@cosmicdrift/kumiko-bundled-features 0.158.2 → 0.159.1

package/src/personal-access-tokens/handlers/list.query.ts

@@ -29,7 +29,7 @@ export const listPatQuery = defineQueryHandler({
     return Promise.all(
       rows.map(async (r) => ({
         id: r.id,
-        name: await decryptStoredPii(r.name, "pat:list"),
+        name: await decryptStoredPii(r.name, "name", "pat:list"),
         prefix: r.prefix,
         scopes: parseScopeNames(r.scopes),
         createdAt: r.createdAt,

package/src/personal-access-tokens/index.ts

@@ -1,6 +1,5 @@
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { PAT_DEFAULT_RATE_LIMIT, type PatRateLimit } from "./constants";
-import type { PatScopeConfig } from "./scopes";
 
 export type { PatRateLimit } from "./constants";
 export { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PatHandlers, PatQueries } from "./constants";
@@ -12,19 +11,6 @@ export { apiTokenEntity, apiTokenTable } from "./schema/api-token";
 export type { PatScopeConfig, PatScopeDef } from "./scopes";
 export { expandScopes } from "./scopes";
 
-// Reads the scope catalog off a mounted PAT feature's exports (set from the
-// setup-callback return). run-prod-app uses this to build the resolver from the
-// same config the handlers were given. Returns {} for a non-PAT / malformed
-// definition — the caller has already matched on feature.name.
-export function patScopesFromFeature(feature: FeatureDefinition): PatScopeConfig {
-  const exports = feature.exports;
-  if (exports && typeof exports === "object" && "scopes" in exports) {
-    const { scopes } = exports as { scopes: unknown };
-    if (scopes && typeof scopes === "object") return scopes as PatScopeConfig;
-  }
-  return {};
-}
-
 // Reads the per-token rate-limit config off a mounted PAT feature's exports.
 // Falls back to the default when absent. run-prod-app uses this to build the
 // limiter from the same declaration the feature was given.

package/src/personal-access-tokens/resolver.ts

@@ -1,4 +1,4 @@
-import type { PatResolver } from "@cosmicdrift/kumiko-framework/api";
+import type { TokenVerifier } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
@@ -16,7 +16,7 @@ import { expandScopes, type PatScopeConfig } from "./scopes";
 export function createPatResolver(opts: {
   readonly db: DbConnection;
   readonly scopes: PatScopeConfig;
-}): PatResolver {
+}): TokenVerifier {
   const { db, scopes } = opts;
   return async (rawToken: string): Promise<SessionUser | null> => {
     const row = await fetchOne<{

package/src/secrets/__tests__/rotate.integration.test.ts

@@ -7,6 +7,7 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { AppContext } from "@cosmicdrift/kumiko-framework/engine";
+import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   createEnvMasterKeyProvider,
   decodeStoredEnvelope,
@@ -235,5 +236,35 @@ describe("rotate-job circuit-breaker", () => {
       const plaintext = await decryptValue(decodeStoredEnvelope(row.envelope), verifier);
       expect(plaintext).toBe(`secret-${expectedIndex}`);
     }
+
+    // Regression guard (kumiko-framework#1189): rotate.job.ts's
+    // executor.update() call carries no options, so it deliberately
+    // never sets skipUnchanged — every rotation writes a real .updated
+    // event, not a raw UPDATE. A full projection rebuild replays those
+    // events; if a future refactor added skipUnchanged (or swapped the
+    // event write for a raw column update) the rebuild would resurrect
+    // the pre-rotation V1 envelopes instead of landing on V2, exactly
+    // the #464 failure class config/auth-mfa already guard against.
+    //
+    // Vacuous-rebuild guard: confirm the projection name actually exists
+    // and the rebuild really replayed events, so a wrong projection name
+    // can't silently no-op the assertion below into a false pass.
+    const projectionName = "secrets:projection:tenant-secret-entity";
+    expect(stack.registry.getAllProjections().has(projectionName)).toBe(true);
+    const rebuildResult = await rebuildProjection(projectionName, {
+      db: stack.db,
+      registry: stack.registry,
+    });
+    expect(rebuildResult.eventsProcessed).toBeGreaterThan(0);
+
+    const rowsAfterRebuild = await selectMany<{ key: string; kekVersion: number }>(
+      stack.db,
+      tenantSecretsTable,
+      { tenantId: admin.tenantId },
+    );
+    expect(rowsAfterRebuild).toHaveLength(20);
+    for (const row of rowsAfterRebuild) {
+      expect(row.kekVersion).toBe(2);
+    }
   });
 });

package/src/sessions/__tests__/cleanup.integration.test.ts

@@ -5,6 +5,7 @@
 // expired/revoked rows go, live rows stay, batching + signal work.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { sql } from "@cosmicdrift/kumiko-framework/db";
 import type { AppContext } from "@cosmicdrift/kumiko-framework/engine";
@@ -40,7 +41,7 @@ let stack: TestStack;
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [createSessionsFeature(), createUserFeature()],
+    features: [authFoundationFeature, createSessionsFeature(), createUserFeature()],
   });
   await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafeCreateEntityTable(stack.db, userEntity);

package/src/sessions/__tests__/password-auto-revoke.integration.test.ts

@@ -1,5 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, mock, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -66,6 +67,7 @@ beforeAll(async () => {
       createUserFeature(),
       createTenantFeature(),
       createAuthEmailPasswordFeature(),
+      authFoundationFeature,
       createSessionsFeature({
         autoRevokeOnPasswordChange: massRevokeSpy,
       }),
@@ -78,7 +80,7 @@ beforeAll(async () => {
     },
   });
   callbacks.set(createSessionCallbacks({ db: stack.db }));
-  h = makeSessionHelpers(stack, TENANT);
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator);
 
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
@@ -99,7 +101,7 @@ beforeEach(async () => {
 
 describe("password change mass-revokes every live session", () => {
   test("changing the password revokes ALL sessions including the caller's", async () => {
-    await h.seedUser("rotate@example.com", "first-password");
+    const { userId } = await h.seedUser("rotate@example.com", "first-password");
 
     const a = await h.login("rotate@example.com", "first-password");
     const b = await h.login("rotate@example.com", "first-password");
@@ -147,7 +149,7 @@ describe("password change mass-revokes every live session", () => {
 
     // DB state confirms: zero live rows for this user
     const liveRows = await selectMany(stack.db, userSessionTable);
-    const stillLive = liveRows.filter((r) => r["revokedAt"] === null);
+    const stillLive = liveRows.filter((r) => r["userId"] === userId && r["revokedAt"] === null);
     expect(stillLive).toHaveLength(0);
 
     // And logging in again with the NEW password works

package/src/sessions/__tests__/rebuild-survival.integration.test.ts

@@ -1,4 +1,5 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createRegistry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
@@ -72,14 +73,22 @@ async function insertRevokedSession(db: DbConnection): Promise<void> {
 
 describe("sessions / store_user_sessions survives projection rebuild", () => {
   test("is NOT registered as a rebuildable implicit projection", () => {
-    const registry = createRegistry([createSessionsFeature(), createUserFeature()]);
+    const registry = createRegistry([
+      authFoundationFeature,
+      createSessionsFeature(),
+      createUserFeature(),
+    ]);
     expect(registry.getAllProjections().has(IMPLICIT_PROJECTION)).toBe(false);
   });
 
   test("direct-written rows (incl. revoked state) survive a rebuild", async () => {
     await insertRevokedSession(createTenantDb(testDb.db, TENANT));
 
-    const registry = createRegistry([createSessionsFeature(), createUserFeature()]);
+    const registry = createRegistry([
+      authFoundationFeature,
+      createSessionsFeature(),
+      createUserFeature(),
+    ]);
     // Pre-fix: the implicit projection exists → rebuild swaps an empty shadow
     // → rows wiped. Post-fix: absent → no rebuild → rows untouched. Either way
     // a regression (re-adding r.entity) makes this fail.

package/src/sessions/__tests__/session-store-registration.test.ts

@@ -0,0 +1,21 @@
+// sessions self-registers as auth-foundation's sessionStore provider (#1371)
+// instead of only being wired by hand into buildServer({ auth: { ... } }).
+
+import { describe, expect, test } from "bun:test";
+import { EXT_SESSION_STORE } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { createSessionsFeature } from "../feature";
+
+describe("createSessionsFeature — sessionStore registration (#1371)", () => {
+  test('registers via r.useExtension(EXT_SESSION_STORE, "default", ...)', () => {
+    const feature = createSessionsFeature();
+    const usage = feature.extensionUsages.find((u) => u.extensionName === EXT_SESSION_STORE);
+    expect(usage).toBeDefined();
+    expect(usage?.entityName).toBe("default");
+    expect(typeof (usage?.options as { build?: unknown } | undefined)?.build).toBe("function");
+  });
+
+  test("requires auth-foundation (owner of EXT_SESSION_STORE)", () => {
+    const feature = createSessionsFeature();
+    expect(feature.requires).toContain("auth-foundation");
+  });
+});

package/src/sessions/__tests__/sessions-screens.boot.test.ts

@@ -1,17 +1,26 @@
 import { describe, expect, test } from "bun:test";
-import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { EXT_SESSION_STORE } from "../../auth-foundation";
 import { createConfigFeature } from "../../config/feature";
 import { createTenantFeature } from "../../tenant";
 import { createUserFeature } from "../../user/feature";
 import { SESSION_DETAIL_SCREEN_ID, SESSION_LIST_SCREEN_ID } from "../constants";
 import { createSessionsFeature } from "../feature";
 
+// Stub instead of the real auth-foundation — this test is about screen/query
+// wiring, not auth; the real feature also mandates a tokenVerifier provider
+// which is out of scope here.
+const sessionStoreOwnerStub = defineFeature("auth-foundation", (r) => {
+  r.extendsRegistrar(EXT_SESSION_STORE, {});
+});
+
 describe("sessions screens + query access alignment (kumiko-framework#255)", () => {
   const features = [
     createConfigFeature(),
     createUserFeature(),
     createTenantFeature(),
+    sessionStoreOwnerStub,
     createSessionsFeature(),
   ];
 

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -1,5 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configureBlindIndexKey,
@@ -13,6 +14,7 @@ import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
   type TestStack,
+  TestUsers,
   testTenantId,
   unsafeCreateEntityTable,
   unsafePushTables,
@@ -65,6 +67,7 @@ beforeAll(async () => {
       createUserFeature(),
       createTenantFeature(),
       createAuthEmailPasswordFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
     ],
     extraContext: { configResolver: resolver, configEncryption: encryption },
@@ -75,7 +78,7 @@ beforeAll(async () => {
     },
   });
   callbacks.set(createSessionCallbacks({ db: stack.db }));
-  h = makeSessionHelpers(stack, TENANT);
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator);
 
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
@@ -97,9 +100,10 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     const { sid } = await h.login("persist@example.com", "pw-long-enough");
 
     const rows = await selectMany(stack.db, userSessionTable);
-    expect(rows).toHaveLength(1);
-    expect(rows[0]?.["id"]).toBe(sid);
-    expect(rows[0]?.["revokedAt"]).toBeNull();
+    const userRows = rows.filter((r) => r["userId"] !== TestUsers.systemAdmin.id);
+    expect(userRows).toHaveLength(1);
+    expect(userRows[0]?.["id"]).toBe(sid);
+    expect(userRows[0]?.["revokedAt"]).toBeNull();
   });
 
   test("authenticated request passes while session is live, 401s once revoked", async () => {
@@ -138,8 +142,9 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     expect(logoutRes.status).toBe(200);
 
     const rows = await selectMany(stack.db, userSessionTable);
-    expect(rows[0]?.["id"]).toBe(sid);
-    expect(rows[0]?.["revokedAt"]).not.toBeNull();
+    const row = rows.find((r) => r["id"] === sid);
+    expect(row?.["id"]).toBe(sid);
+    expect(row?.["revokedAt"]).not.toBeNull();
 
     const next = await h.authedPost("/api/query", token, {
       type: "user:query:user:me",
@@ -294,12 +299,13 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     expect(body.error?.details?.reason).toBe("ownership_denied");
   });
 
-  test("revoke-all-others on a sidless JWT refuses loudly (session_required)", async () => {
+  test("revoke-all-others on a sidless JWT is rejected by the middleware (no_sid)", async () => {
     const { userId } = await h.seedUser("sidless@example.com", "pw-long-enough");
 
-    // Hand-sign a JWT without jti — simulates a stateless-JWT deployment
-    // or a rolling-deploy gap. "sign out everywhere else" is ill-defined
-    // without knowing which session is "current", so refuse.
+    // Hand-sign a JWT without jti. Once a sessionChecker is wired there is
+    // no relaxed mode (see session-strict-mode.integration.test.ts) — the
+    // middleware rejects it with no_sid before the handler's own
+    // session_required guard is ever reached.
     const tokenNoSid = await stack.jwt.sign({ id: userId, tenantId: TENANT, roles: ["User"] });
 
     const res = await stack.http.raw(
@@ -308,9 +314,9 @@ describe("sessions feature — login → check → revoke → rejected", () => {
       { type: SessionHandlers.revokeAllOthers, payload: {} },
       { Authorization: `Bearer ${tokenNoSid}` },
     );
-    expect(res.status).toBe(422);
+    expect(res.status).toBe(401);
     const body = (await res.json()) as { error?: { details?: { reason?: string } } };
-    expect(body.error?.details?.reason).toBe("session_required");
+    expect(body.error?.details?.reason).toBe("no_sid");
   });
 
   test("N concurrent revoke+logout requests on the same sid converge safely", async () => {
@@ -491,10 +497,13 @@ describe("sessions feature — login → check → revoke → rejected", () => {
         revokedAt: string | null;
       }>;
     };
-    // Three rows total: Alice's pre-promotion session, Alice's post-promotion
-    // session, Bob's session. Two distinct users.
-    expect(body.data).toHaveLength(3);
-    const userIds = new Set(body.data.map((r) => r.userId));
+    // Three rows total for the two test users: Alice's pre-promotion session,
+    // Alice's post-promotion session, Bob's session. seedUser's bootstrap
+    // actor (systemAdmin) also holds live sessions in this tenant — exclude
+    // them, they aren't part of what this test pins.
+    const nonSystemRows = body.data.filter((r) => r.userId !== TestUsers.systemAdmin.id);
+    expect(nonSystemRows).toHaveLength(3);
+    const userIds = new Set(nonSystemRows.map((r) => r.userId));
     expect(userIds.size).toBe(2);
 
     // Order: most-recently-created first. aliceAsAdmin's session was the
@@ -552,7 +561,9 @@ describe("sessions feature — login → check → revoke → rejected", () => {
   // different tenant must not be able to read another tenant's session rows.
   test("session:detail and session:list never leak sessions across tenants", async () => {
     const TENANT_2 = testTenantId(2);
-    const h2 = makeSessionHelpers(stack, TENANT_2);
+    const h2 = makeSessionHelpers(stack, TENANT_2, (user, meta) =>
+      callbacks.get().sessionCreator(user, meta),
+    );
 
     const { userId: carolId } = await h.seedUser("carol4@example.com", "pw-long-enough");
     await updateRows(

package/src/sessions/__tests__/test-helpers.ts

@@ -9,12 +9,14 @@
 //   const res = await h.authedPost("/api/query", token, { type, payload });
 
 import { expect } from "bun:test";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type TestStack, TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import * as jose from "jose";
 import { hashPassword } from "../../shared";
 import { seedTenantMembership } from "../../tenant/seeding";
 import { UserHandlers } from "../../user";
+import { withMintedSession } from "../testing";
 
 export type LoginResult = {
   readonly token: string;
@@ -25,7 +27,15 @@ export type LoginResult = {
 // `ReturnType<typeof makeSessionHelpers>` — no separate type export to
 // keep in sync with the implementation. Params are typed inline on each
 // method so the inference is sharp.
-export function makeSessionHelpers(stack: TestStack, tenantId: TenantId) {
+// `sessionCreator` is only needed when the suite wires a real sessionChecker
+// (auth-middleware then rejects the sidless systemAdmin bootstrap actor
+// used by seedUser). Suites without a sessionChecker (e.g. PAT tests) can
+// omit it.
+export function makeSessionHelpers(
+  stack: TestStack,
+  tenantId: TenantId,
+  sessionCreator?: SessionCreator,
+) {
   return {
     async seedUser(
       email: string,
@@ -33,10 +43,13 @@ export function makeSessionHelpers(stack: TestStack, tenantId: TenantId) {
       opts?: { roles?: readonly string[] },
     ): Promise<{ userId: string }> {
       const hash = await hashPassword(password);
+      const actor = sessionCreator
+        ? await withMintedSession(sessionCreator, TestUsers.systemAdmin)
+        : TestUsers.systemAdmin;
       const created = await stack.http.writeOk<{ id: string }>(
         UserHandlers.create,
         { email, passwordHash: hash, displayName: email.split("@")[0] ?? "u" },
-        TestUsers.systemAdmin,
+        actor,
       );
       await seedTenantMembership(stack.db, {
         userId: created.id,

package/src/sessions/feature.ts

@@ -1,3 +1,8 @@
+import {
+  EXT_SESSION_STORE,
+  type SessionStore,
+  type SessionStoreProvider,
+} from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
@@ -14,7 +19,11 @@ import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write";
 import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write";
 import { SESSIONS_I18N } from "./i18n";
 import { userSessionEntity } from "./schema/user-session";
-import type { SessionAllOthersRevoker, SessionMassRevoker } from "./session-callbacks";
+import {
+  createSessionCallbacks,
+  type SessionAllOthersRevoker,
+  type SessionMassRevoker,
+} from "./session-callbacks";
 
 export type SessionsFeatureOptions = {
   // A successful update on the `user` entity that changes the `passwordHash`
@@ -76,7 +85,7 @@ export function bindAutoRevokeFromFeature(
 export function createSessionsFeature(options?: SessionsFeatureOptions): FeatureDefinition {
   return defineFeature("sessions", (r) => {
     r.describe(
-      "Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
+      "Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the same callbacks are also registered as an auth-foundation sessionStore provider, resolvable generically via `resolveSessionStore()`. The feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
     );
     r.uiHints({
       displayLabel: "Sessions · Server-side Logout",
@@ -86,7 +95,9 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // sessionChecker reads read_users on every authenticated request (status
     // gate for locked accounts) — make that a boot-time dependency so a
     // sessions-without-user wiring fails validateBoot instead of 500ing live.
-    r.requires("user");
+    // auth-foundation owns EXT_SESSION_STORE, which the useExtension below
+    // registers against.
+    r.requires("user", "auth-foundation");
     // store_user_sessions is a hot-path direct-write store: sessionCreator
     // inserts and the revoke handlers update rows WITHOUT emitting lifecycle
     // events (the row columns ARE the audit trail). Registering it as
@@ -102,6 +113,23 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       piiEncryptedOnWrite: true,
     });
 
+    // Self-registers as auth-foundation's sessionStore provider (#1371) —
+    // wraps the same createSessionCallbacks() used by the manual
+    // buildServer({ auth: { ... } }) wiring above; a future issue (#1372)
+    // removes that manual wiring once the middleware resolves generically
+    // via resolveSessionStore().
+    r.useExtension(EXT_SESSION_STORE, "default", {
+      build: (deps): SessionStore => {
+        const callbacks = createSessionCallbacks({ db: deps.db });
+        return {
+          creator: callbacks.sessionCreator,
+          revoker: callbacks.sessionRevoker,
+          checker: callbacks.sessionChecker,
+          massRevoker: callbacks.sessionMassRevoker,
+        };
+      },
+    } satisfies SessionStoreProvider);
+
     const handlers = {
       revoke: r.writeHandler(revokeWrite),
       revokeAllOthers: r.writeHandler(revokeAllOthersWrite),

package/src/sessions/handlers/detail.query.ts

@@ -27,9 +27,9 @@ export const detailQuery = defineQueryHandler({
       createdAt: row.createdAt,
       expiresAt: row.expiresAt,
       revokedAt: row.revokedAt,
-      ip: row.ip ? await decryptStoredPii(row.ip, "sessions:detail") : row.ip,
+      ip: row.ip ? await decryptStoredPii(row.ip, "ip", "sessions:detail") : row.ip,
       userAgent: row.userAgent
-        ? await decryptStoredPii(row.userAgent, "sessions:detail")
+        ? await decryptStoredPii(row.userAgent, "userAgent", "sessions:detail")
         : row.userAgent,
     };
   },

package/src/sessions/handlers/list.query.ts

@@ -30,8 +30,10 @@ export const listQuery = defineQueryHandler({
         createdAt: r.createdAt,
         expiresAt: r.expiresAt,
         revokedAt: r.revokedAt,
-        ip: r.ip ? await decryptStoredPii(r.ip, "sessions:list") : r.ip,
-        userAgent: r.userAgent ? await decryptStoredPii(r.userAgent, "sessions:list") : r.userAgent,
+        ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:list") : r.ip,
+        userAgent: r.userAgent
+          ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:list")
+          : r.userAgent,
       })),
     );
   },

package/src/sessions/handlers/mine.query.ts

@@ -32,8 +32,10 @@ export const mineQuery = defineQueryHandler({
         id: r.id,
         createdAt: r.createdAt,
         expiresAt: r.expiresAt,
-        ip: r.ip ? await decryptStoredPii(r.ip, "sessions:mine") : r.ip,
-        userAgent: r.userAgent ? await decryptStoredPii(r.userAgent, "sessions:mine") : r.userAgent,
+        ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:mine") : r.ip,
+        userAgent: r.userAgent
+          ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:mine")
+          : r.userAgent,
         current: currentSid === r.id,
       })),
     );

package/src/sessions/testing.ts

@@ -17,7 +17,8 @@
 // sessions feature owns. framework/testing only provides the generic
 // `createLateBoundHolder<T>` — shape-independent.
 
-import type { AuthRoutesConfig } from "@cosmicdrift/kumiko-framework/api";
+import type { AuthRoutesConfig, SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import type { LateBoundHolder } from "@cosmicdrift/kumiko-framework/testing";
 import type { SessionCallbacks, SessionMassRevoker } from "./session-callbacks";
 
@@ -40,3 +41,15 @@ export function sessionCallbacksFromLateBound(
     asMassRevoker: () => (userId) => holder.get().sessionMassRevoker(userId),
   };
 }
+
+// Bootstrap actors (system-admin seed writes) need a real sid once a
+// sessionChecker is wired — auth-middleware rejects sidless JWTs as
+// forged/pre-session-tracking. Mints a live session row and returns the
+// actor with `sid` attached so `stack.http.writeOk(..., actor)` passes.
+export async function withMintedSession(
+  sessionCreator: SessionCreator,
+  user: SessionUser,
+): Promise<SessionUser> {
+  const sid = await sessionCreator(user, { ip: "127.0.0.1", userAgent: "test" });
+  return { ...user, sid };
+}