qarpeo 0.0.0-alpha.10

package/dist/runtime/server/utils/realtime.d.ts

@@ -0,0 +1,110 @@
+import type { DurableObjectStub, RealtimeMessage, RealtimeUser, RealtimePeer, RealtimeHandlerOptions, RealtimeHandlerRegistration } from "../../../types";
+export type { RealtimePeer, RealtimeHandlerOptions, RealtimeHandlerRegistration };
+/**
+ * Defines a server-side message and lifecycle handler for a room pattern.
+ *
+ * @example
+ *   ```ts
+ *   export default defineRealtimeHandler("chat:*", {
+ *     async message(peer, event, payload) {
+ *       await broadcastToRoom(peer.roomId, "message", {
+ *         from: peer.ctx.user?.name ?? "Anonymous",
+ *         text: payload.text,
+ *         ts: Date.now(),
+ *       })
+ *     },
+ *     connect(peer) {
+ *       console.log(`User connected to ${peer.roomId}`)
+ *     },
+ *   })
+ *   ```
+ */
+export declare function defineRealtimeHandler(roomPattern: string, handlers: RealtimeHandlerOptions): RealtimeHandlerRegistration;
+/**
+ * Retrieves all registered realtime handlers matching a given room ID.
+ */
+export declare function getRealtimeHandlersForRoom(roomId: string): RealtimeHandlerOptions[];
+/**
+ * Retrieves the Durable Object stub for a specific room name.
+ *
+ * @param event Universal server event context (optional if in global context)
+ * @param roomId Room identifier (e.g. "chat:support", "doc:123")
+ * @param bindingName Durable Object binding name (default "QARPEO_ROOM_DO")
+ */
+export declare function getRoomDurableObject(eventOrRoom: any, maybeRoom?: string, bindingName?: string): DurableObjectStub;
+/**
+ * Broadcasts an event and payload to all clients in a room from the server.
+ *
+ * @example
+ *   ;```ts
+ *   await broadcastToRoom(event, "doc:456", "doc:updated", {
+ *     title: "New Title",
+ *     updatedBy: "Admin",
+ *   })
+ *   ```
+ */
+export declare function broadcastToRoom(eventOrRoom: any, roomOrEventName: string, eventNameOrPayload: any, payloadOrOptions?: any, options?: {
+    sender?: string;
+    excludePeerId?: string;
+}): Promise<boolean>;
+/**
+ * Retrieves the active presence roster for a room.
+ *
+ * @example
+ *   ```ts
+ *   const onlineUsers = await getRoomPresence(event, "doc:456")
+ *   console.log(`Online: ${onlineUsers.length}`)
+ *   ```
+ */
+export declare function getRoomPresence(eventOrRoom: any, maybeRoom?: string): Promise<RealtimeUser[]>;
+/**
+ * Retrieves the message history replay buffer for a room from Durable Object storage.
+ *
+ * @example
+ *   ```ts
+ *   const messages = await getRoomHistory(event, "chat:support")
+ *   ```
+ */
+export declare function getRoomHistory(eventOrRoom: any, maybeRoom?: string, options?: {
+    limit?: number;
+    sinceSeq?: number;
+    since?: number;
+}): Promise<RealtimeMessage[]>;
+/**
+ * Clears the persistent message history replay buffer for a room from Durable Object storage.
+ *
+ * @example
+ *   ```ts
+ *   await clearRoomHistory(event, "chat:support")
+ *   ```
+ */
+export declare function clearRoomHistory(eventOrRoom: any, maybeRoom?: string): Promise<boolean>;
+/** Disconnects a user from a room by their userId. */
+export declare function disconnectRoomUser(eventOrRoom: any, roomOrUserId: string, maybeUserId?: string): Promise<number>;
+/**
+ * Retrieves the synchronized state of a room.
+ *
+ * @example
+ *   ```ts
+ *   const state = await getRoomState(event, "doc:456")
+ *   ```
+ */
+export declare function getRoomState<T extends Record<string, any> = Record<string, any>>(eventOrRoom: any, maybeRoom?: string): Promise<T>;
+/**
+ * Replaces the entire synchronized state of a room and broadcasts to all connected clients.
+ *
+ * @example
+ *   ```ts
+ *   await setRoomState(event, "doc:456", { title: "New Document", locked: false })
+ *   ```
+ */
+export declare function setRoomState<T extends Record<string, any> = Record<string, any>>(eventOrRoom: any, roomOrState: string | T, maybeState?: T): Promise<T>;
+/**
+ * Merges a partial patch into the synchronized state of a room and broadcasts the delta.
+ *
+ * @example
+ *   ```ts
+ *   await patchRoomState(event, "doc:456", { locked: true })
+ *   ```
+ */
+export declare function patchRoomState<T extends Record<string, any> = Record<string, any>>(eventOrRoom: any, roomOrPatch: string | Partial<T>, maybePatch?: Partial<T>): Promise<T>;

package/dist/runtime/server/utils/realtime.mjs

@@ -0,0 +1,197 @@
+import { getCloudflareEnv } from "../../bindings.mjs";
+const registeredRealtimeHandlers = [];
+export function defineRealtimeHandler(roomPattern, handlers) {
+  const reg = {
+    pattern: roomPattern,
+    handlers
+  };
+  registeredRealtimeHandlers.push(reg);
+  return reg;
+}
+export function getRealtimeHandlersForRoom(roomId) {
+  return registeredRealtimeHandlers.filter((reg) => {
+    if (reg.pattern === "*" || reg.pattern === roomId) return true;
+    if (reg.pattern.endsWith("*")) {
+      const prefix = reg.pattern.slice(0, -1);
+      return roomId.startsWith(prefix);
+    }
+    return false;
+  }).map((reg) => reg.handlers);
+}
+function resolveRoomAndEvent(arg1, arg2) {
+  if (typeof arg1 === "string") {
+    return { event: void 0, roomId: arg1 };
+  }
+  return { event: arg1, roomId: arg2 || "general" };
+}
+export function getRoomDurableObject(eventOrRoom, maybeRoom, bindingName = "QARPEO_ROOM_DO") {
+  const { event, roomId } = resolveRoomAndEvent(eventOrRoom, maybeRoom);
+  const env = getCloudflareEnv(event);
+  const binding = env[bindingName];
+  if (!binding || typeof binding.idFromName !== "function") {
+    throw new Error(
+      `[qarpeo.realtime] Durable Object binding "${bindingName}" is not available in the current environment. Ensure "qarpeo.realtime: true" or "qarpeo.do: true" is configured.`
+    );
+  }
+  const id = binding.idFromName(roomId);
+  return binding.get(id);
+}
+export async function broadcastToRoom(eventOrRoom, roomOrEventName, eventNameOrPayload, payloadOrOptions, options) {
+  let event;
+  let roomId;
+  let eventName;
+  let payload;
+  let opts;
+  if (typeof eventOrRoom === "string") {
+    event = void 0;
+    roomId = eventOrRoom;
+    eventName = roomOrEventName;
+    payload = eventNameOrPayload;
+    opts = payloadOrOptions;
+  } else {
+    event = eventOrRoom;
+    roomId = roomOrEventName;
+    eventName = eventNameOrPayload;
+    payload = payloadOrOptions;
+    opts = options;
+  }
+  const stub = getRoomDurableObject(event, roomId);
+  const res = await stub.fetch("http://internal/broadcast", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      event: eventName,
+      payload,
+      sender: opts?.sender || "server",
+      excludePeerId: opts?.excludePeerId
+    })
+  });
+  if (!res.ok) {
+    const errorText = await res.text().catch(() => "Unknown error");
+    throw new Error(`[qarpeo.realtime] broadcastToRoom failed: ${errorText}`);
+  }
+  return true;
+}
+export async function getRoomPresence(eventOrRoom, maybeRoom) {
+  const { event, roomId } = resolveRoomAndEvent(eventOrRoom, maybeRoom);
+  const stub = getRoomDurableObject(event, roomId);
+  const res = await stub.fetch("http://internal/presence", {
+    method: "GET"
+  });
+  if (!res.ok) {
+    return [];
+  }
+  const data = await res.json().catch(() => ({ presence: [] }));
+  return data.presence || [];
+}
+export async function getRoomHistory(eventOrRoom, maybeRoom, options) {
+  let opts = options;
+  let finalRoom = maybeRoom;
+  if (typeof maybeRoom === "object" && maybeRoom !== null && !options) {
+    opts = maybeRoom;
+    finalRoom = void 0;
+  }
+  const { event, roomId } = resolveRoomAndEvent(eventOrRoom, finalRoom);
+  const stub = getRoomDurableObject(event, roomId);
+  let url = "http://internal/history";
+  const params = [];
+  if (opts?.limit) params.push(`limit=${opts.limit}`);
+  if (opts?.sinceSeq != null) params.push(`sinceSeq=${opts.sinceSeq}`);
+  if (opts?.since != null) params.push(`since=${opts.since}`);
+  if (params.length > 0) url += `?${params.join("&")}`;
+  const res = await stub.fetch(url, {
+    method: "GET"
+  });
+  if (!res.ok) {
+    return [];
+  }
+  const data = await res.json().catch(() => ({ history: [] }));
+  return data.history || [];
+}
+export async function clearRoomHistory(eventOrRoom, maybeRoom) {
+  const { event, roomId } = resolveRoomAndEvent(eventOrRoom, maybeRoom);
+  const stub = getRoomDurableObject(event, roomId);
+  const res = await stub.fetch("http://internal/history", {
+    method: "DELETE"
+  });
+  return res.ok;
+}
+export async function disconnectRoomUser(eventOrRoom, roomOrUserId, maybeUserId) {
+  let event;
+  let roomId;
+  let userId;
+  if (typeof eventOrRoom === "string") {
+    event = void 0;
+    roomId = eventOrRoom;
+    userId = roomOrUserId;
+  } else {
+    event = eventOrRoom;
+    roomId = roomOrUserId;
+    userId = maybeUserId || "";
+  }
+  const stub = getRoomDurableObject(event, roomId);
+  const res = await stub.fetch("http://internal/disconnect", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ userId })
+  });
+  if (!res.ok) {
+    return 0;
+  }
+  const data = await res.json().catch(() => ({ disconnected: 0 }));
+  return data.disconnected || 0;
+}
+export async function getRoomState(eventOrRoom, maybeRoom) {
+  const { event, roomId } = resolveRoomAndEvent(eventOrRoom, maybeRoom);
+  const stub = getRoomDurableObject(event, roomId);
+  const res = await stub.fetch("http://internal/state", { method: "GET" });
+  if (!res.ok) return {};
+  const data = await res.json().catch(() => ({ state: {} }));
+  return data.state || {};
+}
+export async function setRoomState(eventOrRoom, roomOrState, maybeState) {
+  let event;
+  let roomId;
+  let state;
+  if (typeof eventOrRoom === "string") {
+    event = void 0;
+    roomId = eventOrRoom;
+    state = roomOrState;
+  } else {
+    event = eventOrRoom;
+    roomId = roomOrState;
+    state = maybeState;
+  }
+  const stub = getRoomDurableObject(event, roomId);
+  const res = await stub.fetch("http://internal/state", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ state })
+  });
+  if (!res.ok) throw new Error("[qarpeo.realtime] setRoomState failed");
+  const data = await res.json().catch(() => ({ state }));
+  return data.state;
+}
+export async function patchRoomState(eventOrRoom, roomOrPatch, maybePatch) {
+  let event;
+  let roomId;
+  let patch;
+  if (typeof eventOrRoom === "string") {
+    event = void 0;
+    roomId = eventOrRoom;
+    patch = roomOrPatch;
+  } else {
+    event = eventOrRoom;
+    roomId = roomOrPatch;
+    patch = maybePatch;
+  }
+  const stub = getRoomDurableObject(event, roomId);
+  const res = await stub.fetch("http://internal/state", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ patch })
+  });
+  if (!res.ok) throw new Error("[qarpeo.realtime] patchRoomState failed");
+  const data = await res.json().catch(() => ({ state: patch }));
+  return data.state;
+}

package/dist/runtime/server/utils/schema-fallback.d.ts

@@ -0,0 +1,3 @@
+declare const _default: {};
+export default _default;
+export declare const schema: {};

package/dist/runtime/server/utils/schema-fallback.mjs

@@ -0,0 +1,2 @@
+export default {};
+export const schema = {};

package/dist/runtime/server/utils/session.d.ts

@@ -0,0 +1,72 @@
+import { useSession } from "nuxt/server";
+import type { QarpeoUser } from "../../types/auth";
+/**
+ * Returns the current authenticated user session data from sealed cookie.
+ * Powered by Nuxt 4.6+ native session, with fallback to global session helpers.
+ */
+export declare function getAuthSession<T = any>(event: any): Promise<T>;
+/**
+ * Updates the sealed session cookie with user session data.
+ * Powered by Nuxt 4.6+ native session, and syncs with global session helpers if present.
+ */
+export declare function setAuthSession(event: any, sessionData: any, config?: any): Promise<any>;
+/**
+ * Clears the session cookie.
+ * Powered by Nuxt 4.6+ native session, and syncs with global session helpers if present.
+ */
+export declare function clearAuthSession(event: any, config?: any): Promise<boolean>;
+/**
+ * Requires an active user session, throwing 401 Unauthorized if not authenticated.
+ */
+export declare function requireAuthSession<T = any>(event: any, opts?: any): Promise<T>;
+export declare const getUserSession: typeof getAuthSession;
+export declare const setUserSession: typeof setAuthSession;
+export declare const clearUserSession: typeof clearAuthSession;
+export declare const requireUserSession: typeof requireAuthSession;
+export { useSession };
+export declare function hashSessionToken(secret: string): Promise<string>;
+export interface CreateDeviceSessionOptions {
+    provider?: string;
+    maxAge?: number;
+    maxSessionsPerUser?: number;
+    backend?: "cookie" | "kv";
+}
+export interface DeviceSessionRecord {
+    sessionId: string;
+    tokenSecret: string;
+    tokenHash: string;
+    clientType: string;
+    userAgent: string | null;
+    ipAddress: string | null;
+    loggedInAt: number;
+    expiresAt: number;
+}
+/**
+ * Creates a new multi-device session, handles LRU eviction if limits are exceeded, and saves into
+ * D1 (and KV if backend="kv").
+ */
+export declare function createDeviceSession(event: any, user: QarpeoUser, options?: CreateDeviceSessionOptions): Promise<DeviceSessionRecord>;
+/**
+ * Throttled sliding-window update of last_active. Runs at most once every 15 minutes
+ * to preserve D1 write quotas.
+ */
+export declare function touchDeviceSession(event: any, session: any): Promise<void>;
+export interface SessionListItem {
+    id: string;
+    clientType: string;
+    userAgent: string | null;
+    ipAddress: string | null;
+    lastActive: number;
+    expiresAt: number;
+    isCurrent: boolean;
+}
+/** Lists all active device sessions for a user, sorted by last_active descending. */
+export declare function listDeviceSessions(event: any, userId: string, currentSessionId?: string): Promise<SessionListItem[]>;
+/** Revokes a single session belonging to the user. */
+export declare function revokeDeviceSession(event: any, userId: string, sessionIdToRevoke: string): Promise<boolean>;
+/** Revokes all sessions for the given user. */
+export declare function revokeAllDeviceSessions(event: any, userId: string): Promise<boolean>;
+/** Revokes all sessions for the given user EXCEPT the current active session. */
+export declare function revokeOtherDeviceSessions(event: any, userId: string, currentSessionId?: string): Promise<boolean>;
+/** Validates whether a session ID is still valid in KV (sub-millisecond remote revocation check). */
+export declare function verifyKVSession(event: any, sessionId: string): Promise<boolean>;

package/dist/runtime/server/utils/session.mjs

@@ -0,0 +1,287 @@
+import {
+  getRequestHeader,
+  getSession,
+  updateSession,
+  clearSession,
+  useSession,
+  createError
+} from "nuxt/server";
+import { getD1Binding } from "../../db.mjs";
+import { getKVBinding } from "../../kv.mjs";
+export async function getAuthSession(event) {
+  try {
+    const s = await getSession(event);
+    if (s?.data && Object.keys(s.data).length > 0) {
+      return s.data;
+    }
+  } catch {
+  }
+  if (typeof globalThis.getAuthSession === "function") {
+    try {
+      return await globalThis.getAuthSession(event);
+    } catch {
+    }
+  }
+  if (typeof globalThis.getUserSession === "function") {
+    try {
+      return await globalThis.getUserSession(event);
+    } catch {
+    }
+  }
+  return {};
+}
+export async function setAuthSession(event, sessionData, config) {
+  try {
+    await updateSession(event, config, sessionData);
+  } catch {
+  }
+  if (typeof globalThis.setAuthSession === "function") {
+    try {
+      await globalThis.setAuthSession(event, sessionData, config);
+    } catch {
+    }
+  }
+  if (typeof globalThis.setUserSession === "function") {
+    try {
+      await globalThis.setUserSession(event, sessionData, config);
+    } catch {
+    }
+  }
+  return sessionData;
+}
+export async function clearAuthSession(event, config) {
+  try {
+    await clearSession(event, config);
+  } catch {
+  }
+  if (typeof globalThis.clearAuthSession === "function") {
+    try {
+      await globalThis.clearAuthSession(event, config);
+    } catch {
+    }
+  }
+  if (typeof globalThis.clearUserSession === "function") {
+    try {
+      await globalThis.clearUserSession(event, config);
+    } catch {
+    }
+  }
+  return true;
+}
+export async function requireAuthSession(event, opts) {
+  const session = await getAuthSession(event);
+  if (!session?.user?.id) {
+    if (typeof globalThis.requireAuthSession === "function") {
+      return globalThis.requireAuthSession(event, opts);
+    }
+    if (typeof globalThis.requireUserSession === "function") {
+      return globalThis.requireUserSession(event, opts);
+    }
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Unauthorized",
+      message: "Authentication required"
+    });
+  }
+  return session;
+}
+export const getUserSession = getAuthSession;
+export const setUserSession = setAuthSession;
+export const clearUserSession = clearAuthSession;
+export const requireUserSession = requireAuthSession;
+export { useSession };
+export async function hashSessionToken(secret) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(secret);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+export async function createDeviceSession(event, user, options = {}) {
+  const sessionId = crypto.randomUUID();
+  const tokenSecret = crypto.randomUUID();
+  const tokenHash = await hashSessionToken(tokenSecret);
+  const clientType = getRequestHeader(event, "x-client-type") || "web";
+  const userAgent = getRequestHeader(event, "user-agent") || null;
+  const ipAddress = getRequestHeader(event, "cf-connecting-ip") || getRequestHeader(event, "x-forwarded-for")?.split(",")[0]?.trim() || null;
+  const now = Date.now();
+  const maxAge = options.maxAge || 604800;
+  const expiresAt = now + maxAge * 1e3;
+  const maxSessions = options.maxSessionsPerUser ?? 5;
+  let d1;
+  try {
+    const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+    d1 = getD1Binding(bindingName, event);
+  } catch {
+    d1 = null;
+  }
+  if (d1) {
+    await d1.prepare(`
+        INSERT INTO _qarpeo_sessions (id, user_id, token_hash, client_type, user_agent, ip_address, last_active, expires_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      `).bind(sessionId, user.id, tokenHash, clientType, userAgent, ipAddress, now, expiresAt).run();
+    if (maxSessions > 0) {
+      const activeSessions = await d1.prepare("SELECT id FROM _qarpeo_sessions WHERE user_id = ? ORDER BY last_active ASC").bind(user.id).all();
+      const results = activeSessions.results || [];
+      if (results.length > maxSessions) {
+        const excessCount = results.length - maxSessions;
+        const toEvict = results.slice(0, excessCount).map((r) => r.id);
+        for (const evictId of toEvict) {
+          await d1.prepare("DELETE FROM _qarpeo_sessions WHERE id = ?").bind(evictId).run();
+          if (options.backend === "kv") {
+            try {
+              const kv = getKVBinding("KV", event);
+              await kv.delete(`session:${evictId}`);
+            } catch {
+            }
+          }
+        }
+      }
+    }
+  }
+  if (options.backend === "kv") {
+    try {
+      const kv = getKVBinding("KV", event);
+      const kvPayload = {
+        sessionId,
+        tokenHash,
+        userId: user.id,
+        user,
+        clientType,
+        ipAddress,
+        userAgent,
+        expiresAt,
+        loggedInAt: now,
+        tenantId: event?.context?.tenant?.id ?? null
+      };
+      await kv.put(`session:${sessionId}`, JSON.stringify(kvPayload), {
+        expirationTtl: maxAge
+      });
+    } catch (err) {
+      console.warn("[qarpeo] Failed to store session in KV:", err.message);
+    }
+  }
+  return {
+    sessionId,
+    tokenSecret,
+    tokenHash,
+    clientType,
+    userAgent,
+    ipAddress,
+    loggedInAt: now,
+    expiresAt
+  };
+}
+export async function touchDeviceSession(event, session) {
+  if (!session?.sessionId) return;
+  const now = Date.now();
+  const fifteenMinutes = 15 * 60 * 1e3;
+  if (session.lastActiveUpdated && now - session.lastActiveUpdated < fifteenMinutes) {
+    return;
+  }
+  session.lastActiveUpdated = now;
+  const updateTask = async () => {
+    try {
+      const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+      const d1 = getD1Binding(bindingName, event);
+      await d1.prepare("UPDATE _qarpeo_sessions SET last_active = ? WHERE id = ?").bind(now, session.sessionId).run();
+    } catch {
+    }
+  };
+  const ctx = event.context?.cloudflare?.context;
+  if (ctx && typeof ctx.waitUntil === "function") {
+    ctx.waitUntil(updateTask());
+  } else {
+    updateTask().catch(() => {
+    });
+  }
+}
+export async function listDeviceSessions(event, userId, currentSessionId) {
+  try {
+    const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+    const d1 = getD1Binding(bindingName, event);
+    const res = await d1.prepare(
+      "SELECT id, client_type, user_agent, ip_address, last_active, expires_at FROM _qarpeo_sessions WHERE user_id = ? ORDER BY last_active DESC"
+    ).bind(userId).all();
+    const rows = res.results || [];
+    return rows.map((r) => ({
+      id: r.id,
+      clientType: r.client_type || "web",
+      userAgent: r.user_agent || null,
+      ipAddress: r.ip_address || null,
+      lastActive: r.last_active,
+      expiresAt: r.expires_at,
+      isCurrent: r.id === currentSessionId
+    }));
+  } catch {
+    return [];
+  }
+}
+export async function revokeDeviceSession(event, userId, sessionIdToRevoke) {
+  try {
+    const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+    const d1 = getD1Binding(bindingName, event);
+    await d1.prepare("DELETE FROM _qarpeo_sessions WHERE id = ? AND user_id = ?").bind(sessionIdToRevoke, userId).run();
+    try {
+      const kv = getKVBinding("KV", event);
+      await kv.delete(`session:${sessionIdToRevoke}`);
+    } catch {
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+export async function revokeAllDeviceSessions(event, userId) {
+  try {
+    const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+    const d1 = getD1Binding(bindingName, event);
+    const res = await d1.prepare("SELECT id FROM _qarpeo_sessions WHERE user_id = ?").bind(userId).all();
+    const sessionIds = (res.results || []).map((r) => r.id);
+    await d1.prepare("DELETE FROM _qarpeo_sessions WHERE user_id = ?").bind(userId).run();
+    try {
+      const kv = getKVBinding("KV", event);
+      for (const id of sessionIds) {
+        await kv.delete(`session:${id}`);
+      }
+    } catch {
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+export async function revokeOtherDeviceSessions(event, userId, currentSessionId) {
+  if (!currentSessionId) return false;
+  try {
+    const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+    const d1 = getD1Binding(bindingName, event);
+    const res = await d1.prepare("SELECT id FROM _qarpeo_sessions WHERE user_id = ? AND id != ?").bind(userId, currentSessionId).all();
+    const sessionIds = (res.results || []).map((r) => r.id);
+    await d1.prepare("DELETE FROM _qarpeo_sessions WHERE user_id = ? AND id != ?").bind(userId, currentSessionId).run();
+    try {
+      const kv = getKVBinding("KV", event);
+      for (const id of sessionIds) {
+        await kv.delete(`session:${id}`);
+      }
+    } catch {
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+export async function verifyKVSession(event, sessionId) {
+  try {
+    const kv = getKVBinding("KV", event);
+    const data = await kv.get(`session:${sessionId}`, { type: "json" });
+    if (!data) return false;
+    const sessionTenantId = data.tenantId ?? null;
+    const requestTenantId = event?.context?.tenant?.id ?? null;
+    if (sessionTenantId && requestTenantId && sessionTenantId !== requestTenantId) {
+      return false;
+    }
+    return true;
+  } catch {
+    return true;
+  }
+}