@fonderie/auth 7.17.1 → 7.19.0

package/dist/index.d.cts

@@ -1,10 +1,10 @@
 import { IUser } from './types.cjs';
 export { IMfaChallenge, ISession } from './types.cjs';
-import { IFonderieModule, IAdminDescription, IReadinessProblem, IFonderieApp, IDefaultTemplate, IAdminRoute } from '@fonderie/core';
+import { IFonderieModule, IAdminDescription, IEventCatalogEntry, IReadinessProblem, IFonderieApp, IDefaultTemplate, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig, a as IRequestLocation } from './session-C-ptRylj.cjs';
-export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-C-ptRylj.cjs';
+import { I as IAuthConfig, a as IRequestLocation } from './session-B-IgXFu8.cjs';
+export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, C as CLIENT_KINDS, d as ClientKind, e as IAuthRateLimitConfig, f as IAuthRuntimeConfig, g as IAuthSecrets, h as IDataExportContributor, i as ILocationRequest, j as ISessionPolicy, L as LocationResolver, M as MESSAGE_KEYS, S as SESSION_POLICY_PRESETS, k as buildAuthAccountLimiter, l as buildAuthIpLimiter, m as clientKindOf, n as configForClient, r as readAuthRuntimeConfig, o as resolveLocation, s as sanitizeLocation, p as sessionPolicyConfigKeys, w as withSession } from './session-B-IgXFu8.cjs';
 import { IUserDTO } from './dtos/user.cjs';
 export { toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
@@ -19,6 +19,7 @@ declare class AuthModule implements IFonderieModule {
     readonly version: string;
     constructor(store: IStoreAdapter, config: IAuthConfig, bus?: EventBus | undefined);
     describeAdmin(): IAdminDescription;
+    describeEvents(): IEventCatalogEntry[];
     checkReadiness(): IReadinessProblem[];
     install(app: IFonderieApp): void;
 }
@@ -50,6 +51,8 @@ interface ISessionDTO {
     location: IRequestLocation | null;
     createdAt: string;
     expiresAt: string;
+    /** The platform declared at sign-in (mobile | desktop | web), or null. */
+    clientKind: string | null;
 }
 
 declare const registerSchema: z.ZodUnion<readonly [z.ZodObject<{
@@ -201,6 +204,6 @@ interface IAdminUserPageDTO {
     nextCursor: string | null;
 }
 declare function toAdminUserPageDTO(page: IUserPage): IAdminUserPageDTO;
-declare function describeAuthAdminRoutes(store: IStoreAdapter): IAdminRoute[];
+declare function describeAuthAdminRoutes(store: IStoreAdapter, bus?: EventBus): IAdminRoute[];
 
 export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, type IAdminUserDTO, IAuthConfig, type IImportUser, type ILoginEventDTO, type ILoginHistoryPageDTO, type IPurgeOptions, IRequestLocation, type ISessionDTO, IUser, IUserDTO, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, describeAuthAdminRoutes, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, toAdminUserDTO, toAdminUserPageDTO, validateAuthConfig };

package/dist/index.d.ts

@@ -1,10 +1,10 @@
 import { IUser } from './types.js';
 export { IMfaChallenge, ISession } from './types.js';
-import { IFonderieModule, IAdminDescription, IReadinessProblem, IFonderieApp, IDefaultTemplate, IAdminRoute } from '@fonderie/core';
+import { IFonderieModule, IAdminDescription, IEventCatalogEntry, IReadinessProblem, IFonderieApp, IDefaultTemplate, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig, a as IRequestLocation } from './session-C-ptRylj.js';
-export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, d as IAuthRateLimitConfig, e as IAuthRuntimeConfig, f as IAuthSecrets, g as IDataExportContributor, h as ILocationRequest, L as LocationResolver, M as MESSAGE_KEYS, i as buildAuthAccountLimiter, j as buildAuthIpLimiter, r as resolveLocation, s as sanitizeLocation, w as withSession } from './session-C-ptRylj.js';
+import { I as IAuthConfig, a as IRequestLocation } from './session-B-IgXFu8.js';
+export { A as AUTH_CONFIG_KEYS, b as AuthLimitedRoute, c as AuthMessageKey, C as CLIENT_KINDS, d as ClientKind, e as IAuthRateLimitConfig, f as IAuthRuntimeConfig, g as IAuthSecrets, h as IDataExportContributor, i as ILocationRequest, j as ISessionPolicy, L as LocationResolver, M as MESSAGE_KEYS, S as SESSION_POLICY_PRESETS, k as buildAuthAccountLimiter, l as buildAuthIpLimiter, m as clientKindOf, n as configForClient, r as readAuthRuntimeConfig, o as resolveLocation, s as sanitizeLocation, p as sessionPolicyConfigKeys, w as withSession } from './session-B-IgXFu8.js';
 import { IUserDTO } from './dtos/user.js';
 export { toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
@@ -19,6 +19,7 @@ declare class AuthModule implements IFonderieModule {
     readonly version: string;
     constructor(store: IStoreAdapter, config: IAuthConfig, bus?: EventBus | undefined);
     describeAdmin(): IAdminDescription;
+    describeEvents(): IEventCatalogEntry[];
     checkReadiness(): IReadinessProblem[];
     install(app: IFonderieApp): void;
 }
@@ -50,6 +51,8 @@ interface ISessionDTO {
     location: IRequestLocation | null;
     createdAt: string;
     expiresAt: string;
+    /** The platform declared at sign-in (mobile | desktop | web), or null. */
+    clientKind: string | null;
 }
 
 declare const registerSchema: z.ZodUnion<readonly [z.ZodObject<{
@@ -201,6 +204,6 @@ interface IAdminUserPageDTO {
     nextCursor: string | null;
 }
 declare function toAdminUserPageDTO(page: IUserPage): IAdminUserPageDTO;
-declare function describeAuthAdminRoutes(store: IStoreAdapter): IAdminRoute[];
+declare function describeAuthAdminRoutes(store: IStoreAdapter, bus?: EventBus): IAdminRoute[];
 
 export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, type IAdminUserDTO, IAuthConfig, type IImportUser, type ILoginEventDTO, type ILoginHistoryPageDTO, type IPurgeOptions, IRequestLocation, type ISessionDTO, IUser, IUserDTO, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, describeAuthAdminRoutes, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, toAdminUserDTO, toAdminUserPageDTO, validateAuthConfig };

package/dist/index.js

@@ -284,8 +284,10 @@ var EVENT_KEYS = {
   userPurged: "fonderie.user.purged",
   emailVerified: "fonderie.user.email_verified",
   passwordChanged: "fonderie.user.password_changed",
-  // A session the server revoked — today: a refresh token reused after its
-  // grace (theft signal). { userId, sessionId, reason }.
+  // Sessions the server revoked: { userId, sids (null = all), reason }. Reaches
+  // the user's devices live (@fonderie/sse) so a revoked device signs out at
+  // once. Reasons: 'terminated' (signed out from the devices list),
+  // 'password-changed', 'admin', 'refresh-reuse' (theft signal).
   sessionRevoked: "fonderie.session.revoked"
 };
 
@@ -368,6 +370,79 @@ function validDuration(value, fallback, name) {
   return fallback;
 }
 
+// src/services/session-policy.ts
+var CLIENT_KINDS = ["mobile", "desktop", "web"];
+var SESSION_POLICY_PRESETS = {
+  // Personal device; the token lives in the Keychain / Keystore.
+  mobile: { sessionDuration: "90d", sessionMaxAge: "365d" },
+  // Personal, but often a shared workstation.
+  desktop: { sessionDuration: "30d", sessionMaxAge: "180d" },
+  // Shared and public computers; cookies.
+  web: { sessionDuration: "14d", sessionMaxAge: "90d" }
+};
+function clientKindOf(headers) {
+  const v = headers.get("x-client-kind")?.trim().toLowerCase();
+  return CLIENT_KINDS.includes(v ?? "") ? v : null;
+}
+var FIELDS = ["sessionDuration", "sessionMaxAge", "accessTokenDuration"];
+function configForClient(config, runtime, kind) {
+  const rt = runtime ?? {};
+  const code = config;
+  const out = { ...config, ...rt };
+  for (const field of FIELDS) {
+    const value = (kind ? rt.sessionPolicies?.[kind]?.[field] : void 0) ?? rt[field] ?? (kind ? code.sessionPolicies?.[kind]?.[field] : void 0) ?? code[field] ?? (kind ? SESSION_POLICY_PRESETS[kind][field] : void 0);
+    if (value === void 0) delete out[field];
+    else out[field] = value;
+  }
+  return out;
+}
+function sessionPolicyConfigKeys(kind) {
+  return {
+    sessionDuration: `auth.session.duration.${kind}`,
+    sessionMaxAge: `auth.session.max_age.${kind}`,
+    accessTokenDuration: `auth.access.duration.${kind}`
+  };
+}
+function readAuthRuntimeConfig(read) {
+  const text = (key) => {
+    const v = read(key);
+    return typeof v === "string" && v.trim() ? v.trim() : void 0;
+  };
+  const bool2 = (key) => {
+    const v = read(key);
+    if (typeof v === "boolean") return v;
+    if (typeof v === "string" && ["true", "false"].includes(v.trim().toLowerCase())) return v.trim().toLowerCase() === "true";
+    return void 0;
+  };
+  const num = (key) => {
+    const v = read(key);
+    const n = typeof v === "number" ? v : typeof v === "string" && v.trim() ? Number(v) : NaN;
+    return Number.isFinite(n) ? n : void 0;
+  };
+  const out = {};
+  const set = (k, v) => {
+    if (v !== void 0) out[k] = v;
+  };
+  set("sessionDuration", text("auth.session.duration"));
+  set("sessionMaxAge", text("auth.session.max_age"));
+  set("accessTokenDuration", text("auth.access.duration"));
+  set("verificationCooldown", num("auth.verification.cooldown"));
+  set("mfa", bool2("auth.mfa.enabled"));
+  set("requireVerification", bool2("auth.verification.required"));
+  const policies = {};
+  for (const kind of CLIENT_KINDS) {
+    const keys = sessionPolicyConfigKeys(kind);
+    const policy = {};
+    for (const field of FIELDS) {
+      const v = text(keys[field]);
+      if (v !== void 0) policy[field] = v;
+    }
+    if (Object.keys(policy).length) policies[kind] = policy;
+  }
+  if (Object.keys(policies).length) out.sessionPolicies = policies;
+  return out;
+}
+
 // src/services/mfa.ts
 import { createHmac, randomBytes } from "crypto";
 import { constantTimeEqual } from "@fonderie/core";
@@ -991,8 +1066,8 @@ var SessionModel = class {
   async create(userId, token, expiresAt, sid, meta) {
     const location = this.locate && meta?.headers ? await resolveLocation(this.locate, { ip: meta.ipAddress, headers: meta.headers }) : null;
     await this.store.query(
-      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid, user_agent, ip_address, location, last_used_at)
-			VALUES ($1, $2, $3, $4, $5, $6, $7, now())
+      `INSERT INTO fonderie_sessions (user_id, token, expires_at, sid, user_agent, ip_address, location, last_used_at, client_kind)
+			VALUES ($1, $2, $3, $4, $5, $6, $7, now(), $8)
 			ON CONFLICT (token) DO NOTHING`,
       [
         userId,
@@ -1001,7 +1076,8 @@ var SessionModel = class {
         sid ?? null,
         meta?.userAgent ?? null,
         meta?.ipAddress ?? null,
-        location ? JSON.stringify(location) : null
+        location ? JSON.stringify(location) : null,
+        meta?.clientKind ?? null
       ]
     );
   }
@@ -1016,12 +1092,12 @@ var SessionModel = class {
   async match(token) {
     const hash = hashRefreshToken(token);
     const [current] = await this.store.query(
-      `SELECT id, user_id, sid, token, created_at FROM fonderie_sessions WHERE token IN ($1, $2) AND expires_at > now() LIMIT 1`,
+      `SELECT id, user_id, sid, token, created_at, client_kind FROM fonderie_sessions WHERE token IN ($1, $2) AND expires_at > now() LIMIT 1`,
       [hash, token]
     );
     if (current) return { kind: "current", row: toRow(current) };
     const [previous] = await this.store.query(
-      `SELECT id, user_id, sid, token, created_at, (previous_valid_until > now()) AS in_grace
+      `SELECT id, user_id, sid, token, created_at, client_kind, (previous_valid_until > now()) AS in_grace
 			   FROM fonderie_sessions WHERE previous_token_hash = $1 AND expires_at > now() LIMIT 1`,
       [hash]
     );
@@ -1087,7 +1163,7 @@ var SessionModel = class {
   // No token — that never leaves the server.
   async listLiveByUser(userId) {
     return this.store.query(
-      `SELECT id, sid,
+      `SELECT id, sid, client_kind AS "clientKind",
 			        user_agent AS "userAgent",
 			        ip_address AS "ipAddress",
 			        location,
@@ -1102,22 +1178,30 @@ var SessionModel = class {
   // Terminate one session by row id, scoped to its owner (a user can never
   // delete another user's session). Returns whether a row was removed.
   async terminateById(userId, id) {
+    return await this.terminateByIdReturningSid(userId, id) !== void 0;
+  }
+  /** Terminate one of the user's sessions; its sid (null if unbound), or undefined if none was removed. */
+  async terminateByIdReturningSid(userId, id) {
     const rows = await this.store.query(
-      `DELETE FROM fonderie_sessions WHERE id = $1 AND user_id = $2 RETURNING id`,
+      `DELETE FROM fonderie_sessions WHERE id = $1 AND user_id = $2 RETURNING sid`,
       [id, userId]
     );
-    return rows.length > 0;
+    return rows.length ? rows[0]?.sid ?? null : void 0;
   }
   // Terminate all of a user's sessions except the current one (by sid).
   // Returns the number of sessions removed.
   async terminateOthers(userId, keepSid) {
+    return (await this.terminateOthersReturningSids(userId, keepSid)).length;
+  }
+  /** Terminate all of the user's sessions but `keepSid`; the sids removed. */
+  async terminateOthersReturningSids(userId, keepSid) {
     const rows = await this.store.query(
       `DELETE FROM fonderie_sessions
 			 WHERE user_id = $1 AND (sid IS DISTINCT FROM $2)
-			 RETURNING id`,
+			 RETURNING sid`,
       [userId, keepSid]
     );
-    return rows.length;
+    return rows.map((r) => r.sid);
   }
   async exists(token) {
     const rows = await this.store.query(
@@ -1136,7 +1220,8 @@ var SessionModel = class {
   }
 };
 function toRow(r) {
-  return { id: r.id, userId: r.user_id, sid: r.sid, stored: r.token, createdAt: r.created_at ? new Date(r.created_at) : /* @__PURE__ */ new Date() };
+  const kind = CLIENT_KINDS.includes(r.client_kind ?? "") ? r.client_kind : null;
+  return { id: r.id, userId: r.user_id, sid: r.sid, stored: r.token, createdAt: r.created_at ? new Date(r.created_at) : /* @__PURE__ */ new Date(), clientKind: kind };
 }
 
 // src/models/backup-code.model.ts
@@ -1267,7 +1352,8 @@ function requestMeta(ctx) {
   const meta = {
     ipAddress: typeof ip === "string" && ip.length > 0 ? ip : null,
     userAgent: ua && ua.length > 0 ? ua.slice(0, UA_MAX) : null,
-    headers: ctx.request.headers
+    headers: ctx.request.headers,
+    clientKind: clientKindOf(ctx.request.headers)
   };
   if (meta.ipAddress === null && meta.userAgent === null) warnIfIdentityless(ctx);
   return meta;
@@ -1382,7 +1468,7 @@ function mfaController(store, config, issuer, bus) {
           await users.enableMfa(ctx.user.id);
         }
       }
-      const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
         loginMethod: ctx.user.loginMethod,
         phoneVerified: ctx.user.phoneVerified
       });
@@ -1744,7 +1830,7 @@ function authController(store, config, bus, locales = defineLocales()) {
           },
           reqOpts
         ));
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
           loginMethod: "email"
         });
         const registerMeta = requestMeta(ctx);
@@ -1887,7 +1973,7 @@ function authController(store, config, bus, locales = defineLocales()) {
             mfaToken
           });
         }
-        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
           loginMethod: "email"
         });
         await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
@@ -1980,8 +2066,7 @@ function authController(store, config, bus, locales = defineLocales()) {
       if (!payload || payload.type !== "refresh") {
         return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
       }
-      const resolvedRefresh = { ...config, ...config.resolve?.(ctx) };
-      const maxAgeMs = resolvedRefresh.sessionMaxAge ? durationMs(String(resolvedRefresh.sessionMaxAge)) : null;
+      const runtime = config.resolve?.(ctx);
       let issued = null;
       for (let attempt = 0; attempt < 3 && !issued; attempt++) {
         const found = await sessions.match(token);
@@ -1991,10 +2076,12 @@ function authController(store, config, bus, locales = defineLocales()) {
         if (found.kind === "reused") {
           await sessions.revokeById(found.row.id);
           await background3(
-            bus?.emit(EVENT_KEYS.sessionRevoked, { userId: found.row.userId, sessionId: found.row.id, reason: "refresh-reuse" })
+            bus?.emit(EVENT_KEYS.sessionRevoked, { userId: found.row.userId, sids: [found.row.sid], reason: "refresh-reuse" })
           );
           return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
         }
+        const resolvedRefresh = configForClient(config, runtime, found.row.clientKind);
+        const maxAgeMs = resolvedRefresh.sessionMaxAge ? durationMs(String(resolvedRefresh.sessionMaxAge)) : null;
         if (maxAgeMs !== null && Date.now() - found.row.createdAt.getTime() > maxAgeMs) {
           await sessions.revokeById(found.row.id);
           return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session reached its maximum age \u2014 sign in again");
@@ -2176,7 +2263,7 @@ function authController(store, config, bus, locales = defineLocales()) {
           );
         }
         await phoneVerif.deleteByUser(ctx.user.id);
-        const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
+        const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
           loginMethod: "phone",
           phoneVerified: true
         });
@@ -2353,6 +2440,7 @@ function toSessionDTO(row, currentSid) {
     ipAddress: row.ipAddress,
     userAgent: row.userAgent,
     location: sanitizeLocation(row.location),
+    clientKind: row.clientKind ?? null,
     createdAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : String(row.createdAt),
     expiresAt: row.expiresAt instanceof Date ? row.expiresAt.toISOString() : String(row.expiresAt)
   };
@@ -2426,10 +2514,11 @@ function userController(store, config, bus) {
       if (!id) {
         return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Session not found");
       }
-      const removed = await sessions.terminateById(ctx.user.id, id);
-      if (!removed) {
+      const removed = await sessions.terminateByIdReturningSid(ctx.user.id, id);
+      if (removed === void 0) {
         return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Session not found");
       }
+      await background4(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: [removed], reason: "terminated" }));
       return setApiResponse4(HTTP4.OK, "SESSION_TERMINATED", "Session terminated.", { id });
     },
     terminateOtherSessions: async (ctx) => {
@@ -2441,7 +2530,9 @@ function userController(store, config, bus) {
           "Cannot terminate others without a current session context"
         );
       }
-      const count = await sessions.terminateOthers(ctx.user.id, currentSid);
+      const sids = await sessions.terminateOthersReturningSids(ctx.user.id, currentSid);
+      const count = sids.length;
+      if (count) await background4(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids, reason: "terminated" }));
       return setApiResponse4(HTTP4.OK, "SESSIONS_TERMINATED", "Other sessions terminated.", { count });
     },
     updateProfile: async (ctx) => {
@@ -2603,6 +2694,7 @@ function userController(store, config, bus) {
       const hash = await hashPassword2(newPassword);
       await users.updatePassword(ctx.user.id, hash);
       await sessions.deleteByUser(ctx.user.id);
+      await background4(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: null, reason: "password-changed" }));
       return setApiResponse4(HTTP4.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
     /**
@@ -2901,7 +2993,7 @@ function oauthController(store, config, bus) {
       return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
     }
     await announceOAuthUpsert(ctx, upserted, "apple", fullUser);
-    const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, { loginMethod: "apple" });
+    const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), { loginMethod: "apple" });
     await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
     await loginEvents.recordSafe({
       userId: upserted.id,
@@ -3052,7 +3144,7 @@ function oauthController(store, config, bus) {
         return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
       await announceOAuthUpsert(ctx, upserted, "google", fullUser);
-      const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
+      const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
         loginMethod: "google"
       });
       await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
@@ -3497,6 +3589,7 @@ function extractToken(request) {
 
 // src/admin.ts
 import { HTTP as HTTP7, encodeKeysetCursor as encodeKeysetCursor2, setApiResponse as setApiResponse7 } from "@fonderie/core";
+import { background as background6 } from "@fonderie/core";
 function toAdminUserDTO(user) {
   return {
     ...toUserDTO(user),
@@ -3513,7 +3606,7 @@ function toAdminUserPageDTO(page) {
 var ADMIN_PREFIX = "/_admin";
 var idOf = (ctx) => ctx.meta.params?.["id"] ?? "";
 var NOT_FOUND = () => setApiResponse7(HTTP7.NOT_FOUND, "NOT_FOUND", "No such user");
-function adminRouteTable(store) {
+function adminRouteTable(store, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const events = new LoginEventModel(store);
@@ -3586,6 +3679,7 @@ function adminRouteTable(store) {
       async (ctx) => {
         if (!await users.findById(idOf(ctx))) return NOT_FOUND();
         await sessions.deleteByUser(idOf(ctx));
+        await background6(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: idOf(ctx), sids: null, reason: "admin" }));
         return setApiResponse7(HTTP7.OK, "SESSIONS_REVOKED", "All sessions revoked");
       }
     ],
@@ -3618,8 +3712,8 @@ function adminRouteTable(store) {
     ["POST", "/_admin/users/:id/unsuspend", setSuspended(false)]
   ];
 }
-function describeAuthAdminRoutes(store) {
-  return adminRouteTable(store).map(([method, path, h]) => ({
+function describeAuthAdminRoutes(store, bus) {
+  return adminRouteTable(store, bus).map(([method, path, h]) => ({
     method,
     path: path.slice(ADMIN_PREFIX.length),
     handlers: [h]
@@ -3640,10 +3734,22 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.17.1";
+  version = "7.19.0";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
-    return { routes: describeAuthAdminRoutes(this.store) };
+    return { routes: describeAuthAdminRoutes(this.store, this.bus) };
+  }
+  // Live sign-out (docs/SESSION-DESIGN.md, Phase 5): a revoked device hears it
+  // at once over @fonderie/sse — only the user it is about, ids only.
+  describeEvents() {
+    const revoked = {
+      type: EVENT_KEYS.sessionRevoked,
+      description: "Some of your sessions were signed out \u2014 sign out if this device is one of them",
+      audience: "user",
+      scope: (p) => ({ userId: p.userId }),
+      project: (p) => ({ sids: p.sids, reason: p.reason })
+    };
+    return [revoked];
   }
   // Report config problems for app.checkProductionReadiness() (data, not throw).
   checkReadiness() {
@@ -4235,19 +4341,25 @@ function startUserRetention(store, options) {
 export {
   AUTH_CONFIG_KEYS,
   AuthModule,
+  CLIENT_KINDS,
   DEFAULT_TEMPLATES,
   MESSAGE_KEYS,
+  SESSION_POLICY_PRESETS,
   buildAuthAccountLimiter,
   buildAuthIpLimiter,
+  clientKindOf,
+  configForClient,
   describeAuthAdminRoutes,
   importUser,
   normalizeEmail,
   normalizeEmailSafe,
   purgeSoftDeletedUsers,
+  readAuthRuntimeConfig,
   requireAuth2 as requireAuth,
   resolveLocation,
   sanitizeLocation,
   schemas_exports as schemas,
+  sessionPolicyConfigKeys,
   startUserRetention,
   toAdminUserDTO,
   toAdminUserPageDTO,