@cosmicdrift/kumiko-bundled-features 0.165.1 → 0.165.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.165.1",
+  "version": "0.165.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -119,11 +119,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.165.1",
-    "@cosmicdrift/kumiko-framework": "0.165.1",
-    "@cosmicdrift/kumiko-headless": "0.165.1",
-    "@cosmicdrift/kumiko-renderer": "0.165.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.165.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.165.2",
+    "@cosmicdrift/kumiko-framework": "0.165.2",
+    "@cosmicdrift/kumiko-headless": "0.165.2",
+    "@cosmicdrift/kumiko-renderer": "0.165.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.165.2",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",
@@ -148,7 +148,7 @@
     "LICENSE"
   ],
   "peerDependencies": {
-    "@cosmicdrift/kumiko-types": "^0.165.1"
+    "@cosmicdrift/kumiko-types": "^0.165.2"
   },
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",

package/src/__tests__/access-invalidation-stream.integration.test.ts

@@ -172,13 +172,7 @@ describe("access-invalidation mid-stream SSE teardown (#1561)", () => {
 
     releaseNextChunk?.();
 
-    let thrown: unknown;
-    try {
-      await iter.next();
-    } catch (e) {
-      thrown = e;
-    }
-    expect(thrown).toMatchObject({ code: "access_denied" });
+    await expect(iter.next()).rejects.toMatchObject({ code: "access_denied" });
   });
 
   test("tenant role strip mid-stream terminates the open HTTP SSE stream", async () => {
@@ -206,12 +200,6 @@ describe("access-invalidation mid-stream SSE teardown (#1561)", () => {
 
     releaseNextChunk?.();
 
-    let thrown: unknown;
-    try {
-      await iter.next();
-    } catch (e) {
-      thrown = e;
-    }
-    expect(thrown).toMatchObject({ code: "access_denied" });
+    await expect(iter.next()).rejects.toMatchObject({ code: "access_denied" });
   });
 });

package/src/auth-email-password/__tests__/login-gates.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, test } from "bun:test";
+import { USER_STATUS } from "../../user";
+import type { AuthUserRow } from "../auth-user-row";
+import { gateEnforceAccountStatus, gateEnforceEmailVerified } from "../handlers/login.write";
+
+function row(over: Partial<AuthUserRow> = {}): AuthUserRow {
+  return { id: "00000000-0000-4000-8000-000000000001", passwordHash: "x", ...over };
+}
+
+describe("login.write gates (fw#1284)", () => {
+  test("gateEnforceEmailVerified rejects when strict and unverified", () => {
+    const g = gateEnforceEmailVerified(row({ emailVerified: false }), true);
+    expect(g.ok).toBe(false);
+    if (!g.ok) expect(g.result.isSuccess).toBe(false);
+  });
+
+  test("gateEnforceEmailVerified passes when not strict", () => {
+    expect(gateEnforceEmailVerified(row({ emailVerified: false }), false).ok).toBe(true);
+  });
+
+  test("gateEnforceAccountStatus rejects restricted", () => {
+    const g = gateEnforceAccountStatus(row({ status: USER_STATUS.Restricted }));
+    expect(g.ok).toBe(false);
+  });
+
+  test("gateEnforceAccountStatus rejects deletion_requested as invalid_creds shape", () => {
+    const g = gateEnforceAccountStatus(row({ status: USER_STATUS.DeletionRequested }));
+    expect(g.ok).toBe(false);
+    if (!g.ok) {
+      expect(g.result.isSuccess).toBe(false);
+      // anti-enumeration — same family as invalid credentials
+      expect(g.result).toMatchObject({ isSuccess: false });
+    }
+  });
+
+  test("gateEnforceAccountStatus passes active", () => {
+    expect(gateEnforceAccountStatus(row({ status: USER_STATUS.Active })).ok).toBe(true);
+  });
+});

package/src/auth-email-password/handlers/login.write.ts

@@ -11,7 +11,7 @@ import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
 import { verifyDummyPassword, verifyPassword } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
-import { parseAuthUserRow } from "../auth-user-row";
+import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row";
 import {
   AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES,
   AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS,
@@ -72,6 +72,170 @@ type LoginResult =
   | { readonly kind: "mfa-challenge"; readonly challengeToken: string }
   | { readonly kind: "mfa-setup-required"; readonly preauthSetupToken: string };
 
+type Membership = { readonly tenantId: TenantId; readonly roles: readonly string[] };
+
+type GateReject = { readonly ok: false; readonly result: WriteResult<LoginResult> };
+type GateOk<T> = { readonly ok: true; readonly value: T };
+type GateOutcome<T> = GateReject | GateOk<T>;
+
+function reject(result: WriteResult<LoginResult>): GateReject {
+  return { ok: false, result };
+}
+
+function ok<T>(value: T): GateOk<T> {
+  return { ok: true, value };
+}
+
+/** Uniform response on any credential miss — burns argon2 cost (#774). */
+export async function gateResolveAuthUser(
+  ctx: HandlerContext,
+  systemUser: SessionUser,
+  email: string,
+  password: string,
+): Promise<GateOutcome<AuthUserRow>> {
+  const found = parseAuthUserRow(await ctx.queryAs(systemUser, UserQueries.findForAuth, { email }));
+  if (!found?.passwordHash || found.isDeleted) {
+    await verifyDummyPassword(password);
+    return reject(invalidCredentials());
+  }
+  return ok(found);
+}
+
+/**
+ * Lockout BEFORE password verify — locked accounts can't be password-probed.
+ * Fail-open without Redis (IP rate-limit still covers partially).
+ */
+export async function gateEnforceLockout(
+  ctx: HandlerContext,
+  userId: string,
+): Promise<GateOutcome<undefined>> {
+  if (!ctx.redis) return ok(undefined);
+  const state = await getLockoutState(ctx.redis, userId);
+  if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {
+    const now = Date.now();
+    if (state.lockedUntil > now) {
+      const retryAfterSeconds = Math.max(1, Math.ceil((state.lockedUntil - now) / 1000));
+      return reject(accountLocked(retryAfterSeconds));
+    }
+  }
+  return ok(undefined);
+}
+
+/** Verify password; record miss / clear lockout on hit. */
+export async function gateVerifyPassword(
+  ctx: HandlerContext,
+  found: AuthUserRow,
+  password: string,
+  maxFailedAttempts: number,
+  lockoutDurationMinutes: number,
+): Promise<GateOutcome<undefined>> {
+  const passwordHash = found.passwordHash;
+  if (!passwordHash) return reject(invalidCredentials());
+  const passwordOk = await verifyPassword(passwordHash, password);
+  if (!passwordOk) {
+    if (ctx.redis) {
+      await recordFailedAttempt(ctx.redis, found.id, maxFailedAttempts, lockoutDurationMinutes);
+    }
+    return reject(invalidCredentials());
+  }
+  // Clear before MFA — MFA has its own attempt-cap; don't password-lock
+  // users who occasionally mistype across otherwise-successful logins.
+  if (ctx.redis) {
+    await clearLockoutState(ctx.redis, found.id);
+  }
+  return ok(undefined);
+}
+
+/** Strict email verification — after password, before session. */
+export function gateEnforceEmailVerified(
+  found: AuthUserRow,
+  strictVerification: boolean,
+): GateOutcome<undefined> {
+  if (strictVerification && found.emailVerified !== true) {
+    return reject(emailNotVerified());
+  }
+  return ok(undefined);
+}
+
+/** DSGVO Art. 18 freeze + forget-path anti-enumeration. */
+export function gateEnforceAccountStatus(found: AuthUserRow): GateOutcome<undefined> {
+  if (found.status === USER_STATUS.Restricted) {
+    return reject(accountRestricted());
+  }
+  if (found.status === USER_STATUS.DeletionRequested || found.status === USER_STATUS.Deleted) {
+    return reject(invalidCredentials());
+  }
+  return ok(undefined);
+}
+
+/** Pick membership (last-active preferred); merge global + tenant roles. */
+export async function gateResolveMembership(
+  ctx: HandlerContext,
+  systemUser: SessionUser,
+  found: AuthUserRow,
+): Promise<GateOutcome<{ readonly chosen: Membership; readonly mergedRoles: readonly string[] }>> {
+  const memberships = (await ctx.queryAs(systemUser, "tenant:query:memberships", {
+    userId: found.id,
+  })) as Array<Membership>; // @cast-boundary db-runner
+
+  if (memberships.length === 0) {
+    return reject(noMembership());
+  }
+
+  const preferred =
+    found.lastActiveTenantId !== null && found.lastActiveTenantId !== undefined
+      ? memberships.find((m) => m.tenantId === found.lastActiveTenantId)
+      : undefined;
+  const chosen = preferred ?? memberships[0];
+  if (!chosen) {
+    return reject(noMembership());
+  }
+
+  const globalRoles = parseRoles(found.roles ?? null);
+  // buildSessionRoles calls stripForbiddenMembershipRoles to strip reserved
+  // roles only (globalRoles keeps SystemAdmin) — read-time backstop against a
+  // rebuild-resurrected role.
+  const mergedRoles = buildSessionRoles(globalRoles, chosen.roles);
+  return ok({ chosen, mergedRoles });
+}
+
+/** MFA challenge / setup-required / proceed. */
+export async function gateEnforceMfa(
+  ctx: HandlerContext,
+  opts: LoginHandlerOptions,
+  userId: string,
+  tenantId: TenantId,
+  mergedRoles: readonly string[],
+): Promise<GateOutcome<LoginResult | undefined>> {
+  if (!opts.mfaStatusChecker) return ok(undefined);
+  const mfaStatus = await opts.mfaStatusChecker(ctx, userId, tenantId, mergedRoles);
+  if ("challengeToken" in mfaStatus) {
+    return ok({ kind: "mfa-challenge", challengeToken: mfaStatus.challengeToken });
+  }
+  if ("setupRequired" in mfaStatus) {
+    return ok({ kind: "mfa-setup-required", preauthSetupToken: mfaStatus.preauthSetupToken });
+  }
+  return ok(undefined);
+}
+
+/** Auth-claims hooks → session. */
+export async function gateBuildSession(
+  ctx: HandlerContext,
+  userId: string,
+  tenantId: TenantId,
+  mergedRoles: readonly string[],
+): Promise<GateOutcome<{ readonly kind: "auth-session"; readonly session: SessionUser }>> {
+  const baseSession: SessionUser = {
+    id: userId,
+    tenantId,
+    roles: mergedRoles,
+  };
+  const claims = await ctx.resolveAuthClaims(baseSession);
+  const session: SessionUser =
+    Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;
+  return ok({ kind: "auth-session", session });
+}
+
 // Login — unauthenticated entry point. The route is wired public (no JWT
 // middleware), synthesising a guest SessionUser for the handler's access
 // check. Everything inside the handler goes through ctx.queryAs(system, ...)
@@ -93,177 +257,46 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
     handler: async (event, ctx): Promise<WriteResult<LoginResult>> => {
       const systemUser = createSystemUser(SYSTEM_USER_ID);
 
-      const found = parseAuthUserRow(
-        await ctx.queryAs(systemUser, UserQueries.findForAuth, {
-          email: event.payload.email,
-        }),
+      const userGate = await gateResolveAuthUser(
+        ctx,
+        systemUser,
+        event.payload.email,
+        event.payload.password,
       );
+      if (!userGate.ok) return userGate.result;
+      const found = userGate.value;
 
-      // Uniform response on any credential mismatch (no user, wrong password,
-      // soft-deleted user) — prevents email enumeration.
-      if (!found?.passwordHash || found.isDeleted) {
-        // Burn the same argon2 verify cost as the hit path so response
-        // latency doesn't reveal whether the email is registered (#774).
-        await verifyDummyPassword(event.payload.password);
-        return invalidCredentials();
-      }
-
-      // Lockout gate — runs BEFORE password verification so a locked account
-      // can't be bruteforce-probed for passwords (and also can't be probed
-      // for a timing-oracle on the bcrypt verify). If Redis isn't wired,
-      // lockout is silently skipped — login still works, brute-force
-      // protection just degrades to the IP-rate-limiter at the edge.
-      //
-      // Deliberately fail-open here, unlike auth-mfa's enable-confirm-preauth
-      // (which fails closed without Redis): the secret guarded by THIS gate
-      // is a full password, not a 6-digit code — locking out every login
-      // app-wide because Redis is briefly unavailable is a self-inflicted
-      // outage across every tenant, for a backstop that the IP-rate-limiter
-      // still partially covers. auth-mfa's blast radius is one user's MFA
-      // enrollment, not global login availability — different tradeoff.
-      if (ctx.redis) {
-        const state = await getLockoutState(ctx.redis, found.id);
-        if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {
-          const now = Date.now();
-          if (state.lockedUntil > now) {
-            const retryAfterSeconds = Math.max(1, Math.ceil((state.lockedUntil - now) / 1000));
-            return accountLocked(retryAfterSeconds);
-          }
-          // lockedUntil in the past — shouldn't normally happen because the
-          // Redis TTL on the until-key expires the key at the same moment
-          // as the value. Clock skew / replication lag could surface this;
-          // fall through to password verification. The counter is NOT
-          // reset — next miss re-locks immediately (strict-semantic, see
-          // lockout-store.ts).
-        }
-      }
-
-      const passwordOk = await verifyPassword(found.passwordHash, event.payload.password);
-      if (!passwordOk) {
-        if (ctx.redis) {
-          await recordFailedAttempt(ctx.redis, found.id, maxFailedAttempts, lockoutDurationMinutes);
-        }
-        return invalidCredentials();
-      }
-
-      // Clear the lockout state as soon as the password is proven — the
-      // password itself is the thing this counter guards, and MFA (if
-      // gated below) has its own separate attempt-cap. Doing this before
-      // the MFA gate matters: without it, an MFA user who occasionally
-      // mistypes their password accumulates failures across otherwise-
-      // successful logins and eventually gets password-locked out even
-      // though every login they completed was legitimate.
-      if (ctx.redis) {
-        await clearLockoutState(ctx.redis, found.id);
-      }
+      const lockoutGate = await gateEnforceLockout(ctx, found.id);
+      if (!lockoutGate.ok) return lockoutGate.result;
 
-      // Strict verification gate — runs AFTER password check so an attacker
-      // probing "email_not_verified" needs valid credentials first. The
-      // remaining enumeration surface is "valid-cred + unverified" → accepted
-      // leak because the signup flow already told the user "check your email".
-      if (strictVerification && found.emailVerified !== true) {
-        return emailNotVerified();
-      }
-
-      // S2.U6 — DSGVO Art. 18 Account-Freeze. Restricted users koennen sich
-      // nicht einloggen; lift-restriction-Endpoint ist der einzige Ausgang
-      // (siehe lift-restriction.write.ts Header — typisch via Magic-Link
-      // oder Operator-Tool, da Login geblockt). Auth-side Block ist hard-
-      // requirement; ohne den koennte der User mit Login-Sessions trotz
-      // Restriction-Flag durchschreiben.
-      //
-      // DeletionRequested + Deleted kollabieren bewusst auf invalid_creds
-      // (anti-enumeration im Forget-Pfad) — Restricted ist user-initiiert,
-      // distinct error ist hier safe.
-      if (found.status === USER_STATUS.Restricted) {
-        return accountRestricted();
-      }
-      if (found.status === USER_STATUS.DeletionRequested || found.status === USER_STATUS.Deleted) {
-        return invalidCredentials();
-      }
-
-      // Resolve tenant + roles via the tenant feature's memberships query.
-      // Returns [] if the user has no memberships — MVP: no login without an
-      // invitation, so we refuse with a dedicated error.
-      const memberships = (await ctx.queryAs(systemUser, "tenant:query:memberships", {
-        userId: found.id,
-      })) as Array<{ tenantId: TenantId; roles: readonly string[] }>; // @cast-boundary db-runner
+      const passwordGate = await gateVerifyPassword(
+        ctx,
+        found,
+        event.payload.password,
+        maxFailedAttempts,
+        lockoutDurationMinutes,
+      );
+      if (!passwordGate.ok) return passwordGate.result;
 
-      if (memberships.length === 0) {
-        return noMembership();
-      }
+      const emailGate = gateEnforceEmailVerified(found, strictVerification);
+      if (!emailGate.ok) return emailGate.result;
 
-      const preferred =
-        found.lastActiveTenantId !== null && found.lastActiveTenantId !== undefined
-          ? memberships.find((m) => m.tenantId === found.lastActiveTenantId)
-          : undefined;
-      const chosen = preferred ?? memberships[0];
-      if (!chosen) {
-        return noMembership();
-      }
+      const statusGate = gateEnforceAccountStatus(found);
+      if (!statusGate.ok) return statusGate.result;
 
-      // Globale Rollen aus user.roles + tenant-membership-roles mergen.
-      // Globale Rollen (SystemAdmin etc.) bleiben so über alle tenants
-      // gleich; tenant-spezifische Rollen (Admin, User) kommen aus der
-      // membership. Dedupe via Set damit eine Rolle die in beiden Quellen
-      // steht nicht doppelt im Session-Roles landet.
-      //
-      // Computed BEFORE the MFA gate (moved up from its original spot below
-      // baseSession) because the gate's "admins" enforcement policy needs
-      // the MERGED set — a SystemAdmin whose admin-ness lives only in
-      // globalRoles would be missed if only chosen.roles were passed.
-      const globalRoles = parseRoles(found.roles ?? null);
-      // buildSessionRoles calls stripForbiddenMembershipRoles to strip reserved
-      // only (globalRoles keeps SystemAdmin) — read-time backstop against a
-      // rebuild-resurrected role.
-      const mergedRoles = buildSessionRoles(globalRoles, chosen.roles);
+      const membershipGate = await gateResolveMembership(ctx, systemUser, found);
+      if (!membershipGate.ok) return membershipGate.result;
+      const { chosen, mergedRoles } = membershipGate.value;
 
-      // Second-factor gate. Runs AFTER password verification (correct
-      // credentials proven) and AFTER tenant resolution (need chosen.tenantId
-      // to scope the MFA-enabled check). Three outcomes: enrolled → mint a
-      // challenge instead of a session (/auth/mfa/verify completes the
-      // login); policy demands MFA but the user never enrolled → block with
-      // mfa-setup-required (no session, no challenge — see auth-mfa's
-      // config.ts for why this deliberately hard-blocks); neither → proceed.
-      if (opts.mfaStatusChecker) {
-        const mfaStatus = await opts.mfaStatusChecker(ctx, found.id, chosen.tenantId, mergedRoles);
-        if ("challengeToken" in mfaStatus) {
-          return {
-            isSuccess: true,
-            data: { kind: "mfa-challenge", challengeToken: mfaStatus.challengeToken },
-          };
-        }
-        if ("setupRequired" in mfaStatus) {
-          return {
-            isSuccess: true,
-            data: { kind: "mfa-setup-required", preauthSetupToken: mfaStatus.preauthSetupToken },
-          };
-        }
+      const mfaGate = await gateEnforceMfa(ctx, opts, found.id, chosen.tenantId, mergedRoles);
+      if (!mfaGate.ok) return mfaGate.result;
+      if (mfaGate.value !== undefined) {
+        return { isSuccess: true, data: mfaGate.value };
       }
 
-      const baseSession: SessionUser = {
-        id: found.id,
-        tenantId: chosen.tenantId,
-        roles: mergedRoles,
-      };
-
-      // Features can contribute identity facts (team IDs, feature flags, ...)
-      // via r.authClaims(). ctx.resolveAuthClaims is a thin pass-through to
-      // dispatcher.resolveAuthClaims — same impl also used by the switch-tenant
-      // route, so login + tenant-switch stay in sync.
-      //
-      // Best-effort: if no feature registered a hook, we get an empty record
-      // back and simply omit the `claims` field from the session (keeps the
-      // shape clean for the JWT layer, which already spreads claims
-      // conditionally based on presence).
-      const claims = await ctx.resolveAuthClaims(baseSession);
-      const session: SessionUser =
-        Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;
-
-      return {
-        isSuccess: true,
-        data: { kind: "auth-session", session },
-      };
+      const sessionGate = await gateBuildSession(ctx, found.id, chosen.tenantId, mergedRoles);
+      if (!sessionGate.ok) return sessionGate.result;
+      return { isSuccess: true, data: sessionGate.value };
     },
   });
 }

package/src/auth-mfa/__tests__/reencrypt-job.integration.test.ts

@@ -84,10 +84,16 @@ afterAll(async () => {
   await stack.cleanup();
 });
 
-type RawUserMfaRow = { id: string; totpSecret: string; version: number };
+type RawUserMfaRow = {
+  id: string;
+  userId: string;
+  totpSecret: string;
+  recoveryCodes: string;
+  version: number;
+};
 
-async function readRawRow(): Promise<RawUserMfaRow> {
-  const rows = await selectMany<RawUserMfaRow>(stack.db, userMfaTable, {});
+async function readRawRow(userId?: string): Promise<RawUserMfaRow> {
+  const rows = await selectMany<RawUserMfaRow>(stack.db, userMfaTable, userId ? { userId } : {});
   const row = rows[0];
   if (!row) throw new Error("no user-mfa row");
   return row;
@@ -195,7 +201,7 @@ describe("auth-mfa KEK-rotation job — unrecognized values are not silently ski
       user,
     );
 
-    const beforeRow = await readRawRow();
+    const beforeRow = await readRawRow(user.id);
     const garbage = "not-a-stored-envelope";
     await asRawClient(stack.db).unsafe(`UPDATE read_user_mfa SET totp_secret = $1 WHERE id = $2`, [
       garbage,
@@ -241,7 +247,76 @@ describe("auth-mfa KEK-rotation job — unrecognized values are not silently ski
     );
     expect(rejectedWarning).toBeDefined();
 
-    const afterRow = await readRawRow();
+    const afterRow = await readRawRow(user.id);
     expect(afterRow.totpSecret).toBe(garbage);
   });
+
+  test("a non-envelope recoveryCodes is counted failed, never alreadyCurrent, and is left untouched", async () => {
+    mutableProvider.replace(
+      createEnvMasterKeyProvider({
+        env: {
+          KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+          KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
+        },
+      }),
+    );
+
+    const user = createTestUser({ id: 3, roles: ["User"] });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "user-3@example.com" },
+      user,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      user,
+    );
+
+    const beforeRow = await readRawRow(user.id);
+    const garbage = "not-a-stored-envelope";
+    await asRawClient(stack.db).unsafe(
+      `UPDATE read_user_mfa SET recovery_codes = $1 WHERE id = $2`,
+      [garbage, beforeRow.id],
+    );
+
+    type CapturedLog = { info: string[]; warn: string[] };
+    const captured: CapturedLog = { info: [], warn: [] };
+    const capturingLog = {
+      info: (msg: string) => {
+        captured.info.push(msg);
+      },
+      warn: (msg: string) => {
+        captured.warn.push(msg);
+      },
+      error: () => {},
+      debug: () => {},
+      child: () => capturingLog,
+    };
+
+    await mfaReencryptJob({}, {
+      db: stack.db,
+      registry: stack.registry,
+      masterKeyProvider: mutableProvider,
+      log: capturingLog,
+    } as AppContext);
+
+    const completeLine = captured.info.find((line) =>
+      line.includes("[auth-mfa:reencrypt] complete:"),
+    );
+    if (!completeLine) throw new Error("job did not log a completion summary");
+    const result = JSON.parse(completeLine.slice(completeLine.indexOf("{"))) as {
+      migrated: number;
+      failed: number;
+      alreadyCurrent: number;
+    };
+    expect(result.migrated).toBe(0);
+    expect(result.failed).toBeGreaterThanOrEqual(1);
+    expect(result.alreadyCurrent).toBe(0);
+
+    const afterRow = await readRawRow(user.id);
+    expect(afterRow.recoveryCodes).toBe(garbage);
+  });
 });

package/src/config/handlers/reencrypt.job.ts

@@ -5,9 +5,9 @@
 // parses the stored JSON.
 //
 // A row whose value isn't a current-cipher envelope (malformed JSON, or
-// any pre-envelope format) isn't a supported input here — cipher.decrypt
-// rejects it, so it's counted `failed` rather than silently treated as
-// already current. There is no legacy single-key decrypt path anymore.
+// any pre-envelope format) is counted `failed` before any decrypt attempt
+// and left untouched — migrateRow short-circuits on `unrecognized` instead
+// of relying on cipher.decrypt to reject it. No legacy single-key path.
 //
 // Idempotent: a re-run skips rows already on the current version. Every
 // write goes through the event-store executor (config values are

package/src/inbound-mail-foundation/entities.ts

@@ -1,5 +1,5 @@
 import { collectPiiSubjectFields } from "@cosmicdrift/kumiko-framework/crypto";
-import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createEntity,
@@ -164,9 +164,9 @@ export const seenMessageEntity = createEntity({
 // Plain EntityTableMeta (kein branded EntityTable) — unmanaged Direct-
 // Write-Stores, Handler schreiben via ctx.db (siehe user-session.ts-
 // Rationale).
-export const syncCursorTable = buildEntityTableMeta("mail-sync-cursor", syncCursorEntity, {
+export const syncCursorTable = deriveEntityTableMeta("mail-sync-cursor", syncCursorEntity, {
   source: "unmanaged",
 });
-export const seenMessageTable = buildEntityTableMeta("mail-seen-message", seenMessageEntity, {
+export const seenMessageTable = deriveEntityTableMeta("mail-seen-message", seenMessageEntity, {
   source: "unmanaged",
 });

package/src/personal-access-tokens/feature.ts

@@ -3,7 +3,7 @@ import {
   EXT_TOKEN_VERIFIER,
 } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
-import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PAT_SCREEN_ID, type PatRateLimit } from "./constants";
 import { buildAvailableScopesQuery } from "./handlers/available-scopes.query";
@@ -67,7 +67,7 @@ export function createPersonalAccessTokensFeature(
     // Direct-write store like store_user_sessions: create/revoke write it, the
     // resolver point-reads it. r.entity would make it a rebuildable projection
     // whose replay (no token events) would wipe every live token (#498/#494).
-    r.storeTable(buildEntityTableMeta("api-token", apiTokenEntity, { source: "unmanaged" }), {
+    r.storeTable(deriveEntityTableMeta("api-token", apiTokenEntity, { source: "unmanaged" }), {
       reason: "read_side.api_tokens_direct_write",
       // create.write encrypts `name` via encryptForDirectWrite (#820).
       piiEncryptedOnWrite: true,

package/src/personal-access-tokens/schema/api-token.ts

@@ -1,4 +1,4 @@
-import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createEntity,
@@ -55,9 +55,9 @@ export const apiTokenEntity = createEntity({
   indexes: [{ unique: true, columns: ["tokenHash"], name: "store_api_tokens_hash_unique" }],
 });
 
-// buildEntityTableMeta (not buildEntityTable): this is a direct-write store, so
+// deriveEntityTableMeta (not buildEntityTable): this is a direct-write store, so
 // the table must be a WritableTable (post ES-write-brand #742) — same as
 // sessions' userSessionTable. buildEntityTable is branded executor-only.
-export const apiTokenTable = buildEntityTableMeta("api-token", apiTokenEntity, {
+export const apiTokenTable = deriveEntityTableMeta("api-token", apiTokenEntity, {
   source: "unmanaged",
 });

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -42,7 +42,7 @@ import { SessionHandlers, SessionQueries } from "../constants";
 import { createSessionsFeature } from "../feature";
 import { userSessionEntity, userSessionTable } from "../schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../session-callbacks";
-import { SESSION_REVOKED_EVENT_QN, type SessionRevokedPayload } from "../session-revoked-event";
+import { SESSION_REVOKED_EVENT_QN, sessionRevokedSchema } from "../session-revoked-event";
 import { sessionCallbacksFromLateBound } from "../testing";
 import { makeSessionHelpers } from "./test-helpers";
 
@@ -216,7 +216,7 @@ describe("sessions feature — login → check → revoke → rejected", () => {
 
     const events = await selectMany(stack.db, eventsTable, { type: SESSION_REVOKED_EVENT_QN });
     expect(events).toHaveLength(1);
-    const payload = events[0]?.["payload"] as SessionRevokedPayload;
+    const payload = sessionRevokedSchema.parse(events[0]?.["payload"]);
     expect(payload.userId).toBe(userId);
     expect(payload.sessionIds).toEqual([sid]);
   });
@@ -243,6 +243,22 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     expect(events).toHaveLength(1); // only the first, successful revoke
   });
 
+  test("revoke-all-others with no other live sessions emits no event", async () => {
+    await h.seedUser("noop-others@example.com", "pw-long-enough");
+    const only = await h.login("noop-others@example.com", "pw-long-enough");
+
+    const res = await h.authedPost("/api/write", only.token, {
+      type: SessionHandlers.revokeAllOthers,
+      payload: {},
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { data: { count: number } };
+    expect(body.data.count).toBe(0);
+
+    const events = await selectMany(stack.db, eventsTable, { type: SESSION_REVOKED_EVENT_QN });
+    expect(events).toHaveLength(0);
+  });
+
   test("revoke-all-others appends one event listing every revoked sid", async () => {
     const { userId } = await h.seedUser("event3@example.com", "pw-long-enough");
     const a = await h.login("event3@example.com", "pw-long-enough");
@@ -257,7 +273,7 @@ describe("sessions feature — login → check → revoke → rejected", () => {
 
     const events = await selectMany(stack.db, eventsTable, { type: SESSION_REVOKED_EVENT_QN });
     expect(events).toHaveLength(1);
-    const payload = events[0]?.["payload"] as SessionRevokedPayload;
+    const payload = sessionRevokedSchema.parse(events[0]?.["payload"]);
     expect(payload.userId).toBe(userId);
     expect(new Set(payload.sessionIds)).toEqual(new Set([a.sid, c.sid]));
   });

package/src/sessions/feature.ts

@@ -3,7 +3,7 @@ import {
   type SessionStore,
   type SessionStoreProvider,
 } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
-import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   defineFeature,
@@ -111,11 +111,14 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // (#498/#494). r.storeTable keeps the migration DDL but opts the
     // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
     // which are direct-write stores too.
-    r.storeTable(buildEntityTableMeta("user-session", userSessionEntity, { source: "unmanaged" }), {
-      reason: "read_side.user_sessions_direct_write",
-      // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
-      piiEncryptedOnWrite: true,
-    });
+    r.storeTable(
+      deriveEntityTableMeta("user-session", userSessionEntity, { source: "unmanaged" }),
+      {
+        reason: "read_side.user_sessions_direct_write",
+        // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
+        piiEncryptedOnWrite: true,
+      },
+    );
 
     // Self-registers as auth-foundation's sessionStore provider (#1371) —
     // wraps the same createSessionCallbacks() used by the manual

package/src/sessions/schema/user-session.ts

@@ -1,4 +1,4 @@
-import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createEntity,
@@ -69,11 +69,10 @@ export const userSessionEntity = createEntity({
 });
 
 // Plain EntityTableMeta, NOT a branded EntityTable: user-session is an
-// unmanaged direct-write store (r.unmanagedTable in feature.ts, no event
-// stream — revocation is a column write, not an aggregate). The feature's
-// handlers write it directly via ctx.db; the meta carries no executor-only
-// brand so those writes stay legal. See feature.ts for the rebuild-exclusion
-// rationale (#494/#498).
-export const userSessionTable = buildEntityTableMeta("user-session", userSessionEntity, {
+// unmanaged direct-write store (r.storeTable in feature.ts, no event stream —
+// revocation is a column write, not an aggregate). Handlers write via ctx.db;
+// the meta carries no executor-only brand so those writes stay legal. See
+// feature.ts for the rebuild-exclusion rationale (#494/#498).
+export const userSessionTable = deriveEntityTableMeta("user-session", userSessionEntity, {
   source: "unmanaged",
 });

package/src/tenant-settings/__tests__/tenant-settings.integration.test.ts

@@ -1,8 +1,7 @@
-// Verifies the core promise: set a tenant's tenant-settings:config:currency
-// to CHF, and a new entity without an explicit currency inherits CHF instead
-// of a hard-coded EUR literal.
+// Package-level cases the recipe does NOT cover: unknown field at define time,
+// and missing tenant-settings mount fails loud when currency is omitted.
 
-import { afterAll, beforeAll, expect, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import {
   configValuesTable,
   createConfigAccessorFactory,
@@ -26,7 +25,6 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTenantSettingsFeature } from "../feature";
 import { defineCreateWithTenantDefaults } from "../tenant-defaults";
 
 const invoiceEntity = createEntity({
@@ -40,76 +38,57 @@ const invoiceEntity = createEntity({
 
 const ACCESS = { roles: ["Admin"] } as const;
 
-const invoiceFeature = defineFeature("invoice", (r) => {
-  r.entity("invoice", invoiceEntity);
-  r.writeHandler(
+test("defineCreateWithTenantDefaults throws on an unknown currency field", () => {
+  expect(() =>
     defineCreateWithTenantDefaults("invoice", invoiceEntity, {
       access: ACCESS,
-      currencyFields: ["amount"],
-      localeField: "language",
+      currencyFields: ["notARealField"],
     }),
-  );
+  ).toThrow(/unknown field "notARealField"/);
 });
 
-const tenantId = testTenantId(1);
-const admin: SessionUser = { id: "admin-1", tenantId, roles: ["Admin"] };
-
-let stack: TestStack;
-
-beforeAll(async () => {
-  const resolver = createConfigResolver();
-  stack = await setupTestStack({
-    features: [createConfigFeature(), createTenantSettingsFeature(), invoiceFeature],
-    extraContext: ({ registry }) => ({
-      configResolver: resolver,
-      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
-    }),
+describe("without tenant-settings mount", () => {
+  const invoiceFeature = defineFeature("invoice", (r) => {
+    r.entity("invoice", invoiceEntity);
+    r.writeHandler(
+      defineCreateWithTenantDefaults("invoice", invoiceEntity, {
+        access: ACCESS,
+        currencyFields: ["amount"],
+        localeField: "language",
+      }),
+    );
   });
-  await unsafePushTables(stack.db, { configValuesTable });
-  await unsafeCreateEntityTable(stack.db, invoiceEntity);
-  await createEventsTable(stack.db);
-  await pushEntityProjectionTables(stack, stack.registry);
-});
-
-afterAll(async () => {
-  await stack.cleanup();
-});
 
-test("ohne Tenant-Override übernimmt eine neue Entity den Feature-Default (EUR/en)", async () => {
-  const invoice = await stack.http.writeOk<{
-    data: { amount: { amount: number; currency: string }; language: string };
-  }>("invoice:write:invoice:create", { title: "Rechnung 1", amount: { amount: 1000 } }, admin);
-  expect(invoice.data.amount).toEqual({ amount: 1000, currency: "EUR" });
-  expect(invoice.data.language).toBe("en");
-});
-
-test("Tenant setzt CHF/de — neue Entity ohne explizite Werte übernimmt die Tenant-Config, nicht das Feature-Default", async () => {
-  await stack.http.writeOk(
-    "config:write:set",
-    { key: "tenant-settings:config:currency", value: "CHF" },
-    admin,
-  );
-  await stack.http.writeOk(
-    "config:write:set",
-    { key: "tenant-settings:config:locale", value: "de" },
-    admin,
-  );
+  const tenantId = testTenantId(1);
+  const admin: SessionUser = { id: "admin-1", tenantId, roles: ["Admin"] };
+  let stack: TestStack;
 
-  const invoice = await stack.http.writeOk<{
-    data: { amount: { amount: number; currency: string }; language: string };
-  }>("invoice:write:invoice:create", { title: "Rechnung 2", amount: { amount: 2000 } }, admin);
+  beforeAll(async () => {
+    const resolver = createConfigResolver();
+    // config feature only — no createTenantSettingsFeature()
+    stack = await setupTestStack({
+      features: [createConfigFeature(), invoiceFeature],
+      extraContext: ({ registry }) => ({
+        configResolver: resolver,
+        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+      }),
+    });
+    await unsafePushTables(stack.db, { configValuesTable });
+    await unsafeCreateEntityTable(stack.db, invoiceEntity);
+    await createEventsTable(stack.db);
+    await pushEntityProjectionTables(stack, stack.registry);
+  });
 
-  expect(invoice.data.amount).toEqual({ amount: 2000, currency: "CHF" });
-  expect(invoice.data.language).toBe("de");
-});
+  afterAll(async () => {
+    await stack.cleanup();
+  });
 
-test("expliziter Wert im Payload gewinnt gegen die Tenant-Config", async () => {
-  const invoice = await stack.http.writeOk<{
-    data: { amount: { amount: number; currency: string } };
-  }>(
-    "invoice:write:invoice:create",
-    { title: "Rechnung 3", amount: { amount: 3000, currency: "USD" } },
-    admin,
-  );
-  expect(invoice.data.amount).toEqual({ amount: 3000, currency: "USD" });
+  test("omitting money.currency fails loud (no silent feature-default fill)", async () => {
+    const err = await stack.http.writeErr(
+      "invoice:write:invoice:create",
+      { title: "Invoice", amount: { amount: 1000 } },
+      admin,
+    );
+    expect(err.httpStatus).toBeGreaterThanOrEqual(400);
+  });
 });

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -521,6 +521,19 @@ describe("r.httpRoute :: /user-export/by-token (Magic-Link e2e)", () => {
     const body = (await res.json()) as { error?: string };
     expect(body.error).toBe("missing_token");
   });
+
+  test("POST-Exchange: invalid token → 404 + download.notFound i18nKey", async () => {
+    const res = await stack.app.fetch(
+      new Request("http://test/user-export/by-token", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ token: "fake-xxxxx" }),
+      }),
+    );
+    expect(res.status).toBe(404);
+    const body = (await res.json()) as { error: { i18nKey: string } };
+    expect(body.error.i18nKey).toBe("userDataRights.errors.download.notFound");
+  });
 });
 
 describe("download-by-job :: cross-user + cross-tenant", () => {

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -47,7 +47,7 @@ import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
 import {
   SESSION_REVOKED_EVENT_QN,
-  type SessionRevokedPayload,
+  sessionRevokedSchema,
 } from "../../sessions/session-revoked-event";
 import { sessionCallbacksFromLateBound, withMintedSession } from "../../sessions/testing";
 import { hashPassword } from "../../shared";
@@ -415,6 +415,26 @@ describe("S2.U6 :: Login-Block fuer Restricted/DeletionRequested/Deleted", () =>
 });
 
 describe("S2.U6 :: Cross-Feature sessions.revokeAllForUser direct", () => {
+  test("Privileged revoke-all-for-user with no live sessions emits no event", async () => {
+    const { userId } = await seedAliceWithMembership();
+    const systemUser = await mintActor({
+      id: "00000000-0000-4000-8000-000000000000",
+      tenantId: TENANT,
+      roles: ["SystemAdmin"],
+    });
+
+    const result = await stack.http.writeOk<{ count: number; userId: string }>(
+      SessionHandlers.revokeAllForUser,
+      { userId },
+      systemUser,
+    );
+    expect(result.count).toBe(0);
+    expect(result.userId).toBe(userId);
+
+    const events = await selectMany(stack.db, eventsTable, { type: SESSION_REVOKED_EVENT_QN });
+    expect(events).toHaveLength(0);
+  });
+
   test("Privileged-Caller revoked alle live sessions eines Users", async () => {
     const { userId } = await seedAliceWithMembership();
     // 2 Sessions erzeugen via Login + zweiter Login.
@@ -454,7 +474,7 @@ describe("S2.U6 :: Cross-Feature sessions.revokeAllForUser direct", () => {
     // target user's session tenant). One event, both sids listed.
     const events = await selectMany(stack.db, eventsTable, { type: SESSION_REVOKED_EVENT_QN });
     expect(events).toHaveLength(1);
-    const payload = events[0]?.["payload"] as SessionRevokedPayload;
+    const payload = sessionRevokedSchema.parse(events[0]?.["payload"]);
     expect(payload.userId).toBe(userId);
     expect(new Set(payload.sessionIds)).toEqual(new Set(liveBefore.map((s) => s.id)));
   });

package/src/user-data-rights/handlers/lift-restriction.write.ts

@@ -26,8 +26,8 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 // "Cross-Tenant-Semantik"). Without a membership check, a TenantAdmin
 // from tenant A could unrestrict/reactivate a user who has never been a
 // member of tenant A. Only SystemAdmin (platform-wide) skips the check;
-// TenantAdmin/Admin must have an active membership in the target's own
-// tenantId.
+// the target must have a membership row in the acting admin's
+// `event.user.tenantId` (row existence only — no active-status field).
 //
 // State-Transitions:
 //   Restricted → Active        ✓

package/src/user-data-rights/handlers/restrict-account.write.ts

@@ -34,8 +34,8 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 // user-data-rights.md "Cross-Tenant-Semantik"). Without a membership
 // check, a TenantAdmin from tenant A could restrict/unrestrict a user who
 // has never been a member of tenant A. Only SystemAdmin (platform-wide)
-// skips the check; TenantAdmin/Admin must have an active membership in
-// the target's own tenantId.
+// skips the check; the target must have a membership row in the acting
+// admin's `event.user.tenantId` (row existence only — no active-status field).
 //
 // State-Transitions:
 //   Active → Restricted        ✓ (dieser Handler)