@fonderie/auth 7.17.1 → 7.19.0

package/brain/outcomes.md

@@ -98,6 +98,7 @@ location                 JSONB
 previous_token_hash      TEXT
 previous_valid_until     TIMESTAMPTZ
 last_used_at             TIMESTAMPTZ
+client_kind              TEXT
 -- INDEX idx_fonderie_sessions_expires_at (expires_at)
 -- INDEX idx_fonderie_sessions_sid (sid)
 ```
@@ -144,7 +145,7 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
 | GET | `/_admin/users` | `async (ctx) => { const params = new URL(ctx.request.url).searchParams; const email = params.get('email')?.trim().toLowerCase(); if (email) { const user = await users.findByEmail(email); return user ? setApiResponse(HTTP.OK, 'USER', 'User', toAdminUserDTO(user)) : NOT_FOUND(); } const rawLimit = Number(params.get('limit') ?? 50); const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50; const cursorParam = params.get('cursor'); const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null; if (cursorParam && !cursor) return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'Invalid cursor'); const deleted = params.get('deleted') === '1' || params.get('deleted') === 'true'; const page = await users.list({ limit, ...(cursor ? { cursor } : {}), ...(deleted ? { deleted } : {}), }); return setApiResponse(HTTP.OK, 'USERS', 'Users', toAdminUserPageDTO(page)); }` |
 | GET | `/_admin/users/:id` | `async (ctx) => { // Read-only view: a soft-deleted account resolves (deletedAt set), so // an operator arriving from billing sees what happened to it. const user = await users.findByIdIncludingDeleted(idOf(ctx)); return user ? setApiResponse(HTTP.OK, 'USER', 'User', toAdminUserDTO(user)) : NOT_FOUND(); }` |
 | GET | `/_admin/users/:id/login-history` | `async (ctx) => { if (!(await users.findById(idOf(ctx)))) return NOT_FOUND(); const params = new URL(ctx.request.url).searchParams; const rawLimit = Number(params.get('limit') ?? 50); const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50; const cursorParam = params.get('cursor'); const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null; if (cursorParam && !cursor) return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'Invalid cursor'); const page = await events.listByUser({ userId: idOf(ctx), limit, ...(cursor ? { cursor } : {}), }); return setApiResponse( HTTP.OK, 'LOGIN_HISTORY', 'Login history', toLoginHistoryPageDTO(page), ); }` |
-| DELETE | `/_admin/users/:id/sessions` | `async (ctx) => { if (!(await users.findById(idOf(ctx)))) return NOT_FOUND(); await sessions.deleteByUser(idOf(ctx)); return setApiResponse(HTTP.OK, 'SESSIONS_REVOKED', 'All sessions revoked'); }` |
+| DELETE | `/_admin/users/:id/sessions` | `async (ctx) => { if (!(await users.findById(idOf(ctx)))) return NOT_FOUND(); await sessions.deleteByUser(idOf(ctx)); await background(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: idOf(ctx), sids: null, reason: 'admin' } satisfies ISessionRevokedEvent)); return setApiResponse(HTTP.OK, 'SESSIONS_REVOKED', 'All sessions revoked'); }` |
 | GET | `/_admin/users/:id/sessions` | `async (ctx) => { if (!(await users.findById(idOf(ctx)))) return NOT_FOUND(); const rows = await sessions.listLiveByUser(idOf(ctx)); return setApiResponse( HTTP.OK, 'SESSIONS', 'Live sessions', rows.map((r) => toSessionDTO(r, null)), ); }` |
 | POST | `/_admin/users/:id/suspend` | `setSuspended(true)` |
 | POST | `/_admin/users/:id/unsuspend` | `setSuspended(false)` |

package/brain/signatures.md

@@ -52,6 +52,7 @@ new AuthModule(store: IStoreAdapter, config: IAuthConfig, bus?: EventBus | undef
   .name: "@fonderie/auth"
   .version: string
   .describeAdmin(): IAdminDescription
+  .describeEvents(): IEventCatalogEntry<unknown>[]
   .checkReadiness(): IReadinessProblem[]
   .install(app: IFonderieApp): void
 
@@ -93,6 +94,7 @@ interface IAuthSecrets {
 interface IAuthRuntimeConfig {
     sessionDuration?: string;
     sessionMaxAge?: string;
+    sessionPolicies?: Partial<Record<ClientKind, ISessionPolicy>>;
     verificationCooldown?: number;
     mfa?: boolean;
     requireVerification?: boolean;
@@ -103,7 +105,7 @@ interface IDataExportContributor {
     collect: (userId: string) => Promise<unknown> | unknown;
 }
 
-const AUTH_CONFIG_KEYS: Record<keyof IAuthRuntimeConfig, string>
+const AUTH_CONFIG_KEYS: Record<Exclude<keyof IAuthRuntimeConfig, 'sessionPolicies'>, string>
 
 const MESSAGE_KEYS: { readonly emailRegistration: "email-registration"; readonly emailVerification: "email-verification"; readonly passwordReset: "password-reset"; readonly phoneOtp: "phone-otp"; readonly mfaEnabled: "mfa-enabled"; readonly mfaDisabled: "mfa-disabled"; readonly mfaBackupCodesRegenerated: "mfa-backup-codes-regenerated"; readonly emailChanged: "email-changed"; readonly phoneChanged: "phone-changed"; readonly passwordRevoked: "password-revoked"; readonly oauthRegistration: "oauth-registration"; readonly oauthLinked: "oauth-linked"; readonly oauthUnlinked: "oauth-unlinked"; }
 
@@ -159,6 +161,7 @@ interface ISessionDTO {
     location: IRequestLocation | null;
     createdAt: string;
     expiresAt: string;
+    clientKind: string | null;
 }
 
 function sanitizeLocation(input: unknown): IRequestLocation | null
@@ -265,9 +268,29 @@ interface IAdminUserDTO extends IUserDTO {
     createdAt: string;
 }
 
-function describeAuthAdminRoutes(store: IStoreAdapter): IAdminRoute[]
+function describeAuthAdminRoutes(store: IStoreAdapter, bus?: EventBus | undefined): IAdminRoute[]
 
 function toAdminUserDTO(user: IUser): IAdminUserDTO
 
 function toAdminUserPageDTO(page: IUserPage): IAdminUserPageDTO
+
+const CLIENT_KINDS: readonly ["mobile", "desktop", "web"]
+
+const SESSION_POLICY_PRESETS: Readonly<Record<ClientKind, ISessionPolicy>>
+
+function clientKindOf(headers: Headers): "mobile" | "desktop" | "web" | null
+
+function configForClient(config: IAuthConfig, runtime: Partial<IAuthRuntimeConfig> | undefined, kind: "mobile" | "desktop" | "web" | null): IAuthConfig
+
+function readAuthRuntimeConfig(read: (key: string) => unknown): Partial<IAuthRuntimeConfig>
+
+function sessionPolicyConfigKeys(kind: "mobile" | "desktop" | "web"): Record<keyof ISessionPolicy, string>
+
+type ClientKind = (typeof CLIENT_KINDS)[number];
+
+interface ISessionPolicy {
+    sessionDuration?: string;
+    sessionMaxAge?: string;
+    accessTokenDuration?: string;
+}
 ```

package/dist/index.cjs

@@ -70,19 +70,25 @@ var index_exports = {};
 __export(index_exports, {
   AUTH_CONFIG_KEYS: () => AUTH_CONFIG_KEYS,
   AuthModule: () => AuthModule,
+  CLIENT_KINDS: () => CLIENT_KINDS,
   DEFAULT_TEMPLATES: () => DEFAULT_TEMPLATES,
   MESSAGE_KEYS: () => MESSAGE_KEYS,
+  SESSION_POLICY_PRESETS: () => SESSION_POLICY_PRESETS,
   buildAuthAccountLimiter: () => buildAuthAccountLimiter,
   buildAuthIpLimiter: () => buildAuthIpLimiter,
+  clientKindOf: () => clientKindOf,
+  configForClient: () => configForClient,
   describeAuthAdminRoutes: () => describeAuthAdminRoutes,
   importUser: () => importUser,
   normalizeEmail: () => normalizeEmail,
   normalizeEmailSafe: () => normalizeEmailSafe,
   purgeSoftDeletedUsers: () => purgeSoftDeletedUsers,
+  readAuthRuntimeConfig: () => readAuthRuntimeConfig,
   requireAuth: () => import_middlewares3.requireAuth,
   resolveLocation: () => resolveLocation,
   sanitizeLocation: () => sanitizeLocation,
   schemas: () => schemas_exports,
+  sessionPolicyConfigKeys: () => sessionPolicyConfigKeys,
   startUserRetention: () => startUserRetention,
   toAdminUserDTO: () => toAdminUserDTO,
   toAdminUserPageDTO: () => toAdminUserPageDTO,
@@ -329,8 +335,10 @@ var EVENT_KEYS = {
   userPurged: "fonderie.user.purged",
   emailVerified: "fonderie.user.email_verified",
   passwordChanged: "fonderie.user.password_changed",
-  // A session the server revoked — today: a refresh token reused after its
-  // grace (theft signal). { userId, sessionId, reason }.
+  // Sessions the server revoked: { userId, sids (null = all), reason }. Reaches
+  // the user's devices live (@fonderie/sse) so a revoked device signs out at
+  // once. Reasons: 'terminated' (signed out from the devices list),
+  // 'password-changed', 'admin', 'refresh-reuse' (theft signal).
   sessionRevoked: "fonderie.session.revoked"
 };
 
@@ -413,6 +421,79 @@ function validDuration(value, fallback, name) {
   return fallback;
 }
 
+// src/services/session-policy.ts
+var CLIENT_KINDS = ["mobile", "desktop", "web"];
+var SESSION_POLICY_PRESETS = {
+  // Personal device; the token lives in the Keychain / Keystore.
+  mobile: { sessionDuration: "90d", sessionMaxAge: "365d" },
+  // Personal, but often a shared workstation.
+  desktop: { sessionDuration: "30d", sessionMaxAge: "180d" },
+  // Shared and public computers; cookies.
+  web: { sessionDuration: "14d", sessionMaxAge: "90d" }
+};
+function clientKindOf(headers) {
+  const v = headers.get("x-client-kind")?.trim().toLowerCase();
+  return CLIENT_KINDS.includes(v ?? "") ? v : null;
+}
+var FIELDS = ["sessionDuration", "sessionMaxAge", "accessTokenDuration"];
+function configForClient(config, runtime, kind) {
+  const rt = runtime ?? {};
+  const code = config;
+  const out = { ...config, ...rt };
+  for (const field of FIELDS) {
+    const value = (kind ? rt.sessionPolicies?.[kind]?.[field] : void 0) ?? rt[field] ?? (kind ? code.sessionPolicies?.[kind]?.[field] : void 0) ?? code[field] ?? (kind ? SESSION_POLICY_PRESETS[kind][field] : void 0);
+    if (value === void 0) delete out[field];
+    else out[field] = value;
+  }
+  return out;
+}
+function sessionPolicyConfigKeys(kind) {
+  return {
+    sessionDuration: `auth.session.duration.${kind}`,
+    sessionMaxAge: `auth.session.max_age.${kind}`,
+    accessTokenDuration: `auth.access.duration.${kind}`
+  };
+}
+function readAuthRuntimeConfig(read) {
+  const text = (key) => {
+    const v = read(key);
+    return typeof v === "string" && v.trim() ? v.trim() : void 0;
+  };
+  const bool2 = (key) => {
+    const v = read(key);
+    if (typeof v === "boolean") return v;
+    if (typeof v === "string" && ["true", "false"].includes(v.trim().toLowerCase())) return v.trim().toLowerCase() === "true";
+    return void 0;
+  };
+  const num = (key) => {
+    const v = read(key);
+    const n = typeof v === "number" ? v : typeof v === "string" && v.trim() ? Number(v) : NaN;
+    return Number.isFinite(n) ? n : void 0;
+  };
+  const out = {};
+  const set = (k, v) => {
+    if (v !== void 0) out[k] = v;
+  };
+  set("sessionDuration", text("auth.session.duration"));
+  set("sessionMaxAge", text("auth.session.max_age"));
+  set("accessTokenDuration", text("auth.access.duration"));
+  set("verificationCooldown", num("auth.verification.cooldown"));
+  set("mfa", bool2("auth.mfa.enabled"));
+  set("requireVerification", bool2("auth.verification.required"));
+  const policies = {};
+  for (const kind of CLIENT_KINDS) {
+    const keys = sessionPolicyConfigKeys(kind);
+    const policy = {};
+    for (const field of FIELDS) {
+      const v = text(keys[field]);
+      if (v !== void 0) policy[field] = v;
+    }
+    if (Object.keys(policy).length) policies[kind] = policy;
+  }
+  if (Object.keys(policies).length) out.sessionPolicies = policies;
+  return out;
+}
+
 // src/services/mfa.ts
 var import_node_crypto2 = require("crypto");
 var import_core2 = require("@fonderie/core");
@@ -1036,8 +1117,8 @@ var SessionModel = class {
   async create(userId, token, expiresAt, sid, meta) {
     const location = this.locate && meta?.headers ? await resolveLocation(this.locate, { ip: meta.ipAddress, headers: meta.headers }) : null;
     await this.store.query(
-      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid, user_agent, ip_address, location, last_used_at)
-			VALUES ($1, $2, $3, $4, $5, $6, $7, now())
+      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid, user_agent, ip_address, location, last_used_at, client_kind)
+			VALUES ($1, $2, $3, $4, $5, $6, $7, now(), $8)
 			ON CONFLICT (token) DO NOTHING`,
       [
         userId,
@@ -1046,7 +1127,8 @@ var SessionModel = class {
         sid ?? null,
         meta?.userAgent ?? null,
         meta?.ipAddress ?? null,
-        location ? JSON.stringify(location) : null
+        location ? JSON.stringify(location) : null,
+        meta?.clientKind ?? null
       ]
     );
   }
@@ -1061,12 +1143,12 @@ var SessionModel = class {
   async match(token) {
     const hash = hashRefreshToken(token);
     const [current] = await this.store.query(
-      `SELECT id, user_id, sid, token, created_at FROM fonderie_sessions WHERE token IN ($1, $2) AND expires_at > now() LIMIT 1`,
+      `SELECT id, user_id, sid, token, created_at, client_kind FROM fonderie_sessions WHERE token IN ($1, $2) AND expires_at > now() LIMIT 1`,
       [hash, token]
     );
     if (current) return { kind: "current", row: toRow(current) };
     const [previous] = await this.store.query(
-      `SELECT id, user_id, sid, token, created_at, (previous_valid_until > now()) AS in_grace
+      `SELECT id, user_id, sid, token, created_at, client_kind, (previous_valid_until > now()) AS in_grace
 			   FROM fonderie_sessions WHERE previous_token_hash = $1 AND expires_at > now() LIMIT 1`,
       [hash]
     );
@@ -1132,7 +1214,7 @@ var SessionModel = class {
   // No token — that never leaves the server.
   async listLiveByUser(userId) {
     return this.store.query(
-      `SELECT id, sid,
+      `SELECT id, sid, client_kind AS "clientKind",
 			        user_agent AS "userAgent",
 			        ip_address AS "ipAddress",
 			        location,
@@ -1147,22 +1229,30 @@ var SessionModel = class {
   // Terminate one session by row id, scoped to its owner (a user can never
   // delete another user's session). Returns whether a row was removed.
   async terminateById(userId, id) {
+    return await this.terminateByIdReturningSid(userId, id) !== void 0;
+  }
+  /** Terminate one of the user's sessions; its sid (null if unbound), or undefined if none was removed. */
+  async terminateByIdReturningSid(userId, id) {
     const rows = await this.store.query(
-      `DELETE FROM fonderie_sessions WHERE id = $1 AND user_id = $2 RETURNING id`,
+      `DELETE FROM fonderie_sessions WHERE id = $1 AND user_id = $2 RETURNING sid`,
       [id, userId]
     );
-    return rows.length > 0;
+    return rows.length ? rows[0]?.sid ?? null : void 0;
   }
   // Terminate all of a user's sessions except the current one (by sid).
   // Returns the number of sessions removed.
   async terminateOthers(userId, keepSid) {
+    return (await this.terminateOthersReturningSids(userId, keepSid)).length;
+  }
+  /** Terminate all of the user's sessions but `keepSid`; the sids removed. */
+  async terminateOthersReturningSids(userId, keepSid) {
     const rows = await this.store.query(
       `DELETE FROM fonderie_sessions
 			 WHERE user_id = $1 AND (sid IS DISTINCT FROM $2)
-			 RETURNING id`,
+			 RETURNING sid`,
       [userId, keepSid]
     );
-    return rows.length;
+    return rows.map((r) => r.sid);
   }
   async exists(token) {
     const rows = await this.store.query(
@@ -1181,7 +1271,8 @@ var SessionModel = class {
   }
 };
 function toRow(r) {
-  return { id: r.id, userId: r.user_id, sid: r.sid, stored: r.token, createdAt: r.created_at ? new Date(r.created_at) : /* @__PURE__ */ new Date() };
+  const kind = CLIENT_KINDS.includes(r.client_kind ?? "") ? r.client_kind : null;
+  return { id: r.id, userId: r.user_id, sid: r.sid, stored: r.token, createdAt: r.created_at ? new Date(r.created_at) : /* @__PURE__ */ new Date(), clientKind: kind };
 }
 
 // src/models/backup-code.model.ts
@@ -1312,7 +1403,8 @@ function requestMeta(ctx) {
   const meta = {
     ipAddress: typeof ip === "string" && ip.length > 0 ? ip : null,
     userAgent: ua && ua.length > 0 ? ua.slice(0, UA_MAX) : null,
-    headers: ctx.request.headers
+    headers: ctx.request.headers,
+    clientKind: clientKindOf(ctx.request.headers)
   };
   if (meta.ipAddress === null && meta.userAgent === null) warnIfIdentityless(ctx);
   return meta;
@@ -1427,7 +1519,7 @@ function mfaController(store, config, issuer, bus) {
           await users.enableMfa(ctx.user.id);
         }
       }
-      const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
         loginMethod: ctx.user.loginMethod,
         phoneVerified: ctx.user.phoneVerified
       });
@@ -1789,7 +1881,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           },
           reqOpts
         ));
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
           loginMethod: "email"
         });
         const registerMeta = requestMeta(ctx);
@@ -1932,7 +2024,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
             mfaToken
           });
         }
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
           loginMethod: "email"
         });
         await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
@@ -2025,8 +2117,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       if (!payload || payload.type !== "refresh") {
         return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
       }
-      const resolvedRefresh = { ...config, ...config.resolve?.(ctx) };
-      const maxAgeMs = resolvedRefresh.sessionMaxAge ? durationMs(String(resolvedRefresh.sessionMaxAge)) : null;
+      const runtime = config.resolve?.(ctx);
       let issued = null;
       for (let attempt = 0; attempt < 3 && !issued; attempt++) {
         const found = await sessions.match(token);
@@ -2036,10 +2127,12 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         if (found.kind === "reused") {
           await sessions.revokeById(found.row.id);
           await (0, import_core6.background)(
-            bus?.emit(EVENT_KEYS.sessionRevoked, { userId: found.row.userId, sessionId: found.row.id, reason: "refresh-reuse" })
+            bus?.emit(EVENT_KEYS.sessionRevoked, { userId: found.row.userId, sids: [found.row.sid], reason: "refresh-reuse" })
           );
           return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
         }
+        const resolvedRefresh = configForClient(config, runtime, found.row.clientKind);
+        const maxAgeMs = resolvedRefresh.sessionMaxAge ? durationMs(String(resolvedRefresh.sessionMaxAge)) : null;
         if (maxAgeMs !== null && Date.now() - found.row.createdAt.getTime() > maxAgeMs) {
           await sessions.revokeById(found.row.id);
           return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session reached its maximum age \u2014 sign in again");
@@ -2221,7 +2314,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           );
         }
         await phoneVerif.deleteByUser(ctx.user.id);
-        const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
           loginMethod: "phone",
           phoneVerified: true
         });
@@ -2398,6 +2491,7 @@ function toSessionDTO(row, currentSid) {
     ipAddress: row.ipAddress,
     userAgent: row.userAgent,
     location: sanitizeLocation(row.location),
+    clientKind: row.clientKind ?? null,
     createdAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : String(row.createdAt),
     expiresAt: row.expiresAt instanceof Date ? row.expiresAt.toISOString() : String(row.expiresAt)
   };
@@ -2471,10 +2565,11 @@ function userController(store, config, bus) {
       if (!id) {
         return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
       }
-      const removed = await sessions.terminateById(ctx.user.id, id);
-      if (!removed) {
+      const removed = await sessions.terminateByIdReturningSid(ctx.user.id, id);
+      if (removed === void 0) {
         return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
       }
+      await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: [removed], reason: "terminated" }));
       return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "SESSION_TERMINATED", "Session terminated.", { id });
     },
     terminateOtherSessions: async (ctx) => {
@@ -2486,7 +2581,9 @@ function userController(store, config, bus) {
           "Cannot terminate others without a current session context"
         );
       }
-      const count = await sessions.terminateOthers(ctx.user.id, currentSid);
+      const sids = await sessions.terminateOthersReturningSids(ctx.user.id, currentSid);
+      const count = sids.length;
+      if (count) await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids, reason: "terminated" }));
       return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "SESSIONS_TERMINATED", "Other sessions terminated.", { count });
     },
     updateProfile: async (ctx) => {
@@ -2648,6 +2745,7 @@ function userController(store, config, bus) {
       const hash = await hashPassword2(newPassword);
       await users.updatePassword(ctx.user.id, hash);
       await sessions.deleteByUser(ctx.user.id);
+      await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: null, reason: "password-changed" }));
       return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
     /**
@@ -2946,7 +3044,7 @@ function oauthController(store, config, bus) {
       return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
     }
     await announceOAuthUpsert(ctx, upserted, "apple", fullUser);
-    const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, { loginMethod: "apple" });
+    const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), { loginMethod: "apple" });
     await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
     await loginEvents.recordSafe({
       userId: upserted.id,
@@ -3097,7 +3195,7 @@ function oauthController(store, config, bus) {
         return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
       await announceOAuthUpsert(ctx, upserted, "google", fullUser);
-      const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
         loginMethod: "google"
       });
       await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
@@ -3542,6 +3640,7 @@ function extractToken(request) {
 
 // src/admin.ts
 var import_core12 = require("@fonderie/core");
+var import_core13 = require("@fonderie/core");
 function toAdminUserDTO(user) {
   return {
     ...toUserDTO(user),
@@ -3558,7 +3657,7 @@ function toAdminUserPageDTO(page) {
 var ADMIN_PREFIX = "/_admin";
 var idOf = (ctx) => ctx.meta.params?.["id"] ?? "";
 var NOT_FOUND = () => (0, import_core12.setApiResponse)(import_core12.HTTP.NOT_FOUND, "NOT_FOUND", "No such user");
-function adminRouteTable(store) {
+function adminRouteTable(store, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const events = new LoginEventModel(store);
@@ -3631,6 +3730,7 @@ function adminRouteTable(store) {
       async (ctx) => {
         if (!await users.findById(idOf(ctx))) return NOT_FOUND();
         await sessions.deleteByUser(idOf(ctx));
+        await (0, import_core13.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: idOf(ctx), sids: null, reason: "admin" }));
         return (0, import_core12.setApiResponse)(import_core12.HTTP.OK, "SESSIONS_REVOKED", "All sessions revoked");
       }
     ],
@@ -3663,8 +3763,8 @@ function adminRouteTable(store) {
     ["POST", "/_admin/users/:id/unsuspend", setSuspended(false)]
   ];
 }
-function describeAuthAdminRoutes(store) {
-  return adminRouteTable(store).map(([method, path, h]) => ({
+function describeAuthAdminRoutes(store, bus) {
+  return adminRouteTable(store, bus).map(([method, path, h]) => ({
     method,
     path: path.slice(ADMIN_PREFIX.length),
     handlers: [h]
@@ -3685,10 +3785,22 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.17.1";
+  version = "7.19.0";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
-    return { routes: describeAuthAdminRoutes(this.store) };
+    return { routes: describeAuthAdminRoutes(this.store, this.bus) };
+  }
+  // Live sign-out (docs/SESSION-DESIGN.md, Phase 5): a revoked device hears it
+  // at once over @fonderie/sse — only the user it is about, ids only.
+  describeEvents() {
+    const revoked = {
+      type: EVENT_KEYS.sessionRevoked,
+      description: "Some of your sessions were signed out \u2014 sign out if this device is one of them",
+      audience: "user",
+      scope: (p) => ({ userId: p.userId }),
+      project: (p) => ({ sids: p.sids, reason: p.reason })
+    };
+    return [revoked];
   }
   // Report config problems for app.checkProductionReadiness() (data, not throw).
   checkReadiness() {
@@ -3704,7 +3816,7 @@ var AuthModule = class {
 };
 
 // src/templates.ts
-var import_core13 = require("@fonderie/core");
+var import_core14 = require("@fonderie/core");
 
 // src/templates.es.ts
 var ES_TEMPLATES = {
@@ -4181,7 +4293,7 @@ change your password \u2014 someone else may be able to sign in as you.`
 If you did this, you're all set. If not, contact support right away.`
   }
 };
-var DEFAULT_TEMPLATES = (0, import_core13.withTranslations)(EN_TEMPLATES, { fr: FR_TEMPLATES, es: ES_TEMPLATES });
+var DEFAULT_TEMPLATES = (0, import_core14.withTranslations)(EN_TEMPLATES, { fr: FR_TEMPLATES, es: ES_TEMPLATES });
 var SAMPLE_PAYLOADS = {
   [MESSAGE_KEYS.passwordRevoked]: { provider: "Google" },
   [MESSAGE_KEYS.oauthRegistration]: { provider: "Google", appName: "Fonderie" },
@@ -4281,19 +4393,25 @@ function startUserRetention(store, options) {
 0 && (module.exports = {
   AUTH_CONFIG_KEYS,
   AuthModule,
+  CLIENT_KINDS,
   DEFAULT_TEMPLATES,
   MESSAGE_KEYS,
+  SESSION_POLICY_PRESETS,
   buildAuthAccountLimiter,
   buildAuthIpLimiter,
+  clientKindOf,
+  configForClient,
   describeAuthAdminRoutes,
   importUser,
   normalizeEmail,
   normalizeEmailSafe,
   purgeSoftDeletedUsers,
+  readAuthRuntimeConfig,
   requireAuth,
   resolveLocation,
   sanitizeLocation,
   schemas,
+  sessionPolicyConfigKeys,
   startUserRetention,
   toAdminUserDTO,
   toAdminUserPageDTO,