fix: SessionStore race conditions and async initialization (WAPI-1118)

[chakra-guy]

Summary

Fixes race conditions in SessionStore and replaces fire-and-forget garbage collection with proper async initialization.

• BREAKING: SessionStore constructor is now private; use await SessionStore.create(kvstore) instead
• SessionStore.create() runs garbage collection to completion before returning
• Mutex protection on master list read-modify-write operations (addToMasterList, removeFromMasterList)
• Updated all call sites across packages, apps, and tests

Note: This PR is based on cyfrin/wapi-1116 and should be merged after PR #70.

Jira

• WAPI-1118

Test plan

• New test: GC completes before first public method returns
• New test: concurrent session sets don't lose entries (mutex)
• All unit tests pass (68/68)
• Lint passes
• All new SessionStore(kvstore) call sites updated to await SessionStore.create(kvstore)

---

Note

Medium Risk
Medium risk because it changes the SessionStore instantiation API (breaking) and modifies persistence semantics around master list updates and startup garbage collection, which can affect session resumption and cleanup timing across clients.

Overview
Fixes SessionStore race conditions and startup GC timing. The SessionStore constructor is now private and callers must use await SessionStore.create(kvstore), which runs garbage collection to completion before the store is used.

Master-list updates are now mutex-protected to avoid lost entries under concurrent set/delete operations, with new unit tests covering GC-before-use and concurrent writes; all apps/tests were updated to the async factory API and async-mutex was added as a core dependency.

^{Written by Cursor Bugbot for commit 90bf894. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	async-mutex@​0.5.0

View full report

[adonesky1]

Looks right to me!

The base branch was changed.