@cosmicdrift/kumiko-bundled-features 0.158.2 → 0.160.0

package/src/mail-foundation/__tests__/mail-transport-contract.ts

@@ -0,0 +1,42 @@
+import { beforeEach, describe, expect, test } from "bun:test";
+import type { EmailMessage } from "@cosmicdrift/kumiko-bundled-features/channel-email";
+import type { MailTransportContext, MailTransportPlugin } from "../feature";
+
+export type MailTransportContractFixture = {
+  readonly plugin: MailTransportPlugin;
+  readonly ctx: MailTransportContext;
+  readonly tenantId: string;
+  // Local providers (inmemory) expose readBack to assert real delivery;
+  // remote providers (smtp) omit it — send() needs a live server.
+  readonly readBack?: (tenantId: string) => readonly EmailMessage[];
+};
+
+export function describeMailTransportContract(
+  name: string,
+  factory: () => MailTransportContractFixture | Promise<MailTransportContractFixture>,
+): void {
+  describe(`${name} — MailTransportPlugin contract`, () => {
+    let fixture: MailTransportContractFixture;
+
+    beforeEach(async () => {
+      fixture = await factory();
+    });
+
+    test("build resolves to an EmailTransport with a send function", async () => {
+      const transport = await fixture.plugin.build(fixture.ctx, fixture.tenantId);
+      expect(typeof transport.send).toBe("function");
+    });
+
+    test("send delivers the message — verified via readBack", async () => {
+      if (!fixture.readBack) return;
+      const message: EmailMessage = {
+        to: "contract-recipient@example.test",
+        subject: "contract-test-subject",
+        html: "<p>contract-test-body</p>",
+      };
+      const transport = await fixture.plugin.build(fixture.ctx, fixture.tenantId);
+      await transport.send(message);
+      expect(fixture.readBack(fixture.tenantId)).toContainEqual(message);
+    });
+  });
+}

package/src/mail-transport-inmemory/__tests__/feature.test.ts

@@ -1,8 +1,27 @@
 // feature.ts contract tests for mail-transport-inmemory.
 
 import { describe, expect, test } from "bun:test";
+import { isMailTransportPlugin, type MailTransportPlugin } from "../../mail-foundation";
+import { describeMailTransportContract } from "../../mail-foundation/__tests__/mail-transport-contract";
 import { clearInbox, getInbox, mailTransportInMemoryFeature } from "../feature";
 
+function registeredPlugin(): MailTransportPlugin {
+  const usage = mailTransportInMemoryFeature.extensionUsages.find(
+    (u) => u.extensionName === "mailTransport" && u.entityName === "inmemory",
+  );
+  if (!usage || !isMailTransportPlugin(usage.options)) {
+    throw new Error("mail-transport-inmemory: plugin not registered under 'inmemory'");
+  }
+  return usage.options;
+}
+
+describeMailTransportContract("mail-transport-inmemory", () => ({
+  plugin: registeredPlugin(),
+  ctx: {},
+  tenantId: "contract-test-tenant",
+  readBack: getInbox,
+}));
+
 describe("mailTransportInMemoryFeature — shape", () => {
   test("has the expected name", () => {
     expect(mailTransportInMemoryFeature.name).toBe("mail-transport-inmemory");

package/src/mail-transport-smtp/__tests__/feature.test.ts

@@ -4,8 +4,68 @@
 // build-fn presence).
 
 import { describe, expect, test } from "bun:test";
+import type { ConfigAccessor } from "@cosmicdrift/kumiko-framework/engine";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import { createSecret } from "@cosmicdrift/kumiko-framework/secrets";
+import { isMailTransportPlugin, type MailTransportPlugin } from "../../mail-foundation";
+import { describeMailTransportContract } from "../../mail-foundation/__tests__/mail-transport-contract";
 import { mailTransportSmtpFeature, SMTP_PASSWORD } from "../feature";
 
+function registeredPlugin(): MailTransportPlugin {
+  const usage = mailTransportSmtpFeature.extensionUsages.find(
+    (u) => u.extensionName === "mailTransport" && u.entityName === "smtp",
+  );
+  if (!usage || !isMailTransportPlugin(usage.options)) {
+    throw new Error("mail-transport-smtp: plugin not registered under 'smtp'");
+  }
+  return usage.options;
+}
+
+function fakeConfig(
+  overrides: Partial<
+    Record<"host" | "port" | "secure" | "from" | "authUser", string | number | boolean>
+  > = {},
+): ConfigAccessor {
+  const keys = mailTransportSmtpFeature.exports.configKeys;
+  const values = new Map<string, string | number | boolean>([
+    [keys.host.name, overrides.host ?? "smtp.contract-test.invalid"],
+    [keys.port.name, overrides.port ?? 587],
+    [keys.secure.name, overrides.secure ?? false],
+    [keys.from.name, overrides.from ?? "noreply@contract-test.invalid"],
+    [keys.authUser.name, overrides.authUser ?? "contract-test-user"],
+  ]);
+  return (async (handle: string | { readonly name: string }) => {
+    const key = typeof handle === "string" ? handle : handle.name;
+    return values.get(key);
+  }) as ConfigAccessor;
+}
+
+function fakeSecrets(): SecretsContext {
+  return {
+    get: async () => createSecret("contract-test-password"),
+    has: async () => true,
+    set: async () => {},
+    delete: async () => true,
+  };
+}
+
+describeMailTransportContract("mail-transport-smtp", () => ({
+  plugin: registeredPlugin(),
+  ctx: { config: fakeConfig(), secrets: fakeSecrets(), _userId: "contract-test-user" },
+  tenantId: "contract-test-tenant",
+}));
+
+describe("mailTransportSmtpFeature — build error path", () => {
+  test("build rejects when a required config-key (host) is unset", async () => {
+    const ctx = {
+      config: fakeConfig({ host: "" }),
+      secrets: fakeSecrets(),
+      _userId: "contract-test-user",
+    };
+    await expect(registeredPlugin().build(ctx, "contract-test-tenant")).rejects.toThrow(/host/);
+  });
+});
+
 describe("mailTransportSmtpFeature — shape", () => {
   test("has the expected name", () => {
     expect(mailTransportSmtpFeature.name).toBe("mail-transport-smtp");

package/src/managed-pages/handlers/branding.query.ts

@@ -21,7 +21,11 @@ export function createBrandingQuery(opts: { readonly allowCustomCss: boolean })
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
     handler: async (_query, ctx) => {
       const base = await readBranding(ctx.config);
-      if (!opts.allowCustomCss || !ctx.config || !ctx.hasFeature(MANAGED_PAGES_CSS_FEATURE)) {
+      if (
+        !opts.allowCustomCss ||
+        !ctx.config ||
+        !(await ctx.hasFeature(MANAGED_PAGES_CSS_FEATURE))
+      ) {
         return base;
       }
       return { ...base, customCss: await readCustomCss(ctx.config) };

package/src/personal-access-tokens/__tests__/feature.test.ts

@@ -1,4 +1,6 @@
 import { describe, expect, test } from "bun:test";
+import { PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
+import { EXT_TOKEN_VERIFIER } from "../../auth-foundation";
 import { createPersonalAccessTokensFeature } from "../feature";
 
 describe("createPersonalAccessTokensFeature toggleable-option (tier-gating)", () => {
@@ -22,3 +24,19 @@ describe("createPersonalAccessTokensFeature toggleable-option (tier-gating)", ()
     expect(feature.toggleableDefault).toBe(true);
   });
 });
+
+describe("createPersonalAccessTokensFeature — tokenVerifier registration (#1369)", () => {
+  test('registers via r.useExtension(EXT_TOKEN_VERIFIER, "pat", ...) instead of a patResolver field', () => {
+    const feature = createPersonalAccessTokensFeature({ scopes: {} });
+    expect(feature.extensionUsages).toHaveLength(1);
+    const [usage] = feature.extensionUsages;
+    expect(usage?.extensionName).toBe(EXT_TOKEN_VERIFIER);
+    expect(usage?.entityName).toBe("pat");
+    expect(usage?.options).toMatchObject({ shape: { kind: "prefix", prefix: PAT_TOKEN_PREFIX } });
+  });
+
+  test("requires auth-foundation (owner of EXT_TOKEN_VERIFIER)", () => {
+    const feature = createPersonalAccessTokensFeature({ scopes: {} });
+    expect(feature.requires).toContain("auth-foundation");
+  });
+});

package/src/personal-access-tokens/__tests__/pat.integration.test.ts

@@ -1,9 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import {
-  createInMemoryLoginRateLimiter,
-  type PatResolver,
-} from "@cosmicdrift/kumiko-framework/api";
+import { createInMemoryLoginRateLimiter } from "@cosmicdrift/kumiko-framework/api";
 import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configureBlindIndexKey,
@@ -25,6 +22,7 @@ import { createTestEnvelopeCipher, deleteRows } from "@cosmicdrift/kumiko-framew
 import { Temporal } from "temporal-polyfill";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import { authFoundationFeature, resolveTokenVerifier } from "../../auth-foundation";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -39,7 +37,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity } from "../../user/schema/user";
 import { PatHandlers, PatQueries } from "../constants";
 import { createPersonalAccessTokensFeature } from "../feature";
-import { createPatResolver } from "../resolver";
 import { apiTokenEntity, apiTokenTable } from "../schema/api-token";
 import type { PatScopeConfig } from "../scopes";
 
@@ -51,7 +48,6 @@ import type { PatScopeConfig } from "../scopes";
 
 let stack: TestStack;
 let h: ReturnType<typeof makeSessionHelpers>;
-let patResolver: PatResolver | undefined;
 
 const encryptionKey = randomBytes(32).toString("base64");
 const TENANT: TenantId = testTenantId(1);
@@ -91,21 +87,22 @@ beforeAll(async () => {
       createAuthEmailPasswordFeature(),
       createSessionsFeature(),
       createPersonalAccessTokensFeature({ scopes: SCOPES }),
+      authFoundationFeature,
     ],
     extraContext: { configResolver: resolver, configEncryption: encryption },
     authConfig: {
       membershipQuery: "tenant:query:memberships",
       loginHandler: AuthHandlers.login,
-      patResolver: (raw: string) => {
-        if (!patResolver) throw new Error("resolver not set");
-        return patResolver(raw);
-      },
+      // PAT registers itself as a tokenVerifier provider (auth-foundation)
+      // instead of the app wiring a dedicated patResolver — resolved
+      // generically here, same as run-prod-app/run-dev-app do.
+      tokenVerifier: (raw: string) =>
+        resolveTokenVerifier({ db: stack.db, registry: stack.registry }, raw),
       // Low per-token cap so the rate-limit test can exhaust it. Other tests do
       // ≤2 requests per (distinct) token, so this ceiling never trips them.
       patRateLimiter: createInMemoryLoginRateLimiter(3, 60_000),
     },
   });
-  patResolver = createPatResolver({ db: stack.db, scopes: SCOPES });
   h = makeSessionHelpers(stack, TENANT);
 
   await unsafeCreateEntityTable(stack.db, userEntity);

package/src/personal-access-tokens/feature.ts

@@ -1,3 +1,8 @@
+import {
+  type AuthProviderPlugin,
+  EXT_TOKEN_VERIFIER,
+} from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
 import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PAT_SCREEN_ID, type PatRateLimit } from "./constants";
@@ -6,6 +11,7 @@ import { createPatWrite } from "./handlers/create.write";
 import { listPatQuery } from "./handlers/list.query";
 import { revokePatWrite } from "./handlers/revoke.write";
 import { PAT_FEATURE_I18N } from "./i18n";
+import { createPatResolver } from "./resolver";
 import { apiTokenEntity } from "./schema/api-token";
 import type { PatScopeConfig } from "./scopes";
 
@@ -25,14 +31,13 @@ export type PersonalAccessTokensOptions = {
 };
 
 export type PatFeatureExports = {
-  readonly scopes: PatScopeConfig;
   readonly rateLimit: PatRateLimit;
 };
 
 // Personal Access Tokens — long-lived, revocable bearer credentials for the
 // HTTP API. Like `sessions`, the hot-path resolver is NOT a handler: it runs on
 // every PAT-authenticated request and does a direct-DB point-read (see
-// createPatResolver / run-prod-app wiring). The dispatcher-side handlers here
+// createPatResolver / the tokenVerifier extension-point registration below). The dispatcher-side handlers here
 // only mint/list/revoke tokens and expose the scope catalog.
 export function createPersonalAccessTokensFeature(
   options: PersonalAccessTokensOptions,
@@ -40,16 +45,25 @@ export function createPersonalAccessTokensFeature(
   const { scopes } = options;
   return defineFeature(PAT_FEATURE, (r) => {
     r.describe(
-      "Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `store_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — the resolver is wired via run-prod-app, not the dispatcher. Pass { toggleable: { default: false } } to tier-gate the whole feature.",
+      "Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `store_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — registered as an auth-foundation tokenVerifier provider, resolved generically by the middleware. Pass { toggleable: { default: false } } to tier-gate the whole feature.",
     );
-    r.uiHints({ displayLabel: "Personal Access Tokens", category: "identity", recommended: false });
+    r.uiHints({ displayLabel: "Personal Access Tokens", category: "identity", recommended: true });
     // Opt-in tier-gating (mirrors ledger/tags): when set, the feature declares
     // itself r.toggleable so the dispatcher gate + tier-engine can switch PAT
     // on/off per tenant. { default: false } = fail-closed until a tier grants it.
     if (options.toggleable !== undefined) r.toggleable(options.toggleable);
     // Resolver reads memberships + users on every PAT request to build live
     // roles — make both boot-time deps so a mis-wiring fails validateBoot.
-    r.requires("user", "tenant");
+    // auth-foundation owns EXT_TOKEN_VERIFIER, which the useExtension below
+    // registers against.
+    r.requires("user", "tenant", "auth-foundation");
+    // Self-registers as a bearer-auth provider instead of the app wiring a
+    // dedicated patResolver callback — the middleware finds it generically
+    // via resolveTokenVerifier(), shape-matched by the PAT token prefix.
+    r.useExtension(EXT_TOKEN_VERIFIER, "pat", {
+      shape: { kind: "prefix", prefix: PAT_TOKEN_PREFIX },
+      build: (deps) => createPatResolver({ db: deps.db, scopes }),
+    } satisfies AuthProviderPlugin);
     // Direct-write store like store_user_sessions: create/revoke write it, the
     // resolver point-reads it. r.entity would make it a rebuildable projection
     // whose replay (no token events) would wipe every live token (#498/#494).
@@ -78,12 +92,13 @@ export function createPersonalAccessTokensFeature(
     });
     r.translations({ keys: PAT_FEATURE_I18N });
 
-    // scopes + rateLimit flow into feature.exports so run-prod-app builds the
-    // resolver + limiter from the same declaration — single source of truth.
+    // rateLimit flows into feature.exports so run-prod-app builds the
+    // limiter from the same declaration — single source of truth. `scopes`
+    // is closed over directly by the useExtension build() above and by
+    // available-scopes, so it doesn't need to round-trip through exports.
     return {
       handlers,
       queries,
-      scopes,
       rateLimit: options.rateLimit ?? PAT_DEFAULT_RATE_LIMIT,
     } satisfies { handlers: unknown; queries: unknown } & PatFeatureExports;
   });

package/src/personal-access-tokens/handlers/list.query.ts

@@ -29,7 +29,7 @@ export const listPatQuery = defineQueryHandler({
     return Promise.all(
       rows.map(async (r) => ({
         id: r.id,
-        name: await decryptStoredPii(r.name, "pat:list"),
+        name: await decryptStoredPii(r.name, "name", "pat:list"),
         prefix: r.prefix,
         scopes: parseScopeNames(r.scopes),
         createdAt: r.createdAt,

package/src/personal-access-tokens/index.ts

@@ -1,6 +1,5 @@
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { PAT_DEFAULT_RATE_LIMIT, type PatRateLimit } from "./constants";
-import type { PatScopeConfig } from "./scopes";
 
 export type { PatRateLimit } from "./constants";
 export { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PatHandlers, PatQueries } from "./constants";
@@ -12,19 +11,6 @@ export { apiTokenEntity, apiTokenTable } from "./schema/api-token";
 export type { PatScopeConfig, PatScopeDef } from "./scopes";
 export { expandScopes } from "./scopes";
 
-// Reads the scope catalog off a mounted PAT feature's exports (set from the
-// setup-callback return). run-prod-app uses this to build the resolver from the
-// same config the handlers were given. Returns {} for a non-PAT / malformed
-// definition — the caller has already matched on feature.name.
-export function patScopesFromFeature(feature: FeatureDefinition): PatScopeConfig {
-  const exports = feature.exports;
-  if (exports && typeof exports === "object" && "scopes" in exports) {
-    const { scopes } = exports as { scopes: unknown };
-    if (scopes && typeof scopes === "object") return scopes as PatScopeConfig;
-  }
-  return {};
-}
-
 // Reads the per-token rate-limit config off a mounted PAT feature's exports.
 // Falls back to the default when absent. run-prod-app uses this to build the
 // limiter from the same declaration the feature was given.

package/src/personal-access-tokens/resolver.ts

@@ -1,4 +1,4 @@
-import type { PatResolver } from "@cosmicdrift/kumiko-framework/api";
+import type { TokenVerifier } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
@@ -16,7 +16,7 @@ import { expandScopes, type PatScopeConfig } from "./scopes";
 export function createPatResolver(opts: {
   readonly db: DbConnection;
   readonly scopes: PatScopeConfig;
-}): PatResolver {
+}): TokenVerifier {
   const { db, scopes } = opts;
   return async (rawToken: string): Promise<SessionUser | null> => {
     const row = await fetchOne<{

package/src/secrets/__tests__/rotate.integration.test.ts

@@ -7,6 +7,7 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { AppContext } from "@cosmicdrift/kumiko-framework/engine";
+import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   createEnvMasterKeyProvider,
   decodeStoredEnvelope,
@@ -235,5 +236,35 @@ describe("rotate-job circuit-breaker", () => {
       const plaintext = await decryptValue(decodeStoredEnvelope(row.envelope), verifier);
       expect(plaintext).toBe(`secret-${expectedIndex}`);
     }
+
+    // Regression guard (kumiko-framework#1189): rotate.job.ts's
+    // executor.update() call carries no options, so it deliberately
+    // never sets skipUnchanged — every rotation writes a real .updated
+    // event, not a raw UPDATE. A full projection rebuild replays those
+    // events; if a future refactor added skipUnchanged (or swapped the
+    // event write for a raw column update) the rebuild would resurrect
+    // the pre-rotation V1 envelopes instead of landing on V2, exactly
+    // the #464 failure class config/auth-mfa already guard against.
+    //
+    // Vacuous-rebuild guard: confirm the projection name actually exists
+    // and the rebuild really replayed events, so a wrong projection name
+    // can't silently no-op the assertion below into a false pass.
+    const projectionName = "secrets:projection:tenant-secret-entity";
+    expect(stack.registry.getAllProjections().has(projectionName)).toBe(true);
+    const rebuildResult = await rebuildProjection(projectionName, {
+      db: stack.db,
+      registry: stack.registry,
+    });
+    expect(rebuildResult.eventsProcessed).toBeGreaterThan(0);
+
+    const rowsAfterRebuild = await selectMany<{ key: string; kekVersion: number }>(
+      stack.db,
+      tenantSecretsTable,
+      { tenantId: admin.tenantId },
+    );
+    expect(rowsAfterRebuild).toHaveLength(20);
+    for (const row of rowsAfterRebuild) {
+      expect(row.kekVersion).toBe(2);
+    }
   });
 });

package/src/sessions/__tests__/cleanup.integration.test.ts

@@ -5,6 +5,7 @@
 // expired/revoked rows go, live rows stay, batching + signal work.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { sql } from "@cosmicdrift/kumiko-framework/db";
 import type { AppContext } from "@cosmicdrift/kumiko-framework/engine";
@@ -40,7 +41,7 @@ let stack: TestStack;
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [createSessionsFeature(), createUserFeature()],
+    features: [authFoundationFeature, createSessionsFeature(), createUserFeature()],
   });
   await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafeCreateEntityTable(stack.db, userEntity);

package/src/sessions/__tests__/password-auto-revoke.integration.test.ts

@@ -1,5 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, mock, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -66,6 +67,7 @@ beforeAll(async () => {
       createUserFeature(),
       createTenantFeature(),
       createAuthEmailPasswordFeature(),
+      authFoundationFeature,
       createSessionsFeature({
         autoRevokeOnPasswordChange: massRevokeSpy,
       }),
@@ -78,7 +80,7 @@ beforeAll(async () => {
     },
   });
   callbacks.set(createSessionCallbacks({ db: stack.db }));
-  h = makeSessionHelpers(stack, TENANT);
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator);
 
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
@@ -99,7 +101,7 @@ beforeEach(async () => {
 
 describe("password change mass-revokes every live session", () => {
   test("changing the password revokes ALL sessions including the caller's", async () => {
-    await h.seedUser("rotate@example.com", "first-password");
+    const { userId } = await h.seedUser("rotate@example.com", "first-password");
 
     const a = await h.login("rotate@example.com", "first-password");
     const b = await h.login("rotate@example.com", "first-password");
@@ -147,7 +149,7 @@ describe("password change mass-revokes every live session", () => {
 
     // DB state confirms: zero live rows for this user
     const liveRows = await selectMany(stack.db, userSessionTable);
-    const stillLive = liveRows.filter((r) => r["revokedAt"] === null);
+    const stillLive = liveRows.filter((r) => r["userId"] === userId && r["revokedAt"] === null);
     expect(stillLive).toHaveLength(0);
 
     // And logging in again with the NEW password works

package/src/sessions/__tests__/rebuild-survival.integration.test.ts

@@ -1,4 +1,5 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createRegistry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
@@ -72,14 +73,22 @@ async function insertRevokedSession(db: DbConnection): Promise<void> {
 
 describe("sessions / store_user_sessions survives projection rebuild", () => {
   test("is NOT registered as a rebuildable implicit projection", () => {
-    const registry = createRegistry([createSessionsFeature(), createUserFeature()]);
+    const registry = createRegistry([
+      authFoundationFeature,
+      createSessionsFeature(),
+      createUserFeature(),
+    ]);
     expect(registry.getAllProjections().has(IMPLICIT_PROJECTION)).toBe(false);
   });
 
   test("direct-written rows (incl. revoked state) survive a rebuild", async () => {
     await insertRevokedSession(createTenantDb(testDb.db, TENANT));
 
-    const registry = createRegistry([createSessionsFeature(), createUserFeature()]);
+    const registry = createRegistry([
+      authFoundationFeature,
+      createSessionsFeature(),
+      createUserFeature(),
+    ]);
     // Pre-fix: the implicit projection exists → rebuild swaps an empty shadow
     // → rows wiped. Post-fix: absent → no rebuild → rows untouched. Either way
     // a regression (re-adding r.entity) makes this fail.

package/src/sessions/__tests__/session-store-registration.test.ts

@@ -0,0 +1,21 @@
+// sessions self-registers as auth-foundation's sessionStore provider (#1371)
+// instead of only being wired by hand into buildServer({ auth: { ... } }).
+
+import { describe, expect, test } from "bun:test";
+import { EXT_SESSION_STORE } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { createSessionsFeature } from "../feature";
+
+describe("createSessionsFeature — sessionStore registration (#1371)", () => {
+  test('registers via r.useExtension(EXT_SESSION_STORE, "default", ...)', () => {
+    const feature = createSessionsFeature();
+    const usage = feature.extensionUsages.find((u) => u.extensionName === EXT_SESSION_STORE);
+    expect(usage).toBeDefined();
+    expect(usage?.entityName).toBe("default");
+    expect(typeof (usage?.options as { build?: unknown } | undefined)?.build).toBe("function");
+  });
+
+  test("requires auth-foundation (owner of EXT_SESSION_STORE)", () => {
+    const feature = createSessionsFeature();
+    expect(feature.requires).toContain("auth-foundation");
+  });
+});

package/src/sessions/__tests__/sessions-screens.boot.test.ts

@@ -1,17 +1,26 @@
 import { describe, expect, test } from "bun:test";
-import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { EXT_SESSION_STORE } from "../../auth-foundation";
 import { createConfigFeature } from "../../config/feature";
 import { createTenantFeature } from "../../tenant";
 import { createUserFeature } from "../../user/feature";
 import { SESSION_DETAIL_SCREEN_ID, SESSION_LIST_SCREEN_ID } from "../constants";
 import { createSessionsFeature } from "../feature";
 
+// Stub instead of the real auth-foundation — this test is about screen/query
+// wiring, not auth; the real feature also mandates a tokenVerifier provider
+// which is out of scope here.
+const sessionStoreOwnerStub = defineFeature("auth-foundation", (r) => {
+  r.extendsRegistrar(EXT_SESSION_STORE, {});
+});
+
 describe("sessions screens + query access alignment (kumiko-framework#255)", () => {
   const features = [
     createConfigFeature(),
     createUserFeature(),
     createTenantFeature(),
+    sessionStoreOwnerStub,
     createSessionsFeature(),
   ];