[dowski]

A session's row was only deleted when its expired refresh token was
presented again, so a session nobody came back to kept its row, which
getSession reads for liveness, and its token rows forever.

The core component now mounts @convex-dev/batch-worker and runs a loop
that scans the issued refresh tokens oldest first (a new by_state index)
and erases each session whose newest issued token is past the TTL. An
expired token that is not its session's newest is a sibling whose
response was lost, so only that token is erased. When nothing is expired,
the loop sleeps until the oldest issued token expires, for at most a day.

The loop has no caller to pass it the TTL, so sign-in and refresh store
the refresh-token TTL in a one-row ttlConfig table when it differs from
the stored one, and ping the loop on a change. Each run reads the stored
TTL, so a lowered or a raised TTL applies to every session. A new session
also pings the loop; a plain refresh doesn't, since it only pushes its
session's expiry later.

refresh still enforces expiry against the TTL of its own call: the loop
only removes rows of sessions that can no longer refresh, and it may lag.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
auth-v2	Ready	Preview	Oct 28, 2026 8:43pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
convex-auth-docs	Ignored		Oct 28, 2026 8:43pm UTC

[dowski]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Count every revoked session in revokeOtherSessions #786
• Erase expired sessions with a background batch worker loop #785 👈 (View in Graphite)
• Move the session and TTL helpers out of public.ts #784
• Compute refresh token expiry using the time it was issued and the current TTL #781
• Enforce a 100 session max per-user #783
• Session revocation support #759 : 3 other dependent PRs (#760 , #775 , #779 )
• Move to stateful session auth #757
• Remove the sessions.lastRefreshedAt field #758
• reboot

This stack of pull requests is managed by Graphite. Learn more about stacking.

[pkg-pr-new]

npm i https://pkg.pr.new/@convex-dev/auth@785

commit: 37d0505