@cosmicdrift/kumiko-bundled-features 0.388.0 → 0.390.0

package/dist/billing-foundation/consumer-protection/termination-revoke.js

@@ -11,6 +11,8 @@ import { CONTRACT_TERMINATION_DECLARED_EVENT_QN, CONTRACT_TERMINATION_REVOKED_EV
 import { getSubscriptionForTenant } from "../get-subscription-for-tenant.js";
 import { SubscriptionFoundationHandlers } from "../web/constants.js";
 import { notifyOperator } from "./termination-notify.js";
+import { hasOtherOpenProviderCancel } from "./termination-open-cancels.js";
+import { TERMINATION_PROVIDER_LOCK_KEY, TERMINATION_PROVIDER_LOCK_NAMESPACE, } from "./termination-provider-lock.js";
 import { findRecordedTermination, hasRevocation, resumeAtProvider } from "./termination-record.js";
 export const REVOCATION_PATHS = {
     de: "/legal/kuendigen/zuruecknehmen",
@@ -66,7 +68,7 @@ export function createRevokeContractTerminationHandler() {
         handler: async (event, ctx) => {
             // @cast-boundary engine-payload — dispatcher-zod-validated payload
             const payload = event.payload;
-            const result = await ctx.writeAs(createSystemUser(payload.tenantId), SubscriptionFoundationHandlers.recordContractTerminationRevocation, { requestId: payload.requestId, token: payload.token });
+            const result = await ctx.dispatch.writeAs(createSystemUser(payload.tenantId), SubscriptionFoundationHandlers.recordContractTerminationRevocation, { requestId: payload.requestId, token: payload.token });
             return {
                 isSuccess: true,
                 data: { outcome: result.isSuccess ? parseOutcome(result.data) : "invalid" },
@@ -84,11 +86,13 @@ export function createRecordContractTerminationRevocationHandler(options, consum
             // @cast-boundary engine-payload — dispatcher-zod-validated payload
             const payload = event.payload;
             const tenantId = event.user.tenantId;
+            // The provider cancel/resume and the stream append must not interleave across declarations of the same subscription.
+            await ctx.db.advisoryXactLock(TERMINATION_PROVIDER_LOCK_NAMESPACE, TERMINATION_PROVIDER_LOCK_KEY);
             const outcome = (value) => ({
                 isSuccess: true,
                 data: { outcome: value },
             });
-            const stream = await ctx.fetchForWriting({
+            const stream = await ctx.events.fetchForWriting({
                 aggregateId: subscriptionAggregateId(tenantId),
                 aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
             });
@@ -111,22 +115,16 @@ export function createRecordContractTerminationRevocationHandler(options, consum
                 return outcome("too-late");
             }
             const reasons = ["revoked"];
-            if (requested?.providerCancel === "period-end") {
+            if (requested?.providerCancel === "period-end" &&
+                !hasOtherOpenProviderCancel(stream.events, payload.requestId)) {
                 reasons.push(...(await resumeAtProvider(ctx, subscription)));
             }
             // Re-fetch after the external call, like record-contract-termination.
-            const streamAfterProviderCall = await ctx.fetchForWriting({
+            const streamAfterProviderCall = await ctx.events.fetchForWriting({
                 aggregateId: subscriptionAggregateId(tenantId),
                 aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
             });
-            // A cancel recorded between the first fetch and now was never resumed above.
-            const requestedMeanwhile = requested === undefined
-                ? findRecordedTermination(streamAfterProviderCall.events, payload.requestId)
-                : undefined;
-            if (requestedMeanwhile?.providerCancel === "period-end") {
-                reasons.push(...(await resumeAtProvider(ctx, await getSubscriptionForTenant(ctx, tenantId))));
-            }
-            const providerCancel = (requested ?? requestedMeanwhile)?.providerCancel;
+            const providerCancel = requested?.providerCancel;
             const revoked = {
                 requestId: payload.requestId,
                 revokedAtIso: now.toString(),

package/dist/billing-foundation/events.js

@@ -16,7 +16,7 @@ import { CONSENT_LOCALES } from "./web/consumer-protection/consent-locale.js";
 // one stream; the subscriptionAggregateId helper provides the stream ID.
 export const SUBSCRIPTION_AGGREGATE_TYPE = "subscription";
 // Event-name constants — short form (for r.defineEvent) and qualified
-// FQN (for ctx.unsafeAppendEvent and projection-apply keys).
+// FQN (for ctx.events.unsafeAppend and projection-apply keys).
 export const SUBSCRIPTION_CREATED_EVENT_SHORT = "subscription-created";
 export const SUBSCRIPTION_UPDATED_EVENT_SHORT = "subscription-updated";
 export const SUBSCRIPTION_CANCELED_EVENT_SHORT = "subscription-canceled";

package/dist/billing-foundation/feature.js

@@ -122,7 +122,7 @@ export function createBillingFoundationFeature(options = {}) {
         // providerCustomerId is tenantOwned ciphertext, not plaintext personal data.
         r.defineEvent(PAYMENT_RECEIVED_EVENT_SHORT, paymentEventPayloadSchema, { piiFields: "none" });
         // Inline projection: materialized current state in `read_subscriptions`.
-        // Apply runs in the same TX as ctx.unsafeAppendEvent — read-your-own-
+        // Apply runs in the same TX as ctx.events.unsafeAppend — read-your-own-
         // write without a dispatcher tick.
         r.projection({
             name: "subscription",
@@ -203,11 +203,11 @@ export function createBillingFoundationFeature(options = {}) {
             perTenant: true,
             runOnBoot: true,
             handler: async (_payload, ctx) => {
-                const result = await ctx.write(SubscriptionFoundationHandlers.syncSubscription, {});
+                const result = await ctx.dispatch.write(SubscriptionFoundationHandlers.syncSubscription, {});
                 if (!result.isSuccess) {
                     throw new Error(`billing-foundation:sync-subscriptions: sync-subscription write failed: ${JSON.stringify(result.error)}`);
                 }
-                ctx.log.info(`[billing-foundation:sync-subscriptions] ${JSON.stringify(result.data)}`);
+                ctx.obs.log.info(`[billing-foundation:sync-subscriptions] ${JSON.stringify(result.data)}`);
             },
         });
         r.useExtension(EXT_TENANT_DATA, "subscription", {

package/dist/billing-foundation/get-subscription-for-tenant.d.ts

@@ -18,4 +18,4 @@ export type SubscriptionView = {
 /** Returns the tenant's only subscription row (deterministic
  *  aggregate ID), or null if the tenant has never subscribed. The status
  *  may be active/canceled/past_due/etc.; the caller decides what to do. */
-export declare function getSubscriptionForTenant(ctx: HandlerContext, tenantId: string): Promise<SubscriptionView | null>;
+export declare function getSubscriptionForTenant(ctx: Pick<HandlerContext, "db">, tenantId: string): Promise<SubscriptionView | null>;

package/dist/billing-foundation/handlers/process-event.write.js

@@ -9,7 +9,7 @@
 //      with no second append.
 //   2. Type mapping: SubscriptionEvent.type (= normalized by the plugin)
 //      → one of the 5 ES event types.
-//   3. ctx.unsafeAppendEvent — the inline projection materializes the
+//   3. ctx.events.unsafeAppend — the inline projection materializes the
 //      `read_subscriptions` row in the same TX.
 import { configuredPiiSubjectKms, encryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
@@ -126,7 +126,7 @@ export async function appendSubscriptionEvent(ctx, tenantId, rawPayload, now = T
     //    streams, optimize via snapshot or a per-tenant dedup table as the
     //    idempotency anchor (like cap-counter).
     // ---------------------------------------------------------------
-    const existingEvents = await ctx.loadAggregate(aggId);
+    const existingEvents = await ctx.events.load(aggId);
     const alreadySeen = existingEvents.some((e) => {
         const headers = e.metadata.headers ?? {};
         return (headers["providerEventId"] === payload.providerEventId &&
@@ -139,7 +139,7 @@ export async function appendSubscriptionEvent(ctx, tenantId, rawPayload, now = T
     // late delivery: appending it would roll the row back (a canceled subscription
     // would come back active). Invoice events carry the live state, not a snapshot.
     if (isLateStateEvent(existingEvents, payload)) {
-        ctx.log?.warn(`[billing-foundation:process-event] dropped late ${payload.type} ${payload.providerEventId}: a newer provider event is already stored`);
+        ctx.obs.log?.warn(`[billing-foundation:process-event] dropped late ${payload.type} ${payload.providerEventId}: a newer provider event is already stored`);
         return { duplicate: false, stale: true, subscriptionAggregateId: aggId };
     }
     // ---------------------------------------------------------------
@@ -196,7 +196,7 @@ export async function appendSubscriptionEvent(ctx, tenantId, rawPayload, now = T
         providerEventId: payload.providerEventId,
         providerName: payload.providerName,
     };
-    await ctx.unsafeAppendEvent({
+    await ctx.events.unsafeAppend({
         aggregateId: aggId,
         aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
         type: esEventType,
@@ -240,7 +240,7 @@ export function createProcessEventHandler(now) {
             const payload = event.payload;
             const current = await getSubscriptionForTenant(ctx, event.user.tenantId);
             if (isStaleSubscriptionEvent(current, payload, now())) {
-                ctx.log?.warn(`[billing-foundation:process-event] dropped stale ${payload.type} ${payload.providerEventId}: tenant already tracks another subscription`);
+                ctx.obs.log?.warn(`[billing-foundation:process-event] dropped stale ${payload.type} ${payload.providerEventId}: tenant already tracks another subscription`);
                 return {
                     isSuccess: true,
                     data: {

package/dist/billing-foundation/handlers/process-payment-event.write.js

@@ -6,7 +6,7 @@
 //   1. Idempotency-check: loads the payment-stream and scans for an
 //      already-seen `metadata.providerEventId`. A provider-replay with
 //      the same event-id → duplicate=true, no second append.
-//   2. ctx.unsafeAppendEvent — inline-projection materializes a new
+//   2. ctx.events.unsafeAppend — inline-projection materializes a new
 //      `read_payments`-row (INSERT-once, not UPSERT — every payment is
 //      its own fact, not a state-update).
 import { configuredPiiSubjectKms, encryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
@@ -41,7 +41,7 @@ export const processPaymentEventHandler = {
         //    (a tenant with hundreds of purchases scans hundreds of events;
         //    optimize via a per-tenant providerEventId-index if that bites).
         // ---------------------------------------------------------------
-        const existingEvents = await ctx.loadAggregate(aggId);
+        const existingEvents = await ctx.events.load(aggId);
         const alreadySeen = existingEvents.some((e) => {
             const headers = e.metadata.headers ?? {};
             return (headers["providerEventId"] === payload.providerEventId &&
@@ -81,7 +81,7 @@ export const processPaymentEventHandler = {
                 providerCheckoutId: payload.providerCheckoutId,
             }),
         };
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId: aggId,
             aggregateType: PAYMENT_AGGREGATE_TYPE,
             type: PAYMENT_RECEIVED_EVENT_QN,

package/dist/billing-foundation/plan-catalog.js

@@ -50,7 +50,7 @@ export async function resolvePlanPrices(ctx, plugin, catalog) {
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        ctx.log?.warn("billing-foundation: retrievePrices threw, all plan prices unavailable", {
+        ctx.obs.log?.warn("billing-foundation: retrievePrices threw, all plan prices unavailable", {
             message,
         });
         return result;
@@ -67,7 +67,7 @@ export async function resolvePlanPrices(ctx, plugin, catalog) {
                 result.set(tier, { priceId: chosen.priceId, price: chosen });
         }
         else if (active.length > 1) {
-            ctx.log?.warn(`billing-foundation: tier "${tier}" has ${active.length} active flat-amount prices — expected exactly one, price stays unavailable`);
+            ctx.obs.log?.warn(`billing-foundation: tier "${tier}" has ${active.length} active flat-amount prices — expected exactly one, price stays unavailable`);
         }
     }
     return result;

package/dist/billing-foundation/projection.js

@@ -1,7 +1,7 @@
 // Inline projection for `read_subscriptions`. Materializes the 5
 // subscription events into one row per tenant.
 //
-// Apply runs in the same transaction as ctx.unsafeAppendEvent, so the caller
+// Apply runs in the same transaction as ctx.events.unsafeAppend, so the caller
 // sees its write state immediately (no dispatcher tick required). The PK is
 // event.aggregateId (= deterministic uuidv5 per tenant), so replays collide
 // on the PK instead of creating duplicate rows.

package/dist/billing-foundation/types.js

@@ -18,7 +18,7 @@
 //   2. **Post-tenant-resolution:** `createPortalSession` +
 //      `cancelSubscription` are called from regular write handlers with
 //      a fully resolved HandlerContext. The plugin can use ctx.config +
-//      ctx.secrets for tenant-specific configuration (e.g. tenant-owned
+//      ctx.services.secrets for tenant-specific configuration (e.g. tenant-owned
 //      customer-id mappings).
 //
 // Foundation uses only the common subset of provider functionality;

package/dist/cap-counter/aggregate-id.d.ts

@@ -16,7 +16,7 @@ export declare function capCounterAggregateId(tenantId: string, capName: string,
  * different uuidv5 namespace, different output UUID. This also prevents an
  * accidental calendar increment from landing on the rolling stream.
  *
- * **Caller:** `CapCounterHandlers.incrementRolling` (via `ctx.write`) calls
+ * **Caller:** `CapCounterHandlers.incrementRolling` (via `ctx.dispatch.write`) calls
  * this with tenantId + capName and appends increment events to the stream.
  * Race-free because the event store appends with an auto-incrementing version.
  */

package/dist/cap-counter/aggregate-id.js

@@ -30,7 +30,7 @@ export function capCounterAggregateId(tenantId, capName, periodStartIso) {
  * different uuidv5 namespace, different output UUID. This also prevents an
  * accidental calendar increment from landing on the rolling stream.
  *
- * **Caller:** `CapCounterHandlers.incrementRolling` (via `ctx.write`) calls
+ * **Caller:** `CapCounterHandlers.incrementRolling` (via `ctx.dispatch.write`) calls
  * this with tenantId + capName and appends increment events to the stream.
  * Race-free because the event store appends with an auto-incrementing version.
  */

package/dist/cap-counter/book-cap-usage.d.ts

@@ -1,5 +1,5 @@
 import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { type HandlerContext, type JobContext, type SessionUser, type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import { type HandlerContext, type JobContext, type ReservationContext, type SessionUser, type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 export declare function retryCounterWriteOnVersionConflict(writeAttempt: () => Promise<WriteResult>): Promise<WriteResult>;
 export declare function retryOnStreamVersionConflict<T>(attempt: () => Promise<T>): Promise<T>;
 export type BookCapUsageOptions = {
@@ -9,7 +9,7 @@ export type BookCapUsageOptions = {
     readonly outsideTransaction?: boolean;
     readonly guardCurrentValue?: (currentValue: number) => void;
 };
-export type CapCounterContext = HandlerContext | JobContext;
+export type CapCounterContext = HandlerContext | JobContext | ReservationContext;
 export type CapCounterScope = {
     readonly user: SessionUser;
     readonly readDb: TenantDb;

package/dist/cap-counter/book-cap-usage.js

@@ -60,7 +60,7 @@ function assertDbServesUser(db, user) {
     return db;
 }
 // Jobs write in place (their db is not transaction-bound); systemScope handlers reach both dbs via
-// systemDb, because their ctx.db / ctx.dbOutsideTransaction are fail-closed proxies.
+// systemDb, because their ctx.db / ctx.db.outsideTransaction are fail-closed proxies.
 export function resolveCapCounterScope(ctx, outsideTransaction) {
     // A job context spread into a handler-shaped one (user set) is a handler context: its user, not
     // the job's systemUser, names the metered tenant.
@@ -83,10 +83,10 @@ export function resolveCapCounterScope(ctx, outsideTransaction) {
             : readDb;
         return { user, readDb, writeDb };
     }
-    const writeDb = outsideTransaction ? ctx.dbOutsideTransaction : ctx.db;
+    const writeDb = outsideTransaction ? ctx.db.outsideTransaction : ctx.db;
     if (!writeDb) {
         throw new Error(outsideTransaction
-            ? "cap-counter: outsideTransaction requested but ctx.dbOutsideTransaction is undefined"
+            ? "cap-counter: outsideTransaction requested but ctx.db.outsideTransaction is undefined"
             : "cap-counter: ctx.db missing — run inside a handler context");
     }
     return {

package/dist/cap-counter/cap-reservation.js

@@ -186,6 +186,16 @@ function bookCalendarDelta(txDb, user, period, delta) {
         return Promise.resolve({ isSuccess: true, data: {} });
     return applyCapDeltaOn(txDb, user, { ...period, amount: Math.abs(delta) }, delta > 0 ? "add" : "subtract");
 }
+// Asked after a missed or lost claim. A released tombstone committed since the first read does not
+// count: the caller's own tombstone insert then conflicts with it, and the retry claims that row.
+async function hasSettledTombstone(txDb, user, id) {
+    const settled = await txDb.fetchOne(capReservationsTable, {
+        id,
+        tenantId: user.tenantId,
+        settledAt: { ne: null },
+    });
+    return settled !== undefined;
+}
 async function settleInTransaction(txDb, user, id, options) {
     const ownRow = { id, tenantId: user.tenantId };
     const open = await txDb.fetchOne(capReservationsTable, {
@@ -205,12 +215,11 @@ async function settleInTransaction(txDb, user, id, options) {
         await txDb.updateMany(capReservationsTable, { settledAt: now, expiresAt: now.add({ minutes: CAP_SETTLED_TOMBSTONE_TTL_MINUTES }) }, ownRow);
         return booked;
     }
-    // The claim lost to a concurrent settle or release: a tombstone means the amount is booked.
-    if (await txDb.fetchOne(capReservationsTable, ownRow)) {
+    if (await hasSettledTombstone(txDb, user, id))
         return NOTHING_TO_RELEASE;
-    }
     // Row swept or released: its amount was given back, so the full actual amount is booked and a
-    // tombstone makes a repeated settle a no-op. A parallel settle inserting first fails this insert.
+    // tombstone makes a repeated settle a no-op. A parallel settle or consume inserting first fails
+    // this insert.
     // Booking first: a lost counter race returns a result instead of throwing, so the transaction
     // commits and a tombstone written before it would turn the retry into a no-op.
     const booked = await bookCalendarDelta(txDb, user, options, options.actualAmount);
@@ -286,7 +295,7 @@ async function consumeClaimedRow(txDb, user, claimed, options) {
     return NOTHING_TO_RELEASE;
 }
 // Row already expired away: the units are booked directly and a released tombstone remembers them
-// so a later settle subtracts them. A parallel consume inserting first fails this insert.
+// so a later settle subtracts them. A parallel consume or settle inserting first fails this insert.
 async function consumeWithoutRow(txDb, user, id, options) {
     // Booking first, for the same reason as settle's missing-row path.
     const booked = await bookCalendarDelta(txDb, user, options, options.units);
@@ -320,7 +329,7 @@ async function consumeInTransaction(txDb, user, id, options) {
     const claimed = open && (await claimReservationRow(txDb, user, open));
     if (claimed)
         return consumeClaimedRow(txDb, user, claimed, options);
-    if (await txDb.fetchOne(capReservationsTable, ownRow)) {
+    if (await hasSettledTombstone(txDb, user, id)) {
         throw new CapReservationSettledError(options.capName);
     }
     return consumeWithoutRow(txDb, user, id, options);
@@ -364,7 +373,7 @@ export async function releaseExpiredCapReservations(ctx, capName, outsideTransac
             await releaseCapReservation(ctx, id, outsideTransaction);
         }
         catch (error) {
-            ctx.log?.error("releasing an expired cap reservation failed", { id, capName, error });
+            ctx.obs.log?.error("releasing an expired cap reservation failed", { id, capName, error });
         }
     }
 }

package/dist/cap-counter/constants.js

@@ -10,7 +10,7 @@ export const CAP_COUNTER_ROLLING_AGGREGATE_TYPE = "cap-counter-rolling";
 // Custom event types for rolling-window counters. The pair is symmetric:
 //   _SHORT  — matches `r.defineEvent(short, schema)` in the registrar
 //             (the framework automatically prefixes it to the QN)
-//   _QN     — qualified form for `ctx.unsafeAppendEvent({type})`, the
+//   _QN     — qualified form for `ctx.events.unsafeAppend({type})`, the
 //             `events.type` column, and `registry.getEvent(qn)` lookups
 // Both MUST stay consistent; the feature test pins against drift.
 export const ROLLING_INCREMENTED_EVENT_SHORT = "rolling-incremented";

package/dist/cap-counter/feature.js

@@ -31,7 +31,7 @@
 //     ai-foundation are BYOK by default and currently have no platform pool
 //     to count. cap-counter is generic: an app owner who wants to use the
 //     counter calls `bookCapUsage(...)` /
-//     `ctx.write(CapCounterHandlers.incrementRolling, ...)` from their own handler.
+//     `ctx.dispatch.write(CapCounterHandlers.incrementRolling, ...)` from their own handler.
 //   - **No reset cron for the calendar period.** It works without one: the
 //     periodStartIso part of the aggregate id rolls over to a fresh counter
 //     at the period boundary. Old rows remain for auditing.
@@ -54,6 +54,7 @@ import { CAP_COUNTER_I18N } from "./i18n.js";
 import { capReservationsTableMeta } from "./tables.js";
 export function createCapCounterFeature() {
     return defineFeature(CAP_COUNTER_FEATURE, (r) => {
+        r.adoptsBundledLists();
         r.describe("Tracks per-tenant usage against configurable limits using two complementary storage models: calendar-period counters (one projection row per tenant/capName/period, reset implicitly by period rollover) and rolling-window counters (append-only event stream, no projection). Use `enforceCap` / `enforceRollingCap` (or the `withCapEnforcement` / `withRollingCapEnforcement` handler wrappers) in your write-handlers to check limits with soft-warn and hard-block tolerances; call `enforceCapAndMaybeNotify` when you also want to trigger a delivery notification on soft-threshold hits.");
         r.uiHints({
             displayLabel: "Cap Counter · Usage Limits",
@@ -65,7 +66,7 @@ export function createCapCounterFeature() {
             reason: "coordination.cap_reservation_ledger",
         });
         // Custom domain event for the rolling counter. r.defineEvent registers the
-        // schema with the registry; ctx.unsafeAppendEvent in the handler reuses the
+        // schema with the registry; ctx.events.unsafeAppend in the handler reuses the
         // same schema for append-time validation. QN after prefixing:
         // "cap-counter:event:rolling-incremented" (see
         // ROLLING_INCREMENTED_EVENT_QN).

package/dist/cap-counter/handlers/increment-rolling.write.js

@@ -63,7 +63,7 @@ export const incrementRollingCapHandler = {
         // unsafeAppendEvent: the strict appendEvent is bound to an app's own event map, which
         // bundled-features cannot see. Schema validation still runs because r.defineEvent
         // registered the schema.
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId,
             aggregateType: CAP_COUNTER_ROLLING_AGGREGATE_TYPE,
             type: ROLLING_INCREMENTED_EVENT_QN,

package/dist/cap-counter/reservation-chain.js

@@ -22,7 +22,7 @@ export function chainReservations(inner, own) {
                 await innerHandle.release();
             }
             catch (releaseError) {
-                ctx.log?.error("releasing the inner cap reservation failed", { error: releaseError });
+                ctx.obs.log?.error("releasing the inner cap reservation failed", { error: releaseError });
             }
             throw error;
         }

package/dist/cap-counter/with-cap-enforcement.d.ts

@@ -1,4 +1,4 @@
-import type { HandlerContext, WriteEvent, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import type { ReservationContext, WriteEvent, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { type CapToleranceProfileName, type SoftHitNotifier } from "./enforce-cap.ts";
 /**
  * Dynamic cap definition resolved for each handler invocation. A typical caller reads the tenant
@@ -20,7 +20,7 @@ export type CalendarCapDef = {
  *  to compute the cap-spec for THIS request (e.g. limit derived from
  *  tenant-tier). Sync OR async — async lets the caller fetch the
  *  tier from DB. */
-export type CalendarCapResolver = (event: WriteEvent, ctx: HandlerContext) => Promise<CalendarCapDef> | CalendarCapDef;
+export type CalendarCapResolver = (event: WriteEvent, ctx: ReservationContext) => Promise<CalendarCapDef> | CalendarCapDef;
 /**
  * Wrap a write-handler with calendar-period cap-enforcement.
  *
@@ -40,7 +40,7 @@ export type RollingCapDef = {
     readonly amount?: number;
     readonly notify: SoftHitNotifier;
 };
-export type RollingCapResolver = (event: WriteEvent, ctx: HandlerContext) => Promise<RollingCapDef> | RollingCapDef;
+export type RollingCapResolver = (event: WriteEvent, ctx: ReservationContext) => Promise<RollingCapDef> | RollingCapDef;
 /**
  * Wrap a write-handler with rolling-window cap-enforcement.
  *

package/dist/cap-counter/with-cap-enforcement.js

@@ -12,7 +12,7 @@
 // after a rollback, failure result or failed COMMIT only gives back what is still booked, so an
 // unknown COMMIT outcome cannot under-count. No connection is held across the handler. Rows a
 // crashed process left behind expire after CAP_RESERVATION_TTL_MINUTES and are given back before the
-// next reserve of the same cap. Reached through a nested ctx.write the cap is not reserved, so the
+// next reserve of the same cap. Reached through a nested ctx.dispatch.write the cap is not reserved, so the
 // dispatcher rejects that call unless the top-level batch reserved the same handler.
 //
 // The wrapper spreads the wrapped handler and chains its reserveBeforeTransaction: inner reserves

package/dist/cap-overview/feature.js

@@ -36,6 +36,7 @@ export function createCapOverviewFeature(opts) {
         }
     }
     return defineFeature(CAP_OVERVIEW_FEATURE, (r) => {
+        r.adoptsBundledLists();
         r.describe("Read-only visibility into per-tenant tier assignment and cap usage. SystemAdmin gets a platform-wide tenant list with usage bars; tenant admins (or the roles in `usageVisibleTo`) get their own tenant's usage as dashboard cards. Reads tier-engine, billing-foundation, and tenant data plus app-owned usage tables via caller-supplied CapSpec callbacks — never writes.");
         r.uiHints({
             displayLabel: "Cap Overview · Tier & Usage Visibility",

package/dist/cap-overview/handlers/caps-usage.query.js

@@ -51,7 +51,7 @@ export function createCapsUsageQuery(caps, usageRoles) {
             const tier = checkedRows[0]?.tier ?? "";
             // Override path: limits must read the TARGET tenant's config, not the
             // SystemAdmin caller's.
-            const config = override === undefined ? ctx.config : ctx.configFor?.(targetTenantId);
+            const config = override === undefined ? ctx.config : ctx.tenants.config?.(targetTenantId);
             const rows = await Promise.all(caps.map(async (cap) => {
                 const used = await cap.usage(db, targetTenantId);
                 const limit = await cap.limit(tier, { config });

package/dist/cap-overview/handlers/tenant-caps-list.query.js

@@ -163,7 +163,7 @@ export function createTenantCapsListQuery(caps, listCaps) {
                 const perTenantEntries = await Promise.all(pageTenantIds.map(async (tenantId) => [tenantId, await cap.usage(db, tenantId)]));
                 usageByCap.set(cap.id, new Map(perTenantEntries));
             }));
-            const limitByTenantAndCap = await resolveLimitsByTenantAndCap(listedCaps, page, ctx.configFor);
+            const limitByTenantAndCap = await resolveLimitsByTenantAndCap(listedCaps, page, ctx.tenants.config);
             const rows = page.map((row) => {
                 const capFields = {};
                 for (const cap of listedCaps) {

package/dist/compliance-profiles/seeding.d.ts

@@ -1,6 +1,6 @@
 import type { ComplianceProfileKey, ComplianceProfileOverride } from "@cosmicdrift/kumiko-framework/compliance";
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
 export type SeedComplianceProfileOptions = {
     readonly tenantId: TenantId;

package/dist/compliance-profiles/seeding.js

@@ -10,14 +10,20 @@
 //
 // The pattern matches seedTextBlock in template-resolver/seeding.ts.
 import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
-import { runEventStoreSeed, TestUsers, } from "@cosmicdrift/kumiko-framework/seeding";
+import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { runEventStoreSeed } from "@cosmicdrift/kumiko-framework/seeding";
 import { tenantComplianceProfileEntity, tenantComplianceProfileTable, } from "./schema/profile-selection.js";
 const executor = createEventStoreExecutor(tenantComplianceProfileTable, tenantComplianceProfileEntity, { entityName: "tenant-compliance-profile" });
 export async function seedComplianceProfile(db, opts) {
     // user.tenantId must equal opts.tenantId so the Event Store stream
     // and projection remain in the same tenant bucket.
-    const by = opts.by ?? { ...TestUsers.systemAdmin, tenantId: opts.tenantId };
-    const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
+    const by = opts.by ?? createSystemUser(opts.tenantId);
+    const tdb = createTenantDb({
+        db,
+        tenantId: opts.tenantId,
+        mode: "system",
+        reason: "seeding writes the compliance profile into an explicitly named tenant",
+    });
     const overrideJson = opts.override !== undefined ? JSON.stringify(opts.override) : null;
     const existing = (await fetchOne(db, tenantComplianceProfileTable, {
         tenantId: opts.tenantId,

package/dist/config/feature.js

@@ -64,14 +64,14 @@ export function createConfigAccessorFactory(registry, resolver) {
 // session reads "config feature not wired into AppContext" instead of a
 // generic "configResolver missing".
 export function requireConfigResolver(ctx, handlerName) {
-    if (!ctx.configResolver) {
+    if (!ctx.services.configResolver) {
         throw new InternalError({
-            message: `[${handlerName}] ctx.configResolver missing — pass createConfigAccessorFactory's ` +
+            message: `[${handlerName}] ctx.services.configResolver missing — pass createConfigAccessorFactory's ` +
                 `output via extraContext.configAccessorFactory and the resolver via ` +
                 `extraContext.configResolver at boot.`,
         });
     }
-    return ctx.configResolver;
+    return ctx.services.configResolver;
 }
 // Config declares r.systemScope() (raw ctx.db is unfiltered across tenants
 // in that mode), so config's own query handlers must go through ctx.systemDb's
@@ -101,13 +101,13 @@ export function requireSystemDb(ctx, handlerName, tenantId) {
 // if a handler tries to write an encrypted key without the provider in
 // place, pointing at the exact wiring gap).
 export function requireConfigEncryption(ctx, handlerName) {
-    if (!ctx.configEncryption) {
+    if (!ctx.services.configEncryption) {
         throw new InternalError({
-            message: `[${handlerName}] ctx.configEncryption missing — at least one config key declares ` +
+            message: `[${handlerName}] ctx.services.configEncryption missing — at least one config key declares ` +
                 `encrypted: true, so the boot wiring must pass an EnvelopeCipher via ` +
                 `extraContext.configEncryption (run{Prod,Dev}App wire it automatically from ` +
                 `KUMIKO_SECRETS_MASTER_KEY_V<n>; same instance the resolver was built with).`,
         });
     }
-    return ctx.configEncryption;
+    return ctx.services.configEncryption;
 }

package/dist/config/handlers/cascade.query.js

@@ -38,7 +38,7 @@ export const cascadeQuery = defineQueryHandler({
             keyDefs.set(key, keyDefAtScope(keyDef, query.payload.scope, query.user.roles));
             filteredKeys.push(key);
         }
-        const cascades = await resolver.getCascadeBatch(filteredKeys, keyDefs, query.user.tenantId, query.user.id, db, ctx.secrets);
+        const cascades = await resolver.getCascadeBatch(filteredKeys, keyDefs, query.user.tenantId, query.user.id, db, ctx.services.secrets);
         const result = {};
         for (const [key, rawCascade] of cascades) {
             const keyDef = keyDefs.get(key);

package/dist/config/handlers/readiness.query.js

@@ -58,7 +58,7 @@ export async function collectMissingRequiredConfig(ctx, callerQn, user, db, gate
         candidates.set(qualifiedKey, keyDef);
     }
     const missing = [];
-    const cascades = await resolver.getCascadeBatch([...candidates.keys()], candidates, user.tenantId, user.id, db, ctx.secrets);
+    const cascades = await resolver.getCascadeBatch([...candidates.keys()], candidates, user.tenantId, user.id, db, ctx.services.secrets);
     for (const [qualifiedKey, keyDef] of candidates) {
         // Deliberately the unredacted cascade value: readiness asks "does this
         // tenant functionally have the value?", and an inheritedToTenant:false key