@nifrajs/auth 5.4.0 → 5.5.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @nifrajs/auth
 
+## 5.5.0
+
+### Security and migration
+
+- 8debc4c: Session managers refuse eventually consistent stores, including `KVSessionStore`. Cached session records and missing revocation markers could restore a logged-out session and let it keep renewing. Existing KV-backed session applications must migrate to a strongly consistent shared `SessionStore`; the legacy KV adapter remains exported for reading and migration. Custom adapters may declare `consistency: "strong"`; omitting it asserts the same required contract.
+
+### Minor Changes
+
+- 662afb0: A store-backed session that `regenerate()` rotates while a logout of it runs can no longer come out of that race as a live session. A rotated ID is now the session's original ID, `~`, and a new random part, and logout with any generation's cookie revokes every generation, so the rotating request either sends no cookie or sends one that loads as an empty session. `SessionStore` gains an optional `rotate(previousId, nextId, record, marker)` that moves an existing, unrevoked record to its new ID in one atomic step and resolves whether it did. `MemorySessionStore` implements it, and drops every generation's record when one is revoked, so evicting a revocation marker cannot bring them back. A store without `rotate` keeps working: rotation writes an `<id>.rotated` marker beside the `<id>.revoked` one, and the store must keep both until their `expiresAt`. A load reads the rotation marker, and for a rotated ID the original ID's revocation marker, in parallel with the record.
+- f6a71bc: `SessionStore` gains an optional `replace(id, record)` method that overwrites `id` only while it still holds a record and resolves whether it wrote. When a store implements it, a loaded session renews through `replace` instead of `set`, so a logout that lands between the commit's checks and its write wins, even once the logout's revocation marker is gone. Implement it as one atomic step that also sets the new expiry, such as Redis `SET key value XX PXAT <record.expiresAt>` (a bare `XX` drops the key's TTL) or a SQL `UPDATE ... WHERE id = ?` that reports the rows it changed. `MemorySessionStore` implements it. A store without it works as before and must keep each revocation marker until its `expiresAt`, as `KVSessionStore` does: Workers KV has no conditional write.
+
+### Patch Changes
+
+- b747034: A store-backed session renewal on a store without `replace()` can no longer undo a logout. When the record it renews expires while the write is in flight, a logout in that gap finds nothing to revoke; the renewal now deletes what it wrote and sends no cookie instead of restoring the session.
+- 32c701e: In store mode, `destroy(c)` called with a cookie that a `regenerate()` rotation has already replaced ends the whole session family only within 60 seconds of that rotation, while the rotating response may still be on its way to the browser. After that it drops only the replaced ID, so a pre-login cookie kept elsewhere can no longer end the session that replaced it. A cookie naming the live session, and `destroy(c, session)` with a loaded session, end the family as before.
+- e14bc02: A store-backed session that a request loaded before a logout or rotation can no longer be written back by that request's later `commit()`. A loaded session now commits only while its record still exists and no revocation marker names it, so the guarantee no longer depends on the logout's marker outliving the request: other revocations pushing that marker out of a bounded `MemorySessionStore` cannot bring the session back, and neither can a commit that reads between a logout's marker write and its delete. The commit reads the record and the marker in parallel, so it waits on no extra store round trip. A `MemorySessionStore`, which can evict markers, also makes the renewal itself conditional: it writes only while the record still exists, in one step with the check, so a logout that lands after the commit's reads still wins.
+
 ## 5.4.0
 
 No changes in this release.

package/README.md

@@ -13,6 +13,38 @@ Part of the **[nifra](https://nifra.dev)** full-stack TypeScript framework - one
 bun add @nifrajs/auth
 ```
 
+## Store revocation and rotation
+
+Store mode requires strongly consistent reads: every instance must observe completed writes and
+deletes, including revocation markers. `createSessions` refuses adapters declaring
+`consistency: "eventual"`. `KVSessionStore` declares this and is no longer accepted: Workers KV can
+serve a cached session and a cached missing marker after logout, allowing renewal to restore it.
+Its export remains available for reading and migrating legacy records.
+
+Use a strongly consistent shared `SessionStore`, for example a transactional adapter or a Durable
+Object, in production. `MemorySessionStore` remains suitable for development or an explicitly allowed
+single-instance deployment. Custom adapters may declare `consistency: "strong"`; omitting the
+declaration preserves compatibility but asserts the same strong-consistency contract. Wrapping or
+relabeling Workers KV does not make its reads strongly consistent. No eventual-consistency opt-in is
+provided, including when rolling renewal is disabled.
+
+In store mode, `destroy` revokes the entire session family, including later IDs issued by
+`regenerate`. A cookie that a rotation has already replaced does this only for 60 seconds after
+the rotation, while the rotating response may still be on its way to the browser. After that,
+logging out with it drops only that superseded ID, so a kept pre-login cookie cannot end the
+session that replaced it. Rotated IDs remain opaque signed cookie values. Store adapters must retain
+`<id>.rotated` and `<family>.revoked` marker records until their `expiresAt`, including after the
+original session record is deleted. Do not interpret markers as sessions.
+For store adapters, the family is the session's original ID: a rotated ID has the form
+`<family>~<replacement>`, and repeated rotations keep that same family prefix.
+
+Adapters may implement `SessionStore.rotate(previousId, nextId, record, marker)` atomically: refuse
+when the previous record is missing, rotated, or its family is revoked; otherwise write the rotation
+marker, delete the old record, and store the replacement in one transaction. Return whether it won.
+The built-in memory store implements this operation. Adapters with only `get`/`set`/`delete` keep
+logout markers separate from rotation markers and check family revocation after writing; concurrent
+rotations can produce multiple replacement IDs, all revoked by one logout of the family.
+
 ## Docs
 
 - Reference: <https://nifra.dev/docs>

package/dist/session.d.ts

@@ -46,7 +46,8 @@ export interface SessionOptions {
      * secret, drop the old one after `maxAge` has elapsed. A bare secret swap (no list) invalidates
      * all existing sessions. */
     readonly secret: string | readonly string[];
-    /** Provide a store for **store mode**; omit for **cookie mode** (stateless). */
+    /** Strongly consistent backend for **store mode**; omit for **cookie mode** (stateless).
+     * Declared eventually consistent stores (including KVSessionStore) are refused. */
     readonly store?: SessionStore;
     /** Cookie name. Default `nifra_session`. */
     readonly cookieName?: string;

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,KAAK,aAAa,EAKnB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,YAAY,CAAA;AAElF;qDACqD;AACrD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,GAAG,EAAE;QACZ,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;QAClE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KACjG,CAAA;CACF;AAED,gFAAgF;AAChF,MAAM,WAAW,OAAO,CAAC,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACrF,GAAG,CAAC,CAAC,SAAS,MAAM,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAA;IACtD,GAAG,CAAC,CAAC,SAAS,MAAM,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IACvD,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,IAAI,CAAA;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IAC7B,mGAAmG;IACnG,KAAK,IAAI,IAAI,CAAA;IACb,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED;2EAC2E;AAC3E,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAA;AAEjG,MAAM,WAAW,cAAc;IAC7B;;;gCAG4B;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;IAC3C,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAA;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,kGAAkG;IAClG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B;mFAC+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAA;IACtC,iGAAiG;IACjG,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;CACvC;AAED,MAAM,WAAW,cAAc,CAAC,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC5F,kGAAkG;IAClG,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9C;sGACkG;IAClG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9C,6EAA6E;IAC7E,MAAM,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChE;;;;qDAIiD;IACjD,OAAO,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE;gFAC4E;IAC5E,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CACzC;AA2CD,wBAAgB,cAAc,CAAC,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3F,OAAO,EAAE,cAAc,GACtB,cAAc,CAAC,IAAI,CAAC,CAqOtB"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,KAAK,aAAa,EAKnB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAML,KAAK,YAAY,EAElB,MAAM,YAAY,CAAA;AAEnB;qDACqD;AACrD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,GAAG,EAAE;QACZ,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;QAClE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KACjG,CAAA;CACF;AAED,gFAAgF;AAChF,MAAM,WAAW,OAAO,CAAC,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACrF,GAAG,CAAC,CAAC,SAAS,MAAM,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAA;IACtD,GAAG,CAAC,CAAC,SAAS,MAAM,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IACvD,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,IAAI,CAAA;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IAC7B,mGAAmG;IACnG,KAAK,IAAI,IAAI,CAAA;IACb,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED;2EAC2E;AAC3E,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAA;AAEjG,MAAM,WAAW,cAAc;IAC7B;;;gCAG4B;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;IAC3C;uFACmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAA;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,kGAAkG;IAClG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B;mFAC+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAA;IACtC,iGAAiG;IACjG,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;CACvC;AAED,MAAM,WAAW,cAAc,CAAC,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC5F,kGAAkG;IAClG,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9C;sGACkG;IAClG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9C,6EAA6E;IAC7E,MAAM,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChE;;;;qDAIiD;IACjD,OAAO,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE;gFAC4E;IAC5E,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CACzC;AAgDD,wBAAgB,cAAc,CAAC,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3F,OAAO,EAAE,cAAc,GACtB,cAAc,CAAC,IAAI,CAAC,CAqTtB"}

package/dist/session.js

@@ -10,7 +10,7 @@
  * anonymous session, never an error.
  */
 import { hasDuplicateCookie, parseCookies, signValue, unsignValue, } from "@nifrajs/core/cookies";
-import { REVOKED_SUFFIX } from "./store.js";
+import { isSessionMarker, REVOKED_SUFFIX, ROTATED_SUFFIX, rotateExisting, sessionFamily, } from "./store.js";
 const DAY_SECONDS = 86_400;
 // 256-bit floor, matching @nifrajs/core's signed-cookie/webhook guard. Sessions sign via core's
 // signValue (which enforces the same bar); this early check gives an auth-specific message before
@@ -29,6 +29,10 @@ const randomId = () => encodeBase64Url(crypto.getRandomValues(new Uint8Array(32)
 // commits after it rewrites the record, and a blind `set` cannot be made conditional on every store,
 // but it cannot overwrite a key it never writes. `.` is outside the base64url id alphabet.
 const revokedKey = (id) => `${id}${REVOKED_SUFFIX}`;
+// A superseded cookie is still the user's own while the rotating response is on its way to the
+// browser. Past that it is a copy someone else kept (a planted pre-login cookie), and it must not end
+// the session that replaced it.
+const ROTATION_GRACE_MS = 60_000;
 /** Validate a cookie-mode payload at the trust boundary - malformed JSON / shape → `null` (no session). */
 const parsePayload = (json) => {
     let value;
@@ -49,6 +53,12 @@ const parsePayload = (json) => {
 };
 export function createSessions(options) {
     const { secret, store } = options;
+    // A cached marker miss can authenticate or recreate a session after logout, even with fixed expiry.
+    if (store?.consistency !== undefined && store.consistency !== "strong") {
+        throw new Error("[nifra/auth] sessions require a strongly consistent store for logout and rotation; " +
+            "eventually consistent stores such as KVSessionStore are not supported. " +
+            "Use a strongly consistent shared SessionStore instead.");
+    }
     const secretList = typeof secret === "string" ? [secret] : secret;
     if (secretList.length === 0) {
         throw new Error("[nifra/auth] session secret list cannot be empty");
@@ -131,15 +141,18 @@ export function createSessions(options) {
             return make({}); // tampered / wrong secret → fail closed (anonymous)
         if (store !== undefined) {
             // Only reachable with a value the app signed itself (legacy mode): never read a marker as a session.
-            if (unsigned.endsWith(REVOKED_SUFFIX))
+            if (isSessionMarker(unsigned))
                 return make({});
-            const [record, revoked] = await Promise.all([
+            const family = sessionFamily(unsigned);
+            const [record, revoked, rotated, familyRevoked] = await Promise.all([
                 store.get(unsigned),
                 store.get(revokedKey(unsigned)),
+                store.get(`${unsigned}${ROTATED_SUFFIX}`),
+                family === unsigned ? undefined : store.get(revokedKey(family)),
             ]);
             if (record === undefined)
                 return make({});
-            if (revoked !== undefined) {
+            if (revoked !== undefined || rotated !== undefined || familyRevoked !== undefined) {
                 await store.delete(unsigned); // a commit that raced the logout wrote it back
                 return make({});
             }
@@ -174,7 +187,7 @@ export function createSessions(options) {
     const revoke = async (id) => {
         if (store === undefined)
             return;
-        await store.set(revokedKey(id), { data: {}, expiresAt: now() + maxAge * 1000 });
+        await store.set(revokedKey(sessionFamily(id)), { data: {}, expiresAt: now() + maxAge * 1000 });
         await store.delete(id);
     };
     const commit = async (c, session) => {
@@ -190,30 +203,76 @@ export function createSessions(options) {
         const data = Object.fromEntries(state.data);
         if (store !== undefined) {
             if (state.id !== undefined) {
-                const revoked = await store.get(revokedKey(state.id));
-                // Check again after the read: a delayed store operation can outlive both session and marker.
-                if (revoked !== undefined || (previousExpiry !== undefined && previousExpiry <= now()))
+                // A loaded session commits only while its record exists and no logout has marked it. The
+                // record covers a marker already evicted; the marker covers a logout between its two writes.
+                const family = sessionFamily(state.id);
+                const [current, revoked, rotated, familyRevoked] = await Promise.all([
+                    store.get(state.id),
+                    store.get(revokedKey(state.id)),
+                    store.get(`${state.id}${ROTATED_SUFFIX}`),
+                    family === state.id ? undefined : store.get(revokedKey(family)),
+                ]);
+                // Check again after the reads: a delayed store operation can outlive both session and marker.
+                if (current === undefined ||
+                    revoked !== undefined ||
+                    rotated !== undefined ||
+                    familyRevoked !== undefined ||
+                    (previousExpiry !== undefined && previousExpiry <= now()))
                     return;
             }
-            if (state.regenerate) {
-                if (state.id !== undefined)
-                    await revoke(state.id); // drop the pre-rotation session
-                if (previousExpiry !== undefined && previousExpiry <= now())
+            const record = { data, expiresAt };
+            const previousId = state.regenerate ? state.id : undefined;
+            const loaded = state.id !== undefined && previousId === undefined;
+            if (previousId !== undefined) {
+                const nextId = `${sessionFamily(previousId)}~${randomId()}`;
+                const rotated = await rotateExisting(store, previousId, nextId, record, {
+                    data: { rotatedAt: committedAt },
+                    expiresAt: committedAt + maxAge * 1000,
+                });
+                if (!rotated)
+                    return;
+                if (previousExpiry !== undefined && previousExpiry <= now()) {
+                    await revoke(nextId);
+                    return;
+                }
+                state.id = nextId;
+            }
+            else {
+                state.id ??= randomId();
+                // A store with `replace` makes the renewal conditional, so a logout landing after the checks
+                // above wins outright; any other store relies on keeping the marker until it expires.
+                if (!loaded || store.replace === undefined) {
+                    await store.set(state.id, record);
+                    // The renewed record may have expired while the write was in flight, and a logout in that
+                    // gap found nothing to mark, so the write would revive what it ended.
+                    if (loaded && previousExpiry !== undefined && previousExpiry <= now()) {
+                        await store.delete(state.id);
+                        return;
+                    }
+                }
+                else if (!(await store.replace(state.id, record)))
                     return;
-                state.id = undefined;
-                state.regenerate = false;
             }
-            const loaded = state.id !== undefined;
-            state.id ??= randomId();
-            await store.set(state.id, { data, expiresAt });
+            state.regenerate = false;
             // Checked after the write: a revocation that lands before it is seen here, one that lands after
             // it deletes the record itself. Either way the cookie is left alone - the browser may hold a
             // newer session by now, and this response must not replace or clear it.
-            if (loaded && (await store.get(revokedKey(state.id))) !== undefined) {
+            if (loaded &&
+                (await Promise.all([
+                    store.get(revokedKey(state.id)),
+                    store.get(`${state.id}${ROTATED_SUFFIX}`),
+                    store.get(revokedKey(sessionFamily(state.id))),
+                ])).some((marker) => marker !== undefined)) {
                 await store.delete(state.id);
                 return;
             }
             const signed = await sign(state.id);
+            if (previousId !== undefined &&
+                ((await store.get(state.id)) === undefined ||
+                    (await store.get(revokedKey(sessionFamily(state.id)))) !== undefined)) {
+                await store.delete(state.id);
+                return;
+            }
             state.expiresAt = expiresAt;
             writeCookie(c, signed, expiresAt);
             return;
@@ -223,22 +282,40 @@ export function createSessions(options) {
         state.expiresAt = expiresAt;
         writeCookie(c, signed, expiresAt);
     };
+    // Whether logging out with this id may end its whole family: the live generation always may, a
+    // rotated-away one only within the grace window, and an id with neither record nor marker never.
+    const speaksForFamily = async (activeStore, id) => {
+        const [record, rotated] = await Promise.all([
+            activeStore.get(id),
+            activeStore.get(`${id}${ROTATED_SUFFIX}`),
+        ]);
+        if (rotated === undefined)
+            return record !== undefined;
+        const stamped = rotated.data.rotatedAt;
+        // Markers written before the stamp existed carry the rotation time only through their expiry.
+        const rotatedAt = typeof stamped === "number" ? stamped : rotated.expiresAt - maxAge * 1000;
+        return now() - rotatedAt < ROTATION_GRACE_MS;
+    };
     const destroy = async (c, session) => {
         const state = session === undefined ? undefined : states.get(session);
         if (store !== undefined) {
-            let id;
             if (session !== undefined) {
-                id = state?.id;
+                const id = state?.id;
+                if (id !== undefined && !isSessionMarker(id))
+                    await revoke(id);
             }
             else {
                 // Revoke the record addressed by the signed request cookie even when the caller did not
                 // first load a Session object. The signature check prevents deleting attacker-chosen IDs.
                 const raw = sessionCookie(c);
-                if (raw !== undefined)
-                    id = (await unsign(raw)) ?? undefined;
+                const id = raw === undefined ? null : await unsign(raw);
+                if (id !== null && !isSessionMarker(id)) {
+                    if (await speaksForFamily(store, id))
+                        await revoke(id);
+                    else
+                        await store.delete(id);
+                }
             }
-            if (id !== undefined && !id.endsWith(REVOKED_SUFFIX))
-                await revoke(id);
         }
         // A later commit of this object must neither write the ended data back (cookie mode) nor vanish
         // against the revocation marker (store mode).

package/dist/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAEL,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,WAAW,GACZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,cAAc,EAAyC,MAAM,YAAY,CAAA;AA+ElF,MAAM,WAAW,GAAG,MAAM,CAAA;AAC1B,gGAAgG;AAChG,kGAAkG;AAClG,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAC3B,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAA;AAExC,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAU,EAAE;IACpD,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACpD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC7E,CAAC,CAAA;AAED,sGAAsG;AACtG,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE1F,qGAAqG;AACrG,qGAAqG;AACrG,2FAA2F;AAC3F,MAAM,UAAU,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAA;AAOnE,2GAA2G;AAC3G,MAAM,YAAY,GAAG,CAAC,IAAY,EAAkB,EAAE;IACpD,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC5D,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IACrF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAClE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAA+B,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAA;AAChF,CAAC,CAAA;AAED,MAAM,UAAU,cAAc,CAC5B,OAAuB;IAEvB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACjC,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,gDAAgD,gBAAgB,8DAA8D,CAC/H,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAA;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,WAAW,CAAA;IAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,UAAU,CAAC,wEAAwE,CAAC,CAAA;IAChG,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAA;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,KAAK,IAAI,CAAA;IACzD,oGAAoG;IACpG,kGAAkG;IAClG,MAAM,UAAU,GAAyB,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IAQ7D,oGAAoG;IACpG,+BAA+B;IAC/B,MAAM,MAAM,GAAG,IAAI,OAAO,EAAwB,CAAA;IAElD,MAAM,IAAI,GAAG,CAAC,IAIb,EAAiB,EAAE;QAClB,MAAM,KAAK,GAAU;YACnB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,8FAA8F;YAC9F,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAqC,CAAC;YAClF,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,KAAK;SAClB,CAAA;QACD,MAAM,OAAO,GAAkB;YAC7B,GAAG,EAAE,CAAuB,GAAM,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAwB;YACjF,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC5B,CAAC;YACD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;gBACb,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACxB,CAAC;YACD,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACjC,KAAK,EAAE,GAAG,EAAE;gBACV,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;YACpB,CAAC;YACD,IAAI,IAAI;gBACN,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAA;YACxD,CAAC;YACD,IAAI,OAAO;gBACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAA;YAC9B,CAAC;SACF,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,CAAC,OAAsB,EAAE,EAAU,EAAS,EAAE;QAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,2CAA2C,CAAC,CAAA;QAChF,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,kGAAkG;IAClG,uFAAuF;IACvF,MAAM,KAAK,GAAG,GAAG,UAAU,IAAI,CAAA;IAC/B,MAAM,IAAI,GAAG,KAAK,EAAE,KAAa,EAAmB,EAAE,CACpD,CAAC,MAAM,SAAS,CAAC,GAAG,KAAK,GAAG,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,KAAK,EAAE,GAAW,EAA0B,EAAE;QAC3D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,KAAK,GAAG,GAAG,EAAE,EAAE,MAAM,CAAC,CAAA;QACzD,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACpD,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAA;QAC9B,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC7C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,KAAK,EAAE,GAAuB,EAA0B,EAAE;QAC5E,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QACpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA,CAAC,oDAAoD;QAE3F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,qGAAqG;YACrG,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;YACtD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC1C,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACnB,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;aAChC,CAAC,CAAA;YACF,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;YACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA,CAAC,+CAA+C;gBAC5E,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;YACjB,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC;gBAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA,CAAC,wCAAwC;gBACrE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;YACjB,CAAC;YACD,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;QAC/E,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QACnE,+FAA+F;QAC/F,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAA;QACpE,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IAChD,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CAAC,CAAiB,EAAsB,EAAE,CAC9D,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;QACxF,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAE3B,MAAM,GAAG,GAAG,CAAC,CAAiB,EAA0B,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;IAExF,uGAAuG;IACvG,iGAAiG;IACjG,MAAM,IAAI,GAAG,CAAC,OAAgB,EAA0B,EAAE,CACxD,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;QAC3D,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC;QACxB,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;IAE1E,MAAM,WAAW,GAAG,CAAC,CAAiB,EAAE,KAAa,EAAE,SAAiB,EAAQ,EAAE;QAChF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;QACzE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAA;IAED,gGAAgG;IAChG,MAAM,MAAM,GAAG,KAAK,EAAE,EAAU,EAAiB,EAAE;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAM;QAC/B,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAA;QAC/E,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACxB,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,CAAiB,EAAE,OAAsB,EAAiB,EAAE;QAChF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACxC,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,CAAA;QACtC,+EAA+E;QAC/E,MAAM,WAAW,GAAG,GAAG,EAAE,CAAA;QACzB,2FAA2F;QAC3F,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,IAAI,WAAW;YAAE,OAAM;QACzE,sFAAsF;QACtF,MAAM,SAAS,GACb,OAAO,IAAI,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,cAAc,CAAA;QACxF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAA;QAEtE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;gBACrD,6FAA6F;gBAC7F,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,cAAc,IAAI,GAAG,EAAE,CAAC;oBACpF,OAAM;YACV,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACrB,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;oBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA,CAAC,gCAAgC;gBACnF,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,IAAI,GAAG,EAAE;oBAAE,OAAM;gBACnE,KAAK,CAAC,EAAE,GAAG,SAAS,CAAA;gBACpB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAA;YAC1B,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,SAAS,CAAA;YACrC,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAA;YACvB,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAA0B,CAAC,CAAA;YACtE,gGAAgG;YAChG,6FAA6F;YAC7F,wEAAwE;YACxE,IAAI,MAAM,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpE,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC5B,OAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACnC,KAAK,CAAC,SAAS,GAAG,SAAS,CAAA;YAC3B,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;YACjC,OAAM;QACR,CAAC;QACD,0FAA0F;QAC1F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAoB,CAAC,CAAC,CAAA;QAChF,KAAK,CAAC,SAAS,GAAG,SAAS,CAAA;QAC3B,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IACnC,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,CAAiB,EAAE,OAAuB,EAAiB,EAAE;QAClF,MAAM,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,EAAsB,CAAA;YAC1B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,EAAE,GAAG,KAAK,EAAE,EAAE,CAAA;YAChB,CAAC;iBAAM,CAAC;gBACN,wFAAwF;gBACxF,0FAA0F;gBAC1F,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;gBAC5B,IAAI,GAAG,KAAK,SAAS;oBAAE,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAA;YAC9D,CAAC;YACD,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,MAAM,MAAM,CAAC,EAAE,CAAC,CAAA;QACxE,CAAC;QACD,gGAAgG;QAChG,8CAA8C;QAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,CAAC,EAAE,GAAG,SAAS,CAAA;YACpB,KAAK,CAAC,SAAS,GAAG,SAAS,CAAA;YAC3B,KAAK,CAAC,UAAU,GAAG,KAAK,CAAA;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,EAAE;YAC7B,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,GAAG;YAC5B,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,OAAsB,EAAQ,EAAE;QAClD,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,UAAU,GAAG,IAAI,CAAA;IAClD,CAAC,CAAA;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;AACnD,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAEL,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,WAAW,GACZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,eAAe,EACf,cAAc,EACd,cAAc,EACd,cAAc,EAGd,aAAa,GACd,MAAM,YAAY,CAAA;AAgFnB,MAAM,WAAW,GAAG,MAAM,CAAA;AAC1B,gGAAgG;AAChG,kGAAkG;AAClG,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAC3B,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAA;AAExC,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAU,EAAE;IACpD,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACpD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC7E,CAAC,CAAA;AAED,sGAAsG;AACtG,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE1F,qGAAqG;AACrG,qGAAqG;AACrG,2FAA2F;AAC3F,MAAM,UAAU,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAA;AAEnE,+FAA+F;AAC/F,sGAAsG;AACtG,gCAAgC;AAChC,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAOhC,2GAA2G;AAC3G,MAAM,YAAY,GAAG,CAAC,IAAY,EAAkB,EAAE;IACpD,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC5D,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IACrF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAClE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAA+B,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAA;AAChF,CAAC,CAAA;AAED,MAAM,UAAU,cAAc,CAC5B,OAAuB;IAEvB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACjC,oGAAoG;IACpG,IAAI,KAAK,EAAE,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,yEAAyE;YACzE,wDAAwD,CAC3D,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,gDAAgD,gBAAgB,8DAA8D,CAC/H,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAA;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,WAAW,CAAA;IAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,UAAU,CAAC,wEAAwE,CAAC,CAAA;IAChG,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAA;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,KAAK,IAAI,CAAA;IACzD,oGAAoG;IACpG,kGAAkG;IAClG,MAAM,UAAU,GAAyB,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IAQ7D,oGAAoG;IACpG,+BAA+B;IAC/B,MAAM,MAAM,GAAG,IAAI,OAAO,EAAwB,CAAA;IAElD,MAAM,IAAI,GAAG,CAAC,IAIb,EAAiB,EAAE;QAClB,MAAM,KAAK,GAAU;YACnB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,8FAA8F;YAC9F,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAqC,CAAC;YAClF,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,KAAK;SAClB,CAAA;QACD,MAAM,OAAO,GAAkB;YAC7B,GAAG,EAAE,CAAuB,GAAM,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAwB;YACjF,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC5B,CAAC;YACD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;gBACb,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACxB,CAAC;YACD,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACjC,KAAK,EAAE,GAAG,EAAE;gBACV,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;YACpB,CAAC;YACD,IAAI,IAAI;gBACN,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAA;YACxD,CAAC;YACD,IAAI,OAAO;gBACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAA;YAC9B,CAAC;SACF,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,CAAC,OAAsB,EAAE,EAAU,EAAS,EAAE;QAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,2CAA2C,CAAC,CAAA;QAChF,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,kGAAkG;IAClG,uFAAuF;IACvF,MAAM,KAAK,GAAG,GAAG,UAAU,IAAI,CAAA;IAC/B,MAAM,IAAI,GAAG,KAAK,EAAE,KAAa,EAAmB,EAAE,CACpD,CAAC,MAAM,SAAS,CAAC,GAAG,KAAK,GAAG,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,KAAK,EAAE,GAAW,EAA0B,EAAE;QAC3D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,KAAK,GAAG,GAAG,EAAE,EAAE,MAAM,CAAC,CAAA;QACzD,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACpD,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAA;QAC9B,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC7C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,KAAK,EAAE,GAAuB,EAA0B,EAAE;QAC5E,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QACpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA,CAAC,oDAAoD;QAE3F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,qGAAqG;YACrG,IAAI,eAAe,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;YAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;YACtC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAClE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACnB,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC/B,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,GAAG,cAAc,EAAE,CAAC;gBACzC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;aAChE,CAAC,CAAA;YACF,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;YACzC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAClF,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA,CAAC,+CAA+C;gBAC5E,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;YACjB,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC;gBAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA,CAAC,wCAAwC;gBACrE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;YACjB,CAAC;YACD,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;QAC/E,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QACnE,+FAA+F;QAC/F,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAA;QACpE,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IAChD,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CAAC,CAAiB,EAAsB,EAAE,CAC9D,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;QACxF,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAE3B,MAAM,GAAG,GAAG,CAAC,CAAiB,EAA0B,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;IAExF,uGAAuG;IACvG,iGAAiG;IACjG,MAAM,IAAI,GAAG,CAAC,OAAgB,EAA0B,EAAE,CACxD,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;QAC3D,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC;QACxB,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;IAE1E,MAAM,WAAW,GAAG,CAAC,CAAiB,EAAE,KAAa,EAAE,SAAiB,EAAQ,EAAE;QAChF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;QACzE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAA;IAED,gGAAgG;IAChG,MAAM,MAAM,GAAG,KAAK,EAAE,EAAU,EAAiB,EAAE;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAM;QAC/B,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAA;QAC9F,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACxB,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,CAAiB,EAAE,OAAsB,EAAiB,EAAE;QAChF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACxC,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,CAAA;QACtC,+EAA+E;QAC/E,MAAM,WAAW,GAAG,GAAG,EAAE,CAAA;QACzB,2FAA2F;QAC3F,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,IAAI,WAAW;YAAE,OAAM;QACzE,sFAAsF;QACtF,MAAM,SAAS,GACb,OAAO,IAAI,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,cAAc,CAAA;QACxF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAA;QAEtE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC3B,yFAAyF;gBACzF,6FAA6F;gBAC7F,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBACtC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACnE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnB,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC/B,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC;oBACzC,MAAM,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;iBAChE,CAAC,CAAA;gBACF,8FAA8F;gBAC9F,IACE,OAAO,KAAK,SAAS;oBACrB,OAAO,KAAK,SAAS;oBACrB,OAAO,KAAK,SAAS;oBACrB,aAAa,KAAK,SAAS;oBAC3B,CAAC,cAAc,KAAK,SAAS,IAAI,cAAc,IAAI,GAAG,EAAE,CAAC;oBAEzD,OAAM;YACV,CAAC;YACD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,SAAS,EAA0B,CAAA;YAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,CAAA;YACjE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,QAAQ,EAAE,EAAE,CAAA;gBAC3D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;oBACtE,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE;oBAChC,SAAS,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI;iBACvC,CAAC,CAAA;gBACF,IAAI,CAAC,OAAO;oBAAE,OAAM;gBACpB,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,IAAI,GAAG,EAAE,EAAE,CAAC;oBAC5D,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;oBACpB,OAAM;gBACR,CAAC;gBACD,KAAK,CAAC,EAAE,GAAG,MAAM,CAAA;YACnB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAA;gBACvB,6FAA6F;gBAC7F,sFAAsF;gBACtF,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;oBACjC,0FAA0F;oBAC1F,sEAAsE;oBACtE,IAAI,MAAM,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,IAAI,GAAG,EAAE,EAAE,CAAC;wBACtE,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;wBAC5B,OAAM;oBACR,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;oBAAE,OAAM;YAC7D,CAAC;YACD,KAAK,CAAC,UAAU,GAAG,KAAK,CAAA;YACxB,gGAAgG;YAChG,6FAA6F;YAC7F,wEAAwE;YACxE,IACE,MAAM;gBACN,CACE,MAAM,OAAO,CAAC,GAAG,CAAC;oBAChB,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC/B,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC;oBACzC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;iBAC/C,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,EACxC,CAAC;gBACD,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC5B,OAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACnC,IACE,UAAU,KAAK,SAAS;gBACxB,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS;oBACxC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,EACvE,CAAC;gBACD,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC5B,OAAM;YACR,CAAC;YACD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAA;YAC3B,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;YACjC,OAAM;QACR,CAAC;QACD,0FAA0F;QAC1F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAoB,CAAC,CAAC,CAAA;QAChF,KAAK,CAAC,SAAS,GAAG,SAAS,CAAA;QAC3B,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IACnC,CAAC,CAAA;IAED,+FAA+F;IAC/F,iGAAiG;IACjG,MAAM,eAAe,GAAG,KAAK,EAAE,WAAyB,EAAE,EAAU,EAAoB,EAAE;QACxF,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;SAC1C,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,MAAM,KAAK,SAAS,CAAA;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAA;QACtC,8FAA8F;QAC9F,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,CAAA;QAC3F,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,iBAAiB,CAAA;IAC9C,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,CAAiB,EAAE,OAAuB,EAAiB,EAAE;QAClF,MAAM,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,EAAE,GAAG,KAAK,EAAE,EAAE,CAAA;gBACpB,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;oBAAE,MAAM,MAAM,CAAC,EAAE,CAAC,CAAA;YAChE,CAAC;iBAAM,CAAC;gBACN,wFAAwF;gBACxF,0FAA0F;gBAC1F,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;gBAC5B,MAAM,EAAE,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;gBACvD,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;oBACxC,IAAI,MAAM,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC;wBAAE,MAAM,MAAM,CAAC,EAAE,CAAC,CAAA;;wBACjD,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QACD,gGAAgG;QAChG,8CAA8C;QAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,CAAC,EAAE,GAAG,SAAS,CAAA;YACpB,KAAK,CAAC,SAAS,GAAG,SAAS,CAAA;YAC3B,KAAK,CAAC,UAAU,GAAG,KAAK,CAAA;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,EAAE;YAC7B,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,GAAG;YAC5B,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,OAAsB,EAAQ,EAAE;QAClD,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,UAAU,GAAG,IAAI,CAAA;IAClD,CAAC,CAAA;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;AACnD,CAAC"}

package/dist/store.d.ts

@@ -1,7 +1,7 @@
 /**
  * Session stores (the **store mode** backend) - a pluggable `SessionStore` plus an in-memory
- * implementation (dev / single-instance, prod-guarded) and a Cloudflare Workers KV implementation
- * (the durable, shared production path). The store is dumb persistence: the session *manager* owns the
+ * implementation (dev / single-instance, prod-guarded). The legacy Cloudflare Workers KV adapter is
+ * retained for migration, but is not safe for session revocation. The session *manager* owns the
  * clock and authoritatively enforces expiry, so the store stays clock-free and trivially testable.
  */
 /** A persisted session - its data plus an absolute expiry (ms epoch). */
@@ -11,23 +11,49 @@ export interface SessionRecord {
     readonly expiresAt: number;
 }
 /**
- * Pluggable session backend (store mode). Async so a network store (KV/Redis) fits the same shape.
+ * Pluggable session backend (store mode). Reads must observe completed writes and deletes, including
+ * revocation markers, across all instances. Eventual consistency cannot provide logout guarantees.
  * **Production needs a shared/durable store** so sessions hold across instances - {@link MemorySessionStore}
  * prod-guards against the per-instance footgun. Logout and rotation also write a revocation marker, an
- * empty record under `<id>.revoked`, so a store must accept that key like any other, and keep it until
- * its `expiresAt`: a marker dropped earlier lets a request that loaded the session before the logout
- * write it back.
+ * empty record under `<id>.revoked`, and rotation one under `<id>.rotated`, so a store must accept those
+ * keys like any other and keep each until its `expiresAt`. A dropped marker lets a request that loaded
+ * the session before the logout write it back, unless the store implements `replace`; it also lets a
+ * rotated generation outlive a logout made with an earlier generation's cookie.
  */
 export interface SessionStore {
+    /** Read consistency. Omission asserts strong consistency for existing custom adapters. */
+    readonly consistency?: "strong" | "eventual";
     /** The record for `id`, or `undefined` on a miss. */
     get(id: string): Promise<SessionRecord | undefined>;
     /** Store (or overwrite) the record for `id`. */
     set(id: string, record: SessionRecord): Promise<void>;
     /** Drop `id` (logout / regeneration). A no-op if absent. */
     delete(id: string): Promise<void>;
+    /**
+     * Overwrite `id` only while it still holds a record, resolving whether it wrote. The check and the
+     * write must be one atomic step that also sets the new expiry, such as Redis
+     * `SET key value XX PXAT <record.expiresAt>` (a bare `XX` drops the key's TTL) or a SQL
+     * `UPDATE ... WHERE id = ?` that reports the rows it changed. Optional: when present, a loaded session renews through it instead
+     * of `set`, so a logout that lands between the renewal's checks and its write wins even after the
+     * logout's revocation marker is gone.
+     */
+    replace?(id: string, record: SessionRecord): Promise<boolean>;
+    /**
+     * Move the record at `previousId` to `nextId` only while it exists, is unrevoked and was not rotated
+     * already, resolving whether it moved. One atomic step writes `marker` under `<previousId>.rotated`,
+     * deletes `previousId` and stores `record` at `nextId`; it refuses when `<previousId>.revoked` or the
+     * revocation marker of the original ID (the part before `~`) exists. Optional: without it, rotation
+     * makes those writes one at a time and checks the revocation afterwards.
+     */
+    rotate?(previousId: string, nextId: string, record: SessionRecord, marker: SessionRecord): Promise<boolean>;
 }
 /** The suffix of a revocation marker's key: `<id>.revoked`. */
 export declare const REVOKED_SUFFIX = ".revoked";
+export declare const ROTATED_SUFFIX = ".rotated";
+export declare const sessionFamily: (id: string) => string;
+export declare const isSessionMarker: (id: string) => boolean;
+/** A generic store retains logout markers separately: rotating must never overwrite a racing logout. */
+export declare function rotateExisting(store: SessionStore, previousId: string, nextId: string, record: SessionRecord, marker: SessionRecord): Promise<boolean>;
 export interface MemorySessionStoreOptions {
     /** Allow the in-memory store in production. Off by default - per-instance sessions don't hold across
      * instances and are lost on restart. */
@@ -40,9 +66,13 @@ export interface MemorySessionStoreOptions {
  * In-process session store. Refuses to run in production unless explicitly allowed (mirrors the ISR
  * `MemoryCacheStore` + the rate-limit `MemoryStore` - a per-instance store is unsafe across instances).
  * Bounded: oldest-inserted entries evict past `max`, sessions and revocation markers each on their own.
+ * Because a marker can be evicted, it implements `replace`, so a request that loaded the session before
+ * a logout cannot restore it once the marker is gone.
  */
 export declare class MemorySessionStore implements SessionStore {
+    readonly consistency = "strong";
     private readonly sessions;
+    private readonly families;
     private readonly markers;
     private readonly max;
     constructor(options?: MemorySessionStoreOptions);
@@ -50,6 +80,10 @@ export declare class MemorySessionStore implements SessionStore {
     get(id: string): Promise<SessionRecord | undefined>;
     set(id: string, record: SessionRecord): Promise<void>;
     delete(id: string): Promise<void>;
+    replace(id: string, record: SessionRecord): Promise<boolean>;
+    rotate(previousId: string, nextId: string, record: SessionRecord, marker: SessionRecord): Promise<boolean>;
+    private write;
+    private removeSession;
 }
 /**
  * Minimal structural shape of a Cloudflare Workers **KV namespace** binding - just the three methods
@@ -65,13 +99,16 @@ export interface KVNamespaceLike {
     delete(key: string): Promise<void>;
 }
 /**
- * A {@link SessionStore} backed by a **Cloudflare Workers KV** namespace (or any {@link KVNamespaceLike})
- * - the durable, shared production store: sessions hold across worker instances and survive restarts.
+ * Legacy Cloudflare Workers KV persistence, retained for reading and migrating existing records.
+ * `createSessions` rejects this adapter: cached records and missing revocation markers can resurrect
+ * a logged-out session. Use a strongly consistent {@link SessionStore} for authenticated sessions.
  * Records serialize to JSON; the entry's KV `expiration` is set from the record's `expiresAt` so KV
  * auto-evicts the session (a GC backstop - the manager still authoritatively checks expiry on read).
  * Every read is validated, so a corrupt/skewed entry reads as no session.
+ * @deprecated Workers KV is eventually consistent and cannot enforce session revocation.
  */
 export declare class KVSessionStore implements SessionStore {
+    readonly consistency = "eventual";
     private readonly kv;
     private readonly now;
     constructor(kv: KVNamespaceLike, options?: {

package/dist/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;IACnD,gDAAgD;IAChD,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrD,4DAA4D;IAC5D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClC;AAED,+DAA+D;AAC/D,eAAO,MAAM,cAAc,aAAa,CAAA;AAExC,MAAM,WAAW,yBAAyB;IACxC;4CACwC;IACxC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC;+EAC2E;IAC3E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAG5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;gBAEhB,OAAO,GAAE,yBAA8B;IAenD,OAAO,CAAC,MAAM;IAId,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAInD,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAIlC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,8FAA8F;IAC9F,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1F,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAgBD;;;;;;GAMG;AACH,qBAAa,cAAe,YAAW,YAAY;IACjD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;gBAEtB,EAAE,EAAE,eAAe,EAAE,OAAO,GAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAKxE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAYnD,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAWrD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGxC"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAA;IAC5C,qDAAqD;IACrD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;IACnD,gDAAgD;IAChD,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrD,4DAA4D;IAC5D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7D;;;;;;OAMG;IACH,MAAM,CAAC,CACL,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,OAAO,CAAC,CAAA;CACpB;AAED,+DAA+D;AAC/D,eAAO,MAAM,cAAc,aAAa,CAAA;AACxC,eAAO,MAAM,cAAc,aAAa,CAAA;AAIxC,eAAO,MAAM,aAAa,GAAI,IAAI,MAAM,KAAG,MACQ,CAAA;AAEnD,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,OACe,CAAA;AAE5D,wGAAwG;AACxG,wBAAsB,cAAc,CAClC,KAAK,EAAE,YAAY,EACnB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,MAAM,WAAW,yBAAyB;IACxC;4CACwC;IACxC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC;+EAC2E;IAC3E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IACrD,QAAQ,CAAC,WAAW,YAAW;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAG1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;gBAEhB,OAAO,GAAE,yBAA8B;IAenD,OAAO,CAAC,MAAM;IAId,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAInD,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAO5D,MAAM,CACJ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,OAAO,CAAC;IAcnB,OAAO,CAAC,KAAK;IAoBb,OAAO,CAAC,aAAa;CAOtB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,8FAA8F;IAC9F,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1F,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAgBD;;;;;;;;GAQG;AACH,qBAAa,cAAe,YAAW,YAAY;IACjD,QAAQ,CAAC,WAAW,cAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;gBAEtB,EAAE,EAAE,eAAe,EAAE,OAAO,GAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAKxE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAYnD,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAWrD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGxC"}

package/dist/store.js

@@ -1,18 +1,40 @@
 /**
  * Session stores (the **store mode** backend) - a pluggable `SessionStore` plus an in-memory
- * implementation (dev / single-instance, prod-guarded) and a Cloudflare Workers KV implementation
- * (the durable, shared production path). The store is dumb persistence: the session *manager* owns the
+ * implementation (dev / single-instance, prod-guarded). The legacy Cloudflare Workers KV adapter is
+ * retained for migration, but is not safe for session revocation. The session *manager* owns the
  * clock and authoritatively enforces expiry, so the store stays clock-free and trivially testable.
  */
 /** The suffix of a revocation marker's key: `<id>.revoked`. */
 export const REVOKED_SUFFIX = ".revoked";
+export const ROTATED_SUFFIX = ".rotated";
+// A rotated cookie carries its original ID, so one logout revokes every generation. That ID
+// may be a legacy cookie's value of any length; a rotation only ever appends one random part.
+export const sessionFamily = (id) => /^([^~]+)~[A-Za-z0-9_-]{43}$/.exec(id)?.[1] ?? id;
+export const isSessionMarker = (id) => id.endsWith(REVOKED_SUFFIX) || id.endsWith(ROTATED_SUFFIX);
+/** A generic store retains logout markers separately: rotating must never overwrite a racing logout. */
+export async function rotateExisting(store, previousId, nextId, record, marker) {
+    if (store.rotate !== undefined)
+        return store.rotate(previousId, nextId, record, marker);
+    await store.set(`${previousId}${ROTATED_SUFFIX}`, marker);
+    await store.delete(previousId);
+    await store.set(nextId, record);
+    if ((await store.get(`${sessionFamily(previousId)}${REVOKED_SUFFIX}`)) !== undefined) {
+        await store.delete(nextId);
+        return false;
+    }
+    return true;
+}
 /**
  * In-process session store. Refuses to run in production unless explicitly allowed (mirrors the ISR
  * `MemoryCacheStore` + the rate-limit `MemoryStore` - a per-instance store is unsafe across instances).
  * Bounded: oldest-inserted entries evict past `max`, sessions and revocation markers each on their own.
+ * Because a marker can be evicted, it implements `replace`, so a request that loaded the session before
+ * a logout cannot restore it once the marker is gone.
  */
 export class MemorySessionStore {
+    consistency = "strong";
     sessions = new Map();
+    families = new Map();
     // Apart from the sessions: anonymous sessions written after a logout must not push its marker out.
     // Markers share one lifetime, so the oldest-inserted is the first to expire.
     markers = new Map();
@@ -21,7 +43,7 @@ export class MemorySessionStore {
         const isProd = typeof process !== "undefined" && process.env?.NODE_ENV === "production";
         if (options.allowInProduction !== true && isProd) {
             throw new Error("[nifra/auth] MemorySessionStore is per-instance and unsafe in production (sessions don't hold " +
-                "across instances and are lost on restart). Use a shared store (KVSessionStore, Redis), or " +
+                "across instances and are lost on restart). Use a strongly consistent shared store, or " +
                 "pass { allowInProduction: true } for a single-instance deploy.");
         }
         this.max = options.max ?? 10_000;
@@ -30,26 +52,78 @@ export class MemorySessionStore {
         }
     }
     mapFor(id) {
-        return id.endsWith(REVOKED_SUFFIX) ? this.markers : this.sessions;
+        return isSessionMarker(id) ? this.markers : this.sessions;
     }
     get(id) {
         return Promise.resolve(this.mapFor(id).get(id));
     }
     set(id, record) {
+        this.write(this.mapFor(id), id, record);
+        if (id.endsWith(REVOKED_SUFFIX)) {
+            const family = id.slice(0, -REVOKED_SUFFIX.length);
+            // A bounded marker can later be evicted. Remove every generation now so conditional renewals
+            // and rotations cannot restore it after that eviction.
+            const members = this.families.get(family);
+            if (members !== undefined)
+                for (const key of members)
+                    this.removeSession(key);
+        }
+        return Promise.resolve();
+    }
+    delete(id) {
+        if (isSessionMarker(id))
+            this.markers.delete(id);
+        else
+            this.removeSession(id);
+        return Promise.resolve();
+    }
+    replace(id, record) {
         const entries = this.mapFor(id);
+        if (!entries.has(id))
+            return Promise.resolve(false);
+        this.write(entries, id, record);
+        return Promise.resolve(true);
+    }
+    rotate(previousId, nextId, record, marker) {
+        if (!this.sessions.has(previousId) ||
+            this.markers.has(`${previousId}${REVOKED_SUFFIX}`) ||
+            this.markers.has(`${sessionFamily(previousId)}${REVOKED_SUFFIX}`) ||
+            this.markers.has(`${previousId}${ROTATED_SUFFIX}`))
+            return Promise.resolve(false);
+        this.write(this.markers, `${previousId}${ROTATED_SUFFIX}`, marker);
+        this.removeSession(previousId);
+        this.write(this.sessions, nextId, record);
+        return Promise.resolve(true);
+    }
+    write(entries, id, record) {
         entries.delete(id); // re-insert at the tail so Map order tracks recency for the bounded evict
         entries.set(id, record);
+        if (entries === this.sessions) {
+            const family = sessionFamily(id);
+            let members = this.families.get(family);
+            if (members === undefined) {
+                members = new Set();
+                this.families.set(family, members);
+            }
+            members.add(id);
+        }
         while (entries.size > this.max) {
             const oldest = entries.keys().next().value;
             if (oldest === undefined)
                 break;
-            entries.delete(oldest);
+            if (entries === this.sessions)
+                this.removeSession(oldest);
+            else
+                entries.delete(oldest);
         }
-        return Promise.resolve();
     }
-    delete(id) {
-        this.mapFor(id).delete(id);
-        return Promise.resolve();
+    removeSession(id) {
+        this.sessions.delete(id);
+        const family = sessionFamily(id);
+        const members = this.families.get(family);
+        members?.delete(id);
+        if (members?.size === 0)
+            this.families.delete(family);
     }
 }
 /** Structural validation of a KV-read value before it's trusted as a {@link SessionRecord}. The store
@@ -65,13 +139,16 @@ const isSessionRecord = (value) => {
         v.data !== null);
 };
 /**
- * A {@link SessionStore} backed by a **Cloudflare Workers KV** namespace (or any {@link KVNamespaceLike})
- * - the durable, shared production store: sessions hold across worker instances and survive restarts.
+ * Legacy Cloudflare Workers KV persistence, retained for reading and migrating existing records.
+ * `createSessions` rejects this adapter: cached records and missing revocation markers can resurrect
+ * a logged-out session. Use a strongly consistent {@link SessionStore} for authenticated sessions.
  * Records serialize to JSON; the entry's KV `expiration` is set from the record's `expiresAt` so KV
  * auto-evicts the session (a GC backstop - the manager still authoritatively checks expiry on read).
  * Every read is validated, so a corrupt/skewed entry reads as no session.
+ * @deprecated Workers KV is eventually consistent and cannot enforce session revocation.
  */
 export class KVSessionStore {
+    consistency = "eventual";
     kv;
     now;
     constructor(kv, options = {}) {

package/dist/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA0BH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAA;AAWxC;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACZ,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC5D,mGAAmG;IACnG,6EAA6E;IAC5D,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC1C,GAAG,CAAQ;IAE5B,YAAY,UAAqC,EAAE;QACjD,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAA;QACvF,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,gGAAgG;gBAC9F,4FAA4F;gBAC5F,gEAAgE,CACnE,CAAA;QACH,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,MAAM,CAAA;QAChC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,UAAU,CAAC,qEAAqE,CAAC,CAAA;QAC7F,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,EAAU;QACvB,OAAO,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAA;IACnE,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,GAAG,CAAC,EAAU,EAAE,MAAqB;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC/B,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA,CAAC,0EAA0E;QAC7F,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACvB,OAAO,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC1C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAK;YAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,MAAM,CAAC,EAAU;QACf,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC1B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;CACF;AAcD;;qEAEqE;AACrE,MAAM,eAAe,GAAG,CAAC,KAAc,EAA0B,EAAE;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,CAAC,IAAI,KAAK,IAAI,CAChB,CAAA;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACR,EAAE,CAAiB;IACnB,GAAG,CAAc;IAElC,YAAY,EAAmB,EAAE,UAA2C,EAAE;QAC5E,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAClC,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA,CAAC,0DAA0D;QAC7E,CAAC;QACD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU,EAAE,MAAqB;QACzC,kGAAkG;QAClG,mGAAmG;QACnG,oFAAoF;QACpF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,aAAa,CAAC,CAAA;QAC/E,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;YAC5C,UAAU;SACX,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC1B,CAAC;CACF"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoDH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAA;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAA;AAExC,4FAA4F;AAC5F,8FAA8F;AAC9F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAU,EAAU,EAAE,CAClD,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAEnD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,EAAU,EAAW,EAAE,CACrD,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;AAE5D,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAmB,EACnB,UAAkB,EAClB,MAAc,EACd,MAAqB,EACrB,MAAqB;IAErB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IACvF,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,GAAG,cAAc,EAAE,EAAE,MAAM,CAAC,CAAA;IACzD,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,GAAG,cAAc,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACrF,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC1B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACpB,WAAW,GAAG,QAAQ,CAAA;IACd,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC3C,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC1D,mGAAmG;IACnG,6EAA6E;IAC5D,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC1C,GAAG,CAAQ;IAE5B,YAAY,UAAqC,EAAE;QACjD,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAA;QACvF,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,gGAAgG;gBAC9F,wFAAwF;gBACxF,gEAAgE,CACnE,CAAA;QACH,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,MAAM,CAAA;QAChC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,UAAU,CAAC,qEAAqE,CAAC,CAAA;QAC7F,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,EAAU;QACvB,OAAO,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAA;IAC3D,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,GAAG,CAAC,EAAU,EAAE,MAAqB;QACnC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;YAClD,6FAA6F;YAC7F,uDAAuD;YACvD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACzC,IAAI,OAAO,KAAK,SAAS;gBAAE,KAAK,MAAM,GAAG,IAAI,OAAO;oBAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QAC/E,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,MAAM,CAAC,EAAU;QACf,IAAI,eAAe,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;;YAC3C,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;QAC3B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,OAAO,CAAC,EAAU,EAAE,MAAqB;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;QAC/B,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC;IAED,MAAM,CACJ,UAAkB,EAClB,MAAc,EACd,MAAqB,EACrB,MAAqB;QAErB,IACE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,GAAG,cAAc,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,GAAG,cAAc,EAAE,CAAC;YACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,GAAG,cAAc,EAAE,CAAC;YAElD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,cAAc,EAAE,EAAE,MAAM,CAAC,CAAA;QAClE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACzC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC;IAEO,KAAK,CAAC,OAAmC,EAAE,EAAU,EAAE,MAAqB;QAClF,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA,CAAC,0EAA0E;QAC7F,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACvB,IAAI,OAAO,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC,CAAA;YAChC,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,GAAG,IAAI,GAAG,EAAE,CAAA;gBACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YACpC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC1C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAK;YAC/B,IAAI,OAAO,KAAK,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;;gBACpD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,EAAU;QAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACxB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACzC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACnB,IAAI,OAAO,EAAE,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACvD,CAAC;CACF;AAcD;;qEAEqE;AACrE,MAAM,eAAe,GAAG,CAAC,KAAc,EAA0B,EAAE;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,CAAC,IAAI,KAAK,IAAI,CAChB,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,cAAc;IAChB,WAAW,GAAG,UAAU,CAAA;IAChB,EAAE,CAAiB;IACnB,GAAG,CAAc;IAElC,YAAY,EAAmB,EAAE,UAA2C,EAAE;QAC5E,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAClC,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA,CAAC,0DAA0D;QAC7E,CAAC;QACD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU,EAAE,MAAqB;QACzC,kGAAkG;QAClG,mGAAmG;QACnG,oFAAoF;QACpF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,aAAa,CAAC,CAAA;QAC/E,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;YAC5C,UAAU;SACX,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC1B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/auth",
-  "version": "5.4.0",
+  "version": "5.5.0",
   "description": "Session primitives for nifra - signed-cookie + server-store sessions, CSRF, and route guards. Bring your own identity (Better Auth / Lucia / OAuth); nifra owns the session.",
   "keywords": [
     "bun",
@@ -41,7 +41,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@nifrajs/core": "^5.4.0"
+    "@nifrajs/core": "^5.5.0"
   },
   "devDependencies": {
     "@nifrajs/core": "workspace:*"

package/src/session.ts

@@ -16,7 +16,15 @@ import {
   signValue,
   unsignValue,
 } from "@nifrajs/core/cookies"
-import { REVOKED_SUFFIX, type SessionRecord, type SessionStore } from "./store.ts"
+import {
+  isSessionMarker,
+  REVOKED_SUFFIX,
+  ROTATED_SUFFIX,
+  rotateExisting,
+  type SessionRecord,
+  type SessionStore,
+  sessionFamily,
+} from "./store.ts"
 
 /** The cookie + response surface the manager needs - a structural subset of nifra's `Context`, so any
  * `c` satisfies it and it's testable with a stub. */
@@ -53,7 +61,8 @@ export interface SessionOptions {
    * secret, drop the old one after `maxAge` has elapsed. A bare secret swap (no list) invalidates
    * all existing sessions. */
   readonly secret: string | readonly string[]
-  /** Provide a store for **store mode**; omit for **cookie mode** (stateless). */
+  /** Strongly consistent backend for **store mode**; omit for **cookie mode** (stateless).
+   * Declared eventually consistent stores (including KVSessionStore) are refused. */
   readonly store?: SessionStore
   /** Cookie name. Default `nifra_session`. */
   readonly cookieName?: string
@@ -116,6 +125,11 @@ const randomId = (): string => encodeBase64Url(crypto.getRandomValues(new Uint8A
 // but it cannot overwrite a key it never writes. `.` is outside the base64url id alphabet.
 const revokedKey = (id: string): string => `${id}${REVOKED_SUFFIX}`
 
+// A superseded cookie is still the user's own while the rotating response is on its way to the
+// browser. Past that it is a copy someone else kept (a planted pre-login cookie), and it must not end
+// the session that replaced it.
+const ROTATION_GRACE_MS = 60_000
+
 interface Payload {
   data: Record<string, unknown>
   expiresAt: number
@@ -140,6 +154,14 @@ export function createSessions<Data extends Record<string, unknown> = Record<str
   options: SessionOptions,
 ): SessionManager<Data> {
   const { secret, store } = options
+  // A cached marker miss can authenticate or recreate a session after logout, even with fixed expiry.
+  if (store?.consistency !== undefined && store.consistency !== "strong") {
+    throw new Error(
+      "[nifra/auth] sessions require a strongly consistent store for logout and rotation; " +
+        "eventually consistent stores such as KVSessionStore are not supported. " +
+        "Use a strongly consistent shared SessionStore instead.",
+    )
+  }
   const secretList = typeof secret === "string" ? [secret] : secret
   if (secretList.length === 0) {
     throw new Error("[nifra/auth] session secret list cannot be empty")
@@ -237,13 +259,16 @@ export function createSessions<Data extends Record<string, unknown> = Record<str
 
     if (store !== undefined) {
       // Only reachable with a value the app signed itself (legacy mode): never read a marker as a session.
-      if (unsigned.endsWith(REVOKED_SUFFIX)) return make({})
-      const [record, revoked] = await Promise.all([
+      if (isSessionMarker(unsigned)) return make({})
+      const family = sessionFamily(unsigned)
+      const [record, revoked, rotated, familyRevoked] = await Promise.all([
         store.get(unsigned),
         store.get(revokedKey(unsigned)),
+        store.get(`${unsigned}${ROTATED_SUFFIX}`),
+        family === unsigned ? undefined : store.get(revokedKey(family)),
       ])
       if (record === undefined) return make({})
-      if (revoked !== undefined) {
+      if (revoked !== undefined || rotated !== undefined || familyRevoked !== undefined) {
         await store.delete(unsigned) // a commit that raced the logout wrote it back
         return make({})
       }
@@ -284,7 +309,7 @@ export function createSessions<Data extends Record<string, unknown> = Record<str
   // Marker first: a racing commit's write either precedes the delete below or follows the marker.
   const revoke = async (id: string): Promise<void> => {
     if (store === undefined) return
-    await store.set(revokedKey(id), { data: {}, expiresAt: now() + maxAge * 1000 })
+    await store.set(revokedKey(sessionFamily(id)), { data: {}, expiresAt: now() + maxAge * 1000 })
     await store.delete(id)
   }
 
@@ -302,28 +327,80 @@ export function createSessions<Data extends Record<string, unknown> = Record<str
 
     if (store !== undefined) {
       if (state.id !== undefined) {
-        const revoked = await store.get(revokedKey(state.id))
-        // Check again after the read: a delayed store operation can outlive both session and marker.
-        if (revoked !== undefined || (previousExpiry !== undefined && previousExpiry <= now()))
+        // A loaded session commits only while its record exists and no logout has marked it. The
+        // record covers a marker already evicted; the marker covers a logout between its two writes.
+        const family = sessionFamily(state.id)
+        const [current, revoked, rotated, familyRevoked] = await Promise.all([
+          store.get(state.id),
+          store.get(revokedKey(state.id)),
+          store.get(`${state.id}${ROTATED_SUFFIX}`),
+          family === state.id ? undefined : store.get(revokedKey(family)),
+        ])
+        // Check again after the reads: a delayed store operation can outlive both session and marker.
+        if (
+          current === undefined ||
+          revoked !== undefined ||
+          rotated !== undefined ||
+          familyRevoked !== undefined ||
+          (previousExpiry !== undefined && previousExpiry <= now())
+        )
           return
       }
-      if (state.regenerate) {
-        if (state.id !== undefined) await revoke(state.id) // drop the pre-rotation session
-        if (previousExpiry !== undefined && previousExpiry <= now()) return
-        state.id = undefined
-        state.regenerate = false
+      const record = { data, expiresAt } satisfies SessionRecord
+      const previousId = state.regenerate ? state.id : undefined
+      const loaded = state.id !== undefined && previousId === undefined
+      if (previousId !== undefined) {
+        const nextId = `${sessionFamily(previousId)}~${randomId()}`
+        const rotated = await rotateExisting(store, previousId, nextId, record, {
+          data: { rotatedAt: committedAt },
+          expiresAt: committedAt + maxAge * 1000,
+        })
+        if (!rotated) return
+        if (previousExpiry !== undefined && previousExpiry <= now()) {
+          await revoke(nextId)
+          return
+        }
+        state.id = nextId
+      } else {
+        state.id ??= randomId()
+        // A store with `replace` makes the renewal conditional, so a logout landing after the checks
+        // above wins outright; any other store relies on keeping the marker until it expires.
+        if (!loaded || store.replace === undefined) {
+          await store.set(state.id, record)
+          // The renewed record may have expired while the write was in flight, and a logout in that
+          // gap found nothing to mark, so the write would revive what it ended.
+          if (loaded && previousExpiry !== undefined && previousExpiry <= now()) {
+            await store.delete(state.id)
+            return
+          }
+        } else if (!(await store.replace(state.id, record))) return
       }
-      const loaded = state.id !== undefined
-      state.id ??= randomId()
-      await store.set(state.id, { data, expiresAt } satisfies SessionRecord)
+      state.regenerate = false
       // Checked after the write: a revocation that lands before it is seen here, one that lands after
       // it deletes the record itself. Either way the cookie is left alone - the browser may hold a
       // newer session by now, and this response must not replace or clear it.
-      if (loaded && (await store.get(revokedKey(state.id))) !== undefined) {
+      if (
+        loaded &&
+        (
+          await Promise.all([
+            store.get(revokedKey(state.id)),
+            store.get(`${state.id}${ROTATED_SUFFIX}`),
+            store.get(revokedKey(sessionFamily(state.id))),
+          ])
+        ).some((marker) => marker !== undefined)
+      ) {
         await store.delete(state.id)
         return
       }
       const signed = await sign(state.id)
+      if (
+        previousId !== undefined &&
+        ((await store.get(state.id)) === undefined ||
+          (await store.get(revokedKey(sessionFamily(state.id)))) !== undefined)
+      ) {
+        await store.delete(state.id)
+        return
+      }
       state.expiresAt = expiresAt
       writeCookie(c, signed, expiresAt)
       return
@@ -334,19 +411,36 @@ export function createSessions<Data extends Record<string, unknown> = Record<str
     writeCookie(c, signed, expiresAt)
   }
 
+  // Whether logging out with this id may end its whole family: the live generation always may, a
+  // rotated-away one only within the grace window, and an id with neither record nor marker never.
+  const speaksForFamily = async (activeStore: SessionStore, id: string): Promise<boolean> => {
+    const [record, rotated] = await Promise.all([
+      activeStore.get(id),
+      activeStore.get(`${id}${ROTATED_SUFFIX}`),
+    ])
+    if (rotated === undefined) return record !== undefined
+    const stamped = rotated.data.rotatedAt
+    // Markers written before the stamp existed carry the rotation time only through their expiry.
+    const rotatedAt = typeof stamped === "number" ? stamped : rotated.expiresAt - maxAge * 1000
+    return now() - rotatedAt < ROTATION_GRACE_MS
+  }
+
   const destroy = async (c: SessionContext, session?: Session<Data>): Promise<void> => {
     const state = session === undefined ? undefined : states.get(session)
     if (store !== undefined) {
-      let id: string | undefined
       if (session !== undefined) {
-        id = state?.id
+        const id = state?.id
+        if (id !== undefined && !isSessionMarker(id)) await revoke(id)
       } else {
         // Revoke the record addressed by the signed request cookie even when the caller did not
         // first load a Session object. The signature check prevents deleting attacker-chosen IDs.
         const raw = sessionCookie(c)
-        if (raw !== undefined) id = (await unsign(raw)) ?? undefined
+        const id = raw === undefined ? null : await unsign(raw)
+        if (id !== null && !isSessionMarker(id)) {
+          if (await speaksForFamily(store, id)) await revoke(id)
+          else await store.delete(id)
+        }
       }
-      if (id !== undefined && !id.endsWith(REVOKED_SUFFIX)) await revoke(id)
     }
     // A later commit of this object must neither write the ended data back (cookie mode) nor vanish
     // against the revocation marker (store mode).

package/src/store.ts

@@ -1,7 +1,7 @@
 /**
  * Session stores (the **store mode** backend) - a pluggable `SessionStore` plus an in-memory
- * implementation (dev / single-instance, prod-guarded) and a Cloudflare Workers KV implementation
- * (the durable, shared production path). The store is dumb persistence: the session *manager* owns the
+ * implementation (dev / single-instance, prod-guarded). The legacy Cloudflare Workers KV adapter is
+ * retained for migration, but is not safe for session revocation. The session *manager* owns the
  * clock and authoritatively enforces expiry, so the store stays clock-free and trivially testable.
  */
 
@@ -13,24 +13,78 @@ export interface SessionRecord {
 }
 
 /**
- * Pluggable session backend (store mode). Async so a network store (KV/Redis) fits the same shape.
+ * Pluggable session backend (store mode). Reads must observe completed writes and deletes, including
+ * revocation markers, across all instances. Eventual consistency cannot provide logout guarantees.
  * **Production needs a shared/durable store** so sessions hold across instances - {@link MemorySessionStore}
  * prod-guards against the per-instance footgun. Logout and rotation also write a revocation marker, an
- * empty record under `<id>.revoked`, so a store must accept that key like any other, and keep it until
- * its `expiresAt`: a marker dropped earlier lets a request that loaded the session before the logout
- * write it back.
+ * empty record under `<id>.revoked`, and rotation one under `<id>.rotated`, so a store must accept those
+ * keys like any other and keep each until its `expiresAt`. A dropped marker lets a request that loaded
+ * the session before the logout write it back, unless the store implements `replace`; it also lets a
+ * rotated generation outlive a logout made with an earlier generation's cookie.
  */
 export interface SessionStore {
+  /** Read consistency. Omission asserts strong consistency for existing custom adapters. */
+  readonly consistency?: "strong" | "eventual"
   /** The record for `id`, or `undefined` on a miss. */
   get(id: string): Promise<SessionRecord | undefined>
   /** Store (or overwrite) the record for `id`. */
   set(id: string, record: SessionRecord): Promise<void>
   /** Drop `id` (logout / regeneration). A no-op if absent. */
   delete(id: string): Promise<void>
+  /**
+   * Overwrite `id` only while it still holds a record, resolving whether it wrote. The check and the
+   * write must be one atomic step that also sets the new expiry, such as Redis
+   * `SET key value XX PXAT <record.expiresAt>` (a bare `XX` drops the key's TTL) or a SQL
+   * `UPDATE ... WHERE id = ?` that reports the rows it changed. Optional: when present, a loaded session renews through it instead
+   * of `set`, so a logout that lands between the renewal's checks and its write wins even after the
+   * logout's revocation marker is gone.
+   */
+  replace?(id: string, record: SessionRecord): Promise<boolean>
+  /**
+   * Move the record at `previousId` to `nextId` only while it exists, is unrevoked and was not rotated
+   * already, resolving whether it moved. One atomic step writes `marker` under `<previousId>.rotated`,
+   * deletes `previousId` and stores `record` at `nextId`; it refuses when `<previousId>.revoked` or the
+   * revocation marker of the original ID (the part before `~`) exists. Optional: without it, rotation
+   * makes those writes one at a time and checks the revocation afterwards.
+   */
+  rotate?(
+    previousId: string,
+    nextId: string,
+    record: SessionRecord,
+    marker: SessionRecord,
+  ): Promise<boolean>
 }
 
 /** The suffix of a revocation marker's key: `<id>.revoked`. */
 export const REVOKED_SUFFIX = ".revoked"
+export const ROTATED_SUFFIX = ".rotated"
+
+// A rotated cookie carries its original ID, so one logout revokes every generation. That ID
+// may be a legacy cookie's value of any length; a rotation only ever appends one random part.
+export const sessionFamily = (id: string): string =>
+  /^([^~]+)~[A-Za-z0-9_-]{43}$/.exec(id)?.[1] ?? id
+
+export const isSessionMarker = (id: string): boolean =>
+  id.endsWith(REVOKED_SUFFIX) || id.endsWith(ROTATED_SUFFIX)
+
+/** A generic store retains logout markers separately: rotating must never overwrite a racing logout. */
+export async function rotateExisting(
+  store: SessionStore,
+  previousId: string,
+  nextId: string,
+  record: SessionRecord,
+  marker: SessionRecord,
+): Promise<boolean> {
+  if (store.rotate !== undefined) return store.rotate(previousId, nextId, record, marker)
+  await store.set(`${previousId}${ROTATED_SUFFIX}`, marker)
+  await store.delete(previousId)
+  await store.set(nextId, record)
+  if ((await store.get(`${sessionFamily(previousId)}${REVOKED_SUFFIX}`)) !== undefined) {
+    await store.delete(nextId)
+    return false
+  }
+  return true
+}
 
 export interface MemorySessionStoreOptions {
   /** Allow the in-memory store in production. Off by default - per-instance sessions don't hold across
@@ -45,9 +99,13 @@ export interface MemorySessionStoreOptions {
  * In-process session store. Refuses to run in production unless explicitly allowed (mirrors the ISR
  * `MemoryCacheStore` + the rate-limit `MemoryStore` - a per-instance store is unsafe across instances).
  * Bounded: oldest-inserted entries evict past `max`, sessions and revocation markers each on their own.
+ * Because a marker can be evicted, it implements `replace`, so a request that loaded the session before
+ * a logout cannot restore it once the marker is gone.
  */
 export class MemorySessionStore implements SessionStore {
+  readonly consistency = "strong"
   private readonly sessions = new Map<string, SessionRecord>()
+  private readonly families = new Map<string, Set<string>>()
   // Apart from the sessions: anonymous sessions written after a logout must not push its marker out.
   // Markers share one lifetime, so the oldest-inserted is the first to expire.
   private readonly markers = new Map<string, SessionRecord>()
@@ -58,7 +116,7 @@ export class MemorySessionStore implements SessionStore {
     if (options.allowInProduction !== true && isProd) {
       throw new Error(
         "[nifra/auth] MemorySessionStore is per-instance and unsafe in production (sessions don't hold " +
-          "across instances and are lost on restart). Use a shared store (KVSessionStore, Redis), or " +
+          "across instances and are lost on restart). Use a strongly consistent shared store, or " +
           "pass { allowInProduction: true } for a single-instance deploy.",
       )
     }
@@ -69,7 +127,7 @@ export class MemorySessionStore implements SessionStore {
   }
 
   private mapFor(id: string): Map<string, SessionRecord> {
-    return id.endsWith(REVOKED_SUFFIX) ? this.markers : this.sessions
+    return isSessionMarker(id) ? this.markers : this.sessions
   }
 
   get(id: string): Promise<SessionRecord | undefined> {
@@ -77,20 +135,75 @@ export class MemorySessionStore implements SessionStore {
   }
 
   set(id: string, record: SessionRecord): Promise<void> {
+    this.write(this.mapFor(id), id, record)
+    if (id.endsWith(REVOKED_SUFFIX)) {
+      const family = id.slice(0, -REVOKED_SUFFIX.length)
+      // A bounded marker can later be evicted. Remove every generation now so conditional renewals
+      // and rotations cannot restore it after that eviction.
+      const members = this.families.get(family)
+      if (members !== undefined) for (const key of members) this.removeSession(key)
+    }
+    return Promise.resolve()
+  }
+
+  delete(id: string): Promise<void> {
+    if (isSessionMarker(id)) this.markers.delete(id)
+    else this.removeSession(id)
+    return Promise.resolve()
+  }
+
+  replace(id: string, record: SessionRecord): Promise<boolean> {
     const entries = this.mapFor(id)
+    if (!entries.has(id)) return Promise.resolve(false)
+    this.write(entries, id, record)
+    return Promise.resolve(true)
+  }
+
+  rotate(
+    previousId: string,
+    nextId: string,
+    record: SessionRecord,
+    marker: SessionRecord,
+  ): Promise<boolean> {
+    if (
+      !this.sessions.has(previousId) ||
+      this.markers.has(`${previousId}${REVOKED_SUFFIX}`) ||
+      this.markers.has(`${sessionFamily(previousId)}${REVOKED_SUFFIX}`) ||
+      this.markers.has(`${previousId}${ROTATED_SUFFIX}`)
+    )
+      return Promise.resolve(false)
+    this.write(this.markers, `${previousId}${ROTATED_SUFFIX}`, marker)
+    this.removeSession(previousId)
+    this.write(this.sessions, nextId, record)
+    return Promise.resolve(true)
+  }
+
+  private write(entries: Map<string, SessionRecord>, id: string, record: SessionRecord): void {
     entries.delete(id) // re-insert at the tail so Map order tracks recency for the bounded evict
     entries.set(id, record)
+    if (entries === this.sessions) {
+      const family = sessionFamily(id)
+      let members = this.families.get(family)
+      if (members === undefined) {
+        members = new Set()
+        this.families.set(family, members)
+      }
+      members.add(id)
+    }
     while (entries.size > this.max) {
       const oldest = entries.keys().next().value
       if (oldest === undefined) break
-      entries.delete(oldest)
+      if (entries === this.sessions) this.removeSession(oldest)
+      else entries.delete(oldest)
     }
-    return Promise.resolve()
   }
 
-  delete(id: string): Promise<void> {
-    this.mapFor(id).delete(id)
-    return Promise.resolve()
+  private removeSession(id: string): void {
+    this.sessions.delete(id)
+    const family = sessionFamily(id)
+    const members = this.families.get(family)
+    members?.delete(id)
+    if (members?.size === 0) this.families.delete(family)
   }
 }
 
@@ -121,13 +234,16 @@ const isSessionRecord = (value: unknown): value is SessionRecord => {
 }
 
 /**
- * A {@link SessionStore} backed by a **Cloudflare Workers KV** namespace (or any {@link KVNamespaceLike})
- * - the durable, shared production store: sessions hold across worker instances and survive restarts.
+ * Legacy Cloudflare Workers KV persistence, retained for reading and migrating existing records.
+ * `createSessions` rejects this adapter: cached records and missing revocation markers can resurrect
+ * a logged-out session. Use a strongly consistent {@link SessionStore} for authenticated sessions.
  * Records serialize to JSON; the entry's KV `expiration` is set from the record's `expiresAt` so KV
  * auto-evicts the session (a GC backstop - the manager still authoritatively checks expiry on read).
  * Every read is validated, so a corrupt/skewed entry reads as no session.
+ * @deprecated Workers KV is eventually consistent and cannot enforce session revocation.
  */
 export class KVSessionStore implements SessionStore {
+  readonly consistency = "eventual"
   private readonly kv: KVNamespaceLike
   private readonly now: () => number