strata-storage 2.6.1 → 2.7.1

package/dist/features/encryption.js

@@ -3,25 +3,40 @@
  * Zero-dependency encryption/decryption for storage values
  */
 import { EncryptionError } from "../utils/errors.js";
+/**
+ * Default PBKDF2 iteration count. Raised to 600,000 to match current OWASP
+ * guidance for PBKDF2-HMAC-SHA256. The per-record `iterations` value is stored
+ * in {@link EncryptedData} and used on decrypt, so raising this default never
+ * breaks data written with an older, lower count.
+ */
+export const DEFAULT_PBKDF2_ITERATIONS = 600000;
 /**
  * Encryption manager using Web Crypto API
  */
 export class EncryptionManager {
     config;
     keyCache = new Map();
+    macKeyCache = new Map();
     constructor(config = {}) {
+        if (config.keyDerivation && config.keyDerivation !== 'PBKDF2') {
+            throw new EncryptionError('Unsupported key derivation function: only PBKDF2 is available');
+        }
         this.config = {
             algorithm: config.algorithm || 'AES-GCM',
             keyLength: config.keyLength || 256,
-            iterations: config.iterations || 100000,
+            iterations: config.iterations || DEFAULT_PBKDF2_ITERATIONS,
             saltLength: config.saltLength || 16,
+            keyDerivation: 'PBKDF2',
         };
     }
     /**
-     * Check if encryption is available
+     * Check if encryption is available. Uses the Web Crypto API via `globalThis`
+     * so it works in browsers, Web Workers, and modern Node.js / SSR runtimes
+     * (Node 20+ exposes `globalThis.crypto.subtle`) — not just the browser.
      */
     isAvailable() {
-        return typeof window !== 'undefined' && window.crypto && window.crypto.subtle !== undefined;
+        const cryptoObj = globalThis.crypto;
+        return !!cryptoObj && typeof cryptoObj.subtle !== 'undefined';
     }
     /**
      * Encrypt data
@@ -46,14 +61,20 @@ export class EncryptionManager {
                 name: this.config.algorithm,
                 iv: iv,
             }, key, dataBuffer);
-            // Convert to base64 for storage
-            return {
+            const result = {
                 data: this.bufferToBase64(encryptedBuffer),
-                salt: this.bufferToBase64(salt.buffer.slice(salt.byteOffset, salt.byteOffset + salt.byteLength)),
-                iv: this.bufferToBase64(iv.buffer.slice(iv.byteOffset, iv.byteOffset + iv.byteLength)),
+                salt: this.bufferToBase64(this.toArrayBuffer(salt)),
+                iv: this.bufferToBase64(this.toArrayBuffer(iv)),
                 algorithm: this.config.algorithm,
                 iterations: this.config.iterations,
             };
+            // Encrypt-then-MAC for the unauthenticated CBC mode.
+            if (this.config.algorithm === 'AES-CBC') {
+                const macKey = await this.deriveMacKey(password, salt, this.config.iterations);
+                const mac = await crypto.subtle.sign('HMAC', macKey, this.concatBuffers(this.toArrayBuffer(iv), encryptedBuffer));
+                result.mac = this.bufferToBase64(mac);
+            }
+            return result;
         }
         catch (error) {
             throw new EncryptionError(`Encryption failed: ${error}`);
@@ -71,6 +92,21 @@ export class EncryptionManager {
             const dataBuffer = this.base64ToBuffer(encryptedData.data);
             const salt = this.base64ToBuffer(encryptedData.salt);
             const iv = this.base64ToBuffer(encryptedData.iv);
+            // For AES-CBC, verify the HMAC tag BEFORE attempting decryption
+            // (Encrypt-then-MAC). This authenticates the ciphertext and prevents
+            // padding-oracle / tampering attacks against the unauthenticated mode.
+            if (encryptedData.algorithm === 'AES-CBC') {
+                if (!encryptedData.mac) {
+                    throw new EncryptionError('AES-CBC value is missing its authentication tag. It was written by a version ' +
+                        'that did not authenticate CBC and cannot be safely decrypted — re-encrypt the ' +
+                        'data (preferably with the default AES-GCM).');
+                }
+                const macKey = await this.deriveMacKey(password, new Uint8Array(salt), encryptedData.iterations);
+                const valid = await crypto.subtle.verify('HMAC', macKey, this.base64ToBuffer(encryptedData.mac), this.concatBuffers(iv, dataBuffer));
+                if (!valid) {
+                    throw new EncryptionError('Authentication failed: data has been tampered with');
+                }
+            }
             // Derive key from password
             const key = await this.deriveKey(password, new Uint8Array(salt), encryptedData.iterations);
             // Decrypt data
@@ -84,6 +120,8 @@ export class EncryptionManager {
             return JSON.parse(decryptedStr);
         }
         catch (error) {
+            if (error instanceof EncryptionError)
+                throw error;
             throw new EncryptionError(`Decryption failed: ${error}`);
         }
     }
@@ -91,19 +129,14 @@ export class EncryptionManager {
      * Derive encryption key from password
      */
     async deriveKey(password, salt, iterations = this.config.iterations) {
-        // Check cache
-        const saltBuffer = salt.buffer.slice(salt.byteOffset, salt.byteOffset + salt.byteLength);
-        const cacheKey = `${password}-${this.bufferToBase64(saltBuffer)}-${iterations}`;
-        if (this.keyCache.has(cacheKey)) {
-            return this.keyCache.get(cacheKey);
-        }
-        // Import password as key material
-        const encoder = new TextEncoder();
-        const passwordBuffer = encoder.encode(password);
-        const keyMaterial = await crypto.subtle.importKey('raw', passwordBuffer, 'PBKDF2', false, [
-            'deriveBits',
-            'deriveKey',
-        ]);
+        const saltBuffer = this.toArrayBuffer(salt);
+        // Cache key is a hash of the composite, never the raw password — so the
+        // plaintext secret is not retained as a Map key for the process lifetime.
+        const cacheKey = await this.hashCacheKey(`aes:${this.bufferToBase64(saltBuffer)}:${iterations}`, password);
+        const cached = this.keyCache.get(cacheKey);
+        if (cached)
+            return cached;
+        const keyMaterial = await this.importPasswordKeyMaterial(password);
         // Derive key using PBKDF2
         const key = await crypto.subtle.deriveKey({
             name: 'PBKDF2',
@@ -114,10 +147,76 @@ export class EncryptionManager {
             name: this.config.algorithm,
             length: this.config.keyLength,
         }, false, ['encrypt', 'decrypt']);
-        // Cache the key
         this.keyCache.set(cacheKey, key);
         return key;
     }
+    /**
+     * Derive a separate HMAC-SHA256 key for Encrypt-then-MAC on AES-CBC.
+     *
+     * The HMAC key must be cryptographically independent of the AES key, so the
+     * PBKDF2 salt is domain-separated with a trailing marker byte. The MAC key is
+     * non-extractable and limited to sign/verify.
+     */
+    async deriveMacKey(password, salt, iterations = this.config.iterations) {
+        // Domain separation: a distinct salt yields a key unrelated to the AES key.
+        const macSalt = new Uint8Array(salt.length + 1);
+        macSalt.set(salt, 0);
+        macSalt[salt.length] = 0x01; // marker distinguishing the MAC key derivation
+        const macSaltBuffer = this.toArrayBuffer(macSalt);
+        const cacheKey = await this.hashCacheKey(`hmac:${this.bufferToBase64(macSaltBuffer)}:${iterations}`, password);
+        const cached = this.macKeyCache.get(cacheKey);
+        if (cached)
+            return cached;
+        const keyMaterial = await this.importPasswordKeyMaterial(password);
+        const macKey = await crypto.subtle.deriveKey({
+            name: 'PBKDF2',
+            salt: macSaltBuffer,
+            iterations: iterations,
+            hash: 'SHA-256',
+        }, keyMaterial, {
+            name: 'HMAC',
+            hash: 'SHA-256',
+            length: 256,
+        }, false, ['sign', 'verify']);
+        this.macKeyCache.set(cacheKey, macKey);
+        return macKey;
+    }
+    /**
+     * Import a password string as PBKDF2 key material.
+     */
+    async importPasswordKeyMaterial(password) {
+        const encoder = new TextEncoder();
+        const passwordBuffer = encoder.encode(password);
+        return crypto.subtle.importKey('raw', passwordBuffer, 'PBKDF2', false, [
+            'deriveBits',
+            'deriveKey',
+        ]);
+    }
+    /**
+     * Build an opaque cache key by hashing the password together with the public
+     * derivation parameters. Returns a base64 SHA-256 digest so the raw password
+     * is never used as (or recoverable from) the Map key.
+     */
+    async hashCacheKey(scope, password) {
+        const encoder = new TextEncoder();
+        const digest = await crypto.subtle.digest('SHA-256', encoder.encode(`${scope}:${password}`));
+        return this.bufferToBase64(digest);
+    }
+    /**
+     * Copy a (possibly offset) typed array into a standalone ArrayBuffer.
+     */
+    toArrayBuffer(view) {
+        return view.buffer.slice(view.byteOffset, view.byteOffset + view.byteLength);
+    }
+    /**
+     * Concatenate two buffers into one ArrayBuffer.
+     */
+    concatBuffers(a, b) {
+        const out = new Uint8Array(a.byteLength + b.byteLength);
+        out.set(new Uint8Array(a), 0);
+        out.set(new Uint8Array(b), a.byteLength);
+        return out.buffer;
+    }
     /**
      * Convert ArrayBuffer to base64
      */
@@ -145,17 +244,31 @@ export class EncryptionManager {
      */
     clearCache() {
         this.keyCache.clear();
+        this.macKeyCache.clear();
     }
     /**
-     * Generate a secure random password
+     * Generate a secure random password.
+     *
+     * Uses rejection sampling so every character in the alphabet is equally
+     * likely. Naive `randomByte % alphabetLength` is biased whenever 256 is not a
+     * multiple of the alphabet length (here 89), making some characters more
+     * probable and slightly reducing entropy.
      */
     generatePassword(length = 32) {
         const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+-=[]{}|;:,.<>?';
-        const array = new Uint8Array(length);
-        crypto.getRandomValues(array);
+        // Largest multiple of chars.length that fits in a byte; bytes at or above
+        // this threshold are rejected to remove modulo bias.
+        const limit = Math.floor(256 / chars.length) * chars.length;
         let password = '';
-        for (let i = 0; i < length; i++) {
-            password += chars[array[i] % chars.length];
+        const buffer = new Uint8Array(length);
+        while (password.length < length) {
+            crypto.getRandomValues(buffer);
+            for (let i = 0; i < buffer.length && password.length < length; i++) {
+                const byte = buffer[i];
+                if (byte < limit) {
+                    password += chars[byte % chars.length];
+                }
+            }
         }
         return password;
     }

package/dist/features/migration.d.ts

@@ -1,7 +1,7 @@
 /**
  * Migration utilities for storage upgrades
  */
-import type { StorageAdapter } from '@/types';
+import type { StorageAdapter } from "../types/index.js";
 export interface Migration {
     version: number;
     up: (adapter: StorageAdapter) => Promise<void>;

package/dist/features/migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../src/features/migration.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,UAAU,CAAmB;IAErC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAK9B,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YA0B9D,iBAAiB;YAKjB,UAAU;CAOzB"}
+{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../src/features/migration.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG9C,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,UAAU,CAAmB;IAErC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAK9B,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAgC9D,iBAAiB;YAKjB,UAAU;CAOzB"}

package/dist/features/migration.js

@@ -1,6 +1,7 @@
 /**
  * Migration utilities for storage upgrades
  */
+import { MigrationError } from "../utils/errors.js";
 export class MigrationManager {
     migrations = [];
     register(migration) {
@@ -22,9 +23,13 @@ export class MigrationManager {
         }
         else {
             for (const migration of migrationsToRun.reverse()) {
-                if (migration.down) {
-                    await migration.down(adapter);
+                // An irreversible migration must NOT silently lower the stored version
+                // (that would claim a rollback that never reverted the data). Fail
+                // before touching anything so the version stays consistent with data.
+                if (!migration.down) {
+                    throw new MigrationError(`Cannot roll back migration ${migration.version}: it has no down() and is irreversible.`);
                 }
+                await migration.down(adapter);
                 await this.setVersion(adapter, migration.version - 1);
             }
         }

package/dist/features/observer/index.d.ts

@@ -1,2 +1,2 @@
-export * from '../observer';
+export * from "../observer.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/features/observer.d.ts

@@ -1,7 +1,7 @@
 /**
  * Storage Observer - Watch for storage changes
  */
-import type { ObserverCallback, StorageEvent } from '@/types';
+import type { ObserverCallback, StorageEvent } from "../types/index.js";
 export declare class StorageObserver {
     private observers;
     /**

package/dist/features/query/index.d.ts

@@ -1,2 +1,2 @@
-export * from '../query';
+export * from "../query.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/features/query.d.ts

@@ -2,7 +2,7 @@
  * Query Engine Feature
  * Zero-dependency implementation of MongoDB-like query operators
  */
-import type { QueryCondition } from '@/types';
+import type { QueryCondition } from "../types/index.js";
 /**
  * Query engine for advanced data filtering
  */
@@ -68,6 +68,7 @@ export declare class QueryEngine {
     /**
      * Set nested value in object using dot notation
      */
+    private static readonly FORBIDDEN_KEYS;
     private setNestedValue;
     /**
      * Delete nested value from object using dot notation

package/dist/features/query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/features/query.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,SAAS,CAAC;AAG9D;;GAEG;AACH,qBAAa,WAAW;IACtB;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,GAAG,OAAO;IAwB3D;;OAEG;IACH,OAAO,CAAC,YAAY;IAIpB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IASxB;;OAEG;IACH,OAAO,CAAC,eAAe;IA2DvB;;OAEG;IACH,OAAO,CAAC,aAAa;IAkBrB;;OAEG;IACH,OAAO,CAAC,cAAc;IAmBtB;;OAEG;IACH,OAAO,CAAC,MAAM;IA+Bd;;OAEG;IACH,OAAO,CAAC,OAAO;IAyBf;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAOpB;;OAEG;IACH,OAAO,CAAC,OAAO;IASf;;OAEG;IACH,OAAO,CAAC,WAAW;IAcnB;;OAEG;IACH,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;IAoBxD;;OAEG;IACH,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IA2B5E;;OAEG;IACH,OAAO,CAAC,cAAc;IAetB;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAc1B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,WAAW,CAE/C"}
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/features/query.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,SAAS,CAAC;AAG9D;;GAEG;AACH,qBAAa,WAAW;IACtB;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,GAAG,OAAO;IAwB3D;;OAEG;IACH,OAAO,CAAC,YAAY;IAIpB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IASxB;;OAEG;IACH,OAAO,CAAC,eAAe;IAkEvB;;OAEG;IACH,OAAO,CAAC,aAAa;IAkBrB;;OAEG;IACH,OAAO,CAAC,cAAc;IAqBtB;;OAEG;IACH,OAAO,CAAC,MAAM;IA+Bd;;OAEG;IACH,OAAO,CAAC,OAAO;IAyBf;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAOpB;;OAEG;IACH,OAAO,CAAC,OAAO;IASf;;OAEG;IACH,OAAO,CAAC,WAAW;IAcnB;;OAEG;IACH,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;IAoBxD;;OAEG;IACH,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IA6B5E;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAsD;IAE5F,OAAO,CAAC,cAAc;IAyBtB;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAkB1B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,WAAW,CAE/C"}

package/dist/features/query.js

@@ -73,7 +73,15 @@ export class QueryEngine {
                 // Otherwise check if value equals any operand value
                 return operand.some((v) => this.equals(value, v));
             case '$nin':
-                return Array.isArray(operand) && !operand.some((v) => this.equals(value, v));
+                if (!Array.isArray(operand))
+                    return false;
+                // Mirror $in: for an array field, "not in" means none of its items
+                // match any operand value (the previous code compared the whole array
+                // to each scalar operand, giving wrong results for array fields).
+                if (Array.isArray(value)) {
+                    return !operand.some((v) => value.some((item) => this.equals(item, v)));
+                }
+                return !operand.some((v) => this.equals(value, v));
             case '$regex':
                 return this.matchesRegex(value, operand);
             case '$exists':
@@ -121,7 +129,9 @@ export class QueryEngine {
             if (current === null || current === undefined) {
                 return undefined;
             }
-            if (typeof current === 'object' && part in current) {
+            // Match own properties only — `in` would traverse the prototype chain and
+            // could resolve a path segment to an inherited member (e.g. `constructor`).
+            if (typeof current === 'object' && Object.prototype.hasOwnProperty.call(current, part)) {
                 current = current[part];
             }
             else {
@@ -270,8 +280,10 @@ export class QueryEngine {
             }
         }
         else {
-            // Exclusion mode - include all except specified fields
-            result.value = { ...item };
+            // Exclusion mode - include all except specified fields. Spread the item's
+            // own fields directly onto result (NOT under a `value` wrapper, which left
+            // the excluded keys unreachable and returned the whole item unchanged).
+            Object.assign(result, item);
             for (const [key, exclude] of Object.entries(projection)) {
                 if (exclude === 0 || exclude === false) {
                     this.deleteNestedValue(result, key);
@@ -283,17 +295,28 @@ export class QueryEngine {
     /**
      * Set nested value in object using dot notation
      */
+    static FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
     setNestedValue(obj, path, value) {
         const parts = path.split('.');
         let current = obj;
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object') {
+            // Refuse prototype-polluting paths and use own-property checks only — `in`
+            // walks the prototype chain, so a '__proto__.x' path could reach
+            // Object.prototype.
+            if (QueryEngine.FORBIDDEN_KEYS.has(part))
+                return;
+            if (!Object.prototype.hasOwnProperty.call(current, part) ||
+                typeof current[part] !== 'object' ||
+                current[part] === null) {
                 current[part] = {};
             }
             current = current[part];
         }
-        current[parts[parts.length - 1]] = value;
+        const last = parts[parts.length - 1];
+        if (QueryEngine.FORBIDDEN_KEYS.has(last))
+            return;
+        current[last] = value;
     }
     /**
      * Delete nested value from object using dot notation
@@ -303,7 +326,9 @@ export class QueryEngine {
         let current = obj;
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object') {
+            if (!Object.prototype.hasOwnProperty.call(current, part) ||
+                typeof current[part] !== 'object' ||
+                current[part] === null) {
                 return;
             }
             current = current[part];

package/dist/features/sync/index.d.ts

@@ -1,2 +1,2 @@
-export * from '../sync';
+export * from "../sync.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/features/sync.d.ts

@@ -2,8 +2,8 @@
  * Cross-tab Synchronization Feature
  * Zero-dependency implementation using BroadcastChannel and storage events
  */
-import { EventEmitter } from '@/utils';
-import type { StorageType, SubscriptionCallback, UnsubscribeFunction } from '@/types';
+import { EventEmitter } from "../utils/index.js";
+import type { StorageType, SubscriptionCallback, UnsubscribeFunction } from "../types/index.js";
 /**
  * Sync configuration
  */
@@ -61,6 +61,14 @@ export declare class SyncManager extends EventEmitter {
     private setupBroadcastChannel;
     /**
      * Set up storage event listeners for fallback sync
+     *
+     * NOTE: the `storage` event is the cross-tab fallback for environments without
+     * BroadcastChannel, and the browser only fires it for `localStorage` changes
+     * made in OTHER tabs. `sessionStorage` is tab-scoped — it never propagates
+     * cross-tab and never raises a cross-tab `storage` event — so this fallback is
+     * inherently localStorage-only (see `SessionStorageAdapter.capabilities.crossTab
+     * === false`). BroadcastChannel remains the real cross-tab mechanism when
+     * available.
      */
     private setupStorageEvents;
     /**
@@ -72,7 +80,15 @@ export declare class SyncManager extends EventEmitter {
      */
     private emitChange;
     /**
-     * Generate unique origin ID
+     * Narrow an untrusted BroadcastChannel payload to a well-formed SyncMessage.
+     */
+    private isValidSyncMessage;
+    /**
+     * Generate unique origin ID.
+     *
+     * Prefers `crypto.randomUUID()` so two tabs cannot collide on the same origin
+     * (a collision would defeat the self-message filter and cause an echo loop).
+     * Falls back to timestamp + random only where Web Crypto is unavailable.
      */
     private generateOrigin;
     /**

package/dist/features/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/features/sync.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,KAAK,EAEV,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,SAAS,CAAC;AAEjB;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,kBAAkB,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,CAAC;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,WAAW,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,YAAY;IAC3C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,OAAO,CAAC,CAAmB;IACnC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAuE;IACxF,OAAO,CAAC,cAAc,CAAyD;gBAEnE,MAAM,GAAE,UAAe;IAYnC;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAYjC;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,IAAI;IAuBrD;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,oBAAoB,GAAG,mBAAmB;IAY9D;;OAEG;IACH,KAAK,IAAI,IAAI;IAuBb;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAInC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA6B7B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA+C1B;;OAEG;IACH,OAAO,CAAC,WAAW;IAcnB;;OAEG;IACH,OAAO,CAAC,UAAU;IAIlB;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO;CAyB5C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,WAAW,CAElE"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/features/sync.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,KAAK,EAEV,WAAW,EAEX,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,SAAS,CAAC;AAYjB;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,kBAAkB,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,CAAC;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,WAAW,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,YAAY;IAC3C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,OAAO,CAAC,CAAmB;IACnC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAuE;IACxF,OAAO,CAAC,cAAc,CAAyD;gBAEnE,MAAM,GAAE,UAAe;IAYnC;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAYjC;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,IAAI;IAuBrD;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,oBAAoB,GAAG,mBAAmB;IAY9D;;OAEG;IACH,KAAK,IAAI,IAAI;IAuBb;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAInC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAkC7B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;OAEG;IACH,OAAO,CAAC,WAAW;IAcnB;;OAEG;IACH,OAAO,CAAC,UAAU;IAIlB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO;CAyD5C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,WAAW,CAElE"}

package/dist/features/sync.js

@@ -4,6 +4,13 @@
  */
 import { EventEmitter } from "../utils/index.js";
 import { logger } from "../utils/logger.js";
+function isStorageValue(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'value' in value &&
+        'created' in value &&
+        'updated' in value);
+}
 /**
  * Cross-tab synchronization manager
  */
@@ -105,6 +112,11 @@ export class SyncManager extends EventEmitter {
             this.channel = new BroadcastChannel(this.config.channelName);
             this.channel.onmessage = (event) => {
                 const message = event.data;
+                // Validate inbound shape before trusting it. Same-origin scripts can
+                // post arbitrary messages onto this channel, so reject anything that
+                // isn't a well-formed SyncMessage instead of emitting a malformed change.
+                if (!this.isValidSyncMessage(message))
+                    return;
                 // Ignore messages from self
                 if (message.origin === this.origin)
                     return;
@@ -128,19 +140,23 @@ export class SyncManager extends EventEmitter {
     }
     /**
      * Set up storage event listeners for fallback sync
+     *
+     * NOTE: the `storage` event is the cross-tab fallback for environments without
+     * BroadcastChannel, and the browser only fires it for `localStorage` changes
+     * made in OTHER tabs. `sessionStorage` is tab-scoped — it never propagates
+     * cross-tab and never raises a cross-tab `storage` event — so this fallback is
+     * inherently localStorage-only (see `SessionStorageAdapter.capabilities.crossTab
+     * === false`). BroadcastChannel remains the real cross-tab mechanism when
+     * available.
      */
     setupStorageEvents() {
         if (typeof window === 'undefined')
             return;
         const listener = (event) => {
-            // Only process events from other windows
+            // The browser only fires cross-tab `storage` events for localStorage.
             if (event.storageArea !== window.localStorage)
                 return;
-            // Parse the storage type from key prefix
-            let storageType = 'localStorage';
-            if (event.key?.startsWith('strata:session:')) {
-                storageType = 'sessionStorage';
-            }
+            const storageType = 'localStorage';
             // Check if this storage type is enabled for sync
             if (!this.config.storages.includes(storageType))
                 return;
@@ -194,10 +210,30 @@ export class SyncManager extends EventEmitter {
         this.emit('change', change);
     }
     /**
-     * Generate unique origin ID
+     * Narrow an untrusted BroadcastChannel payload to a well-formed SyncMessage.
+     */
+    isValidSyncMessage(message) {
+        if (typeof message !== 'object' || message === null)
+            return false;
+        const m = message;
+        return ((m.type === 'set' || m.type === 'remove' || m.type === 'clear') &&
+            typeof m.storage === 'string' &&
+            typeof m.timestamp === 'number' &&
+            typeof m.origin === 'string');
+    }
+    /**
+     * Generate unique origin ID.
+     *
+     * Prefers `crypto.randomUUID()` so two tabs cannot collide on the same origin
+     * (a collision would defeat the self-message filter and cause an echo loop).
+     * Falls back to timestamp + random only where Web Crypto is unavailable.
      */
     generateOrigin() {
-        return `${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+        const cryptoObj = globalThis.crypto;
+        if (cryptoObj && typeof cryptoObj.randomUUID === 'function') {
+            return cryptoObj.randomUUID();
+        }
+        return `${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
     }
     /**
      * Resolve conflicts between values
@@ -211,11 +247,38 @@ export class SyncManager extends EventEmitter {
             return this.config.conflictResolution(values);
         }
         switch (this.config.conflictResolution) {
-            case 'latest':
-                // Return the last value (most recent)
-                return values[values.length - 1];
+            case 'latest': {
+                // Most-recent-wins by the StorageValue `updated` timestamp so two tabs
+                // with concurrent same-key writes converge on the genuinely newest
+                // value, instead of each applying the other's (last-received-wins, which
+                // diverges and lets a delayed older message clobber a newer local
+                // write). Falls back to positional-last when values carry no timestamp.
+                let newest = values[values.length - 1];
+                let newestTime = isStorageValue(newest) ? newest.updated : undefined;
+                for (const candidate of values) {
+                    if (!isStorageValue(candidate))
+                        continue;
+                    if (typeof newestTime !== 'number' || candidate.updated >= newestTime) {
+                        newest = candidate;
+                        newestTime = candidate.updated;
+                    }
+                }
+                return newest;
+            }
             case 'merge':
-                // Simple merge for objects
+                if (values.every(isStorageValue)) {
+                    const wrappers = values;
+                    const latest = wrappers[wrappers.length - 1];
+                    const payloads = wrappers.map((entry) => entry.value);
+                    if (payloads.every((payload) => typeof payload === 'object' && payload !== null && !Array.isArray(payload))) {
+                        return {
+                            ...latest,
+                            value: Object.assign({}, ...payloads),
+                        };
+                    }
+                    return latest;
+                }
+                // Simple merge for plain user objects
                 if (values.every((v) => typeof v === 'object' && v !== null && !Array.isArray(v))) {
                     return Object.assign({}, ...values);
                 }

package/dist/features/ttl/index.d.ts

@@ -1,2 +1,2 @@
-export * from '../ttl';
+export * from "../ttl.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/features/ttl.d.ts

@@ -2,8 +2,8 @@
  * TTL (Time To Live) Manager
  * Handles automatic expiration of storage items
  */
-import type { StorageValue } from '@/types';
-import { EventEmitter } from '@/utils';
+import type { StorageValue } from "../types/index.js";
+import { EventEmitter } from "../utils/index.js";
 export interface TTLConfig {
     /**
      * Default TTL in milliseconds

package/dist/features/ttl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ttl.d.ts","sourceRoot":"","sources":["../../src/features/ttl.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,UAAW,SAAQ,YAAY;IAC1C,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,eAAe,CAAC,CAAiC;IACzD,OAAO,CAAC,gBAAgB,CAA+C;gBAE3D,MAAM,GAAE,SAAc;IAWlC;;OAEG;IACH,mBAAmB,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS;IA2B7D;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO;IAKvC;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,YAAY;IAezE;;OAEG;IACH,gBAAgB,CACd,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,EAChC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,EACtD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACzC,IAAI;IAcP;;OAEG;IACH,eAAe,IAAI,IAAI;IAOvB;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,EAChC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,EACtD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACzC,OAAO,CAAC,WAAW,EAAE,CAAC;IA0CzB;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAI3D;;OAEG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIxC;;OAEG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,EAChC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GACrD,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAmBrD;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY;IAgB/D;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY;IAQ1C;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI;IAMjD;;OAEG;IACH,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAiBvC;;OAEG;IACH,KAAK,IAAI,IAAI;CAKd;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,CAE/D"}
+{"version":3,"file":"ttl.d.ts","sourceRoot":"","sources":["../../src/features/ttl.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,UAAW,SAAQ,YAAY;IAC1C,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,eAAe,CAAC,CAAiC;IACzD,OAAO,CAAC,gBAAgB,CAA+C;gBAE3D,MAAM,GAAE,SAAc;IAWlC;;OAEG;IACH,mBAAmB,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS;IA6B7D;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO;IAKvC;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,YAAY;IAezE;;OAEG;IACH,gBAAgB,CACd,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,EAChC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,EACtD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACzC,IAAI;IAcP;;OAEG;IACH,eAAe,IAAI,IAAI;IAOvB;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,EAChC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,EACtD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACzC,OAAO,CAAC,WAAW,EAAE,CAAC;IA0CzB;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAI3D;;OAEG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIxC;;OAEG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,EAChC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GACrD,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAmBrD;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY;IAgB/D;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY;IAQ1C;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI;IAMjD;;OAEG;IACH,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAiBvC;;OAEG;IACH,KAAK,IAAI,IAAI;CAKd;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,CAE/D"}

package/dist/features/ttl.js

@@ -32,10 +32,12 @@ export class TTLManager extends EventEmitter {
             const time = options.expireAt instanceof Date ? options.expireAt.getTime() : options.expireAt;
             return time > Date.now() ? time : undefined;
         }
-        // Expire after a certain date
+        // Expire after a certain date — documented as an alias of expireAt, so it
+        // gets the same past-guard (a past time yields no expiry rather than an
+        // entry that is dead on arrival).
         if (options.expireAfter) {
             const afterTime = options.expireAfter instanceof Date ? options.expireAfter.getTime() : options.expireAfter;
-            return afterTime;
+            return afterTime > Date.now() ? afterTime : undefined;
         }
         // TTL from now
         if (options.ttl) {