@cosmicdrift/kumiko-samples 0.388.0 → 0.390.0

package/packages/bundled-features/src/personal-access-tokens/handlers/create.write.ts

@@ -68,7 +68,7 @@ export function createPatCreateHandler(opts: CreatePatOptions = {}) {
     escapeHatch: {
       grants: ["systemIdentity"],
       reason:
-        "Reads the caller's own passwordHash (privileged-only field) via ctx.queryAs(SYSTEM, " +
+        "Reads the caller's own passwordHash (privileged-only field) via ctx.dispatch.queryAs(SYSTEM, " +
         "user:findForAuth) to re-verify the current password before minting the token. Also " +
         "reads the MFA enrollment of the user being re-authenticated via the mfaVerifier callback.",
     },
@@ -79,7 +79,7 @@ export function createPatCreateHandler(opts: CreatePatOptions = {}) {
     agent: { expose: false },
     handler: async (event, ctx) => {
       const systemUser = createSystemUser(event.user.tenantId);
-      const me = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
+      const me = (await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
         id: event.user.id,
       })) as { passwordHash: string | null } | null; // @cast-boundary db-runner
       if (!me?.passwordHash) return reauthFailed();

package/packages/bundled-features/src/personal-access-tokens/handlers/revoke.write.ts

@@ -39,7 +39,7 @@ export const revokePatWrite = defineWriteHandler({
       // see feature.ts). Without this, the access-invalidation consumer
       // never hears about the revoke and an already-open SSE stream
       // authenticated by this exact token survives it.
-      await ctx.unsafeAppendEvent({
+      await ctx.events.unsafeAppend({
         aggregateId: generateId(),
         aggregateType: PAT_REVOKED_AGGREGATE_TYPE,
         type: PAT_REVOKED_EVENT_QN,

package/packages/bundled-features/src/rate-limiting/handlers/status.query.ts

@@ -37,12 +37,12 @@ export const rateLimitStatus = defineQueryHandler({
     // about the wiring either.
     const denied = bucketAccessDenied(query.payload.bucket, ctx.user);
     if (denied) throw denied;
-    if (!ctx.rateLimit) {
+    if (!ctx.services.rateLimit) {
       throw new UnprocessableError(RateLimitErrors.resolverUnavailable, {
         i18nKey: "rateLimiting.errors.resolverUnavailable",
       });
     }
-    const decision = await ctx.rateLimit.peek(query.payload.bucket, {
+    const decision = await ctx.services.rateLimit.peek(query.payload.bucket, {
       limit: query.payload.limit,
       windowSeconds: query.payload.windowSeconds,
     });

package/packages/bundled-features/src/readiness/handlers/status.query.ts

@@ -36,7 +36,10 @@ export const statusQuery = defineQueryHandler({
 
     // has() is metadata-only: no decryption, no read-audit event — a
     // readiness probe must not pollute the credential-read trail.
-    const secrets = requireSecretsContext(ctx, ReadinessQueries.status);
+    const secrets = requireSecretsContext(
+      { secrets: ctx.services.secrets, user: ctx.user },
+      ReadinessQueries.status,
+    );
     const missingSecrets: ReadinessMissingSecret[] = [];
     for (const [qualifiedName, keyDef] of ctx.registry.getAllSecretKeys()) {
       if (keyDef.required !== true) continue;

package/packages/bundled-features/src/renderer-foundation/api.ts

@@ -87,12 +87,12 @@ function indexByKind(plugins: ReadonlyArray<RendererPlugin>): Map<RenderKind, Re
 // Single source of truth for handlers that require renderer-foundation.
 // The pattern mirrors requireTemplateResolver + requireTextContent.
 export function requireRendererFoundation(
-  ctx: { readonly rendererFoundation?: RendererFoundationApi } | object,
+  ctx: { readonly services: { readonly extensions: Readonly<Record<string, unknown>> } },
   callerName: string,
 ): RendererFoundationApi {
   // @cast-boundary engine-bridge — rendererFoundation kommt per extraContext
-  // from the app bootstrap.
-  const api = (ctx as { rendererFoundation?: RendererFoundationApi }).rendererFoundation;
+  // from the app bootstrap and lands in services.extensions; the framework does not know its type.
+  const api = ctx.services.extensions["rendererFoundation"] as RendererFoundationApi | undefined;
   if (!api) {
     throw new InternalError({
       message:

package/packages/bundled-features/src/secrets/announce-secret-change.ts

@@ -6,8 +6,8 @@ import {
 } from "@cosmicdrift/kumiko-framework/redis";
 
 type AnnouncingContext = {
-  readonly cacheSync?: CacheSyncBus;
-  readonly scheduleAfterCommit?: (hook: () => Promise<void>) => void;
+  readonly services: { readonly cacheSync?: CacheSyncBus };
+  readonly lifecycle: { readonly afterCommit?: (hook: () => Promise<void>) => void };
 };
 
 // Secret writes bypass config:write:*, yet provider caches (e.g. the S3 secret
@@ -18,13 +18,13 @@ export function announceSecretChange(
   tenantId: TenantId,
   key: string,
 ): void {
-  const bus = ctx.cacheSync;
+  const bus = ctx.services.cacheSync;
   // skip: no bus wired (single-process setup), nothing to announce
   if (!bus) return;
   const message: TenantConfigSyncMessage = { tenantId, key };
   const publish = async (): Promise<void> => {
     bus.publish(CACHE_SYNC_TOPICS.tenantConfig, message);
   };
-  if (ctx.scheduleAfterCommit) ctx.scheduleAfterCommit(publish);
+  if (ctx.lifecycle.afterCommit) ctx.lifecycle.afterCommit(publish);
   else bus.publish(CACHE_SYNC_TOPICS.tenantConfig, message);
 }

package/packages/bundled-features/src/secrets/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Feature-prefixed undeclared secret keys are not deletable",
+    "detail": "The delete handler still accepts legacy undeclared keys, but a key starting with \"<feature>:\" of a mounted feature now fails as unknown key. Feature-owned credentials keep their writeRoles protection."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/packages/bundled-features/src/secrets/feature.ts

@@ -70,19 +70,19 @@ export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./
 export const JOIN_REQUEST_TRANSACTION_REASON =
   "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 
-// AppContext carries ctx.secrets via extraContext. requireSecretsContext
+// AppContext carries ctx.services.secrets via extraContext. requireSecretsContext
 // wraps that raw context so every `.get(...)` call automatically includes
 // the current user and handler as audit metadata, preventing feature code
 // from silently bypassing read auditing.
 //
-// The context shape stays minimal: HandlerContext paths (Set/Delete handlers)
-// and FileProviderContext paths (the S3 plugin in the worker) provide the same
-// two fields, so importing the full HandlerContext is unnecessary.
-// Handler contexts carry the caller as ctx.user; provider contexts set
-// auditUserId, which takes precedence.
+// The source shape stays minimal: handler paths pass `{ secrets: ctx.services.secrets,
+// user: ctx.user }`, provider paths (the S3 plugin in the worker) pass `{ secrets, auditUserId }`.
+// `secrets` is a required key on purpose: a whole HandlerContext or JobContext does not carry
+// it flat, so handing one over is a type error instead of a silently undefined secret store.
+// Provider contexts set auditUserId, which takes precedence over the caller in `user`.
 export function requireSecretsContext(
   ctx: {
-    readonly secrets?: SecretsContext;
+    readonly secrets: SecretsContext | undefined;
     readonly auditUserId?: string | undefined;
     readonly user?: { readonly id: string };
   },
@@ -91,7 +91,7 @@ export function requireSecretsContext(
   if (!ctx.secrets) {
     throw new InternalError({
       message:
-        `[${handlerName}] ctx.secrets missing — pass ` +
+        `[${handlerName}] ctx.services.secrets missing — pass ` +
         "createSecretsContext({db, masterKeyProvider, registry}) via extraContext.secrets at boot.",
     });
   }
@@ -187,7 +187,7 @@ export function createSecretsFeature(
     // Read-audit domain-event. Registered here so ops tools + MSPs can
     // discover the type; secrets-context.get parses payloads against
     // `secretReadSchema` at write time because the low-level append() path
-    // skips ctx.appendEvent's schema-validation guard.
+    // skips ctx.events.append's schema-validation guard.
     r.defineEvent("read", secretReadSchema, { piiFields: "none" });
 
     // Per-tenant handlers (set/delete/list) run in the default tenant-scope,

package/packages/bundled-features/src/secrets/handlers/delete.write.ts

@@ -18,9 +18,10 @@ export function createDeleteHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS)
     access,
     escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
     handler: async (event, ctx) => {
-      const secrets = requireSecretsContext(ctx, SecretsHandlers.delete).withRunner(
-        ctx.db.unsafeRaw(),
-      );
+      const secrets = requireSecretsContext(
+        { secrets: ctx.services.secrets, user: ctx.user },
+        SecretsHandlers.delete,
+      ).withRunner(ctx.db.unsafeRaw());
       const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key, {
         allowUndeclared: true,
       });

package/packages/bundled-features/src/secrets/handlers/rotate.job.ts

@@ -61,13 +61,13 @@ export async function rotateJob(
   db: DbConnection,
 ): Promise<void> {
   const payload = rawPayload as RotateJobPayload; // @cast-boundary engine-payload
-  if (!ctx.masterKeyProvider) {
+  if (!ctx.services.masterKeyProvider) {
     throw new InternalError({
       message:
-        "[secrets:rotate] ctx.masterKeyProvider missing — wire it via extraContext.masterKeyProvider at boot.",
+        "[secrets:rotate] ctx.services.masterKeyProvider missing — wire it via extraContext.masterKeyProvider at boot.",
     });
   }
-  const provider = ctx.masterKeyProvider;
+  const provider = ctx.services.masterKeyProvider;
   const batchSize = payload.batchSize ?? DEFAULT_BATCH_SIZE;
   const maxFailures = payload.maxFailures ?? DEFAULT_MAX_FAILURES;
   const deadline = payload.maxDurationMs
@@ -81,7 +81,12 @@ export async function rotateJob(
   function tdbFor(tenantId: TenantId): TenantDb {
     let existing = tdbCache.get(tenantId);
     if (!existing) {
-      existing = createTenantDb({ db, tenantId, mode: "system" });
+      existing = createTenantDb({
+        db,
+        tenantId,
+        mode: "system",
+        reason: "secret key rotation job re-encrypts secrets of every tenant",
+      });
       tdbCache.set(tenantId, existing);
     }
     return existing;
@@ -137,7 +142,7 @@ export async function rotateJob(
     // potentially even past target.
     if (!result.isSuccess) {
       if (result.error.code === "version_conflict") return "skipped";
-      ctx.log?.warn?.(`[secrets:rotate] executor rejected row ${row.id}`, {
+      ctx.obs.log?.warn?.(`[secrets:rotate] executor rejected row ${row.id}`, {
         code: result.error.code,
       });
       return "failed";
@@ -150,9 +155,9 @@ export async function rotateJob(
     migrateRow,
     maxFailures,
     deadlineAt: deadline,
-    signal: ctx.signal,
+    signal: ctx.lifecycle.signal,
     onRowError: (row, err) => {
-      ctx.log?.warn?.(`[secrets:rotate] failed to rotate row ${row.id}`, { err });
+      ctx.obs.log?.warn?.(`[secrets:rotate] failed to rotate row ${row.id}`, { err });
     },
   });
 
@@ -162,5 +167,5 @@ export async function rotateJob(
     batchesProcessed: outcome.batchesProcessed,
     stoppedReason: outcome.stoppedReason,
   };
-  ctx.log?.info?.(`[secrets:rotate] complete: ${JSON.stringify(result)}`);
+  ctx.obs.log?.info?.(`[secrets:rotate] complete: ${JSON.stringify(result)}`);
 }

package/packages/bundled-features/src/secrets/handlers/set.write.ts

@@ -25,9 +25,10 @@ export function createSetHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
     access,
     escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
     handler: async (event, ctx) => {
-      const secrets = requireSecretsContext(ctx, SecretsHandlers.set).withRunner(
-        ctx.db.unsafeRaw(),
-      );
+      const secrets = requireSecretsContext(
+        { secrets: ctx.services.secrets, user: ctx.user },
+        SecretsHandlers.set,
+      ).withRunner(ctx.db.unsafeRaw());
       const { key, value, redactedPreview, hint } = event.payload;
 
       // Preview-priority: explicit payload param > feature-declared redact

package/packages/bundled-features/src/secrets/secrets-context.ts

@@ -1,6 +1,6 @@
-// Feature-level accessor injected as `ctx.secrets` at boot. Not a HTTP API —
+// Feature-level accessor injected as `ctx.services.secrets` at boot. Not a HTTP API —
 // feature code that needs a plaintext secret (SMTP-connect, Stripe-call, …)
-// pulls it via ctx.secrets.get. Cleartext never crosses the wire.
+// pulls it via ctx.services.secrets.get. Cleartext never crosses the wire.
 //
 // Post-ES pivot: all three ops (get/set/delete) flow through the events-
 // table.
@@ -154,7 +154,7 @@ function buildSecretsContext(
         const readId = generateId();
         const metadata: EventMetadata = { userId: auditCtx.userId };
         // Parse against the registered schema so the low-level append
-        // here gets the same validation guarantee as ctx.appendEvent.
+        // here gets the same validation guarantee as ctx.events.append.
         // A payload-shape drift between schema + call-site fails at the
         // source instead of landing on the events-stream.
         const payload = secretReadSchema.parse({
@@ -206,7 +206,12 @@ function buildSecretsContext(
         tenantId,
         roles: SYSTEM_ROLES,
       };
-      const tdb = createTenantDb({ db, tenantId, mode: "system" });
+      const tdb = createTenantDb({
+        db,
+        tenantId,
+        mode: "system",
+        reason: "secrets API writes for a caller-named tenant, outside a request scope",
+      });
 
       const existing = await lookup(tenantId, key);
       const commonFields = {
@@ -271,7 +276,12 @@ function buildSecretsContext(
         tenantId,
         roles: SYSTEM_ROLES,
       };
-      const tdb = createTenantDb({ db, tenantId, mode: "system" });
+      const tdb = createTenantDb({
+        db,
+        tenantId,
+        mode: "system",
+        reason: "secrets API writes for a caller-named tenant, outside a request scope",
+      });
       const result = await executor.delete({ id: existing.id }, actor, tdb);
       return result.isSuccess;
     },
@@ -279,7 +289,7 @@ function buildSecretsContext(
 }
 
 // Wrap an executor-level write failure into a KumikoError so callers of
-// ctx.secrets.set / .delete can still branch on .code / details / i18nKey
+// ctx.services.secrets.set / .delete can still branch on .code / details / i18nKey
 // after it propagates up. Plain `new Error(...)` would have stripped the
 // structured payload the error-contract promises.
 function wrapSetFailure(err: WriteErrorInfo): InternalError {

package/packages/bundled-features/src/secrets/write-gate.ts

@@ -28,6 +28,11 @@ function unknownKeyFailure(key: string): SecretKeyWriteCheck {
   };
 }
 
+function isUnderMountedFeaturePrefix(registry: Registry, key: string): boolean {
+  const separator = key.indexOf(":");
+  return separator > 0 && registry.getFeature(key.slice(0, separator)) !== undefined;
+}
+
 function namespaceAcceptsKey(namespace: SecretNamespaceDefinition, key: string): boolean {
   const suffix = key.slice(namespace.qualifiedPrefix.length);
   if (suffix.length === 0) return false;
@@ -38,7 +43,9 @@ function namespaceAcceptsKey(namespace: SecretNamespaceDefinition, key: string):
 // are writable through the API, so a tenant admin cannot plant arbitrary rows
 // next to the feature-owned ones. writeRoles narrows the handler access
 // further for a key or a whole namespace. Delete passes allowUndeclared: it
-// creates nothing, and legacy rows under since-undeclared keys must stay removable.
+// creates nothing, and legacy rows under since-undeclared keys must stay removable,
+// unless the key sits under a mounted feature's prefix: those rows belong to the
+// feature and must not be removable by a tenant admin outside its writeRoles.
 export function checkSecretKeyWrite(
   registry: Registry,
   userRoles: readonly string[],
@@ -50,7 +57,7 @@ export function checkSecretKeyWrite(
   if (
     !keyDef &&
     !(namespace && namespaceAcceptsKey(namespace, key)) &&
-    options.allowUndeclared !== true
+    (options.allowUndeclared !== true || isUnderMountedFeaturePrefix(registry, key))
   ) {
     return unknownKeyFailure(key);
   }
@@ -70,7 +77,7 @@ export function checkSecretKeyWrite(
   return { ok: true, keyDef };
 }
 
-// The registry surface the value check needs; lets ctx.secrets validate without a full Registry.
+// The registry surface the value check needs; lets ctx.services.secrets validate without a full Registry.
 export type SecretValueSchemaSource = Pick<Registry, "getSecretKey" | "findSecretNamespace">;
 
 // Carries neither the value nor the schema's issues.

package/packages/bundled-features/src/seo/feature.ts

@@ -285,7 +285,7 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
           sitemapEntries: opts.sitemapEntries,
           includeLegalPages: opts.includeLegalPages ?? false,
           hasManagedPages: opts.managedPages !== undefined,
-          log: ctx.log,
+          log: ctx.obs.log,
         }),
     );
 

package/packages/bundled-features/src/sessions/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Session screens show the device without sessionsClient()",
+    "detail": "The list, my-sessions and detail screens showed [object Object] in the device column for apps that do not register sessionsClient(). The session queries (user-session:list, user-session:mine, user-session:detail) now return a deviceLabel string such as \"Chrome 141 · macOS\" next to the unchanged device object, null when the user agent is unknown, and the screens render that field. sessionsClient() only adds the translated \"Unknown device\" for rows without a label."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Sessions tests no longer write projection tables directly",
+    "detail": "The sessions integration tests change tenant memberships and user status through the update-member-roles handler or the event-store executor instead of writing into the projection tables. Nothing changes for apps; the package is only republished."
+  },
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "isPrincipalBlocked is no longer exported from sessions",
+    "detail": "The sessions export dropped its re-export of isPrincipalBlocked, which ignored isDeleted. isPrincipalRowBlocked from the user export covers status and isDeleted and is what the session callbacks use.",
+    "migration": "import isPrincipalRowBlocked (for a user row) or isPrincipalBlocked (for a bare status) from \"@cosmicdrift/kumiko-bundled-features/user\" instead of the sessions export"
+  },
   {
     "version": "0.384.0",
     "type": "improvement",

package/packages/bundled-features/src/sessions/feature.ts

@@ -102,6 +102,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     "sessions",
     (r) => {
       const adminRoles = access[options?.adminAccess ?? "admin"];
+      r.adoptsBundledLists();
       r.describe(
         "Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the same callbacks are also registered as an auth-foundation sessionStore provider, resolvable generically via `resolveSessionStore()`. The feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
       );
@@ -156,7 +157,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       } satisfies SessionStoreProvider);
 
       // Custom domain-event for cross-instance access-invalidation.
-      // r.defineEvent registers the schema so ctx.unsafeAppendEvent (revoke,
+      // r.defineEvent registers the schema so ctx.events.unsafeAppend (revoke,
       // revoke-all-others) enforces it at append time. revoke-all-for-user
       // appends via the low-level append() instead (needs to anchor on
       // SYSTEM_TENANT_ID — see that handler for why) — append() does NOT

package/packages/bundled-features/src/sessions/handlers/cleanup.job.ts

@@ -60,7 +60,7 @@ export async function cleanupJob(
   let stoppedReason: SessionCleanupResult["stoppedReason"] = "empty";
 
   while (true) {
-    if (ctx.signal?.aborted) {
+    if (ctx.lifecycle.signal?.aborted) {
       stoppedReason = "signal";
       break;
     }
@@ -79,5 +79,5 @@ export async function cleanupJob(
   }
 
   const result: SessionCleanupResult = { deleted, batchesProcessed, stoppedReason };
-  ctx.log?.info?.(`[sessions:cleanup] complete: ${JSON.stringify(result)}`);
+  ctx.obs.log?.info?.(`[sessions:cleanup] complete: ${JSON.stringify(result)}`);
 }

package/packages/bundled-features/src/sessions/handlers/detail.query.ts

@@ -3,7 +3,7 @@ import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.ts";
 import { userSessionTable } from "../schema/user-session.ts";
-import { parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
+import { formatDeviceLabel, parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
 
 // Admin single-session inspector — mirrors list.query's decrypt handling for
 // the one-row case. ctx.db (TenantDb) applies tenant-scoping automatically.
@@ -16,6 +16,7 @@ const sessionRowSchema = z.object({
   ip: z.string().nullable(),
   userAgent: z.string().nullable(),
   device: parsedDeviceSchema,
+  deviceLabel: z.string().nullable(),
 });
 
 export const createDetailQuery = (adminRoles: readonly string[] = access.admin) =>
@@ -42,6 +43,7 @@ export const createDetailQuery = (adminRoles: readonly string[] = access.admin)
       const userAgent = row.userAgent
         ? await decryptStoredPii(row.userAgent, "userAgent", "sessions:detail")
         : row.userAgent;
+      const device = parseUserAgent(userAgent);
       return {
         id: row.id,
         userId: row.userId,
@@ -50,7 +52,8 @@ export const createDetailQuery = (adminRoles: readonly string[] = access.admin)
         revokedAt: row.revokedAt,
         ip: row.ip ? await decryptStoredPii(row.ip, "ip", "sessions:detail") : row.ip,
         userAgent,
-        device: parseUserAgent(userAgent),
+        device,
+        deviceLabel: formatDeviceLabel(device),
       };
     },
   });

package/packages/bundled-features/src/sessions/handlers/list.query.ts

@@ -8,7 +8,7 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.ts";
 import { userSessionTable } from "../schema/user-session.ts";
-import { parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
+import { formatDeviceLabel, parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
 
 // `sort` arrives raw from the client's query string. selectMany's orderBy
 // has no column-existence check — an unrecognised field just gets
@@ -49,6 +49,7 @@ export const createListQuery = (adminRoles: readonly string[] = access.admin) =>
           ip: z.string().nullable(),
           userAgent: z.string().nullable(),
           device: parsedDeviceSchema,
+          deviceLabel: z.string().nullable(),
         }),
       ),
       nextCursor: z.string().nullable(),
@@ -85,6 +86,7 @@ export const createListQuery = (adminRoles: readonly string[] = access.admin) =>
           const userAgent = r.userAgent
             ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:list")
             : r.userAgent;
+          const device = parseUserAgent(userAgent);
           return {
             id: r.id,
             userId: r.userId,
@@ -93,7 +95,8 @@ export const createListQuery = (adminRoles: readonly string[] = access.admin) =>
             revokedAt: r.revokedAt,
             ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:list") : r.ip,
             userAgent,
-            device: parseUserAgent(userAgent),
+            device,
+            deviceLabel: formatDeviceLabel(device),
           };
         }),
       );

package/packages/bundled-features/src/sessions/handlers/mine.query.ts

@@ -3,7 +3,7 @@ import { definePagedQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.ts";
 import { userSessionTable } from "../schema/user-session.ts";
-import { parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
+import { formatDeviceLabel, parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
 
 // "My live sessions" — the backing data for a devices/sessions UI. Returns
 // ONLY the current user's own, currently-live sessions, ordered by most-
@@ -31,6 +31,7 @@ export const mineQuery = definePagedQueryHandler({
         ip: z.string().nullable(),
         userAgent: z.string().nullable(),
         device: parsedDeviceSchema,
+        deviceLabel: z.string().nullable(),
         current: z.boolean(),
       }),
     ),
@@ -57,13 +58,15 @@ export const mineQuery = definePagedQueryHandler({
         const userAgent = r.userAgent
           ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:mine")
           : r.userAgent;
+        const device = parseUserAgent(userAgent);
         return {
           id: r.id,
           createdAt: r.createdAt,
           expiresAt: r.expiresAt,
           ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:mine") : r.ip,
           userAgent,
-          device: parseUserAgent(userAgent),
+          device,
+          deviceLabel: formatDeviceLabel(device),
           current: currentSid === r.id,
         };
       }),

package/packages/bundled-features/src/sessions/handlers/revoke-all-for-user.write.ts

@@ -67,9 +67,9 @@ export const revokeAllForUserWrite = defineWriteHandler({
     // Lightweight append alongside the direct-write above; see revoke.write.ts
     // for why this isn't a lifecycle event on
     // store_user_sessions. Uses the low-level append() (not
-    // ctx.unsafeAppendEvent) because this handler is deliberately
+    // ctx.events.unsafeAppend) because this handler is deliberately
     // cross-tenant: the privileged caller's own tenantId (what
-    // ctx.unsafeAppendEvent would bind to) has no relationship to the
+    // ctx.events.unsafeAppend would bind to) has no relationship to the
     // target user's session tenant(s). Anchored on SYSTEM_TENANT_ID
     // instead, same as the jobs feature's cross-tenant run-lifecycle
     // events (job-run-logger.ts) — a fresh aggregate per call, so no
@@ -77,7 +77,7 @@ export const revokeAllForUserWrite = defineWriteHandler({
     //
     // append() itself does NOT validate against the r.defineEvent-
     // registered schema (that guarantee only comes from going through
-    // ctx.unsafeAppendEvent's dispatcher path). Mirrors job-run-logger.ts:
+    // ctx.events.unsafeAppend's dispatcher path). Mirrors job-run-logger.ts:
     // parse explicitly before the raw append so a shape drift fails loudly
     // here instead of landing unvalidated on the events table.
     if (updated.length > 0) {

package/packages/bundled-features/src/sessions/handlers/revoke-all-others.write.ts

@@ -51,7 +51,7 @@ export const revokeAllOthersWrite = defineWriteHandler({
     // store_user_sessions. Skipped when nothing was revoked (no other
     // live sessions) — a spurious invalidation would be the failure mode.
     if (updated.length > 0) {
-      await ctx.unsafeAppendEvent({
+      await ctx.events.unsafeAppend({
         aggregateId: generateId(),
         aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
         type: SESSION_REVOKED_EVENT_QN,

package/packages/bundled-features/src/sessions/handlers/revoke.write.ts

@@ -55,7 +55,7 @@ export const revokeWrite = defineWriteHandler({
       // unmanaged direct-write store, see feature.ts). Own aggregate id per
       // revoke, no predecessor to satisfy, no version_conflict against a
       // concurrent revoke on a different sid.
-      await ctx.unsafeAppendEvent({
+      await ctx.events.unsafeAppend({
         aggregateId: generateId(),
         aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
         type: SESSION_REVOKED_EVENT_QN,

package/packages/bundled-features/src/sessions/index.ts

@@ -15,7 +15,7 @@ export type {
   SessionCallbacksOptions,
   SessionMassRevoker,
 } from "./session-callbacks.ts";
-export { createSessionCallbacks, isPrincipalBlocked } from "./session-callbacks.ts";
+export { createSessionCallbacks } from "./session-callbacks.ts";
 export type { SessionRevokedPayload } from "./session-revoked-event.ts";
 export {
   SESSION_REVOKED_AGGREGATE_TYPE,

package/packages/bundled-features/src/sessions/screens.ts

@@ -39,7 +39,7 @@ export const createSessionListScreen = (
       refLabelField: "displayName",
     },
     {
-      field: "device",
+      field: "deviceLabel",
       label: i18nKey("sessions.list.col.device"),
       renderer: DEVICE_RENDERER,
     },
@@ -94,7 +94,7 @@ export const createSessionDetailScreen = (
           { field: "createdAt", renderer: { format: "timestamp" } },
           { field: "expiresAt", renderer: { format: "timestamp" } },
           { field: "revokedAt", renderer: { format: "timestamp" } },
-          { field: "device", renderer: DEVICE_RENDERER },
+          { field: "deviceLabel", renderer: DEVICE_RENDERER },
           "ip",
           "userAgent",
         ],
@@ -107,7 +107,7 @@ export const createSessionDetailScreen = (
     createdAt: i18nKey("sessions.detail.field.createdAt"),
     expiresAt: i18nKey("sessions.detail.field.expiresAt"),
     revokedAt: i18nKey("sessions.detail.field.revokedAt"),
-    device: i18nKey("sessions.list.col.device"),
+    deviceLabel: i18nKey("sessions.list.col.device"),
     ip: i18nKey("sessions.detail.field.ip"),
     userAgent: i18nKey("sessions.detail.field.userAgent"),
   },
@@ -120,7 +120,11 @@ export const sessionMineScreen: ProjectionListScreenDefinition = {
   type: "projectionList",
   query: SessionQueries.mine,
   columns: [
-    { field: "device", label: i18nKey("sessions.mine.col.userAgent"), renderer: DEVICE_RENDERER },
+    {
+      field: "deviceLabel",
+      label: i18nKey("sessions.mine.col.userAgent"),
+      renderer: DEVICE_RENDERER,
+    },
     { field: "ip", label: i18nKey("sessions.mine.col.ip") },
     {
       field: "current",

package/packages/bundled-features/src/sessions/session-callbacks.ts

@@ -18,12 +18,7 @@ import { generateId, parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { encryptForDirectWrite } from "../shared/index.ts";
 import { tenantMembershipsTable } from "../tenant/index.ts";
-import {
-  isPrincipalBlocked,
-  isPrincipalRowBlocked,
-  type UserStatus,
-  userTable,
-} from "../user/index.ts";
+import { isPrincipalRowBlocked, type UserStatus, userTable } from "../user/index.ts";
 import {
   DEFAULT_SESSION_EXPIRY_MS,
   LAST_SEEN_REFRESH_MS,
@@ -36,9 +31,6 @@ import {
   sessionRevokedSchema,
 } from "./session-revoked-event.ts";
 
-// Re-exported so existing `../sessions` importers keep working unchanged.
-export { isPrincipalBlocked };
-
 type SettledLookup<T> = { readonly ok: true; readonly value: T } | { readonly ok: false };
 
 function settleLookup<T>(lookup: Promise<T>): Promise<SettledLookup<T>> {