@cosmicdrift/kumiko-bundled-features 0.208.3 → 0.209.0

package/src/delivery/handlers/log.query.ts

@@ -1,14 +1,77 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import { decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
+import {
+  access,
+  definePagedQueryHandler,
+  MAX_LIST_LIMIT,
+  type NotifyPriority,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
 import { decryptStoredPii } from "../../shared";
+import type { DeliveryStatusValue } from "../constants";
 import { deliveryAttemptsTable } from "../tables";
 
-export const logQuery = defineQueryHandler({
+type DeliveryLogRow = {
+  id: string;
+  tenantId: string;
+  notificationType: string;
+  channel: string;
+  recipientId: string | null;
+  recipientAddress: string | null;
+  status: DeliveryStatusValue;
+  error: string | null;
+  priority: NotifyPriority;
+  createdAt: Temporal.Instant;
+};
+
+// Sort whitelist keyed by the DISPLAY field the client actually sends: the
+// declarative projectionList renderer marks every listed column uniformly
+// sortable and a header click sends `sort=<screen.columns[].field>`, not the
+// DB column name (see projection-list-shim.ts synthesizeProjectionEntity).
+// "recipient" is deliberately absent — it's PII decrypted per-row in
+// application code, so there is no column to ORDER BY in SQL for it.
+const DELIVERY_LOG_SORT_COLUMNS = {
+  createdAt: "createdAt",
+  type: "notificationType",
+  channel: "channel",
+  status: "status",
+} as const;
+type DeliveryLogSortField = keyof typeof DELIVERY_LOG_SORT_COLUMNS;
+
+function isDeliveryLogSortField(value: string): value is DeliveryLogSortField {
+  return value in DELIVERY_LOG_SORT_COLUMNS;
+}
+
+type DeliveryLogSortColumn = (typeof DELIVERY_LOG_SORT_COLUMNS)[DeliveryLogSortField];
+
+// createdAt round-trips through Temporal.Instant (matches how the WHERE
+// builder coerces timestamptz values — see bun-db/query.ts prepareValue);
+// every other whitelisted column is a plain text column. Keyed by the
+// PHYSICAL column, not the display alias — row only has the DB field names
+// (e.g. notificationType), never the alias (e.g. "type").
+function encodeSortCursor(column: DeliveryLogSortColumn, row: DeliveryLogRow): string {
+  if (column === "createdAt") return encodeCursor(row.createdAt.toString());
+  return encodeCursor(String(row[column]));
+}
+
+function decodeSortCursor(
+  column: DeliveryLogSortColumn,
+  cursor: string,
+): Temporal.Instant | string {
+  const decoded = decodeCursor(cursor);
+  if (column === "createdAt") return Temporal.Instant.from(decoded);
+  return decoded;
+}
+
+export const logQuery = definePagedQueryHandler({
   name: "log",
   schema: z.object({
-    limit: z.number().min(1).max(100).default(50),
+    cursor: z.string().optional(),
+    limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(50),
+    sort: z.string().optional(),
+    sortDirection: z.enum(["asc", "desc"]).optional(),
   }),
   access: { roles: access.admin },
   handler: async (query, ctx) => {
@@ -20,27 +83,61 @@ export const logQuery = defineQueryHandler({
     // tenantId, not a query filter — it returns that same unfiltered db, so
     // the explicit `where` below still does the actual tenant scoping.
     const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-    const rows = await selectMany(
-      db,
-      deliveryAttemptsTable,
-      { tenantId: query.user.tenantId },
-      {
-        orderBy: { col: "createdAt", direction: "desc" },
-        limit: query.payload.limit,
-      },
-    );
+
+    const requestedSort = query.payload.sort;
+    const sortField: DeliveryLogSortField =
+      requestedSort !== undefined && isDeliveryLogSortField(requestedSort)
+        ? requestedSort
+        : "createdAt";
+    const sortDirection = query.payload.sortDirection ?? "desc";
+    const sortColumn = DELIVERY_LOG_SORT_COLUMNS[sortField];
+
+    const where: WhereObject = { tenantId: query.user.tenantId };
+    if (query.payload.cursor) {
+      where[sortColumn] = {
+        [sortDirection === "asc" ? "gt" : "lt"]: decodeSortCursor(sortColumn, query.payload.cursor),
+      };
+    }
+
+    const rows = await selectMany<DeliveryLogRow>(db, deliveryAttemptsTable, where, {
+      // Tie-breaker on id keeps ordering stable across pages when the sort
+      // column has duplicate values (e.g. many rows with the same status).
+      orderBy: [
+        { col: sortColumn, direction: sortDirection },
+        { col: "id", direction: "asc" },
+      ],
+      limit: query.payload.limit,
+    });
+
+    const lastRow = rows[rows.length - 1];
+    const nextCursor =
+      rows.length === query.payload.limit && lastRow ? encodeSortCursor(sortColumn, lastRow) : null;
+
     // recipientAddress is stored encrypted under the recipient's DEK (#799)
     // — decrypt for the admin log view; forgotten subjects show [[erased]].
+    // The notificationType/recipientAddress → type/recipient rename happens
+    // here, not in the client: a projectionList screen has no entity to
+    // derive a field-mapping from, so the row shape the query returns is the
+    // shape the declarative columns read directly.
     return {
       rows: await Promise.all(
         rows.map(async (row) => ({
-          ...row,
-          recipientAddress:
-            typeof row["recipientAddress"] === "string"
-              ? await decryptStoredPii(row["recipientAddress"], "recipientAddress", "delivery-log")
-              : row["recipientAddress"],
+          id: row.id,
+          tenantId: row.tenantId,
+          recipientId: row.recipientId,
+          type: row.notificationType,
+          channel: row.channel,
+          recipient:
+            row.recipientAddress !== null
+              ? await decryptStoredPii(row.recipientAddress, "recipientAddress", "delivery-log")
+              : row.recipientAddress,
+          status: row.status,
+          error: row.error,
+          priority: row.priority,
+          createdAt: row.createdAt,
         })),
       ),
+      nextCursor,
     };
   },
 });

package/src/delivery/i18n.ts

@@ -3,4 +3,8 @@ type LocalizedString = { readonly en: string };
 export const DELIVERY_I18N: Readonly<Record<string, LocalizedString>> = {
   "screen:delivery-log.title": { en: "Delivery log" },
   "delivery:nav.deliveryLog": { en: "Delivery" },
+  "delivery.log.col.type": { en: "Type" },
+  "delivery.log.col.channel": { en: "Channel" },
+  "delivery.log.col.recipient": { en: "Recipient" },
+  "delivery.log.col.status": { en: "Status" },
 };

package/src/delivery/public-names.ts

@@ -14,6 +14,11 @@ export const DeliveryQueries = {
 
 export const DELIVERY_LOG_SCREEN_ID = "delivery-log" as const;
 
+// Client column-renderer registered for the delivery-log screen's status
+// column — see `screen.columns[].renderer.react.__component` in feature.ts
+// and `deliveryClient()`'s `columnRenderers` map.
+export const DELIVERY_STATUS_CELL_COMPONENT = "DeliveryStatusCell" as const;
+
 export const DeliveryErrors = {
   noRecipient: "delivery_no_recipient",
   channelFailed: "delivery_channel_failed",

package/src/delivery/web/client-plugin.tsx

@@ -1,9 +1,8 @@
 // @runtime client
-import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
-import { DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID } from "../public-names";
-import { DeliveryLogScreen } from "./delivery-log-screen";
-import { defaultTranslations } from "./i18n";
+import { DELIVERY_FEATURE, DELIVERY_STATUS_CELL_COMPONENT } from "../public-names";
+import { DeliveryStatusCell } from "./delivery-status-cell";
 
 export type DeliveryClientOptions = {
   readonly translations?: TranslationsByLocale;
@@ -12,9 +11,9 @@ export type DeliveryClientOptions = {
 export function deliveryClient(options?: DeliveryClientOptions): ClientFeatureDefinition {
   return {
     name: DELIVERY_FEATURE,
-    translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
-    components: {
-      [DELIVERY_LOG_SCREEN_ID]: DeliveryLogScreen,
+    columnRenderers: {
+      [DELIVERY_STATUS_CELL_COMPONENT]: DeliveryStatusCell,
     },
+    ...(options?.translations !== undefined && { translations: options.translations }),
   };
 }

package/src/delivery/web/delivery-status-cell.tsx

@@ -0,0 +1,26 @@
+// @runtime client
+// Column-renderer for the delivery-log screen's status column, registered
+// via `deliveryClient()`'s `columnRenderers` map (screen.columns[].renderer
+// in feature.ts). The list frame itself is the generic declarative
+// projectionList renderer — only this one cell stays TSX.
+
+import type { ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import { StatusBadge, type StatusTone } from "@cosmicdrift/kumiko-renderer-web";
+import type { ReactNode } from "react";
+import { DeliveryStatus } from "../public-names";
+
+const STATUS_TONE: Readonly<Record<string, StatusTone>> = {
+  [DeliveryStatus.sent]: "ok",
+  [DeliveryStatus.failed]: "bad",
+  [DeliveryStatus.queued]: "muted",
+  [DeliveryStatus.skipped]: "muted",
+};
+
+export function DeliveryStatusCell({ row }: ColumnRendererProps): ReactNode {
+  const status = typeof row["status"] === "string" ? row["status"] : "";
+  return (
+    <StatusBadge tone={STATUS_TONE[status] ?? "muted"} testId="delivery-status-cell">
+      {status}
+    </StatusBadge>
+  );
+}

package/src/delivery/web/index.ts

@@ -1,3 +1,3 @@
 // @runtime client
 export { type DeliveryClientOptions, deliveryClient } from "./client-plugin";
-export { DeliveryLogScreen } from "./delivery-log-screen";
+export { DeliveryStatusCell } from "./delivery-status-cell";

package/src/sessions/__tests__/session-last-seen.integration.test.ts

@@ -0,0 +1,165 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { Temporal } from "temporal-polyfill";
+import { AuthHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../../tenant";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { LAST_SEEN_REFRESH_MS } from "../constants";
+import { createSessionsFeature } from "../feature";
+import { userSessionEntity, userSessionTable } from "../schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../session-callbacks";
+import { sessionCallbacksFromLateBound } from "../testing";
+import { makeSessionHelpers } from "./test-helpers";
+
+// Proves the #2220 lastSeenAt refresh: sessionChecker stamps a coarse
+// activity marker on the session row, but only once per LAST_SEEN_REFRESH_MS
+// rather than on every authenticated request.
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+let sessionCreator: SessionCreator;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+const encryptionKey = randomBytes(32).toString("base64");
+
+const TENANT: TenantId = testTenantId(1);
+
+async function readLastSeenAt(sid: string): Promise<Temporal.Instant | null> {
+  const rows = await selectMany<{ lastSeenAt: Temporal.Instant | null }>(
+    stack.db,
+    userSessionTable,
+    { id: sid },
+  );
+  return rows[0]?.lastSeenAt ?? null;
+}
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature(),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  const creator = bound.asAuthConfig().sessionCreator;
+  if (!creator) throw new Error("sessionCreator missing from bound auth config");
+  sessionCreator = creator;
+  h = makeSessionHelpers(stack, TENANT, sessionCreator);
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userSessionTable.tableName}"`);
+});
+
+describe("sessionChecker — lastSeenAt refresh", () => {
+  test("freshly created session has lastSeenAt set, not null", async () => {
+    await h.seedUser("fresh@example.com", "pw-long-enough");
+    const { sid } = await h.login("fresh@example.com", "pw-long-enough");
+
+    const lastSeenAt = await readLastSeenAt(sid);
+    expect(lastSeenAt).not.toBeNull();
+    // Sanity: stamped at creation time, not far in the past/future.
+    const driftMs = Math.abs(
+      Temporal.Now.instant().epochMilliseconds - (lastSeenAt?.epochMilliseconds ?? 0),
+    );
+    expect(driftMs).toBeLessThan(10_000);
+  });
+
+  test("null lastSeenAt is refreshed to a fresh value on check", async () => {
+    const { userId } = await h.seedUser("null-refresh@example.com", "pw-long-enough");
+    const { sid } = await h.login("null-refresh@example.com", "pw-long-enough");
+
+    await updateRows(stack.db, userSessionTable, { lastSeenAt: null }, { id: sid });
+    expect(await readLastSeenAt(sid)).toBeNull();
+
+    await callbacks.get().sessionChecker(sid, userId);
+
+    const refreshed = await readLastSeenAt(sid);
+    expect(refreshed).not.toBeNull();
+    const driftMs = Math.abs(
+      Temporal.Now.instant().epochMilliseconds - (refreshed?.epochMilliseconds ?? 0),
+    );
+    expect(driftMs).toBeLessThan(10_000);
+  });
+
+  test("lastSeenAt older than LAST_SEEN_REFRESH_MS is refreshed to a fresh value on check", async () => {
+    const { userId } = await h.seedUser("stale-refresh@example.com", "pw-long-enough");
+    const { sid } = await h.login("stale-refresh@example.com", "pw-long-enough");
+
+    const stale = Temporal.Now.instant().subtract({ milliseconds: LAST_SEEN_REFRESH_MS + 1_000 });
+    await updateRows(stack.db, userSessionTable, { lastSeenAt: stale }, { id: sid });
+    expect((await readLastSeenAt(sid))?.epochMilliseconds).toBe(stale.epochMilliseconds);
+
+    await callbacks.get().sessionChecker(sid, userId);
+
+    const refreshed = await readLastSeenAt(sid);
+    expect(refreshed?.epochMilliseconds).toBeGreaterThan(stale.epochMilliseconds);
+    const driftMs = Math.abs(
+      Temporal.Now.instant().epochMilliseconds - (refreshed?.epochMilliseconds ?? 0),
+    );
+    expect(driftMs).toBeLessThan(10_000);
+  });
+
+  test("lastSeenAt younger than LAST_SEEN_REFRESH_MS is left unchanged on check", async () => {
+    const { userId } = await h.seedUser("recent-noop@example.com", "pw-long-enough");
+    const { sid } = await h.login("recent-noop@example.com", "pw-long-enough");
+
+    const recent = Temporal.Now.instant().subtract({ milliseconds: 1_000 });
+    await updateRows(stack.db, userSessionTable, { lastSeenAt: recent }, { id: sid });
+    const before = await readLastSeenAt(sid);
+    expect(before?.epochMilliseconds).toBe(recent.epochMilliseconds);
+
+    await callbacks.get().sessionChecker(sid, userId);
+
+    const after = await readLastSeenAt(sid);
+    expect(after?.epochMilliseconds).toBe(before?.epochMilliseconds);
+  });
+});

package/src/sessions/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.208.2",
+    "type": "improvement",
+    "title": "Session rows track lastSeenAt, refreshed hourly",
+    "detail": "userSession now carries a lastSeenAt timestamp, set on session creation and refreshed by sessionChecker at most once per hour (LAST_SEEN_REFRESH_MS). A refresh failure is swallowed and the check still returns \"live\" — this is a coarse activity marker, not a per-request write."
+  },
   {
     "version": "0.165.1",
     "type": "fix",

package/src/sessions/constants.ts

@@ -48,5 +48,9 @@ export const DEFAULT_SESSION_CACHE_TTL_MS = 60_000;
 // MVP ships a single window; per-app overrides can come later.
 export const DEFAULT_SESSION_EXPIRY_MS = 30 * 24 * 60 * 60 * 1000;
 
+// Minimum gap between lastSeenAt writes — coarse activity tracking without a
+// write on every authenticated request.
+export const LAST_SEEN_REFRESH_MS = 3_600_000;
+
 export const SESSION_LIST_SCREEN_ID = "session-list" as const;
 export const SESSION_DETAIL_SCREEN_ID = "session-detail" as const;

package/src/sessions/feature.ts

@@ -245,10 +245,26 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       type: "projectionDetail",
       query: SessionQueries.detail,
       listScreenId: SESSION_LIST_SCREEN_ID,
+      // No write path on this screen — a "Cancel" button here would only
+      // ever discard nothing. Back-navigation still works via listScreenId
+      // above (resolveDetailBreadcrumb, renderer-web) — fw#2245.
+      hideActions: true,
       layout: {
         sections: [
           {
-            fields: ["id", "userId", "createdAt", "expiresAt", "revokedAt", "ip", "userAgent"],
+            fields: [
+              "id",
+              "userId",
+              // The shim (projection-detail-shim.ts) stamps every field as
+              // type:"text" — field.renderer is the only way this screen
+              // type reaches real per-type formatting instead of a raw ISO
+              // string (fw#2245).
+              { field: "createdAt", renderer: { format: "timestamp" } },
+              { field: "expiresAt", renderer: { format: "timestamp" } },
+              { field: "revokedAt", renderer: { format: "timestamp" } },
+              "ip",
+              "userAgent",
+            ],
           },
         ],
       },

package/src/sessions/schema/user-session.ts

@@ -53,6 +53,11 @@ export const userSessionEntity = createEntity({
     revokedAt: createTimestampField({
       access: { write: access.privileged },
     }),
+    // Coarse last-activity marker, refreshed at most hourly (see
+    // LAST_SEEN_REFRESH_MS) — not a per-request write.
+    lastSeenAt: createTimestampField({
+      access: { write: access.privileged },
+    }),
     // Subject is the session's user, not the session row — a user-forget
     // must shred these, so the key hangs off userId (sid-self would orphan).
     ip: createTextField({

package/src/sessions/session-callbacks.ts

@@ -19,7 +19,7 @@ import { Temporal } from "temporal-polyfill";
 import { encryptForDirectWrite } from "../shared";
 import { tenantMembershipsTable } from "../tenant";
 import { USER_STATUS, type UserStatus, userTable } from "../user";
-import { DEFAULT_SESSION_EXPIRY_MS } from "./constants";
+import { DEFAULT_SESSION_EXPIRY_MS, LAST_SEEN_REFRESH_MS } from "./constants";
 import { userSessionEntity, userSessionTable } from "./schema/user-session";
 import {
   SESSION_REVOKED_AGGREGATE_TYPE,
@@ -91,6 +91,7 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
             userId: user.id,
             createdAt: now,
             expiresAt,
+            lastSeenAt: now,
             ip: meta.ip,
             userAgent: meta.userAgent,
           },
@@ -120,6 +121,7 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
         tenantId: TenantId;
         revokedAt: unknown;
         expiresAt: { epochMilliseconds: number };
+        lastSeenAt: { epochMilliseconds: number } | null;
       }>(db, userSessionTable, { id: sid });
       if (!row) return "missing";
       // Cross-user check: if the sid belongs to someone else, treat it
@@ -133,6 +135,23 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       if (row.expiresAt.epochMilliseconds <= Temporal.Now.instant().epochMilliseconds) {
         return "expired";
       }
+
+      // Hourly, not per-request: this check runs on every authenticated
+      // request, so a write here has to stay off the hot path.
+      const nowMs = Temporal.Now.instant().epochMilliseconds;
+      if (!row.lastSeenAt || row.lastSeenAt.epochMilliseconds + LAST_SEEN_REFRESH_MS <= nowMs) {
+        try {
+          await updateMany(
+            db,
+            userSessionTable,
+            { lastSeenAt: Temporal.Now.instant() },
+            { id: sid },
+          );
+        } catch {
+          // fail-open: a refresh failure must not block the session check
+        }
+      }
+
       // Defense-in-depth: status flips (Art. 18 restrict, forget) revoke
       // sessions, but a missed revoke must not keep a locked account alive on
       // a stale sid. Fail-OPEN on a lookup miss — this is the second layer,

package/src/sessions/session-checker-fail-open.test.ts

@@ -110,6 +110,44 @@ describe("sessionChecker fail-open on user-lookup throw", () => {
   });
 });
 
+describe("sessionChecker fail-open on lastSeenAt refresh throw", () => {
+  test("updateMany THROW on refresh → live (not 500)", async () => {
+    const db = {} as DbConnection;
+    const cbs = createSessionCallbacks({ db });
+    const sid = "00000000-0000-4000-8000-00000000sid5";
+    const userId = "00000000-0000-4000-8000-00000000usr5";
+    const farFutureMs = Temporal.Now.instant().add({ hours: 1 }).epochMilliseconds;
+
+    const originalUpdateMany = bunDb.updateMany;
+    const fetchSpy = spyOn(bunDb, "fetchOne").mockImplementation((async (_db, table) => {
+      if (table === userSessionTable) {
+        return {
+          userId,
+          revokedAt: null,
+          expiresAt: { epochMilliseconds: farFutureMs },
+          lastSeenAt: null,
+        };
+      }
+      if (table === userTable) {
+        throw new Error("simulated pool exhaustion");
+      }
+      throw new Error("unexpected table in sessionChecker spy");
+    }) as FetchOne);
+    const updateSpy = spyOn(bunDb, "updateMany").mockImplementation(async () => {
+      throw new Error("simulated write failure");
+    });
+
+    try {
+      expect(await cbs.sessionChecker(sid, userId)).toBe("live");
+      expect(updateSpy).toHaveBeenCalledTimes(1);
+    } finally {
+      fetchSpy.mockRestore();
+      updateSpy.mockRestore();
+      expect(bunDb.updateMany).toBe(originalUpdateMany);
+    }
+  });
+});
+
 describe("sessionChecker role re-derivation", () => {
   test("live session composes global + tenant-membership roles fresh from the DB", async () => {
     const db = {} as DbConnection;