@spine-event-engine/auth 2.0.0-snapshot.25 → 2.0.0-snapshot.28

package/dist/sessions/opaque-session-store.js

@@ -0,0 +1,185 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+import { clone, equals } from "@bufbuild/protobuf";
+import {} from "@bufbuild/protobuf/wkt";
+import { Time } from "@spine-event-engine/core/time";
+import { OpaqueSessionRecordSchema, } from "@spine-event-engine/proto/auth";
+import { SessionRecords } from "./session-record.js";
+/**
+ * Process-local implementation of the same atomic session transitions.
+ */
+export class MemoryOpaqueSessionStore {
+    #records = new Map();
+    #clock;
+    #maxSessions;
+    #closed = false;
+    /**
+     * Creates a process-local store with a trusted maintenance clock.
+     *
+     * @param clock Supplies the latest allowed purge cutoff.
+     * @param maxSessions Process-local retained record bound; defaults to 10,000.
+     */
+    constructor(clock = Time.currentTime, maxSessions = 10_000) {
+        if (!Number.isSafeInteger(maxSessions) || maxSessions <= 0)
+            throw new RangeError("maxSessions must be a positive safe integer.");
+        this.#clock = clock;
+        this.#maxSessions = maxSessions;
+    }
+    /**
+     * Returns whether the process-local retained record bound is reached.
+     *
+     * @returns Whether another insert requires explicit expiry maintenance.
+     */
+    atCapacity() {
+        return this.#records.size >= this.#maxSessions;
+    }
+    /**
+     * Creates a complete session only when its stable reference is absent.
+     *
+     * @param record Complete session to insert.
+     * @param signal Optional cancellation.
+     * @returns Whether insertion won.
+     */
+    insert(record, signal) {
+        return this.#run(() => {
+            this.#check(signal);
+            if (this.#records.has(record.id))
+                return false;
+            if (this.atCapacity())
+                return false;
+            SessionRecords.expiry(record);
+            this.#records.set(record.id, clone(OpaqueSessionRecordSchema, record));
+            return true;
+        });
+    }
+    /**
+     * Reads one authoritative session by stable reference.
+     *
+     * @param id Stable session reference.
+     * @param signal Optional cancellation.
+     * @returns Detached current record, if present.
+     */
+    read(id, signal) {
+        return this.#run(() => {
+            this.#check(signal);
+            const record = this.#records.get(id);
+            return record === undefined ? undefined : clone(OpaqueSessionRecordSchema, record);
+        });
+    }
+    /**
+     * Replaces exactly one expected session record.
+     *
+     * @param expected Complete record that must still be current.
+     * @param next Replacement with the same stable reference.
+     * @param signal Optional cancellation.
+     * @returns Whether replacement won.
+     */
+    replace(expected, next, signal) {
+        return this.#run(() => {
+            this.#check(signal);
+            if (expected.id !== next.id)
+                throw new Error("Replacement must retain the stable reference.");
+            SessionRecords.expiry(next);
+            const current = this.#records.get(expected.id);
+            if (current === undefined || !equals(OpaqueSessionRecordSchema, current, expected))
+                return false;
+            this.#records.set(next.id, clone(OpaqueSessionRecordSchema, next));
+            return true;
+        });
+    }
+    /**
+     * Deletes the current generation behind a stable reference.
+     *
+     * @param id Stable session reference.
+     * @param signal Optional cancellation.
+     * @returns Whether a record was removed.
+     */
+    revoke(id, signal) {
+        return this.#run(() => {
+            this.#check(signal);
+            return this.#records.delete(id);
+        });
+    }
+    /**
+     * Deletes only one complete expected record.
+     *
+     * @param expected Complete record that may be removed.
+     * @param signal Optional cancellation.
+     * @returns Whether the expected record was removed.
+     */
+    remove(expected, signal) {
+        return this.#run(() => {
+            this.#check(signal);
+            const current = this.#records.get(expected.id);
+            if (current === undefined || !equals(OpaqueSessionRecordSchema, current, expected))
+                return false;
+            return this.#records.delete(expected.id);
+        });
+    }
+    /**
+     * Removes exact deadlines at or before the trusted cutoff.
+     *
+     * @param cutoff Current-or-earlier exact deadline.
+     * @param signal Optional maintenance cancellation.
+     * @returns Number of conditionally removed records.
+     */
+    purgeExpired(cutoff, signal) {
+        return this.#run(() => {
+            this.#check(signal);
+            const valid = SessionRecords.deadline(cutoff);
+            if (SessionRecords.compare(valid, SessionRecords.deadline(this.#clock())) > 0)
+                throw new RangeError("Purge cutoff cannot be later than the trusted clock.");
+            let removed = 0;
+            for (const record of this.#records.values()) {
+                this.#check(signal);
+                if (SessionRecords.compare(SessionRecords.expiry(record), valid) <= 0) {
+                    this.#records.delete(record.id);
+                    removed += 1;
+                }
+            }
+            return removed;
+        });
+    }
+    /**
+     * Closes and drops the process-local record references.
+     *
+     * @returns Completion after local records are dropped.
+     */
+    close() {
+        this.#closed = true;
+        this.#records.clear();
+        return Promise.resolve();
+    }
+    /**
+     * Converts one synchronous memory transition to the asynchronous port.
+     *
+     * @typeParam T Result produced by the atomic transition.
+     * @param action Atomic memory transition.
+     * @returns Transition result or rejected failure.
+     */
+    #run(action) {
+        return Promise.resolve().then(action);
+    }
+    /**
+     * Rejects new work after close or cancellation.
+     *
+     * @param signal Optional operation cancellation.
+     */
+    #check(signal) {
+        if (this.#closed)
+            throw new Error("Opaque session store is closed.");
+        signal?.throwIfAborted();
+    }
+}
+//# sourceMappingURL=opaque-session-store.js.map

package/dist/sessions/opaque-session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaque-session-store.js","sourceRoot":"","sources":["../../src/sessions/opaque-session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAkB,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AACrD,OAAO,EACL,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA8ErD;;GAEG;AACH,MAAM,OAAO,wBAAwB;IAC1B,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAElD,MAAM,CAAkB;IAExB,YAAY,CAAS;IAE9B,OAAO,GAAG,KAAK,CAAC;IAEhB;;;;;OAKG;IACH,YAAY,QAAyB,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM;QACzE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC;YACxD,MAAM,IAAI,UAAU,CAAC,8CAA8C,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,MAA2B,EAAE,MAAoB;QACtD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/C,IAAI,IAAI,CAAC,UAAU,EAAE;gBAAE,OAAO,KAAK,CAAC;YACpC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,EAAU,EAAE,MAAoB;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,QAA6B,EAC7B,IAAyB,EACzB,MAAoB;QAEpB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpB,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC9F,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,OAAO,EAAE,QAAQ,CAAC;gBAChF,OAAO,KAAK,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAU,EAAE,MAAoB;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,QAA6B,EAAE,MAAoB;QACxD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,OAAO,EAAE,QAAQ,CAAC;gBAChF,OAAO,KAAK,CAAC;YACf,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAiB,EAAE,MAAoB;QAClD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC;gBAC3E,MAAM,IAAI,UAAU,CAAC,sDAAsD,CAAC,CAAC;YAC/E,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACpB,IAAI,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAChC,OAAO,IAAI,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAI,MAAe;QACrB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAoB;QACzB,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/sessions/opaque.d.ts

@@ -1,200 +1,187 @@
+import { type Timestamp } from "@bufbuild/protobuf/wkt";
+import { type OpaqueSessionStore } from "./opaque-session-store.js";
 import type { AuthenticatedPrincipal, CookieCredential, RequestCredential, ResolvedSession, SessionResolver } from "../index.js";
 /**
- * Clock used to evaluate opaque-session expiry.
+ * Trusted millisecond clock for exact application-session validity.
  */
 export interface OpaqueSessionClock {
     /**
-     * Returns Unix epoch milliseconds as a safe integer in the Protobuf Timestamp range.
-     * @returns The current milliseconds.
+     * Reads a safe Unix epoch millisecond in the Protobuf Timestamp range.
+     *
+     * @returns Current milliseconds.
      */
     now(): number;
 }
 /**
- * Creates random bytes for an opaque session identifier.
- * @param length The required byte length.
- * @returns The generated bytes.
+ * Creates cryptographic bytes for a stable ID or credential generation.
+ *
+ * @param length Required byte count.
+ * @returns Random bytes that the caller clears after use.
  */
 export type OpaqueSessionRandom = (length: number) => Uint8Array;
 /**
- * Construction options for the bounded in-memory opaque-session resolver.
+ * Required sealing and lifetime policy with optional replaceable storage.
  */
 export interface OpaqueSessionsOptions {
     /**
-     * Millisecond clock; each value must be a safe integer in Timestamp range.
+     * Store selected for authoritative session transitions; omission selects memory.
      */
-    readonly clock?: OpaqueSessionClock;
+    readonly store?: OpaqueSessionStore;
     /**
-     * Receives exactly `32` and returns exactly 32 random bytes per call.
-     * Throwing or wrong-length results consume a bounded collision attempt, and
-     * every returned mutable buffer is zeroed before this resolver returns.
+     * Application and purpose binding authenticated into every seal.
      */
-    readonly randomBytes?: OpaqueSessionRandom;
+    readonly scope: string;
     /**
-     * Positive safe session lifetime in milliseconds; defaults to eight hours.
+     * Iron-session secret or numeric version-to-secret rotation map.
      */
-    readonly ttlMilliseconds?: number;
+    readonly password: string | Readonly<Record<string, string>>;
     /**
-     * Positive safe retained-session bound; defaults to 10,000.
+     * Trusted application clock for exact expiry checks.
      */
-    readonly maxSessions?: number;
+    readonly clock: OpaqueSessionClock;
     /**
-     * Positive safe ID-generation attempt bound; defaults to three.
+     * Positive safe lifetime in milliseconds.
+     */
+    readonly ttlMilliseconds: number;
+    /**
+     * Optional injected random source for session ID and generation.
+     */
+    readonly randomBytes?: OpaqueSessionRandom;
+    /**
+     * Existing bounded retry policy for random-ID collisions; defaults to three.
      */
     readonly collisionAttempts?: number;
+    /**
+     * Memory-only retained-session bound; defaults to 10,000.
+     */
+    readonly maxSessions?: number;
 }
 /**
- * Result of creating an opaque session.
+ * Issuance outcome, including a sealed cookie on success.
  */
 export type OpaqueSessionCreateResult = {
     /**
-     * Identifies successful session creation.
+     * Successful issuance through the selected store.
      */
     readonly kind: "created";
     /**
-     * Provides the cookie credential for the created session.
+     * Sealed cookie credential.
      */
     readonly credential: CookieCredential;
     /**
-     * Provides a defensive copy of the created session.
+     * Detached resolved session.
      */
     readonly session: ResolvedSession;
 } | {
     /**
-     * Identifies rejected session creation.
+     * Rejected issuance.
      */
     readonly kind: "rejected";
     /**
-     * Explains why the session could not be created.
+     * Application-level rejection reason.
      */
     readonly reason: "capacity-exceeded" | "entropy-exhausted" | "clock-failure" | "closed";
 };
 /**
- * Result of rotating an opaque session.
+ * Rotation outcome, including a newly sealed cookie on success.
  */
 export type OpaqueSessionRotateResult = {
     /**
-     * Identifies successful session rotation.
+     * Successful atomic generation replacement.
      */
     readonly kind: "rotated";
     /**
-     * Provides the replacement cookie credential.
+     * Replacement sealed cookie credential.
      */
     readonly credential: CookieCredential;
     /**
-     * Provides a defensive copy of the replacement session.
+     * Detached replacement session.
      */
     readonly session: ResolvedSession;
 } | {
     /**
-     * Identifies rejected session rotation.
+     * Rejected rotation.
      */
     readonly kind: "rejected";
     /**
-     * Explains why the session could not be rotated.
+     * Application-level rejection reason.
      */
     readonly reason: "not-found" | "expired" | "unsupported-credential" | "entropy-exhausted" | "clock-failure" | "closed";
 };
 /**
- * Enumeration-safe acknowledgement of an opaque-session logout request.
+ * Enumeration-safe logout acknowledgement.
  */
 export interface OpaqueSessionLogoutResult {
     /**
-     * Confirms that the logout request was accepted.
+     * Acknowledges logout without revealing session presence.
      */
     readonly kind: "logged-out";
 }
 /**
- * A bounded, terminal in-memory store of random opaque application sessions.
- *
- * It is intentionally process-local: applications needing durable or shared
- * sessions provide another `SessionResolver` implementation.
+ * Sealed opaque credentials backed by atomic stable-reference transitions.
  */
 export declare class OpaqueSessions implements SessionResolver {
-    private readonly records;
-    private readonly clock;
-    private readonly random;
-    private readonly ttlMilliseconds;
-    private readonly maxSessions;
-    private readonly collisionAttempts;
-    private closed;
-    /**
-     * Creates a bounded in-memory session store.
-     * @param options The optional clock, entropy, lifetime, and capacity settings.
-     */
-    constructor(options?: OpaqueSessionsOptions);
-    /**
-     * Creates a new session unless the terminal or bounded store state rejects it.
-     * @param principal The authenticated principal to retain.
-     * @returns The creation outcome and, when accepted, credential and session.
-     */
-    create(principal: AuthenticatedPrincipal): Promise<OpaqueSessionCreateResult>;
+    #private;
     /**
-     * Resolves one currently live cookie credential as a defensive copy.
-     * @param credentialInput The credential to resolve.
-     * @returns The live session, or undefined when it is invalid or expired.
+     * Binds already validated policy and an authoritative store.
+     *
+     * @param options Validated session policy.
+     * @param store Selected atomic store.
+     * @param internalStore Process-local store created by this strategy, if any.
      */
-    resolve(credentialInput: RequestCredential): Promise<ResolvedSession | undefined>;
+    private constructor();
     /**
-     * Updates a live opaque credential without ever retaining both values.
-     * @param credentialInput The credential to replace.
-     * @returns The rotation outcome and, when accepted, the replacement values.
+     * Validates sealing and lifetime policy before exposing a usable strategy.
+     *
+     * @param options Required application policy and optional store.
+     * @returns Initialized opaque-session strategy.
      */
-    rotate(credentialInput: RequestCredential): Promise<OpaqueSessionRotateResult>;
+    static create(options: OpaqueSessionsOptions): Promise<OpaqueSessions>;
     /**
-     * Deletes a cookie session when present without revealing whether it existed.
-     * @param credentialInput The credential to invalidate.
-     * @returns An enumeration-safe logout acknowledgement.
+     * Creates one sealed credential after an atomic absent insertion.
+     *
+     * @param principal Complete authenticated identity.
+     * @param signal Optional cancellation.
+     * @returns Issuance result; cancellation never returns a credential.
      */
-    logout(credentialInput: RequestCredential): Promise<OpaqueSessionLogoutResult>;
+    issue(principal: AuthenticatedPrincipal, signal?: AbortSignal): Promise<OpaqueSessionCreateResult>;
     /**
-     * Closes the store and drops retained session identity and record references.
-     * @returns Completes after retained records are dropped.
+     * Resolves only the current generation before its exact deadline.
+     *
+     * @param credentialInput Cookie credential to validate.
+     * @param signal Optional cancellation.
+     * @returns Detached session, or undefined for invalid or expired credentials.
      */
-    close(): Promise<void>;
+    resolve(credentialInput: RequestCredential, signal?: AbortSignal): Promise<ResolvedSession | undefined>;
     /**
-     * Checks whether the session store has been closed.
-     * @returns Whether further session operations must be rejected.
+     * Creates a new generation before atomically replacing the current record.
+     *
+     * @param credentialInput Current cookie credential.
+     * @param signal Optional cancellation.
+     * @returns One winning replacement or a rejection.
      */
-    private isClosed;
+    rotate(credentialInput: RequestCredential, signal?: AbortSignal): Promise<OpaqueSessionRotateResult>;
     /**
-     * Creates a bounded session record for an authenticated principal.
-     * @param principal The identity to store in the session.
-     * @param now The validated issuance time in milliseconds.
-     * @returns The record, or undefined if expiry cannot be represented.
+     * Removes the stable reference when the supplied seal is still live.
+     *
+     * @param credentialInput Cookie credential to revoke.
+     * @param signal Optional cancellation.
+     * @returns Enumeration-safe acknowledgement.
      */
-    private record;
+    logout(credentialInput: RequestCredential, signal?: AbortSignal): Promise<OpaqueSessionLogoutResult>;
     /**
-     * Creates an unused opaque credential identifier within the retry limit.
-     * @returns The identifier, or undefined after entropy failures or collisions.
+     * Removes records at or before a trusted maintenance cutoff.
+     *
+     * @param cutoff Current-or-earlier exact deadline.
+     * @param signal Optional maintenance cancellation.
+     * @returns Number of conditionally removed records.
      */
-    private nextId;
+    purgeExpired(cutoff: Timestamp, signal?: AbortSignal): Promise<number>;
     /**
-     * Returns a live session record and removes it when expired.
-     * @param id The opaque credential identifier.
-     * @param now The validated lookup time in milliseconds.
-     * @returns The live record, or undefined if absent or expired.
+     * Closes new work and drains admitted work and compensation.
+     *
+     * @returns Repeatable close completion; injected stores remain open.
      */
-    private live;
-    /**
-     * Removes every session that has expired by the supplied time.
-     * @param now The validated sweep time in milliseconds.
-     */
-    private sweepExpired;
-    /**
-     * Compares a session expiry with the current millisecond reading.
-     * @param record The session record to inspect.
-     * @param now The validated current time.
-     * @returns Whether the record has expired.
-     */
-    private expired;
-    /**
-     * Reads a safe clock value and closes the store on clock failure.
-     * @returns Current epoch milliseconds, or undefined after failure.
-     */
-    private now;
-    /**
-     * Closes the store and clears session records after a clock fault.
-     */
-    private failClosed;
+    close(): Promise<void>;
 }
 //# sourceMappingURL=opaque.d.ts.map

package/dist/sessions/opaque.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opaque.d.ts","sourceRoot":"","sources":["../../src/sessions/opaque.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAGjC;;;OAGG;IACH,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAEpC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAElC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,mBAAmB,GAAG,eAAe,GAAG,QAAQ,CAAC;CACzF,CAAC;AAEN;;GAEG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACX,WAAW,GACX,SAAS,GACT,wBAAwB,GACxB,mBAAmB,GACnB,eAAe,GACf,QAAQ,CAAC;CACd,CAAC;AAEN;;GAEG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;GAKG;AACH,qBAAa,cAAe,YAAW,eAAe;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAE7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAE3C,OAAO,CAAC,MAAM,CAAS;IAEvB;;;OAGG;gBACS,OAAO,GAAE,qBAA0B;IAiB/C;;;;OAIG;IACH,MAAM,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA8B7E;;;;OAIG;IACH,OAAO,CAAC,eAAe,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAQjF;;;;OAIG;IACH,MAAM,CAAC,eAAe,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAsC9E;;;;OAIG;IACH,MAAM,CAAC,eAAe,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAM9E;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAOtB;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAIhB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IASd;;;OAGG;IACH,OAAO,CAAC,MAAM;IAmBd;;;;;OAKG;IACH,OAAO,CAAC,IAAI;IAQZ;;;OAGG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;OAKG;IACH,OAAO,CAAC,OAAO;IAIf;;;OAGG;IACH,OAAO,CAAC,GAAG;IAYX;;OAEG;IACH,OAAO,CAAC,UAAU;CAInB"}
+{"version":3,"file":"opaque.d.ts","sourceRoot":"","sources":["../../src/sessions/opaque.ts"],"names":[],"mappings":"AAeA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAQzE,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAG9F,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAGjC;;;;OAIG;IACH,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE7D;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,mBAAmB,GAAG,eAAe,GAAG,QAAQ,CAAC;CACzF,CAAC;AAEN;;GAEG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACX,WAAW,GACX,SAAS,GACT,wBAAwB,GACxB,mBAAmB,GACnB,eAAe,GACf,QAAQ,CAAC;CACd,CAAC;AAEN;;GAEG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;CAC7B;AAED;;GAEG;AACH,qBAAa,cAAe,YAAW,eAAe;;IA6BpD;;;;;;OAMG;IACH,OAAO;IAgBP;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;IA0BtE;;;;;;OAMG;IACH,KAAK,CACH,SAAS,EAAE,sBAAsB,EACjC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,yBAAyB,CAAC;IAKrC;;;;;;OAMG;IACH,OAAO,CACL,eAAe,EAAE,iBAAiB,EAClC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IA+BvC;;;;;;OAMG;IACH,MAAM,CACJ,eAAe,EAAE,iBAAiB,EAClC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,yBAAyB,CAAC;IAOrC;;;;;;OAMG;IACH,MAAM,CACJ,eAAe,EAAE,iBAAiB,EAClC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,yBAAyB,CAAC;IAmBrC;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAKtE;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA8VvB"}