| 82 | private readonly key: Buffer; |
| 83 | |
| 84 | constructor(secret: string) { |
| 85 | // Derive a stable 32-byte key so the same secret always produces the |
| 86 | // same key (important if the process restarts while cookies are live). |
| 87 | const hmac = createHmac("sha256", secret); |
| 88 | hmac.update("cc-session-key-v1"); |
| 89 | this.key = hmac.digest(); |
| 90 | |
| 91 | // Purge expired sessions every 5 minutes. |
| 92 | setInterval(() => this.cleanup(), 5 * 60_000).unref(); |
| 93 | } |
| 94 | |
| 95 | // ── CRUD ────────────────────────────────────────────────────────────────── |
| 96 | |