@web-ts-toolkit/express-oidc-vault-memory-store 0.31.5 → 0.33.0

package/README.md

@@ -16,7 +16,7 @@ pnpm add @web-ts-toolkit/express-oidc-vault @web-ts-toolkit/express-oidc-vault-m
 
 ## Production Note
 
-This package stores authorization transactions, exchange codes, and sessions in process memory.
+This package stores authorization transactions, exchange codes, sessions, rotated-session aliases, and backchannel logout replay JTIs in process memory.
 
 Do not use it for multi-instance or production deployments. Use Redis or MongoDB provider packages for durable or horizontally scaled deployments.
 
@@ -33,12 +33,57 @@ const storeProvider = createMemoryOidcVaultStore();
 app.use(
   createOidcVaultMiddleware({
     basePath: '/auth/oidc',
+    backendOrigin: 'https://api.example.com',
+    config: {
+      issuer: process.env.OIDC_ISSUER,
+      clientId: process.env.OIDC_CLIENT_ID,
+      clientSecret: process.env.OIDC_CLIENT_SECRET,
+    },
+    frontendRedirectUri: 'https://frontend.example.com/callback',
     storeProvider,
   }),
 );
 ```
 
+For local development, this is the shortest setup because it has no Redis, MongoDB, or file-system dependency. Sessions are lost on process restart and are not visible to other Node.js instances.
+
+### Test-Friendly Clock Override
+
+`now()` returns epoch milliseconds and defaults to `Date.now`. Override it only as a deterministic test seam; the returned value must be monotonic enough for the expiry scenarios your test exercises.
+
+```ts
+const storeProvider = createMemoryOidcVaultStore({
+  now: () => 1_700_000_000_000,
+});
+```
+
 ## Main Exports
 
 - `createMemoryOidcVaultStore(...)`
 - `type MemoryOidcVaultStoreOptions`
+
+## Session Rotation Aliases
+
+When a session is rotated, the previous public session ID remains a revocation alias for the current logical session while that logical session is still live. Aliases expire with the rotated target session and are removed when logical, subject, provider-session, direct, or expiry deletion leaves no live session in that logical lineage.
+
+Rotation requires a distinct unused target session ID. Missing-source, same-ID, and existing-target rotation conflicts throw `OidcVaultStoreConflictError` without changing source or target records.
+
+## Store Contract
+
+The store keeps these record kinds in separate in-process maps:
+
+- authorization transactions, consumed once by `state`
+- exchange codes, consumed once by `code`
+- sessions, read and deleted by session, logical session, subject, or provider session identifiers
+- rotated-session aliases, used only so an old public session ID can revoke the current logical session
+- backchannel logout token JTIs, consumed once until their expiry time
+
+`createAuthorizationTransaction`, `createExchangeCode`, and `createSession` are upserts; creating the same key again replaces the old value. Metadata should be structured-clone compatible and JSON-compatible for portability across the memory, Redis, and MongoDB stores. The memory store clones inputs and returned records with `structuredClone`, so callers retain ownership of their objects and later mutations do not update persisted state.
+
+Expiry checks use `expiresAt <= now()` as expired. Cleanup is opportunistic: reads and writes prune expired records in bounded batches or when a specific record is accessed, not on a background timer.
+
+`deleteSession(...)`, `deleteSessionsByLogicalSessionId(...)`, `deleteSessionsBySubject(...)`, and `deleteSessionsByProviderSessionId(...)` logically revoke live sessions and remove stale rotation aliases when no live session remains in a logical lineage.
+
+## Replay JTI Expiry
+
+Backchannel logout token JTI records are consumed only when `expiresAt` is a finite timestamp greater than the store clock at consume time. Expired, equal-to-current-time, `NaN`, and infinite expiries return `false` and are not stored.

package/index.d.mts

@@ -1,10 +1,22 @@
 import { OidcVaultStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
 
 interface MemoryOidcVaultStoreOptions {
+    /**
+     * Store clock in epoch milliseconds.
+     *
+     * Defaults to `Date.now`. Override this in deterministic tests only; the
+     * returned value should move forward enough for the expiry scenarios being
+     * tested.
+     */
     now?: () => number;
 }
 /**
- * Create an in-memory store provider for local development and tests.
+ * Create a process-local OIDC vault store provider for local development and tests.
+ *
+ * Records are kept in memory, cloned on read/write, cleaned up opportunistically
+ * during store operations, and lost when the Node.js process exits. Do not use
+ * this provider when sessions must survive restarts or be shared by multiple
+ * application instances.
  */
 declare function createMemoryOidcVaultStore(options?: MemoryOidcVaultStoreOptions): OidcVaultStoreProvider;
 

package/index.d.ts

@@ -1,10 +1,22 @@
 import { OidcVaultStoreProvider } from '@web-ts-toolkit/express-oidc-vault';
 
 interface MemoryOidcVaultStoreOptions {
+    /**
+     * Store clock in epoch milliseconds.
+     *
+     * Defaults to `Date.now`. Override this in deterministic tests only; the
+     * returned value should move forward enough for the expiry scenarios being
+     * tested.
+     */
     now?: () => number;
 }
 /**
- * Create an in-memory store provider for local development and tests.
+ * Create a process-local OIDC vault store provider for local development and tests.
+ *
+ * Records are kept in memory, cloned on read/write, cleaned up opportunistically
+ * during store operations, and lost when the Node.js process exits. Do not use
+ * this provider when sessions must survive restarts or be shared by multiple
+ * application instances.
  */
 declare function createMemoryOidcVaultStore(options?: MemoryOidcVaultStoreOptions): OidcVaultStoreProvider;
 

package/index.js

@@ -26,6 +26,7 @@ module.exports = __toCommonJS(index_exports);
 var import_express_oidc_vault = require("@web-ts-toolkit/express-oidc-vault");
 var cloneRecord = (value) => structuredClone(value);
 var isExpiredRecord = (value, now) => typeof value.expiresAt === "number" && value.expiresAt <= now;
+var EXPIRY_SWEEP_BATCH_SIZE = 64;
 var matchesProviderScope = (session, input) => {
   if (input.issuer !== void 0 && session.provider?.issuer !== input.issuer) {
     return false;
@@ -37,109 +38,309 @@ var matchesProviderScope = (session, input) => {
 };
 var toSubjectDeleteInput = (input) => typeof input === "string" ? { subject: input } : input;
 var toProviderSessionDeleteInput = (input) => typeof input === "string" ? { providerSessionId: input } : input;
+var toLogicalSessionDeleteInput = (input) => typeof input === "string" ? { logicalSessionId: input } : input;
 var MemoryOidcVaultStore = class {
   constructor(options = {}) {
     this.authorizationTransactions = /* @__PURE__ */ new Map();
     this.exchangeCodes = /* @__PURE__ */ new Map();
     this.sessions = /* @__PURE__ */ new Map();
+    this.rotatedSessionAliases = /* @__PURE__ */ new Map();
+    this.backchannelLogoutTokenJtis = /* @__PURE__ */ new Map();
     this.now = options.now ?? (() => Date.now());
   }
   async createAuthorizationTransaction(input) {
-    this.pruneExpiredRecords();
+    const now = this.now();
+    this.authorizationTransactionSweepCursor = this.pruneMapBatch(
+      this.authorizationTransactions,
+      now,
+      this.authorizationTransactionSweepCursor
+    );
     this.authorizationTransactions.set(input.state, cloneRecord(input));
   }
   async consumeAuthorizationTransaction(state) {
-    this.pruneExpiredRecords();
+    const now = this.now();
+    this.authorizationTransactionSweepCursor = this.pruneMapBatch(
+      this.authorizationTransactions,
+      now,
+      this.authorizationTransactionSweepCursor
+    );
     const record = this.authorizationTransactions.get(state);
     if (!record) {
       return null;
     }
     this.authorizationTransactions.delete(state);
+    if (isExpiredRecord(record, now)) {
+      return null;
+    }
     return cloneRecord(record);
   }
   async createExchangeCode(input) {
-    this.pruneExpiredRecords();
+    const now = this.now();
+    this.exchangeCodeSweepCursor = this.pruneMapBatch(this.exchangeCodes, now, this.exchangeCodeSweepCursor);
     this.exchangeCodes.set(input.code, cloneRecord(input));
   }
   async consumeExchangeCode(code) {
-    this.pruneExpiredRecords();
+    const now = this.now();
+    this.exchangeCodeSweepCursor = this.pruneMapBatch(this.exchangeCodes, now, this.exchangeCodeSweepCursor);
     const record = this.exchangeCodes.get(code);
     if (!record) {
       return null;
     }
     this.exchangeCodes.delete(code);
+    if (isExpiredRecord(record, now)) {
+      return null;
+    }
     return cloneRecord(record);
   }
   async createSession(input) {
-    this.pruneExpiredRecords();
     const timestamp = this.now();
+    this.pruneSessionsBatch(timestamp);
+    this.rotatedSessionAliasSweepCursor = this.pruneMapBatch(
+      this.rotatedSessionAliases,
+      timestamp,
+      this.rotatedSessionAliasSweepCursor
+    );
     const session = {
       ...cloneRecord(input),
+      logicalSessionId: input.logicalSessionId ?? input.sessionId,
       createdAt: input.createdAt ?? timestamp,
       updatedAt: input.updatedAt ?? timestamp
     };
     this.sessions.set(session.sessionId, session);
+    this.rotatedSessionAliases.delete(session.sessionId);
     return cloneRecord(session);
   }
   async getSession(sessionId) {
-    this.pruneExpiredRecords();
+    const now = this.now();
     const session = this.sessions.get(sessionId);
+    if (session && isExpiredRecord(session, now)) {
+      this.sessions.delete(sessionId);
+      this.removeAliasesForInactiveLogicalSession(session.logicalSessionId ?? session.sessionId);
+      return null;
+    }
     return session ? cloneRecord(session) : null;
   }
   async rotateSession(input) {
-    this.pruneExpiredRecords();
-    if (!this.sessions.has(input.sessionId)) {
+    const timestamp = this.now();
+    const sourceSession = this.sessions.get(input.sessionId);
+    if (sourceSession && isExpiredRecord(sourceSession, timestamp)) {
+      this.sessions.delete(input.sessionId);
+      this.removeAliasesForInactiveLogicalSession(sourceSession.logicalSessionId ?? sourceSession.sessionId);
+    }
+    const liveSourceSession = this.sessions.get(input.sessionId);
+    if (!liveSourceSession) {
       throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
     }
-    this.sessions.delete(input.sessionId);
+    if (input.nextSession.sessionId === input.sessionId) {
+      throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session rotation target must use a different session ID.");
+    }
+    const existingTargetSession = this.sessions.get(input.nextSession.sessionId);
+    if (existingTargetSession && isExpiredRecord(existingTargetSession, timestamp)) {
+      this.sessions.delete(input.nextSession.sessionId);
+      this.removeAliasesForInactiveLogicalSession(
+        existingTargetSession.logicalSessionId ?? existingTargetSession.sessionId
+      );
+    } else if (existingTargetSession) {
+      throw new import_express_oidc_vault.OidcVaultStoreConflictError("OIDC vault session rotation target already exists.");
+    }
     const nextSession = cloneRecord(input.nextSession);
-    const timestamp = this.now();
     const session = {
       ...nextSession,
+      logicalSessionId: nextSession.logicalSessionId ?? liveSourceSession.logicalSessionId ?? liveSourceSession.sessionId,
       createdAt: nextSession.createdAt ?? timestamp,
       updatedAt: nextSession.updatedAt ?? timestamp
     };
+    this.sessions.delete(input.sessionId);
     this.sessions.set(session.sessionId, session);
+    this.rotatedSessionAliases.set(input.sessionId, {
+      logicalSessionId: session.logicalSessionId ?? session.sessionId,
+      expiresAt: session.expiresAt
+    });
     return cloneRecord(session);
   }
   async deleteSession(sessionId) {
-    this.sessions.delete(sessionId);
+    const now = this.now();
+    this.pruneSessionsBatch(now);
+    this.rotatedSessionAliasSweepCursor = this.pruneMapBatch(
+      this.rotatedSessionAliases,
+      now,
+      this.rotatedSessionAliasSweepCursor
+    );
+    const session = this.sessions.get(sessionId);
+    if (session) {
+      const logicalSessionId = session.logicalSessionId ?? session.sessionId;
+      this.sessions.delete(sessionId);
+      this.rotatedSessionAliases.delete(sessionId);
+      this.removeAliasesForInactiveLogicalSession(logicalSessionId);
+      return;
+    }
+    const alias = this.rotatedSessionAliases.get(sessionId);
+    if (alias) {
+      if (isExpiredRecord(alias, now)) {
+        this.rotatedSessionAliases.delete(sessionId);
+        return;
+      }
+      await this.deleteSessionsByLogicalSessionId(alias.logicalSessionId);
+      this.rotatedSessionAliases.delete(sessionId);
+    }
+  }
+  async deleteSessionsByLogicalSessionId(input) {
+    const now = this.now();
+    const resolved = toLogicalSessionDeleteInput(input);
+    let deleted = 0;
+    const expiredLogicalSessionIds = /* @__PURE__ */ new Set();
+    for (const [sessionId, session] of this.sessions.entries()) {
+      if (isExpiredRecord(session, now)) {
+        expiredLogicalSessionIds.add(session.logicalSessionId ?? session.sessionId);
+        this.sessions.delete(sessionId);
+        continue;
+      }
+      if ((session.logicalSessionId ?? session.sessionId) === resolved.logicalSessionId) {
+        this.sessions.delete(sessionId);
+        deleted += 1;
+      }
+    }
+    this.removeAliasesForInactiveLogicalSessions(expiredLogicalSessionIds);
+    this.removeAliasesForLogicalSession(resolved.logicalSessionId);
+    return deleted;
+  }
+  async consumeBackchannelLogoutTokenJti(input) {
+    const now = this.now();
+    this.backchannelLogoutTokenJtiSweepCursor = this.pruneMapBatch(
+      this.backchannelLogoutTokenJtis,
+      now,
+      this.backchannelLogoutTokenJtiSweepCursor
+    );
+    if (!Number.isFinite(input.expiresAt) || input.expiresAt <= now) {
+      return false;
+    }
+    const existingRecord = this.backchannelLogoutTokenJtis.get(input.jti);
+    if (existingRecord && !isExpiredRecord(existingRecord, now)) {
+      return false;
+    }
+    this.backchannelLogoutTokenJtis.set(input.jti, { expiresAt: input.expiresAt });
+    return true;
   }
   async deleteSessionsBySubject(input) {
-    this.pruneExpiredRecords();
+    const now = this.now();
     const resolved = toSubjectDeleteInput(input);
     let deleted = 0;
+    const logicalSessionIds = /* @__PURE__ */ new Set();
+    const expiredLogicalSessionIds = /* @__PURE__ */ new Set();
     for (const [sessionId, session] of this.sessions.entries()) {
+      if (isExpiredRecord(session, now)) {
+        expiredLogicalSessionIds.add(session.logicalSessionId ?? session.sessionId);
+        this.sessions.delete(sessionId);
+        continue;
+      }
       if (session.subject === resolved.subject && matchesProviderScope(session, resolved)) {
+        logicalSessionIds.add(session.logicalSessionId ?? session.sessionId);
         this.sessions.delete(sessionId);
         deleted += 1;
       }
     }
+    this.removeAliasesForInactiveLogicalSessions(expiredLogicalSessionIds);
+    this.removeAliasesForInactiveLogicalSessions(logicalSessionIds);
     return deleted;
   }
   async deleteSessionsByProviderSessionId(input) {
-    this.pruneExpiredRecords();
+    const now = this.now();
     const resolved = toProviderSessionDeleteInput(input);
     let deleted = 0;
+    const logicalSessionIds = /* @__PURE__ */ new Set();
+    const expiredLogicalSessionIds = /* @__PURE__ */ new Set();
     for (const [sessionId, session] of this.sessions.entries()) {
+      if (isExpiredRecord(session, now)) {
+        expiredLogicalSessionIds.add(session.logicalSessionId ?? session.sessionId);
+        this.sessions.delete(sessionId);
+        continue;
+      }
       if (session.providerSessionId === resolved.providerSessionId && matchesProviderScope(session, resolved)) {
+        logicalSessionIds.add(session.logicalSessionId ?? session.sessionId);
         this.sessions.delete(sessionId);
         deleted += 1;
       }
     }
+    this.removeAliasesForInactiveLogicalSessions(expiredLogicalSessionIds);
+    this.removeAliasesForInactiveLogicalSessions(logicalSessionIds);
     return deleted;
   }
-  pruneExpiredRecords() {
-    const now = this.now();
-    this.pruneMap(this.authorizationTransactions, now);
-    this.pruneMap(this.exchangeCodes, now);
-    this.pruneMap(this.sessions, now);
-  }
-  pruneMap(map, now) {
-    for (const [key, value] of map.entries()) {
+  pruneMapBatch(map, now, cursor) {
+    let inspected = 0;
+    let nextCursor;
+    for (const [key, value] of this.entriesAfterCursor(map, cursor)) {
       if (isExpiredRecord(value, now)) {
         map.delete(key);
       }
+      inspected += 1;
+      nextCursor = key;
+      if (inspected >= EXPIRY_SWEEP_BATCH_SIZE) {
+        return nextCursor;
+      }
+    }
+    return void 0;
+  }
+  pruneSessionsBatch(now) {
+    const expiredLogicalSessionIds = /* @__PURE__ */ new Set();
+    let inspected = 0;
+    for (const [sessionId, session] of this.entriesAfterCursor(this.sessions, this.sessionSweepCursor)) {
+      if (isExpiredRecord(session, now)) {
+        expiredLogicalSessionIds.add(session.logicalSessionId ?? session.sessionId);
+        this.sessions.delete(sessionId);
+      }
+      inspected += 1;
+      this.sessionSweepCursor = sessionId;
+      if (inspected >= EXPIRY_SWEEP_BATCH_SIZE) {
+        this.removeAliasesForInactiveLogicalSessions(expiredLogicalSessionIds);
+        return;
+      }
+    }
+    this.sessionSweepCursor = void 0;
+    this.removeAliasesForInactiveLogicalSessions(expiredLogicalSessionIds);
+  }
+  *entriesAfterCursor(map, cursor) {
+    if (!cursor || !map.has(cursor)) {
+      yield* map.entries();
+      return;
+    }
+    let foundCursor = false;
+    for (const entry of map.entries()) {
+      if (!foundCursor) {
+        foundCursor = entry[0] === cursor;
+        continue;
+      }
+      yield entry;
+    }
+    for (const entry of map.entries()) {
+      if (entry[0] === cursor) {
+        return;
+      }
+      yield entry;
+    }
+  }
+  removeAliasesForInactiveLogicalSessions(logicalSessionIds) {
+    for (const logicalSessionId of logicalSessionIds) {
+      this.removeAliasesForInactiveLogicalSession(logicalSessionId);
+    }
+  }
+  removeAliasesForInactiveLogicalSession(logicalSessionId) {
+    if (!this.hasLiveSessionForLogicalSession(logicalSessionId)) {
+      this.removeAliasesForLogicalSession(logicalSessionId);
+    }
+  }
+  hasLiveSessionForLogicalSession(logicalSessionId) {
+    for (const session of this.sessions.values()) {
+      if ((session.logicalSessionId ?? session.sessionId) === logicalSessionId) {
+        return true;
+      }
+    }
+    return false;
+  }
+  removeAliasesForLogicalSession(logicalSessionId) {
+    for (const [sessionId, alias] of this.rotatedSessionAliases.entries()) {
+      if (alias.logicalSessionId === logicalSessionId) {
+        this.rotatedSessionAliases.delete(sessionId);
+      }
     }
   }
 };

package/index.mjs

@@ -4,6 +4,7 @@ import {
 } from "@web-ts-toolkit/express-oidc-vault";
 var cloneRecord = (value) => structuredClone(value);
 var isExpiredRecord = (value, now) => typeof value.expiresAt === "number" && value.expiresAt <= now;
+var EXPIRY_SWEEP_BATCH_SIZE = 64;
 var matchesProviderScope = (session, input) => {
   if (input.issuer !== void 0 && session.provider?.issuer !== input.issuer) {
     return false;
@@ -15,109 +16,309 @@ var matchesProviderScope = (session, input) => {
 };
 var toSubjectDeleteInput = (input) => typeof input === "string" ? { subject: input } : input;
 var toProviderSessionDeleteInput = (input) => typeof input === "string" ? { providerSessionId: input } : input;
+var toLogicalSessionDeleteInput = (input) => typeof input === "string" ? { logicalSessionId: input } : input;
 var MemoryOidcVaultStore = class {
   constructor(options = {}) {
     this.authorizationTransactions = /* @__PURE__ */ new Map();
     this.exchangeCodes = /* @__PURE__ */ new Map();
     this.sessions = /* @__PURE__ */ new Map();
+    this.rotatedSessionAliases = /* @__PURE__ */ new Map();
+    this.backchannelLogoutTokenJtis = /* @__PURE__ */ new Map();
     this.now = options.now ?? (() => Date.now());
   }
   async createAuthorizationTransaction(input) {
-    this.pruneExpiredRecords();
+    const now = this.now();
+    this.authorizationTransactionSweepCursor = this.pruneMapBatch(
+      this.authorizationTransactions,
+      now,
+      this.authorizationTransactionSweepCursor
+    );
     this.authorizationTransactions.set(input.state, cloneRecord(input));
   }
   async consumeAuthorizationTransaction(state) {
-    this.pruneExpiredRecords();
+    const now = this.now();
+    this.authorizationTransactionSweepCursor = this.pruneMapBatch(
+      this.authorizationTransactions,
+      now,
+      this.authorizationTransactionSweepCursor
+    );
     const record = this.authorizationTransactions.get(state);
     if (!record) {
       return null;
     }
     this.authorizationTransactions.delete(state);
+    if (isExpiredRecord(record, now)) {
+      return null;
+    }
     return cloneRecord(record);
   }
   async createExchangeCode(input) {
-    this.pruneExpiredRecords();
+    const now = this.now();
+    this.exchangeCodeSweepCursor = this.pruneMapBatch(this.exchangeCodes, now, this.exchangeCodeSweepCursor);
     this.exchangeCodes.set(input.code, cloneRecord(input));
   }
   async consumeExchangeCode(code) {
-    this.pruneExpiredRecords();
+    const now = this.now();
+    this.exchangeCodeSweepCursor = this.pruneMapBatch(this.exchangeCodes, now, this.exchangeCodeSweepCursor);
     const record = this.exchangeCodes.get(code);
     if (!record) {
       return null;
     }
     this.exchangeCodes.delete(code);
+    if (isExpiredRecord(record, now)) {
+      return null;
+    }
     return cloneRecord(record);
   }
   async createSession(input) {
-    this.pruneExpiredRecords();
     const timestamp = this.now();
+    this.pruneSessionsBatch(timestamp);
+    this.rotatedSessionAliasSweepCursor = this.pruneMapBatch(
+      this.rotatedSessionAliases,
+      timestamp,
+      this.rotatedSessionAliasSweepCursor
+    );
     const session = {
       ...cloneRecord(input),
+      logicalSessionId: input.logicalSessionId ?? input.sessionId,
       createdAt: input.createdAt ?? timestamp,
       updatedAt: input.updatedAt ?? timestamp
     };
     this.sessions.set(session.sessionId, session);
+    this.rotatedSessionAliases.delete(session.sessionId);
     return cloneRecord(session);
   }
   async getSession(sessionId) {
-    this.pruneExpiredRecords();
+    const now = this.now();
     const session = this.sessions.get(sessionId);
+    if (session && isExpiredRecord(session, now)) {
+      this.sessions.delete(sessionId);
+      this.removeAliasesForInactiveLogicalSession(session.logicalSessionId ?? session.sessionId);
+      return null;
+    }
     return session ? cloneRecord(session) : null;
   }
   async rotateSession(input) {
-    this.pruneExpiredRecords();
-    if (!this.sessions.has(input.sessionId)) {
+    const timestamp = this.now();
+    const sourceSession = this.sessions.get(input.sessionId);
+    if (sourceSession && isExpiredRecord(sourceSession, timestamp)) {
+      this.sessions.delete(input.sessionId);
+      this.removeAliasesForInactiveLogicalSession(sourceSession.logicalSessionId ?? sourceSession.sessionId);
+    }
+    const liveSourceSession = this.sessions.get(input.sessionId);
+    if (!liveSourceSession) {
       throw new OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
     }
-    this.sessions.delete(input.sessionId);
+    if (input.nextSession.sessionId === input.sessionId) {
+      throw new OidcVaultStoreConflictError("OIDC vault session rotation target must use a different session ID.");
+    }
+    const existingTargetSession = this.sessions.get(input.nextSession.sessionId);
+    if (existingTargetSession && isExpiredRecord(existingTargetSession, timestamp)) {
+      this.sessions.delete(input.nextSession.sessionId);
+      this.removeAliasesForInactiveLogicalSession(
+        existingTargetSession.logicalSessionId ?? existingTargetSession.sessionId
+      );
+    } else if (existingTargetSession) {
+      throw new OidcVaultStoreConflictError("OIDC vault session rotation target already exists.");
+    }
     const nextSession = cloneRecord(input.nextSession);
-    const timestamp = this.now();
     const session = {
       ...nextSession,
+      logicalSessionId: nextSession.logicalSessionId ?? liveSourceSession.logicalSessionId ?? liveSourceSession.sessionId,
       createdAt: nextSession.createdAt ?? timestamp,
       updatedAt: nextSession.updatedAt ?? timestamp
     };
+    this.sessions.delete(input.sessionId);
     this.sessions.set(session.sessionId, session);
+    this.rotatedSessionAliases.set(input.sessionId, {
+      logicalSessionId: session.logicalSessionId ?? session.sessionId,
+      expiresAt: session.expiresAt
+    });
     return cloneRecord(session);
   }
   async deleteSession(sessionId) {
-    this.sessions.delete(sessionId);
+    const now = this.now();
+    this.pruneSessionsBatch(now);
+    this.rotatedSessionAliasSweepCursor = this.pruneMapBatch(
+      this.rotatedSessionAliases,
+      now,
+      this.rotatedSessionAliasSweepCursor
+    );
+    const session = this.sessions.get(sessionId);
+    if (session) {
+      const logicalSessionId = session.logicalSessionId ?? session.sessionId;
+      this.sessions.delete(sessionId);
+      this.rotatedSessionAliases.delete(sessionId);
+      this.removeAliasesForInactiveLogicalSession(logicalSessionId);
+      return;
+    }
+    const alias = this.rotatedSessionAliases.get(sessionId);
+    if (alias) {
+      if (isExpiredRecord(alias, now)) {
+        this.rotatedSessionAliases.delete(sessionId);
+        return;
+      }
+      await this.deleteSessionsByLogicalSessionId(alias.logicalSessionId);
+      this.rotatedSessionAliases.delete(sessionId);
+    }
+  }
+  async deleteSessionsByLogicalSessionId(input) {
+    const now = this.now();
+    const resolved = toLogicalSessionDeleteInput(input);
+    let deleted = 0;
+    const expiredLogicalSessionIds = /* @__PURE__ */ new Set();
+    for (const [sessionId, session] of this.sessions.entries()) {
+      if (isExpiredRecord(session, now)) {
+        expiredLogicalSessionIds.add(session.logicalSessionId ?? session.sessionId);
+        this.sessions.delete(sessionId);
+        continue;
+      }
+      if ((session.logicalSessionId ?? session.sessionId) === resolved.logicalSessionId) {
+        this.sessions.delete(sessionId);
+        deleted += 1;
+      }
+    }
+    this.removeAliasesForInactiveLogicalSessions(expiredLogicalSessionIds);
+    this.removeAliasesForLogicalSession(resolved.logicalSessionId);
+    return deleted;
+  }
+  async consumeBackchannelLogoutTokenJti(input) {
+    const now = this.now();
+    this.backchannelLogoutTokenJtiSweepCursor = this.pruneMapBatch(
+      this.backchannelLogoutTokenJtis,
+      now,
+      this.backchannelLogoutTokenJtiSweepCursor
+    );
+    if (!Number.isFinite(input.expiresAt) || input.expiresAt <= now) {
+      return false;
+    }
+    const existingRecord = this.backchannelLogoutTokenJtis.get(input.jti);
+    if (existingRecord && !isExpiredRecord(existingRecord, now)) {
+      return false;
+    }
+    this.backchannelLogoutTokenJtis.set(input.jti, { expiresAt: input.expiresAt });
+    return true;
   }
   async deleteSessionsBySubject(input) {
-    this.pruneExpiredRecords();
+    const now = this.now();
     const resolved = toSubjectDeleteInput(input);
     let deleted = 0;
+    const logicalSessionIds = /* @__PURE__ */ new Set();
+    const expiredLogicalSessionIds = /* @__PURE__ */ new Set();
     for (const [sessionId, session] of this.sessions.entries()) {
+      if (isExpiredRecord(session, now)) {
+        expiredLogicalSessionIds.add(session.logicalSessionId ?? session.sessionId);
+        this.sessions.delete(sessionId);
+        continue;
+      }
       if (session.subject === resolved.subject && matchesProviderScope(session, resolved)) {
+        logicalSessionIds.add(session.logicalSessionId ?? session.sessionId);
         this.sessions.delete(sessionId);
         deleted += 1;
       }
     }
+    this.removeAliasesForInactiveLogicalSessions(expiredLogicalSessionIds);
+    this.removeAliasesForInactiveLogicalSessions(logicalSessionIds);
     return deleted;
   }
   async deleteSessionsByProviderSessionId(input) {
-    this.pruneExpiredRecords();
+    const now = this.now();
     const resolved = toProviderSessionDeleteInput(input);
     let deleted = 0;
+    const logicalSessionIds = /* @__PURE__ */ new Set();
+    const expiredLogicalSessionIds = /* @__PURE__ */ new Set();
     for (const [sessionId, session] of this.sessions.entries()) {
+      if (isExpiredRecord(session, now)) {
+        expiredLogicalSessionIds.add(session.logicalSessionId ?? session.sessionId);
+        this.sessions.delete(sessionId);
+        continue;
+      }
       if (session.providerSessionId === resolved.providerSessionId && matchesProviderScope(session, resolved)) {
+        logicalSessionIds.add(session.logicalSessionId ?? session.sessionId);
         this.sessions.delete(sessionId);
         deleted += 1;
       }
     }
+    this.removeAliasesForInactiveLogicalSessions(expiredLogicalSessionIds);
+    this.removeAliasesForInactiveLogicalSessions(logicalSessionIds);
     return deleted;
   }
-  pruneExpiredRecords() {
-    const now = this.now();
-    this.pruneMap(this.authorizationTransactions, now);
-    this.pruneMap(this.exchangeCodes, now);
-    this.pruneMap(this.sessions, now);
-  }
-  pruneMap(map, now) {
-    for (const [key, value] of map.entries()) {
+  pruneMapBatch(map, now, cursor) {
+    let inspected = 0;
+    let nextCursor;
+    for (const [key, value] of this.entriesAfterCursor(map, cursor)) {
       if (isExpiredRecord(value, now)) {
         map.delete(key);
       }
+      inspected += 1;
+      nextCursor = key;
+      if (inspected >= EXPIRY_SWEEP_BATCH_SIZE) {
+        return nextCursor;
+      }
+    }
+    return void 0;
+  }
+  pruneSessionsBatch(now) {
+    const expiredLogicalSessionIds = /* @__PURE__ */ new Set();
+    let inspected = 0;
+    for (const [sessionId, session] of this.entriesAfterCursor(this.sessions, this.sessionSweepCursor)) {
+      if (isExpiredRecord(session, now)) {
+        expiredLogicalSessionIds.add(session.logicalSessionId ?? session.sessionId);
+        this.sessions.delete(sessionId);
+      }
+      inspected += 1;
+      this.sessionSweepCursor = sessionId;
+      if (inspected >= EXPIRY_SWEEP_BATCH_SIZE) {
+        this.removeAliasesForInactiveLogicalSessions(expiredLogicalSessionIds);
+        return;
+      }
+    }
+    this.sessionSweepCursor = void 0;
+    this.removeAliasesForInactiveLogicalSessions(expiredLogicalSessionIds);
+  }
+  *entriesAfterCursor(map, cursor) {
+    if (!cursor || !map.has(cursor)) {
+      yield* map.entries();
+      return;
+    }
+    let foundCursor = false;
+    for (const entry of map.entries()) {
+      if (!foundCursor) {
+        foundCursor = entry[0] === cursor;
+        continue;
+      }
+      yield entry;
+    }
+    for (const entry of map.entries()) {
+      if (entry[0] === cursor) {
+        return;
+      }
+      yield entry;
+    }
+  }
+  removeAliasesForInactiveLogicalSessions(logicalSessionIds) {
+    for (const logicalSessionId of logicalSessionIds) {
+      this.removeAliasesForInactiveLogicalSession(logicalSessionId);
+    }
+  }
+  removeAliasesForInactiveLogicalSession(logicalSessionId) {
+    if (!this.hasLiveSessionForLogicalSession(logicalSessionId)) {
+      this.removeAliasesForLogicalSession(logicalSessionId);
+    }
+  }
+  hasLiveSessionForLogicalSession(logicalSessionId) {
+    for (const session of this.sessions.values()) {
+      if ((session.logicalSessionId ?? session.sessionId) === logicalSessionId) {
+        return true;
+      }
+    }
+    return false;
+  }
+  removeAliasesForLogicalSession(logicalSessionId) {
+    for (const [sessionId, alias] of this.rotatedSessionAliases.entries()) {
+      if (alias.logicalSessionId === logicalSessionId) {
+        this.rotatedSessionAliases.delete(sessionId);
+      }
     }
   }
 };

package/package.json

@@ -2,7 +2,7 @@
   "name": "@web-ts-toolkit/express-oidc-vault-memory-store",
   "description": "In-memory store provider for @web-ts-toolkit/express-oidc-vault",
   "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/express-oidc-vault-memory-store",
-  "version": "0.31.5",
+  "version": "0.33.0",
   "sideEffects": false,
   "keywords": [
     "express",
@@ -15,17 +15,21 @@
   "types": "./index.d.ts",
   "exports": {
     ".": {
-      "types": "./index.d.ts",
+      "types": {
+        "import": "./index.d.mts",
+        "require": "./index.d.ts",
+        "default": "./index.d.ts"
+      },
       "import": "./index.mjs",
       "require": "./index.js",
       "default": "./index.js"
     }
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "dependencies": {
-    "@web-ts-toolkit/express-oidc-vault": "0.31.5"
+    "@web-ts-toolkit/express-oidc-vault": "0.33.0"
   },
   "files": [
     "**/*",