Session Token Revocation Stamp (lib/session-stamp.ts)

Session validation utility enforcing global sign-outs and token invalidation timestamps. Reuse in authentication layers to handle security revocations.

// Source: https://github.com/rekey-dev/rekey | License: MIT | Copyright 2026 Rekey
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * The session kill switches.
 *
 * Two grains, and which one a revocation writes is the whole point.
 *
 * Per user: `EndUser.sessionsInvalidBefore` and `TenantUser.sessionsInvalidBefore`
 * are stamped ONLY by revocations that end every session the person holds:
 * password change or reset, sign-out everywhere, refresh-token reuse
 * detection. An access token whose `iat` falls before the stamp is refused on
 * its next use, whatever lifetime it was issued with.
 *
 * How it is compared depends on whether the token names a session. One that
 * carries `sid` is also answered for by its refresh family, which the same
 * revocation revoked 

... (truncated -- full source via MCP)