Note

Medium Risk
Touches session and WebSocket verification and revocation error paths in auth; behavior is largely additive structured fields with nested causes, but callers depending on old error shapes or broad mapError wrappers could see different error tags.

Overview
SessionStore auth failures now carry structured correlation fields instead of relying on generic messages alone.

Expiry, unknown-session, revocation, and invalid-exp errors for session and WebSocket tokens include sessionId plus lifecycle timestamps (expiresAt / observedAt or revokedAt). Internal paths—issue, verify, WebSocket issue/verify, revoke, and revoke-all-except—attach sessionId (or currentSessionId) on wrapper errors while nesting encoding and persistence failures as cause. Expiry checks use DateTime.now rather than raw millisecond clock reads.

Tests assert tagged error shapes and context fields (including repository failures on revoke) instead of substring checks on message.

^{Reviewed by Cursor Bugbot for commit 308f5f4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add session context fields to credential and revocation errors in SessionStore

• Adds structured context fields (sessionId, expiresAt, observedAt, revokedAt, etc.) to all typed errors in SessionStore.ts, replacing bare string messages.
• Switches time resolution from Clock.currentTimeMillis to DateTime.now for expiry checks in both session and WebSocket token verification.
• Maps previously untyped repository and encoding failures into specific typed errors (SessionCredentialIssueError, SessionRevocationError, OtherSessionsRevocationError, etc.) with nested causes.
• Updates tests in SessionStore.test.ts to assert on typed error tags and contextual fields rather than message substrings.

^{Macroscope summarized 308f5f4.}