@cosmicdrift/kumiko-bundled-features 0.389.0 → 0.390.0

package/dist/audit/feature.js

@@ -57,7 +57,7 @@ export function createAuditFeature() {
                 await runEscapeHatchRetention({
                     db: ctx.db.unsafeRaw(),
                     registry: ctx.registry,
-                    configResolver: ctx.configResolver,
+                    configResolver: ctx.services.configResolver,
                     userId: SYSTEM_USER_ID,
                 });
             },

package/dist/auth-email-password/auth-user-row.js

@@ -1,4 +1,4 @@
-// Narrow cross-feature query results (ctx.queryAs → Promise<unknown>) into
+// Narrow cross-feature query results (ctx.dispatch.queryAs → Promise<unknown>) into
 // the shape the auth handlers actually read. Replaces a bare
 // `as AuthUserRow | null` at the system boundary — the coding standard
 // requires a TypeGuard in place of unchecked casts from unknown.

package/dist/auth-email-password/bootstrap.js

@@ -7,6 +7,7 @@
 import { makeDispatchSystemWrite, makeDispatchWriteAs, } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { ConfigScopes, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 // kumiko-lint-ignore cross-feature-import bootstrap sets per-tenant config through the config feature's write handler
 import { ConfigHandlers } from "../config/web/constants.js";
@@ -139,7 +140,11 @@ async function decideInvite(deps, invite) {
 function isMailingOutcome(outcome) {
     return outcome === "invited" || outcome === "resent";
 }
-export async function bootstrapTenants(deps, plan) {
+// A one-shot operator process, not a tenant request: it looks up users, memberships and invitations across tenants.
+export function bootstrapTenants(deps, plan) {
+    return runInSystemRowLevelSecurityScope("boot tenant bootstrap creates tenants and memberships before any tenant exists", () => bootstrapTenantsInScope(deps, plan));
+}
+async function bootstrapTenantsInScope(deps, plan) {
     const plannedInvites = planInvites(plan);
     const dispatchSystemWrite = makeDispatchSystemWrite(deps.dispatcher);
     const dispatchWriteAsRoles = makeDispatchWriteAs(deps.dispatcher);

package/dist/auth-email-password/feature.js

@@ -48,7 +48,7 @@ export const authEmailPasswordEnvSchema = z.object({
         .describe("Optional `iss` claim pinned on every minted JWT."),
 });
 // Auth feature — email+password login. Depends on the user feature for
-// identity lookups (via ctx.queryAs) and on the tenant feature for
+// identity lookups (via ctx.dispatch.queryAs) and on the tenant feature for
 // membership resolution. No direct imports of foreign tables.
 export function createAuthEmailPasswordFeature(opts = {}) {
     // ≥32 chars, symmetric to the JWT_SECRET env check: a short HMAC secret

package/dist/auth-email-password/handlers/change-password.write.js

@@ -5,7 +5,7 @@ import { UserHandlers, UserQueries } from "../../user/index.js";
 import { invalidCredentials } from "../errors.js";
 import { passwordSchema } from "../password-policy.js";
 // Change-password — authenticated. The user supplies their current password
-// (re-auth) and the new one. The new hash is written via ctx.writeAs(system)
+// (re-auth) and the new one. The new hash is written via ctx.dispatch.writeAs(system)
 // against the user feature's update handler; field-access on passwordHash
 // (privileged-only) lets the system identity through.
 export const changePasswordWrite = defineWriteHandler({
@@ -21,8 +21,8 @@ export const changePasswordWrite = defineWriteHandler({
     },
     escapeHatch: {
         grants: ["systemIdentity"],
-        reason: "Reads the caller's own passwordHash (privileged-only field) via ctx.queryAs(SYSTEM, ...) " +
-            "and writes the new hash via ctx.writeAs(SYSTEM, user:update) — the caller's own " +
+        reason: "Reads the caller's own passwordHash (privileged-only field) via ctx.dispatch.queryAs(SYSTEM, ...) " +
+            "and writes the new hash via ctx.dispatch.writeAs(SYSTEM, user:update) — the caller's own " +
             "identity can't reach either, field-access on passwordHash is privileged-only.",
     },
     // Payload carries the old and new password.
@@ -31,7 +31,7 @@ export const changePasswordWrite = defineWriteHandler({
     handler: async (event, ctx) => {
         const systemUser = createSystemUser(event.user.tenantId);
         // Load self with passwordHash — only visible to the privileged caller.
-        const me = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
+        const me = (await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
             id: event.user.id,
         })); // @cast-boundary db-runner
         if (!me?.passwordHash) {
@@ -43,13 +43,13 @@ export const changePasswordWrite = defineWriteHandler({
         }
         const newHash = await hashPassword(event.payload.newPassword);
         // The user aggregate is systemStream: its event stream lives on
-        // SYSTEM_TENANT_ID deterministically. Previously scattered streams need the
-        // one-time backfillUserStreamTenants migration.
+        // SYSTEM_TENANT_ID deterministically. Previously scattered streams are moved by the
+        // boot-time stream-tenant backfill (runStreamTenantBackfillOnBoot).
         const writer = createSystemUser(SYSTEM_TENANT_ID);
         // Apply via user feature's update handler — writeAs(system) satisfies
         // the privileged-only write rule on passwordHash. Pass the current version
         // through so optimistic locking still applies end-to-end.
-        const writeRes = await ctx.writeAs(writer, UserHandlers.update, {
+        const writeRes = await ctx.dispatch.writeAs(writer, UserHandlers.update, {
             id: me.id,
             version: me.version,
             changes: { passwordHash: newHash },

package/dist/auth-email-password/handlers/confirm-account-unlock.write.js

@@ -29,9 +29,9 @@ export function createConfirmAccountUnlockHandler(opts) {
                     i18nKey: "auth.errors.unlockNotConfigured",
                 }));
             }
-            if (!ctx.redis) {
+            if (!ctx.services.redis) {
                 return writeFailure(new InternalError({
-                    message: "account-unlock requires ctx.redis to clear lockout state",
+                    message: "account-unlock requires ctx.services.redis to clear lockout state",
                 }));
             }
             // All verify failures (malformed / bad_signature / expired) fold into
@@ -40,7 +40,7 @@ export function createConfirmAccountUnlockHandler(opts) {
             const verify = verifyUnlockToken(event.payload.token, opts.hmacSecret);
             if (!verify.ok)
                 return invalidUnlockToken();
-            await clearLockoutState(ctx.redis, verify.userId);
+            await clearLockoutState(ctx.services.redis, verify.userId);
             return { isSuccess: true, data: { kind: "account-unlocked" } };
         },
     });

package/dist/auth-email-password/handlers/confirm-token-flow.js

@@ -30,10 +30,10 @@ export async function runConfirmTokenFlow(ctx, userId, expiresAtMs, spec) {
     declareEscapeHatch({
         reason: "writes the confirming user's row via UserHandlers.update on the caller's handler context, using a SYSTEM_TENANT-scoped identity; the calling handler declares its own escapeHatch",
     });
-    if (!ctx.redis) {
+    if (!ctx.services.redis) {
         return writeFailure(new InternalError({ message: spec.redisRequiredMessage }));
     }
-    const redis = ctx.redis;
+    const redis = ctx.services.redis;
     const burn = await burnToken(redis, spec.purpose, userId, expiresAtMs);
     if (burn === "already-used")
         return spec.invalidToken();
@@ -52,7 +52,7 @@ export async function runConfirmTokenFlow(ctx, userId, expiresAtMs, spec) {
             return { isSuccess: true, data: spec.alreadyDone.data };
         }
         const changes = await spec.buildChanges(me);
-        const writeRes = await ctx.writeAs(systemUser, UserHandlers.update, {
+        const writeRes = await ctx.dispatch.writeAs(systemUser, UserHandlers.update, {
             id: me.id,
             version: me.version,
             changes,
@@ -89,7 +89,7 @@ async function loadValidatedUser(ctx, systemUser, userId) {
     declareEscapeHatch({
         reason: "reads the confirming user's row via UserQueries.findForAuth on the caller's handler context, using a SYSTEM_TENANT-scoped identity; the calling handler declares its own escapeHatch",
     });
-    const me = parseAuthUserRow(await ctx.queryAs(systemUser, UserQueries.findForAuth, { id: userId }));
+    const me = parseAuthUserRow(await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, { id: userId }));
     if (!me || me.isDeleted || me.version === undefined || me.version < 1)
         return null;
     return { ...me, version: me.version };

package/dist/auth-email-password/handlers/invite-accept-with-login.write.js

@@ -64,13 +64,13 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
         agent: { expose: false },
         // kumiko-lint-ignore complexity-budget reuses login.write.ts's gate chain (lockout/password/email/status/membership/mfa) plus invite-specific branches (email match, already-member check, invitation update, unburn-on-failure) — splitting would scatter gate order across functions without reducing risk
         handler: async (event, ctx) => {
-            if (!ctx.redis) {
-                return writeFailure(new InternalError({ message: "invite-accept-with-login requires ctx.redis" }));
+            if (!ctx.services.redis) {
+                return writeFailure(new InternalError({ message: "invite-accept-with-login requires ctx.services.redis" }));
             }
-            const invitationId = await getInvitationIdForToken(ctx.redis, event.payload.token);
+            const invitationId = await getInvitationIdForToken(ctx.services.redis, event.payload.token);
             if (!invitationId)
                 return invalidInviteToken();
-            const burn = await burnInviteToken(ctx.redis, event.payload.token);
+            const burn = await burnInviteToken(ctx.services.redis, event.payload.token);
             if (burn === "already-used")
                 return invalidInviteToken();
             let committed = false;
@@ -131,6 +131,7 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                     db: dbConn,
                     tenantId: invitationTenantId,
                     mode: "system",
+                    reason: "invitation tenant differs from the caller's tenant, the accept step updates the invitation row there",
                 });
                 const updateResult = await invitationExecutor.update({
                     id: invitationId,
@@ -139,7 +140,7 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                 }, createSystemUser(invitationTenantId), invitationTdb);
                 if (!updateResult.isSuccess)
                     return updateResult;
-                await deleteInviteToken(ctx.redis, { invitationId, token: event.payload.token });
+                await deleteInviteToken(ctx.services.redis, { invitationId, token: event.payload.token });
                 // buildSessionRoles calls stripForbiddenMembershipRoles internally —
                 // a reserved role on an existing membership must never reach the session.
                 const mergedRoles = buildSessionRoles(globalGrant.data.roles, grant.data.roles);
@@ -172,8 +173,8 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                 };
             }
             finally {
-                if (!committed && ctx.redis) {
-                    await unburnInviteToken(ctx.redis, event.payload.token);
+                if (!committed && ctx.services.redis) {
+                    await unburnInviteToken(ctx.services.redis, event.payload.token);
                 }
             }
         },

package/dist/auth-email-password/handlers/invite-accept.write.js

@@ -55,13 +55,15 @@ export function createInviteAcceptHandler() {
         },
         // kumiko-lint-ignore complexity-budget invite branches (auth/anon/burn) stay in one handler
         handler: async (event, ctx) => {
-            if (!ctx.redis) {
-                return writeFailure(new InternalError({ message: "invite-accept requires ctx.redis for token consumption" }));
+            if (!ctx.services.redis) {
+                return writeFailure(new InternalError({
+                    message: "invite-accept requires ctx.services.redis for token consumption",
+                }));
             }
-            const invitationId = await getInvitationIdForToken(ctx.redis, event.payload.token);
+            const invitationId = await getInvitationIdForToken(ctx.services.redis, event.payload.token);
             if (!invitationId)
                 return invalidInviteToken();
-            const burn = await burnInviteToken(ctx.redis, event.payload.token);
+            const burn = await burnInviteToken(ctx.services.redis, event.payload.token);
             if (burn === "already-used")
                 return invalidInviteToken();
             let committed = false;
@@ -111,6 +113,7 @@ export function createInviteAcceptHandler() {
                     db: dbConn,
                     tenantId: invitationTenantId,
                     mode: "system",
+                    reason: "invitation tenant differs from the caller's tenant, the accept step updates the invitation row there",
                 });
                 const updateResult = await invitationExecutor.update({
                     id: invitationId,
@@ -119,7 +122,7 @@ export function createInviteAcceptHandler() {
                 }, createSystemUser(invitationTenantId), invitationTdb);
                 if (!updateResult.isSuccess)
                     return updateResult;
-                await deleteInviteToken(ctx.redis, { invitationId, token: event.payload.token });
+                await deleteInviteToken(ctx.services.redis, { invitationId, token: event.payload.token });
                 committed = true;
                 return {
                     isSuccess: true,
@@ -132,8 +135,8 @@ export function createInviteAcceptHandler() {
                 };
             }
             finally {
-                if (!committed && ctx.redis) {
-                    await unburnInviteToken(ctx.redis, event.payload.token);
+                if (!committed && ctx.services.redis) {
+                    await unburnInviteToken(ctx.services.redis, event.payload.token);
                 }
             }
         },

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -76,8 +76,8 @@ async function currentMembershipVersion(ctx, tenantId, email) {
     return membershipVersionOf(ctx.db, tenantId, user.id);
 }
 async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAccepted = false) {
-    if (!ctx.redis) {
-        return writeFailure(new InternalError({ message: "invite-create requires ctx.redis for token store" }));
+    if (!ctx.services.redis) {
+        return writeFailure(new InternalError({ message: "invite-create requires ctx.services.redis for token store" }));
     }
     const email = request.email.toLowerCase();
     const tenantId = inviter.tenantId;
@@ -100,7 +100,7 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
         const existingVersion = existing["version"]; // @cast-boundary db-row
         // At most one live invite token per invitation: invalidate
         // whatever's there before minting the new one.
-        await invalidateExistingInviteToken(ctx.redis, invitationId);
+        await invalidateExistingInviteToken(ctx.services.redis, invitationId);
         const updateResult = await executor.update({
             id: invitationId,
             version: existingVersion,
@@ -133,7 +133,7 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
         invitationId = createResult.data.id; // @cast-boundary engine-payload
     }
     const token = generateToken();
-    await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
+    await storeInviteToken(ctx.services.redis, { invitationId, token, ttlSeconds });
     const locale = request.locale ?? resolveHandlerMailLocale(ctx, opts.locale);
     await dispatchMagicLinkMail(ctx.notify, {
         handlerName: "invite-create",

package/dist/auth-email-password/handlers/invite-info.query.js

@@ -40,9 +40,9 @@ export const inviteInfoQuery = defineQueryHandler({
     description: "Anonymous, read-only invite lookup for the invite-acceptance page: reveals the invited " +
         "email and whether an account already exists for it, without consuming the token.",
     handler: async (query, ctx) => {
-        if (!ctx.redis)
+        if (!ctx.services.redis)
             throwInvalidInviteToken();
-        const invitationId = await getInvitationIdForToken(ctx.redis, query.payload.token);
+        const invitationId = await getInvitationIdForToken(ctx.services.redis, query.payload.token);
         if (!invitationId)
             throwInvalidInviteToken();
         const invitation = await fetchOne(ctx.db.unsafeRaw(), tenantInvitationsTable, {

package/dist/auth-email-password/handlers/invite-signup-complete.write.js

@@ -55,13 +55,13 @@ export function createInviteSignupCompleteHandler(opts = {}) {
             reason: INVITE_SIGNUP_COMPLETE_ESCAPE_HATCH_REASON,
         },
         handler: async (event, ctx) => {
-            if (!ctx.redis) {
-                return writeFailure(new InternalError({ message: "invite-signup-complete requires ctx.redis" }));
+            if (!ctx.services.redis) {
+                return writeFailure(new InternalError({ message: "invite-signup-complete requires ctx.services.redis" }));
             }
-            const invitationId = await getInvitationIdForToken(ctx.redis, event.payload.token);
+            const invitationId = await getInvitationIdForToken(ctx.services.redis, event.payload.token);
             if (!invitationId)
                 return invalidInviteToken();
-            const burn = await burnInviteToken(ctx.redis, event.payload.token);
+            const burn = await burnInviteToken(ctx.services.redis, event.payload.token);
             if (burn === "already-used")
                 return invalidInviteToken();
             let committed = false;
@@ -115,6 +115,7 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                     db: dbConn,
                     tenantId: invitationTenantId,
                     mode: "system",
+                    reason: "invitation tenant differs from the caller's tenant, the accept step updates the invitation row there",
                 });
                 const updateResult = await invitationExecutor.update({
                     id: invitationId,
@@ -130,7 +131,7 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                 // call, but an MFA-gated role gets the MFA step instead of a session.
                 // It runs before the token is deleted so a throwing check leaves the link retryable.
                 const mfaGate = await gateEnforceMfa(ctx, { mfaStatusChecker: opts.mfaStatusChecker }, userId, invitationTenantId, mergedRoles);
-                await deleteInviteToken(ctx.redis, { invitationId, token: event.payload.token });
+                await deleteInviteToken(ctx.services.redis, { invitationId, token: event.payload.token });
                 if (mfaGate !== undefined) {
                     committed = true;
                     return { isSuccess: true, data: mfaGate };
@@ -153,8 +154,8 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                 };
             }
             finally {
-                if (!committed && ctx.redis) {
-                    await unburnInviteToken(ctx.redis, event.payload.token);
+                if (!committed && ctx.services.redis) {
+                    await unburnInviteToken(ctx.services.redis, event.payload.token);
                 }
             }
         },

package/dist/auth-email-password/handlers/login.write.js

@@ -34,12 +34,12 @@ function unknownEmailLockoutSubject(ctx, email) {
 }
 export async function gateCountUnknownUser(ctx, email, maxFailedAttempts, lockoutDurationMinutes) {
     const subject = unknownEmailLockoutSubject(ctx, email);
-    if (!ctx.redis || subject === undefined)
+    if (!ctx.services.redis || subject === undefined)
         return ok(undefined);
     const locked = await gateEnforceLockout(ctx, subject);
     if (!locked.ok)
         return locked;
-    await recordFailedAttempt(ctx.redis, subject, maxFailedAttempts, lockoutDurationMinutes);
+    await recordFailedAttempt(ctx.services.redis, subject, maxFailedAttempts, lockoutDurationMinutes);
     return ok(undefined);
 }
 /**
@@ -47,9 +47,9 @@ export async function gateCountUnknownUser(ctx, email, maxFailedAttempts, lockou
  * Fail-open without Redis (IP rate-limit still covers partially).
  */
 export async function gateEnforceLockout(ctx, userId) {
-    if (!ctx.redis)
+    if (!ctx.services.redis)
         return ok(undefined);
-    const state = await getLockoutState(ctx.redis, userId);
+    const state = await getLockoutState(ctx.services.redis, userId);
     if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {
         const now = Date.now();
         if (state.lockedUntil > now) {
@@ -63,15 +63,15 @@ export async function gateEnforceLockout(ctx, userId) {
 export async function gateVerifyPassword(ctx, found, password, maxFailedAttempts, lockoutDurationMinutes) {
     const passwordOk = await verifyPassword(found.passwordHash, password);
     if (!passwordOk) {
-        if (ctx.redis) {
-            await recordFailedAttempt(ctx.redis, found.id, maxFailedAttempts, lockoutDurationMinutes);
+        if (ctx.services.redis) {
+            await recordFailedAttempt(ctx.services.redis, found.id, maxFailedAttempts, lockoutDurationMinutes);
         }
         return reject(invalidCredentials());
     }
     // Clear before MFA — MFA has its own attempt-cap; don't password-lock
     // users who occasionally mistype across otherwise-successful logins.
-    if (ctx.redis) {
-        await clearLockoutState(ctx.redis, found.id);
+    if (ctx.services.redis) {
+        await clearLockoutState(ctx.services.redis, found.id);
     }
     return ok(undefined);
 }
@@ -105,7 +105,7 @@ export async function gateResolveMembership(ctx, found, memberships) {
         : memberships;
     const globalRoles = parseRoles(found.roles ?? null);
     for (const candidate of candidates) {
-        const active = await ctx.resolveActiveMembership(found.id, candidate.tenantId);
+        const active = await ctx.auth.resolveActiveMembership(found.id, candidate.tenantId);
         if (active.kind === "rejected") {
             // A blocked principal is blocked for every tenant, so stop here;
             // not_a_member/tenant_teardown are per-tenant — try the next candidate.
@@ -149,14 +149,14 @@ export async function gateBuildSession(ctx, userId, tenantId, mergedRoles, timez
         ...(timezone !== null && timezone !== undefined && { timezone }),
         ...(locale !== null && locale !== undefined && { locale }),
     };
-    const claims = await ctx.resolveAuthClaims(baseSession);
+    const claims = await ctx.auth.resolveClaims(baseSession);
     const session = Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;
     return { kind: "auth-session", session };
 }
 // Login — unauthenticated entry point. The route is wired public (no JWT
 // middleware), dispatching with the framework's anonymous identity for the
 // handler's access check. Everything inside the handler goes through
-// ctx.queryAs(system, ...) so the user feature stays the single owner of its
+// ctx.dispatch.queryAs(system, ...) so the user feature stays the single owner of its
 // table.
 export function createLoginHandler(opts = {}) {
     const strictVerification = opts.strictEmailVerification === true;
@@ -173,8 +173,8 @@ export function createLoginHandler(opts = {}) {
         escapeHatch: {
             grants: ["systemIdentity", "unsafeRaw"],
             reason: "Unauthenticated login has no caller identity yet — it looks up the user row by " +
-                "email via ctx.queryAs(SYSTEM, ...) and resolves tenant membership via " +
-                "ctx.resolveActiveMembership before a session exists. It also reads the MFA " +
+                "email via ctx.dispatch.queryAs(SYSTEM, ...) and resolves tenant membership via " +
+                "ctx.auth.resolveActiveMembership before a session exists. It also reads the MFA " +
                 "enrollment of the tenant named in the signed login/setup token, not the guest " +
                 "dispatch tenant, via the mfaStatusChecker callback.",
         },
@@ -183,7 +183,9 @@ export function createLoginHandler(opts = {}) {
         description: "Signs a user in with email and password, running the lockout, email-verification, account-status, tenant-membership and MFA gates, and answering with a session or with an MFA challenge or setup requirement.",
         handler: async (event, ctx) => {
             const systemUser = createSystemUser(SYSTEM_USER_ID);
-            const foundRow = parseAuthUserRow(await ctx.queryAs(systemUser, UserQueries.findForAuth, { email: event.payload.email }));
+            const foundRow = parseAuthUserRow(await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
+                email: event.payload.email,
+            }));
             if (!foundRow?.passwordHash || foundRow.isDeleted) {
                 const unknown = await gateCountUnknownUser(ctx, event.payload.email, maxFailedAttempts, lockoutDurationMinutes);
                 if (!unknown.ok)
@@ -206,7 +208,7 @@ export function createLoginHandler(opts = {}) {
             if (!statusGate.ok)
                 return statusGate.result;
             // Still needed for candidate ORDER (preferred tenant first) in gateResolveMembership.
-            const memberships = (await ctx.queryAs(systemUser, TENANT_MEMBERSHIPS_QUERY, {
+            const memberships = (await ctx.dispatch.queryAs(systemUser, TENANT_MEMBERSHIPS_QUERY, {
                 userId: found.id,
             })); // @cast-boundary db-runner
             const membershipGate = await gateResolveMembership(ctx, found, memberships);

package/dist/auth-email-password/handlers/reset-password.write.js

@@ -25,7 +25,7 @@ export function createResetPasswordHandler(opts) {
         escapeHatch: {
             grants: ["systemIdentity"],
             reason: "Anonymous token holder has no session — runConfirmTokenFlow loads and updates the " +
-                "target user via ctx.writeAs(SYSTEM, user:update) to set the new password hash.",
+                "target user via ctx.dispatch.writeAs(SYSTEM, user:update) to set the new password hash.",
         },
         agent: { expose: false },
         handler: async (event, ctx) => {
@@ -42,7 +42,7 @@ export function createResetPasswordHandler(opts) {
                 return invalidResetToken();
             return runConfirmTokenFlow(ctx, verify.userId, verify.expiresAtMs, {
                 purpose: "reset",
-                redisRequiredMessage: "password-reset requires ctx.redis to enforce token single-use",
+                redisRequiredMessage: "password-reset requires ctx.services.redis to enforce token single-use",
                 invalidToken: invalidResetToken,
                 buildChanges: async () => ({
                     passwordHash: await hashPassword(event.payload.newPassword),

package/dist/auth-email-password/handlers/signup-confirm.write.js

@@ -55,16 +55,16 @@ function isBenignClaimRejection(error) {
 async function claimBoundHandover(ctx, session, binding) {
     const provider = findSignupHandoverProvider(ctx.registry);
     if (!provider) {
-        ctx.log?.warn("signup-confirm: handover binding present but no signupHandover provider mounted");
+        ctx.obs.log?.warn("signup-confirm: handover binding present but no signupHandover provider mounted");
         return undefined;
     }
     const claim = provider.mintClaim(binding);
-    const claimResult = await ctx.writeAs(session, claim.qualifiedName, claim.payload);
+    const claimResult = await ctx.dispatch.writeAs(session, claim.qualifiedName, claim.payload);
     if (claimResult.isSuccess)
         return { entityType: binding.entityType, id: binding.rowId };
     if (!isBenignClaimRejection(claimResult.error))
         throw reraiseAsKumikoError(claimResult.error);
-    ctx.log?.warn("signup-confirm: handover grant did not redeem", {
+    ctx.obs.log?.warn("signup-confirm: handover grant did not redeem", {
         entityType: binding.entityType,
     });
     return undefined;
@@ -81,19 +81,19 @@ export function createSignupConfirmHandler(opts = {}) {
             reason: SIGNUP_CONFIRM_PROVISION_REASON,
         },
         handler: async (event, ctx) => {
-            if (!ctx.redis) {
+            if (!ctx.services.redis) {
                 return writeFailure(new InternalError({
-                    message: "signup-confirm requires ctx.redis for token consumption",
+                    message: "signup-confirm requires ctx.services.redis for token consumption",
                 }));
             }
             // Token lookup: nonexistent, expired, and already-consumed tokens all
             // collapse to invalid_signup_token to prevent enumeration.
-            const email = await getEmailForSignupToken(ctx.redis, event.payload.token);
+            const email = await getEmailForSignupToken(ctx.services.redis, event.payload.token);
             if (!email)
                 return invalidSignupToken();
             // Single-use burn: of two parallel confirmations from different tabs,
             // one succeeds and the other receives invalid_signup_token.
-            const burn = await burnSignupToken(ctx.redis, event.payload.token);
+            const burn = await burnSignupToken(ctx.services.redis, event.payload.token);
             if (burn === "already-used")
                 return invalidSignupToken();
             let committed = false;
@@ -154,7 +154,7 @@ export function createSignupConfirmHandler(opts = {}) {
                 // Claim BEFORE spending the signup token or the binding below and
                 // before `committed` flips: if the claim throws, the `finally` still
                 // unburns and the activation link stays retryable.
-                const handoverBinding = await getSignupHandover(ctx.redis, event.payload.token);
+                const handoverBinding = await getSignupHandover(ctx.services.redis, event.payload.token);
                 const handover = handoverBinding
                     ? await claimBoundHandover(ctx, session, handoverBinding)
                     : undefined;
@@ -162,9 +162,9 @@ export function createSignupConfirmHandler(opts = {}) {
                 const mfaGate = await gateEnforceMfa(ctx, { mfaStatusChecker: opts.mfaStatusChecker }, provisioned.userId, provisioned.tenantId, session.roles);
                 // Drop both token lookup keys; the burn key stays for its remaining
                 // TTL as replay protection.
-                await deleteSignupToken(ctx.redis, { email, token: event.payload.token });
+                await deleteSignupToken(ctx.services.redis, { email, token: event.payload.token });
                 if (handoverBinding)
-                    await deleteSignupHandover(ctx.redis, event.payload.token);
+                    await deleteSignupHandover(ctx.services.redis, event.payload.token);
                 if (mfaGate !== undefined) {
                     committed = true;
                     return {
@@ -192,10 +192,10 @@ export function createSignupConfirmHandler(opts = {}) {
                 };
             }
             finally {
-                if (!committed && ctx.redis) {
+                if (!committed && ctx.services.redis) {
                     // Release the burn so a retry after a DB hiccup is not blocked.
                     // Keep the token lookup keys so the user can click the email link again.
-                    await unburnSignupToken(ctx.redis, event.payload.token);
+                    await unburnSignupToken(ctx.services.redis, event.payload.token);
                 }
             }
         },

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -73,12 +73,12 @@ export function createSignupRequestHandler(opts) {
                 // No email address here — this fires on every no-op request, PII
                 // must not accumulate in logs just for the "was this toggled off"
                 // signal a support ticket needs.
-                ctx.log?.info("signup-request skipped: self-registration disabled");
+                ctx.obs.log?.info("signup-request skipped: self-registration disabled");
                 return { isSuccess: true, data: { kind: "no-op" } };
             }
-            if (!ctx.redis) {
+            if (!ctx.services.redis) {
                 return writeFailure(new InternalError({
-                    message: "signup-request requires ctx.redis for the activation-token store",
+                    message: "signup-request requires ctx.services.redis for the activation-token store",
                 }));
             }
             // Email normalization lives in the store (signup-token-store). The
@@ -89,9 +89,9 @@ export function createSignupRequestHandler(opts) {
             // resend without a fresh `handover` in the payload (the common case:
             // the visitor just retyped their email) must still carry the earlier
             // verified grant over to the new token instead of silently dropping it.
-            const priorBinding = await takeOverSignupHandoverForResend(ctx.redis, email);
+            const priorBinding = await takeOverSignupHandoverForResend(ctx.services.redis, email);
             const locale = resolveHandlerMailLocale(ctx, opts.locale);
-            const redis = ctx.redis;
+            const redis = ctx.services.redis;
             const issued = await issueSignupActivation({
                 redis,
                 notify: ctx.notify,
@@ -115,7 +115,7 @@ export function createSignupRequestHandler(opts) {
                         const { entityType, token: grantToken } = event.payload.handover;
                         const provider = findSignupHandoverProvider(ctx.registry);
                         if (!provider) {
-                            ctx.log?.warn("signup-request: handover payload present but no signupHandover provider mounted");
+                            ctx.obs.log?.warn("signup-request: handover payload present but no signupHandover provider mounted");
                         }
                         else {
                             try {
@@ -129,11 +129,15 @@ export function createSignupRequestHandler(opts) {
                                     binding = verified;
                                 }
                                 else {
-                                    ctx.log?.warn("signup-request: handover grant did not verify", { entityType });
+                                    ctx.obs.log?.warn("signup-request: handover grant did not verify", {
+                                        entityType,
+                                    });
                                 }
                             }
                             catch {
-                                ctx.log?.warn("signup-request: handover grant verification threw", { entityType });
+                                ctx.obs.log?.warn("signup-request: handover grant verification threw", {
+                                    entityType,
+                                });
                             }
                         }
                     }

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.js

@@ -24,10 +24,12 @@ export function createSwitchTenantMfaGateHandler(opts) {
         description: "Runs the MFA gate of the login for a tenant switch and answers with an MFA challenge, a setup requirement, or clearance.",
         handler: async (event, ctx) => {
             const { userId, tenantId } = event.payload;
-            const active = await ctx.resolveActiveMembership(userId, tenantId);
+            const active = await ctx.auth.resolveActiveMembership(userId, tenantId);
             if (active.kind === "rejected")
                 return noMembership();
-            const userRow = parseAuthUserRow(await ctx.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, { id: userId }));
+            const userRow = parseAuthUserRow(await ctx.dispatch.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, {
+                id: userId,
+            }));
             const roles = buildSessionRoles(parseRoles(userRow?.roles ?? null), active.membership.roles);
             const mfaGate = await gateEnforceMfa(ctx, opts, userId, tenantId, roles);
             return { isSuccess: true, data: mfaGate ?? { kind: "mfa-gate-clear", roles } };

package/dist/auth-email-password/handlers/token-request-handler.js

@@ -41,7 +41,7 @@ export function createTokenRequestHandler(spec, opts) {
         escapeHatch: {
             grants: ["systemIdentity"],
             reason: "Anonymous requester has no session — looks up the target user by email via " +
-                "ctx.queryAs(SYSTEM, user:findForAuth) to mint the out-of-band token.",
+                "ctx.dispatch.queryAs(SYSTEM, user:findForAuth) to mint the out-of-band token.",
         },
         description: spec.description,
         handler: async (event, ctx) => {
@@ -53,7 +53,7 @@ export function createTokenRequestHandler(spec, opts) {
                 }));
             }
             const systemUser = createSystemUser(event.user.tenantId);
-            const user = parseAuthUserRow(await ctx.queryAs(systemUser, UserQueries.findForAuth, {
+            const user = parseAuthUserRow(await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
                 email: event.payload.email,
             }));
             // Silent-success branches all return the SAME shape with kind="no-op".