@cosmicdrift/kumiko-bundled-features 0.113.1 → 1.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.113.1",
+  "version": "1.0.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -77,8 +77,6 @@
     "./secrets": "./src/secrets/index.ts",
     "./sessions": "./src/sessions/index.ts",
     "./sessions/testing": "./src/sessions/testing.ts",
-    "./personal-access-tokens": "./src/personal-access-tokens/index.ts",
-    "./personal-access-tokens/web": "./src/personal-access-tokens/web/index.ts",
     "./feature-toggles": "./src/feature-toggles/index.ts",
     "./text-content": "./src/text-content/index.ts",
     "./text-content/seeding": "./src/text-content/seeding.ts",
@@ -95,11 +93,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.113.1",
-    "@cosmicdrift/kumiko-framework": "0.113.1",
-    "@cosmicdrift/kumiko-headless": "0.113.1",
-    "@cosmicdrift/kumiko-renderer": "0.113.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.113.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "1.0.0",
+    "@cosmicdrift/kumiko-framework": "1.0.0",
+    "@cosmicdrift/kumiko-headless": "1.0.0",
+    "@cosmicdrift/kumiko-renderer": "1.0.0",
+    "@cosmicdrift/kumiko-renderer-web": "1.0.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/__tests__/account-lockout-no-redis.integration.test.ts

@@ -13,6 +13,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -21,7 +22,6 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -42,8 +42,8 @@ const systemAdmin = TestUsers.systemAdmin;
 const encryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/account-lockout.integration.test.ts

@@ -12,6 +12,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -20,7 +21,6 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -48,8 +48,8 @@ const MAX_ATTEMPTS = 3;
 const LOCK_MINUTES = 1;
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/auth-claims.integration.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -11,7 +12,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher, seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -67,8 +68,8 @@ const segmentsByUserAndTenant = new Map<string, string>();
 const plansByTenant = new Map<TenantId, string>();
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [
@@ -259,8 +260,8 @@ describe("scenario 2: switch-tenant recomputes claims (no stale tenant-A claims
 
 describe("scenario 2.5: reserved separator + multi-feature isolation", () => {
   test("one feature returns key with ':' → only that key dropped, other features merge cleanly", async () => {
-    const localEncryption = createTestEnvelopeCipher(encryptionKey);
-    const localResolver = createConfigResolver({ cipher: localEncryption });
+    const localEncryption = createEncryptionProvider(encryptionKey);
+    const localResolver = createConfigResolver({ encryption: localEncryption });
     // A polluted feature that tries to smuggle in a qualified-name-shaped
     // inner key (injecting ":" would otherwise let it spoof another
     // feature's prefix). Plus a clean companion to prove the drop is
@@ -336,8 +337,8 @@ describe("scenario 2.5: reserved separator + multi-feature isolation", () => {
 
 describe("scenario 2.6: multi-feature drift warnings fire independently", () => {
   test("feature A + feature B both return undeclared keys → each logs its own warning", async () => {
-    const localEncryption = createTestEnvelopeCipher(encryptionKey);
-    const localResolver = createConfigResolver({ cipher: localEncryption });
+    const localEncryption = createEncryptionProvider(encryptionKey);
+    const localResolver = createConfigResolver({ encryption: localEncryption });
 
     // Capture warn() calls to verify drift warnings fire per-feature, not
     // globally collapsed.
@@ -424,8 +425,8 @@ describe("scenario 2.6: multi-feature drift warnings fire independently", () =>
 
 describe("scenario 3: a broken claims hook does not break login", () => {
   test("hook throws → login still succeeds, broken feature simply contributes nothing, warn logged with featureName+err", async () => {
-    const localEncryption = createTestEnvelopeCipher(encryptionKey);
-    const localResolver = createConfigResolver({ cipher: localEncryption });
+    const localEncryption = createEncryptionProvider(encryptionKey);
+    const localResolver = createConfigResolver({ encryption: localEncryption });
 
     // Capture warn-calls so the test can verify the resolver actually
     // logged the broken hook with featureName + err.message — previously

package/src/auth-email-password/__tests__/auth.integration.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createTestUser,
@@ -12,7 +13,6 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
-  createTestEnvelopeCipher,
   expectErrorIncludes,
   getSetCookieRaw,
   getSetCookieValue,
@@ -37,8 +37,8 @@ const systemAdmin = TestUsers.systemAdmin;
 const encryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [
@@ -374,8 +374,8 @@ describe("scenario 7b: login rate limiting", () => {
   let rlStack: TestStack;
 
   beforeAll(async () => {
-    const encryption = createTestEnvelopeCipher(encryptionKey);
-    const resolver = createConfigResolver({ cipher: encryption });
+    const encryption = createEncryptionProvider(encryptionKey);
+    const resolver = createConfigResolver({ encryption });
     const { createInMemoryLoginRateLimiter } = await import("@cosmicdrift/kumiko-framework/api");
 
     rlStack = await setupTestStack({

package/src/auth-email-password/__tests__/email-verification.integration.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -9,11 +10,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import {
-  createTestEnvelopeCipher,
-  seedRow,
-  updateRows,
-} from "@cosmicdrift/kumiko-framework/testing";
+import { seedRow, updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
@@ -53,8 +50,8 @@ const appVerifyUrl = "https://app.example.com/verify";
 const appResetUrl = "https://app.example.com/reset";
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/identity-v3-login.integration.test.ts

@@ -8,6 +8,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { pbkdf2Sync, randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -17,7 +18,6 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -50,8 +50,8 @@ function buildBmcStyleV3Hash(password: string, salt: Buffer): string {
 }
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/password-reset.integration.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -9,7 +10,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher, seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
@@ -50,8 +51,8 @@ const resetSecret = randomBytes(32).toString("base64");
 const appResetUrl = "https://app.example.com/reset";
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/public-routes-rate-limit.integration.test.ts

@@ -7,13 +7,13 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -40,8 +40,8 @@ const resetSecret = randomBytes(32).toString("base64");
 const verifySecret = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/session-callbacks.integration.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -9,7 +10,6 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import * as jose from "jose";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -90,8 +90,8 @@ const TENANT_A: TenantId = "00000000-0000-4000-8000-0000000000a1";
 const TENANT_B: TenantId = "00000000-0000-4000-8000-0000000000b1";
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
 
   store = createFakeStore();
   sidStream = deterministicSids();

package/src/auth-email-password/constants.ts

@@ -6,10 +6,6 @@
 // der server-side Zugriff (handlers, dispatcher) erhalten.
 export const AUTH_EMAIL_PASSWORD_FEATURE = "auth-email-password" as const;
 
-// Minimum length for reset/verify hmacSecret — mirrors the ≥32-char
-// JWT_SECRET env check (HMAC-SHA256 key material).
-export const MIN_HMAC_SECRET_LENGTH = 32;
-
 // Qualified handler names. Non-CRUD handlers, no entity prefix.
 export const AuthHandlers = {
   login: "auth-email-password:write:login",

package/src/auth-email-password/feature.ts

@@ -1,6 +1,5 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
-import { MIN_HMAC_SECRET_LENGTH } from "./constants";
 import type { AuthMailLocale } from "./email-templates";
 import { changePasswordWrite } from "./handlers/change-password.write";
 import { createInviteAcceptHandler } from "./handlers/invite-accept.write";
@@ -123,17 +122,14 @@ export type AuthEmailPasswordOptions = {
 export function createAuthEmailPasswordFeature(
   opts: AuthEmailPasswordOptions = {},
 ): FeatureDefinition {
-  // ≥32 chars, symmetric to the JWT_SECRET env check: a short HMAC secret
-  // makes reset/verify tokens forgeable — that's account takeover, so the
-  // factory fails fast instead of trusting the caller.
-  if (opts.passwordReset && opts.passwordReset.hmacSecret.length < MIN_HMAC_SECRET_LENGTH) {
+  if (opts.passwordReset && !opts.passwordReset.hmacSecret) {
     throw new Error(
-      `[auth-email-password] passwordReset.hmacSecret must be ≥${MIN_HMAC_SECRET_LENGTH} chars (HMAC-SHA256 token signing)`,
+      "[auth-email-password] passwordReset.hmacSecret must be non-empty when passwordReset is configured",
     );
   }
-  if (opts.emailVerification && opts.emailVerification.hmacSecret.length < MIN_HMAC_SECRET_LENGTH) {
+  if (opts.emailVerification && !opts.emailVerification.hmacSecret) {
     throw new Error(
-      `[auth-email-password] emailVerification.hmacSecret must be ≥${MIN_HMAC_SECRET_LENGTH} chars (HMAC-SHA256 token signing)`,
+      "[auth-email-password] emailVerification.hmacSecret must be non-empty when emailVerification is configured",
     );
   }
 

package/src/auth-email-password/handlers/change-password.write.ts

@@ -1,11 +1,7 @@
-import {
-  access,
-  createSystemUser,
-  defineWriteHandler,
-  SYSTEM_TENANT_ID,
-} from "@cosmicdrift/kumiko-framework/engine";
+import { access, createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { getAggregateStreamTenant } from "@cosmicdrift/kumiko-framework/event-store";
 import { z } from "zod";
-import { UserHandlers, UserQueries } from "../../user";
+import { USER_FEATURE, UserHandlers, UserQueries } from "../../user";
 import { invalidCredentials } from "../errors";
 import { hashPassword, verifyPassword } from "../password-hashing";
 
@@ -39,10 +35,14 @@ export const changePasswordWrite = defineWriteHandler({
 
     const newHash = await hashPassword(event.payload.newPassword);
 
-    // The user aggregate is systemStream (#497): its event stream lives on
-    // SYSTEM_TENANT_ID deterministically. Pre-#497 scattered streams need the
-    // one-time backfillUserStreamTenants migration (#762).
-    const writer = createSystemUser(SYSTEM_TENANT_ID);
+    // The user aggregate is r.systemScope(): its event stream can live in a
+    // tenant that isn't the session tenant (a platform operator's stream sits
+    // in the seed executor's tenant, not their membership). Write against the
+    // real stream tenant so optimistic locking targets the right stream instead
+    // of version_conflict-ing against an empty one. Falls back to the session
+    // tenant when the lookup finds nothing (fresh/unknown stream).
+    const streamTenant = await getAggregateStreamTenant(ctx.db.raw, event.user.id, USER_FEATURE);
+    const writer = createSystemUser(streamTenant ?? event.user.tenantId);
 
     // Apply via user feature's update handler — writeAs(system) satisfies
     // the privileged-only write rule on passwordHash. Pass the current version

package/src/auth-email-password/handlers/confirm-token-flow.ts

@@ -5,8 +5,9 @@
 //   1. Redis check + burn (single-use enforcement)
 //   2. Load user + deleted/missing/no-version guard
 //   3. Optional idempotent short-circuit (verify-email when already done)
-//   4. Apply the handler-specific `changes` on the user's SYSTEM stream
-//   5. Release the burn on ANY non-success path so a legit retry isn't
+//   4. Resolve memberships → tenant-order for stream-matching
+//   5. Try each tenant's stream with the handler-specific `changes`
+//   6. Release the burn on ANY non-success path so a legit retry isn't
 //      locked out by a stale marker
 //
 // The top-level `runConfirmTokenFlow` orchestrates and owns the
@@ -14,26 +15,26 @@
 // burn (success, already-done) flips `committed = true`; everything
 // else — including future branches a maintainer adds — releases
 // automatically.
-//
-// The user aggregate is systemStream (#497): its event stream lives on
-// SYSTEM_TENANT_ID deterministically, so the write targets exactly one
-// stream. The former membership-probing (`tryWriteAcrossTenants`) existed
-// for pre-#497 scattered streams; those need the one-time
-// backfillUserStreamTenants migration (#762) — probing them stopped working
-// the moment the executor's stream choke-point landed anyway.
 
 import {
   createSystemUser,
   type HandlerContext,
   type SessionUser,
   SYSTEM_TENANT_ID,
+  type TenantId,
   type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  InternalError,
+  type WriteFailure,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import { getAggregateStreamTenant } from "@cosmicdrift/kumiko-framework/event-store";
 import type Redis from "ioredis";
-import { UserHandlers, UserQueries } from "../../user";
+import { USER_FEATURE, UserHandlers, UserQueries } from "../../user";
 import type { AuthUserRow } from "../auth-user-row";
 import { parseAuthUserRow } from "../auth-user-row";
+import { orderTenantsByPreference } from "../stream-tenant";
 import { burnToken, unburnToken } from "../token-burn-store";
 
 export type ConfirmTokenFlowSpec<TSuccessData> = {
@@ -45,11 +46,13 @@ export type ConfirmTokenFlowSpec<TSuccessData> = {
   // is misconfigured, not the caller's fault.
   readonly redisRequiredMessage: string;
   // Standard failure returned for every "token can't be consumed" path
-  // (bad state, version conflict on the stream). The route layer returns
-  // 422 with a uniform code so the caller can't tell which branch fired.
+  // (bad state, missing memberships, every tenant rejected). The route
+  // layer returns 422 with a uniform code so the caller can't tell which
+  // branch fired.
   readonly invalidToken: () => ReturnType<typeof writeFailure>;
-  // Handler-specific payload for user:update. Runs once per token. Can be
-  // async (password-reset hashes here).
+  // Handler-specific payload for user:update. Runs once per token — the
+  // result is shared across every tenant-stream attempt. Can be async
+  // (password-reset hashes here).
   readonly buildChanges: (me: AuthUserRow) => Promise<Record<string, unknown>>;
   // Returned verbatim on a successful write.
   readonly successData: TSuccessData;
@@ -93,21 +96,20 @@ export async function runConfirmTokenFlow<TSuccessData>(
       return { isSuccess: true, data: spec.alreadyDone.data };
     }
 
+    const tenantOrder = await resolveStreamTenants(ctx, systemUser, me);
+    if (tenantOrder.length === 0) return spec.invalidToken();
+
     const changes = await spec.buildChanges(me);
-    const writeRes = await ctx.writeAs(systemUser, UserHandlers.update, {
-      id: me.id,
-      version: me.version,
-      changes,
-    });
-    if (writeRes.isSuccess) {
+    const writeResult = await tryWriteAcrossTenants(ctx, me, tenantOrder, changes);
+    if (writeResult.isSuccess) {
       committed = true;
       return { isSuccess: true, data: spec.successData };
     }
-    // version_conflict = concurrent modification (or an un-migrated pre-#497
-    // stream, see header) → token-level failure. Anything else (DB down,
-    // access denied) bubbles unchanged so ops sees the real failure class.
-    if (writeRes.error.code === "version_conflict") return spec.invalidToken();
-    return writeRes;
+    // `all_conflicts` = every tenant returned version_conflict → token-level
+    // failure. `hard_failure` = a real write error (DB down, access
+    // denied) that bubbles unchanged.
+    if (writeResult.reason === "all_conflicts") return spec.invalidToken();
+    return writeResult.failure;
   } finally {
     // committed===false covers EVERY failure path — including branches a
     // future maintainer adds without reading this file. The original
@@ -119,13 +121,14 @@ export async function runConfirmTokenFlow<TSuccessData>(
   }
 }
 
+// --- Private helpers ------------------------------------------------------
+
 // Fetches the user row via the privileged findForAuth query and validates
-// it's usable for a write: not deleted, has a row.version >= 1 (a row
-// without any event stream — e.g. inserted straight into read_users — must
-// not be confirmable: the write would otherwise seed a fresh stream with a
-// bare user.updated). Return type narrows `version` to `number` so the
-// write-callsite doesn't need a `?? 0` fallback — the guard lives here,
-// not at every callsite.
+// it's usable for a write: not deleted, has a row.version (the version
+// column is a findForAuth contract field — absence is a schema bug, but
+// we still handle it gracefully rather than throwing past the burn).
+// Return type narrows `version` to `number` so the write-callsite doesn't
+// need a `?? 0` fallback — the guard lives here, not at every callsite.
 async function loadValidatedUser(
   ctx: HandlerContext,
   systemUser: SessionUser,
@@ -134,6 +137,74 @@ async function loadValidatedUser(
   const me = parseAuthUserRow(
     await ctx.queryAs(systemUser, UserQueries.findForAuth, { id: userId }),
   );
-  if (!me || me.isDeleted || me.version === undefined || me.version < 1) return null;
+  if (!me || me.isDeleted || me.version === undefined) return null;
   return { ...me, version: me.version };
 }
+
+// Loads the user's memberships and returns a prioritised tenant list, with the
+// aggregate's real stream tenant recovered from the event log prepended.
+//
+// Empty only when the user has NO memberships AND no recoverable stream tenant
+// — the caller treats that as invalid_token. A zero-membership systemScope user
+// whose stream lives outside any membership (a platform operator seeded under a
+// fixture/SYSTEM tenant) still resolves, because the stream-tenant lookup runs
+// before the empty check rather than being short-circuited by it.
+async function resolveStreamTenants(
+  ctx: HandlerContext,
+  systemUser: SessionUser,
+  me: AuthUserRow,
+): Promise<readonly TenantId[]> {
+  const memberships = (await ctx.queryAs(systemUser, "tenant:query:memberships", {
+    userId: me.id,
+  })) as Array<{ tenantId: TenantId }>; // @cast-boundary db-runner
+  const ordered = orderTenantsByPreference(memberships, me.lastActiveTenantId);
+
+  // The user aggregate is r.systemScope(): its event stream lives in whichever
+  // tenant the creating executor used, which need NOT be a membership tenant.
+  // A platform operator seeded under a fixture/platform tenant is the live case
+  // — its stream tenant is absent from `ordered`, so a membership-only search
+  // rejects every write and collapses to invalid_token. Recover the real stream
+  // tenant from the event log and try it first; memberships stay as fallback.
+  // Pulled BEFORE the empty-membership check so a zero-membership operator whose
+  // stream lives in SYSTEM_TENANT is recoverable instead of collapsing to
+  // invalid_token — mirrors change-password.write.ts's unconditional recovery.
+  const streamTenant = await getAggregateStreamTenant(ctx.db.raw, me.id, USER_FEATURE);
+  if (streamTenant && !ordered.includes(streamTenant)) {
+    return [streamTenant, ...ordered];
+  }
+  return ordered;
+}
+
+// Discriminated result for the write-across-tenants loop.
+//   all_conflicts → every candidate rejected with version_conflict →
+//                   token-level failure; caller returns invalidToken.
+//   hard_failure  → a non-conflict error that should bubble unchanged
+//                   (DB down, access denied, …); caller returns it as-is.
+type TenantWriteResult =
+  | { isSuccess: true }
+  | { isSuccess: false; reason: "all_conflicts" }
+  | { isSuccess: false; reason: "hard_failure"; failure: WriteFailure };
+
+// Attempts the update against each candidate stream. memberships-query
+// has no deterministic ORDER BY, so the matching stream is discovered by
+// attempt: version_conflict → try the next candidate, anything else →
+// bubble immediately so ops sees the real failure class.
+async function tryWriteAcrossTenants(
+  ctx: HandlerContext,
+  me: AuthUserRow & { version: number },
+  tenantOrder: readonly TenantId[],
+  changes: Record<string, unknown>,
+): Promise<TenantWriteResult> {
+  for (const tenantId of tenantOrder) {
+    const writeRes = await ctx.writeAs(createSystemUser(tenantId), UserHandlers.update, {
+      id: me.id,
+      version: me.version,
+      changes,
+    });
+    if (writeRes.isSuccess) return { isSuccess: true };
+    if (writeRes.error.code !== "version_conflict") {
+      return { isSuccess: false, reason: "hard_failure", failure: writeRes };
+    }
+  }
+  return { isSuccess: false, reason: "all_conflicts" };
+}

package/src/auth-email-password/handlers/login.write.ts

@@ -21,7 +21,7 @@ import {
   noMembership,
 } from "../errors";
 import { clearLockoutState, getLockoutState, recordFailedAttempt } from "../lockout-store";
-import { verifyDummyPassword, verifyPassword } from "../password-hashing";
+import { verifyPassword } from "../password-hashing";
 
 export type LoginHandlerOptions = {
   // When true, a valid (email + password) login fails with email_not_verified
@@ -74,9 +74,6 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
       // Uniform response on any credential mismatch (no user, wrong password,
       // soft-deleted user) — prevents email enumeration.
       if (!found?.passwordHash || found.isDeleted) {
-        // Burn the same argon2 verify cost as the hit path so response
-        // latency doesn't reveal whether the email is registered (#774).
-        await verifyDummyPassword(event.payload.password);
         return invalidCredentials();
       }
 

package/src/auth-email-password/password-hashing.ts

@@ -42,14 +42,3 @@ export async function verifyPassword(hashString: string, password: string): Prom
     return false;
   }
 }
-
-// Anti-enumeration timing equaliser (#774). The login handler runs this on
-// the no-user / no-hash path so a missing account costs the same argon2
-// latency as a real verify — otherwise response timing leaks whether an
-// email is registered. Derived from hashPassword once and cached, so it
-// always tracks HASH_OPTIONS; the password never matches, result discarded.
-let dummyHash: Promise<string> | undefined;
-export async function verifyDummyPassword(password: string): Promise<void> {
-  dummyHash ??= hashPassword("anti-enumeration-dummy");
-  await verifyPassword(await dummyHash, password);
-}