@sigrun/sigrun 0.1.6 → 0.2.0

package/dist/harness/event-bus.js

@@ -1,7 +1,7 @@
 /**
  * The event bus (memory-seam Tasks 2 + 4): commit observation + bounded
- * side lane + idle detection + shutdown sequencing. See
- * docs/superpowers/specs/2026-10-15-sigrun-memory-seam.md §"Design".
+ * side lane + idle detection + shutdown sequencing. See the memory-seam
+ * spec §"Design".
  *
  * The bus subscribes to pi-durable's `Session.subscribeCommits` (sigrun's
  * harness IS a Session) and reduces each `CommitPublication` into the
@@ -64,6 +64,7 @@ import { SessionMetaDoc } from "../server/session-meta.js";
 import { EXPANDED_ENTRY_KIND } from "../commands/expand.js";
 import { InteractionDoc, TERMINAL as INTERACTION_TERMINAL } from "./interactions.js";
 import { AmbientDoc } from "./ambient.js";
+import { beginUserDeletion } from "./stores.js";
 /** Project a SessionMeta doc value into the tracked basis. */
 function metaBasisOf(value) {
     const basis = {
@@ -84,6 +85,10 @@ function metaBasisOf(value) {
 }
 /** How long shutdown waits for in-flight worker runs before abandoning (spec §3). */
 const WORKER_SHUTDOWN_AWAIT_MS = 30_000;
+/** The default last-admission window (gateway spec §8.13). */
+const SHUTDOWN_SETTLE_WAIT_MS = 10_000;
+/** Short pause between live-run checks while the commit side lane works. */
+const SHUTDOWN_SETTLE_POLL_MS = 10;
 /**
  * The commit-observation side lane. One instance per harness; open after
  * boot, close before the harness closes (`shutdownSequence` for the
@@ -129,6 +134,7 @@ export class EventBus {
     /** The worker states, in registration order (memory-seam Task 5). */
     #workers = [];
     #workerDeadlineMs;
+    #shutdownSettleWaitMs;
     #closed = false;
     constructor(harness, options) {
         this.#harness = harness;
@@ -136,6 +142,7 @@ export class EventBus {
         this.#hookDeadlineMs = options.hookDeadlineMs;
         this.#idleThresholdMs = options.idleThresholdMs;
         this.#workerDeadlineMs = options.workerDeadlineMs;
+        this.#shutdownSettleWaitMs = options.shutdownSettleWaitMs ?? SHUTDOWN_SETTLE_WAIT_MS;
         if (options.onHostEvent !== undefined) {
             this.onHostEvent(options.onHostEvent);
         }
@@ -316,8 +323,9 @@ export class EventBus {
     }
     /**
      * Emit one `userDeleted` directly (core hardening W1 Task 4): the
-     * DELETE /v1/users route's final step, AFTER the ownership transfer,
-     * token revocation, and record removal have landed. Delivered exactly
+     * DELETE /v1/users route's step 3, AFTER transfer/revocation/link
+     * removal and service stop, but BEFORE the directory record is removed,
+     * so per-user secrets remain readable. Delivered exactly
      * like `harnessShutdown` — inline to every registered extension's
      * handler in install order, each deadline-bounded, never queued —
      * because the directory is not durable conversation state (there is
@@ -327,12 +335,37 @@ export class EventBus {
     async emitUserDeleted(payload, context) {
         if (this.#closed)
             return;
-        const api = this.#apiFor(undefined);
+        const endDeletion = beginUserDeletion(payload.user);
+        try {
+            const api = this.#apiFor(undefined);
+            for (const [name, handlers] of this.#extensions) {
+                const handler = handlers.userDeleted;
+                if (handler === undefined)
+                    continue;
+                await this.#bounded(`extension ${name} userDeleted`, () => handler(payload, api, context));
+            }
+        }
+        finally {
+            endDeletion();
+        }
+    }
+    /**
+     * Emit one `settings.changed` fan-out (UI-blocks U4, spec §13.2):
+     * after a settings write COMMITS, every registered extension's
+     * `onSettingsChanged` receives the flattened keys the write touched.
+     * Delivered like `userDeleted` — inline, deadline-bounded, rejections
+     * caught and logged — because settings are not durable conversation
+     * state (no commit to derive from), and §13.2's rule is explicit: a
+     * throwing handler never fails the write.
+     */
+    async emitSettingsChanged(keys, user) {
+        if (this.#closed)
+            return;
         for (const [name, handlers] of this.#extensions) {
-            const handler = handlers.userDeleted;
+            const handler = handlers.onSettingsChanged;
             if (handler === undefined)
                 continue;
-            await this.#bounded(`extension ${name} userDeleted`, () => handler(payload, api, context));
+            await this.#bounded(`extension ${name} onSettingsChanged`, () => handler(keys, user));
         }
     }
     /**
@@ -362,8 +395,9 @@ export class EventBus {
      * 2. stop idle workers FIRST (Task 5, spec §3): pending wakes dropped,
      *    in-flight runs awaited up to 30s then abandoned — a curator is not
      *    competing with the flush handlers for the window;
-     * 3. drain pending settles — a run that settled just before shutdown
-     *    delivers before the shutdown flush (the ordering constraint);
+     * 3. drain pending settles and wait (bounded) for placed live runs —
+     *    a run settling during this last admission window delivers before
+     *    the shutdown flush; a wedged run logs its conversation ids;
      * 4. deliver `harnessShutdown` to every extension in install order,
      *    each deadline-bounded. Handlers may commit — admission is still
      *    open in this window (the seal is `Harness.close`, the caller's
@@ -380,6 +414,7 @@ export class EventBus {
         }
         await this.#stopWorkers();
         await this.drain(this.#hookDeadlineMs, context);
+        await this.#drainLiveRuns(context);
         // harnessShutdown carries no conversation: the conversation-scoped
         // reads resolve empty and `document` serves any conversation.
         const api = this.#apiFor(undefined);
@@ -429,6 +464,23 @@ export class EventBus {
                 clearTimeout(timer);
         });
     }
+    /** Drain runs placed before shutdown, bounded so a wedged run cannot hang close. */
+    async #drainLiveRuns(context) {
+        const deadline = Date.now() + this.#shutdownSettleWaitMs;
+        for (;;) {
+            const live = [...this.#liveInputs.entries()]
+                .filter(([, count]) => count > 0)
+                .map(([conversationId]) => conversationId);
+            if (live.length === 0)
+                return;
+            if (Date.now() >= deadline) {
+                console.warn("event-bus: shutdown settle wait expired; stranded conversations: %s", live.map(String).join(", "));
+                return;
+            }
+            await new Promise((resolve) => setTimeout(resolve, SHUTDOWN_SETTLE_POLL_MS));
+            await this.drain(this.#hookDeadlineMs, context);
+        }
+    }
     /** Stop everything: unsubscribe, empty the queue, stop the sweep + workers, and let a running loop exit. */
     close() {
         if (this.#closed)
@@ -640,6 +692,20 @@ export class EventBus {
                         if (typeof record.callId === "string" &&
                             typeof record.kind === "string" &&
                             typeof record.status === "string") {
+                            // C6 widening: carry the attribution + the STORED
+                            // (masked-by-construction) answer values — the stored
+                            // copy never holds a secret's true value, so these are
+                            // render-safe without any delivery-table read.
+                            const recordAnsweredByUser = typeof record.answeredByUser === "string"
+                                ? record.answeredByUser
+                                : undefined;
+                            const recordAnswerValues = typeof record.answer === "object" &&
+                                record.answer !== null &&
+                                typeof record.answer.values ===
+                                    "object" &&
+                                record.answer.values !== null
+                                ? record.answer.values
+                                : undefined;
                             this.#emitHost({
                                 type: INTERACTION_TERMINAL.has(record.status)
                                     ? "interaction.settled"
@@ -666,6 +732,12 @@ export class EventBus {
                                     conversationId: change.conversationId,
                                     callId: record.callId,
                                     kind: record.kind,
+                                    ...(recordAnsweredByUser === undefined
+                                        ? {}
+                                        : { answeredByUser: recordAnsweredByUser }),
+                                    ...(recordAnswerValues === undefined
+                                        ? {}
+                                        : { answer: recordAnswerValues }),
                                     // SAFETY: `record.status` is a narrowed `string`, but
                                     // the payload wants the terminal union — sound because
                                     // the union and the TERMINAL set share one definition
@@ -1015,7 +1087,11 @@ export class EventBus {
         const registered = [...this.#extensions.entries()].filter(([, handlers]) => handlers[type] !== undefined);
         if (registered.length === 0)
             return;
-        const payload = this.#lifecyclePayload(event);
+        const owner = await this.#ownerOf(this.#lifecycleConversation(event), context);
+        const payload = {
+            ...this.#lifecyclePayload(event),
+            ...(owner === undefined ? {} : { owner }),
+        };
         const api = this.#apiFor(this.#lifecycleConversation(event));
         for (const [name, handlers] of registered) {
             const handler = handlers[type];
@@ -1042,6 +1118,10 @@ export class EventBus {
                     callId: event.callId,
                     kind: event.kind,
                     status: event.status,
+                    ...(event.answeredByUser === undefined
+                        ? {}
+                        : { answeredByUser: event.answeredByUser }),
+                    ...(event.answer === undefined ? {} : { answer: event.answer }),
                 };
         }
     }
@@ -1083,6 +1163,8 @@ export class EventBus {
      * (immutable once committed; defensive) downgrades to unanswered.
      */
     async #resolveRunSettled(group, context) {
+        const owner = await this.#ownerOf(group.conversationId, context);
+        const ownerField = owner === undefined ? {} : { owner };
         const inputs = [];
         const inputTexts = [];
         for (const one of group.settled) {
@@ -1103,6 +1185,7 @@ export class EventBus {
             if (message !== undefined && message.role === "assistant") {
                 return {
                     conversationId: group.conversationId,
+                    ...ownerField,
                     inputs,
                     inputTexts,
                     outcome: { status: "answered", answerEntryId, answer: message },
@@ -1113,6 +1196,7 @@ export class EventBus {
         const firstUnanswered = all.find((one) => one.status === "unanswered");
         return {
             conversationId: group.conversationId,
+            ...ownerField,
             inputs,
             inputTexts,
             outcome: {
@@ -1121,6 +1205,17 @@ export class EventBus {
             },
         };
     }
+    /** The current SessionMeta owner; absent means the key is omitted from the event. */
+    async #ownerOf(conversationId, context) {
+        try {
+            const meta = await this.#harness.snapshot(SessionMetaDoc, conversationId, context);
+            return meta?.owner;
+        }
+        catch (error) {
+            console.error("event-bus: owner read failed:", error);
+            return undefined;
+        }
+    }
     /** One visible entry by exact id (`undefined` on absence or read failure). */
     async #readEntry(conversationId, id, context) {
         try {

package/dist/harness/identity/accounts.js

@@ -0,0 +1,186 @@
+/**
+ * The account-link store (multi-user M3a, spec §11.3): ONE
+ * `<configDir>/accounts.json` linking external identities to directory
+ * users — chat senders (`chat:<channel>`, written by the gateway) and
+ * login subjects (`login:<slug>:<id>`, written by the login routes) in
+ * the same table.
+ *
+ * It lives in CORE, not in an extension, for one reason: an extension
+ * runs inside sigrun's process, so a link table owned by an extension
+ * is a second write path to the same identity data. Core owns the file,
+ * extensions go through `host.accounts`, and the gateway and the login
+ * seam cannot disagree about who a sender is.
+ *
+ * A link is refused, never re-pointed, when `(provider, subject)` is
+ * already linked to a DIFFERENT user: re-pointing an existing external
+ * identity is an account-takeover path (an attacker who controls the
+ * other side of a stale link would inherit the account). The holder or
+ * an admin removes the old link first. Re-linking to the SAME user is a
+ * no-op that returns the existing record.
+ *
+ * Store discipline is `users.json`'s (`json-store.ts`): synchronous
+ * mtime-reloading reads, atomic 0600 writes, mutations serialized on a
+ * per-instance {@link MutationQueue}. A second writer on the same file
+ * (another sigrun process, or a future CLI accounts command) is honored
+ * live by the per-access stat check.
+ */
+import { MutationQueue, readRecords, writeJson } from "./json-store.js";
+/**
+ * The allowed `via` values, as a runtime set: `accounts.json` is a file,
+ * so a hand-edited or future-written record can carry anything, and the
+ * value reaches the wire verbatim. Validated like every other field.
+ */
+const VIAS = new Set([
+    "login",
+    "self",
+    "pairing",
+    "admin",
+]);
+/**
+ * A `(provider, subject)` already linked to a different user. The
+ * message never names the current holder — the caller learns only that
+ * the identity is taken (extensions match on the
+ * `account_link_conflict:` prefix, like `command_not_found:`).
+ */
+export class AccountLinkConflictError extends Error {
+    provider;
+    subject;
+    constructor(provider, subject) {
+        super(`account_link_conflict: ${provider} is linked to another user`);
+        this.name = "AccountLinkConflictError";
+        this.provider = provider;
+        this.subject = subject;
+    }
+}
+/** `chat:<channel>` / `login:<slug>:<id>` — lowercase, no spaces. */
+const PROVIDER_PATTERN = /^(login|chat):[a-z0-9][a-z0-9._:-]*$/;
+/** A subject is opaque, non-empty, and bounded. */
+const SUBJECT_MAX_LENGTH = 512;
+/**
+ * The file-backed link table. Reads are synchronous (mtime reload per
+ * access); every mutation is a whole-file read-modify-write serialized
+ * on the store's {@link MutationQueue}, with validation INSIDE the
+ * mutation so the user-existence and conflict checks see the same file
+ * state as the write.
+ */
+export class AccountStore {
+    path;
+    users;
+    mutations = new MutationQueue();
+    constructor(path, users) {
+        this.path = path;
+        this.users = users;
+    }
+    /** Every link, insertion order. */
+    list() {
+        return readRecords(this.path);
+    }
+    /** The link for one external identity; absent → undefined. */
+    lookup(provider, subject) {
+        return this.list().find((link) => link.provider === provider && link.subject === subject);
+    }
+    /** One user's links, insertion order. */
+    listForUser(user) {
+        return this.list().filter((link) => link.user === user);
+    }
+    /**
+     * Link an external identity to a directory user. Same-user re-link is
+     * a no-op returning the existing record (its `via` and `linkedAt` are
+     * the first link's); a different user is refused with
+     * {@link AccountLinkConflictError}. Throws `unknown user "<user>"`,
+     * `invalid_provider: <provider>`, `invalid_subject`, or
+     * `invalid_via: <via>`.
+     */
+    link(input) {
+        return this.mutations.run(async () => {
+            const { provider, subject, user, via } = input;
+            if (!PROVIDER_PATTERN.test(provider)) {
+                throw new Error(`invalid_provider: ${provider}`);
+            }
+            if (subject === "" || subject.length > SUBJECT_MAX_LENGTH) {
+                throw new Error("invalid_subject");
+            }
+            if (!VIAS.has(via)) {
+                throw new Error(`invalid_via: ${String(via)}`);
+            }
+            if (this.users.get(user) === undefined) {
+                throw new Error(`unknown user "${user}"`);
+            }
+            const records = this.list();
+            const existing = records.find((link) => link.provider === provider && link.subject === subject);
+            if (existing !== undefined) {
+                if (existing.user !== user) {
+                    throw new AccountLinkConflictError(provider, subject);
+                }
+                return existing;
+            }
+            const record = {
+                provider,
+                subject,
+                user,
+                linkedAt: Date.now(),
+                via,
+            };
+            records.push(record);
+            await writeJson(this.path, records);
+            return record;
+        });
+    }
+    /** Remove one link; `false` when it was not there. */
+    unlink(provider, subject) {
+        return this.mutations.run(async () => {
+            const records = this.list();
+            const index = records.findIndex((link) => link.provider === provider && link.subject === subject);
+            if (index === -1)
+                return false;
+            records.splice(index, 1);
+            await writeJson(this.path, records);
+            return true;
+        });
+    }
+    /**
+     * Remove one link, deciding AUTHORIZATION inside the mutation against
+     * the record the write will actually replace.
+     *
+     * The route cannot check ownership itself: it reads the link, then
+     * awaits {@link unlink}, whose read happens later — in the window the
+     * subject could be unlinked and re-linked to a different user, and the
+     * stale check would remove the NEW holder's link. That is the same
+     * doctrine this store's validation follows: the check and the write
+     * see one file state.
+     *
+     * `principal.admin` and an absent `principal.user` (the naive
+     * single-operator superuser, a userless service token) may remove
+     * anyone's link; anyone else may remove only their own.
+     */
+    unlinkAuthorized(provider, subject, principal) {
+        return this.mutations.run(async () => {
+            const records = this.list();
+            const index = records.findIndex((link) => link.provider === provider && link.subject === subject);
+            if (index === -1)
+                return "absent";
+            const record = records[index];
+            if (!principal.admin && record.user !== principal.user) {
+                return "forbidden";
+            }
+            records.splice(index, 1);
+            await writeJson(this.path, records);
+            return "removed";
+        });
+    }
+    /**
+     * Remove every link of one user (user deletion, spec §10.6 step 1).
+     * Links never transfer: credentials belong to a person.
+     */
+    removeUser(user) {
+        return this.mutations.run(async () => {
+            const records = this.list();
+            const kept = records.filter((link) => link.user !== user);
+            const removed = records.length - kept.length;
+            if (removed === 0)
+                return 0;
+            await writeJson(this.path, kept);
+            return removed;
+        });
+    }
+}

package/dist/harness/identity/groups.js

@@ -0,0 +1,14 @@
+/** Group-derived views over the user directory (multi-user M3b §11.5). */
+/** The deduplicated union of a user's stored groups, in source order. */
+export function storedGroups(record) {
+    const groups = new Set();
+    for (const entry of record.groups ?? []) {
+        for (const value of entry.values)
+            groups.add(value);
+    }
+    return [...groups];
+}
+/** Effective admin reads stored groups only, never request-supplied groups. */
+export function effectiveAdmin(record, adminGroups) {
+    return record.admin || storedGroups(record).some((group) => adminGroups.includes(group));
+}

package/dist/harness/identity/index.js

@@ -1,26 +1,31 @@
 /**
  * The identity stores bundle (core hardening W1 Task 2): the directory,
- * tokens, invites, and the setup code, opened over the resolved store
- * roots — the object `openHarness` exposes as `OpenedHarness.identity`
- * and the auth pipeline/routes consume.
+ * tokens, account links, invites, and the setup code, opened over the
+ * resolved store roots — the object `openHarness` exposes as
+ * `OpenedHarness.identity` and the auth pipeline/routes consume.
  *
  - `<configDir>/users.json` — the user directory (0600; holds emails);
  - `<configDir>/api-tokens.json` — the token digests (0600);
+ - `<configDir>/accounts.json` — external-identity links (0600);
  - `<stateDir>/invites.json` — the invite digests (0600);
  - `<cacheDir>` — the setup code's home (pod-local, never backed up).
  *
  All four files: atomic writes (temp + rename), mtime-reload reads per
- access (the CLI is a second writer), serialized mutations per store.
+ access (a second writer — the CLI, or another sigrun process sharing a
+ config root — is honored live), serialized mutations per store.
  */
 import { join } from "node:path";
 import { UserDirectory } from "./users.js";
+import { effectiveAdmin, storedGroups } from "./groups.js";
+import { AccountStore, AccountLinkConflictError, } from "./accounts.js";
 import { TokenStore, generateToken, hashToken, } from "./tokens.js";
 import { InviteStore, DEFAULT_INVITE_EXPIRY_MS, } from "./invites.js";
 import { ensureSetupCode, readSetupCode, clearSetupCode, generateCode, setupCodePath, CODE_ALPHABET, } from "./setup-code.js";
-export { UserDirectory, TokenStore, generateToken, hashToken, InviteStore, DEFAULT_INVITE_EXPIRY_MS, ensureSetupCode, readSetupCode, clearSetupCode, generateCode, setupCodePath, CODE_ALPHABET, };
+export { UserDirectory, effectiveAdmin, storedGroups, AccountStore, AccountLinkConflictError, TokenStore, generateToken, hashToken, InviteStore, DEFAULT_INVITE_EXPIRY_MS, ensureSetupCode, readSetupCode, clearSetupCode, generateCode, setupCodePath, CODE_ALPHABET, };
 /** The file names each store owns under its root. */
 const USERS_FILE = "users.json";
 const TOKENS_FILE = "api-tokens.json";
+const ACCOUNTS_FILE = "accounts.json";
 const INVITES_FILE = "invites.json";
 /**
  * Open the identity stores over resolved roots (cheap — no I/O; every
@@ -28,9 +33,11 @@ const INVITES_FILE = "invites.json";
  * `ensureStoreRoots`, and by tests directly over tmp dirs.
  */
 export function openIdentityStores(roots) {
+    const users = new UserDirectory(join(roots.configDir, USERS_FILE));
     return {
-        users: new UserDirectory(join(roots.configDir, USERS_FILE)),
+        users,
         tokens: new TokenStore(join(roots.configDir, TOKENS_FILE)),
+        accounts: new AccountStore(join(roots.configDir, ACCOUNTS_FILE), users),
         invites: new InviteStore(join(roots.stateDir, INVITES_FILE)),
         cacheDir: roots.cacheDir,
     };

package/dist/harness/identity/json-store.js

@@ -76,16 +76,27 @@ export function readRecords(path) {
     }
     return value;
 }
+/** Invalidate one path after a writer outside writeJson replaces it. */
+export function invalidateJsonCache(path) {
+    cache.delete(path);
+}
 /**
  * Write one JSON value the house way (tabs, trailing newline),
  * atomically, mode `0600` — identity files all carry credential
  * material (token hashes, emails, invite hashes). The path's cache
- * entry is invalidated (never eagerly re-statted): the next read
- * re-stats and sees the new file.
+ * entry is invalidated whether the write succeeds or fails: a FAILED
+ * write leaves the file as it was, so a cache entry that outlived it
+ * would serve a value the disk no longer holds (a revoked link that
+ * silently comes back, or a link that is not on disk authorizing a
+ * sender). Re-stating on the next read is cheap and always correct.
  */
 export async function writeJson(path, value) {
-    await writeFileAtomic(path, `${JSON.stringify(value, null, "\t")}\n`, 0o600);
-    cache.delete(path);
+    try {
+        await writeFileAtomic(path, `${JSON.stringify(value, null, "\t")}\n`, 0o600);
+    }
+    finally {
+        cache.delete(path);
+    }
 }
 /**
  * A per-store-instance FIFO mutex (the "store semantics" serialization

package/dist/harness/identity/setup-code-check.js

@@ -0,0 +1,9 @@
+import { timingSafeEqual } from "node:crypto";
+/** Constant-time setup-code comparison shared by every claim surface. */
+export function setupCodeMatches(presented, expected) {
+    if (presented === undefined || expected === undefined)
+        return false;
+    const left = Buffer.from(presented, "utf8");
+    const right = Buffer.from(expected, "utf8");
+    return left.length === right.length && timingSafeEqual(left, right);
+}

package/dist/harness/identity/tokens.js

@@ -16,6 +16,10 @@ import { createHash, randomBytes, randomUUID, timingSafeEqual, } from "node:cryp
 import { MutationQueue, readRecords, writeJson } from "./json-store.js";
 /** The token wire prefix (the `sk-`/`sgr_` convention; spec §5.4). */
 const TOKEN_PREFIX = "sgr_";
+/** Drop expired session records before every store mutation is written. */
+function pruneExpired(records, now) {
+    return records.filter((record) => record.expiresAt === undefined || record.expiresAt > now);
+}
 /** A fresh token: `sgr_` + 32 random bytes in base64url (43 chars). */
 export function generateToken() {
     return `${TOKEN_PREFIX}${randomBytes(32).toString("base64url")}`;
@@ -52,9 +56,10 @@ export class TokenStore {
      * Verify a presented token: hash it, compare against every stored
      * digest with `timingSafeEqual`. Absent/unknown/malformed → undefined.
      */
-    verify(token) {
+    verify(token, now = Date.now()) {
         const digest = hashToken(token);
-        return this.list().find((record) => sameDigest(record.sha256, digest));
+        return this.list().find((record) => sameDigest(record.sha256, digest) &&
+            (record.expiresAt === undefined || record.expiresAt > now));
     }
     /**
      * Mint one token for `user`: generates the secret, stores ONLY its
@@ -70,14 +75,32 @@ export class TokenStore {
                 sha256: hashToken(token),
                 createdAt: Date.now(),
             };
-            await writeJson(this.path, [...this.list(), record]);
+            await writeJson(this.path, [...pruneExpired(this.list(), Date.now()), record]);
+            return { record, token };
+        });
+    }
+    /** Mint a revocable, expiring browser session for an IdP sign-in. */
+    createSession(user, provider, ttlMs, now = Date.now()) {
+        return this.mutations.run(async () => {
+            const token = generateToken();
+            const record = {
+                id: randomUUID(),
+                name: `login:${provider}`,
+                user,
+                sha256: hashToken(token),
+                createdAt: now,
+                kind: "session",
+                provider,
+                expiresAt: now + ttlMs,
+            };
+            await writeJson(this.path, [...pruneExpired(this.list(), now), record]);
             return { record, token };
         });
     }
     /** Revoke by record id; false when no such record existed. */
     revoke(id) {
         return this.mutations.run(async () => {
-            const records = this.list();
+            const records = pruneExpired(this.list(), Date.now());
             const index = records.findIndex((record) => record.id === id);
             if (index === -1)
                 return false;
@@ -89,7 +112,7 @@ export class TokenStore {
     /** Revoke every token of one user (user removal's companion); returns the count. */
     revokeAllFor(user) {
         return this.mutations.run(async () => {
-            const records = this.list();
+            const records = pruneExpired(this.list(), Date.now());
             const kept = records.filter((record) => record.user !== user);
             const removed = records.length - kept.length;
             if (removed > 0) {