.js","sourceRoot":"","sources":["../../../src/session/drivers/CookieDriver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAG7D;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACvB,OAAO,CAAc;IAErB,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAA;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACjD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAC3B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,KAA8B,EAAE,IAAY;QAC1E,uEAAuE;IACzE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,yDAAyD;IAC3D,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,IAAY;QAC1C,uCAAuC;IACzC,CAAC;IAED,0DAA0D;IAC1D,MAAM,CAAC,IAA6B;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;IACnD,CAAC;CACF"}
+{"version":3,"file":"CookieDriver.js","sourceRoot":"","sources":["../../../src/session/drivers/CookieDriver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAG7D;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,YAAY;IACvB,OAAO,CAAc;IACZ,QAAQ,CAAQ;IAChB,SAAS,GAAG,IAAI,CAAA;IAEzB,YAAY,MAAc,EAAE,UAAU,GAAG,cAAc;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAA;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChE,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC9C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,KAA8B,EAAE,IAAY;QAC1E,uEAAuE;IACzE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,KAA8B,EAAE,IAAY;QAC3E,uEAAuE;QACvE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,yDAAyD;IAC3D,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,IAAY;QAC1C,uCAAuC;IACzC,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,IAA6B,EAAE,GAAW;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC9E,CAAC;CACF"}

package/dist/session/drivers/DatabaseDriver.d.ts

@@ -58,6 +58,8 @@ export declare class DatabaseDriver implements SessionDriverWithTagging {
     constructor(options: DatabaseDriverOptions);
     read(sessionId: string): Promise<Record<string, unknown> | null>;
     write(sessionId: string, data: Record<string, unknown>, ttl: number): Promise<void>;
+    /** One UPDATE: a row deleted or expired meanwhile matches nothing. */
+    update(sessionId: string, data: Record<string, unknown>, ttl: number): Promise<boolean>;
     destroy(sessionId: string): Promise<void>;
     touch(sessionId: string, ttl: number): Promise<void>;
     /**

package/dist/session/drivers/DatabaseDriver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DatabaseDriver.d.ts","sourceRoot":"","sources":["../../../src/session/drivers/DatabaseDriver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE5E;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IAC/E,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC5E;AAQD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,mBAAmB,CAAA;IAC/B,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAKD;;;;;;;;;;;;;GAaG;AACH,qBAAa,cAAe,YAAW,wBAAwB;;gBAKjD,OAAO,EAAE,qBAAqB;IAoBpC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAiBhE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCnF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1D;;;OAGG;IACG,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpE;;;OAGG;IACG,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtE,wEAAwE;IAClE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAe/D,+EAA+E;IACzE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}
+{"version":3,"file":"DatabaseDriver.d.ts","sourceRoot":"","sources":["../../../src/session/drivers/DatabaseDriver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE5E;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IAC/E,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC5E;AAQD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,mBAAmB,CAAA;IAC/B,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAKD;;;;;;;;;;;;;GAaG;AACH,qBAAa,cAAe,YAAW,wBAAwB;;gBAKjD,OAAO,EAAE,qBAAqB;IAoBpC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAiBhE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCzF,sEAAsE;IAChE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASvF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1D;;;OAGG;IACG,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpE;;;OAGG;IACG,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtE,wEAAwE;IAClE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAe/D,+EAA+E;IACzE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/session/drivers/DatabaseDriver.js

@@ -92,6 +92,12 @@ export class DatabaseDriver {
             // See above — the session was written, which is what the request needed.
         }
     }
+    /** One UPDATE: a row deleted or expired meanwhile matches nothing. */
+    async update(sessionId, data, ttl) {
+        const now = Date.now();
+        const updated = await this.#db.execute(`UPDATE ${this.#table} SET data = ?, expires_at = ? WHERE id = ? AND expires_at >= ?`, [JSON.stringify(data), now + ttl * 1000, sessionId, now]);
+        return updated.rowsAffected > 0;
+    }
     async destroy(sessionId) {
         await this.#db.execute(`DELETE FROM ${this.#table} WHERE id = ?`, [sessionId]);
     }

package/dist/session/drivers/DatabaseDriver.js.map

@@ -1 +1 @@
-{"version":3,"file":"DatabaseDriver.js","sourceRoot":"","sources":["../../../src/session/drivers/DatabaseDriver.ts"],"names":[],"mappings":"AA0BA,0DAA0D;AAC1D,SAAS,UAAU,CAAC,GAA4B,EAAE,IAAY;IAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC;AAkBD,uEAAuE;AACvE,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEhC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,cAAc;IAChB,GAAG,CAAqB;IACxB,MAAM,CAAQ;IACd,cAAc,CAAQ;IAE/B,YAAY,OAA8B;QACxC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,CAAA;QAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAA;QAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,qEAAqE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CACtG,CAAA;QACH,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,EAAE,CAAA;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAA;QAC7C,mEAAmE;QACnE,wEAAwE;QACxE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,qEAAqE,CAClG,CAAA;QACH,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gCAAgC,IAAI,CAAC,MAAM,eAAe,EAAE;YAC5F,SAAS;SACV,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YAC7B,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACpC,2EAA2E;QAC3E,2BAA2B;QAC3B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC9B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,IAA6B,EAAE,GAAW;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAA;QACzC,0EAA0E;QAC1E,0EAA0E;QAC1E,oCAAoC;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACpC,UAAU,IAAI,CAAC,MAAM,4CAA4C,EACjE,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAChC,CAAA;QACD,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,eAAe,EAAE,CAAA;YAC5B,OAAM;QACR,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,MAAM,0CAA0C,EAAE;YAC3F,SAAS;YACT,OAAO;YACP,SAAS;SACV,CAAC,CAAA;QACF,MAAM,IAAI,CAAC,eAAe,EAAE,CAAA;IAC9B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC;YAAE,OAAM;QACpC,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,cAAc;YAAE,OAAM;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,MAAM,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IAChF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,GAAW;QACxC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,MAAM,kCAAkC,EAAE;YAC9E,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI;YACvB,SAAS;SACV,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,MAAuB;QAClD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,MAAM,+BAA+B,EAAE;YAC3E,MAAM,CAAC,MAAM,CAAC;YACd,SAAS;SACV,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,MAAuB;QACpD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACpB,UAAU,IAAI,CAAC,MAAM,kDAAkD,EACvE,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAC5B,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,MAAM,CAAC,MAAuB;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAC/B,wBAAwB,IAAI,CAAC,MAAM,wCAAwC,EAC3E,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAC7B,CAAA;QACD,MAAM,QAAQ,GAAoB,EAAE,CAAA;QACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAChC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACpC,IAAI,EAAE,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAQ;YAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACzF,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAA;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"DatabaseDriver.js","sourceRoot":"","sources":["../../../src/session/drivers/DatabaseDriver.ts"],"names":[],"mappings":"AA0BA,0DAA0D;AAC1D,SAAS,UAAU,CAAC,GAA4B,EAAE,IAAY;IAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC;AAkBD,uEAAuE;AACvE,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEhC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,cAAc;IAChB,GAAG,CAAqB;IACxB,MAAM,CAAQ;IACd,cAAc,CAAQ;IAE/B,YAAY,OAA8B;QACxC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,CAAA;QAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAA;QAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,qEAAqE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CACtG,CAAA;QACH,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,EAAE,CAAA;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAA;QAC7C,mEAAmE;QACnE,wEAAwE;QACxE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,qEAAqE,CAClG,CAAA;QACH,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gCAAgC,IAAI,CAAC,MAAM,eAAe,EAAE;YAC5F,SAAS;SACV,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YAC7B,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACpC,2EAA2E;QAC3E,2BAA2B;QAC3B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC9B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,IAA6B,EAAE,GAAW;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAA;QACzC,0EAA0E;QAC1E,0EAA0E;QAC1E,oCAAoC;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACpC,UAAU,IAAI,CAAC,MAAM,4CAA4C,EACjE,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAChC,CAAA;QACD,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,eAAe,EAAE,CAAA;YAC5B,OAAM;QACR,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,MAAM,0CAA0C,EAAE;YAC3F,SAAS;YACT,OAAO;YACP,SAAS;SACV,CAAC,CAAA;QACF,MAAM,IAAI,CAAC,eAAe,EAAE,CAAA;IAC9B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC;YAAE,OAAM;QACpC,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,cAAc;YAAE,OAAM;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,IAA6B,EAAE,GAAW;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACpC,UAAU,IAAI,CAAC,MAAM,gEAAgE,EACrF,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CACzD,CAAA;QACD,OAAO,OAAO,CAAC,YAAY,GAAG,CAAC,CAAA;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,MAAM,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IAChF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,GAAW;QACxC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,MAAM,kCAAkC,EAAE;YAC9E,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI;YACvB,SAAS;SACV,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,MAAuB;QAClD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,MAAM,+BAA+B,EAAE;YAC3E,MAAM,CAAC,MAAM,CAAC;YACd,SAAS;SACV,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,MAAuB;QACpD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACpB,UAAU,IAAI,CAAC,MAAM,kDAAkD,EACvE,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAC5B,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,MAAM,CAAC,MAAuB;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAC/B,wBAAwB,IAAI,CAAC,MAAM,wCAAwC,EAC3E,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAC7B,CAAA;QACD,MAAM,QAAQ,GAAoB,EAAE,CAAA;QACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAChC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACpC,IAAI,EAAE,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAQ;YAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACzF,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAA;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/session/drivers/FileDriver.d.ts

@@ -16,6 +16,14 @@ export declare class FileDriver implements SessionDriver {
     constructor(options: FileDriverOptions);
     read(sessionId: string): Promise<Record<string, unknown> | null>;
     write(sessionId: string, data: Record<string, unknown>, ttl: number): Promise<void>;
+    /**
+     * Written only while the file is still there. A filesystem has no
+     * conditional write, so every change to a session's file — this, `write`,
+     * `destroy` and `touch` — runs under that session's lock: a `destroy` from a
+     * logout cannot land between the check and the write, in this process or in
+     * another one sharing the directory.
+     */
+    update(sessionId: string, data: Record<string, unknown>, ttl: number): Promise<boolean>;
     destroy(sessionId: string): Promise<void>;
     touch(sessionId: string, ttl: number): Promise<void>;
 }

package/dist/session/drivers/FileDriver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FileDriver.d.ts","sourceRoot":"","sources":["../../../src/session/drivers/FileDriver.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,qBAAa,UAAW,YAAW,aAAa;;gBAGlC,OAAO,EAAE,iBAAiB;IAiBhC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAuBhE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWnF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAO3D"}
+{"version":3,"file":"FileDriver.d.ts","sourceRoot":"","sources":["../../../src/session/drivers/FileDriver.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAA;CACjB;AAcD,qBAAa,UAAW,YAAW,aAAa;;gBAGlC,OAAO,EAAE,iBAAiB;IAiBhC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAkChE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzF;;;;;;OAMG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQvF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoD3D"}

package/dist/session/drivers/FileDriver.js

@@ -1,6 +1,16 @@
 import { createHash } from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+/** How long a writer waits for a session's lock before giving up. */
+const LOCK_WAIT_MS = 2000;
+/**
+ * A lock older than this was left by a process that died holding it. Every
+ * operation under the lock is one small file read or write, far below it.
+ */
+const LOCK_STALE_MS = 10_000;
+function hasCode(error, code) {
+    return error instanceof Error && Reflect.get(error, 'code') === code;
+}
 export class FileDriver {
     #location;
     constructor(options) {
@@ -19,6 +29,13 @@ export class FileDriver {
         return path.join(this.#location, `${name}.json`);
     }
     async read(sessionId) {
+        return this.#read(sessionId, () => this.destroy(sessionId));
+    }
+    /**
+     * Read, dropping an expired file through `drop`: `destroy()` from outside,
+     * a bare removal from inside the lock, which is already held there.
+     */
+    async #read(sessionId, drop) {
         let raw;
         try {
             raw = await fs.promises.readFile(this.#pathFor(sessionId), 'utf8');
@@ -32,7 +49,7 @@ export class FileDriver {
                 return null;
             const entry = parsed;
             if (typeof entry.expiresAt === 'number' && entry.expiresAt < Date.now()) {
-                await this.destroy(sessionId);
+                await drop();
                 return null;
             }
             return entry.data ?? {};
@@ -44,6 +61,40 @@ export class FileDriver {
         }
     }
     async write(sessionId, data, ttl) {
+        await this.#locked(sessionId, () => this.#replace(sessionId, data, ttl));
+    }
+    /**
+     * Written only while the file is still there. A filesystem has no
+     * conditional write, so every change to a session's file — this, `write`,
+     * `destroy` and `touch` — runs under that session's lock: a `destroy` from a
+     * logout cannot land between the check and the write, in this process or in
+     * another one sharing the directory.
+     */
+    async update(sessionId, data, ttl) {
+        return this.#locked(sessionId, async () => {
+            if ((await this.#read(sessionId, () => this.#remove(sessionId))) === null)
+                return false;
+            await this.#replace(sessionId, data, ttl);
+            return true;
+        });
+    }
+    async destroy(sessionId) {
+        await this.#locked(sessionId, () => this.#remove(sessionId));
+    }
+    async #remove(sessionId) {
+        await fs.promises.rm(this.#pathFor(sessionId), { force: true });
+    }
+    async touch(sessionId, ttl) {
+        await this.#locked(sessionId, async () => {
+            const data = await this.#read(sessionId, () => this.#remove(sessionId));
+            // Nothing stored: there is no expiry to slide, and writing here would
+            // create the very session that was not there.
+            if (data === null || Object.keys(data).length === 0)
+                return;
+            await this.#replace(sessionId, data, ttl);
+        });
+    }
+    async #replace(sessionId, data, ttl) {
         const file = this.#pathFor(sessionId);
         const payload = JSON.stringify({ expiresAt: Date.now() + ttl * 1000, data });
         // Written to a temporary neighbour then renamed: a crash mid-write would
@@ -53,16 +104,39 @@ export class FileDriver {
         await fs.promises.writeFile(temp, payload, { encoding: 'utf8', mode: 0o600 });
         await fs.promises.rename(temp, file);
     }
-    async destroy(sessionId) {
-        await fs.promises.rm(this.#pathFor(sessionId), { force: true });
-    }
-    async touch(sessionId, ttl) {
-        const data = await this.read(sessionId);
-        // Nothing stored: there is no expiry to slide, and writing here would
-        // create the very session that was not there.
-        if (data === null || Object.keys(data).length === 0)
-            return;
-        await this.write(sessionId, data, ttl);
+    /**
+     * Run `fn` holding the session's lock: a directory beside its file, which
+     * `mkdir` creates atomically or refuses — the one exclusive primitive every
+     * filesystem gives, across processes too.
+     */
+    async #locked(sessionId, fn) {
+        const lock = `${this.#pathFor(sessionId)}.lock`;
+        const deadline = Date.now() + LOCK_WAIT_MS;
+        for (;;) {
+            try {
+                await fs.promises.mkdir(lock);
+                break;
+            }
+            catch (error) {
+                if (!hasCode(error, 'EEXIST'))
+                    throw error;
+                const held = await fs.promises.stat(lock).catch(() => null);
+                if (held !== null && Date.now() - held.mtimeMs > LOCK_STALE_MS) {
+                    await fs.promises.rm(lock, { recursive: true, force: true });
+                    continue;
+                }
+                if (Date.now() > deadline) {
+                    throw new Error(`Session file is locked: ${lock}`);
+                }
+                await new Promise((resolve) => setTimeout(resolve, 5));
+            }
+        }
+        try {
+            return await fn();
+        }
+        finally {
+            await fs.promises.rmdir(lock).catch(() => { });
+        }
     }
 }
 //# sourceMappingURL=FileDriver.js.map

package/dist/session/drivers/FileDriver.js.map

@@ -1 +1 @@
-{"version":3,"file":"FileDriver.js","sourceRoot":"","sources":["../../../src/session/drivers/FileDriver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAgBjC,MAAM,OAAO,UAAU;IACZ,SAAS,CAAQ;IAE1B,YAAY,OAA0B;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,SAAiB;QACxB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACjE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAA;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YAC9D,MAAM,KAAK,GAAG,MAAgE,CAAA;YAC9E,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACxE,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;gBAC7B,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,iEAAiE;YACjE,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,IAA6B,EAAE,GAAW;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;QACzC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7E,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,GAAW;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,sEAAsE;QACtE,8CAA8C;QAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;IACxC,CAAC;CACF"}
+{"version":3,"file":"FileDriver.js","sourceRoot":"","sources":["../../../src/session/drivers/FileDriver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAgBjC,qEAAqE;AACrE,MAAM,YAAY,GAAG,IAAI,CAAA;AACzB;;;GAGG;AACH,MAAM,aAAa,GAAG,MAAM,CAAA;AAE5B,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,OAAO,KAAK,YAAY,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,CAAA;AACtE,CAAC;AAED,MAAM,OAAO,UAAU;IACZ,SAAS,CAAQ;IAE1B,YAAY,OAA0B;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,SAAiB;QACxB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACjE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CACT,SAAiB,EACjB,IAAyB;QAEzB,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAA;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YAC9D,MAAM,KAAK,GAAG,MAAgE,CAAA;YAC9E,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACxE,MAAM,IAAI,EAAE,CAAA;gBACZ,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,iEAAiE;YACjE,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,IAA6B,EAAE,GAAW;QACvE,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,IAA6B,EAAE,GAAW;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YACxC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAA;YACvF,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;YACzC,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,GAAW;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;YACvE,sEAAsE;YACtE,8CAA8C;YAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAM;YAC3D,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,IAA6B,EAAE,GAAW;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;QACzC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7E,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACtC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAI,SAAiB,EAAE,EAAoB;QACtD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAA;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAA;QAC1C,SAAS,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC7B,MAAK;YACP,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;oBAAE,MAAM,KAAK,CAAA;gBAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;gBAC3D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBAC/D,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;oBAC5D,SAAQ;gBACV,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAA;gBACpD,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAA;QACnB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;CACF"}

package/dist/session/drivers/MemoryDriver.d.ts

@@ -8,6 +8,8 @@ export declare class MemoryDriver implements SessionDriverWithTagging {
     constructor(options?: MemoryDriverOptions);
     read(sessionId: string): Promise<Record<string, unknown> | null>;
     write(sessionId: string, data: Record<string, unknown>, ttl: number): Promise<void>;
+    /** Atomic by construction: nothing else runs between the check and the set. */
+    update(sessionId: string, data: Record<string, unknown>, ttl: number): Promise<boolean>;
     destroy(sessionId: string): Promise<void>;
     touch(sessionId: string, ttl: number): Promise<void>;
     tag(sessionId: string, userId: string | number): Promise<void>;

package/dist/session/drivers/MemoryDriver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MemoryDriver.d.ts","sourceRoot":"","sources":["../../../src/session/drivers/MemoryDriver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAgB5E,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,YAAa,YAAW,wBAAwB;;gBAM/C,OAAO,GAAE,mBAAwB;IAIvC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAShE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBnF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9D,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAkBhE"}
+{"version":3,"file":"MemoryDriver.d.ts","sourceRoot":"","sources":["../../../src/session/drivers/MemoryDriver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAiB5E,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,YAAa,YAAW,wBAAwB;;gBAM/C,OAAO,GAAE,mBAAwB;IAIvC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAShE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBzF,+EAA+E;IACzE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQvF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9D,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAkBhE"}

package/dist/session/drivers/MemoryDriver.js

@@ -6,8 +6,9 @@ const SWEEP_THRESHOLD = 1000;
  * The sweep alone only removes EXPIRED entries, so within the TTL window
  * nothing bounded growth: anyone able to request a page could mint sessions
  * until the process ran out of memory, without ever logging in. Past the cap
- * the oldest sessions are dropped — a bounded store that forgets is strictly
- * better than an unbounded one that dies.
+ * the least recently used sessions are dropped (a write, an update or a
+ * touch moves a session to the back of the line) — a bounded store that
+ * forgets is strictly better than an unbounded one that dies.
  */
 const DEFAULT_MAX_ENTRIES = 10_000;
 export class MemoryDriver {
@@ -46,6 +47,15 @@ export class MemoryDriver {
             this.#store.delete(oldest.value);
         }
     }
+    /** Atomic by construction: nothing else runs between the check and the set. */
+    async update(sessionId, data, ttl) {
+        const entry = this.#store.get(sessionId);
+        if (!entry || entry.expiresAt < Date.now())
+            return false;
+        this.#store.delete(sessionId);
+        this.#store.set(sessionId, { data, expiresAt: Date.now() + ttl * 1000 });
+        return true;
+    }
     async destroy(sessionId) {
         this.#store.delete(sessionId);
         // Drop the tags too: a destroyed session left in the index would be
@@ -59,9 +69,15 @@ export class MemoryDriver {
     }
     async touch(sessionId, ttl) {
         const entry = this.#store.get(sessionId);
-        if (entry) {
-            entry.expiresAt = Date.now() + ttl * 1000;
-        }
+        if (!entry || entry.expiresAt < Date.now())
+            return;
+        // Re-inserted, not updated in place: eviction drops the head of the map,
+        // so a session in use has to move to the tail. Updated in place, a
+        // signed-in user who keeps browsing stayed first in line, and ten
+        // thousand anonymous requests evicted them.
+        entry.expiresAt = Date.now() + ttl * 1000;
+        this.#store.delete(sessionId);
+        this.#store.set(sessionId, entry);
     }
     async tag(sessionId, userId) {
         const key = String(userId);