@cosmicdrift/kumiko-bundled-features 0.160.0 → 0.161.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.160.0",
+  "version": "0.161.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -117,11 +117,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.160.0",
-    "@cosmicdrift/kumiko-framework": "0.160.0",
-    "@cosmicdrift/kumiko-headless": "0.160.0",
-    "@cosmicdrift/kumiko-renderer": "0.160.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.160.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.161.0",
+    "@cosmicdrift/kumiko-framework": "0.161.0",
+    "@cosmicdrift/kumiko-headless": "0.161.0",
+    "@cosmicdrift/kumiko-renderer": "0.161.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.161.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-email-password/__tests__/login-mfa-setup-required.integration.test.ts

@@ -0,0 +1,129 @@
+// #1455: enforcement policy blocks an unenrolled user at login
+// (mfa-setup-required) — the response must carry a preauthSetupToken so a
+// later pre-auth enroll step (#1231) can look the user back up without a
+// session. Real HTTP through setupTestStack, both auth-mfa and
+// auth-email-password mounted together (mirrors auth.integration.test.ts).
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createAuthMfaFeature,
+  mfaRequiredConfigHandle,
+  mfaStatusCheckerFromFeature,
+} from "../../auth-mfa";
+import { userMfaEntity } from "../../auth-mfa/schema/user-mfa";
+import { ConfigHandlers, createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
+import { createTenantFeature } from "../../tenant";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { seedTenantMembership } from "../../tenant/testing";
+import { UserHandlers } from "../../user";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { AuthErrors, AuthHandlers } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+
+let stack: TestStack;
+
+const CHALLENGE_TOKEN_SECRET = "test-mfa-challenge-secret-at-least-32-bytes!!";
+const TENANT_ID: TenantId = testTenantId(400);
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  const resolver = createConfigResolver({ cipher: encryption });
+  const authMfaFeature = createAuthMfaFeature({
+    setupTokenSecret: "test-mfa-setup-token-secret-at-least-32-bytes!!",
+    issuer: "Kumiko Test",
+    challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+  });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      authMfaFeature,
+      createAuthEmailPasswordFeature({
+        mfaStatusChecker: mfaStatusCheckerFromFeature(authMfaFeature),
+      }),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      loginErrorStatusMap: {
+        [AuthErrors.invalidCredentials]: 401,
+        [AuthErrors.noMembership]: 403,
+      },
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+});
+
+describe("login: mfa-setup-required carries a verifiable preauthSetupToken", () => {
+  test("unenrolled user blocked by 'all' policy gets a token instead of a session", async () => {
+    const password = "correct-horse-battery-2026";
+    const hash = await hashPassword(password);
+    const created = await stack.http.writeOk<{ id: string }>(
+      UserHandlers.create,
+      { email: "unenrolled@example.com", passwordHash: hash, displayName: "Unenrolled" },
+      createTestUser({ id: 401, tenantId: TENANT_ID, roles: ["SystemAdmin"] }),
+    );
+    await seedTenantMembership(stack.db, {
+      userId: created.id,
+      tenantId: TENANT_ID,
+      roles: ["User"],
+    });
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: mfaRequiredConfigHandle.name, value: "all" },
+      createTestUser({ id: 402, tenantId: TENANT_ID, roles: ["Admin"] }),
+    );
+
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: "unenrolled@example.com",
+      password,
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(true);
+    expect(body.mfaSetupRequired).toBe(true);
+    expect(body.token).toBeUndefined();
+    expect(typeof body.preauthSetupToken).toBe("string");
+
+    const { verifyMfaPreauthSetupToken } = await import("../../auth-mfa/mfa-preauth-setup-token");
+    const verified = verifyMfaPreauthSetupToken(body.preauthSetupToken, CHALLENGE_TOKEN_SECRET);
+    expect(verified.ok).toBe(true);
+    if (verified.ok) {
+      expect(verified.payload).toEqual({ userId: created.id, tenantId: TENANT_ID });
+    }
+  });
+});

package/src/auth-email-password/__tests__/session-callbacks.integration.test.ts

@@ -158,6 +158,11 @@ async function seedUser(opts: {
       roles: t.roles,
     });
   }
+  // request-helper mints a sid for systemAdmin when sessionCreator is wired
+  // (#1372) — that is seed plumbing, not the auth-route behavior under test.
+  store.live.clear();
+  store.created.length = 0;
+  store.revoked.length = 0;
   return { userId: created.id };
 }
 

package/src/auth-email-password/handlers/login.write.ts

@@ -58,7 +58,7 @@ export type LoginHandlerOptions = {
   ) => Promise<
     | { readonly required: false }
     | { readonly required: true; readonly challengeToken: string }
-    | { readonly setupRequired: true }
+    | { readonly setupRequired: true; readonly preauthSetupToken: string }
   >;
 };
 
@@ -70,7 +70,7 @@ const SYSTEM_USER_ID = "00000000-0000-4000-8000-000000000000";
 type LoginResult =
   | { readonly kind: "auth-session"; readonly session: SessionUser }
   | { readonly kind: "mfa-challenge"; readonly challengeToken: string }
-  | { readonly kind: "mfa-setup-required" };
+  | { readonly kind: "mfa-setup-required"; readonly preauthSetupToken: string };
 
 // Login — unauthenticated entry point. The route is wired public (no JWT
 // middleware), synthesising a guest SessionUser for the handler's access
@@ -226,7 +226,10 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
           };
         }
         if ("setupRequired" in mfaStatus) {
-          return { isSuccess: true, data: { kind: "mfa-setup-required" } };
+          return {
+            isSuccess: true,
+            data: { kind: "mfa-setup-required", preauthSetupToken: mfaStatus.preauthSetupToken },
+          };
         }
       }
 

package/src/auth-email-password/i18n.ts

@@ -35,6 +35,8 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.errors.loginFailed": "Login fehlgeschlagen.",
     "auth.errors.mfaNotSupported":
       "Diese App unterstützt keine Zwei-Faktor-Bestätigung. Bitte an den Support wenden.",
+    "auth.errors.mfaSetupRequired":
+      "Zwei-Faktor-Authentifizierung erforderlich. Bitte an den Administrator wenden.",
     "auth.errors.invalidResetToken":
       "Der Link ist ungültig oder abgelaufen. Bitte fordere einen neuen an.",
     "auth.errors.invalidVerificationToken": "Der Bestätigungs-Link ist ungültig oder abgelaufen.",
@@ -161,6 +163,8 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.errors.loginFailed": "Login failed.",
     "auth.errors.mfaNotSupported":
       "This app doesn't support two-factor verification. Please contact support.",
+    "auth.errors.mfaSetupRequired":
+      "Two-factor authentication required. Please contact your administrator.",
     "auth.errors.invalidResetToken": "Link is invalid or expired. Please request a new one.",
     "auth.errors.invalidVerificationToken": "Verification link is invalid or expired.",
     "auth.errors.invalidUnlockToken":

package/src/auth-email-password/web/__tests__/auth-client.test.ts

@@ -95,12 +95,16 @@ describe("login", () => {
 
   test("MFA enforcement blocks unenrolled user → kind:mfa-setup-required", async () => {
     globalThis.fetch = mock(async () =>
-      jsonResponse({ isSuccess: true, mfaSetupRequired: true }),
+      jsonResponse({
+        isSuccess: true,
+        mfaSetupRequired: true,
+        preauthSetupToken: "setup-token-value",
+      }),
     ) as unknown as typeof fetch;
 
     const res = await login({ email: "a@b.c", password: "secret" });
 
-    expect(res).toEqual({ kind: "mfa-setup-required" });
+    expect(res).toEqual({ kind: "mfa-setup-required", preauthSetupToken: "setup-token-value" });
   });
 
   test("string error → kind:failure with reason from string", async () => {

package/src/auth-email-password/web/__tests__/login-screen.test.tsx

@@ -275,6 +275,7 @@ describe("LoginScreen", () => {
       { reason: "rate_limited", needle: "Zu viele Login-Versuche" },
       { reason: "invalid_body", needle: "Ungültige Eingabe" },
       { reason: "weird_unknown", needle: "Login fehlgeschlagen" },
+      { reason: "mfa_setup_required", needle: "Zwei-Faktor-Authentifizierung erforderlich" },
     ];
     for (const { reason, needle } of cases) {
       const session = makeSessionApi({
@@ -339,7 +340,10 @@ describe("LoginScreen", () => {
     const sessionOk = makeSessionApi({
       status: "unauthenticated",
       user: null,
-      login: mock<SessionApi["login"]>(async () => ({ kind: "mfa-setup-required" })),
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "mfa-setup-required",
+        preauthSetupToken: "setup-token-value",
+      })),
     });
     const { unmount } = renderWithProviders(
       <LoginScreen onMfaSetupRequired={onMfaSetupRequired} />,
@@ -356,14 +360,19 @@ describe("LoginScreen", () => {
     const sessionBare = makeSessionApi({
       status: "unauthenticated",
       user: null,
-      login: mock<SessionApi["login"]>(async () => ({ kind: "mfa-setup-required" })),
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "mfa-setup-required",
+        preauthSetupToken: "setup-token-value",
+      })),
     });
     renderWithProviders(<LoginScreen />, { session: sessionBare });
     fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
     fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
     fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
     await waitFor(() => {
-      expect(screen.getByRole("alert").textContent).toContain("Zwei-Faktor-Bestätigung");
+      expect(screen.getByRole("alert").textContent).toContain(
+        "Zwei-Faktor-Authentifizierung erforderlich",
+      );
     });
   });
 

package/src/auth-email-password/web/auth-client.ts

@@ -53,7 +53,7 @@ export function csrfHeader(): Record<string, string> {
 export type LoginResult =
   | { readonly kind: "success"; readonly data: LoginResponse }
   | { readonly kind: "mfa-challenge"; readonly challengeToken: string }
-  | { readonly kind: "mfa-setup-required" }
+  | { readonly kind: "mfa-setup-required"; readonly preauthSetupToken: string }
   | { readonly kind: "failure"; readonly error: LoginFailure };
 
 // POST /api/auth/login. Success → token + user; MFA-enrolled user → a
@@ -80,6 +80,7 @@ export async function login(req: LoginRequest): Promise<LoginResult> {
     mfaRequired?: boolean;
     challengeToken?: string;
     mfaSetupRequired?: boolean;
+    preauthSetupToken?: string;
     error?:
       | {
           code?: string;
@@ -92,8 +93,8 @@ export async function login(req: LoginRequest): Promise<LoginResult> {
     if (body.mfaRequired === true && typeof body.challengeToken === "string") {
       return { kind: "mfa-challenge", challengeToken: body.challengeToken };
     }
-    if (body.mfaSetupRequired === true) {
-      return { kind: "mfa-setup-required" };
+    if (body.mfaSetupRequired === true && typeof body.preauthSetupToken === "string") {
+      return { kind: "mfa-setup-required", preauthSetupToken: body.preauthSetupToken };
     }
     if (body.token !== undefined && body.user !== undefined) {
       return { kind: "success", data: { token: body.token, user: body.user } };

package/src/auth-email-password/web/login-screen.tsx

@@ -65,7 +65,8 @@ export type LoginScreenProps = {
   readonly onMfaChallenge?: (challengeToken: string) => void;
   /** Called when the tenant's enforcement policy requires MFA but this
    *  user has no factor enrolled yet. Apps typically route to an
-   *  enrollment flow. Same fallback behavior as onMfaChallenge when unset. */
+   *  enrollment flow. Without a handler, the user sees a "setup required,
+   *  contact your administrator" error. */
   readonly onMfaSetupRequired?: () => void;
 };
 
@@ -97,6 +98,8 @@ function reasonToKey(failure: LoginFailure): {
       return { key: "auth.errors.invalidBody" };
     case "mfa_not_supported":
       return { key: "auth.errors.mfaNotSupported" };
+    case "mfa_setup_required":
+      return { key: "auth.errors.mfaSetupRequired" };
     default:
       return { key: "auth.errors.loginFailed" };
   }
@@ -147,7 +150,7 @@ export function LoginScreen({
         onMfaSetupRequired();
         return;
       }
-      setError({ reason: "mfa_not_supported" });
+      setError({ reason: "mfa_setup_required" });
       setFailedLoginEmail(email);
       return;
     }

package/src/auth-foundation/__tests__/feature.test.ts

@@ -4,7 +4,12 @@
 
 import { describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "../feature";
-import { EXT_SESSION_STORE, EXT_TOKEN_VERIFIER } from "../types";
+import {
+  EXT_SESSION_STORE,
+  EXT_TENANT_EXISTENCE,
+  EXT_TENANT_RESOLVER,
+  EXT_TOKEN_VERIFIER,
+} from "../types";
 
 describe("authFoundationFeature — shape", () => {
   test("has the expected name", () => {
@@ -24,10 +29,18 @@ describe("authFoundationFeature — registers extension-point", () => {
   test("declares the sessionStore extension-point", () => {
     expect(authFoundationFeature.registrarExtensions[EXT_SESSION_STORE]).toBeDefined();
   });
+
+  test("declares the tenantResolver extension-point", () => {
+    expect(authFoundationFeature.registrarExtensions[EXT_TENANT_RESOLVER]).toBeDefined();
+  });
+
+  test("declares the tenantExistence extension-point", () => {
+    expect(authFoundationFeature.registrarExtensions[EXT_TENANT_EXISTENCE]).toBeDefined();
+  });
 });
 
 describe("authFoundationFeature — multiplicity boot-check", () => {
-  test("registers a bootCheck per extension-point (tokenVerifier + sessionStore)", () => {
-    expect(authFoundationFeature.bootChecks.length).toBeGreaterThanOrEqual(2);
+  test("registers a bootCheck per extension-point (token/session/tenant×2)", () => {
+    expect(authFoundationFeature.bootChecks.length).toBeGreaterThanOrEqual(4);
   });
 });

package/src/auth-foundation/__tests__/session-store.test.ts

@@ -17,6 +17,7 @@ function mockStore(): SessionStore {
     revoker: async () => undefined,
     checker: async () => "live",
     massRevoker: async () => 0,
+    revokeAllOthers: async () => 0,
   };
 }
 

package/src/auth-foundation/__tests__/tenant-providers.test.ts

@@ -0,0 +1,136 @@
+// resolveTenantResolver / resolveTenantExistence + optional multiplicity (#1373).
+
+import { describe, expect, test } from "bun:test";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createRegistry, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  validateTenantExistenceMultiplicity,
+  validateTenantResolverMultiplicity,
+} from "../boot-checks";
+import { authFoundationFeature, resolveTenantExistence, resolveTenantResolver } from "../feature";
+import { resolveAnonymousAccessFromRegistry } from "../resolve-anonymous-access";
+import {
+  EXT_TENANT_EXISTENCE,
+  EXT_TENANT_RESOLVER,
+  type TenantExistenceProvider,
+  type TenantResolverProvider,
+} from "../types";
+
+const fakeDb = {} as DbConnection;
+
+function resolverProvider(
+  entityName: string,
+  trust: "authoritative" | "fallback-only" = "authoritative",
+): ReturnType<typeof defineFeature> {
+  const plugin: TenantResolverProvider = {
+    trust,
+    build: () => async () => "00000000-0000-4000-8000-000000000001",
+  };
+  return defineFeature(`mock-resolver-${entityName}`, (r) => {
+    r.useExtension(EXT_TENANT_RESOLVER, entityName, plugin);
+  });
+}
+
+function existenceProvider(entityName: string): ReturnType<typeof defineFeature> {
+  const plugin: TenantExistenceProvider = {
+    build: () => async () => true,
+  };
+  return defineFeature(`mock-existence-${entityName}`, (r) => {
+    r.useExtension(EXT_TENANT_EXISTENCE, entityName, plugin);
+  });
+}
+
+describe("resolveTenantResolver — optional single provider", () => {
+  test("no provider → null", async () => {
+    const registry = createRegistry([authFoundationFeature]);
+    expect(await resolveTenantResolver({ db: fakeDb, registry })).toBeNull();
+  });
+
+  test("one provider → resolve + trust", async () => {
+    const registry = createRegistry([authFoundationFeature, resolverProvider("subdomain")]);
+    const resolved = await resolveTenantResolver({ db: fakeDb, registry });
+    expect(resolved?.trust).toBe("authoritative");
+    expect(await resolved?.resolve({})).toBe("00000000-0000-4000-8000-000000000001");
+  });
+});
+
+describe("resolveTenantExistence — optional single provider", () => {
+  test("no provider → null", async () => {
+    const registry = createRegistry([authFoundationFeature]);
+    expect(await resolveTenantExistence({ db: fakeDb, registry })).toBeNull();
+  });
+
+  test("one provider → existence fn", async () => {
+    const registry = createRegistry([authFoundationFeature, existenceProvider("db")]);
+    const exists = await resolveTenantExistence({ db: fakeDb, registry });
+    expect(await exists?.("00000000-0000-4000-8000-000000000001")).toBe(true);
+  });
+});
+
+describe("validateTenantResolverMultiplicity", () => {
+  test("0 providers → no throw", () => {
+    const registry = createRegistry([authFoundationFeature]);
+    expect(() => validateTenantResolverMultiplicity([...registry.features.values()])).not.toThrow();
+  });
+
+  test("1 provider → no throw", () => {
+    const registry = createRegistry([authFoundationFeature, resolverProvider("a")]);
+    expect(() => validateTenantResolverMultiplicity([...registry.features.values()])).not.toThrow();
+  });
+
+  test("≥2 providers → throws", () => {
+    const registry = createRegistry([
+      authFoundationFeature,
+      resolverProvider("a"),
+      resolverProvider("b"),
+    ]);
+    expect(() => validateTenantResolverMultiplicity([...registry.features.values()])).toThrow(
+      /2 tenantResolver providers/,
+    );
+  });
+
+  test("malformed (no trust) → throws", () => {
+    const broken = defineFeature("mock-broken-resolver", (r) => {
+      r.useExtension(EXT_TENANT_RESOLVER, "broken", { build: () => () => null });
+    });
+    const registry = createRegistry([authFoundationFeature, broken]);
+    expect(() => validateTenantResolverMultiplicity([...registry.features.values()])).toThrow(
+      /without a valid TenantResolverProvider/,
+    );
+  });
+});
+
+describe("validateTenantExistenceMultiplicity", () => {
+  test("0 providers → no throw", () => {
+    const registry = createRegistry([authFoundationFeature]);
+    expect(() =>
+      validateTenantExistenceMultiplicity([...registry.features.values()]),
+    ).not.toThrow();
+  });
+
+  test("≥2 providers → throws", () => {
+    const registry = createRegistry([
+      authFoundationFeature,
+      existenceProvider("a"),
+      existenceProvider("b"),
+    ]);
+    expect(() => validateTenantExistenceMultiplicity([...registry.features.values()])).toThrow(
+      /2 tenantExistence providers/,
+    );
+  });
+});
+
+describe("resolveAnonymousAccessFromRegistry — fail-closed trust", () => {
+  test("inline tenantResolver without resolverTrust throws", async () => {
+    const registry = createRegistry([authFoundationFeature]);
+    await expect(
+      resolveAnonymousAccessFromRegistry(
+        {
+          tenantResolver: () => "00000000-0000-4000-8000-000000000001" as TenantId,
+        },
+        { db: fakeDb, registry },
+      ),
+    ).rejects.toThrow(/resolverTrust/);
+  });
+});

package/src/auth-foundation/boot-checks.ts

@@ -13,9 +13,13 @@
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import {
   EXT_SESSION_STORE,
+  EXT_TENANT_EXISTENCE,
+  EXT_TENANT_RESOLVER,
   EXT_TOKEN_VERIFIER,
   isAuthProviderPlugin,
   isSessionStoreProvider,
+  isTenantExistenceProvider,
+  isTenantResolverProvider,
   tokenShapeKey,
 } from "./types";
 
@@ -89,3 +93,53 @@ export function validateSessionStoreMultiplicity(features: readonly FeatureDefin
     );
   }
 }
+
+// Optional single-provider (#1373). Zero registrations = OK (single-tenant /
+// header-cookie path). ≥2 or malformed = boot fail.
+export function validateTenantResolverMultiplicity(features: readonly FeatureDefinition[]): void {
+  const names: string[] = [];
+
+  for (const feature of features) {
+    for (const usage of feature.extensionUsages) {
+      if (usage.extensionName !== EXT_TENANT_RESOLVER) continue;
+      if (!isTenantResolverProvider(usage.options)) {
+        throw new Error(
+          `[auth-foundation] tenantResolver provider "${usage.entityName}" (feature "${feature.name}") ` +
+            `registered without a valid TenantResolverProvider — options must have { trust, build }.`,
+        );
+      }
+      names.push(usage.entityName);
+    }
+  }
+
+  if (names.length >= 2) {
+    throw new Error(
+      `[auth-foundation] ${names.length} tenantResolver providers registered (${names.join(", ")}) — ` +
+        `only one tenantResolver provider may be mounted at a time.`,
+    );
+  }
+}
+
+export function validateTenantExistenceMultiplicity(features: readonly FeatureDefinition[]): void {
+  const names: string[] = [];
+
+  for (const feature of features) {
+    for (const usage of feature.extensionUsages) {
+      if (usage.extensionName !== EXT_TENANT_EXISTENCE) continue;
+      if (!isTenantExistenceProvider(usage.options)) {
+        throw new Error(
+          `[auth-foundation] tenantExistence provider "${usage.entityName}" (feature "${feature.name}") ` +
+            `registered without a valid TenantExistenceProvider — options must have a { build } shape.`,
+        );
+      }
+      names.push(usage.entityName);
+    }
+  }
+
+  if (names.length >= 2) {
+    throw new Error(
+      `[auth-foundation] ${names.length} tenantExistence providers registered (${names.join(", ")}) — ` +
+        `only one tenantExistence provider may be mounted at a time.`,
+    );
+  }
+}

package/src/auth-foundation/feature.ts

@@ -1,41 +1,52 @@
 // kumiko-feature-version: 1
 //
-// auth-foundation — declares the `tokenVerifier` extension point for Bearer-
-// token verification. Provider-features (auth-provider-jwt, auth-provider-
-// pat, ...) register via `r.useExtension(EXT_TOKEN_VERIFIER, "<name>", plugin)`.
+// auth-foundation — declares auth-middleware extension points:
+//   - tokenVerifier (multi, shape-routed)
+//   - sessionStore (single, required when foundation mounts)
+//   - tenantResolver (single, optional)
+//   - tenantExistence (single, optional)
 //
-// **Scaffold only:** not wired into `api/auth-middleware.ts` yet —
-// personal-access-tokens still uses its own direct `patResolver` callback
-// (kumiko-framework#745). A future issue migrates the middleware onto this
-// extension point; #1368 only lays the groundwork (PAT-Plan-Doc Phase-1-
-// Sub-Step-1).
-//
-// **Pattern precedent:** file-foundation/mail-foundation for the extension-
-// point + plugin-registry shape. Diverges on ROUTING: those pick one active
-// provider per tenant via a config-key; auth-foundation has no tenant yet
-// at verify-time, so providers are tried in shape-match order instead (see
-// types.ts).
+// Provider-features register via `r.useExtension(EXT_*, "<name>", plugin)`.
+// Middleware / runProdApp resolve providers from the registry at boot
+// (tokenVerifier/sessionStore) or request-time (tokenVerifier shape match).
 
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { defineFeature, type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import { validateSessionStoreMultiplicity, validateTokenVerifierMultiplicity } from "./boot-checks";
+import {
+  validateSessionStoreMultiplicity,
+  validateTenantExistenceMultiplicity,
+  validateTenantResolverMultiplicity,
+  validateTokenVerifierMultiplicity,
+} from "./boot-checks";
 import {
   type AuthProviderBuildDeps,
   EXT_SESSION_STORE,
+  EXT_TENANT_EXISTENCE,
+  EXT_TENANT_RESOLVER,
   EXT_TOKEN_VERIFIER,
   isAuthProviderPlugin,
   isSessionStoreProvider,
+  isTenantExistenceProvider,
+  isTenantResolverProvider,
   type SessionStore,
+  type TenantExistsFn,
+  type TenantResolverFn,
+  type TenantResolverTrust,
   tokenShapeMatches,
 } from "./types";
 
-export { EXT_SESSION_STORE, EXT_TOKEN_VERIFIER } from "./types";
+export {
+  EXT_SESSION_STORE,
+  EXT_TENANT_EXISTENCE,
+  EXT_TENANT_RESOLVER,
+  EXT_TOKEN_VERIFIER,
+} from "./types";
 
 const FEATURE_NAME = "auth-foundation";
 
 export const authFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
   r.describe(
-    "Declares the `tokenVerifier` (Bearer-token auth) and `sessionStore` extension points. Provider-features register a static `shape` plus a `build()` for tokenVerifier — mount together with at least one auth-provider-* feature (e.g. personal-access-tokens) and call `resolveTokenVerifier(deps, rawToken)` to find the matching one; sessions self-registers as the single sessionStore provider.",
+    "Declares auth-middleware extension points: `tokenVerifier` (Bearer), `sessionStore` (revocable JWT sid), optional `tenantResolver` + `tenantExistence` for anonymous multi-tenant. Provider-features register via r.useExtension; mount auth-foundation with the matching provider features.",
   );
   r.uiHints({
     displayLabel: "Auth Provider Foundation",
@@ -49,19 +60,28 @@ export const authFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
       // resolveTokenVerifier looks it up at request-time.
     },
   });
-
-  // Owns EXT_TOKEN_VERIFIER, so its own mount is the trigger — same
-  // convention as tenant-lifecycle/user-data-rights' self-bootCheck.
   r.bootCheck(({ features }) => validateTokenVerifierMultiplicity(features));
 
   r.extendsRegistrar(EXT_SESSION_STORE, {
     onRegister: () => {
-      // No side-effects at register-time — registry stores the usage,
-      // resolveSessionStore looks it up at request-time.
+      // No side-effects at register-time — resolveSessionStore at boot/request.
     },
   });
-
   r.bootCheck(({ features }) => validateSessionStoreMultiplicity(features));
+
+  r.extendsRegistrar(EXT_TENANT_RESOLVER, {
+    onRegister: () => {
+      // Optional — zero providers is fine (single-tenant / header-cookie).
+    },
+  });
+  r.bootCheck(({ features }) => validateTenantResolverMultiplicity(features));
+
+  r.extendsRegistrar(EXT_TENANT_EXISTENCE, {
+    onRegister: () => {
+      // Optional — zero providers skips the existence check.
+    },
+  });
+  r.bootCheck(({ features }) => validateTenantExistenceMultiplicity(features));
 });
 
 /**
@@ -101,3 +121,37 @@ export async function resolveSessionStore(
   }
   return usage.options.build(deps);
 }
+
+export type ResolvedTenantResolver = {
+  readonly resolve: TenantResolverFn;
+  readonly trust: TenantResolverTrust;
+};
+
+/** Optional tenantResolver — null when no provider registered. */
+export async function resolveTenantResolver(
+  deps: AuthProviderBuildDeps & { readonly registry: Registry },
+): Promise<ResolvedTenantResolver | null> {
+  const usage = deps.registry.getExtensionUsages(EXT_TENANT_RESOLVER)[0];
+  if (!usage) return null;
+  if (!isTenantResolverProvider(usage.options)) {
+    throw new Error(
+      "[auth-foundation] tenantResolver provider registered without a valid TenantResolverProvider",
+    );
+  }
+  const resolve = await usage.options.build(deps);
+  return { resolve, trust: usage.options.trust };
+}
+
+/** Optional tenantExistence — null when no provider registered. */
+export async function resolveTenantExistence(
+  deps: AuthProviderBuildDeps & { readonly registry: Registry },
+): Promise<TenantExistsFn | null> {
+  const usage = deps.registry.getExtensionUsages(EXT_TENANT_EXISTENCE)[0];
+  if (!usage) return null;
+  if (!isTenantExistenceProvider(usage.options)) {
+    throw new Error(
+      "[auth-foundation] tenantExistence provider registered without a valid TenantExistenceProvider",
+    );
+  }
+  return usage.options.build(deps);
+}

package/src/auth-foundation/index.ts

@@ -2,21 +2,35 @@
 
 export {
   authFoundationFeature,
+  type ResolvedTenantResolver,
   resolveSessionStore,
+  resolveTenantExistence,
+  resolveTenantResolver,
   resolveTokenVerifier,
 } from "./feature";
+export { resolveAnonymousAccessFromRegistry } from "./resolve-anonymous-access";
 export {
   type AuthProviderBuildDeps,
   type AuthProviderPlugin,
   type AuthVerifier,
   EXT_SESSION_STORE,
+  EXT_TENANT_EXISTENCE,
+  EXT_TENANT_RESOLVER,
   EXT_TOKEN_VERIFIER,
   isAuthProviderPlugin,
   isSessionStoreProvider,
+  isTenantExistenceProvider,
+  isTenantResolverProvider,
+  isTenantResolverTrust,
   isValidTokenShape,
   type SessionMassRevoker,
   type SessionStore,
   type SessionStoreProvider,
+  type TenantExistenceProvider,
+  type TenantExistsFn,
+  type TenantResolverFn,
+  type TenantResolverProvider,
+  type TenantResolverTrust,
   type TokenShape,
   tokenShapeKey,
   tokenShapeMatches,

package/src/auth-foundation/resolve-anonymous-access.ts

@@ -0,0 +1,54 @@
+/**
+ * Merge app-facing AnonymousAccessConfig with auth-foundation tenant providers.
+ * Providers win over any leftover callback fields (hard cutover #1374).
+ * Test stacks may still pass Resolved callbacks when no provider is mounted.
+ */
+import type {
+  AnonymousAccessConfig,
+  AnonymousAccessResolved,
+  TenantExists,
+  TenantResolver,
+} from "@cosmicdrift/kumiko-framework/api";
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { resolveTenantExistence, resolveTenantResolver } from "./feature";
+import type { AuthProviderBuildDeps } from "./types";
+
+export async function resolveAnonymousAccessFromRegistry(
+  base: AnonymousAccessResolved | AnonymousAccessConfig | undefined,
+  deps: AuthProviderBuildDeps & { readonly registry: Registry },
+): Promise<AnonymousAccessResolved | undefined> {
+  const [tenantResolver, tenantExists] = await Promise.all([
+    resolveTenantResolver(deps),
+    resolveTenantExistence(deps),
+  ]);
+
+  if (!base && !tenantResolver && !tenantExists) return undefined;
+
+  // Fail-closed (#1374 security): inline tenantResolver without trust is the
+  // old ambiguous config — providers always carry trust; test stacks must too.
+  if (
+    !tenantResolver &&
+    base &&
+    "tenantResolver" in base &&
+    base.tenantResolver !== undefined &&
+    base.resolverTrust === undefined
+  ) {
+    throw new Error(
+      "[auth-foundation] anonymousAccess.tenantResolver is set without resolverTrust — " +
+        'declare "authoritative" or "fallback-only" (or mount an EXT_TENANT_RESOLVER provider).',
+    );
+  }
+
+  // Providers win (#1374). When none are mounted, keep any test-injected
+  // Resolved callbacks so framework middleware suites stay self-contained.
+  return {
+    ...(base ?? {}),
+    ...(tenantResolver
+      ? {
+          tenantResolver: tenantResolver.resolve as TenantResolver,
+          resolverTrust: tenantResolver.trust,
+        }
+      : {}),
+    ...(tenantExists ? { tenantExists: tenantExists as TenantExists } : {}),
+  };
+}

package/src/auth-foundation/types.ts

@@ -86,11 +86,18 @@ export const EXT_SESSION_STORE = "sessionStore";
 /** Mass-revoke every live session for a user. Used by password-change and "sign out everywhere". */
 export type SessionMassRevoker = (userId: string) => Promise<number>;
 
+/** Keep current sid (if any); revoke every other live session. Used by auth-mfa. */
+export type SessionRevokeAllOthers = (
+  userId: string,
+  currentSid: string | undefined,
+) => Promise<number>;
+
 export type SessionStore = {
   readonly creator: SessionCreator;
   readonly revoker: SessionRevoker;
   readonly checker: SessionChecker;
   readonly massRevoker: SessionMassRevoker;
+  readonly revokeAllOthers: SessionRevokeAllOthers;
 };
 
 export type SessionStoreProvider = {
@@ -105,3 +112,59 @@ export function isSessionStoreProvider(o: unknown): o is SessionStoreProvider {
     typeof (o as { build: unknown }).build === "function"
   );
 }
+
+// Tenant-resolution extension points (#1373). Both are single-provider and
+// optional — zero registered means today's single-tenant / header-cookie
+// path (no subdomain resolver, no existence check). ≥2 fails boot.
+
+export const EXT_TENANT_RESOLVER = "tenantResolver";
+export const EXT_TENANT_EXISTENCE = "tenantExistence";
+
+/** Trust mode for a registered tenantResolver — mirrors AnonymousAccessConfig.resolverTrust. */
+export type TenantResolverTrust = "authoritative" | "fallback-only";
+
+/**
+ * Resolves the tenant for an unauthenticated request. Return null when no
+ * tenant can be determined — middleware rejects with 400. Throw only on
+ * infrastructure failures.
+ */
+export type TenantResolverFn = (
+  // Hono Context — typed loosely so auth-foundation stays free of a hono dep.
+  // Callers cast at the boundary (same shape as framework TenantResolver).
+  c: unknown,
+) => Promise<string | null> | string | null;
+
+export type TenantExistsFn = (tenantId: string) => Promise<boolean> | boolean;
+
+export type TenantResolverProvider = {
+  readonly trust: TenantResolverTrust;
+  readonly build: (deps: AuthProviderBuildDeps) => Promise<TenantResolverFn> | TenantResolverFn;
+};
+
+export type TenantExistenceProvider = {
+  readonly build: (deps: AuthProviderBuildDeps) => Promise<TenantExistsFn> | TenantExistsFn;
+};
+
+export function isTenantResolverTrust(v: unknown): v is TenantResolverTrust {
+  return v === "authoritative" || v === "fallback-only";
+}
+
+export function isTenantResolverProvider(o: unknown): o is TenantResolverProvider {
+  return (
+    typeof o === "object" &&
+    o !== null &&
+    "build" in o &&
+    typeof (o as { build: unknown }).build === "function" &&
+    "trust" in o &&
+    isTenantResolverTrust((o as { trust: unknown }).trust)
+  );
+}
+
+export function isTenantExistenceProvider(o: unknown): o is TenantExistenceProvider {
+  return (
+    typeof o === "object" &&
+    o !== null &&
+    "build" in o &&
+    typeof (o as { build: unknown }).build === "function"
+  );
+}

package/src/auth-mfa/__tests__/mfa-preauth-setup-token.test.ts

@@ -0,0 +1,87 @@
+import { describe, expect, test } from "bun:test";
+import { Temporal } from "temporal-polyfill";
+import { signMfaPreauthSetupToken, verifyMfaPreauthSetupToken } from "../mfa-preauth-setup-token";
+
+const SECRET = "test-mfa-preauth-setup-secret-at-least-32-bytes!!";
+const USER_ID = "11111111-1111-4111-8111-111111111111";
+const TENANT_ID = "22222222-2222-4222-8222-222222222222";
+
+describe("mfa-preauth-setup-token", () => {
+  test("round-trip: sign → verify → payload", () => {
+    const { token } = signMfaPreauthSetupToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+    );
+    const result = verifyMfaPreauthSetupToken(token, SECRET);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.payload).toEqual({ userId: USER_ID, tenantId: TENANT_ID });
+    }
+  });
+
+  test("cross-domain replay from a challenge-shaped signature is rejected", () => {
+    const { token } = signMfaPreauthSetupToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+    );
+    const [bodyB64] = token.split(".");
+    const forged = `${bodyB64}.${Buffer.from("not-the-real-signature-bytes").toString("base64url")}`;
+    expect(verifyMfaPreauthSetupToken(forged, SECRET)).toEqual({
+      ok: false,
+      reason: "bad_signature",
+    });
+  });
+
+  test("tampered signature → bad_signature", () => {
+    const { token } = signMfaPreauthSetupToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+    );
+    const tampered = `${token.slice(0, -3)}XXX`;
+    expect(verifyMfaPreauthSetupToken(tampered, SECRET)).toEqual({
+      ok: false,
+      reason: "bad_signature",
+    });
+  });
+
+  test("different secret → bad_signature", () => {
+    const { token } = signMfaPreauthSetupToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+    );
+    expect(verifyMfaPreauthSetupToken(token, "other-secret-not-the-same-one!!!!")).toEqual({
+      ok: false,
+      reason: "bad_signature",
+    });
+  });
+
+  test("expired → expired", () => {
+    const t0 = Temporal.Instant.fromEpochMilliseconds(1_700_000_000_000);
+    const laterThanTtl = t0.add({ minutes: 11 });
+    const { token } = signMfaPreauthSetupToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+      t0,
+    );
+    expect(verifyMfaPreauthSetupToken(token, SECRET, laterThanTtl)).toEqual({
+      ok: false,
+      reason: "expired",
+    });
+  });
+
+  test("malformed: wrong part count", () => {
+    expect(verifyMfaPreauthSetupToken("not-a-token", SECRET)).toEqual({
+      ok: false,
+      reason: "malformed",
+    });
+    expect(verifyMfaPreauthSetupToken("a.b.c", SECRET)).toEqual({
+      ok: false,
+      reason: "malformed",
+    });
+  });
+});

package/src/auth-mfa/constants.ts

@@ -34,6 +34,7 @@ export const AuthMfaErrorCodes = {
 
 export const MFA_SETUP_TOKEN_TTL_MINUTES = 10;
 export const MFA_CHALLENGE_TOKEN_TTL_MINUTES = 10;
+export const MFA_PREAUTH_SETUP_TOKEN_TTL_MINUTES = 10;
 export const MFA_VERIFY_MAX_ATTEMPTS = 5;
 export const MFA_VERIFY_LOCKOUT_MINUTES = 5;
 

package/src/auth-mfa/mfa-preauth-setup-token.ts

@@ -0,0 +1,86 @@
+// HMAC-signed token minted by login.write.ts when enforcement policy blocks
+// an unenrolled user (mfa-setup-required) — proves the password check
+// already succeeded, so a later pre-auth enable-start variant (#1231) can
+// let the user enroll without a full session. No secret material (unlike
+// mfa-setup-token.ts) — just enough to look the user back up.
+//
+// Same domain-separated HMAC shape as mfa-challenge-token.ts, distinct
+// signing string so this can never be replayed as a login challenge or
+// vice versa. Reuses challengeTokenSecret rather than adding a third
+// feature secret: both tokens assert the identical trust boundary
+// ("password already verified, short-lived follow-up allowed").
+import { createHmac, timingSafeEqual } from "node:crypto";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { Temporal } from "temporal-polyfill";
+
+export type MfaPreauthSetupPayload = {
+  readonly userId: string;
+  readonly tenantId: TenantId;
+};
+
+type EncodedBody = MfaPreauthSetupPayload & { readonly expiresAtMs: number };
+
+function sign(input: string, secret: string): string {
+  return createHmac("sha256", secret).update(input).digest("base64url");
+}
+
+export function signMfaPreauthSetupToken(
+  payload: MfaPreauthSetupPayload,
+  ttlMinutes: number,
+  secret: string,
+  now: Temporal.Instant = Temporal.Now.instant(),
+): { token: string; expiresAt: Temporal.Instant } {
+  const expiresAt = now.add({ minutes: ttlMinutes });
+  const body: EncodedBody = { ...payload, expiresAtMs: expiresAt.epochMilliseconds };
+  const bodyB64 = Buffer.from(JSON.stringify(body)).toString("base64url");
+  const signature = sign(`mfa-preauth-setup:${bodyB64}`, secret);
+  return { token: `${bodyB64}.${signature}`, expiresAt };
+}
+
+export type VerifyMfaPreauthSetupResult =
+  | { readonly ok: true; readonly payload: MfaPreauthSetupPayload; readonly expiresAtMs: number }
+  | { readonly ok: false; readonly reason: "malformed" | "bad_signature" | "expired" };
+
+function isEncodedBody(value: unknown): value is EncodedBody {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value as Record<string, unknown>;
+  return (
+    typeof v["userId"] === "string" &&
+    typeof v["tenantId"] === "string" &&
+    typeof v["expiresAtMs"] === "number"
+  );
+}
+
+export function verifyMfaPreauthSetupToken(
+  token: string,
+  secret: string,
+  now: Temporal.Instant = Temporal.Now.instant(),
+): VerifyMfaPreauthSetupResult {
+  const parts = token.split(".");
+  if (parts.length !== 2) return { ok: false, reason: "malformed" };
+  const [bodyB64, providedSig] = parts;
+  if (!bodyB64 || !providedSig) return { ok: false, reason: "malformed" };
+
+  const expected = sign(`mfa-preauth-setup:${bodyB64}`, secret);
+  const expectedBuf = Buffer.from(expected, "base64url");
+  const providedBuf = Buffer.from(providedSig, "base64url");
+  if (expectedBuf.length !== providedBuf.length) return { ok: false, reason: "bad_signature" };
+  if (!timingSafeEqual(expectedBuf, providedBuf)) return { ok: false, reason: "bad_signature" };
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(Buffer.from(bodyB64, "base64url").toString("utf8"));
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  if (!isEncodedBody(parsed)) return { ok: false, reason: "malformed" };
+
+  if (
+    Temporal.Instant.compare(now, Temporal.Instant.fromEpochMilliseconds(parsed.expiresAtMs)) > 0
+  ) {
+    return { ok: false, reason: "expired" };
+  }
+
+  const { expiresAtMs, ...payload } = parsed;
+  return { ok: true, payload, expiresAtMs };
+}

package/src/auth-mfa/mfa-status-checker.ts

@@ -6,9 +6,10 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { type MfaRequiredPolicy, mfaRequiredConfigHandle, mfaRequiredConfigKey } from "./config";
-import { MFA_CHALLENGE_TOKEN_TTL_MINUTES } from "./constants";
+import { MFA_CHALLENGE_TOKEN_TTL_MINUTES, MFA_PREAUTH_SETUP_TOKEN_TTL_MINUTES } from "./constants";
 import { findUserMfaRow } from "./db/queries";
 import { signMfaChallengeToken } from "./mfa-challenge-token";
+import { signMfaPreauthSetupToken } from "./mfa-preauth-setup-token";
 
 export type MfaStatusCheckResult =
   | { readonly required: false }
@@ -17,7 +18,7 @@ export type MfaStatusCheckResult =
   // yet. Distinct from `required: true` (which means "enrolled, prove it
   // now") — see config.ts's ponytail note on why this hard-blocks login
   // with no in-band recovery until PR3's enrollment-during-login UI ships.
-  | { readonly setupRequired: true };
+  | { readonly setupRequired: true; readonly preauthSetupToken: string };
 
 // Consumed by auth-email-password's login.write.ts via `mfaStatusChecker`
 // (a generic callback type declared THERE, not here — auth-email-password
@@ -67,9 +68,17 @@ export function createMfaStatusChecker(opts: {
       scopedDb,
     )) ?? "optional") as MfaRequiredPolicy | "optional";
     if (policy === "optional") return { required: false };
-    if (policy === "all") return { setupRequired: true };
+    const buildSetupToken = (): string =>
+      signMfaPreauthSetupToken(
+        { userId, tenantId },
+        MFA_PREAUTH_SETUP_TOKEN_TTL_MINUTES,
+        opts.challengeTokenSecret,
+      ).token;
+    if (policy === "all") return { setupRequired: true, preauthSetupToken: buildSetupToken() };
     // policy === "admins"
     const isAdmin = roles.some((role) => access.admin.includes(role));
-    return isAdmin ? { setupRequired: true } : { required: false };
+    return isAdmin
+      ? { setupRequired: true, preauthSetupToken: buildSetupToken() }
+      : { required: false };
   };
 }

package/src/sessions/feature.ts

@@ -42,6 +42,9 @@ export type SessionsFeatureOptions = {
   // only to supply a custom revoker — an explicit value wins over the
   // runtime binding.
   readonly autoRevokeOnPasswordChange?: SessionMassRevoker;
+  // Session JWT / store_user_sessions TTL. Was previously auth.sessions.expiresInMs
+  // (#1372) — lives on the sessions feature now that sessionStore is the wiring.
+  readonly expiresInMs?: number;
 };
 
 export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
@@ -120,12 +123,16 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // via resolveSessionStore().
     r.useExtension(EXT_SESSION_STORE, "default", {
       build: (deps): SessionStore => {
-        const callbacks = createSessionCallbacks({ db: deps.db });
+        const callbacks = createSessionCallbacks({
+          db: deps.db,
+          ...(options?.expiresInMs !== undefined && { expiresInMs: options.expiresInMs }),
+        });
         return {
           creator: callbacks.sessionCreator,
           revoker: callbacks.sessionRevoker,
           checker: callbacks.sessionChecker,
           massRevoker: callbacks.sessionMassRevoker,
+          revokeAllOthers: callbacks.sessionRevokeAllOthers,
         };
       },
     } satisfies SessionStoreProvider);