@puzzle-ui/session 0.0.0-stage → 0.5.1

package/dist/session.manager.cjs

@@ -0,0 +1,289 @@
+const require_session_errors = require("./errors/session.errors.cjs");
+const require_session_crypto = require("./utils/session-crypto.cjs");
+const require_session_storage = require("./session.storage.cjs");
+let _puzzle_ui_storage = require("@puzzle-ui/storage");
+// src/session.manager.ts
+const DEFAULT_OPTIONS = {
+	lifetime: {
+		idleTimeoutSeconds: 604800,
+		absoluteLifetimeSeconds: 2592e3
+	},
+	maximumSessionsPerUser: 10,
+	touchIntervalSeconds: 60
+};
+const toPublicSession = (record) => ({
+	id: record.id,
+	tokenHash: record.tokenHash,
+	userId: record.userId,
+	kind: record.kind,
+	createdAt: record.createdAt,
+	lastSeenAt: record.lastSeenAt,
+	expiresAt: record.expiresAt,
+	revokedAt: record.revokedAt,
+	metadata: record.metadata
+});
+const isActive = (session, now) => session.revokedAt === null && session.expiresAt.getTime() > now.getTime();
+const validateOptions = (options) => {
+	const { idleTimeoutSeconds, absoluteLifetimeSeconds } = options.lifetime;
+	if (!Number.isFinite(idleTimeoutSeconds) || !Number.isFinite(absoluteLifetimeSeconds) || idleTimeoutSeconds <= 0 || absoluteLifetimeSeconds <= 0 || idleTimeoutSeconds > absoluteLifetimeSeconds) throw new require_session_errors.SessionConfigurationError("Session lifetimes must be positive and the idle timeout cannot exceed the absolute lifetime.");
+	if (options.maximumSessionsPerUser !== void 0 && (!Number.isInteger(options.maximumSessionsPerUser) || options.maximumSessionsPerUser < 1)) throw new require_session_errors.SessionConfigurationError("maximumSessionsPerUser must be a positive integer.");
+	if (options.touchIntervalSeconds !== void 0 && (!Number.isFinite(options.touchIntervalSeconds) || options.touchIntervalSeconds < 0)) throw new require_session_errors.SessionConfigurationError("touchIntervalSeconds must be a non-negative number.");
+};
+var StorageSessionManager = class {
+	storage;
+	options;
+	collection;
+	clock;
+	constructor(storage, options = {}) {
+		this.storage = storage;
+		this.options = {
+			...DEFAULT_OPTIONS,
+			...options,
+			lifetime: {
+				...DEFAULT_OPTIONS.lifetime,
+				...options.lifetime
+			}
+		};
+		validateOptions(this.options);
+		this.collection = options.collectionName ?? "sessions";
+		this.clock = options.clock ?? (() => /* @__PURE__ */ new Date());
+		if (!storage.capabilities.uniqueConstraints || !storage.capabilities.conditionalWrites || !storage.capabilities.atomicBatch) throw new require_session_errors.SessionConfigurationError("The storage adapter does not support the atomicity required by session management.");
+	}
+	async initialize() {
+		await this.storage.registerCollection({
+			...require_session_storage.sessionCollection,
+			name: this.collection
+		});
+		await this.storage.registerCollection(require_session_storage.sessionUserLockCollection);
+	}
+	now() {
+		return this.clock();
+	}
+	absoluteExpiry(createdAt) {
+		return new Date(createdAt.getTime() + this.options.lifetime.absoluteLifetimeSeconds * 1e3);
+	}
+	idleExpiry(lastSeenAt) {
+		return new Date(lastSeenAt.getTime() + this.options.lifetime.idleTimeoutSeconds * 1e3);
+	}
+	effectiveExpiry(createdAt, lastSeenAt) {
+		return new Date(Math.min(this.absoluteExpiry(createdAt).getTime(), this.idleExpiry(lastSeenAt).getTime()));
+	}
+	async createRecord(input, now) {
+		if (input.kind === "authenticated" && !input.userId) throw new require_session_errors.SessionConfigurationError("Authenticated sessions require a user ID.");
+		if (input.kind === "anonymous" && input.userId !== null) throw new require_session_errors.SessionConfigurationError("Anonymous sessions cannot have a user ID.");
+		const token = require_session_crypto.generateSessionToken();
+		const tokenHash = await require_session_crypto.hashSessionToken(token);
+		const absoluteExpiry = this.absoluteExpiry(now);
+		const requestedExpiry = input.expiresAt ?? absoluteExpiry;
+		if (!(requestedExpiry instanceof Date) || !Number.isFinite(requestedExpiry.getTime()) || requestedExpiry.getTime() <= now.getTime()) throw new require_session_errors.SessionConfigurationError("Session expiration must be a valid future date.");
+		const record = {
+			id: require_session_crypto.generateSessionId(),
+			tokenHash,
+			userId: input.userId,
+			kind: input.kind,
+			createdAt: now,
+			updatedAt: now,
+			revision: 1,
+			lastSeenAt: now,
+			expiresAt: new Date(Math.min(requestedExpiry.getTime(), absoluteExpiry.getTime(), this.idleExpiry(now).getTime())),
+			revokedAt: null,
+			metadata: input.metadata
+		};
+		return {
+			session: toPublicSession(record),
+			token
+		};
+	}
+	toStorageRecord(session) {
+		return {
+			...session,
+			updatedAt: session.lastSeenAt,
+			revision: 1
+		};
+	}
+	async create(input) {
+		const created = await this.createRecord(input, this.now());
+		if (!input.userId) {
+			await this.storage.insert(this.collection, this.toStorageRecord(created.session));
+			return created;
+		}
+		await this.createAuthenticatedSessionAtomically(input.userId, created);
+		return created;
+	}
+	async createAuthenticatedSessionAtomically(userId, created) {
+		const maximum = this.options.maximumSessionsPerUser;
+		for (let attempt = 0; attempt < 8; attempt++) {
+			const now = this.now();
+			const lock = await this.storage.findOne(require_session_storage.SESSION_USER_LOCK_COLLECTION, { where: { userId: {
+				operator: "eq",
+				value: userId
+			} } });
+			const active = (await this.storage.findMany(this.collection, {
+				where: {
+					userId: {
+						operator: "eq",
+						value: userId
+					},
+					revokedAt: {
+						operator: "eq",
+						value: null
+					}
+				},
+				orderBy: [{
+					field: "lastSeenAt",
+					direction: "desc"
+				}, {
+					field: "createdAt",
+					direction: "desc"
+				}]
+			})).filter((session) => isActive(session, now));
+			const excess = maximum === void 0 ? [] : active.slice(Math.max(0, maximum - 1));
+			const operations = [];
+			if (lock) operations.push({
+				type: "update",
+				collection: require_session_storage.SESSION_USER_LOCK_COLLECTION,
+				id: lock.id,
+				condition: { expectedRevision: lock.revision },
+				changes: {}
+			});
+			else operations.push({
+				type: "insert",
+				collection: require_session_storage.SESSION_USER_LOCK_COLLECTION,
+				record: {
+					id: require_session_crypto.generateSessionId(),
+					userId,
+					createdAt: now,
+					updatedAt: now,
+					revision: 1
+				}
+			});
+			operations.push({
+				type: "insert",
+				collection: this.collection,
+				record: this.toStorageRecord(created.session)
+			});
+			for (const session of excess) operations.push({
+				type: "update",
+				collection: this.collection,
+				id: session.id,
+				condition: { expectedRevision: session.revision },
+				changes: { revokedAt: now }
+			});
+			try {
+				await this.storage.atomicBatch(operations);
+				return;
+			} catch (error) {
+				if (error instanceof _puzzle_ui_storage.StorageConflictError || error instanceof _puzzle_ui_storage.StorageDuplicateError) continue;
+				throw error;
+			}
+		}
+		throw new require_session_errors.SessionConfigurationError("Could not acquire the user session concurrency lock after repeated conflicts.");
+	}
+	async validate(token, options = {}) {
+		if (!token) return null;
+		const tokenHash = await require_session_crypto.hashSessionToken(token);
+		const session = await this.storage.findOne(this.collection, { where: { tokenHash: {
+			operator: "eq",
+			value: tokenHash
+		} } });
+		if (!session) return null;
+		const now = this.now();
+		if (!isActive(session, now)) return null;
+		if (this.idleExpiry(session.lastSeenAt).getTime() <= now.getTime() || this.absoluteExpiry(session.createdAt).getTime() <= now.getTime()) {
+			await this.revoke(session.id);
+			return null;
+		}
+		if (!(options.touch !== false && now.getTime() - session.lastSeenAt.getTime() >= (this.options.touchIntervalSeconds ?? 60) * 1e3)) return toPublicSession(session);
+		try {
+			const updated = await this.storage.update(this.collection, session.id, {
+				lastSeenAt: now,
+				expiresAt: this.effectiveExpiry(session.createdAt, now)
+			}, { expectedRevision: session.revision });
+			return updated ? toPublicSession(updated) : null;
+		} catch (error) {
+			if (error instanceof _puzzle_ui_storage.StorageConflictError) return null;
+			throw error;
+		}
+	}
+	async get(sessionId) {
+		const session = await this.storage.findById(this.collection, sessionId);
+		if (!session || !isActive(session, this.now())) return null;
+		const now = this.now();
+		if (this.idleExpiry(session.lastSeenAt).getTime() <= now.getTime() || this.absoluteExpiry(session.createdAt).getTime() <= now.getTime()) {
+			await this.revoke(sessionId);
+			return null;
+		}
+		return toPublicSession(session);
+	}
+	async rotate(input) {
+		const current = await this.storage.findById(this.collection, input.sessionId);
+		const now = this.now();
+		if (!current || !isActive(current, now) || this.idleExpiry(current.lastSeenAt).getTime() <= now.getTime() || this.absoluteExpiry(current.createdAt).getTime() <= now.getTime()) throw new require_session_errors.SessionNotFoundError();
+		const created = await this.createRecord({
+			userId: current.userId,
+			kind: current.kind,
+			metadata: input.metadata ?? current.metadata
+		}, now);
+		const operations = [{
+			type: "insert",
+			collection: this.collection,
+			record: this.toStorageRecord(created.session)
+		}, {
+			type: "update",
+			collection: this.collection,
+			id: current.id,
+			condition: { expectedRevision: current.revision },
+			changes: { revokedAt: now }
+		}];
+		await this.storage.atomicBatch(operations);
+		return created;
+	}
+	async revoke(sessionId) {
+		const session = await this.storage.findById(this.collection, sessionId);
+		if (!session || session.revokedAt) return;
+		await this.storage.update(this.collection, sessionId, { revokedAt: this.now() }, { expectedRevision: session.revision });
+	}
+	async revokeAll(userId) {
+		if (!userId) throw new require_session_errors.SessionConfigurationError("A user ID is required to revoke sessions.");
+		await this.storage.updateMany(this.collection, { where: {
+			userId: {
+				operator: "eq",
+				value: userId
+			},
+			revokedAt: {
+				operator: "eq",
+				value: null
+			}
+		} }, { revokedAt: this.now() });
+	}
+	async list(userId, currentSessionId) {
+		const now = this.now();
+		return (await this.storage.findMany(this.collection, {
+			where: {
+				userId: {
+					operator: "eq",
+					value: userId
+				},
+				revokedAt: {
+					operator: "eq",
+					value: null
+				}
+			},
+			orderBy: [{
+				field: "lastSeenAt",
+				direction: "desc"
+			}]
+		})).filter((session) => isActive(session, now) && this.idleExpiry(session.lastSeenAt).getTime() > now.getTime() && this.absoluteExpiry(session.createdAt).getTime() > now.getTime()).map((session) => ({
+			sessionId: session.id,
+			kind: session.kind,
+			createdAt: session.createdAt,
+			lastSeenAt: session.lastSeenAt,
+			expiresAt: session.expiresAt,
+			current: session.id === currentSessionId,
+			metadata: session.metadata
+		}));
+	}
+};
+exports.StorageSessionManager = StorageSessionManager;
+
+//# sourceMappingURL=session.manager.cjs.map

package/dist/session.manager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.manager.cjs","names":["SessionConfigurationError","sessionCollection","sessionUserLockCollection","generateSessionToken","hashSessionToken","generateSessionId","SESSION_USER_LOCK_COLLECTION","StorageConflictError","StorageDuplicateError","SessionNotFoundError"],"sources":["../src/session.manager.ts"],"sourcesContent":["import {\n  StorageConflictError,\n  StorageDuplicateError,\n  type StorageAdapter,\n  type StorageBatchOperation,\n} from \"@puzzle-ui/storage\";\n\nimport {\n  SessionConfigurationError,\n  SessionNotFoundError,\n} from \"./errors/session.errors\";\n\nimport {\n  generateSessionId,\n  generateSessionToken,\n  hashSessionToken,\n} from \"./utils/session-crypto\";\n\nimport {\n  SESSION_COLLECTION,\n  SESSION_USER_LOCK_COLLECTION,\n  sessionCollection,\n  sessionUserLockCollection,\n} from \"./session.storage\";\n\nimport type {\n  SessionDevice,\n  SessionRecord,\n  SessionStorageRecord,\n} from \"./types/session.types\";\n\nimport type { SessionUserLockRecord } from \"./types/session-lock.types\";\n\nimport type {\n  CreatedSession,\n  CreateSessionInput,\n  SessionManager,\n  SessionManagerOptions,\n  ValidateSessionOptions,\n  RotateSessionInput,\n} from \"./types/session-manager.types\";\n\nconst DEFAULT_OPTIONS: SessionManagerOptions = {\n  lifetime: {\n    idleTimeoutSeconds: 60 * 60 * 24 * 7,\n    absoluteLifetimeSeconds: 60 * 60 * 24 * 30,\n  },\n  maximumSessionsPerUser: 10,\n  touchIntervalSeconds: 60,\n};\n\nconst toPublicSession = (record: SessionStorageRecord): SessionRecord => ({\n  id: record.id,\n  tokenHash: record.tokenHash,\n  userId: record.userId,\n  kind: record.kind,\n  createdAt: record.createdAt,\n  lastSeenAt: record.lastSeenAt,\n  expiresAt: record.expiresAt,\n  revokedAt: record.revokedAt,\n  metadata: record.metadata,\n});\n\nconst isActive = (session: SessionStorageRecord, now: Date): boolean =>\n  session.revokedAt === null && session.expiresAt.getTime() > now.getTime();\n\nconst validateOptions = (options: SessionManagerOptions): void => {\n  const { idleTimeoutSeconds, absoluteLifetimeSeconds } = options.lifetime;\n\n  if (\n    !Number.isFinite(idleTimeoutSeconds) ||\n    !Number.isFinite(absoluteLifetimeSeconds) ||\n    idleTimeoutSeconds <= 0 ||\n    absoluteLifetimeSeconds <= 0 ||\n    idleTimeoutSeconds > absoluteLifetimeSeconds\n  ) {\n    throw new SessionConfigurationError(\n      \"Session lifetimes must be positive and the idle timeout cannot exceed the absolute lifetime.\",\n    );\n  }\n\n  if (\n    options.maximumSessionsPerUser !== undefined &&\n    (!Number.isInteger(options.maximumSessionsPerUser) ||\n      options.maximumSessionsPerUser < 1)\n  ) {\n    throw new SessionConfigurationError(\n      \"maximumSessionsPerUser must be a positive integer.\",\n    );\n  }\n\n  if (\n    options.touchIntervalSeconds !== undefined &&\n    (!Number.isFinite(options.touchIntervalSeconds) ||\n      options.touchIntervalSeconds < 0)\n  ) {\n    throw new SessionConfigurationError(\n      \"touchIntervalSeconds must be a non-negative number.\",\n    );\n  }\n};\n\nexport class StorageSessionManager implements SessionManager {\n  private readonly options: SessionManagerOptions;\n  private readonly collection: string;\n  private readonly clock: () => Date;\n\n  constructor(\n    private readonly storage: StorageAdapter,\n    options: Partial<SessionManagerOptions> = {},\n  ) {\n    this.options = {\n      ...DEFAULT_OPTIONS,\n      ...options,\n      lifetime: {\n        ...DEFAULT_OPTIONS.lifetime,\n        ...options.lifetime,\n      },\n    };\n\n    validateOptions(this.options);\n\n    this.collection = options.collectionName ?? SESSION_COLLECTION;\n    this.clock = options.clock ?? (() => new Date());\n\n    if (\n      !storage.capabilities.uniqueConstraints ||\n      !storage.capabilities.conditionalWrites ||\n      !storage.capabilities.atomicBatch\n    ) {\n      throw new SessionConfigurationError(\n        \"The storage adapter does not support the atomicity required by session management.\",\n      );\n    }\n  }\n\n  async initialize(): Promise<void> {\n    await this.storage.registerCollection({\n      ...sessionCollection,\n      name: this.collection,\n    });\n\n    await this.storage.registerCollection(sessionUserLockCollection);\n  }\n\n  private now(): Date {\n    return this.clock();\n  }\n\n  private absoluteExpiry(createdAt: Date): Date {\n    return new Date(\n      createdAt.getTime() +\n        this.options.lifetime.absoluteLifetimeSeconds * 1000,\n    );\n  }\n\n  private idleExpiry(lastSeenAt: Date): Date {\n    return new Date(\n      lastSeenAt.getTime() + this.options.lifetime.idleTimeoutSeconds * 1000,\n    );\n  }\n\n  private effectiveExpiry(createdAt: Date, lastSeenAt: Date): Date {\n    return new Date(\n      Math.min(\n        this.absoluteExpiry(createdAt).getTime(),\n        this.idleExpiry(lastSeenAt).getTime(),\n      ),\n    );\n  }\n\n  private async createRecord(\n    input: CreateSessionInput,\n    now: Date,\n  ): Promise<CreatedSession> {\n    if (input.kind === \"authenticated\" && !input.userId) {\n      throw new SessionConfigurationError(\n        \"Authenticated sessions require a user ID.\",\n      );\n    }\n\n    if (input.kind === \"anonymous\" && input.userId !== null) {\n      throw new SessionConfigurationError(\n        \"Anonymous sessions cannot have a user ID.\",\n      );\n    }\n\n    const token = generateSessionToken();\n    const tokenHash = await hashSessionToken(token);\n\n    const absoluteExpiry = this.absoluteExpiry(now);\n    const requestedExpiry = input.expiresAt ?? absoluteExpiry;\n\n    if (\n      !(requestedExpiry instanceof Date) ||\n      !Number.isFinite(requestedExpiry.getTime()) ||\n      requestedExpiry.getTime() <= now.getTime()\n    ) {\n      throw new SessionConfigurationError(\n        \"Session expiration must be a valid future date.\",\n      );\n    }\n\n    const record: SessionStorageRecord = {\n      id: generateSessionId(),\n      tokenHash,\n      userId: input.userId,\n      kind: input.kind,\n      createdAt: now,\n      updatedAt: now,\n      revision: 1,\n      lastSeenAt: now,\n      expiresAt: new Date(\n        Math.min(\n          requestedExpiry.getTime(),\n          absoluteExpiry.getTime(),\n          this.idleExpiry(now).getTime(),\n        ),\n      ),\n      revokedAt: null,\n      metadata: input.metadata,\n    };\n\n    return {\n      session: toPublicSession(record),\n      token,\n    };\n  }\n\n  private toStorageRecord(session: SessionRecord): SessionStorageRecord {\n    return {\n      ...session,\n      updatedAt: session.lastSeenAt,\n      revision: 1,\n    };\n  }\n\n  async create(input: CreateSessionInput): Promise<CreatedSession> {\n    const created = await this.createRecord(input, this.now());\n\n    if (!input.userId) {\n      await this.storage.insert<SessionStorageRecord>(\n        this.collection,\n        this.toStorageRecord(created.session),\n      );\n\n      return created;\n    }\n\n    await this.createAuthenticatedSessionAtomically(input.userId, created);\n\n    return created;\n  }\n\n  private async createAuthenticatedSessionAtomically(\n    userId: string,\n    created: CreatedSession,\n  ): Promise<void> {\n    const maximum = this.options.maximumSessionsPerUser;\n\n    for (let attempt = 0; attempt < 8; attempt++) {\n      const now = this.now();\n\n      const lock = await this.storage.findOne<SessionUserLockRecord>(\n        SESSION_USER_LOCK_COLLECTION,\n        {\n          where: {\n            userId: { operator: \"eq\", value: userId },\n          },\n        },\n      );\n\n      const sessions = await this.storage.findMany<SessionStorageRecord>(\n        this.collection,\n        {\n          where: {\n            userId: { operator: \"eq\", value: userId },\n            revokedAt: { operator: \"eq\", value: null },\n          },\n          orderBy: [\n            { field: \"lastSeenAt\", direction: \"desc\" },\n            { field: \"createdAt\", direction: \"desc\" },\n          ],\n        },\n      );\n\n      const active = sessions.filter((session) => isActive(session, now));\n\n      const excess =\n        maximum === undefined ? [] : active.slice(Math.max(0, maximum - 1));\n\n      const operations: (\n        | StorageBatchOperation<SessionStorageRecord>\n        | StorageBatchOperation<SessionUserLockRecord>\n      )[] = [];\n\n      if (lock) {\n        operations.push({\n          type: \"update\",\n          collection: SESSION_USER_LOCK_COLLECTION,\n          id: lock.id,\n          condition: {\n            expectedRevision: lock.revision,\n          },\n          changes: {},\n        });\n      } else {\n        operations.push({\n          type: \"insert\",\n          collection: SESSION_USER_LOCK_COLLECTION,\n          record: {\n            id: generateSessionId(),\n            userId,\n            createdAt: now,\n            updatedAt: now,\n            revision: 1,\n          },\n        });\n      }\n\n      operations.push({\n        type: \"insert\",\n        collection: this.collection,\n        record: this.toStorageRecord(created.session),\n      });\n\n      for (const session of excess) {\n        operations.push({\n          type: \"update\",\n          collection: this.collection,\n          id: session.id,\n          condition: {\n            expectedRevision: session.revision,\n          },\n          changes: {\n            revokedAt: now,\n          },\n        });\n      }\n\n      try {\n        await this.storage.atomicBatch<\n          SessionStorageRecord | SessionUserLockRecord\n        >(operations);\n\n        return;\n      } catch (error) {\n        if (\n          error instanceof StorageConflictError ||\n          error instanceof StorageDuplicateError\n        ) {\n          continue;\n        }\n\n        throw error;\n      }\n    }\n\n    throw new SessionConfigurationError(\n      \"Could not acquire the user session concurrency lock after repeated conflicts.\",\n    );\n  }\n\n  async validate(\n    token: string,\n    options: ValidateSessionOptions = {},\n  ): Promise<SessionRecord | null> {\n    if (!token) return null;\n\n    const tokenHash = await hashSessionToken(token);\n\n    const session = await this.storage.findOne<SessionStorageRecord>(\n      this.collection,\n      {\n        where: {\n          tokenHash: { operator: \"eq\", value: tokenHash },\n        },\n      },\n    );\n\n    if (!session) return null;\n\n    const now = this.now();\n\n    if (!isActive(session, now)) return null;\n\n    if (\n      this.idleExpiry(session.lastSeenAt).getTime() <= now.getTime() ||\n      this.absoluteExpiry(session.createdAt).getTime() <= now.getTime()\n    ) {\n      await this.revoke(session.id);\n      return null;\n    }\n\n    const touch =\n      options.touch !== false &&\n      now.getTime() - session.lastSeenAt.getTime() >=\n        (this.options.touchIntervalSeconds ?? 60) * 1000;\n\n    if (!touch) return toPublicSession(session);\n\n    try {\n      const updated = await this.storage.update<SessionStorageRecord>(\n        this.collection,\n        session.id,\n        {\n          lastSeenAt: now,\n          expiresAt: this.effectiveExpiry(session.createdAt, now),\n        },\n        { expectedRevision: session.revision },\n      );\n\n      return updated ? toPublicSession(updated) : null;\n    } catch (error) {\n      if (error instanceof StorageConflictError) {\n        return null;\n      }\n\n      throw error;\n    }\n  }\n\n  async get(sessionId: string): Promise<SessionRecord | null> {\n    const session = await this.storage.findById<SessionStorageRecord>(\n      this.collection,\n      sessionId,\n    );\n\n    if (!session || !isActive(session, this.now())) return null;\n\n    const now = this.now();\n\n    if (\n      this.idleExpiry(session.lastSeenAt).getTime() <= now.getTime() ||\n      this.absoluteExpiry(session.createdAt).getTime() <= now.getTime()\n    ) {\n      await this.revoke(sessionId);\n      return null;\n    }\n\n    return toPublicSession(session);\n  }\n\n  async rotate(input: RotateSessionInput): Promise<CreatedSession> {\n    const current = await this.storage.findById<SessionStorageRecord>(\n      this.collection,\n      input.sessionId,\n    );\n\n    const now = this.now();\n\n    if (\n      !current ||\n      !isActive(current, now) ||\n      this.idleExpiry(current.lastSeenAt).getTime() <= now.getTime() ||\n      this.absoluteExpiry(current.createdAt).getTime() <= now.getTime()\n    ) {\n      throw new SessionNotFoundError();\n    }\n\n    const created = await this.createRecord(\n      {\n        userId: current.userId,\n        kind: current.kind,\n        metadata: input.metadata ?? current.metadata,\n      },\n      now,\n    );\n\n    const operations: StorageBatchOperation<SessionStorageRecord>[] = [\n      {\n        type: \"insert\",\n        collection: this.collection,\n        record: this.toStorageRecord(created.session),\n      },\n      {\n        type: \"update\",\n        collection: this.collection,\n        id: current.id,\n        condition: {\n          expectedRevision: current.revision,\n        },\n        changes: {\n          revokedAt: now,\n        },\n      },\n    ];\n\n    await this.storage.atomicBatch(operations);\n\n    return created;\n  }\n\n  async revoke(sessionId: string): Promise<void> {\n    const session = await this.storage.findById<SessionStorageRecord>(\n      this.collection,\n      sessionId,\n    );\n\n    if (!session || session.revokedAt) return;\n\n    await this.storage.update<SessionStorageRecord>(\n      this.collection,\n      sessionId,\n      { revokedAt: this.now() },\n      { expectedRevision: session.revision },\n    );\n  }\n\n  async revokeAll(userId: string): Promise<void> {\n    if (!userId) {\n      throw new SessionConfigurationError(\n        \"A user ID is required to revoke sessions.\",\n      );\n    }\n\n    await this.storage.updateMany<SessionStorageRecord>(\n      this.collection,\n      {\n        where: {\n          userId: { operator: \"eq\", value: userId },\n          revokedAt: { operator: \"eq\", value: null },\n        },\n      },\n      { revokedAt: this.now() },\n    );\n  }\n\n  async list(\n    userId: string,\n    currentSessionId?: string,\n  ): Promise<readonly SessionDevice[]> {\n    const now = this.now();\n\n    const sessions = await this.storage.findMany<SessionStorageRecord>(\n      this.collection,\n      {\n        where: {\n          userId: { operator: \"eq\", value: userId },\n          revokedAt: { operator: \"eq\", value: null },\n        },\n        orderBy: [{ field: \"lastSeenAt\", direction: \"desc\" }],\n      },\n    );\n\n    return sessions\n      .filter(\n        (session) =>\n          isActive(session, now) &&\n          this.idleExpiry(session.lastSeenAt).getTime() > now.getTime() &&\n          this.absoluteExpiry(session.createdAt).getTime() > now.getTime(),\n      )\n      .map((session) => ({\n        sessionId: session.id,\n        kind: session.kind,\n        createdAt: session.createdAt,\n        lastSeenAt: session.lastSeenAt,\n        expiresAt: session.expiresAt,\n        current: session.id === currentSessionId,\n        metadata: session.metadata,\n      }));\n  }\n}\n"],"mappings":";;;;;AA0CA,MAAM,kBAAyC;CAC7C,UAAU;EACR,oBAAoB;EACpB,yBAAyB;CAC3B;CACA,wBAAwB;CACxB,sBAAsB;AACxB;AAEA,MAAM,mBAAmB,YAAiD;CACxE,IAAI,OAAO;CACX,WAAW,OAAO;CAClB,QAAQ,OAAO;CACf,MAAM,OAAO;CACb,WAAW,OAAO;CAClB,YAAY,OAAO;CACnB,WAAW,OAAO;CAClB,WAAW,OAAO;CAClB,UAAU,OAAO;AACnB;AAEA,MAAM,YAAY,SAA+B,QAC/C,QAAQ,cAAc,QAAQ,QAAQ,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAE1E,MAAM,mBAAmB,YAAyC;CAChE,MAAM,EAAE,oBAAoB,4BAA4B,QAAQ;CAEhE,IACE,CAAC,OAAO,SAAS,kBAAkB,KACnC,CAAC,OAAO,SAAS,uBAAuB,KACxC,sBAAsB,KACtB,2BAA2B,KAC3B,qBAAqB,yBAErB,MAAM,IAAIA,uBAAAA,0BACR,8FACF;CAGF,IACE,QAAQ,2BAA2B,KAAA,MAClC,CAAC,OAAO,UAAU,QAAQ,sBAAsB,KAC/C,QAAQ,yBAAyB,IAEnC,MAAM,IAAIA,uBAAAA,0BACR,oDACF;CAGF,IACE,QAAQ,yBAAyB,KAAA,MAChC,CAAC,OAAO,SAAS,QAAQ,oBAAoB,KAC5C,QAAQ,uBAAuB,IAEjC,MAAM,IAAIA,uBAAAA,0BACR,qDACF;AAEJ;AAEA,IAAa,wBAAb,MAA6D;CAMxC;CALnB;CACA;CACA;CAEA,YACE,SACA,UAA0C,CAAC,GAC3C;EAFiB,KAAA,UAAA;EAGjB,KAAK,UAAU;GACb,GAAG;GACH,GAAG;GACH,UAAU;IACR,GAAG,gBAAgB;IACnB,GAAG,QAAQ;GACb;EACF;EAEA,gBAAgB,KAAK,OAAO;EAE5B,KAAK,aAAa,QAAQ,kBAAA;EAC1B,KAAK,QAAQ,QAAQ,gCAAgB,IAAI,KAAK;EAE9C,IACE,CAAC,QAAQ,aAAa,qBACtB,CAAC,QAAQ,aAAa,qBACtB,CAAC,QAAQ,aAAa,aAEtB,MAAM,IAAIA,uBAAAA,0BACR,oFACF;CAEJ;CAEA,MAAM,aAA4B;EAChC,MAAM,KAAK,QAAQ,mBAAmB;GACpC,GAAGC,wBAAAA;GACH,MAAM,KAAK;EACb,CAAC;EAED,MAAM,KAAK,QAAQ,mBAAmBC,wBAAAA,yBAAyB;CACjE;CAEA,MAAoB;EAClB,OAAO,KAAK,MAAM;CACpB;CAEA,eAAuB,WAAuB;EAC5C,OAAO,IAAI,KACT,UAAU,QAAQ,IAChB,KAAK,QAAQ,SAAS,0BAA0B,GACpD;CACF;CAEA,WAAmB,YAAwB;EACzC,OAAO,IAAI,KACT,WAAW,QAAQ,IAAI,KAAK,QAAQ,SAAS,qBAAqB,GACpE;CACF;CAEA,gBAAwB,WAAiB,YAAwB;EAC/D,OAAO,IAAI,KACT,KAAK,IACH,KAAK,eAAe,SAAS,CAAC,CAAC,QAAQ,GACvC,KAAK,WAAW,UAAU,CAAC,CAAC,QAAQ,CACtC,CACF;CACF;CAEA,MAAc,aACZ,OACA,KACyB;EACzB,IAAI,MAAM,SAAS,mBAAmB,CAAC,MAAM,QAC3C,MAAM,IAAIF,uBAAAA,0BACR,2CACF;EAGF,IAAI,MAAM,SAAS,eAAe,MAAM,WAAW,MACjD,MAAM,IAAIA,uBAAAA,0BACR,2CACF;EAGF,MAAM,QAAQG,uBAAAA,qBAAqB;EACnC,MAAM,YAAY,MAAMC,uBAAAA,iBAAiB,KAAK;EAE9C,MAAM,iBAAiB,KAAK,eAAe,GAAG;EAC9C,MAAM,kBAAkB,MAAM,aAAa;EAE3C,IACE,EAAE,2BAA2B,SAC7B,CAAC,OAAO,SAAS,gBAAgB,QAAQ,CAAC,KAC1C,gBAAgB,QAAQ,KAAK,IAAI,QAAQ,GAEzC,MAAM,IAAIJ,uBAAAA,0BACR,iDACF;EAGF,MAAM,SAA+B;GACnC,IAAIK,uBAAAA,kBAAkB;GACtB;GACA,QAAQ,MAAM;GACd,MAAM,MAAM;GACZ,WAAW;GACX,WAAW;GACX,UAAU;GACV,YAAY;GACZ,WAAW,IAAI,KACb,KAAK,IACH,gBAAgB,QAAQ,GACxB,eAAe,QAAQ,GACvB,KAAK,WAAW,GAAG,CAAC,CAAC,QAAQ,CAC/B,CACF;GACA,WAAW;GACX,UAAU,MAAM;EAClB;EAEA,OAAO;GACL,SAAS,gBAAgB,MAAM;GAC/B;EACF;CACF;CAEA,gBAAwB,SAA8C;EACpE,OAAO;GACL,GAAG;GACH,WAAW,QAAQ;GACnB,UAAU;EACZ;CACF;CAEA,MAAM,OAAO,OAAoD;EAC/D,MAAM,UAAU,MAAM,KAAK,aAAa,OAAO,KAAK,IAAI,CAAC;EAEzD,IAAI,CAAC,MAAM,QAAQ;GACjB,MAAM,KAAK,QAAQ,OACjB,KAAK,YACL,KAAK,gBAAgB,QAAQ,OAAO,CACtC;GAEA,OAAO;EACT;EAEA,MAAM,KAAK,qCAAqC,MAAM,QAAQ,OAAO;EAErE,OAAO;CACT;CAEA,MAAc,qCACZ,QACA,SACe;EACf,MAAM,UAAU,KAAK,QAAQ;EAE7B,KAAK,IAAI,UAAU,GAAG,UAAU,GAAG,WAAW;GAC5C,MAAM,MAAM,KAAK,IAAI;GAErB,MAAM,OAAO,MAAM,KAAK,QAAQ,QAC9BC,wBAAAA,8BACA,EACE,OAAO,EACL,QAAQ;IAAE,UAAU;IAAM,OAAO;GAAO,EAC1C,EACF,CACF;GAgBA,MAAM,UAAS,MAdQ,KAAK,QAAQ,SAClC,KAAK,YACL;IACE,OAAO;KACL,QAAQ;MAAE,UAAU;MAAM,OAAO;KAAO;KACxC,WAAW;MAAE,UAAU;MAAM,OAAO;KAAK;IAC3C;IACA,SAAS,CACP;KAAE,OAAO;KAAc,WAAW;IAAO,GACzC;KAAE,OAAO;KAAa,WAAW;IAAO,CAC1C;GACF,CACF,EAAA,CAEwB,QAAQ,YAAY,SAAS,SAAS,GAAG,CAAC;GAElE,MAAM,SACJ,YAAY,KAAA,IAAY,CAAC,IAAI,OAAO,MAAM,KAAK,IAAI,GAAG,UAAU,CAAC,CAAC;GAEpE,MAAM,aAGA,CAAC;GAEP,IAAI,MACF,WAAW,KAAK;IACd,MAAM;IACN,YAAYA,wBAAAA;IACZ,IAAI,KAAK;IACT,WAAW,EACT,kBAAkB,KAAK,SACzB;IACA,SAAS,CAAC;GACZ,CAAC;QAED,WAAW,KAAK;IACd,MAAM;IACN,YAAYA,wBAAAA;IACZ,QAAQ;KACN,IAAID,uBAAAA,kBAAkB;KACtB;KACA,WAAW;KACX,WAAW;KACX,UAAU;IACZ;GACF,CAAC;GAGH,WAAW,KAAK;IACd,MAAM;IACN,YAAY,KAAK;IACjB,QAAQ,KAAK,gBAAgB,QAAQ,OAAO;GAC9C,CAAC;GAED,KAAK,MAAM,WAAW,QACpB,WAAW,KAAK;IACd,MAAM;IACN,YAAY,KAAK;IACjB,IAAI,QAAQ;IACZ,WAAW,EACT,kBAAkB,QAAQ,SAC5B;IACA,SAAS,EACP,WAAW,IACb;GACF,CAAC;GAGH,IAAI;IACF,MAAM,KAAK,QAAQ,YAEjB,UAAU;IAEZ;GACF,SAAS,OAAO;IACd,IACE,iBAAiBE,mBAAAA,wBACjB,iBAAiBC,mBAAAA,uBAEjB;IAGF,MAAM;GACR;EACF;EAEA,MAAM,IAAIR,uBAAAA,0BACR,+EACF;CACF;CAEA,MAAM,SACJ,OACA,UAAkC,CAAC,GACJ;EAC/B,IAAI,CAAC,OAAO,OAAO;EAEnB,MAAM,YAAY,MAAMI,uBAAAA,iBAAiB,KAAK;EAE9C,MAAM,UAAU,MAAM,KAAK,QAAQ,QACjC,KAAK,YACL,EACE,OAAO,EACL,WAAW;GAAE,UAAU;GAAM,OAAO;EAAU,EAChD,EACF,CACF;EAEA,IAAI,CAAC,SAAS,OAAO;EAErB,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI,CAAC,SAAS,SAAS,GAAG,GAAG,OAAO;EAEpC,IACE,KAAK,WAAW,QAAQ,UAAU,CAAC,CAAC,QAAQ,KAAK,IAAI,QAAQ,KAC7D,KAAK,eAAe,QAAQ,SAAS,CAAC,CAAC,QAAQ,KAAK,IAAI,QAAQ,GAChE;GACA,MAAM,KAAK,OAAO,QAAQ,EAAE;GAC5B,OAAO;EACT;EAOA,IAAI,EAJF,QAAQ,UAAU,SAClB,IAAI,QAAQ,IAAI,QAAQ,WAAW,QAAQ,MACxC,KAAK,QAAQ,wBAAwB,MAAM,MAEpC,OAAO,gBAAgB,OAAO;EAE1C,IAAI;GACF,MAAM,UAAU,MAAM,KAAK,QAAQ,OACjC,KAAK,YACL,QAAQ,IACR;IACE,YAAY;IACZ,WAAW,KAAK,gBAAgB,QAAQ,WAAW,GAAG;GACxD,GACA,EAAE,kBAAkB,QAAQ,SAAS,CACvC;GAEA,OAAO,UAAU,gBAAgB,OAAO,IAAI;EAC9C,SAAS,OAAO;GACd,IAAI,iBAAiBG,mBAAAA,sBACnB,OAAO;GAGT,MAAM;EACR;CACF;CAEA,MAAM,IAAI,WAAkD;EAC1D,MAAM,UAAU,MAAM,KAAK,QAAQ,SACjC,KAAK,YACL,SACF;EAEA,IAAI,CAAC,WAAW,CAAC,SAAS,SAAS,KAAK,IAAI,CAAC,GAAG,OAAO;EAEvD,MAAM,MAAM,KAAK,IAAI;EAErB,IACE,KAAK,WAAW,QAAQ,UAAU,CAAC,CAAC,QAAQ,KAAK,IAAI,QAAQ,KAC7D,KAAK,eAAe,QAAQ,SAAS,CAAC,CAAC,QAAQ,KAAK,IAAI,QAAQ,GAChE;GACA,MAAM,KAAK,OAAO,SAAS;GAC3B,OAAO;EACT;EAEA,OAAO,gBAAgB,OAAO;CAChC;CAEA,MAAM,OAAO,OAAoD;EAC/D,MAAM,UAAU,MAAM,KAAK,QAAQ,SACjC,KAAK,YACL,MAAM,SACR;EAEA,MAAM,MAAM,KAAK,IAAI;EAErB,IACE,CAAC,WACD,CAAC,SAAS,SAAS,GAAG,KACtB,KAAK,WAAW,QAAQ,UAAU,CAAC,CAAC,QAAQ,KAAK,IAAI,QAAQ,KAC7D,KAAK,eAAe,QAAQ,SAAS,CAAC,CAAC,QAAQ,KAAK,IAAI,QAAQ,GAEhE,MAAM,IAAIE,uBAAAA,qBAAqB;EAGjC,MAAM,UAAU,MAAM,KAAK,aACzB;GACE,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,UAAU,MAAM,YAAY,QAAQ;EACtC,GACA,GACF;EAEA,MAAM,aAA4D,CAChE;GACE,MAAM;GACN,YAAY,KAAK;GACjB,QAAQ,KAAK,gBAAgB,QAAQ,OAAO;EAC9C,GACA;GACE,MAAM;GACN,YAAY,KAAK;GACjB,IAAI,QAAQ;GACZ,WAAW,EACT,kBAAkB,QAAQ,SAC5B;GACA,SAAS,EACP,WAAW,IACb;EACF,CACF;EAEA,MAAM,KAAK,QAAQ,YAAY,UAAU;EAEzC,OAAO;CACT;CAEA,MAAM,OAAO,WAAkC;EAC7C,MAAM,UAAU,MAAM,KAAK,QAAQ,SACjC,KAAK,YACL,SACF;EAEA,IAAI,CAAC,WAAW,QAAQ,WAAW;EAEnC,MAAM,KAAK,QAAQ,OACjB,KAAK,YACL,WACA,EAAE,WAAW,KAAK,IAAI,EAAE,GACxB,EAAE,kBAAkB,QAAQ,SAAS,CACvC;CACF;CAEA,MAAM,UAAU,QAA+B;EAC7C,IAAI,CAAC,QACH,MAAM,IAAIT,uBAAAA,0BACR,2CACF;EAGF,MAAM,KAAK,QAAQ,WACjB,KAAK,YACL,EACE,OAAO;GACL,QAAQ;IAAE,UAAU;IAAM,OAAO;GAAO;GACxC,WAAW;IAAE,UAAU;IAAM,OAAO;GAAK;EAC3C,EACF,GACA,EAAE,WAAW,KAAK,IAAI,EAAE,CAC1B;CACF;CAEA,MAAM,KACJ,QACA,kBACmC;EACnC,MAAM,MAAM,KAAK,IAAI;EAarB,QAAO,MAXgB,KAAK,QAAQ,SAClC,KAAK,YACL;GACE,OAAO;IACL,QAAQ;KAAE,UAAU;KAAM,OAAO;IAAO;IACxC,WAAW;KAAE,UAAU;KAAM,OAAO;IAAK;GAC3C;GACA,SAAS,CAAC;IAAE,OAAO;IAAc,WAAW;GAAO,CAAC;EACtD,CACF,EAAA,CAGG,QACE,YACC,SAAS,SAAS,GAAG,KACrB,KAAK,WAAW,QAAQ,UAAU,CAAC,CAAC,QAAQ,IAAI,IAAI,QAAQ,KAC5D,KAAK,eAAe,QAAQ,SAAS,CAAC,CAAC,QAAQ,IAAI,IAAI,QAAQ,CACnE,CAAC,CACA,KAAK,aAAa;GACjB,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,WAAW,QAAQ;GACnB,YAAY,QAAQ;GACpB,WAAW,QAAQ;GACnB,SAAS,QAAQ,OAAO;GACxB,UAAU,QAAQ;EACpB,EAAE;CACN;AACF"}

package/dist/session.manager.d.cts

@@ -0,0 +1,25 @@
+import { SessionDevice, SessionRecord } from "./types/session.types.cjs";
+import { CreateSessionInput, CreatedSession, RotateSessionInput, SessionManager, SessionManagerOptions, ValidateSessionOptions } from "./types/session-manager.types.cjs";
+import { StorageAdapter } from "@puzzle-ui/storage";
+export declare class StorageSessionManager implements SessionManager {
+  private readonly storage;
+  private readonly options;
+  private readonly collection;
+  private readonly clock;
+  constructor(storage: StorageAdapter, options?: Partial<SessionManagerOptions>);
+  initialize(): Promise<void>;
+  private now;
+  private absoluteExpiry;
+  private idleExpiry;
+  private effectiveExpiry;
+  private createRecord;
+  private toStorageRecord;
+  create(input: CreateSessionInput): Promise<CreatedSession>;
+  private createAuthenticatedSessionAtomically;
+  validate(token: string, options?: ValidateSessionOptions): Promise<SessionRecord | null>;
+  get(sessionId: string): Promise<SessionRecord | null>;
+  rotate(input: RotateSessionInput): Promise<CreatedSession>;
+  revoke(sessionId: string): Promise<void>;
+  revokeAll(userId: string): Promise<void>;
+  list(userId: string, currentSessionId?: string): Promise<readonly SessionDevice[]>;
+}

package/dist/session.manager.d.ts

@@ -0,0 +1,25 @@
+import { SessionDevice, SessionRecord } from "./types/session.types.js";
+import { CreateSessionInput, CreatedSession, RotateSessionInput, SessionManager, SessionManagerOptions, ValidateSessionOptions } from "./types/session-manager.types.js";
+import { StorageAdapter } from "@puzzle-ui/storage";
+export declare class StorageSessionManager implements SessionManager {
+  private readonly storage;
+  private readonly options;
+  private readonly collection;
+  private readonly clock;
+  constructor(storage: StorageAdapter, options?: Partial<SessionManagerOptions>);
+  initialize(): Promise<void>;
+  private now;
+  private absoluteExpiry;
+  private idleExpiry;
+  private effectiveExpiry;
+  private createRecord;
+  private toStorageRecord;
+  create(input: CreateSessionInput): Promise<CreatedSession>;
+  private createAuthenticatedSessionAtomically;
+  validate(token: string, options?: ValidateSessionOptions): Promise<SessionRecord | null>;
+  get(sessionId: string): Promise<SessionRecord | null>;
+  rotate(input: RotateSessionInput): Promise<CreatedSession>;
+  revoke(sessionId: string): Promise<void>;
+  revokeAll(userId: string): Promise<void>;
+  list(userId: string, currentSessionId?: string): Promise<readonly SessionDevice[]>;
+}

package/dist/session.manager.js

@@ -0,0 +1,289 @@
+import { SessionConfigurationError, SessionNotFoundError } from "./errors/session.errors.js";
+import { generateSessionId, generateSessionToken, hashSessionToken } from "./utils/session-crypto.js";
+import { SESSION_USER_LOCK_COLLECTION, sessionCollection, sessionUserLockCollection } from "./session.storage.js";
+import { StorageConflictError, StorageDuplicateError } from "@puzzle-ui/storage";
+// src/session.manager.ts
+const DEFAULT_OPTIONS = {
+	lifetime: {
+		idleTimeoutSeconds: 604800,
+		absoluteLifetimeSeconds: 2592e3
+	},
+	maximumSessionsPerUser: 10,
+	touchIntervalSeconds: 60
+};
+const toPublicSession = (record) => ({
+	id: record.id,
+	tokenHash: record.tokenHash,
+	userId: record.userId,
+	kind: record.kind,
+	createdAt: record.createdAt,
+	lastSeenAt: record.lastSeenAt,
+	expiresAt: record.expiresAt,
+	revokedAt: record.revokedAt,
+	metadata: record.metadata
+});
+const isActive = (session, now) => session.revokedAt === null && session.expiresAt.getTime() > now.getTime();
+const validateOptions = (options) => {
+	const { idleTimeoutSeconds, absoluteLifetimeSeconds } = options.lifetime;
+	if (!Number.isFinite(idleTimeoutSeconds) || !Number.isFinite(absoluteLifetimeSeconds) || idleTimeoutSeconds <= 0 || absoluteLifetimeSeconds <= 0 || idleTimeoutSeconds > absoluteLifetimeSeconds) throw new SessionConfigurationError("Session lifetimes must be positive and the idle timeout cannot exceed the absolute lifetime.");
+	if (options.maximumSessionsPerUser !== void 0 && (!Number.isInteger(options.maximumSessionsPerUser) || options.maximumSessionsPerUser < 1)) throw new SessionConfigurationError("maximumSessionsPerUser must be a positive integer.");
+	if (options.touchIntervalSeconds !== void 0 && (!Number.isFinite(options.touchIntervalSeconds) || options.touchIntervalSeconds < 0)) throw new SessionConfigurationError("touchIntervalSeconds must be a non-negative number.");
+};
+var StorageSessionManager = class {
+	storage;
+	options;
+	collection;
+	clock;
+	constructor(storage, options = {}) {
+		this.storage = storage;
+		this.options = {
+			...DEFAULT_OPTIONS,
+			...options,
+			lifetime: {
+				...DEFAULT_OPTIONS.lifetime,
+				...options.lifetime
+			}
+		};
+		validateOptions(this.options);
+		this.collection = options.collectionName ?? "sessions";
+		this.clock = options.clock ?? (() => /* @__PURE__ */ new Date());
+		if (!storage.capabilities.uniqueConstraints || !storage.capabilities.conditionalWrites || !storage.capabilities.atomicBatch) throw new SessionConfigurationError("The storage adapter does not support the atomicity required by session management.");
+	}
+	async initialize() {
+		await this.storage.registerCollection({
+			...sessionCollection,
+			name: this.collection
+		});
+		await this.storage.registerCollection(sessionUserLockCollection);
+	}
+	now() {
+		return this.clock();
+	}
+	absoluteExpiry(createdAt) {
+		return new Date(createdAt.getTime() + this.options.lifetime.absoluteLifetimeSeconds * 1e3);
+	}
+	idleExpiry(lastSeenAt) {
+		return new Date(lastSeenAt.getTime() + this.options.lifetime.idleTimeoutSeconds * 1e3);
+	}
+	effectiveExpiry(createdAt, lastSeenAt) {
+		return new Date(Math.min(this.absoluteExpiry(createdAt).getTime(), this.idleExpiry(lastSeenAt).getTime()));
+	}
+	async createRecord(input, now) {
+		if (input.kind === "authenticated" && !input.userId) throw new SessionConfigurationError("Authenticated sessions require a user ID.");
+		if (input.kind === "anonymous" && input.userId !== null) throw new SessionConfigurationError("Anonymous sessions cannot have a user ID.");
+		const token = generateSessionToken();
+		const tokenHash = await hashSessionToken(token);
+		const absoluteExpiry = this.absoluteExpiry(now);
+		const requestedExpiry = input.expiresAt ?? absoluteExpiry;
+		if (!(requestedExpiry instanceof Date) || !Number.isFinite(requestedExpiry.getTime()) || requestedExpiry.getTime() <= now.getTime()) throw new SessionConfigurationError("Session expiration must be a valid future date.");
+		const record = {
+			id: generateSessionId(),
+			tokenHash,
+			userId: input.userId,
+			kind: input.kind,
+			createdAt: now,
+			updatedAt: now,
+			revision: 1,
+			lastSeenAt: now,
+			expiresAt: new Date(Math.min(requestedExpiry.getTime(), absoluteExpiry.getTime(), this.idleExpiry(now).getTime())),
+			revokedAt: null,
+			metadata: input.metadata
+		};
+		return {
+			session: toPublicSession(record),
+			token
+		};
+	}
+	toStorageRecord(session) {
+		return {
+			...session,
+			updatedAt: session.lastSeenAt,
+			revision: 1
+		};
+	}
+	async create(input) {
+		const created = await this.createRecord(input, this.now());
+		if (!input.userId) {
+			await this.storage.insert(this.collection, this.toStorageRecord(created.session));
+			return created;
+		}
+		await this.createAuthenticatedSessionAtomically(input.userId, created);
+		return created;
+	}
+	async createAuthenticatedSessionAtomically(userId, created) {
+		const maximum = this.options.maximumSessionsPerUser;
+		for (let attempt = 0; attempt < 8; attempt++) {
+			const now = this.now();
+			const lock = await this.storage.findOne(SESSION_USER_LOCK_COLLECTION, { where: { userId: {
+				operator: "eq",
+				value: userId
+			} } });
+			const active = (await this.storage.findMany(this.collection, {
+				where: {
+					userId: {
+						operator: "eq",
+						value: userId
+					},
+					revokedAt: {
+						operator: "eq",
+						value: null
+					}
+				},
+				orderBy: [{
+					field: "lastSeenAt",
+					direction: "desc"
+				}, {
+					field: "createdAt",
+					direction: "desc"
+				}]
+			})).filter((session) => isActive(session, now));
+			const excess = maximum === void 0 ? [] : active.slice(Math.max(0, maximum - 1));
+			const operations = [];
+			if (lock) operations.push({
+				type: "update",
+				collection: SESSION_USER_LOCK_COLLECTION,
+				id: lock.id,
+				condition: { expectedRevision: lock.revision },
+				changes: {}
+			});
+			else operations.push({
+				type: "insert",
+				collection: SESSION_USER_LOCK_COLLECTION,
+				record: {
+					id: generateSessionId(),
+					userId,
+					createdAt: now,
+					updatedAt: now,
+					revision: 1
+				}
+			});
+			operations.push({
+				type: "insert",
+				collection: this.collection,
+				record: this.toStorageRecord(created.session)
+			});
+			for (const session of excess) operations.push({
+				type: "update",
+				collection: this.collection,
+				id: session.id,
+				condition: { expectedRevision: session.revision },
+				changes: { revokedAt: now }
+			});
+			try {
+				await this.storage.atomicBatch(operations);
+				return;
+			} catch (error) {
+				if (error instanceof StorageConflictError || error instanceof StorageDuplicateError) continue;
+				throw error;
+			}
+		}
+		throw new SessionConfigurationError("Could not acquire the user session concurrency lock after repeated conflicts.");
+	}
+	async validate(token, options = {}) {
+		if (!token) return null;
+		const tokenHash = await hashSessionToken(token);
+		const session = await this.storage.findOne(this.collection, { where: { tokenHash: {
+			operator: "eq",
+			value: tokenHash
+		} } });
+		if (!session) return null;
+		const now = this.now();
+		if (!isActive(session, now)) return null;
+		if (this.idleExpiry(session.lastSeenAt).getTime() <= now.getTime() || this.absoluteExpiry(session.createdAt).getTime() <= now.getTime()) {
+			await this.revoke(session.id);
+			return null;
+		}
+		if (!(options.touch !== false && now.getTime() - session.lastSeenAt.getTime() >= (this.options.touchIntervalSeconds ?? 60) * 1e3)) return toPublicSession(session);
+		try {
+			const updated = await this.storage.update(this.collection, session.id, {
+				lastSeenAt: now,
+				expiresAt: this.effectiveExpiry(session.createdAt, now)
+			}, { expectedRevision: session.revision });
+			return updated ? toPublicSession(updated) : null;
+		} catch (error) {
+			if (error instanceof StorageConflictError) return null;
+			throw error;
+		}
+	}
+	async get(sessionId) {
+		const session = await this.storage.findById(this.collection, sessionId);
+		if (!session || !isActive(session, this.now())) return null;
+		const now = this.now();
+		if (this.idleExpiry(session.lastSeenAt).getTime() <= now.getTime() || this.absoluteExpiry(session.createdAt).getTime() <= now.getTime()) {
+			await this.revoke(sessionId);
+			return null;
+		}
+		return toPublicSession(session);
+	}
+	async rotate(input) {
+		const current = await this.storage.findById(this.collection, input.sessionId);
+		const now = this.now();
+		if (!current || !isActive(current, now) || this.idleExpiry(current.lastSeenAt).getTime() <= now.getTime() || this.absoluteExpiry(current.createdAt).getTime() <= now.getTime()) throw new SessionNotFoundError();
+		const created = await this.createRecord({
+			userId: current.userId,
+			kind: current.kind,
+			metadata: input.metadata ?? current.metadata
+		}, now);
+		const operations = [{
+			type: "insert",
+			collection: this.collection,
+			record: this.toStorageRecord(created.session)
+		}, {
+			type: "update",
+			collection: this.collection,
+			id: current.id,
+			condition: { expectedRevision: current.revision },
+			changes: { revokedAt: now }
+		}];
+		await this.storage.atomicBatch(operations);
+		return created;
+	}
+	async revoke(sessionId) {
+		const session = await this.storage.findById(this.collection, sessionId);
+		if (!session || session.revokedAt) return;
+		await this.storage.update(this.collection, sessionId, { revokedAt: this.now() }, { expectedRevision: session.revision });
+	}
+	async revokeAll(userId) {
+		if (!userId) throw new SessionConfigurationError("A user ID is required to revoke sessions.");
+		await this.storage.updateMany(this.collection, { where: {
+			userId: {
+				operator: "eq",
+				value: userId
+			},
+			revokedAt: {
+				operator: "eq",
+				value: null
+			}
+		} }, { revokedAt: this.now() });
+	}
+	async list(userId, currentSessionId) {
+		const now = this.now();
+		return (await this.storage.findMany(this.collection, {
+			where: {
+				userId: {
+					operator: "eq",
+					value: userId
+				},
+				revokedAt: {
+					operator: "eq",
+					value: null
+				}
+			},
+			orderBy: [{
+				field: "lastSeenAt",
+				direction: "desc"
+			}]
+		})).filter((session) => isActive(session, now) && this.idleExpiry(session.lastSeenAt).getTime() > now.getTime() && this.absoluteExpiry(session.createdAt).getTime() > now.getTime()).map((session) => ({
+			sessionId: session.id,
+			kind: session.kind,
+			createdAt: session.createdAt,
+			lastSeenAt: session.lastSeenAt,
+			expiresAt: session.expiresAt,
+			current: session.id === currentSessionId,
+			metadata: session.metadata
+		}));
+	}
+};
+export { StorageSessionManager };
+
+//# sourceMappingURL=session.manager.js.map