@pegma/sessions v0.2.0

@pegma/sessions v0.2.0

A dependency-alignment release: @pegma/storage-core advances from 0.3.0 to
0.4.0, matching the pin already used by webhooks, mail, and identity so host
dependency trees resolve a single storage-core and no longer need an npm
override to avoid two incompatible Store types. The
@pegma/storage-azure-tables test backend advances to 0.4.0 alongside it.

No behavioural or public API change in the session port itself. The version
advances to 0.2.0 (rather than a patch) because hosts composing this package
must now supply a storage-core 0.4.0 Store, which is a breaking composition
change under 0.x semver. The full memory and Azurite race suite passes
against storage-core 0.4.0 unchanged.

v0.1.1

First release through the hardened path: protected signed annotated tag, prepared artifact, npm trusted publishing. 0.1.0 was published manually after its release workflow failed and has no provenance.

No behavioural change. The 2026-07-29 remediation pass over docs/securityscan.md re-checked all seven findings and disputed every one — each suggested remediation traded a theoretical problem for a real one.

• Documents why the principal-revocation guard lease is deliberately never consulted: expiry judged from an issuing host's clock would let a host running fast release a guard taken seconds ago and issue a session inside the revocation window. Recovery from a faulted revocation stays a repeat destroyAllForPrincipal, which compares no clocks.
• Adds a race case pinning that an issuer whose clock sits a full lease ahead of the revoker is still refused while a revocation is in flight.
• Records the dispositions in docs/securityscan.md and reformats that file so npm run format:check passes.

@pegma/sessions v0.1.0

Initial public 0.x release of @pegma/sessions.

• Server-side session record store for Pegma hosts
• Hashed session identifiers, absolute + idle expiry, and principal-wide revocation
• Extracted from the RetireGolden account API after the first consumer migration merged in RetireGolden/retiregolden.org#54

The package remains 0.x: public API unstable and not production-ready.