@cosmicdrift/kumiko-framework 0.264.1 → 0.266.0

package/src/engine/boot-validator/zod-shape.ts

@@ -1,4 +1,23 @@
-import { ZodArray, ZodDefault, ZodNullable, ZodObject, ZodOptional, type ZodType } from "zod";
+import {
+  ZodArray,
+  ZodCatch,
+  ZodDefault,
+  ZodIntersection,
+  ZodLazy,
+  ZodNonOptional,
+  ZodNullable,
+  ZodObject,
+  ZodOptional,
+  ZodPipe,
+  ZodPrefault,
+  ZodReadonly,
+  ZodRecord,
+  ZodTuple,
+  type ZodType,
+  ZodUnion,
+  ZodXor,
+} from "zod";
+import type { $ZodType } from "zod/v4/core";
 
 // Drills through wrapper types (.nullable(), .optional(), .default()) a
 // handler's schema may use around its actual object/array shape — e.g. a
@@ -49,3 +68,75 @@ export function getZodRowShape(schema: ZodType | undefined): Record<string, ZodT
     ? getZodObjectShape(rowsArray.element as ZodType)
     : undefined;
 }
+
+type SingleInnerSchema =
+  | ZodOptional
+  | ZodNullable
+  | ZodDefault
+  | ZodPrefault
+  | ZodNonOptional
+  | ZodCatch
+  | ZodReadonly
+  | ZodLazy;
+
+const SINGLE_INNER_SCHEMA_CLASSES = [
+  ZodOptional,
+  ZodNullable,
+  ZodDefault,
+  ZodPrefault,
+  ZodNonOptional,
+  ZodCatch,
+  ZodReadonly,
+  ZodLazy,
+] as const;
+
+function isSingleInnerSchema(schema: $ZodType): schema is SingleInnerSchema {
+  return SINGLE_INNER_SCHEMA_CLASSES.some((schemaClass) => schema instanceof schemaClass);
+}
+
+function combinatorChildSchemas(schema: $ZodType): readonly $ZodType[] {
+  if (schema instanceof ZodUnion || schema instanceof ZodXor) return schema.options;
+  if (schema instanceof ZodIntersection) return [schema.def.left, schema.def.right];
+  // z.preprocess() carries the accepted shape on `out`, .transform() on `in`.
+  if (schema instanceof ZodPipe) return [schema.in, schema.out];
+  return [];
+}
+
+function childSchemas(schema: $ZodType): readonly $ZodType[] {
+  if (schema instanceof ZodObject) return Object.values(schema.shape);
+  if (schema instanceof ZodArray) return [schema.element];
+  if (schema instanceof ZodRecord) return [schema.valueType];
+  if (schema instanceof ZodTuple) {
+    const { items, rest } = schema.def;
+    return rest ? [...items, rest] : items;
+  }
+  if (isSingleInnerSchema(schema)) return [schema.unwrap()];
+  return combinatorChildSchemas(schema);
+}
+
+// A z.lazy() getter that builds a fresh schema per call never revisits a node.
+const MAX_WALKED_SCHEMAS = 10_000;
+
+// Object keys at any depth, so a field nested in an intersection, union or an
+// update's `changes` object is found too.
+export function collectZodObjectKeys(schema: $ZodType | undefined): ReadonlySet<string> {
+  const keys = new Set<string>();
+  if (schema === undefined) return keys;
+  const visited = new Set<$ZodType>();
+  const pending: $ZodType[] = [schema];
+  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {
+    if (visited.has(next)) continue;
+    if (visited.size >= MAX_WALKED_SCHEMAS) {
+      throw new Error(
+        `collectZodObjectKeys: schema has more than ${MAX_WALKED_SCHEMAS} nodes — ` +
+          "a z.lazy() getter probably returns a new schema on every call; hoist it into a constant.",
+      );
+    }
+    visited.add(next);
+    if (next instanceof ZodObject) {
+      for (const key of Object.keys(next.shape)) keys.add(key);
+    }
+    pending.push(...childSchemas(next));
+  }
+  return keys;
+}

package/src/engine/extension-names.ts

@@ -155,6 +155,22 @@ export const EXT_EXTERNAL_RESOURCE = "externalResource" as const;
  */
 export const EXT_INFRA_RESOURCE = "infraResource" as const;
 
+/**
+ * `principalStatus` — "is this principal blocked from signing in" contract,
+ * consulted by the active-membership building block; fulfilled by the bundled `user` feature.
+ */
+export const EXT_PRINCIPAL_STATUS = "principalStatus" as const;
+
+/**
+ * `tenantLifecycleStatus` — tenant-teardown status contract, fulfilled by
+ * the bundled `tenant-lifecycle` feature; absent means no tenant is ever "in teardown".
+ */
+export const EXT_TENANT_LIFECYCLE_STATUS = "tenantLifecycleStatus" as const;
+
+// Default membership-list query handler name. Accepted coupling, same
+// pattern as FILE_PROVIDER_CONFIG_KEY — the `tenant` feature registers a handler under this literal.
+export const TENANT_MEMBERSHIPS_QUERY = "tenant:query:memberships" as const;
+
 /**
  * Union aller standardisierten Extension-Namen der Datenschutz-Surface.
  * Nicht alle Extensions im System sind in dieser Liste — andere

package/src/engine/feature-ast/__tests__/read-optional-access-rule.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from "bun:test";
+import { readOptionalAccessRule } from "../extractors/hooks";
+
+describe("readOptionalAccessRule — openToAll.personalData", () => {
+  test("keeps personalData: tenant-members on the object form", () => {
+    expect(
+      readOptionalAccessRule({
+        openToAll: { reason: "members edit their team roster", personalData: "tenant-members" },
+      }),
+    ).toEqual({
+      openToAll: { reason: "members edit their team roster", personalData: "tenant-members" },
+    });
+  });
+
+  test("drops an unknown personalData value", () => {
+    expect(
+      readOptionalAccessRule({
+        openToAll: { reason: "signup", personalData: "public-intake" },
+      }),
+    ).toEqual({ openToAll: { reason: "signup" } });
+  });
+
+  test("the deprecated openToAll: true form carries no personalData", () => {
+    expect(readOptionalAccessRule({ openToAll: true, personalData: "tenant-members" })).toEqual({
+      openToAll: true,
+    });
+  });
+});

package/src/engine/feature-ast/extractors/hooks.ts

@@ -42,12 +42,16 @@ export function readOptionalAccessRule(value: unknown): AccessRule | undefined {
   if (Array.isArray(value["roles"]) && value["roles"].every((r) => typeof r === "string")) {
     return { roles: value["roles"] as readonly string[] };
   }
-  const publicIntake = value["publicIntake"] === true ? { publicIntake: true as const } : {};
   if (value["openToAll"] === true) {
-    return { openToAll: true, ...publicIntake };
+    return { openToAll: true };
   }
-  if (isPlainObject(value["openToAll"]) && typeof value["openToAll"]["reason"] === "string") {
-    return { openToAll: { reason: value["openToAll"]["reason"] }, ...publicIntake };
+  const openToAll = value["openToAll"];
+  if (isPlainObject(openToAll) && typeof openToAll["reason"] === "string") {
+    const personalData =
+      openToAll["personalData"] === "tenant-members"
+        ? { personalData: "tenant-members" as const }
+        : {};
+    return { openToAll: { reason: openToAll["reason"], ...personalData } };
   }
   return undefined;
 }

package/src/engine/index.ts

@@ -1,6 +1,14 @@
 // Public API
 
 export { hasAccess } from "./access";
+export {
+  isPrincipalStatusPlugin,
+  isTenantLifecycleStatusPlugin,
+  type PrincipalStatus,
+  type PrincipalStatusPlugin,
+  TENANT_TEARDOWN_STATUSES,
+  type TenantLifecycleStatusPlugin,
+} from "./active-membership";
 export {
   collectWriteHandlerQns,
   SECURITY_BASELINE_FEATURE_NAMES,
@@ -90,12 +98,15 @@ export {
   EXT_EXTERNAL_RESOURCE,
   EXT_FILE_PROVIDER,
   EXT_INFRA_RESOURCE,
+  EXT_PRINCIPAL_STATUS,
   EXT_SEARCH_ADAPTER,
   EXT_STORAGE_PROVIDER,
   EXT_TENANT_DATA,
+  EXT_TENANT_LIFECYCLE_STATUS,
   EXT_USER_DATA,
   EXT_USER_DATA_ORDER,
   FILE_PROVIDER_CONFIG_KEY,
+  TENANT_MEMBERSHIPS_QUERY,
 } from "./extension-names";
 export type {
   StorageProviderDestroyTenantHook,
@@ -283,6 +294,9 @@ export {
 export type {
   AccessRule,
   ActionFormScreenDefinition,
+  ActiveMembership,
+  ActiveMembershipRejection,
+  ActiveMembershipResult,
   AgentExposure,
   AgentHandlerHints,
   AgentRisk,
@@ -418,6 +432,7 @@ export type {
   OnDeleteStrategy,
   OpenToAllAccessRule,
   OpenToAllDeclaration,
+  OpenToAllPersonalData,
   ParentRefDef,
   PersonalAnnotations,
   PersonalAnnotationsLongText,

package/src/engine/types/index.ts

@@ -138,6 +138,9 @@ export type {
 } from "@cosmicdrift/kumiko-types/fields";
 export type {
   AccessRule,
+  ActiveMembership,
+  ActiveMembershipRejection,
+  ActiveMembershipResult,
   AgentExposure,
   AgentHandlerHints,
   AgentRisk,
@@ -175,6 +178,7 @@ export type {
   NotifyPriority,
   OpenToAllAccessRule,
   OpenToAllDeclaration,
+  OpenToAllPersonalData,
   QualifiedEventName,
   QueryEvent,
   QueryHandlerDef,

package/src/pipeline/__tests__/system-identity-switch.integration.test.ts

@@ -75,6 +75,24 @@ const probeFeature = defineFeature("idswitch-probe", (r) => {
     access: { roles: ["Admin"] },
   });
 
+  // --- ctx.resolveActiveMembership: gated the same as a SYSTEM queryAs/writeAs ---
+  r.queryHandler(
+    "resolve-active-membership-no-hatch",
+    z.object({}),
+    async (query, ctx) => ctx.resolveActiveMembership(query.user.id, query.user.tenantId),
+    { access: { roles: ["User"] } },
+  );
+
+  r.queryHandler(
+    "resolve-active-membership-with-hatch",
+    z.object({}),
+    async (query, ctx) => ctx.resolveActiveMembership(query.user.id, query.user.tenantId),
+    {
+      access: { roles: ["User"] },
+      escapeHatch: { reason: "test: needs SYSTEM to resolve membership" },
+    },
+  );
+
   // --- Direct SYSTEM switch: gated by the CALLING handler's own escapeHatch ---
   r.writeHandler(
     "write-as-system-no-hatch",
@@ -276,6 +294,26 @@ describe("ctx.queryAs(SYSTEM, ...) — gated by the calling handler's escapeHatc
   });
 });
 
+describe("ctx.resolveActiveMembership — gated like a SYSTEM queryAs/writeAs", () => {
+  test("WITHOUT escapeHatch: fails with access_denied", async () => {
+    const err = await stack.http.queryErr(
+      "idswitch-probe:query:resolve-active-membership-no-hatch",
+      {},
+      user,
+    );
+    expect(err.code).toBe("access_denied");
+  });
+
+  test("WITH escapeHatch: the SYSTEM-identity gate lets the call through (no membershipQuery wired here, so it fails downstream instead)", async () => {
+    const err = await stack.http.queryErr(
+      "idswitch-probe:query:resolve-active-membership-with-hatch",
+      {},
+      user,
+    );
+    expect(err.code).not.toBe("access_denied");
+  });
+});
+
 describe("ctx.queryAs(nonSystemUser, ...) — never gated by this feature", () => {
   test("delegates to the target's own access check: denied when the target user lacks the role", async () => {
     const err = await stack.http.queryErr(

package/src/pipeline/active-membership.ts

@@ -0,0 +1,178 @@
+// One framework-owned composition of membership / principal-status /
+// tenant-lifecycle checks so login, switch-tenant and MFA completion can't independently drift.
+
+import type { DbConnection } from "../db/connection";
+import {
+  isPrincipalStatusPlugin,
+  isTenantLifecycleStatusPlugin,
+  type PrincipalStatusPlugin,
+  TENANT_TEARDOWN_STATUSES,
+  type TenantLifecycleStatusPlugin,
+} from "../engine/active-membership";
+import { EXT_PRINCIPAL_STATUS, EXT_TENANT_LIFECYCLE_STATUS } from "../engine/extension-names";
+import { createSystemUser } from "../engine/system-user";
+import type { ActiveMembershipResult, Registry } from "../engine/types";
+import type { TenantId } from "../engine/types/identifiers";
+import { InternalError } from "../errors";
+import { executeQuery } from "./dispatch-query";
+import { type DispatchContext, resolveDbSource } from "./dispatch-shared";
+
+export type ActiveMembershipPolicy = {
+  // destroyRequested still counts as active — owners must be able to cancel
+  // destruction; auth-middleware's own 410 gate then only admits that write.
+  readonly allowPendingDestruction: boolean;
+  // Whether a userId with no persisted principal row counts as active — a
+  // future background caller may instead want to fail closed.
+  readonly allowUnknownPrincipal: boolean;
+};
+
+export const INTERACTIVE_SIGN_IN_POLICY: ActiveMembershipPolicy = {
+  allowPendingDestruction: true,
+  allowUnknownPrincipal: true,
+};
+
+type RawMembershipRow = {
+  readonly tenantId: string;
+  readonly roles: readonly string[];
+  readonly tenantName?: string;
+  readonly tenantKey?: string;
+};
+
+// membershipQuery is a per-app-registered handler — engine-payload, not
+// trusted shape. Structural validation instead of a blind cast.
+function isMembershipRow(v: unknown): v is RawMembershipRow {
+  if (typeof v !== "object" || v === null) return false;
+  if (!("tenantId" in v) || typeof v.tenantId !== "string") return false;
+  if (!("roles" in v) || !Array.isArray(v.roles) || !v.roles.every((r) => typeof r === "string")) {
+    return false;
+  }
+  if ("tenantName" in v && v.tenantName !== undefined && typeof v.tenantName !== "string") {
+    return false;
+  }
+  if ("tenantKey" in v && v.tenantKey !== undefined && typeof v.tenantKey !== "string") {
+    return false;
+  }
+  return true;
+}
+
+async function findMembership(
+  ctx: DispatchContext,
+  userId: string,
+  tenantId: TenantId,
+): Promise<RawMembershipRow | undefined> {
+  const rawMemberships = await executeQuery(
+    ctx,
+    ctx.membershipQuery,
+    { userId },
+    createSystemUser(tenantId),
+  );
+  if (!Array.isArray(rawMemberships) || !rawMemberships.every(isMembershipRow)) {
+    throw new InternalError({
+      message:
+        `dispatcher.resolveActiveMembership: membershipQuery "${ctx.membershipQuery}" returned ` +
+        "a malformed result — expected an array of {tenantId, roles, tenantName?, tenantKey?} rows.",
+    });
+  }
+  return rawMemberships.find((m) => m.tenantId === tenantId);
+}
+
+function resolvePrincipalPlugin(registry: Registry): PrincipalStatusPlugin {
+  const usages = registry.getExtensionUsages(EXT_PRINCIPAL_STATUS);
+  if (usages.length !== 1) {
+    throw new InternalError({
+      message:
+        usages.length === 0
+          ? `dispatcher.resolveActiveMembership: no "${EXT_PRINCIPAL_STATUS}" provider registered — mount the user feature.`
+          : `dispatcher.resolveActiveMembership: multiple "${EXT_PRINCIPAL_STATUS}" providers registered — exactly one is expected.`,
+    });
+  }
+  const usage = usages[0];
+  if (!usage || !isPrincipalStatusPlugin(usage.options)) {
+    throw new InternalError({
+      message: `dispatcher.resolveActiveMembership: "${usage?.entityName}" registered under "${EXT_PRINCIPAL_STATUS}" without a resolveStatus(userId, {db}) — extension options must be a PrincipalStatusPlugin.`,
+    });
+  }
+  return usage.options;
+}
+
+function resolveLifecyclePlugin(registry: Registry): TenantLifecycleStatusPlugin | undefined {
+  const usages = registry.getExtensionUsages(EXT_TENANT_LIFECYCLE_STATUS);
+  if (usages.length > 1) {
+    throw new InternalError({
+      message: `dispatcher.resolveActiveMembership: multiple "${EXT_TENANT_LIFECYCLE_STATUS}" providers registered — exactly one (or zero) is expected.`,
+    });
+  }
+  const usage = usages[0];
+  if (!usage) return undefined;
+  if (!isTenantLifecycleStatusPlugin(usage.options)) {
+    throw new InternalError({
+      message: `dispatcher.resolveActiveMembership: "${usage.entityName}" registered under "${EXT_TENANT_LIFECYCLE_STATUS}" without a resolveStatus(tenantId, {db}) — extension options must be a TenantLifecycleStatusPlugin.`,
+    });
+  }
+  return usage.options;
+}
+
+function isTeardownRejected(
+  status: { readonly status: string } | null,
+  policy: ActiveMembershipPolicy,
+): boolean {
+  return (
+    status !== null &&
+    TENANT_TEARDOWN_STATUSES.has(status.status) &&
+    !(status.status === "destroyRequested" && policy.allowPendingDestruction)
+  );
+}
+
+// Order is load-bearing: a non-member must never learn a foreign tenant's
+// lifecycle/blocked state, so membership is resolved and checked FIRST.
+export async function resolveActiveMembershipFn(
+  ctx: DispatchContext,
+  userId: string,
+  tenantId: TenantId,
+  policy: ActiveMembershipPolicy,
+): Promise<ActiveMembershipResult> {
+  const { registry } = ctx;
+
+  const membership = await findMembership(ctx, userId, tenantId);
+  if (!membership) {
+    return { kind: "rejected", reason: "not_a_member" };
+  }
+
+  const principalPlugin = resolvePrincipalPlugin(registry);
+  const dbSource = resolveDbSource(ctx, undefined);
+  if (!dbSource) {
+    throw new InternalError({
+      message:
+        "dispatcher.resolveActiveMembership requires a database connection — none is configured.",
+    });
+  }
+  // resolveDbSource(ctx, undefined) never returns a tx, only AppContext.db —
+  // the dispatcher boundary holds that as the root DbConnection, same as buildAuthClaimsContext.
+  const db = dbSource as DbConnection; // @cast-boundary db-operator
+
+  const principalStatus = await principalPlugin.resolveStatus(userId, { db });
+  if (
+    principalStatus === "blocked" ||
+    (principalStatus === "unknown" && !policy.allowUnknownPrincipal)
+  ) {
+    return { kind: "rejected", reason: "principal_blocked" };
+  }
+
+  const lifecyclePlugin = resolveLifecyclePlugin(registry);
+  if (lifecyclePlugin) {
+    const lifecycle = await lifecyclePlugin.resolveStatus(tenantId, { db });
+    if (isTeardownRejected(lifecycle, policy)) {
+      return { kind: "rejected", reason: "tenant_teardown" };
+    }
+  }
+
+  return {
+    kind: "active",
+    membership: {
+      tenantId,
+      roles: membership.roles,
+      ...(membership.tenantName !== undefined ? { tenantName: membership.tenantName } : {}),
+      ...(membership.tenantKey !== undefined ? { tenantKey: membership.tenantKey } : {}),
+    },
+  };
+}

package/src/pipeline/dispatch-shared.ts

@@ -64,6 +64,7 @@ import {
 } from "../observability";
 import { buildBucketKey } from "../rate-limit";
 import { createTzContext, isValidIanaTimeZone } from "../time";
+import { INTERACTIVE_SIGN_IN_POLICY, resolveActiveMembershipFn } from "./active-membership";
 import { appendDomainEventCore } from "./append-event-core";
 import { resolveAuthClaims as runAuthClaimsResolver } from "./auth-claims-resolver";
 import { executeQuery } from "./dispatch-query";
@@ -75,7 +76,7 @@ import {
 } from "./dispatcher-utils";
 import type { IdempotencyGuard } from "./idempotency";
 import type { LifecycleHooks } from "./lifecycle-pipeline";
-import { createGatedIdentitySwitch } from "./system-identity-switch";
+import { createGatedIdentitySwitch, systemIdentitySwitchDenied } from "./system-identity-switch";
 import type { TenantTimezoneCache } from "./tenant-timezone-cache";
 
 // Framework/pipeline stays bundled-features-free, so this can't import the
@@ -123,6 +124,9 @@ export type DispatchContext = {
   tenantTimezoneCache: TenantTimezoneCache;
   tracer: ReturnType<typeof getFallbackTracer>;
   meter: ReturnType<typeof getFallbackMeter>;
+  // Qualified name of the membership-list query handler consulted by
+  // resolveActiveMembershipFn — defaults to TENANT_MEMBERSHIPS_QUERY, overridable via DispatcherOptions.
+  membershipQuery: string;
 };
 
 // Narrowing-helper: AppContext.db ist DbConnection|TenantDb|undefined. Die
@@ -591,6 +595,15 @@ export async function buildHandlerContext(
     // dispatcher.resolveAuthClaims) cannot drift.
     resolveAuthClaims: (claimsUser: SessionUser) => resolveAuthClaimsFn(ctx, claimsUser), // @wrapper-known semantic-alias
 
+    // Thin pass-through, same reasoning as resolveAuthClaims above — one
+    // resolve impl lives on the dispatcher so callers can't drift apart.
+    // Internally queries memberships as SYSTEM, so it needs the same grant
+    // as a SYSTEM queryAs/writeAs (r.systemScope() or escapeHatch).
+    resolveActiveMembership: (userId: string, tenantId: TenantId) => {
+      if (!allowSystemIdentity) throw systemIdentitySwitchDenied(`handler "${type}"`);
+      return resolveActiveMembershipFn(ctx, userId, tenantId, INTERACTIVE_SIGN_IN_POLICY); // @wrapper-known semantic-alias
+    },
+
     // Feature-effective check for in-handler opt-in logic. Scope:
     // **current user's tenant** — for cross-tenant lookups (rare,
     // SysAdmin operations) read effectiveFeatures(otherTenantId) directly.

package/src/pipeline/dispatcher.ts

@@ -1,10 +1,20 @@
 import type { SseBroker } from "../api/sse-broker";
 import type { buildEntityTable } from "../db/table-builder";
+import { TENANT_MEMBERSHIPS_QUERY } from "../engine/extension-names";
 import type { defineTransitions } from "../engine/state-machine";
 import type { EffectiveFeaturesResolver } from "../engine/tier-resolver-extension";
-import type { AppContext, JobRunnerRef, Registry, SessionUser, WriteResult } from "../engine/types";
+import type {
+  ActiveMembershipResult,
+  AppContext,
+  JobRunnerRef,
+  Registry,
+  SessionUser,
+  WriteResult,
+} from "../engine/types";
+import type { TenantId } from "../engine/types/identifiers";
 import { reraiseAsKumikoError } from "../errors";
 import { getFallbackMeter, getFallbackTracer, registerStandardMetrics } from "../observability";
+import { INTERACTIVE_SIGN_IN_POLICY, resolveActiveMembershipFn } from "./active-membership";
 import { runBatch, unwrapSingle } from "./dispatch-batch";
 import { executeQuery } from "./dispatch-query";
 import type { BatchCommand, BatchResult, DispatchContext } from "./dispatch-shared";
@@ -25,6 +35,9 @@ export type DispatcherOptions = {
   idempotency?: IdempotencyGuard;
   lifecycle?: LifecycleHooks;
   jobRunner?: JobRunnerRef;
+  // Qualified name of the membership-list query handler consulted by
+  // dispatcher.resolveActiveMembership. Defaults to TENANT_MEMBERSHIPS_QUERY.
+  membershipQuery?: string;
   // Resolves the effective-feature set per tenant — the dispatcher uses
   // it to gate calls to handlers of disabled features (403 feature_disabled)
   // and to populate ctx.hasFeature. Absent = all features treated as
@@ -81,6 +94,9 @@ export type Dispatcher = {
   // This is the single resolve implementation — ctx.resolveAuthClaims is a
   // thin pass-through so both entry points can't drift.
   resolveAuthClaims(user: SessionUser): Promise<Record<string, unknown>>;
+  // Membership check for interactive sign-in paths (login, MFA completion,
+  // tenant switch) — single resolve implementation so callers can't independently drift.
+  resolveActiveMembership(userId: string, tenantId: TenantId): Promise<ActiveMembershipResult>;
 };
 
 export function createDispatcher(
@@ -89,6 +105,7 @@ export function createDispatcher(
   options: DispatcherOptions = {},
 ): Dispatcher {
   const { idempotency, lifecycle, jobRunner, effectiveFeatures, sseBroker } = options;
+  const membershipQuery = options.membershipQuery ?? TENANT_MEMBERSHIPS_QUERY;
 
   // Pre-build tables and transition maps for auto-guard (avoid per-request allocation)
   const tableCache = new Map<string, ReturnType<typeof buildEntityTable>>();
@@ -116,6 +133,7 @@ export function createDispatcher(
     tenantTimezoneCache,
     tracer: dispatcherTracer,
     meter: dispatcherMeter,
+    membershipQuery,
   };
 
   return {
@@ -143,5 +161,8 @@ export function createDispatcher(
     },
 
     resolveAuthClaims: (user) => resolveAuthClaimsFn(ctx, user),
+
+    resolveActiveMembership: (userId, tenantId) =>
+      resolveActiveMembershipFn(ctx, userId, tenantId, INTERACTIVE_SIGN_IN_POLICY),
   };
 }