@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/auth-email-password/feature.ts

@@ -1,7 +1,9 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { MIN_HMAC_SECRET_LENGTH } from "./constants";
 import type { AuthMailLocale } from "./email-templates";
 import { changePasswordWrite } from "./handlers/change-password.write";
+import { createConfirmAccountUnlockHandler } from "./handlers/confirm-account-unlock.write";
 import { createInviteAcceptHandler } from "./handlers/invite-accept.write";
 import { createInviteAcceptWithLoginHandler } from "./handlers/invite-accept-with-login.write";
 import {
@@ -9,11 +11,16 @@ import {
   type InviteCreateOptions,
 } from "./handlers/invite-create.write";
 import { createInviteSignupCompleteHandler } from "./handlers/invite-signup-complete.write";
-import { createLoginHandler } from "./handlers/login.write";
+import { createLoginHandler, type LoginHandlerOptions } from "./handlers/login.write";
 import { logoutWrite } from "./handlers/logout.write";
+import {
+  createRequestAccountUnlockHandler,
+  type RequestAccountUnlockOptions,
+} from "./handlers/request-account-unlock.write";
 import { createRequestEmailVerificationHandler } from "./handlers/request-email-verification.write";
 import { createRequestPasswordResetHandler } from "./handlers/request-password-reset.write";
 import { createResetPasswordHandler } from "./handlers/reset-password.write";
+import { selfRegistrationStatusQuery } from "./handlers/self-registration-status.query";
 import { createSignupConfirmHandler } from "./handlers/signup-confirm.write";
 import {
   createSignupRequestHandler,
@@ -108,12 +115,26 @@ export type SignupOptions = SignupRequestOptions;
 // 7 Tage (industry standard).
 export type InviteOptions = InviteCreateOptions;
 
+// Account-Unlock Magic-Link (#1266). When set, registers the
+// request-account-unlock + confirm-account-unlock handlers — the
+// self-service escape hatch for the monotonic lockout counter (see
+// lockout-store.ts). Only meaningful paired with `accountLockout`, but
+// wired independently like passwordReset/emailVerification — no implicit
+// auto-enable, so apps without lockout don't get an unasked-for new
+// public endpoint.
+export type AccountUnlockOptions = RequestAccountUnlockOptions;
+
 export type AuthEmailPasswordOptions = {
+  // Second-factor gate. auth-mfa (if mounted) wires this in via
+  // mfaStatusCheckerFromFeature() at app-composition time — see
+  // LoginHandlerOptions.mfaStatusChecker for the contract it must satisfy.
+  readonly mfaStatusChecker?: LoginHandlerOptions["mfaStatusChecker"];
   readonly passwordReset?: PasswordResetOptions;
   readonly emailVerification?: EmailVerificationOptions;
   readonly accountLockout?: AccountLockoutOptions;
   readonly signup?: SignupOptions;
   readonly invite?: InviteOptions;
+  readonly accountUnlock?: AccountUnlockOptions;
 };
 
 // Auth feature — email+password login. Depends on the user feature for
@@ -122,14 +143,22 @@ export type AuthEmailPasswordOptions = {
 export function createAuthEmailPasswordFeature(
   opts: AuthEmailPasswordOptions = {},
 ): FeatureDefinition {
-  if (opts.passwordReset && !opts.passwordReset.hmacSecret) {
+  // ≥32 chars, symmetric to the JWT_SECRET env check: a short HMAC secret
+  // makes reset/verify tokens forgeable — that's account takeover, so the
+  // factory fails fast instead of trusting the caller.
+  if (opts.passwordReset && opts.passwordReset.hmacSecret.length < MIN_HMAC_SECRET_LENGTH) {
+    throw new Error(
+      `[auth-email-password] passwordReset.hmacSecret must be ≥${MIN_HMAC_SECRET_LENGTH} chars (HMAC-SHA256 token signing)`,
+    );
+  }
+  if (opts.emailVerification && opts.emailVerification.hmacSecret.length < MIN_HMAC_SECRET_LENGTH) {
     throw new Error(
-      "[auth-email-password] passwordReset.hmacSecret must be non-empty when passwordReset is configured",
+      `[auth-email-password] emailVerification.hmacSecret must be ≥${MIN_HMAC_SECRET_LENGTH} chars (HMAC-SHA256 token signing)`,
     );
   }
-  if (opts.emailVerification && !opts.emailVerification.hmacSecret) {
+  if (opts.accountUnlock && opts.accountUnlock.hmacSecret.length < MIN_HMAC_SECRET_LENGTH) {
     throw new Error(
-      "[auth-email-password] emailVerification.hmacSecret must be non-empty when emailVerification is configured",
+      `[auth-email-password] accountUnlock.hmacSecret must be ≥${MIN_HMAC_SECRET_LENGTH} chars (HMAC-SHA256 token signing)`,
     );
   }
 
@@ -138,7 +167,7 @@ export function createAuthEmailPasswordFeature(
 
   return defineFeature("auth-email-password", (r) => {
     r.describe(
-      "Provides email+password authentication: the always-on handlers are `login`, `changePassword`, and `logout`; optional flows \u2014 password reset, email verification, magic-link self-signup, and tenant invite \u2014 are registered only when you pass their respective option objects (`passwordReset`, `emailVerification`, `signup`, `invite`) to `createAuthEmailPasswordFeature(opts)`. All four magic-link flows (reset, verification, signup activation, tenant invite) dispatch their mail through the `delivery` feature via `ctx.notify`, so mounting any of them additionally requires `delivery`. Tokens are HMAC-signed (reset/verify) or opaque-random in Redis (signup/invite). Requires the `user` and `tenant` features, and declares `JWT_SECRET` (\u2265 32 chars) in `authEmailPasswordEnvSchema` so a missing secret surfaces at boot validation rather than on the first login attempt.",
+      "Provides email+password authentication: the always-on handlers are `login`, `changePassword`, and `logout`; optional flows — password reset, email verification, magic-link self-signup, tenant invite, and account-unlock — are registered only when you pass their respective option objects (`passwordReset`, `emailVerification`, `signup`, `invite`, `accountUnlock`) to `createAuthEmailPasswordFeature(opts)`. All five magic-link flows dispatch their mail through the `delivery` feature via `ctx.notify`, so mounting any of them additionally requires `delivery`. Tokens are HMAC-signed (reset/verify/unlock) or opaque-random in Redis (signup/invite). `accountUnlock` is the self-service escape hatch for `accountLockout`'s monotonic failure-counter (#1266): confirming the mailed token clears the Redis lockout state without touching the user entity. Requires the `user` and `tenant` features, and declares `JWT_SECRET` (≥ 32 chars) in `authEmailPasswordEnvSchema` so a missing secret surfaces at boot validation rather than on the first login attempt.",
     );
     r.uiHints({
       displayLabel: "Auth \u00b7 Email + Password",
@@ -154,14 +183,21 @@ export function createAuthEmailPasswordFeature(
         },
         { key: "signup", label: "Self-Signup-Flow", type: "boolean", default: false },
         { key: "invite", label: "Tenant-Invite-Flow", type: "boolean", default: false },
+        { key: "accountUnlock", label: "Account-Unlock-Flow", type: "boolean", default: false },
       ],
     });
     r.requires("user");
     r.requires("tenant");
-    // All four magic-link flows (reset/verify/signup/invite) dispatch via
-    // ctx.notify → delivery must be mounted. Fail closed at boot instead of
-    // silently dropping the mail.
-    if (opts.passwordReset || opts.emailVerification || opts.signup || opts.invite) {
+    // All five magic-link flows (reset/verify/signup/invite/unlock) dispatch
+    // via ctx.notify → delivery must be mounted. Fail closed at boot instead
+    // of silently dropping the mail.
+    if (
+      opts.passwordReset ||
+      opts.emailVerification ||
+      opts.signup ||
+      opts.invite ||
+      opts.accountUnlock
+    ) {
       r.requires("delivery");
     }
     r.envSchema(authEmailPasswordEnvSchema);
@@ -171,6 +207,7 @@ export function createAuthEmailPasswordFeature(
         createLoginHandler({
           strictEmailVerification: strictVerification,
           accountLockout: opts.accountLockout,
+          mfaStatusChecker: opts.mfaStatusChecker,
         }),
       ),
       changePassword: r.writeHandler(changePasswordWrite),
@@ -187,6 +224,12 @@ export function createAuthEmailPasswordFeature(
       r.writeHandler(createVerifyEmailHandler(opts.emailVerification));
     }
 
+    const queries = {
+      ...(opts.signup && {
+        signupRegistrationStatus: r.queryHandler(selfRegistrationStatusQuery),
+      }),
+    };
+
     if (opts.signup) {
       r.writeHandler(createSignupRequestHandler(opts.signup));
       r.writeHandler(createSignupConfirmHandler());
@@ -199,6 +242,11 @@ export function createAuthEmailPasswordFeature(
       r.writeHandler(createInviteSignupCompleteHandler());
     }
 
-    return { handlers };
+    if (opts.accountUnlock) {
+      r.writeHandler(createRequestAccountUnlockHandler(opts.accountUnlock));
+      r.writeHandler(createConfirmAccountUnlockHandler(opts.accountUnlock));
+    }
+
+    return { handlers, queries };
   });
 }

package/src/auth-email-password/handlers/change-password.write.ts

@@ -1,9 +1,14 @@
-import { access, createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { getAggregateStreamTenant } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  access,
+  createSystemUser,
+  defineWriteHandler,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
-import { USER_FEATURE, UserHandlers, UserQueries } from "../../user";
+import { hashPassword, verifyPassword } from "../../shared";
+import { UserHandlers, UserQueries } from "../../user";
 import { invalidCredentials } from "../errors";
-import { hashPassword, verifyPassword } from "../password-hashing";
+import { passwordSchema } from "../password-policy";
 
 // Change-password — authenticated. The user supplies their current password
 // (re-auth) and the new one. The new hash is written via ctx.writeAs(system)
@@ -13,7 +18,7 @@ export const changePasswordWrite = defineWriteHandler({
   name: "change-password",
   schema: z.object({
     oldPassword: z.string().min(1),
-    newPassword: z.string().min(8).max(200),
+    newPassword: passwordSchema,
   }),
   access: { roles: access.authenticated },
   handler: async (event, ctx) => {
@@ -35,14 +40,10 @@ export const changePasswordWrite = defineWriteHandler({
 
     const newHash = await hashPassword(event.payload.newPassword);
 
-    // The user aggregate is r.systemScope(): its event stream can live in a
-    // tenant that isn't the session tenant (a platform operator's stream sits
-    // in the seed executor's tenant, not their membership). Write against the
-    // real stream tenant so optimistic locking targets the right stream instead
-    // of version_conflict-ing against an empty one. Falls back to the session
-    // tenant when the lookup finds nothing (fresh/unknown stream).
-    const streamTenant = await getAggregateStreamTenant(ctx.db.raw, event.user.id, USER_FEATURE);
-    const writer = createSystemUser(streamTenant ?? event.user.tenantId);
+    // The user aggregate is systemStream (#497): its event stream lives on
+    // SYSTEM_TENANT_ID deterministically. Pre-#497 scattered streams need the
+    // one-time backfillUserStreamTenants migration (#762).
+    const writer = createSystemUser(SYSTEM_TENANT_ID);
 
     // Apply via user feature's update handler — writeAs(system) satisfies
     // the privileged-only write rule on passwordHash. Pass the current version

package/src/auth-email-password/handlers/confirm-account-unlock.write.ts

@@ -0,0 +1,59 @@
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  InternalError,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import { z } from "zod";
+import { AuthErrors } from "../constants";
+import { invalidUnlockToken } from "../errors";
+import { clearLockoutState } from "../lockout-store";
+import { verifyUnlockToken } from "../unlock-token";
+
+export type ConfirmAccountUnlockOptions = {
+  readonly hmacSecret: string;
+};
+
+// Confirm step of the unlock flow. Unlike reset/verify, there's no entity
+// write: the token's HMAC signature already proves it was minted for an
+// existing, non-deleted user (see request-account-unlock.write.ts's
+// findForAuth + extraSilentSkip), so there's no user to (re-)load or
+// validate here. Clearing the Redis lockout state is naturally idempotent
+// (DEL on an already-cleared/missing key is a no-op), so a replayed unlock
+// link within its TTL just re-clears — harmless, unlike reset which sets a
+// password. That's why this skips the single-use burn-store confirm-token-
+// flow.ts needs to protect a state-changing write.
+export function createConfirmAccountUnlockHandler(opts: ConfirmAccountUnlockOptions) {
+  return defineWriteHandler({
+    name: "confirm-account-unlock",
+    schema: z.object({
+      token: z.string().min(1),
+    }),
+    access: { roles: ["all"] },
+    handler: async (event, ctx) => {
+      if (!opts.hmacSecret) {
+        return writeFailure(
+          new UnprocessableError(AuthErrors.unlockNotConfigured, {
+            i18nKey: "auth.errors.unlockNotConfigured",
+          }),
+        );
+      }
+      if (!ctx.redis) {
+        return writeFailure(
+          new InternalError({
+            message: "account-unlock requires ctx.redis to clear lockout state",
+          }),
+        );
+      }
+
+      // All verify failures (malformed / bad_signature / expired) fold into
+      // the same invalid_unlock_token error — a probing caller can't
+      // distinguish tampered from stale from random-string.
+      const verify = verifyUnlockToken(event.payload.token, opts.hmacSecret);
+      if (!verify.ok) return invalidUnlockToken();
+
+      await clearLockoutState(ctx.redis, verify.userId);
+      return { isSuccess: true, data: { kind: "account-unlocked" as const } };
+    },
+  });
+}

package/src/auth-email-password/handlers/confirm-token-flow.ts

@@ -5,9 +5,8 @@
 //   1. Redis check + burn (single-use enforcement)
 //   2. Load user + deleted/missing/no-version guard
 //   3. Optional idempotent short-circuit (verify-email when already done)
-//   4. Resolve memberships → tenant-order for stream-matching
-//   5. Try each tenant's stream with the handler-specific `changes`
-//   6. Release the burn on ANY non-success path so a legit retry isn't
+//   4. Apply the handler-specific `changes` on the user's SYSTEM stream
+//   5. Release the burn on ANY non-success path so a legit retry isn't
 //      locked out by a stale marker
 //
 // The top-level `runConfirmTokenFlow` orchestrates and owns the
@@ -15,27 +14,27 @@
 // burn (success, already-done) flips `committed = true`; everything
 // else — including future branches a maintainer adds — releases
 // automatically.
+//
+// The user aggregate is systemStream (#497): its event stream lives on
+// SYSTEM_TENANT_ID deterministically, so the write targets exactly one
+// stream. The former membership-probing (`tryWriteAcrossTenants`) existed
+// for pre-#497 scattered streams; those need the one-time
+// backfillUserStreamTenants migration (#762) — probing them stopped working
+// the moment the executor's stream choke-point landed anyway.
 
 import {
   createSystemUser,
   type HandlerContext,
   type SessionUser,
   SYSTEM_TENANT_ID,
-  type TenantId,
   type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  InternalError,
-  type WriteFailure,
-  writeFailure,
-} from "@cosmicdrift/kumiko-framework/errors";
-import { getAggregateStreamTenant } from "@cosmicdrift/kumiko-framework/event-store";
+import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import type Redis from "ioredis";
-import { USER_FEATURE, UserHandlers, UserQueries } from "../../user";
+import { burnToken, unburnToken } from "../../shared";
+import { UserHandlers, UserQueries } from "../../user";
 import type { AuthUserRow } from "../auth-user-row";
 import { parseAuthUserRow } from "../auth-user-row";
-import { orderTenantsByPreference } from "../stream-tenant";
-import { burnToken, unburnToken } from "../token-burn-store";
 
 export type ConfirmTokenFlowSpec<TSuccessData> = {
   // Short purpose-tag used in the burn-store key. Must NOT overlap with
@@ -46,13 +45,11 @@ export type ConfirmTokenFlowSpec<TSuccessData> = {
   // is misconfigured, not the caller's fault.
   readonly redisRequiredMessage: string;
   // Standard failure returned for every "token can't be consumed" path
-  // (bad state, missing memberships, every tenant rejected). The route
-  // layer returns 422 with a uniform code so the caller can't tell which
-  // branch fired.
+  // (bad state, version conflict on the stream). The route layer returns
+  // 422 with a uniform code so the caller can't tell which branch fired.
   readonly invalidToken: () => ReturnType<typeof writeFailure>;
-  // Handler-specific payload for user:update. Runs once per token — the
-  // result is shared across every tenant-stream attempt. Can be async
-  // (password-reset hashes here).
+  // Handler-specific payload for user:update. Runs once per token. Can be
+  // async (password-reset hashes here).
   readonly buildChanges: (me: AuthUserRow) => Promise<Record<string, unknown>>;
   // Returned verbatim on a successful write.
   readonly successData: TSuccessData;
@@ -96,20 +93,21 @@ export async function runConfirmTokenFlow<TSuccessData>(
       return { isSuccess: true, data: spec.alreadyDone.data };
     }
 
-    const tenantOrder = await resolveStreamTenants(ctx, systemUser, me);
-    if (tenantOrder.length === 0) return spec.invalidToken();
-
     const changes = await spec.buildChanges(me);
-    const writeResult = await tryWriteAcrossTenants(ctx, me, tenantOrder, changes);
-    if (writeResult.isSuccess) {
+    const writeRes = await ctx.writeAs(systemUser, UserHandlers.update, {
+      id: me.id,
+      version: me.version,
+      changes,
+    });
+    if (writeRes.isSuccess) {
       committed = true;
       return { isSuccess: true, data: spec.successData };
     }
-    // `all_conflicts` = every tenant returned version_conflict → token-level
-    // failure. `hard_failure` = a real write error (DB down, access
-    // denied) that bubbles unchanged.
-    if (writeResult.reason === "all_conflicts") return spec.invalidToken();
-    return writeResult.failure;
+    // version_conflict = concurrent modification (or an un-migrated pre-#497
+    // stream, see header) → token-level failure. Anything else (DB down,
+    // access denied) bubbles unchanged so ops sees the real failure class.
+    if (writeRes.error.code === "version_conflict") return spec.invalidToken();
+    return writeRes;
   } finally {
     // committed===false covers EVERY failure path — including branches a
     // future maintainer adds without reading this file. The original
@@ -121,14 +119,13 @@ export async function runConfirmTokenFlow<TSuccessData>(
   }
 }
 
-// --- Private helpers ------------------------------------------------------
-
 // Fetches the user row via the privileged findForAuth query and validates
-// it's usable for a write: not deleted, has a row.version (the version
-// column is a findForAuth contract field — absence is a schema bug, but
-// we still handle it gracefully rather than throwing past the burn).
-// Return type narrows `version` to `number` so the write-callsite doesn't
-// need a `?? 0` fallback — the guard lives here, not at every callsite.
+// it's usable for a write: not deleted, has a row.version >= 1 (a row
+// without any event stream — e.g. inserted straight into read_users — must
+// not be confirmable: the write would otherwise seed a fresh stream with a
+// bare user.updated). Return type narrows `version` to `number` so the
+// write-callsite doesn't need a `?? 0` fallback — the guard lives here,
+// not at every callsite.
 async function loadValidatedUser(
   ctx: HandlerContext,
   systemUser: SessionUser,
@@ -137,74 +134,6 @@ async function loadValidatedUser(
   const me = parseAuthUserRow(
     await ctx.queryAs(systemUser, UserQueries.findForAuth, { id: userId }),
   );
-  if (!me || me.isDeleted || me.version === undefined) return null;
+  if (!me || me.isDeleted || me.version === undefined || me.version < 1) return null;
   return { ...me, version: me.version };
 }
-
-// Loads the user's memberships and returns a prioritised tenant list, with the
-// aggregate's real stream tenant recovered from the event log prepended.
-//
-// Empty only when the user has NO memberships AND no recoverable stream tenant
-// — the caller treats that as invalid_token. A zero-membership systemScope user
-// whose stream lives outside any membership (a platform operator seeded under a
-// fixture/SYSTEM tenant) still resolves, because the stream-tenant lookup runs
-// before the empty check rather than being short-circuited by it.
-async function resolveStreamTenants(
-  ctx: HandlerContext,
-  systemUser: SessionUser,
-  me: AuthUserRow,
-): Promise<readonly TenantId[]> {
-  const memberships = (await ctx.queryAs(systemUser, "tenant:query:memberships", {
-    userId: me.id,
-  })) as Array<{ tenantId: TenantId }>; // @cast-boundary db-runner
-  const ordered = orderTenantsByPreference(memberships, me.lastActiveTenantId);
-
-  // The user aggregate is r.systemScope(): its event stream lives in whichever
-  // tenant the creating executor used, which need NOT be a membership tenant.
-  // A platform operator seeded under a fixture/platform tenant is the live case
-  // — its stream tenant is absent from `ordered`, so a membership-only search
-  // rejects every write and collapses to invalid_token. Recover the real stream
-  // tenant from the event log and try it first; memberships stay as fallback.
-  // Pulled BEFORE the empty-membership check so a zero-membership operator whose
-  // stream lives in SYSTEM_TENANT is recoverable instead of collapsing to
-  // invalid_token — mirrors change-password.write.ts's unconditional recovery.
-  const streamTenant = await getAggregateStreamTenant(ctx.db.raw, me.id, USER_FEATURE);
-  if (streamTenant && !ordered.includes(streamTenant)) {
-    return [streamTenant, ...ordered];
-  }
-  return ordered;
-}
-
-// Discriminated result for the write-across-tenants loop.
-//   all_conflicts → every candidate rejected with version_conflict →
-//                   token-level failure; caller returns invalidToken.
-//   hard_failure  → a non-conflict error that should bubble unchanged
-//                   (DB down, access denied, …); caller returns it as-is.
-type TenantWriteResult =
-  | { isSuccess: true }
-  | { isSuccess: false; reason: "all_conflicts" }
-  | { isSuccess: false; reason: "hard_failure"; failure: WriteFailure };
-
-// Attempts the update against each candidate stream. memberships-query
-// has no deterministic ORDER BY, so the matching stream is discovered by
-// attempt: version_conflict → try the next candidate, anything else →
-// bubble immediately so ops sees the real failure class.
-async function tryWriteAcrossTenants(
-  ctx: HandlerContext,
-  me: AuthUserRow & { version: number },
-  tenantOrder: readonly TenantId[],
-  changes: Record<string, unknown>,
-): Promise<TenantWriteResult> {
-  for (const tenantId of tenantOrder) {
-    const writeRes = await ctx.writeAs(createSystemUser(tenantId), UserHandlers.update, {
-      id: me.id,
-      version: me.version,
-      changes,
-    });
-    if (writeRes.isSuccess) return { isSuccess: true };
-    if (writeRes.error.code !== "version_conflict") {
-      return { isSuccess: false, reason: "hard_failure", failure: writeRes };
-    }
-  }
-  return { isSuccess: false, reason: "all_conflicts" };
-}

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -20,14 +20,15 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
+  buildSessionRoles,
   createSystemUser,
   defineWriteHandler,
   type SessionUser,
-  stripForbiddenMembershipRoles,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { decryptStoredPii, verifyPassword } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
   INVITATION_STATUS,
@@ -45,12 +46,12 @@ import {
   getInvitationIdForToken,
   unburnInviteToken,
 } from "../invite-token-store";
-import { verifyPassword } from "../password-hashing";
+import { passwordSchema } from "../password-policy";
 
 const InviteAcceptWithLoginSchema = z.object({
   token: z.string().min(1),
   email: z.email(),
-  password: z.string().min(8).max(200),
+  password: passwordSchema,
 });
 
 export type InviteAcceptWithLoginData = {
@@ -106,7 +107,11 @@ export function createInviteAcceptWithLoginHandler() {
           return invalidInviteToken();
 
         const invitationTenantId = invitation.tenantId;
-        const invitationEmail = invitation.email;
+        const invitationEmail = await decryptStoredPii(
+          invitation.email,
+          "email",
+          "auth:invite-accept-with-login",
+        );
         const invitationRole = invitation.role;
         const invitationVersion = invitation.version;
 
@@ -165,7 +170,9 @@ export function createInviteAcceptWithLoginHandler() {
         const session: SessionUser = {
           id: userId,
           tenantId: invitationTenantId,
-          roles: stripForbiddenMembershipRoles([invitationRole]),
+          // buildSessionRoles calls stripForbiddenMembershipRoles internally —
+          // a reserved role on the invitation itself must never reach the session.
+          roles: buildSessionRoles([], [invitationRole]),
         };
 
         committed = true;

package/src/auth-email-password/handlers/invite-accept.write.ts

@@ -24,6 +24,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
 import {
   INVITATION_STATUS,
@@ -100,7 +101,11 @@ export function createInviteAcceptHandler() {
           return invalidInviteToken();
 
         const invitationTenantId = invitation.tenantId;
-        const invitationEmail = invitation.email;
+        const invitationEmail = await decryptStoredPii(
+          invitation.email,
+          "email",
+          "auth:invite-accept",
+        );
         const invitationRole = invitation.role;
         const invitationVersion = invitation.version;
 
@@ -110,7 +115,9 @@ export function createInviteAcceptHandler() {
         const userRow = await fetchOne<UserEmailRow>(ctx.db.raw, userTable, {
           id: event.user.id,
         });
-        const userEmail = userRow?.email;
+        const userEmail = userRow?.email
+          ? await decryptStoredPii(userRow.email, "email", "auth:invite-accept")
+          : undefined;
         if (!userRow || !userEmail || userEmail.toLowerCase() !== invitationEmail) {
           return inviteEmailMismatch();
         }

package/src/auth-email-password/handlers/invite-create.write.ts

@@ -19,7 +19,7 @@
 import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
@@ -77,7 +77,7 @@ export function createInviteCreateHandler(opts: InviteCreateOptions) {
   return defineWriteHandler<"invite-create", typeof InviteCreateSchema, InviteCreateData>({
     name: "invite-create",
     schema: InviteCreateSchema,
-    access: { roles: ["Admin"] },
+    access: { roles: access.admin },
     handler: async (event, ctx) => {
       if (!ctx.redis) {
         return writeFailure(

package/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -24,14 +24,15 @@ import {
   type DbConnection,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
+  buildSessionRoles,
   createSystemUser,
   defineWriteHandler,
   type SessionUser,
-  stripForbiddenMembershipRoles,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
   INVITATION_STATUS,
@@ -49,12 +50,13 @@ import {
   getInvitationIdForToken,
   unburnInviteToken,
 } from "../invite-token-store";
+import { passwordSchema } from "../password-policy";
 // kumiko-lint-ignore cross-feature-import provisioning needs cross-feature seeding helpers
 import { seedUserWithPassword } from "../seeding";
 
 const InviteSignupCompleteSchema = z.object({
   token: z.string().min(1),
-  password: z.string().min(8).max(200),
+  password: passwordSchema,
 });
 
 export type InviteSignupCompleteData = {
@@ -109,7 +111,11 @@ export function createInviteSignupCompleteHandler() {
           return invalidInviteToken();
 
         const invitationTenantId = invitation.tenantId;
-        const invitationEmail = invitation.email;
+        const invitationEmail = await decryptStoredPii(
+          invitation.email,
+          "email",
+          "auth:invite-signup-complete",
+        );
         const invitationRole = invitation.role;
         const invitationVersion = invitation.version;
 
@@ -161,7 +167,9 @@ export function createInviteSignupCompleteHandler() {
         const session: SessionUser = {
           id: userId,
           tenantId: invitationTenantId,
-          roles: stripForbiddenMembershipRoles([invitationRole]),
+          // buildSessionRoles calls stripForbiddenMembershipRoles internally —
+          // a reserved role on the invitation itself must never reach the session.
+          roles: buildSessionRoles([], [invitationRole]),
         };
 
         committed = true;