@frontmcp/auth 1.10.15 → 1.11.0-rc.1

package/browser/session/storage-orchestrated-token.store.mjs

@@ -0,0 +1,197 @@
+// libs/auth/src/session/storage-orchestrated-token.store.ts
+import { EncryptionKeyNotConfiguredError } from "../errors/auth-internal.errors.mjs";
+import {
+  decryptRecord,
+  deriveKeyForRecord,
+  encryptRecord,
+  hasLiveAccessToken,
+  recordDropAt
+} from "./orchestrated-token.crypto.mjs";
+var StorageOrchestratedTokenStore = class {
+  storage;
+  encryptionKey;
+  defaultTtlMs;
+  refreshSkewMs;
+  namespace;
+  storageIsNamespaced;
+  /** HKDF-derived subkey cache, keyed by composite key. */
+  derivedKeys = /* @__PURE__ */ new Map();
+  constructor(storage, options = {}) {
+    this.encryptionKey = options.encryptionKey;
+    this.defaultTtlMs = options.defaultTtlMs;
+    this.refreshSkewMs = options.refreshSkewMs ?? 0;
+    this.namespace = options.namespace ?? "otok";
+    this.storageIsNamespaced = this.isNamespacedStorage(storage);
+    this.storage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+  }
+  // ============================================
+  // TokenStore interface
+  // ============================================
+  async getAccessToken(authorizationId, providerId) {
+    const record = await this.getRecord(authorizationId, providerId);
+    return record && hasLiveAccessToken(record, this.refreshSkewMs) ? record.accessToken : null;
+  }
+  async getRefreshToken(authorizationId, providerId) {
+    const record = await this.getRecord(authorizationId, providerId);
+    return record?.refreshToken ?? null;
+  }
+  async storeTokens(authorizationId, providerId, tokens) {
+    const compositeKey = this.compositeKey(authorizationId, providerId);
+    const now = Date.now();
+    const record = {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: tokens.expiresAt ?? (this.defaultTtlMs ? now + this.defaultTtlMs : void 0),
+      createdAt: now,
+      updatedAt: now
+    };
+    const value = this.encryptionKey ? encryptRecord(this.keyFor(compositeKey), record) : JSON.stringify(record);
+    await this.storage.set(this.storageKey(compositeKey), value, this.ttlOptions(recordDropAt(record)));
+  }
+  async deleteTokens(authorizationId, providerId) {
+    const compositeKey = this.compositeKey(authorizationId, providerId);
+    await this.storage.delete(this.storageKey(compositeKey));
+    this.derivedKeys.delete(compositeKey);
+  }
+  async hasTokens(authorizationId, providerId) {
+    const record = await this.getRecord(authorizationId, providerId);
+    return record !== null;
+  }
+  async getProviderIds(authorizationId) {
+    const prefix = `${authorizationId}:`;
+    const compositeKeys = await this.listCompositeKeys(`${prefix}*`);
+    const providerIds = [];
+    for (const compositeKey of compositeKeys) {
+      if (!compositeKey.startsWith(prefix)) continue;
+      const providerId = compositeKey.slice(prefix.length);
+      const record = await this.getRecord(authorizationId, providerId);
+      if (record) {
+        providerIds.push(providerId);
+      }
+    }
+    return providerIds;
+  }
+  async migrateTokens(fromAuthId, toAuthId) {
+    for (const oldComposite of await this.copyRecords(fromAuthId, toAuthId)) {
+      await this.storage.delete(this.storageKey(oldComposite));
+      this.derivedKeys.delete(oldComposite);
+    }
+  }
+  async copyTokens(fromAuthId, toAuthId) {
+    await this.copyRecords(fromAuthId, toAuthId);
+  }
+  /**
+   * Delete all tokens for an authorization id.
+   */
+  async deleteAllForAuthorization(authorizationId) {
+    const prefix = `${authorizationId}:`;
+    const compositeKeys = await this.listCompositeKeys(`${prefix}*`);
+    for (const compositeKey of compositeKeys) {
+      if (!compositeKey.startsWith(prefix)) continue;
+      await this.storage.delete(this.storageKey(compositeKey));
+      this.derivedKeys.delete(compositeKey);
+    }
+  }
+  // ============================================
+  // Internals
+  // ============================================
+  /** Copy every record of `fromAuthId` to `toAuthId`, skipping a corrupted one; returns the composite keys copied. */
+  async copyRecords(fromAuthId, toAuthId) {
+    const prefix = `${fromAuthId}:`;
+    const compositeKeys = await this.listCompositeKeys(`${prefix}*`);
+    const copiedKeys = [];
+    for (const oldComposite of compositeKeys) {
+      if (!oldComposite.startsWith(prefix)) continue;
+      const newComposite = this.compositeKey(toAuthId, oldComposite.slice(prefix.length));
+      const stored = await this.storage.get(this.storageKey(oldComposite));
+      if (stored === null) continue;
+      if (this.encryptionKey) {
+        let record;
+        try {
+          record = decryptRecord(this.keyFor(oldComposite), stored);
+        } catch {
+          continue;
+        }
+        const value = encryptRecord(this.keyFor(newComposite), record);
+        await this.storage.set(this.storageKey(newComposite), value, this.ttlOptions(recordDropAt(record)));
+      } else {
+        let dropAt;
+        try {
+          dropAt = recordDropAt(JSON.parse(stored));
+        } catch {
+          dropAt = void 0;
+        }
+        await this.storage.set(this.storageKey(newComposite), stored, this.ttlOptions(dropAt));
+      }
+      copiedKeys.push(oldComposite);
+    }
+    return copiedKeys;
+  }
+  async getRecord(authorizationId, providerId) {
+    const compositeKey = this.compositeKey(authorizationId, providerId);
+    const stored = await this.storage.get(this.storageKey(compositeKey));
+    if (stored === null) {
+      return null;
+    }
+    let record;
+    if (this.encryptionKey) {
+      try {
+        record = decryptRecord(this.keyFor(compositeKey), stored);
+      } catch {
+        await this.storage.delete(this.storageKey(compositeKey));
+        return null;
+      }
+    } else {
+      try {
+        record = JSON.parse(stored);
+      } catch {
+        await this.storage.delete(this.storageKey(compositeKey));
+        return null;
+      }
+    }
+    const dropAt = recordDropAt(record);
+    if (dropAt && dropAt < Date.now()) {
+      await this.storage.delete(this.storageKey(compositeKey));
+      return null;
+    }
+    return record;
+  }
+  keyFor(compositeKey) {
+    if (!this.encryptionKey) {
+      throw new EncryptionKeyNotConfiguredError();
+    }
+    return deriveKeyForRecord(this.encryptionKey, compositeKey, this.derivedKeys);
+  }
+  compositeKey(authorizationId, providerId) {
+    return `${authorizationId}:${providerId}`;
+  }
+  storageKey(compositeKey) {
+    return this.storageIsNamespaced ? compositeKey : `${this.namespace}:${compositeKey}`;
+  }
+  /**
+   * List composite keys (authorizationId:providerId) matching a glob over the
+   * composite-key space, stripping any non-namespaced prefix we added.
+   */
+  async listCompositeKeys(compositeGlob) {
+    const pattern = this.storageIsNamespaced ? compositeGlob : `${this.namespace}:${compositeGlob}`;
+    const raw = await this.storage.keys(pattern);
+    if (this.storageIsNamespaced) {
+      return raw;
+    }
+    const stripPrefix = `${this.namespace}:`;
+    return raw.map((k) => k.startsWith(stripPrefix) ? k.slice(stripPrefix.length) : k);
+  }
+  ttlOptions(expiresAtMs) {
+    if (!expiresAtMs) {
+      return void 0;
+    }
+    const ttl = Math.ceil((expiresAtMs - Date.now()) / 1e3);
+    return { ttlSeconds: ttl > 0 ? ttl : 1 };
+  }
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
+  }
+};
+export {
+  StorageOrchestratedTokenStore
+};

package/browser/session/token-storage.factory.mjs

@@ -0,0 +1,58 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// libs/auth/src/session/token-storage.factory.ts
+import { MemoryStorageAdapter, RedisStorageAdapter } from "@frontmcp/utils";
+function isRedisTokenStorage(config) {
+  return typeof config === "object" && config !== null && "redis" in config && !!config.redis;
+}
+function isSqliteTokenStorage(config) {
+  return typeof config === "object" && config !== null && "sqlite" in config && !!config.sqlite;
+}
+function isPersistentTokenStorage(config) {
+  return config !== void 0 && config !== "memory";
+}
+async function createTokenStorageAdapter(config) {
+  if (config === void 0 || config === "memory") {
+    const adapter = new MemoryStorageAdapter();
+    await adapter.connect();
+    return adapter;
+  }
+  if (isSqliteTokenStorage(config)) {
+    const { SqliteStorageAdapter } = __require("@frontmcp/storage-sqlite");
+    const adapter = new SqliteStorageAdapter({
+      path: config.sqlite.path,
+      encryption: config.sqlite.encryption,
+      ttlCleanupIntervalMs: config.sqlite.ttlCleanupIntervalMs ?? 6e4,
+      walMode: config.sqlite.walMode ?? true,
+      busyTimeoutMs: config.sqlite.busyTimeoutMs
+    });
+    await adapter.connect();
+    return adapter;
+  }
+  if (isRedisTokenStorage(config)) {
+    const { host, port, password, db, tls, keyPrefix } = config.redis;
+    const adapter = new RedisStorageAdapter({
+      config: { host, port, password, db, tls },
+      keyPrefix: keyPrefix ?? ""
+    });
+    await adapter.connect();
+    return adapter;
+  }
+  const fallback = new MemoryStorageAdapter();
+  await fallback.connect();
+  return fallback;
+}
+export {
+  createTokenStorageAdapter,
+  isPersistentTokenStorage,
+  isRedisTokenStorage,
+  isSqliteTokenStorage
+};

package/browser/session/token.refresh.mjs

@@ -0,0 +1,36 @@
+// libs/auth/src/session/token.refresh.ts
+import { base64urlDecode } from "@frontmcp/utils";
+function toEpochSeconds(exp) {
+  if (exp == null) return void 0;
+  if (exp instanceof Date) return Math.floor(exp.getTime() / 1e3);
+  return exp > 1e12 ? Math.floor(exp / 1e3) : Math.floor(exp);
+}
+function isSoonExpiring(exp, skewSec = 60) {
+  const expSec = toEpochSeconds(exp);
+  if (expSec == null) return false;
+  const now = Math.floor(Date.now() / 1e3);
+  return expSec <= now + Math.max(0, skewSec);
+}
+function isSoonExpiringProvider(sessionLike, providerId, skewSec = 60) {
+  const snap = sessionLike.authorizedProviders[providerId];
+  if (!snap) return false;
+  return isSoonExpiring(snap.exp, skewSec);
+}
+function tryJwtExp(token) {
+  if (!token) return void 0;
+  const parts = token.split(".");
+  if (parts.length < 2) return void 0;
+  try {
+    const json = JSON.parse(new TextDecoder().decode(base64urlDecode(parts[1])));
+    const e = json?.exp;
+    return typeof e === "number" ? toEpochSeconds(e) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+export {
+  isSoonExpiring,
+  isSoonExpiringProvider,
+  toEpochSeconds,
+  tryJwtExp
+};

package/browser/session/token.vault.mjs

@@ -0,0 +1,61 @@
+// libs/auth/src/session/token.vault.ts
+import { encryptAesGcm, decryptAesGcm, randomBytes, base64urlEncode, base64urlDecode } from "@frontmcp/utils";
+var TokenVault = class {
+  /** Active key used for new encryptions */
+  active;
+  /** All known keys by kid for decryption (includes active) */
+  keys = /* @__PURE__ */ new Map();
+  constructor(keys) {
+    if (!Array.isArray(keys) || keys.length === 0) {
+      throw new Error("TokenVault requires at least one key");
+    }
+    for (const k of keys) {
+      if (!(k.key instanceof Uint8Array) || k.key.length !== 32) {
+        throw new Error(`TokenVault key "${k.kid}" must be a 32-byte Uint8Array for AES-256-GCM`);
+      }
+      if (this.keys.has(k.kid)) {
+        throw new Error(`TokenVault duplicate kid: "${k.kid}"`);
+      }
+      this.keys.set(k.kid, k.key);
+    }
+    this.active = keys[0];
+  }
+  rotateTo(k) {
+    if (!(k.key instanceof Uint8Array) || k.key.length !== 32) {
+      throw new Error(`TokenVault key "${k.kid}" must be a 32-byte Uint8Array for AES-256-GCM`);
+    }
+    this.active = k;
+    this.keys.set(k.kid, k.key);
+  }
+  async encrypt(plaintext, opts) {
+    const iv = randomBytes(12);
+    const { ciphertext, tag } = await encryptAesGcm(this.active.key, new TextEncoder().encode(plaintext), iv);
+    return {
+      alg: "A256GCM",
+      kid: this.active.kid,
+      iv: base64urlEncode(iv),
+      tag: base64urlEncode(tag),
+      data: base64urlEncode(ciphertext),
+      exp: opts?.exp,
+      meta: opts?.meta
+    };
+  }
+  async decrypt(blob) {
+    if (blob.exp !== void 0) {
+      const nowSeconds = Math.floor(Date.now() / 1e3);
+      if (nowSeconds > blob.exp) {
+        throw new Error(`vault_expired:${blob.kid}`);
+      }
+    }
+    const key = this.keys.get(blob.kid);
+    if (!key) throw new Error(`vault_unknown_kid:${blob.kid}`);
+    const iv = base64urlDecode(blob.iv);
+    const tag = base64urlDecode(blob.tag);
+    const data = base64urlDecode(blob.data);
+    const plaintext = await decryptAesGcm(key, data, iv, tag);
+    return new TextDecoder().decode(plaintext);
+  }
+};
+export {
+  TokenVault
+};

package/browser/session/transport-session.types.mjs

@@ -0,0 +1,108 @@
+// libs/auth/src/session/transport-session.types.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+var transportProtocolSchema = z.enum([
+  "legacy-sse",
+  "sse",
+  "streamable-http",
+  "stateful-http",
+  "stateless-http"
+]);
+var sseTransportStateSchema = z.object({
+  type: z.literal("sse"),
+  lastEventId: z.string().optional(),
+  lastPing: z.number().optional(),
+  connectionState: z.enum(["connecting", "open", "closed"]).optional()
+});
+var streamableHttpTransportStateSchema = z.object({
+  type: z.literal("streamable-http"),
+  requestSeq: z.number(),
+  activeStreamId: z.string().optional(),
+  pendingRequests: z.array(z.string()).optional()
+});
+var statefulHttpTransportStateSchema = z.object({
+  type: z.literal("stateful-http"),
+  requestSeq: z.number(),
+  pendingResponses: z.array(z.string()).optional(),
+  lastActivity: z.number().optional()
+});
+var statelessHttpTransportStateSchema = z.object({
+  type: z.literal("stateless-http"),
+  requestCount: z.number(),
+  windowStart: z.number().optional()
+});
+var legacySseTransportStateSchema = z.object({
+  type: z.literal("legacy-sse"),
+  messagePath: z.string(),
+  lastEventId: z.string().optional(),
+  connectionState: z.enum(["connecting", "open", "closed"]).optional()
+});
+var transportStateSchema = z.discriminatedUnion("type", [
+  sseTransportStateSchema,
+  streamableHttpTransportStateSchema,
+  statefulHttpTransportStateSchema,
+  statelessHttpTransportStateSchema,
+  legacySseTransportStateSchema
+]);
+var transportSessionSchema = z.object({
+  id: z.string(),
+  authorizationId: z.string(),
+  protocol: transportProtocolSchema,
+  createdAt: z.number(),
+  expiresAt: z.number().optional(),
+  nodeId: z.string(),
+  clientFingerprint: z.string().optional(),
+  transportState: transportStateSchema.optional()
+});
+var sessionJwtPayloadSchema = z.object({
+  sid: z.string(),
+  aid: z.string(),
+  proto: transportProtocolSchema,
+  nid: z.string(),
+  iat: z.number(),
+  exp: z.number().optional()
+});
+var encryptedBlobSchema = z.object({
+  alg: z.literal("A256GCM"),
+  kid: z.string().optional(),
+  iv: z.string(),
+  tag: z.string(),
+  data: z.string(),
+  exp: z.number().optional(),
+  meta: z.record(z.string(), z.unknown()).optional()
+});
+var storedSessionSchema = z.object({
+  session: transportSessionSchema,
+  authorizationId: z.string(),
+  tokens: z.record(z.string(), encryptedBlobSchema).optional(),
+  createdAt: z.number(),
+  lastAccessedAt: z.number(),
+  initialized: z.boolean().optional(),
+  maxLifetimeAt: z.number().optional(),
+  clientCapabilities: z.record(z.string(), z.unknown()).optional(),
+  reassignedAt: z.number().optional(),
+  reassignedFrom: z.string().optional()
+});
+var redisConfigSchema = z.object({
+  host: z.string().min(1),
+  port: z.number().int().positive().optional().default(6379),
+  password: z.string().optional(),
+  db: z.number().int().nonnegative().optional().default(0),
+  tls: z.boolean().optional().default(false),
+  keyPrefix: z.string().optional().default("mcp:session:"),
+  defaultTtlMs: z.number().int().positive().optional().default(36e5)
+  // 1 hour default
+});
+export {
+  encryptedBlobSchema,
+  legacySseTransportStateSchema,
+  redisConfigSchema,
+  sessionJwtPayloadSchema,
+  sseTransportStateSchema,
+  statefulHttpTransportStateSchema,
+  statelessHttpTransportStateSchema,
+  storedSessionSchema,
+  streamableHttpTransportStateSchema,
+  transportProtocolSchema,
+  transportSessionSchema,
+  transportStateSchema
+};

package/browser/session/utils/auth-token.utils.mjs

@@ -0,0 +1,58 @@
+// libs/auth/src/session/utils/auth-token.utils.ts
+import { sha256Base64url } from "@frontmcp/utils";
+function isJwt(token) {
+  if (!token) return false;
+  return token.split(".").length === 3;
+}
+function getTokenSignatureFingerprint(token) {
+  if (isJwt(token)) {
+    const sig = token.split(".")[2];
+    if (sig) return sig;
+  }
+  return sha256Base64url(token);
+}
+function extractClaimValue(claims, key, validator) {
+  const value = claims[key];
+  return validator(value) ? value : void 0;
+}
+var isString = (value) => typeof value === "string";
+var isNumber = (value) => typeof value === "number";
+var isStringOrStringArray = (value) => typeof value === "string" || Array.isArray(value);
+function deriveTypedUser(claims) {
+  return {
+    ...claims,
+    iss: extractClaimValue(claims, "iss", isString) ?? "",
+    sid: extractClaimValue(claims, "sid", isString),
+    // RFC 9068 \u00a72.2: a client-credentials token names the client as its subject; some IdPs only put it in client_id / azp
+    sub: extractClaimValue(claims, "sub", isString) ?? extractClaimValue(claims, "client_id", isString) ?? extractClaimValue(claims, "azp", isString) ?? "",
+    exp: extractClaimValue(claims, "exp", isNumber),
+    iat: extractClaimValue(claims, "iat", isNumber),
+    aud: extractClaimValue(claims, "aud", isStringOrStringArray),
+    email: extractClaimValue(claims, "email", isString),
+    preferred_username: extractClaimValue(claims, "preferred_username", isString),
+    username: extractClaimValue(claims, "username", isString),
+    name: extractClaimValue(claims, "name", isString),
+    picture: extractClaimValue(claims, "picture", isString)
+  };
+}
+function anonymousCallerClaims(options, anonymousId) {
+  const { issuer, scopes = ["anonymous"], subject } = options;
+  return {
+    sub: subject ?? `anon:${anonymousId}`,
+    iss: issuer,
+    name: subject ? "Static token" : "Anonymous",
+    scope: scopes.join(" ")
+  };
+}
+function extractBearerToken(header) {
+  if (!header) return void 0;
+  const m = header.match(/^\s*Bearer\s+(\S+)\s*$/i);
+  return m ? m[1] : void 0;
+}
+export {
+  anonymousCallerClaims,
+  deriveTypedUser,
+  extractBearerToken,
+  getTokenSignatureFingerprint,
+  isJwt
+};

package/browser/session/utils/index.mjs

@@ -0,0 +1,23 @@
+// libs/auth/src/session/utils/index.ts
+import { TinyTtlCache } from "./tiny-ttl-cache.mjs";
+import {
+  isJwt,
+  getTokenSignatureFingerprint,
+  deriveTypedUser,
+  anonymousCallerClaims,
+  extractBearerToken
+} from "./auth-token.utils.mjs";
+import { getKey, encryptJson, decryptSessionJson, safeDecrypt, resetCachedKey } from "./session-crypto.utils.mjs";
+export {
+  TinyTtlCache,
+  anonymousCallerClaims,
+  decryptSessionJson,
+  deriveTypedUser,
+  encryptJson,
+  extractBearerToken,
+  getKey,
+  getTokenSignatureFingerprint,
+  isJwt,
+  resetCachedKey,
+  safeDecrypt
+};

package/browser/session/utils/session-crypto.utils.mjs

@@ -0,0 +1,49 @@
+// libs/auth/src/session/utils/session-crypto.utils.ts
+import { decryptValue, encryptValue, getEnv, getMachineId, isProduction, sha256 } from "@frontmcp/utils";
+import { SessionSecretRequiredError } from "../../errors/auth-internal.errors.mjs";
+var cachedKey = null;
+function getKey() {
+  if (cachedKey) return cachedKey;
+  const secret = getEnv("MCP_SESSION_SECRET");
+  if (!secret) {
+    if (isProduction()) {
+      throw new SessionSecretRequiredError("session ID encryption");
+    }
+    console.warn(
+      "[SessionIdUtils] Using machine ID as session encryption secret - NOT SECURE FOR PRODUCTION. Set MCP_SESSION_SECRET environment variable for secure session encryption."
+    );
+  }
+  const base = secret || getMachineId();
+  cachedKey = sha256(new TextEncoder().encode(base));
+  return cachedKey;
+}
+function encryptJson(obj) {
+  const key = getKey();
+  const encrypted = encryptValue(obj, key);
+  return `${encrypted.iv}.${encrypted.tag}.${encrypted.data}`;
+}
+function decryptSessionJson(sessionId) {
+  const parts = sessionId.split(".");
+  if (parts.length !== 3) return null;
+  const [ivB64, tagB64, ctB64] = parts;
+  if (!ivB64 || !tagB64 || !ctB64) return null;
+  const key = getKey();
+  return decryptValue({ alg: "A256GCM", iv: ivB64, tag: tagB64, data: ctB64 }, key);
+}
+function safeDecrypt(sessionId) {
+  try {
+    return decryptSessionJson(sessionId);
+  } catch {
+    return null;
+  }
+}
+function resetCachedKey() {
+  cachedKey = null;
+}
+export {
+  decryptSessionJson,
+  encryptJson,
+  getKey,
+  resetCachedKey,
+  safeDecrypt
+};

package/browser/session/utils/tiny-ttl-cache.mjs

@@ -0,0 +1,46 @@
+// libs/auth/src/session/utils/tiny-ttl-cache.ts
+var TinyTtlCache = class {
+  constructor(ttlMs) {
+    this.ttlMs = ttlMs;
+  }
+  ttlMs;
+  map = /* @__PURE__ */ new Map();
+  get(k) {
+    const hit = this.map.get(k);
+    if (!hit) return void 0;
+    if (hit.exp < Date.now()) {
+      this.map.delete(k);
+      return void 0;
+    }
+    return hit.v;
+  }
+  set(k, v) {
+    this.map.set(k, { v, exp: Date.now() + this.ttlMs });
+  }
+  delete(k) {
+    return this.map.delete(k);
+  }
+  clear() {
+    this.map.clear();
+  }
+  size() {
+    return this.map.size;
+  }
+  /**
+   * Remove all expired entries
+   */
+  cleanup() {
+    const now = Date.now();
+    let removed = 0;
+    for (const [k, { exp }] of this.map) {
+      if (exp < now) {
+        this.map.delete(k);
+        removed++;
+      }
+    }
+    return removed;
+  }
+};
+export {
+  TinyTtlCache
+};