BREAKING CHANGE(core): implement complete stateless architecture with consumer-controlled session persistence

ts/bunq.classes.session.ts

@@ -109,11 +109,15 @@ export class BunqSession {
       secret: this.context.apiKey
     });
 
-    // Extract session token and user info
+    // Extract session token, session ID, and user info
     let sessionToken: string;
+    let sessionId: number;
     let userId: number;
 
     for (const item of response.Response) {
+      if (item.Id) {
+        sessionId = item.Id.id;
+      }
       if (item.Token) {
         sessionToken = item.Token.token;
       }
@@ -126,12 +130,13 @@ export class BunqSession {
       }
     }
 
-    if (!sessionToken || !userId) {
+    if (!sessionToken || !userId || !sessionId) {
       throw new Error('Failed to create session');
     }
 
     // Update context
     this.context.sessionToken = sessionToken;
+    this.context.sessionId = sessionId;
     
     // Update HTTP client context
     this.httpClient.updateContext({
@@ -140,6 +145,7 @@ export class BunqSession {
 
     // Set session expiry (bunq sessions expire after 10 minutes of inactivity)
     this.sessionExpiryTime = plugins.smarttime.TimeStamp.fromMilliSeconds(Date.now() + 600000);
+    this.context.expiresAt = new Date(Date.now() + 600000);
   }
 
   /**
@@ -150,7 +156,9 @@ export class BunqSession {
     if (isOAuth) {
       // OAuth tokens don't expire in the same way as regular sessions
       // Set a far future expiry time
-      this.sessionExpiryTime = plugins.smarttime.TimeStamp.fromMilliSeconds(Date.now() + 365 * 24 * 60 * 60 * 1000);
+      const farFutureTime = Date.now() + 365 * 24 * 60 * 60 * 1000;
+      this.sessionExpiryTime = plugins.smarttime.TimeStamp.fromMilliSeconds(farFutureTime);
+      this.context.expiresAt = new Date(farFutureTime);
     }
   }
 
@@ -192,12 +200,13 @@ export class BunqSession {
   }
 
   /**
-   * Get the current session ID from the token
+   * Get the current session ID
    */
   private getSessionId(): string {
-    // In a real implementation, we would need to store the session ID
-    // For now, return a placeholder
-    return '0';
+    if (!this.context.sessionId) {
+      throw new Error('Session ID not available');
+    }
+    return this.context.sessionId.toString();
   }
 
   /**