@cosmicdrift/kumiko-bundled-features 0.113.1 → 1.0.0

package/src/ledger/recurring.ts

@@ -53,22 +53,6 @@ export function scheduleReference(scheduleId: string, period: string): string {
   return `schedule:${scheduleId}:${period}`;
 }
 
-// A Storno mirror carries reference = the reversed tx's id, so any tx whose
-// reference names another tx in the set marks that other tx reversed. Shared
-// by mergeScheduleActuals (below) and confirm-schedule-period.write.ts's
-// idempotency check (684/4) — same detection, kept in one place so a fix
-// can't land in one call-site and drift from the other.
-export function findReversedIds(
-  rows: readonly { readonly id: string; readonly reference: string | null }[],
-): Set<string> {
-  const ids = new Set(rows.map((r) => r.id));
-  return new Set(
-    rows
-      .filter((r) => r.reference !== null && ids.has(r.reference))
-      .map((r) => r.reference as string),
-  );
-}
-
 // "YYYY-MM" ⇄ a month index (year*12 + monthOfYear), so window math is pure
 // integer arithmetic — no Date object (no-date-api guard) and no DST/timezone
 // drift. isoMonth tolerates a full ISO date ("2026-01-15" → "2026-01").
@@ -121,7 +105,14 @@ export function mergeScheduleActuals(
   transactions: readonly LedgerTxRow[],
   asOf: string,
 ): ScheduleMonth[] {
-  const reversedTxIds = findReversedIds(transactions);
+  const txIds = new Set(transactions.map((t) => t.id));
+  // A Storno mirror carries reference = the reversed tx's id, so any tx whose
+  // reference names another tx marks that other tx reversed.
+  const reversedTxIds = new Set(
+    transactions
+      .filter((t) => t.reference != null && txIds.has(t.reference))
+      .map((t) => t.reference as string),
+  );
   const asOfIndex = monthIndex(isoMonth(asOf));
 
   return projection.map((projected) => {

package/src/ledger/web/index.ts

@@ -1,7 +1,6 @@
 // @runtime client
-// Client-safe ledger surface: QN constants, the pure recurring helpers
-// (projection + Soll/Ist merge), and the Zod payload schemas (for client-side
-// pre-validation before dispatch) — nothing else. The full `../ledger` entry
+// Client-safe ledger surface: QN constants + the pure recurring helpers
+// (projection + Soll/Ist merge), nothing else. The full `../ledger` entry
 // re-exports the feature/handlers/executor, which pull bun-db/postgres — a
 // browser bundle that imports from there fails on Node builtins. A client screen
 // (e.g. a rent-cashflow view) imports the dispatch QNs + the pure forecast/merge

package/src/legal-pages/feature.ts

@@ -26,7 +26,9 @@ type ByslugQueryBody = {
   data: { title: string; body: string | null; updatedAt: string } | null;
 };
 
-// 60s-shared-cache saves the origin-revalidate roundtrip; legal-content edits are live within 60s.
+// Legal-Content ändert sich selten — ein 60s-Shared-Cache-Fenster spart den
+// Origin-Revalidate-Roundtrip (jeder 304 re-runt sonst die Content-Query),
+// ohne dass Edits spürbar stale wirken.
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
 
 // legal-pages — Opt-in-Wrapper um text-content für DACH-Compliance.

package/src/mail-foundation/__tests__/mail-foundation.integration.test.ts

@@ -10,7 +10,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
@@ -24,7 +24,6 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createMutableMasterKeyProvider,
-  createTestEnvelopeCipher,
   type MutableMasterKeyProvider,
 } from "@cosmicdrift/kumiko-framework/testing";
 import { z } from "zod";
@@ -88,8 +87,8 @@ let providerRef: MutableMasterKeyProvider;
 const testEncryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(testEncryptionKey);
-  resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(testEncryptionKey);
+  resolver = createConfigResolver({ encryption });
 
   // Master-key for the secrets-feature. Production env shape:
   //   KUMIKO_SECRETS_MASTER_KEY_V1=<base64 32 bytes>

package/src/managed-pages/__tests__/branding-coerce.test.ts

@@ -2,8 +2,12 @@ import { describe, expect, test } from "bun:test";
 import { type BrandingTokens, EMPTY_BRANDING } from "../../page-render";
 import { coerceBranding } from "../branding";
 
-// IO-boundary coercion: untrusted `unknown` → BrandingTokens, no `as` cast —
-// every missing/non-string field collapses to "" instead of throwing.
+// coerceBranding is the IO boundary for the branding query's wire response:
+// untrusted `unknown` → BrandingTokens with no `as` cast. Every missing or
+// non-string field must collapse to "" so a malformed/empty response renders
+// the unbranded default rather than throwing — and an attacker-controlled
+// non-string (e.g. a logoUrl object) can never leak through as a live render
+// token. Exercised only indirectly by the integration path before this.
 
 describe("coerceBranding", () => {
   const FULL: BrandingTokens = {

package/src/managed-pages/feature.ts

@@ -28,7 +28,9 @@ import { pageEntity } from "./table";
 // Alias (publicstatus = "Admin") müssen TenantAdmin granten/mappen.
 const ADMIN_ACCESS = { roles: ["TenantAdmin", "SystemAdmin"] } as const;
 
-// 60s-shared-cache saves the origin-revalidate roundtrip; CMS edits are live within 60s.
+// Published CMS-Content ändert sich selten — ein 60s-Shared-Cache-Fenster
+// spart den Origin-Revalidate-Roundtrip (jeder 304 re-runt sonst Page- +
+// Branding-Query), Edits sind nach spätestens 60s live.
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
 
 // QN-Konstante als dokumentierter Public-Contract — der Render-Pfad ruft

package/src/readiness/__tests__/readiness.integration.test.ts

@@ -6,7 +6,7 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
@@ -18,7 +18,6 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigAccessorFactory } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
@@ -134,8 +133,8 @@ let stack: TestStack;
 let db: DbConnection;
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(randomBytes(32).toString("base64"));
+  const resolver = createConfigResolver({ encryption });
   const masterKeyProvider = createEnvMasterKeyProvider({
     env: {
       KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),

package/src/secrets/handlers/rotate.job.ts

@@ -26,12 +26,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import type { JobHandlerFn, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import {
-  decodeStoredEnvelope,
-  encodeStoredEnvelope,
-  rewrapDek,
-} from "@cosmicdrift/kumiko-framework/secrets";
-import { type ChunkedMigrationStopReason, runChunkedMigration } from "../../shared";
+import { rewrapDek } from "@cosmicdrift/kumiko-framework/secrets";
 import { type StoredEnvelope, tenantSecretEntity, tenantSecretsTable } from "../table";
 
 const DEFAULT_BATCH_SIZE = 100;
@@ -52,7 +47,7 @@ export type RotateJobResult = {
   readonly migrated: number;
   readonly failed: number;
   readonly batchesProcessed: number;
-  readonly stoppedReason: ChunkedMigrationStopReason;
+  readonly stoppedReason: "empty" | "timeout" | "signal" | "too_many_failures";
 };
 
 export const rotateJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
@@ -76,6 +71,11 @@ export const rotateJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> =>
     ? Date.now() + payload.maxDurationMs
     : Number.POSITIVE_INFINITY;
 
+  let migrated = 0;
+  let failed = 0;
+  let batchesProcessed = 0;
+  let stoppedReason: RotateJobResult["stoppedReason"] = "empty";
+
   // Reuse a TenantDb-per-tenant map so we don't rebuild the wrapper for
   // each row in the same tenant. Rotation typically hits one tenant in a
   // batch; the map trims an allocation without adding complexity.
@@ -89,80 +89,101 @@ export const rotateJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> =>
     return existing;
   }
 
-  type SecretRow = {
-    id: string;
-    tenantId: string;
-    version: number;
-    envelope: StoredEnvelope;
-    kekVersion: number;
-  };
-
-  // A partial batch means the ne-filter is exhausted — the next re-query
-  // would only re-serve rows that failed above; end the run instead.
-  let sawPartialBatch = false;
-  async function nextBatch(): Promise<readonly SecretRow[]> {
-    if (sawPartialBatch) return [];
-    const batch = await selectMany<SecretRow>(
-      db,
-      tenantSecretsTable,
-      { kekVersion: { ne: provider.currentVersion() } },
-      { limit: batchSize },
-    );
-    if (batch.length < batchSize) sawPartialBatch = true;
-    return batch;
-  }
+  while (true) {
+    if (ctx.signal?.aborted) {
+      stoppedReason = "signal";
+      break;
+    }
+    if (Date.now() >= deadline) {
+      stoppedReason = "timeout";
+      break;
+    }
+
+    const targetVersion = provider.currentVersion();
+    const batch = await selectMany<{
+      id: string;
+      tenantId: string;
+      version: number;
+      envelope: StoredEnvelope;
+      kekVersion: number;
+    }>(db, tenantSecretsTable, { kekVersion: { ne: targetVersion } }, { limit: batchSize });
+
+    if (batch.length === 0) break;
+
+    batchesProcessed++;
 
-  async function migrateRow(row: SecretRow): Promise<"migrated" | "skipped" | "failed"> {
-    const rotated = await rewrapDek(decodeStoredEnvelope(row.envelope), provider);
-    if (rotated.kekVersion === row.kekVersion) return "skipped";
-
-    const actor: SessionUser = {
-      id: "system",
-      tenantId: row.tenantId as TenantId,
-      roles: SYSTEM_ROLES,
-    };
-    const result = await executor.update(
-      {
-        id: row.id,
-        version: row.version,
-        changes: {
-          envelope: encodeStoredEnvelope(rotated),
+    if (failed >= maxFailures) {
+      stoppedReason = "too_many_failures";
+      break;
+    }
+
+    for (const row of batch) {
+      if (failed >= maxFailures) {
+        stoppedReason = "too_many_failures";
+        break;
+      }
+      try {
+        const oldEnvelope = {
+          ciphertext: Buffer.from(row.envelope.ciphertext, "base64"),
+          iv: Buffer.from(row.envelope.iv, "base64"),
+          authTag: Buffer.from(row.envelope.authTag, "base64"),
+          encryptedDek: Buffer.from(row.envelope.encryptedDek, "base64"),
+          kekVersion: row.envelope.kekVersion,
+        };
+        const rotated = await rewrapDek(oldEnvelope, provider);
+
+        if (rotated.kekVersion === row.kekVersion) continue;
+
+        const newEnvelope: StoredEnvelope = {
+          ciphertext: rotated.ciphertext.toString("base64"),
+          iv: rotated.iv.toString("base64"),
+          authTag: rotated.authTag.toString("base64"),
+          encryptedDek: rotated.encryptedDek.toString("base64"),
           kekVersion: rotated.kekVersion,
-        },
-      },
-      actor,
-      tdbFor(row.tenantId as TenantId),
-    );
-
-    // version_conflict == another writer (secrets.set or a parallel
-    // rotation worker) beat us — the row is already in a valid state,
-    // potentially even past target.
-    if (!result.isSuccess) {
-      if (result.error.code === "version_conflict") return "skipped";
-      ctx.log?.warn?.(`[secrets:rotate] executor rejected row ${row.id}`, {
-        code: result.error.code,
-      });
-      return "failed";
+        };
+
+        const actor: SessionUser = {
+          id: "system",
+          tenantId: row.tenantId as TenantId,
+          roles: SYSTEM_ROLES,
+        };
+
+        const result = await executor.update(
+          {
+            id: row.id,
+            version: row.version,
+            changes: {
+              envelope: newEnvelope,
+              kekVersion: rotated.kekVersion,
+            },
+          },
+          actor,
+          tdbFor(row.tenantId as TenantId),
+        );
+
+        // version_conflict == another writer (secrets.set or a parallel
+        // rotation worker) beat us. Count as "skipped" and move on — the
+        // row is already in a valid state, potentially even past target.
+        if (!result.isSuccess) {
+          if (result.error.code === "version_conflict") continue;
+          failed++;
+          ctx.log?.warn?.(`[secrets:rotate] executor rejected row ${row.id}`, {
+            code: result.error.code,
+          });
+          continue;
+        }
+      } catch (err) {
+        failed++;
+        ctx.log?.warn?.(`[secrets:rotate] failed to rotate row ${row.id}`, { err });
+        continue;
+      }
+      migrated++;
     }
-    return "migrated";
+
+    if (stoppedReason === "too_many_failures") break;
+    if (batch.length < batchSize) break;
   }
 
-  const outcome = await runChunkedMigration<SecretRow>({
-    nextBatch,
-    migrateRow,
-    maxFailures,
-    deadlineAt: deadline,
-    signal: ctx.signal,
-    onRowError: (row, err) => {
-      ctx.log?.warn?.(`[secrets:rotate] failed to rotate row ${row.id}`, { err });
-    },
-  });
-
-  const result: RotateJobResult = {
-    migrated: outcome.migrated,
-    failed: outcome.failed,
-    batchesProcessed: outcome.batchesProcessed,
-    stoppedReason: outcome.stoppedReason,
-  };
+  const result: RotateJobResult = { migrated, failed, batchesProcessed, stoppedReason };
   ctx.log?.info?.(`[secrets:rotate] complete: ${JSON.stringify(result)}`);
 };

package/src/secrets/secrets-context.ts

@@ -25,13 +25,10 @@ import {
   createDekCache,
   createSecret,
   type DekCache,
-  decodeStoredEnvelope,
   decryptValue,
-  encodeStoredEnvelope,
   encryptValue,
   type MasterKeyProvider,
   type SecretsContext,
-  withDekCache,
 } from "@cosmicdrift/kumiko-framework/secrets";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
@@ -82,9 +79,37 @@ function resolveKey(keyOrHandle: string | { readonly name: string }): string {
   return typeof keyOrHandle === "string" ? keyOrHandle : keyOrHandle.name;
 }
 
+// Wrap a provider so its unwrapDek goes through the cache. Lets decryptValue
+// use the full provider contract without knowing about caching — separation
+// of concerns: decryptValue handles crypto, cache handles cost.
+function cachedProvider(provider: MasterKeyProvider, cache: DekCache): MasterKeyProvider {
+  return {
+    wrapDek: provider.wrapDek.bind(provider),
+    unwrapDek: (encryptedDek, version) => cache.unwrapDek(encryptedDek, version, provider),
+    currentVersion: provider.currentVersion.bind(provider),
+    isAvailable: provider.isAvailable.bind(provider),
+  };
+}
+
+function decodeEnvelope(stored: StoredEnvelope): {
+  ciphertext: Buffer;
+  iv: Buffer;
+  authTag: Buffer;
+  encryptedDek: Buffer;
+  kekVersion: number;
+} {
+  return {
+    ciphertext: Buffer.from(stored.ciphertext, "base64"),
+    iv: Buffer.from(stored.iv, "base64"),
+    authTag: Buffer.from(stored.authTag, "base64"),
+    encryptedDek: Buffer.from(stored.encryptedDek, "base64"),
+    kekVersion: stored.kekVersion,
+  };
+}
+
 export function createSecretsContext(opts: SecretsContextOptions): SecretsContext {
   const { db, masterKeyProvider } = opts;
-  const provider = withDekCache(masterKeyProvider, opts.dekCache ?? createDekCache());
+  const provider = cachedProvider(masterKeyProvider, opts.dekCache ?? createDekCache());
 
   type SecretLookupRow = {
     readonly id: string;
@@ -108,7 +133,7 @@ export function createSecretsContext(opts: SecretsContextOptions): SecretsContex
       if (!auditCtx) {
         const existing = await lookup(tenantId, key);
         if (!existing) return undefined;
-        const plaintext = await decryptValue(decodeStoredEnvelope(existing.envelope), provider);
+        const plaintext = await decryptValue(decodeEnvelope(existing.envelope), provider);
         return createSecret(plaintext);
       }
 
@@ -117,7 +142,7 @@ export function createSecretsContext(opts: SecretsContextOptions): SecretsContex
         // type doesn't widen to the transaction object cleanly.
         const envelope = await selectTenantSecretEnvelope(tx, tenantId, key);
         if (!envelope) return undefined;
-        const pt = await decryptValue(decodeStoredEnvelope(envelope), provider);
+        const pt = await decryptValue(decodeEnvelope(envelope), provider);
 
         // One event per read on its own aggregate-stream (fresh UUID as
         // aggregateId). Avoids version-conflicts between parallel reads —
@@ -165,7 +190,13 @@ export function createSecretsContext(opts: SecretsContextOptions): SecretsContex
     async set(tenantId, keyOrHandle, value, setOpts = {}) {
       const key = resolveKey(keyOrHandle);
       const envelope = await encryptValue(value, masterKeyProvider);
-      const stored: StoredEnvelope = encodeStoredEnvelope(envelope);
+      const stored: StoredEnvelope = {
+        ciphertext: envelope.ciphertext.toString("base64"),
+        iv: envelope.iv.toString("base64"),
+        authTag: envelope.authTag.toString("base64"),
+        encryptedDek: envelope.encryptedDek.toString("base64"),
+        kekVersion: envelope.kekVersion,
+      };
       const metadata: StoredMetadata = {
         ...(setOpts.redact ? { redactedPreview: setOpts.redact(value) } : {}),
         ...(setOpts.hint ? { hint: setOpts.hint } : {}),

package/src/secrets/table.ts

@@ -13,7 +13,6 @@ import {
   createNumberField,
   createTextField,
 } from "@cosmicdrift/kumiko-framework/engine";
-import type { StoredEnvelope } from "@cosmicdrift/kumiko-framework/secrets";
 
 // Envelope stored as a single jsonb blob. All ops are upsert-by-(tenantId, key)
 // so there's no value in decomposing the envelope into separate columns —
@@ -23,11 +22,13 @@ import type { StoredEnvelope } from "@cosmicdrift/kumiko-framework/secrets";
 // `WHERE kek_version != currentVersion()` with an index on just that column
 // without deserializing the jsonb. Duplicated inside envelope too — the two
 // always stay in sync via the write path.
-//
-// StoredEnvelope itself is canonical in @cosmicdrift/kumiko-framework/secrets
-// (shared with EnvelopeCipher for TEXT-column stores) — re-exported here so
-// existing consumers keep their import path.
-export type { StoredEnvelope } from "@cosmicdrift/kumiko-framework/secrets";
+export type StoredEnvelope = {
+  readonly ciphertext: string; // base64
+  readonly iv: string; // base64
+  readonly authTag: string; // base64
+  readonly encryptedDek: string; // base64
+  readonly kekVersion: number;
+};
 
 export type StoredMetadata = {
   readonly redactedPreview?: string;

package/src/sessions/__tests__/password-auto-revoke.integration.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, mock, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -9,10 +10,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import {
-  createLateBoundHolder,
-  createTestEnvelopeCipher,
-} from "@cosmicdrift/kumiko-framework/testing";
+import { createLateBoundHolder } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
 import { createConfigFeature } from "../../config";
@@ -51,8 +49,8 @@ const encryptionKey = randomBytes(32).toString("base64");
 const TENANT: TenantId = testTenantId(1);
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
   const baseRevoker = bound.asMassRevoker();
 

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -11,7 +12,6 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createLateBoundHolder,
-  createTestEnvelopeCipher,
   deleteRows,
   resetTestTables,
   updateRows,
@@ -47,8 +47,8 @@ const encryptionKey = randomBytes(32).toString("base64");
 const TENANT: TenantId = testTenantId(1);
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
 
   stack = await setupTestStack({

package/src/sessions/feature.ts

@@ -10,46 +10,19 @@ import { userSessionEntity } from "./schema/user-session";
 import type { SessionMassRevoker } from "./session-callbacks";
 
 export type SessionsFeatureOptions = {
-  // A successful update on the `user` entity that changes the `passwordHash`
-  // column triggers a mass-revoke of every live session for that user.
-  // Industry-standard "password-change signs you out everywhere" flow,
-  // including the session that did the change itself — the client has
+  // When wired, a successful update on the `user` entity that changes the
+  // `passwordHash` column triggers a mass-revoke of every live session for
+  // that user. Industry-standard "password-change signs you out everywhere"
+  // flow, including the session that did the change itself — the client has
   // to re-login after a password change.
   //
   // Runs as an afterCommit postSave hook: the password-change commits first,
   // then the sessions are revoked. Best-effort — if the mass-revoker throws,
   // the password change is NOT rolled back (a password change with a stale
   // session still wins over a user-visible error on the change itself).
-  //
-  // Default: run{Prod,Dev}App bind their own sessionMassRevoker via
-  // `bindAutoRevokeOnPasswordChange` (secure-by-default). Set this option
-  // only to supply a custom revoker — an explicit value wins over the
-  // runtime binding.
   readonly autoRevokeOnPasswordChange?: SessionMassRevoker;
 };
 
-export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
-
-// Reads the late-bind setter off a mounted sessions feature's exports.
-// run{Prod,Dev}App call it once the DB connection is concrete — the feature
-// itself is constructed in app run-config long before a db exists, so the
-// revoker can't be a constructor argument.
-export function bindAutoRevokeFromFeature(
-  feature: FeatureDefinition,
-): BindAutoRevokeOnPasswordChange | undefined {
-  const exports = feature.exports;
-  if (exports && typeof exports === "object" && "bindAutoRevokeOnPasswordChange" in exports) {
-    const { bindAutoRevokeOnPasswordChange } = exports as {
-      bindAutoRevokeOnPasswordChange: unknown;
-    };
-    if (typeof bindAutoRevokeOnPasswordChange === "function") {
-      // @cast-boundary exports-walk — feature.exports is untyped by design
-      return bindAutoRevokeOnPasswordChange as BindAutoRevokeOnPasswordChange;
-    }
-  }
-  return undefined;
-}
-
 // The sessions feature registers the read_user_sessions table (as an
 // unmanaged direct-write store, NOT an r.entity — see below) and the three
 // user-facing handlers (mine/revoke/revoke-all-others). It intentionally does NOT
@@ -120,26 +93,20 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // "the handler didn't touch this column", which is exactly the signal
     // we want to skip on. Works for both direct user:update calls and any
     // other handler that happens to write the column.
-    let autoRevoke = options?.autoRevokeOnPasswordChange;
-    r.entityHook("postSave", "user", async (ctx) => {
-      // skip: nothing bound — stateless-JWT deployments without a runtime
-      // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
-      if (!autoRevoke) return;
-      // skip: brand-new user, no sessions can possibly exist yet. The
-      // initial passwordHash on a user:create would trip the second guard
-      // otherwise — every registration would do a mass-revoke roundtrip
-      // for a user who literally has no rows in user_sessions.
-      if (ctx.isNew) return;
-      // skip: handler didn't touch passwordHash, nothing to revoke
-      if (ctx.changes["passwordHash"] === undefined) return;
-      await autoRevoke(String(ctx.id));
-    });
-
-    const bindAutoRevokeOnPasswordChange: BindAutoRevokeOnPasswordChange = (revoker) => {
-      // explicit constructor option wins over the runtime binding
-      autoRevoke ??= revoker;
-    };
+    const autoRevoke = options?.autoRevokeOnPasswordChange;
+    if (autoRevoke) {
+      r.entityHook("postSave", "user", async (ctx) => {
+        // skip: brand-new user, no sessions can possibly exist yet. The
+        // initial passwordHash on a user:create would trip the second guard
+        // otherwise — every registration would do a mass-revoke roundtrip
+        // for a user who literally has no rows in user_sessions.
+        if (ctx.isNew) return;
+        // skip: handler didn't touch passwordHash, nothing to revoke
+        if (ctx.changes["passwordHash"] === undefined) return;
+        await autoRevoke(String(ctx.id));
+      });
+    }
 
-    return { handlers, queries, bindAutoRevokeOnPasswordChange };
+    return { handlers, queries };
   });
 }

package/src/sessions/index.ts

@@ -6,8 +6,8 @@ export {
   SessionHandlers,
   SessionQueries,
 } from "./constants";
-export type { BindAutoRevokeOnPasswordChange, SessionsFeatureOptions } from "./feature";
-export { bindAutoRevokeFromFeature, createSessionsFeature } from "./feature";
+export type { SessionsFeatureOptions } from "./feature";
+export { createSessionsFeature } from "./feature";
 export { userSessionEntity, userSessionTable } from "./schema/user-session";
 export type {
   SessionCallbacks,