@cosmicdrift/kumiko-bundled-features 0.258.0 → 0.259.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.258.0",
+  "version": "0.259.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -129,16 +129,17 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.258.0",
-    "@cosmicdrift/kumiko-framework": "0.258.0",
-    "@cosmicdrift/kumiko-headless": "0.258.0",
-    "@cosmicdrift/kumiko-renderer": "0.258.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.258.0",
-    "@cosmicdrift/kumiko-types": "0.258.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.259.0",
+    "@cosmicdrift/kumiko-framework": "0.259.0",
+    "@cosmicdrift/kumiko-headless": "0.259.0",
+    "@cosmicdrift/kumiko-renderer": "0.259.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.259.0",
+    "@cosmicdrift/kumiko-types": "0.259.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
     "@types/nodemailer": "^8.0.0",
+    "@types/qrcode": "^1.5.5",
     "clsx": "^2.1.1",
     "imapflow": "^1.3.3",
     "lucide-react": "^1.14.0",
@@ -162,8 +163,7 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.258.0",
-    "@cosmicdrift/kumiko-locale-es": "0.258.0"
+    "@cosmicdrift/kumiko-locale-de": "0.259.0",
+    "@cosmicdrift/kumiko-locale-es": "0.259.0"
   }
 }

package/src/__tests__/account-security-composition.boot.test.ts

@@ -0,0 +1,83 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { authFoundationFeature } from "../auth-foundation";
+import {
+  AuthMfaHandlers,
+  createAuthMfaFeature,
+  MFA_DISABLE_SCREEN_ID,
+  MFA_ENABLE_SCREEN_ID,
+  MFA_REGENERATE_RECOVERY_SCREEN_ID,
+} from "../auth-mfa";
+import { createConfigFeature } from "../config/feature";
+import { createPersonalAccessTokensFeature } from "../personal-access-tokens";
+import { createSessionsFeature, SESSION_MINE_SCREEN_ID, SessionHandlers } from "../sessions";
+import { createTenantFeature } from "../tenant";
+import { createUserFeature } from "../user/feature";
+import { accountSecurityFeature, testAuthMfaOptions } from "./account-security-fixture";
+
+function bootFeatures() {
+  return [
+    createConfigFeature(),
+    createUserFeature(),
+    createTenantFeature(),
+    authFoundationFeature,
+    createPersonalAccessTokensFeature({ scopes: {} }),
+    createSessionsFeature(),
+    createAuthMfaFeature(testAuthMfaOptions),
+  ];
+}
+
+describe("account-security composed from bundled screens (fw#2841)", () => {
+  // auth-mfa's user-mfa entity has encrypted fields — validateBoot probes for a cipher.
+  beforeAll(() => configureEntityFieldEncryption(createTestEnvelopeCipher()));
+  afterAll(() => configureEntityFieldEncryption(undefined));
+
+  test("boot-validates as a dashboard of screen panels", () => {
+    expect(() => validateBoot([...bootFeatures(), accountSecurityFeature])).not.toThrow();
+  });
+
+  test("the self-service screens are open to every signed-in user", () => {
+    const [, , , , , sessions, mfa] = bootFeatures();
+    const screens = [
+      sessions?.screens[SESSION_MINE_SCREEN_ID],
+      mfa?.screens[MFA_ENABLE_SCREEN_ID],
+      mfa?.screens[MFA_DISABLE_SCREEN_ID],
+      mfa?.screens[MFA_REGENERATE_RECOVERY_SCREEN_ID],
+    ];
+    for (const screen of screens) {
+      expect(screen?.access).toEqual({ openToAll: true });
+    }
+  });
+
+  test("MFA disable and regenerate-recovery dispatch their handlers with a possession code", () => {
+    const mfa = bootFeatures()[6];
+    const disable = mfa?.screens[MFA_DISABLE_SCREEN_ID];
+    if (disable?.type !== "actionForm") throw new Error("expected an actionForm");
+    expect(disable.handler).toBe(AuthMfaHandlers.disable);
+    expect(Object.keys(disable.fields)).toEqual(["code"]);
+
+    const regenerate = mfa?.screens[MFA_REGENERATE_RECOVERY_SCREEN_ID];
+    if (regenerate?.type !== "secretMint") throw new Error("expected a secretMint");
+    expect(regenerate.handler).toBe(AuthMfaHandlers.regenerateRecovery);
+    expect(Object.keys(regenerate.fields)).toEqual(["code"]);
+    expect(regenerate.reveal.fields.map((f) => f.field)).toEqual(["recoveryCodes"]);
+  });
+
+  test("my-sessions hides revoke on the current session and offers revoke-all-others", () => {
+    const sessions = bootFeatures()[5];
+    const mine = sessions?.screens[SESSION_MINE_SCREEN_ID];
+    if (mine?.type !== "projectionList") throw new Error("expected a projectionList");
+    const revoke = mine.rowActions?.find((a) => a.id === "revoke");
+    if (revoke === undefined || revoke.kind !== "writeHandler") {
+      throw new Error("expected a writeHandler revoke action");
+    }
+    expect(revoke.handler).toBe(SessionHandlers.revoke);
+    expect(revoke.visible).toEqual({ field: "current", eq: false });
+    const revokeAllOthers = mine.toolbarActions?.find((a) => a.id === "revoke-all-others");
+    expect(revokeAllOthers?.kind === "writeHandler" && revokeAllOthers.handler).toBe(
+      SessionHandlers.revokeAllOthers,
+    );
+  });
+});

package/src/__tests__/account-security-composition.integration.test.ts

@@ -0,0 +1,168 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import { buildAppSchema, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers } from "../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../auth-email-password/feature";
+import { authFoundationFeature } from "../auth-foundation";
+import { createAuthMfaFeature } from "../auth-mfa";
+import { userMfaEntity } from "../auth-mfa/schema/user-mfa";
+import { createConfigFeature } from "../config";
+import { createConfigResolver } from "../config/resolver";
+import { configValuesTable } from "../config/table";
+import { createSessionsFeature } from "../sessions";
+import { makeSessionHelpers } from "../sessions/__tests__/test-helpers";
+import { userSessionEntity } from "../sessions/schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../sessions/session-callbacks";
+import { sessionCallbacksFromLateBound } from "../sessions/testing";
+import { createTenantFeature } from "../tenant";
+import { tenantMembershipsTable } from "../tenant/membership-table";
+import { tenantEntity } from "../tenant/schema/tenant";
+import { createUserFeature } from "../user/feature";
+import { userEntity } from "../user/schema/user";
+import {
+  ACCOUNT_SECURITY_SCREEN_ID,
+  accountSecurityFeature,
+  mfaStatusVisibility,
+  testAuthMfaOptions,
+} from "./account-security-fixture";
+
+type PanelQueryRow = { readonly id: string; readonly current: boolean };
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+const TENANT: TenantId = testTenantId(1);
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher();
+  configureEntityFieldEncryption(encryption);
+  const bound = sessionCallbacksFromLateBound(callbacks);
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature(),
+      createAuthMfaFeature(testAuthMfaOptions),
+      accountSecurityFeature,
+    ],
+    extraContext: {
+      configResolver: createConfigResolver({ cipher: encryption }),
+      configEncryption: encryption,
+    },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator);
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+  configureEntityFieldEncryption(undefined);
+});
+
+function accountSecurityScreenPanels() {
+  const app = buildAppSchema(stack.registry);
+  const screen = app.features
+    .find((f) => f.featureName === "account-security")
+    ?.screens.find((s) => s.id === ACCOUNT_SECURITY_SCREEN_ID);
+  if (screen?.type !== "dashboard") throw new Error("expected the account-security dashboard");
+  return screen.panels;
+}
+
+function embeddedScreen(qn: string) {
+  const [featureName, , screenId] = qn.split(":");
+  const screen = buildAppSchema(stack.registry)
+    .features.find((f) => f.featureName === featureName)
+    ?.screens.find((s) => s.id === screenId);
+  if (screen === undefined) throw new Error(`embedded screen ${qn} missing from app schema`);
+  return screen;
+}
+
+describe("account-security dashboard on a real stack", () => {
+  test("ships its screen panels in the client app schema, each resolving to a wired screen", () => {
+    const panels = accountSecurityScreenPanels();
+    const targets = panels.flatMap((p) => (p.kind === "screen" ? [p.screen] : []));
+    expect(targets).toEqual([
+      "auth-mfa:screen:auth-mfa-enable",
+      "auth-mfa:screen:auth-mfa-regenerate-recovery",
+      "auth-mfa:screen:auth-mfa-disable",
+      "sessions:screen:my-sessions",
+    ]);
+    for (const qn of targets) expect(embeddedScreen(qn).access).toEqual({ openToAll: true });
+  });
+
+  test("a plain User gets the flat visibleWhen record and their own sessions over HTTP", async () => {
+    await h.seedUser("dash@example.com", "pw-long-enough");
+    const other = await h.login("dash@example.com", "pw-long-enough");
+    const current = await h.login("dash@example.com", "pw-long-enough");
+
+    const statusRes = await h.authedPost("/api/query", current.token, {
+      type: mfaStatusVisibility.query,
+      payload: {},
+    });
+    expect(statusRes.status).toBe(200);
+    const status = (await statusRes.json()) as { data: Record<string, unknown> };
+    expect(status.data[mfaStatusVisibility.field]).toBe(false);
+
+    const sessionsScreen = embeddedScreen("sessions:screen:my-sessions");
+    if (sessionsScreen.type !== "projectionList") throw new Error("expected a projectionList");
+    const listRes = await h.authedPost("/api/query", current.token, {
+      type: sessionsScreen.query,
+      payload: { limit: 50 },
+    });
+    expect(listRes.status).toBe(200);
+    const list = (await listRes.json()) as { data: { rows: PanelQueryRow[] } };
+    expect(list.data.rows.map((r) => r.id).sort()).toEqual([current.sid, other.sid].sort());
+    expect(list.data.rows.find((r) => r.current)?.id).toBe(current.sid);
+  });
+
+  test("the embedded list's revoke-all-others toolbar action leaves only the current session", async () => {
+    await h.seedUser("dash-revoke@example.com", "pw-long-enough");
+    await h.login("dash-revoke@example.com", "pw-long-enough");
+    const current = await h.login("dash-revoke@example.com", "pw-long-enough");
+
+    const sessionsScreen = embeddedScreen("sessions:screen:my-sessions");
+    if (sessionsScreen.type !== "projectionList") throw new Error("expected a projectionList");
+    const action = sessionsScreen.toolbarActions?.find((a) => a.id === "revoke-all-others");
+    if (action?.kind !== "writeHandler") throw new Error("expected a writeHandler toolbar action");
+
+    const revokeRes = await h.authedPost("/api/write", current.token, {
+      type: action.handler,
+      payload: action.payload ?? {},
+    });
+    expect(revokeRes.status).toBe(200);
+
+    const listRes = await h.authedPost("/api/query", current.token, {
+      type: sessionsScreen.query,
+      payload: {},
+    });
+    const list = (await listRes.json()) as { data: { rows: PanelQueryRow[] } };
+    expect(list.data.rows.map((r) => r.id)).toEqual([current.sid]);
+  });
+});

package/src/__tests__/account-security-fixture.ts

@@ -0,0 +1,52 @@
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  type AuthMfaFeatureOptions,
+  AuthMfaQueries,
+  MFA_DISABLE_SCREEN_ID,
+  MFA_ENABLE_SCREEN_ID,
+  MFA_REGENERATE_RECOVERY_SCREEN_ID,
+} from "../auth-mfa";
+import { SESSION_MINE_SCREEN_ID } from "../sessions";
+
+export const ACCOUNT_SECURITY_SCREEN_ID = "account-security";
+
+export const mfaStatusVisibility = { query: AuthMfaQueries.status, field: "enabled" } as const;
+
+export const testAuthMfaOptions: AuthMfaFeatureOptions = {
+  setupTokenSecret: "test-setup-token-secret-do-not-use-in-prod",
+  issuer: "Kumiko Test",
+  challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+};
+
+export const accountSecurityFeature = defineFeature("account-security", (r) => {
+  r.requires("sessions");
+  r.requires("auth-mfa");
+  r.screen({
+    id: ACCOUNT_SECURITY_SCREEN_ID,
+    type: "dashboard",
+    panels: [
+      {
+        kind: "screen",
+        id: "mfa-enable",
+        screen: `auth-mfa:screen:${MFA_ENABLE_SCREEN_ID}`,
+        visibleWhen: { ...mfaStatusVisibility, eq: false },
+      },
+      {
+        kind: "screen",
+        id: "mfa-regenerate",
+        screen: `auth-mfa:screen:${MFA_REGENERATE_RECOVERY_SCREEN_ID}`,
+        visibleWhen: { ...mfaStatusVisibility, eq: true },
+      },
+      {
+        kind: "screen",
+        id: "mfa-disable",
+        screen: `auth-mfa:screen:${MFA_DISABLE_SCREEN_ID}`,
+        visibleWhen: { ...mfaStatusVisibility, eq: true },
+      },
+      { kind: "screen", id: "sessions", screen: `sessions:screen:${SESSION_MINE_SCREEN_ID}` },
+    ],
+  });
+  r.translations({
+    keys: { "screen:account-security.title": { de: "Kontosicherheit", en: "Account security" } },
+  });
+});

package/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.259.0",
+    "type": "improvement",
+    "title": "Declarative auth-mfa-disable and auth-mfa-regenerate-recovery screens (fw#2844).",
+    "detail": "`auth-mfa-disable` (actionForm on auth-mfa:write:disable) and `auth-mfa-regenerate-recovery` (secretMint on auth-mfa:write:regenerate-recovery, one-time reveal of the new codes) join `auth-mfa-enable`, so a settings page can offer the full MFA lifecycle without client components — gate them on `auth-mfa:query:user-mfa:status` via a dashboard screen panel's `visibleWhen`. Exported ids MFA_DISABLE_SCREEN_ID, MFA_REGENERATE_RECOVERY_SCREEN_ID. Additive; handlers unchanged."
+  },
   {
     "version": "0.165.0",
     "type": "fix",

package/src/auth-mfa/constants.ts

@@ -43,3 +43,5 @@ export const MFA_VERIFY_LOCKOUT_MINUTES = 5;
 // Dormant custom-screen id — see personal-access-tokens/feature.ts for the
 // same convention. App places it via r.nav in its logged-in settings area.
 export const MFA_ENABLE_SCREEN_ID = "auth-mfa-enable";
+export const MFA_DISABLE_SCREEN_ID = "auth-mfa-disable";
+export const MFA_REGENERATE_RECOVERY_SCREEN_ID = "auth-mfa-regenerate-recovery";

package/src/auth-mfa/feature.ts

@@ -13,7 +13,7 @@ import { AUTH_MFA_FEATURE_I18N } from "./i18n";
 import { createMfaCodeVerifier, type MfaCodeVerifier } from "./mfa-code-verifier";
 import { createMfaStatusChecker, type MfaStatusChecker } from "./mfa-status-checker";
 import { userMfaEntity } from "./schema/user-mfa";
-import { mfaEnableScreen } from "./screens";
+import { mfaDisableScreen, mfaEnableScreen, mfaRegenerateRecoveryScreen } from "./screens";
 
 export type AuthMfaFeatureOptions = {
   // HMAC secret for the stateless enable-flow token (carries the generated
@@ -130,6 +130,8 @@ export function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefini
     // logged-in settings area (see personal-access-tokens/feature.ts for the
     // same convention).
     r.screen(mfaEnableScreen);
+    r.screen(mfaDisableScreen);
+    r.screen(mfaRegenerateRecoveryScreen);
     r.translations({ keys: AUTH_MFA_FEATURE_I18N });
 
     // KEK-rotation for totpSecret (entity-field encryption). Manual

package/src/auth-mfa/i18n.ts

@@ -22,6 +22,16 @@ export const AUTH_MFA_FEATURE_I18N: Readonly<Record<string, LocalizedString>> =
   "mfa.enable.confirm.submit": { en: "Enable" },
   "mfa.enable.confirm.done": { en: "Two-factor authentication is now enabled." },
 
+  "screen:auth-mfa-disable.title": { en: "Disable two-factor authentication" },
+  "mfa.disable.submit": { en: "Disable" },
+
+  "screen:auth-mfa-regenerate-recovery.title": { en: "Generate new recovery codes" },
+  "mfa.regenerate.submit": { en: "Generate new codes" },
+  "mfa.regenerate.reveal.title": { en: "Your new recovery codes" },
+  "mfa.regenerate.reveal.warning": {
+    en: "Save these codes now — they are shown only this once, and your previous codes no longer work.",
+  },
+
   // Field label for the confirm step's pseudo-entity (`__action-form__`, see
   // action-form-shim.ts) — required by the i18n boot-validator
   // (requiredKeysFromScreen); the declarative renderer resolves this through

package/src/auth-mfa/index.ts

@@ -4,7 +4,9 @@ export {
   AUTH_MFA_FEATURE,
   AuthMfaHandlers,
   AuthMfaQueries,
+  MFA_DISABLE_SCREEN_ID,
   MFA_ENABLE_SCREEN_ID,
+  MFA_REGENERATE_RECOVERY_SCREEN_ID,
 } from "./constants";
 export type {
   AuthMfaFeatureOptions,

package/src/auth-mfa/screens.ts

@@ -1,5 +1,14 @@
-import { i18nKey, type SecretMintScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { AuthMfaHandlers, MFA_ENABLE_SCREEN_ID } from "./constants";
+import {
+  type ActionFormScreenDefinition,
+  i18nKey,
+  type SecretMintScreenDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AuthMfaHandlers,
+  MFA_DISABLE_SCREEN_ID,
+  MFA_ENABLE_SCREEN_ID,
+  MFA_REGENERATE_RECOVERY_SCREEN_ID,
+} from "./constants";
 
 // Declarative TOTP-enrollment screen: mint (no input) -> reveal QR/secret/
 // recovery-codes -> confirm with a 6-digit code. `setupToken` is carried
@@ -50,3 +59,46 @@ export const mfaEnableScreen: SecretMintScreenDefinition = {
     doneMessage: i18nKey("mfa.enable.confirm.done"),
   },
 };
+
+// Either a 6-digit TOTP code or a 9-char recovery code proves possession —
+// same bounds as the disable/regenerate-recovery handler schemas.
+const possessionCodeField = { type: "text", required: true, maxLength: 9 } as const;
+
+export const mfaDisableScreen: ActionFormScreenDefinition = {
+  id: MFA_DISABLE_SCREEN_ID,
+  type: "actionForm",
+  handler: AuthMfaHandlers.disable,
+  fields: { code: possessionCodeField },
+  layout: { sections: [{ fields: ["code"] }] },
+  submitLabel: i18nKey("mfa.disable.submit"),
+  submitStyle: "danger",
+  cancelTarget: false,
+  access: { openToAll: true },
+  description:
+    "Self-service screen where a signed-in user turns two-factor authentication off by entering a code from their authenticator app or a recovery code; their other sessions and access tokens are signed out.",
+};
+
+export const mfaRegenerateRecoveryScreen: SecretMintScreenDefinition = {
+  id: MFA_REGENERATE_RECOVERY_SCREEN_ID,
+  type: "secretMint",
+  handler: AuthMfaHandlers.regenerateRecovery,
+  fields: { code: possessionCodeField },
+  layout: { sections: [{ fields: ["code"] }] },
+  submitLabel: i18nKey("mfa.regenerate.submit"),
+  cancelTarget: false,
+  access: { openToAll: true },
+  description:
+    "Self-service screen where a signed-in user with two-factor authentication replaces all recovery codes after confirming with a current code; the new codes are shown once.",
+  reveal: {
+    title: i18nKey("mfa.regenerate.reveal.title"),
+    warning: i18nKey("mfa.regenerate.reveal.warning"),
+    fields: [
+      {
+        field: "recoveryCodes",
+        label: i18nKey("mfa.enable.reveal.recoveryCodes"),
+        display: "list",
+        copyable: true,
+      },
+    ],
+  },
+};

package/src/data-retention/__tests__/retention-cleanup.integration.test.ts

@@ -72,7 +72,10 @@ const retainedEntity = createEntity({
     // No subject flag on the old fixture either — anonymize alone has no
     // PersonalAnnotations arm, so this stays a spread instead of a direct
     // createTextField(...) override (kumiko-framework#2250).
-    label: { ...createTextField({ required: true }), anonymize: () => "[ANONYMIZED]" },
+    label: {
+      ...createTextField({ personal: false, reason: "test_fixture", required: true }),
+      anonymize: () => "[ANONYMIZED]",
+    },
   },
   retention: { keepFor: "30d", strategy: "blockDelete" },
 });
@@ -82,7 +85,10 @@ const retainedEntity = createEntity({
 const anonEntity = createEntity({
   table: "read_c7_anon",
   fields: {
-    label: { ...createTextField({ required: true }), anonymize: () => "[ANONYMIZED]" },
+    label: {
+      ...createTextField({ personal: false, reason: "test_fixture", required: true }),
+      anonymize: () => "[ANONYMIZED]",
+    },
     note: createTextField({
       personal: false,
       reason: "is_business_data",

package/src/notes-history/entity.ts

@@ -114,7 +114,12 @@ export function createNoteMentionEntity() {
     description:
       "One row recording that a note names a subject via a structured @-mention, keyed by noteId and the mentioned subject's id.",
     fields: {
-      noteId: createTextField({ required: true, maxLength: 64 }),
+      noteId: createTextField({
+        required: true,
+        maxLength: 64,
+        personal: false,
+        reason: "technical_reference",
+      }),
       subjectId: createTextField({ required: true, maxLength: 64, personal: "ref" }),
     },
   });

package/src/notes-history-user-data/__tests__/mention-forget.integration.test.ts

@@ -60,7 +60,14 @@ function pastInstant(): Instant {
 const CONTACT_TABLE = "notes_mention_forget_test_contacts";
 const contactEntity = createEntity({
   table: CONTACT_TABLE,
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      personal: false,
+      reason: "test_fixture",
+      required: true,
+      maxLength: 64,
+    }),
+  },
 });
 const contactFixtureFeature = defineFeature("notes-mention-forget-test-contact-fixture", (r) => {
   r.entity("contact", contactEntity);

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -300,9 +300,10 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     });
     expect(listRes.status).toBe(200);
     const body = (await listRes.json()) as {
-      data: Array<{ id: string; current: boolean }>;
+      data: { rows: Array<{ id: string; current: boolean }>; nextCursor: string | null };
     };
-    const ids = body.data.map((r) => r.id);
+    expect(body.data.nextCursor).toBeNull();
+    const ids = body.data.rows.map((r) => r.id);
     // Order: most-recently-created first. c was the last login, so it
     // should lead; a (the first login) trails. Pinning the order stops a
     // silent orderBy removal from slipping through.
@@ -310,7 +311,7 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     expect(ids).not.toContain(_b.sid);
 
     // The caller's OWN sid is flagged as current
-    const currentRow = body.data.find((r) => r.current);
+    const currentRow = body.data.rows.find((r) => r.current);
     expect(currentRow?.id).toBe(c.sid);
   });
 
@@ -959,9 +960,9 @@ describe("sessions with active KMS (#820): ip/userAgent are userOwned PII", () =
       });
       expect(res.status).toBe(200);
       const body = (await res.json()) as {
-        data: Array<{ id: string; ip: string | null; userAgent: string | null }>;
+        data: { rows: Array<{ id: string; ip: string | null; userAgent: string | null }> };
       };
-      const manual = body.data.find((s) => s.id === sid);
+      const manual = body.data.rows.find((s) => s.id === sid);
       expect(manual?.ip).toBe("203.0.113.7");
       expect(manual?.userAgent).toBe("TestBrowser/1.0");
     } finally {

package/src/sessions/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.259.0",
+    "type": "breaking",
+    "title": "sessions:query:user-session:mine returns the paged envelope { rows, nextCursor }; new self-service my-sessions screen (fw#2844).",
+    "detail": "The query backs the new `my-sessions` projectionList (open to every signed-in user): the caller's live sessions with a per-row revoke (hidden on the current session) and \"sign out all other devices\". Exported id SESSION_MINE_SCREEN_ID. Server-side scoping to the caller is unchanged.",
+    "migration": "Breaking for direct callers of `sessions:query:user-session:mine`: read `data.rows` instead of treating `data` as the array (`nextCursor` is always null). Account-security custom screens built on this query can be replaced by a dashboard with `kind: \"screen\"` panels on `sessions:screen:my-sessions` and the auth-mfa screens (money-horse#477, publicstatus#435, kumiko-studio#283)."
+  },
   {
     "version": "0.208.2",
     "type": "improvement",

package/src/sessions/constants.ts

@@ -54,3 +54,4 @@ export const LAST_SEEN_REFRESH_MS = 3_600_000;
 
 export const SESSION_LIST_SCREEN_ID = "session-list" as const;
 export const SESSION_DETAIL_SCREEN_ID = "session-detail" as const;
+export const SESSION_MINE_SCREEN_ID = "my-sessions" as const;

package/src/sessions/feature.ts

@@ -14,7 +14,7 @@ import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write";
 import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write";
 import { SESSIONS_I18N } from "./i18n";
 import { userSessionEntity } from "./schema/user-session";
-import { sessionDetailScreen, sessionListScreen } from "./screens";
+import { sessionDetailScreen, sessionListScreen, sessionMineScreen } from "./screens";
 import {
   createSessionCallbacks,
   type SessionAllOthersRevoker,
@@ -209,6 +209,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
 
     r.screen(sessionListScreen);
     r.screen(sessionDetailScreen);
+    r.screen(sessionMineScreen);
     r.nav({
       id: "session-list",
       label: "sessions:nav.sessionList",

package/src/sessions/handlers/mine.query.ts

@@ -1,18 +1,33 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { definePagedQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import { decryptStoredPii } from "../../shared";
 import { userSessionTable } from "../schema/user-session";
 
 // "My live sessions" — the backing data for a devices/sessions UI. Returns
 // ONLY the current user's own, currently-live sessions, ordered by most-
-// recently-used first. Revoked rows excluded (revokedAt IS NULL).
-export const mineQuery = defineQueryHandler({
+// recently-used first. Revoked rows excluded (revokedAt IS NULL). Paged
+// envelope so the self-service projectionList screen can bind to it; a user's
+// live-session count is small, so there is a single page (nextCursor null).
+export const mineQuery = definePagedQueryHandler({
   name: "user-session:mine",
   schema: z.object({}),
   access: { openToAll: true },
   description:
     "Lists the calling user's own still-live sessions, newest first, each flagged whether it is the one making the request; use it to show a user their signed-in devices.",
+  outputSchema: z.object({
+    rows: z.array(
+      z.object({
+        id: z.string(),
+        createdAt: z.unknown(),
+        expiresAt: z.unknown(),
+        ip: z.string().nullable(),
+        userAgent: z.string().nullable(),
+        current: z.boolean(),
+      }),
+    ),
+    nextCursor: z.string().nullable(),
+  }),
   handler: async (query, ctx) => {
     const rows = await selectMany<{
       id: string;
@@ -29,7 +44,7 @@ export const mineQuery = defineQueryHandler({
       },
     );
     const currentSid = query.user.sid;
-    return Promise.all(
+    const decryptedRows = await Promise.all(
       rows.map(async (r) => ({
         id: r.id,
         createdAt: r.createdAt,
@@ -41,5 +56,6 @@ export const mineQuery = defineQueryHandler({
         current: currentSid === r.id,
       })),
     );
+    return { rows: decryptedRows, nextCursor: null };
   },
 });

package/src/sessions/i18n.ts

@@ -20,4 +20,14 @@ export const SESSIONS_I18N: Readonly<Record<string, LocalizedString>> = {
   "sessions.detail.field.revokedAt": { en: "Revoked" },
   "sessions.detail.field.ip": { en: "IP address" },
   "sessions.detail.field.userAgent": { en: "User agent" },
+  "screen:my-sessions.title": { en: "Your sessions" },
+  "sessions.mine.col.ip": { en: "IP address" },
+  "sessions.mine.col.userAgent": { en: "Device" },
+  "sessions.mine.col.current": { en: "This device" },
+  "sessions.mine.revoke": { en: "Sign out" },
+  "sessions.mine.revoke.confirm": { en: "Sign this device out?" },
+  "sessions.mine.revokeAllOthers": { en: "Sign out all other devices" },
+  "sessions.mine.revokeAllOthers.confirm": {
+    en: "Sign out every device except this one?",
+  },
 };

package/src/sessions/index.ts

@@ -1,6 +1,7 @@
 export {
   DEFAULT_SESSION_CACHE_TTL_MS,
   DEFAULT_SESSION_EXPIRY_MS,
+  SESSION_MINE_SCREEN_ID,
   SESSIONS_FEATURE,
   SessionErrors,
   SessionHandlers,

package/src/sessions/screens.ts

@@ -4,7 +4,13 @@ import {
   type ProjectionDetailScreenDefinition,
   type ProjectionListScreenDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { SESSION_DETAIL_SCREEN_ID, SESSION_LIST_SCREEN_ID, SessionQueries } from "./constants";
+import {
+  SESSION_DETAIL_SCREEN_ID,
+  SESSION_LIST_SCREEN_ID,
+  SESSION_MINE_SCREEN_ID,
+  SessionHandlers,
+  SessionQueries,
+} from "./constants";
 
 const listAccess = { roles: access.admin };
 
@@ -88,3 +94,51 @@ export const sessionDetailScreen: ProjectionDetailScreenDefinition = {
   },
   access: listAccess,
 };
+
+// Revoke is hidden on the current session — it would sign the user out mid-click; logout covers it.
+export const sessionMineScreen: ProjectionListScreenDefinition = {
+  id: SESSION_MINE_SCREEN_ID,
+  type: "projectionList",
+  query: SessionQueries.mine,
+  columns: [
+    {
+      field: "createdAt",
+      label: i18nKey("sessions.list.col.createdAt"),
+      renderer: { format: "timestamp" },
+    },
+    {
+      field: "expiresAt",
+      label: i18nKey("sessions.list.col.expiresAt"),
+      renderer: { format: "timestamp" },
+    },
+    { field: "ip", label: i18nKey("sessions.mine.col.ip") },
+    { field: "userAgent", label: i18nKey("sessions.mine.col.userAgent") },
+    {
+      field: "current",
+      label: i18nKey("sessions.mine.col.current"),
+      renderer: { format: "boolean" },
+    },
+  ],
+  rowActions: [
+    {
+      kind: "writeHandler",
+      id: "revoke",
+      label: i18nKey("sessions.mine.revoke"),
+      handler: SessionHandlers.revoke,
+      style: "danger",
+      confirm: i18nKey("sessions.mine.revoke.confirm"),
+      visible: { field: "current", eq: false },
+    },
+  ],
+  toolbarActions: [
+    {
+      kind: "writeHandler",
+      id: "revoke-all-others",
+      label: i18nKey("sessions.mine.revokeAllOthers"),
+      handler: SessionHandlers.revokeAllOthers,
+      style: "danger",
+      confirm: i18nKey("sessions.mine.revokeAllOthers.confirm"),
+    },
+  ],
+  access: { openToAll: true },
+};