@cosmicdrift/kumiko-bundled-features 0.165.0 → 2.0.0

package/src/inbound-mail-foundation/handlers/ingest-message.write.ts

@@ -235,20 +235,30 @@ export const ingestMessageHandler: WriteHandlerDef = {
     //    on the same thread (Watch-Push vs. Poll-Reconciliation overlap,
     //    or two different messages of the same thread arriving at once)
     //    can both read the same stream version before either commits.
-    //    tryAppendEvent's fresh version-read at append time then makes
-    //    the loser's append fail with a VersionConflictError instead of
-    //    silently succeeding — so we retry: reload the thread stream,
-    //    recompute the live row-count and lastMessageAt, and append
-    //    again. Unlike step 4, a lost race here must NOT be treated as a
-    //    no-op duplicate — skipping would leave this message's
-    //    contribution to messageCount/lastMessageAt out of the thread
-    //    forever. Exhausting all attempts throws, rolling back the whole
-    //    TX (including the step-4 message append) for a clean re-ingest
-    //    on the next poll — never return success with a stale snapshot.
+    //    tryAppendEvent's fresh version-read at append time makes the
+    //    loser's append fail with a VersionConflictError ONLY when the
+    //    other TX's commit lands between this reload and the append's own
+    //    version check — so we retry: reload the thread stream, recompute
+    //    the live row-count and lastMessageAt, and append again. If the
+    //    other TX instead commits in the gap between the countWhere below
+    //    and the append's version-read, the version check sees the
+    //    already-bumped stream and appends without conflict — but with the
+    //    stale row-count this countWhere captured before the concurrent
+    //    insert. That write still lands (messageCount can undercount by
+    //    one round), it is not eliminated by this retry loop; the next
+    //    ingest on the thread re-counts and self-corrects. Unlike step 4,
+    //    a lost version-conflict race here must NOT be treated as a no-op
+    //    duplicate — skipping would leave this message's contribution to
+    //    messageCount/lastMessageAt out of the thread forever. Exhausting
+    //    all attempts throws, rolling back the whole TX (including the
+    //    step-4 message append) for a clean re-ingest on the next poll —
+    //    never return success with a stale snapshot.
     //
     //    A true race-free read+append (e.g. SELECT ... FOR UPDATE or an
-    //    advisory lock on threadAggId) is deliberately not part of this
-    //    fix — two writers (watch + poll) make bounded retry sufficient.
+    //    advisory lock on threadAggId) would close the countWhere→append
+    //    gap above and is deliberately not part of this fix — two writers
+    //    (watch + poll) make self-correcting drift an acceptable trade for
+    //    now.
     // ---------------------------------------------------------------
     const threadPlainPii = { tenantId, subject: payload.subject };
     const encryptedThreadFields = piiKms

package/src/inbound-provider-imap/__tests__/imap-live.integration.test.ts

@@ -202,5 +202,5 @@ describeInboundMailProviderContract(
     account,
     seed: (subject) => sendTestMail(subject, "contract seed"),
   }),
-  { skip: !available },
+  { skip: !available, hasWatch: Boolean(imapInboundMailPlugin.watch), timeout: 20_000 },
 );

package/src/inbound-provider-imap/__tests__/plugin-mocked.test.ts

@@ -2,7 +2,7 @@
 // Greenmail suites skip in CI when the container is down — this file mocks
 // imapflow so the plugin body stays on the coverage badge without Docker.
 
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 import { EventEmitter } from "node:events";
 import { createSecret } from "@cosmicdrift/kumiko-framework/secrets";
 import {
@@ -110,17 +110,27 @@ class FakeImapFlow extends EventEmitter {
   }
 }
 
+// Restore hygiene: Bun runs a test-run's files in one process, so a
+// top-level mock.module leaks into every file that runs after this one. The
+// real module is captured before mocking so afterAll can put it back — a
+// later file that needs the real imapflow (or a filtered/reordered run via
+// `-t`) would otherwise silently see FakeImapFlow instead.
+const realImapflow = await import("imapflow");
 mock.module("imapflow", () => ({ ImapFlow: FakeImapFlow }));
 
 const { imapInboundMailPlugin } = await import("../feature");
 
+afterAll(() => {
+  mock.module("imapflow", () => realImapflow);
+});
+
 function mime(subject: string, text: string): Buffer {
   return Buffer.from(
     [
       "From: Sender <sender@example.com>",
       "To: inbox@example.com",
       `Subject: ${subject}`,
-      "Message-ID: <msg-1@example.com>",
+      `Message-ID: <${subject}-@example.com>`,
       "Date: Mon, 01 Jan 2024 12:00:00 +0000",
       "MIME-Version: 1.0",
       "Content-Type: text/plain; charset=utf-8",
@@ -142,6 +152,13 @@ const account: MailAccountRecord = {
   watchState: "idle",
 };
 
+async function waitFor(predicate: () => boolean, timeoutMs = 2000): Promise<void> {
+  const t0 = Date.now();
+  while (!predicate() && Date.now() - t0 < timeoutMs) {
+    await Bun.sleep(5);
+  }
+}
+
 function ctxWithDoc(doc: string | null): InboundMailContext {
   return {
     _userId: "imap-plugin-mocked",
@@ -227,6 +244,11 @@ describe("imapInboundMailPlugin — mocked imapflow", () => {
     expect(result.messages[0]?.subject).toBe("one");
     expect(result.nextCursor).toEqual({ uidValidity: "17", lastUid: 2 });
     expect(result.hasMore).toBe(false);
+    // Fixtures must carry distinct Message-ID headers — colliding fixtures
+    // would mask a mapping bug where toRawInboundMessage produces a
+    // wrong/constant messageIdHeader per batch (used for the References/
+    // threading chain and the self-heal dedup fallback).
+    expect(new Set(result.messages.map((m) => m.messageIdHeader)).size).toBe(2);
   });
 
   test("fetch: incremental cursor filters uid <= lastUid + hasMore via maxMessages", async () => {
@@ -254,10 +276,11 @@ describe("imapInboundMailPlugin — mocked imapflow", () => {
       { uidValidity: "17", lastUid: 1 },
       { backfillWindowDays: 7, maxMessages: 2 },
     );
-    // search returns 2,3,4 (> lastUid=1); maxMessages=2 → hasMore
-    expect(result.messages.length).toBeLessThanOrEqual(2);
+    // search returns 2,3,4 (> lastUid=1); maxMessages=2 → hasMore, uid 1
+    // filtered out and only the first 2 of the 3 remaining survive the cap.
+    expect(result.messages.map((m) => m.subject)).toEqual(["two", "three"]);
     expect(result.hasMore).toBe(true);
-    expect(result.nextCursor["uidValidity"]).toBe("17");
+    expect(result.nextCursor).toEqual({ uidValidity: "17", lastUid: 3 });
   });
 
   test("fetch: UIDVALIDITY change → InboundCursorInvalidError", async () => {
@@ -307,7 +330,9 @@ describe("imapInboundMailPlugin — mocked imapflow", () => {
     ];
     lastIdleClient?.emit("exists");
 
-    await Bun.sleep(50);
+    // drainNew() does MIME-parsing before onMessages fires — a fixed sleep
+    // flakes on a loaded CI runner; poll instead.
+    await waitFor(() => received.some((batch) => batch.some((m) => m.subject === "pushed")));
     expect(received.some((batch) => batch.some((m) => m.subject === "pushed"))).toBe(true);
 
     await stop();
@@ -322,9 +347,11 @@ describe("imapInboundMailPlugin — mocked imapflow", () => {
       },
     });
     lastIdleClient?.emit("error", new Error("socket hang up"));
-    await Bun.sleep(20);
+    await waitFor(() => errors >= 1);
     lastIdleClient?.emit("error", new Error("second"));
-    await Bun.sleep(20);
+    // Confirms onError stays unsubscribed after the first error — polls the
+    // same bounded window rather than betting on a fixed sleep outlasting it.
+    await waitFor(() => errors >= 2, 100);
     expect(errors).toBe(1);
     await stop().catch(() => {});
   });

package/src/inbound-provider-inmemory/__tests__/feature.test.ts

@@ -13,36 +13,40 @@ describe("inboundProviderInMemoryFeature — shape", () => {
   });
 });
 
-describeInboundMailProviderContract("inmemory", () => {
-  const accountId = crypto.randomUUID();
-  return {
-    plugin: inMemoryInboundMailPlugin,
-    ctx: {},
-    account: {
-      id: accountId,
-      tenantId: "00000000-0000-4000-8000-000000004242",
-      provider: "inmemory",
-      authMethod: "password",
-      ownerUserId: null,
-      address: "contract@example.com",
-      displayName: "Contract-Test",
-      status: "active",
-      watchState: "idle",
-    },
-    seed: (subject) =>
-      seedInboundMessage(accountId, {
-        providerMessageId: crypto.randomUUID(),
-        messageIdHeader: null,
-        providerThreadId: null,
-        references: [],
-        from: "sender@example.com",
-        to: ["contract@example.com"],
-        cc: [],
-        subject,
-        snippet: subject,
-        receivedAtIso: "2026-07-01T10:00:00Z",
-        rawMime: null,
-        scope: "inbox",
-      }),
-  };
-});
+describeInboundMailProviderContract(
+  "inmemory",
+  () => {
+    const accountId = crypto.randomUUID();
+    return {
+      plugin: inMemoryInboundMailPlugin,
+      ctx: {},
+      account: {
+        id: accountId,
+        tenantId: "00000000-0000-4000-8000-000000004242",
+        provider: "inmemory",
+        authMethod: "password",
+        ownerUserId: null,
+        address: "contract@example.com",
+        displayName: "Contract-Test",
+        status: "active",
+        watchState: "idle",
+      },
+      seed: (subject) =>
+        seedInboundMessage(accountId, {
+          providerMessageId: crypto.randomUUID(),
+          messageIdHeader: null,
+          providerThreadId: null,
+          references: [],
+          from: "sender@example.com",
+          to: ["contract@example.com"],
+          cc: [],
+          subject,
+          snippet: subject,
+          receivedAtIso: "2026-07-01T10:00:00Z",
+          rawMime: null,
+          scope: "inbox",
+        }),
+    };
+  },
+  { hasWatch: Boolean(inMemoryInboundMailPlugin.watch) },
+);

package/src/jobs/__tests__/job-instant.test.ts

@@ -0,0 +1,15 @@
+// kumiko-framework#1525: parseJobInstant is the extracted seam for the five
+// value-position Temporal.Instant.from call sites inside feature.ts's
+// defineApply callbacks (no exported seam there) — must not rely on
+// globalThis.Temporal.
+
+import { describe, expect, test } from "bun:test";
+import { withoutAmbientTemporal } from "@cosmicdrift/kumiko-framework/testing";
+import { parseJobInstant } from "../job-instant";
+
+describe("parseJobInstant — kumiko-framework#1525: no ambient Temporal global", () => {
+  test("parses an ISO instant without relying on globalThis.Temporal", async () => {
+    const instant = await withoutAmbientTemporal(() => parseJobInstant("2026-01-01T00:00:00Z"));
+    expect(instant.toString()).toBe("2026-01-01T00:00:00Z");
+  });
+});

package/src/jobs/__tests__/reindex-entity-job.integration.test.ts

@@ -92,10 +92,16 @@ describe("reindexEntityJob", () => {
     });
     expect(preResults).toHaveLength(0);
 
-    await reindexEntityJob(
-      { entity: "widget" },
-      { db: stack.db, registry: stack.registry, searchAdapter: stack.search, systemUser: admin },
-    );
+    const ctx: JobContext = {
+      db: stack.db,
+      registry: stack.registry,
+      searchAdapter: stack.search,
+      systemUser: admin,
+      log: noopLogger,
+      triggeredBy: null,
+      ...bridgeStub(),
+    };
+    await reindexEntityJob({ entity: "widget" }, ctx);
 
     const postResults = await stack.search.search(admin.tenantId, "backfillable", {
       filterType: "widget",
@@ -103,11 +109,15 @@ describe("reindexEntityJob", () => {
     expect(postResults.some((r) => r.entityId === created.data.id)).toBe(true);
   });
 
-  test("the registered job handler resolves a systemUser-scoped fan-out run and actually indexes (not reindexEntityJob called directly)", async () => {
-    // The two direct-call tests above bypass jobRunner.dispatch()'s
-    // ctx-resolution/guard chain entirely — a bug there (e.g. a systemUser
-    // that isn't wired through) would be invisible to them. Invoke the
-    // ACTUAL registered handler, same as retention-cleanup's handler test.
+  test("the job is registered under REINDEX_ENTITY_JOB and its handler indexes", async () => {
+    // Honest scope: this still hand-builds JobContext (same as
+    // retention-cleanup's handler test) rather than going through
+    // jobRunner.dispatch() — it does NOT cover the dispatch chain's own
+    // ctx-resolution/guard logic, only that registry.getJob(REINDEX_ENTITY_JOB)
+    // resolves to a handler and that handler indexes correctly when called
+    // with a well-formed ctx. A bug in dispatch()'s ctx-resolution itself
+    // (e.g. a systemUser that isn't wired through) would be invisible here,
+    // same as in the two direct-call tests above.
     const executor = createEventStoreExecutor(widgetTable, widgetEntity, { entityName: "widget" });
     const tenantDb = createTenantDb(stack.db, admin.tenantId, "system");
     const created = await executor.create({ name: "Registry-Resolved Widget" }, admin, tenantDb);

package/src/jobs/feature.ts

@@ -21,6 +21,7 @@ import { reindexEntityJob, reindexEntityPayloadSchema } from "./handlers/reindex
 import { retryWrite } from "./handlers/retry.write";
 import { triggerWrite } from "./handlers/trigger.write";
 import { JOBS_I18N } from "./i18n";
+import { parseJobInstant } from "./job-instant";
 import {
   JOB_RUN_COMPLETED_EVENT,
   JOB_RUN_FAILED_EVENT,
@@ -78,7 +79,7 @@ export function createJobsFeature(): FeatureDefinition {
               status: p.status,
               payload: p.payload,
               attempt: p.attempt,
-              startedAt: Temporal.Instant.from(p.startedAt),
+              startedAt: parseJobInstant(p.startedAt),
               triggeredById: p.triggeredById,
             });
           },
@@ -92,7 +93,7 @@ export function createJobsFeature(): FeatureDefinition {
               {
                 status: "completed",
                 duration: p.duration,
-                finishedAt: Temporal.Instant.from(p.finishedAt),
+                finishedAt: parseJobInstant(p.finishedAt),
                 version: event.version,
                 modifiedAt: event.createdAt,
                 modifiedById: event.metadata?.userId ?? "system",
@@ -111,7 +112,7 @@ export function createJobsFeature(): FeatureDefinition {
                 status: "failed",
                 error: p.error,
                 duration: p.duration,
-                finishedAt: Temporal.Instant.from(p.finishedAt),
+                finishedAt: parseJobInstant(p.finishedAt),
                 version: event.version,
                 modifiedAt: event.createdAt,
                 modifiedById: event.metadata?.userId ?? "system",
@@ -145,7 +146,7 @@ export function createJobsFeature(): FeatureDefinition {
                 runId: event.aggregateId,
                 level: log.level,
                 message: log.message,
-                timestamp: Temporal.Instant.from(log.timestamp),
+                timestamp: parseJobInstant(log.timestamp),
               })),
             );
           },
@@ -161,7 +162,7 @@ export function createJobsFeature(): FeatureDefinition {
               runId: event.aggregateId,
               level: log.level,
               message: log.message,
-              timestamp: Temporal.Instant.from(log.timestamp),
+              timestamp: parseJobInstant(log.timestamp),
             })),
           );
         }),

package/src/jobs/job-instant.ts

@@ -0,0 +1,9 @@
+import { Temporal } from "temporal-polyfill";
+
+// kumiko-framework#1525: the five value-position Temporal.Instant.from
+// call sites in feature.ts live inside defineApply callbacks with no
+// exported seam, so this thin wrapper gives the ambient-global-independence
+// regression test something to import directly.
+export function parseJobInstant(iso: string): Temporal.Instant {
+  return Temporal.Instant.from(iso);
+}

package/src/mail-foundation/__tests__/mail-transport-contract.ts

@@ -11,9 +11,18 @@ export type MailTransportContractFixture = {
   readonly readBack?: (tenantId: string) => readonly EmailMessage[];
 };
 
+export type MailTransportContractOptions = {
+  // Local providers (inmemory) can assert real delivery via readBack —
+  // remote providers (smtp) can't (send() needs a live server), so their
+  // delivery test must show as an explicit `skip` in test output, not a
+  // silently-passing green with zero assertions (#1334).
+  readonly verifiesDelivery: boolean;
+};
+
 export function describeMailTransportContract(
   name: string,
   factory: () => MailTransportContractFixture | Promise<MailTransportContractFixture>,
+  options: MailTransportContractOptions,
 ): void {
   describe(`${name} — MailTransportPlugin contract`, () => {
     let fixture: MailTransportContractFixture;
@@ -27,16 +36,23 @@ export function describeMailTransportContract(
       expect(typeof transport.send).toBe("function");
     });
 
-    test("send delivers the message — verified via readBack", async () => {
-      if (!fixture.readBack) return;
-      const message: EmailMessage = {
-        to: "contract-recipient@example.test",
-        subject: "contract-test-subject",
-        html: "<p>contract-test-body</p>",
-      };
-      const transport = await fixture.plugin.build(fixture.ctx, fixture.tenantId);
-      await transport.send(message);
-      expect(fixture.readBack(fixture.tenantId)).toContainEqual(message);
-    });
+    (options.verifiesDelivery ? test : test.skip)(
+      "send delivers the message — verified via readBack",
+      async () => {
+        if (!fixture.readBack) {
+          throw new Error(
+            "describeMailTransportContract: verifiesDelivery:true but the fixture has no readBack",
+          );
+        }
+        const message: EmailMessage = {
+          to: "contract-recipient@example.test",
+          subject: "contract-test-subject",
+          html: "<p>contract-test-body</p>",
+        };
+        const transport = await fixture.plugin.build(fixture.ctx, fixture.tenantId);
+        await transport.send(message);
+        expect(fixture.readBack(fixture.tenantId)).toContainEqual(message);
+      },
+    );
   });
 }

package/src/mail-transport-inmemory/__tests__/feature.test.ts

@@ -15,12 +15,16 @@ function registeredPlugin(): MailTransportPlugin {
   return usage.options;
 }
 
-describeMailTransportContract("mail-transport-inmemory", () => ({
-  plugin: registeredPlugin(),
-  ctx: {},
-  tenantId: "contract-test-tenant",
-  readBack: getInbox,
-}));
+describeMailTransportContract(
+  "mail-transport-inmemory",
+  () => ({
+    plugin: registeredPlugin(),
+    ctx: {},
+    tenantId: "contract-test-tenant",
+    readBack: getInbox,
+  }),
+  { verifiesDelivery: true },
+);
 
 describe("mailTransportInMemoryFeature — shape", () => {
   test("has the expected name", () => {

package/src/mail-transport-smtp/__tests__/feature.test.ts

@@ -49,11 +49,16 @@ function fakeSecrets(): SecretsContext {
   };
 }
 
-describeMailTransportContract("mail-transport-smtp", () => ({
-  plugin: registeredPlugin(),
-  ctx: { config: fakeConfig(), secrets: fakeSecrets(), _userId: "contract-test-user" },
-  tenantId: "contract-test-tenant",
-}));
+describeMailTransportContract(
+  "mail-transport-smtp",
+  () => ({
+    plugin: registeredPlugin(),
+    ctx: { config: fakeConfig(), secrets: fakeSecrets(), _userId: "contract-test-user" },
+    tenantId: "contract-test-tenant",
+  }),
+  // send() needs a live SMTP server — can't assert real delivery here.
+  { verifiesDelivery: false },
+);
 
 describe("mailTransportSmtpFeature — build error path", () => {
   test("build rejects when a required config-key (host) is unset", async () => {

package/src/page-render/__tests__/markdown.test.ts

@@ -20,6 +20,35 @@ describe("renderSafeMarkdown — XSS-Härtung", () => {
     expect(html).toContain('href="#"');
   });
 
+  // kumiko-framework#1522/#1523: CommonMark allows a tab inside a
+  // <...>-bracketed link destination; `.trim()` only strips leading/
+  // trailing whitespace, so "java\tscript:" survived isSafeHref's scheme
+  // regex (the tab breaks the character class before ":", the check falls
+  // through to `return true`) and the browser normalizes it back to
+  // "javascript:" on click. Mirrors xss-safety.test.tsx's UNSAFE_HREFS.
+  test("java\\tscript:-Link-href (tab-obfuscated scheme via <...> destination) wird neutralisiert", () => {
+    const html = renderSafeMarkdown("[klick](<java\tscript:alert(1)>)");
+    expect(html.toLowerCase()).not.toContain("javascript:");
+    expect(html).toContain('href="#"');
+  });
+
+  // kumiko-framework#1545: HTML character references decode client-side
+  // (the browser parses them before the URL parser ever sees the value),
+  // so "javascript&colon;", "java&Tab;script:" and "java&#9;script:" all
+  // normalize to an executable javascript: URL on click even though none
+  // contains a literal ":" for isSafeHref's pre-decode scheme check.
+  test("HTML-entity-obfuscated javascript: hrefs are neutralized", () => {
+    for (const href of [
+      "javascript&colon;alert(1)",
+      "java&Tab;script:alert(1)",
+      "java&#9;script:alert(1)",
+    ]) {
+      const html = renderSafeMarkdown(`[klick](<${href}>)`);
+      expect(html.toLowerCase()).not.toContain("javascript:");
+      expect(html).toContain('href="#"');
+    }
+  });
+
   test("data:-Image-src wird neutralisiert", () => {
     const html = renderSafeMarkdown("![x](data:text/html;base64,PHNjcmlwdD4=)");
     expect(html.toLowerCase()).not.toContain("data:");

package/src/page-render/markdown.ts

@@ -1,4 +1,4 @@
-import { escapeHtml } from "@cosmicdrift/kumiko-headless";
+import { escapeHtml, isSafeHref } from "@cosmicdrift/kumiko-headless";
 import { Marked } from "marked";
 
 // Geteilter, gehärteter Markdown→HTML-Kern für server-gerenderte Public-
@@ -24,14 +24,6 @@ safeRenderer.use({
   },
 });
 
-// http(s)/mailto oder schema-los (relativ/anchor) erlaubt; javascript:, data:,
-// vbscript: u.a. abgelehnt. Ein relativer href hat kein `scheme:`-Präfix.
-function isSafeHref(href: string): boolean {
-  const trimmed = href.trim().toLowerCase();
-  if (!/^[a-z][a-z0-9+.-]*:/.test(trimmed)) return true;
-  return /^(?:https?|mailto):/.test(trimmed);
-}
-
 export function renderSafeMarkdown(markdown: string): string {
   // @cast-boundary marked.parse return-type ist `string | Promise<string>`;
   // `{ async: false }` garantiert sync (string) — Cast nur API-Vertragsfix.

package/src/personal-access-tokens/feature.ts

@@ -47,7 +47,7 @@ export function createPersonalAccessTokensFeature(
     r.describe(
       "Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `store_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — registered as an auth-foundation tokenVerifier provider, resolved generically by the middleware. Pass { toggleable: { default: false } } to tier-gate the whole feature.",
     );
-    r.uiHints({ displayLabel: "Personal Access Tokens", category: "identity", recommended: true });
+    r.uiHints({ displayLabel: "Personal Access Tokens", category: "identity", recommended: false });
     // Opt-in tier-gating (mirrors ledger/tags): when set, the feature declares
     // itself r.toggleable so the dispatcher gate + tier-engine can switch PAT
     // on/off per tenant. { default: false } = fail-closed until a tier grants it.

package/src/sessions/__tests__/rebuild-survival.integration.test.ts

@@ -57,7 +57,9 @@ beforeEach(async () => {
 // written directly on the hot path, then revoked — no events anywhere.
 const SID = "00000000-0000-0000-0000-000000000001";
 
-async function insertRevokedSession(db: DbConnection): Promise<void> {
+async function insertRevokedSession(
+  db: DbConnection | ReturnType<typeof createTenantDb>,
+): Promise<void> {
   const now = Temporal.Now.instant();
   await seedRow(db, userSessionTable, {
     id: SID,

package/src/sessions/__tests__/sessions-screens.boot.test.ts

@@ -1,26 +1,21 @@
 import { describe, expect, test } from "bun:test";
-import { defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
-import { EXT_SESSION_STORE } from "../../auth-foundation";
+import { authFoundationFeature } from "../../auth-foundation";
 import { createConfigFeature } from "../../config/feature";
+import { createPersonalAccessTokensFeature } from "../../personal-access-tokens";
 import { createTenantFeature } from "../../tenant";
 import { createUserFeature } from "../../user/feature";
 import { SESSION_DETAIL_SCREEN_ID, SESSION_LIST_SCREEN_ID } from "../constants";
 import { createSessionsFeature } from "../feature";
 
-// Stub instead of the real auth-foundation — this test is about screen/query
-// wiring, not auth; the real feature also mandates a tokenVerifier provider
-// which is out of scope here.
-const sessionStoreOwnerStub = defineFeature("auth-foundation", (r) => {
-  r.extendsRegistrar(EXT_SESSION_STORE, {});
-});
-
 describe("sessions screens + query access alignment (kumiko-framework#255)", () => {
   const features = [
     createConfigFeature(),
     createUserFeature(),
     createTenantFeature(),
-    sessionStoreOwnerStub,
+    authFoundationFeature,
+    createPersonalAccessTokensFeature({ scopes: {} }),
     createSessionsFeature(),
   ];