feat: SessionManager.listForUser and revokeOthers

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## Unreleased
+
+- `SessionManager.listForUser(userId)` and
+  `SessionManager.revokeOthers(userId, keepSessionId)`: list a user's live
+  sessions and end all but one. Additive; for "sign out other sessions" in an
+  account page. Implementations of `SessionManager` must add both (core's does).
+
 ## 1.0.0 (2026-11-10)
 
 First release: the plugin contract of Dune 0.36. It was declared in slices; this

src/identity.ts

@@ -136,6 +136,14 @@ export interface SessionManager {
   revoke(sessionId: string): Promise<void>;
   /** Revoke all sessions for a user. */
   revokeAll(userId: string): Promise<void>;
+  /**
+   * The user's live (unexpired) sessions, newest first. A session's `id` is the
+   * bearer credential in its cookie, so never render it in a page: show a
+   * derived handle and look the session up again server-side to act on it.
+   */
+  listForUser(userId: string): Promise<Session[]>;
+  /** Revoke all of a user's sessions except `keepSessionId` (the caller's own). */
+  revokeOthers(userId: string, keepSessionId: string): Promise<void>;
   /** Clean up expired sessions. */
   cleanup(): Promise<number>;
 }