fix: SessionStore race conditions and async initialization (WAPI-1118)

[chakra-guy]

Summary

Fixes race conditions in SessionStore and replaces fire-and-forget garbage collection with proper async initialization.

• BREAKING: SessionStore constructor is now private; use await SessionStore.create(kvstore) instead
• SessionStore.create() runs garbage collection to completion before returning
• Mutex protection on master list read-modify-write operations (addToMasterList, removeFromMasterList)
• Updated all call sites across packages, apps, and tests

Note: This PR is based on cyfrin/wapi-1116 and should be merged after PR #70.

Jira

• WAPI-1118

Test plan

• New test: GC completes before first public method returns
• New test: concurrent session sets don't lose entries (mutex)
• All unit tests pass (68/68)
• Lint passes
• All new SessionStore(kvstore) call sites updated to await SessionStore.create(kvstore)

---

Note

Medium Risk
Breaking API change and modified session persistence/concurrency behavior; issues here could impact session listing/deletion under load, though coverage was added for the new guarantees.

Overview
Fixes SessionStore initialization and concurrency by making construction async-only and serializing master-list updates.

SessionStore now exposes await SessionStore.create(kvstore) (constructor made private) which runs startup garbage collection to completion before the instance is used, and uses an async-mutex to prevent lost updates in addToMasterList/removeFromMasterList during concurrent set/delete calls.

All apps/tests/load-tests/demos are updated to use the new async factory, and new unit tests cover GC completion on init and concurrent set behavior; changelog and core deps are updated accordingly.

^{Written by Cursor Bugbot for commit fcf6205. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	async-mutex@​0.5.0

View full report

[adonesky1]

Looks right to me!