@cosmicdrift/kumiko-bundled-features 0.159.1 → 0.161.0

package/src/auth-email-password/web/__tests__/invite-accept-screen.test.tsx

@@ -3,16 +3,17 @@
 // useSession() throws without a provider, so any consumer mounting this
 // screen on a public route outside SessionAuthGate crashed at runtime.
 
-import { describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 import {
   createStaticLocaleResolver,
   LocaleProvider,
   PrimitivesProvider,
 } from "@cosmicdrift/kumiko-renderer";
 import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
-import { render, screen } from "@testing-library/react";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
 import { defaultTranslations } from "../../i18n";
 import { InviteAcceptScreen } from "../invite-accept-screen";
+import { makeSessionApi, renderWithProviders } from "./test-utils";
 
 const resolver = createStaticLocaleResolver({ locale: "de" });
 
@@ -26,6 +27,24 @@ function renderWithoutSessionProvider(token: string) {
   );
 }
 
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(JSON.stringify({ tenantId: "tenant-new" }), { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+
+// Capture once — afterEach must restore the real Location, not `{...location}`
+// (plain objects break `new URL(window.location.href)` in useUrlToken → ResetPasswordScreen).
+const originalLocation = window.location;
+
+afterEach(() => {
+  Object.defineProperty(window, "location", {
+    configurable: true,
+    writable: true,
+    value: originalLocation,
+  });
+});
+
 describe("InviteAcceptScreen — no <SessionProvider> ancestor (632/1)", () => {
   test("renders the anonymous accept-form instead of throwing", () => {
     renderWithoutSessionProvider("tok-123");
@@ -40,5 +59,110 @@ describe("InviteAcceptScreen — no <SessionProvider> ancestor (632/1)", () => {
     expect(
       screen.getByText("Der Einladungs-Link enthält keinen Token oder ist ungültig."),
     ).toBeTruthy();
+    expect(screen.getByRole("link", { name: "Zum Login" }).getAttribute("href")).toBe("/login");
+  });
+});
+
+describe("InviteAcceptScreen — logged-in branch", () => {
+  test("authenticated session shows 1-click accept form", () => {
+    renderWithProviders(<InviteAcceptScreen token="tok-123" />, {
+      session: makeSessionApi({ status: "authenticated" }),
+    });
+    expect(screen.getByText(/Du bist eingeloggt/)).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Annehmen" })).toBeTruthy();
+    expect(screen.queryByLabelText(/^E-Mail/)).toBeNull();
+  });
+
+  test("accept logged-in success redirects via loggedInHref function", async () => {
+    const assign = mock<(url: string) => void>();
+    Object.defineProperty(window, "location", {
+      configurable: true,
+      writable: true,
+      value: { href: originalLocation.href, search: originalLocation.search, assign },
+    });
+    renderWithProviders(
+      <InviteAcceptScreen token="tok-123" loggedInHref={({ tenantId }) => `/${tenantId}/home`} />,
+      { session: makeSessionApi({ status: "authenticated" }) },
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen" }));
+    await waitFor(() => {
+      expect(assign).toHaveBeenCalledWith("/tenant-new/home");
+    });
+  });
+
+  test("accept logged-in failure shows invalidInviteToken banner", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 422 }),
+    ) as unknown as typeof fetch;
+    renderWithProviders(<InviteAcceptScreen token="bad" />, {
+      session: makeSessionApi({ status: "authenticated" }),
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("auth.errors.invalidInviteToken");
+    });
+  });
+
+  test("use other account switches to anon-existing form", () => {
+    renderWithProviders(<InviteAcceptScreen token="tok-123" />, {
+      session: makeSessionApi({ status: "authenticated" }),
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Mit anderem Account anmelden" }));
+    expect(screen.getByLabelText(/^E-Mail/)).toBeTruthy();
+  });
+});
+
+describe("InviteAcceptScreen — anonymous branches", () => {
+  test("anon-existing submit posts invite-accept-with-login", async () => {
+    const fetchMock = mock(
+      async () => new Response(JSON.stringify({ tenantId: "t1" }), { status: 200 }),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+    renderWithoutSessionProvider("tok-123");
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@example.com" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "secret123" } });
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen + Anmelden" }));
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/invite-accept-with-login",
+        expect.objectContaining({
+          method: "POST",
+          body: JSON.stringify({ token: "tok-123", email: "a@example.com", password: "secret123" }),
+        }),
+      );
+    });
+  });
+
+  test("toggle to anon-new hides email and posts invite-signup-complete", async () => {
+    const fetchMock = mock(
+      async () => new Response(JSON.stringify({ tenantId: "t1" }), { status: 200 }),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+    renderWithoutSessionProvider("tok-123");
+    fireEvent.click(screen.getByRole("button", { name: "Ich habe noch keinen Account" }));
+    expect(screen.queryByLabelText(/^E-Mail/)).toBeNull();
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "newpass123" } });
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen + Anmelden" }));
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/invite-signup-complete",
+        expect.objectContaining({
+          body: JSON.stringify({ token: "tok-123", password: "newpass123" }),
+        }),
+      );
+    });
+  });
+
+  test("anon failure shows invalidInviteToken banner", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 422 }),
+    ) as unknown as typeof fetch;
+    renderWithoutSessionProvider("tok-123");
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@example.com" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "wrong" } });
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen + Anmelden" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("auth.errors.invalidInviteToken");
+    });
   });
 });

package/src/auth-email-password/web/__tests__/login-screen.test.tsx

@@ -247,4 +247,138 @@ describe("LoginScreen", () => {
       expect(screen.queryByRole("button", { name: /erneut senden/i })).toBeNull();
     });
   });
+
+  test("account_locked without retry → unlock link when href set", async () => {
+    const session = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "failure",
+        error: { reason: "account_locked" },
+      })),
+    });
+    renderWithProviders(<LoginScreen unlockAccountHref="/unlock" />, { session });
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("vorübergehend gesperrt");
+    });
+    expect(screen.getByRole("link", { name: /Konto entsperren/i }).getAttribute("href")).toBe(
+      "/unlock",
+    );
+  });
+
+  test("reasonToKey covers no_membership, rate_limited, invalid_body, default", async () => {
+    const cases: Array<{ reason: string; needle: string }> = [
+      { reason: "no_membership", needle: "keinen Tenant-Zugang" },
+      { reason: "rate_limited", needle: "Zu viele Login-Versuche" },
+      { reason: "invalid_body", needle: "Ungültige Eingabe" },
+      { reason: "weird_unknown", needle: "Login fehlgeschlagen" },
+      { reason: "mfa_setup_required", needle: "Zwei-Faktor-Authentifizierung erforderlich" },
+    ];
+    for (const { reason, needle } of cases) {
+      const session = makeSessionApi({
+        status: "unauthenticated",
+        user: null,
+        login: mock<SessionApi["login"]>(async () => ({
+          kind: "failure",
+          error: { reason },
+        })),
+      });
+      const { unmount } = renderWithProviders(<LoginScreen />, { session });
+      fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+      fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+      fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+      await waitFor(() => {
+        expect(screen.getByRole("alert").textContent).toContain(needle);
+      });
+      unmount();
+    }
+  });
+
+  test("mfa-challenge with onMfaChallenge fires token", async () => {
+    const onMfaChallenge = mock<(t: string) => void>();
+    const session = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "mfa-challenge",
+        challengeToken: "chal-1",
+      })),
+    });
+    renderWithProviders(<LoginScreen onMfaChallenge={onMfaChallenge} />, { session });
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(onMfaChallenge).toHaveBeenCalledWith("chal-1");
+    });
+    expect(screen.queryByRole("alert")).toBeNull();
+  });
+
+  test("mfa-challenge without callback → mfa_not_supported", async () => {
+    const session = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "mfa-challenge",
+        challengeToken: "chal-1",
+      })),
+    });
+    renderWithProviders(<LoginScreen />, { session });
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toMatch(/MFA|Zwei-Faktor|nicht unterstützt/i);
+    });
+  });
+
+  test("mfa-setup-required with and without onMfaSetupRequired", async () => {
+    const onMfaSetupRequired = mock<() => void>();
+    const sessionOk = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "mfa-setup-required",
+        preauthSetupToken: "setup-token-value",
+      })),
+    });
+    const { unmount } = renderWithProviders(
+      <LoginScreen onMfaSetupRequired={onMfaSetupRequired} />,
+      { session: sessionOk },
+    );
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(onMfaSetupRequired).toHaveBeenCalled();
+    });
+    unmount();
+
+    const sessionBare = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "mfa-setup-required",
+        preauthSetupToken: "setup-token-value",
+      })),
+    });
+    renderWithProviders(<LoginScreen />, { session: sessionBare });
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain(
+        "Zwei-Faktor-Authentifizierung erforderlich",
+      );
+    });
+  });
+
+  test("signupHref renders signup link", () => {
+    renderWithProviders(<LoginScreen signupHref="/signup" />);
+    const link = screen.getByRole("link", { name: "Account erstellen" });
+    expect(link.getAttribute("href")).toBe("/signup");
+  });
 });

package/src/auth-email-password/web/__tests__/request-account-unlock-screen.test.tsx

@@ -0,0 +1,131 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { fireEvent, screen, waitFor } from "@testing-library/react";
+import { RequestAccountUnlockScreen } from "../request-account-unlock-screen";
+import { renderWithProviders } from "./test-utils";
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(null, { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {});
+
+describe("RequestAccountUnlockScreen", () => {
+  test("renders title + email input + submit (de)", () => {
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    expect(screen.getByText("Konto entsperren")).toBeTruthy();
+    expect(screen.getByLabelText(/^E-Mail/)).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Link anfordern" })).toBeTruthy();
+  });
+
+  test("submit posts /api/auth/request-account-unlock with email", async () => {
+    const fetchMock = mock(async () => new Response(null, { status: 200 }));
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/request-account-unlock",
+        expect.objectContaining({
+          method: "POST",
+          body: JSON.stringify({ email: "user@example.com" }),
+        }),
+      );
+    });
+  });
+
+  test("success → silent-success banner + back-to-login link", async () => {
+    renderWithProviders(<RequestAccountUnlockScreen loginHref="/signin" />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Mail gesendet")).toBeTruthy();
+    });
+    expect(screen.getByRole("link", { name: /Zurück zum Login/i }).getAttribute("href")).toBe(
+      "/signin",
+    );
+  });
+
+  test("429 with retryAfterSeconds → accountLockedRetry banner", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(JSON.stringify({ error: { details: { retryAfterSeconds: 180 } } }), {
+          status: 429,
+        }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("3 Minuten");
+    });
+    expect(screen.queryByText("Mail gesendet")).toBeNull();
+  });
+
+  test("429 without retryAfterSeconds → generic rateLimited banner", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 429 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("Zu viele Login-Versuche");
+    });
+  });
+
+  test("server 5xx → unknownError banner, stays on form", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 500 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("schief");
+    });
+    expect(screen.queryByText("Mail gesendet")).toBeNull();
+    expect(screen.getByLabelText(/^E-Mail/)).toBeTruthy();
+  });
+
+  test("fetch throw → unknownError banner", async () => {
+    globalThis.fetch = mock(async () => {
+      throw new Error("network down");
+    }) as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("schief");
+    });
+  });
+
+  test("custom title prop overrides default", () => {
+    renderWithProviders(<RequestAccountUnlockScreen title="Custom Unlock" />);
+    expect(screen.getByText("Custom Unlock")).toBeTruthy();
+  });
+});

package/src/auth-email-password/web/auth-client.ts

@@ -53,7 +53,7 @@ export function csrfHeader(): Record<string, string> {
 export type LoginResult =
   | { readonly kind: "success"; readonly data: LoginResponse }
   | { readonly kind: "mfa-challenge"; readonly challengeToken: string }
-  | { readonly kind: "mfa-setup-required" }
+  | { readonly kind: "mfa-setup-required"; readonly preauthSetupToken: string }
   | { readonly kind: "failure"; readonly error: LoginFailure };
 
 // POST /api/auth/login. Success → token + user; MFA-enrolled user → a
@@ -80,6 +80,7 @@ export async function login(req: LoginRequest): Promise<LoginResult> {
     mfaRequired?: boolean;
     challengeToken?: string;
     mfaSetupRequired?: boolean;
+    preauthSetupToken?: string;
     error?:
       | {
           code?: string;
@@ -92,8 +93,8 @@ export async function login(req: LoginRequest): Promise<LoginResult> {
     if (body.mfaRequired === true && typeof body.challengeToken === "string") {
       return { kind: "mfa-challenge", challengeToken: body.challengeToken };
     }
-    if (body.mfaSetupRequired === true) {
-      return { kind: "mfa-setup-required" };
+    if (body.mfaSetupRequired === true && typeof body.preauthSetupToken === "string") {
+      return { kind: "mfa-setup-required", preauthSetupToken: body.preauthSetupToken };
     }
     if (body.token !== undefined && body.user !== undefined) {
       return { kind: "success", data: { token: body.token, user: body.user } };

package/src/auth-email-password/web/login-screen.tsx

@@ -65,7 +65,8 @@ export type LoginScreenProps = {
   readonly onMfaChallenge?: (challengeToken: string) => void;
   /** Called when the tenant's enforcement policy requires MFA but this
    *  user has no factor enrolled yet. Apps typically route to an
-   *  enrollment flow. Same fallback behavior as onMfaChallenge when unset. */
+   *  enrollment flow. Without a handler, the user sees a "setup required,
+   *  contact your administrator" error. */
   readonly onMfaSetupRequired?: () => void;
 };
 
@@ -97,6 +98,8 @@ function reasonToKey(failure: LoginFailure): {
       return { key: "auth.errors.invalidBody" };
     case "mfa_not_supported":
       return { key: "auth.errors.mfaNotSupported" };
+    case "mfa_setup_required":
+      return { key: "auth.errors.mfaSetupRequired" };
     default:
       return { key: "auth.errors.loginFailed" };
   }
@@ -147,7 +150,7 @@ export function LoginScreen({
         onMfaSetupRequired();
         return;
       }
-      setError({ reason: "mfa_not_supported" });
+      setError({ reason: "mfa_setup_required" });
       setFailedLoginEmail(email);
       return;
     }

package/src/auth-foundation/__tests__/feature.test.ts

@@ -4,7 +4,12 @@
 
 import { describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "../feature";
-import { EXT_SESSION_STORE, EXT_TOKEN_VERIFIER } from "../types";
+import {
+  EXT_SESSION_STORE,
+  EXT_TENANT_EXISTENCE,
+  EXT_TENANT_RESOLVER,
+  EXT_TOKEN_VERIFIER,
+} from "../types";
 
 describe("authFoundationFeature — shape", () => {
   test("has the expected name", () => {
@@ -24,10 +29,18 @@ describe("authFoundationFeature — registers extension-point", () => {
   test("declares the sessionStore extension-point", () => {
     expect(authFoundationFeature.registrarExtensions[EXT_SESSION_STORE]).toBeDefined();
   });
+
+  test("declares the tenantResolver extension-point", () => {
+    expect(authFoundationFeature.registrarExtensions[EXT_TENANT_RESOLVER]).toBeDefined();
+  });
+
+  test("declares the tenantExistence extension-point", () => {
+    expect(authFoundationFeature.registrarExtensions[EXT_TENANT_EXISTENCE]).toBeDefined();
+  });
 });
 
 describe("authFoundationFeature — multiplicity boot-check", () => {
-  test("registers a bootCheck per extension-point (tokenVerifier + sessionStore)", () => {
-    expect(authFoundationFeature.bootChecks.length).toBeGreaterThanOrEqual(2);
+  test("registers a bootCheck per extension-point (token/session/tenant×2)", () => {
+    expect(authFoundationFeature.bootChecks.length).toBeGreaterThanOrEqual(4);
   });
 });

package/src/auth-foundation/__tests__/session-store.test.ts

@@ -17,6 +17,7 @@ function mockStore(): SessionStore {
     revoker: async () => undefined,
     checker: async () => "live",
     massRevoker: async () => 0,
+    revokeAllOthers: async () => 0,
   };
 }
 

package/src/auth-foundation/__tests__/tenant-providers.test.ts

@@ -0,0 +1,136 @@
+// resolveTenantResolver / resolveTenantExistence + optional multiplicity (#1373).
+
+import { describe, expect, test } from "bun:test";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createRegistry, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  validateTenantExistenceMultiplicity,
+  validateTenantResolverMultiplicity,
+} from "../boot-checks";
+import { authFoundationFeature, resolveTenantExistence, resolveTenantResolver } from "../feature";
+import { resolveAnonymousAccessFromRegistry } from "../resolve-anonymous-access";
+import {
+  EXT_TENANT_EXISTENCE,
+  EXT_TENANT_RESOLVER,
+  type TenantExistenceProvider,
+  type TenantResolverProvider,
+} from "../types";
+
+const fakeDb = {} as DbConnection;
+
+function resolverProvider(
+  entityName: string,
+  trust: "authoritative" | "fallback-only" = "authoritative",
+): ReturnType<typeof defineFeature> {
+  const plugin: TenantResolverProvider = {
+    trust,
+    build: () => async () => "00000000-0000-4000-8000-000000000001",
+  };
+  return defineFeature(`mock-resolver-${entityName}`, (r) => {
+    r.useExtension(EXT_TENANT_RESOLVER, entityName, plugin);
+  });
+}
+
+function existenceProvider(entityName: string): ReturnType<typeof defineFeature> {
+  const plugin: TenantExistenceProvider = {
+    build: () => async () => true,
+  };
+  return defineFeature(`mock-existence-${entityName}`, (r) => {
+    r.useExtension(EXT_TENANT_EXISTENCE, entityName, plugin);
+  });
+}
+
+describe("resolveTenantResolver — optional single provider", () => {
+  test("no provider → null", async () => {
+    const registry = createRegistry([authFoundationFeature]);
+    expect(await resolveTenantResolver({ db: fakeDb, registry })).toBeNull();
+  });
+
+  test("one provider → resolve + trust", async () => {
+    const registry = createRegistry([authFoundationFeature, resolverProvider("subdomain")]);
+    const resolved = await resolveTenantResolver({ db: fakeDb, registry });
+    expect(resolved?.trust).toBe("authoritative");
+    expect(await resolved?.resolve({})).toBe("00000000-0000-4000-8000-000000000001");
+  });
+});
+
+describe("resolveTenantExistence — optional single provider", () => {
+  test("no provider → null", async () => {
+    const registry = createRegistry([authFoundationFeature]);
+    expect(await resolveTenantExistence({ db: fakeDb, registry })).toBeNull();
+  });
+
+  test("one provider → existence fn", async () => {
+    const registry = createRegistry([authFoundationFeature, existenceProvider("db")]);
+    const exists = await resolveTenantExistence({ db: fakeDb, registry });
+    expect(await exists?.("00000000-0000-4000-8000-000000000001")).toBe(true);
+  });
+});
+
+describe("validateTenantResolverMultiplicity", () => {
+  test("0 providers → no throw", () => {
+    const registry = createRegistry([authFoundationFeature]);
+    expect(() => validateTenantResolverMultiplicity([...registry.features.values()])).not.toThrow();
+  });
+
+  test("1 provider → no throw", () => {
+    const registry = createRegistry([authFoundationFeature, resolverProvider("a")]);
+    expect(() => validateTenantResolverMultiplicity([...registry.features.values()])).not.toThrow();
+  });
+
+  test("≥2 providers → throws", () => {
+    const registry = createRegistry([
+      authFoundationFeature,
+      resolverProvider("a"),
+      resolverProvider("b"),
+    ]);
+    expect(() => validateTenantResolverMultiplicity([...registry.features.values()])).toThrow(
+      /2 tenantResolver providers/,
+    );
+  });
+
+  test("malformed (no trust) → throws", () => {
+    const broken = defineFeature("mock-broken-resolver", (r) => {
+      r.useExtension(EXT_TENANT_RESOLVER, "broken", { build: () => () => null });
+    });
+    const registry = createRegistry([authFoundationFeature, broken]);
+    expect(() => validateTenantResolverMultiplicity([...registry.features.values()])).toThrow(
+      /without a valid TenantResolverProvider/,
+    );
+  });
+});
+
+describe("validateTenantExistenceMultiplicity", () => {
+  test("0 providers → no throw", () => {
+    const registry = createRegistry([authFoundationFeature]);
+    expect(() =>
+      validateTenantExistenceMultiplicity([...registry.features.values()]),
+    ).not.toThrow();
+  });
+
+  test("≥2 providers → throws", () => {
+    const registry = createRegistry([
+      authFoundationFeature,
+      existenceProvider("a"),
+      existenceProvider("b"),
+    ]);
+    expect(() => validateTenantExistenceMultiplicity([...registry.features.values()])).toThrow(
+      /2 tenantExistence providers/,
+    );
+  });
+});
+
+describe("resolveAnonymousAccessFromRegistry — fail-closed trust", () => {
+  test("inline tenantResolver without resolverTrust throws", async () => {
+    const registry = createRegistry([authFoundationFeature]);
+    await expect(
+      resolveAnonymousAccessFromRegistry(
+        {
+          tenantResolver: () => "00000000-0000-4000-8000-000000000001" as TenantId,
+        },
+        { db: fakeDb, registry },
+      ),
+    ).rejects.toThrow(/resolverTrust/);
+  });
+});