@cosmicdrift/kumiko-samples 0.388.0 → 0.390.0

package/packages/bundled-features/src/auth-mfa/handlers/enable-confirm.write.ts

@@ -63,10 +63,11 @@ export function createEnableConfirmHandler(opts: EnableConfirmOptions) {
       // second seeing invalidSetupToken(). Checked before the TOTP verify
       // for the same reason the other two handlers check it early: fail
       // closed before doing any of the guarded work, not partway through.
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
           new InternalError({
-            message: "enable-confirm requires ctx.redis for the single-use setup-token burn",
+            message:
+              "enable-confirm requires ctx.services.redis for the single-use setup-token burn",
           }),
         );
       }
@@ -86,7 +87,12 @@ export function createEnableConfirmHandler(opts: EnableConfirmOptions) {
       // concurrent mfa_already_enabled() write) is meant to leave the burn
       // standing. Add unburnToken here if create-failure retries turn out
       // to matter.
-      const burnResult = await burnToken(ctx.redis, "mfa-setup", event.user.id, verify.expiresAtMs);
+      const burnResult = await burnToken(
+        ctx.services.redis,
+        "mfa-setup",
+        event.user.id,
+        verify.expiresAtMs,
+      );
       if (burnResult === "already-used") return invalidSetupToken();
 
       const existing = await findUserMfaRow(ctx.db, event.user);

package/packages/bundled-features/src/auth-mfa/handlers/enable-start-preauth.write.ts

@@ -62,7 +62,12 @@ export function createEnableStartPreauthHandler(opts: EnableStartPreauthOptions)
       // "system" mode: the guest dispatch identity's own tenantId is
       // meaningless here — the preauthSetupToken is the source of truth
       // for which tenant's row to read, mirroring verify.write.ts.
-      const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
+      const scopedDb = createTenantDb({
+        db: ctx.db.unsafeRaw(),
+        tenantId,
+        mode: "system",
+        reason: "pre-auth MFA setup has no session, the tenant comes from the verified setup token",
+      });
       const scopedUser: SessionUser = { id: userId, tenantId, roles: ["User"] };
       const existing = await findUserMfaRow(scopedDb, scopedUser);
       if (existing) return mfaAlreadyEnabled();

package/packages/bundled-features/src/auth-mfa/handlers/enable-start.write.ts

@@ -61,7 +61,9 @@ export function createEnableStartHandler(opts: EnableStartOptions) {
       if (!accountLabel) {
         // The declarative secretMint screen has no client component left to
         // read the session email off — derive the otpauth label server-side.
-        accountLabel = readableAccountLabel(await ctx.queryAs(event.user, UserQueries.me, {}));
+        accountLabel = readableAccountLabel(
+          await ctx.dispatch.queryAs(event.user, UserQueries.me, {}),
+        );
       }
 
       const secret = generateTotpSecret();

package/packages/bundled-features/src/auth-mfa/handlers/reencrypt.job.ts

@@ -88,13 +88,13 @@ export async function mfaReencryptJob(
   // hoisted function declarations below capture this — pin the narrowed
   // type explicitly so TS keeps it inside the closures.
   const cipher: EnvelopeCipher = maybeCipher;
-  if (!ctx.masterKeyProvider) {
+  if (!ctx.services.masterKeyProvider) {
     throw new InternalError({
       message:
-        "[auth-mfa:reencrypt] ctx.masterKeyProvider missing — wire it via extraContext.masterKeyProvider at boot.",
+        "[auth-mfa:reencrypt] ctx.services.masterKeyProvider missing — wire it via extraContext.masterKeyProvider at boot.",
     });
   }
-  const provider = ctx.masterKeyProvider;
+  const provider = ctx.services.masterKeyProvider;
   // Undefined = per-subject crypto-shredding isn't configured for this app —
   // both fields are then plain envelope strings, no PII layer to peel.
   const piiKms = configuredPiiSubjectKms();
@@ -109,7 +109,12 @@ export async function mfaReencryptJob(
   function tdbFor(tenantId: TenantId): TenantDb {
     let existing = tdbCache.get(tenantId);
     if (!existing) {
-      existing = createTenantDb({ db, tenantId, mode: "system" });
+      existing = createTenantDb({
+        db,
+        tenantId,
+        mode: "system",
+        reason: "MFA key re-encryption job rewrites enrollments of every tenant",
+      });
       tdbCache.set(tenantId, existing);
     }
     return existing;
@@ -158,7 +163,7 @@ export async function mfaReencryptJob(
     const totpClass = classifyStoredEnvelope(envelopeValues.totpSecret, targetVersion);
     const recoveryClass = classifyStoredEnvelope(envelopeValues.recoveryCodes, targetVersion);
     if (totpClass === "unrecognized" || recoveryClass === "unrecognized") {
-      ctx.log?.warn?.(
+      ctx.obs.log?.warn?.(
         `[auth-mfa:reencrypt] row ${row.id} has a field that is not a current-cipher envelope, not re-encryptable`,
       );
       return "failed";
@@ -193,7 +198,7 @@ export async function mfaReencryptJob(
     // the row now holds a fresh write, already fine.
     if (!result.isSuccess) {
       if (result.error.code === "version_conflict") return "skipped";
-      ctx.log?.warn?.(`[auth-mfa:reencrypt] executor rejected row ${row.id}`, {
+      ctx.obs.log?.warn?.(`[auth-mfa:reencrypt] executor rejected row ${row.id}`, {
         code: result.error.code,
       });
       return "failed";
@@ -206,9 +211,9 @@ export async function mfaReencryptJob(
     migrateRow,
     maxFailures,
     deadlineAt: deadline,
-    signal: ctx.signal,
+    signal: ctx.lifecycle.signal,
     onRowError: (row, err) => {
-      ctx.log?.warn?.(`[auth-mfa:reencrypt] failed to re-encrypt row ${row.id}`, { err });
+      ctx.obs.log?.warn?.(`[auth-mfa:reencrypt] failed to re-encrypt row ${row.id}`, { err });
     },
   });
 
@@ -219,5 +224,5 @@ export async function mfaReencryptJob(
     batchesProcessed: outcome.batchesProcessed,
     stoppedReason: outcome.stoppedReason,
   };
-  ctx.log?.info?.(`[auth-mfa:reencrypt] complete: ${JSON.stringify(result)}`);
+  ctx.obs.log?.info?.(`[auth-mfa:reencrypt] complete: ${JSON.stringify(result)}`);
 }

package/packages/bundled-features/src/auth-mfa/handlers/regenerate-recovery.write.ts

@@ -48,18 +48,19 @@ export function createRegenerateRecoveryHandler(opts: RegenerateRecoveryOptions)
       // afterward.
       //
       // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts:
-      // without ctx.redis, verifyMfaFactor's TOTP-replay burn is skipped,
+      // without ctx.services.redis, verifyMfaFactor's TOTP-replay burn is skipped,
       // letting an observed code be replayed within the ±1-step window to
       // regenerate (and thus invalidate) recovery codes — a session-authed
       // route, so pre-unwiring JWTs stay a valid attack path.
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
           new InternalError({
-            message: "regenerate-recovery (mfa) requires ctx.redis for TOTP replay protection",
+            message:
+              "regenerate-recovery (mfa) requires ctx.services.redis for TOTP replay protection",
           }),
         );
       }
-      const replay = { redis: ctx.redis, userId: event.user.id };
+      const replay = { redis: ctx.services.redis, userId: event.user.id };
       const verify = await verifyMfaFactor(row, event.payload.code, replay);
       if (!verify.ok) return invalidTotpCode();
 

package/packages/bundled-features/src/auth-mfa/handlers/verify.write.ts

@@ -50,8 +50,8 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
     escapeHatch: {
       grants: ["systemIdentity", "unsafeRaw"],
       reason:
-        "Pre-auth MFA step has no session yet — re-derives it via ctx.queryAs(SYSTEM, " +
-        "user:findForAuth) and ctx.resolveActiveMembership for the user the challenge token names. " +
+        "Pre-auth MFA step has no session yet — re-derives it via ctx.dispatch.queryAs(SYSTEM, " +
+        "user:findForAuth) and ctx.auth.resolveActiveMembership for the user the challenge token names. " +
         "Also reads the MFA enrollment of the tenant named in the signed login/setup token, not the " +
         "guest dispatch tenant.",
     },
@@ -71,14 +71,15 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // this route sits behind a challenge token from a successful login,
       // but its own secret is still just a short TOTP/recovery code —
       // silently skipping the brute-force cap and single-use burn when
-      // ctx.redis is absent would let a stolen challenge token be guessed
+      // ctx.services.redis is absent would let a stolen challenge token be guessed
       // against unboundedly, and let a recovery code be replayed via a
       // reissued challenge (mfa-verify-attempts.ts's counter is deliberately
       // NOT reset by reissuance, precisely to survive this).
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
           new InternalError({
-            message: "verify (mfa) requires ctx.redis for the brute-force cap and single-use burn",
+            message:
+              "verify (mfa) requires ctx.services.redis for the brute-force cap and single-use burn",
           }),
         );
       }
@@ -86,7 +87,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // Per-account brute-force cap — survives challenge-token reissuance
       // on purpose (see mfa-verify-attempts.ts header). Checked BEFORE the
       // TOTP/recovery verify so a locked account can't be guessed against.
-      const state = await getMfaVerifyLockoutState(ctx.redis, userId);
+      const state = await getMfaVerifyLockoutState(ctx.services.redis, userId);
       if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {
         const now = Date.now();
         if (state.lockedUntil > now) {
@@ -98,7 +99,12 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // "system" mode: this handler runs with a guest identity whose own
       // tenantId is meaningless here — the challenge token is the source
       // of truth for which tenant's row to read.
-      const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
+      const scopedDb = createTenantDb({
+        db: ctx.db.unsafeRaw(),
+        tenantId,
+        mode: "system",
+        reason: "MFA challenge has no session, the tenant comes from the verified challenge token",
+      });
       const scopedUser: SessionUser = { id: userId, tenantId, roles: ["User"] };
       const row = await findUserMfaRow(scopedDb, scopedUser);
       // MFA got disabled between login and verify (race, or a stale
@@ -106,10 +112,10 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // bad code, no detail leak about account state.
       if (!row) return invalidChallengeToken();
 
-      const replay = { redis: ctx.redis, userId };
+      const replay = { redis: ctx.services.redis, userId };
       const verify = await verifyMfaFactor(row, event.payload.code, replay);
       if (!verify.ok) {
-        await recordFailedMfaVerifyAttempt(ctx.redis, userId, maxAttempts, lockoutMinutes);
+        await recordFailedMfaVerifyAttempt(ctx.services.redis, userId, maxAttempts, lockoutMinutes);
         return invalidTotpCode();
       }
 
@@ -121,7 +127,12 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // is reached, so this burn only needs to guard a DIFFERENT code
       // (recovery, or a still-valid-but-not-yet-burned TOTP step) reused
       // against the same challenge token.
-      const burnResult = await burnToken(ctx.redis, "mfa-challenge", userId, verified.expiresAtMs);
+      const burnResult = await burnToken(
+        ctx.services.redis,
+        "mfa-challenge",
+        userId,
+        verified.expiresAtMs,
+      );
       if (burnResult === "already-used") return invalidChallengeToken();
 
       // Recovery-code use consumes the code — persist the reduced hash-list
@@ -140,13 +151,13 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
         if (!updateResult.isSuccess) return updateResult;
       }
 
-      await clearMfaVerifyAttempts(ctx.redis, userId);
+      await clearMfaVerifyAttempts(ctx.services.redis, userId);
 
       // Re-derive the full session the way login.write.ts would have, for
       // the SAME tenant the challenge token already committed to (no
       // "pick a tenant" step here — that already happened at login time).
       const systemUser = createSystemUser(tenantId, ["SystemAdmin"]);
-      const userRow = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
+      const userRow = (await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
         id: userId,
       })) as {
         roles?: string | null;
@@ -174,7 +185,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
 
       // Membership revoked or principal blocked between login and verify —
       // mirror login.write.ts's refusal instead of falling back to globalRoles only.
-      const active = await ctx.resolveActiveMembership(userId, tenantId);
+      const active = await ctx.auth.resolveActiveMembership(userId, tenantId);
       if (active.kind === "rejected") return invalidChallengeToken();
       // buildSessionRoles calls stripForbiddenMembershipRoles to strip reserved
       // roles from the membership portion (globalRoles keeps SystemAdmin) —
@@ -188,7 +199,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
         ...sessionTimezoneField(userRow?.timezone),
         ...sessionLocaleField(userRow?.locale),
       };
-      const claims = await ctx.resolveAuthClaims(baseSession);
+      const claims = await ctx.auth.resolveClaims(baseSession);
       const session: SessionUser =
         Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;
 

package/packages/bundled-features/src/auth-mfa/mfa-code-verifier.ts

@@ -29,13 +29,19 @@ export function createMfaCodeVerifier(): MfaCodeVerifier {
       reason:
         "reads the MFA enrollment of the user being re-authenticated on the caller's handler context; the calling handler declares its own escapeHatch",
     });
-    const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
+    const scopedDb = createTenantDb({
+      db: ctx.db.unsafeRaw(),
+      tenantId,
+      mode: "system",
+      reason:
+        "re-authentication reads the MFA enrollment of the user's own tenant, not the handler's dispatch tenant",
+    });
     const row = await findUserMfaRow(scopedDb, { id: userId, tenantId, roles: [] });
     if (!row) return { enrolled: false, ok: false };
-    // Fail closed without ctx.redis, matching disable.write.ts/verify.write.ts —
+    // Fail closed without ctx.services.redis, matching disable.write.ts/verify.write.ts —
     // skipping the TOTP-replay burn would let an observed code be replayed.
-    if (!code || !ctx.redis) return { enrolled: true, ok: false };
-    const verify = await verifyMfaFactor(row, code, { redis: ctx.redis, userId });
+    if (!code || !ctx.services.redis) return { enrolled: true, ok: false };
+    const verify = await verifyMfaFactor(row, code, { redis: ctx.services.redis, userId });
     return { enrolled: true, ok: verify.ok && verify.method === "totp" };
   };
 }

package/packages/bundled-features/src/auth-mfa/mfa-status-checker.ts

@@ -1,3 +1,4 @@
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
@@ -31,8 +32,8 @@ export type MfaStatusChecker = (
   ctx: HandlerContext,
   userId: string,
   tenantId: TenantId,
-  // Merged global+tenant roles — needed to evaluate the "admins" policy
-  // value. Must be the MERGED set (see login.write.ts caller): a
+  // Merged global+tenant roles — needed to evaluate the "admins" and "systemAdmins"
+  // policies. Must be the MERGED set (see login.write.ts caller): a
   // SystemAdmin whose admin-ness lives only in global roles would be
   // missed if the caller passed tenant-membership roles alone.
   roles: readonly string[],
@@ -47,7 +48,13 @@ export function createMfaStatusChecker(opts: {
       reason:
         "reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant, on the caller's handler context; the calling handler declares its own escapeHatch",
     });
-    const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
+    const scopedDb = createTenantDb({
+      db: ctx.db.unsafeRaw(),
+      tenantId,
+      mode: "system",
+      reason:
+        "login/setup token names the tenant to check, the guest dispatch tenant is meaningless",
+    });
     const scopedUser: SessionUser = { id: userId, tenantId, roles: ["User"] };
     const row = await findUserMfaRow(scopedDb, scopedUser);
 
@@ -64,12 +71,12 @@ export function createMfaStatusChecker(opts: {
     }
 
     // ctx.config is bound to the CALLING user's tenant (the anonymous
-    // identity's tenant for login) — wrong tenant here. ctx.configResolver takes tenantId
+    // identity's tenant for login) — wrong tenant here. ctx.services.configResolver takes tenantId
     // explicitly, which is what a pre-session check against the LOGGING-IN
     // user's tenant needs.
     // @cast-boundary engine-payload — "select" config values are validated
     // against the declared `options` at write-time by the config feature.
-    const policy = ((await ctx.configResolver?.get(
+    const policy = ((await ctx.services.configResolver?.get(
       mfaRequiredConfigHandle.name,
       mfaRequiredConfigKey(opts.requiredPolicy),
       tenantId,
@@ -84,9 +91,11 @@ export function createMfaStatusChecker(opts: {
         opts.challengeTokenSecret,
       ).token;
     if (policy === "all") return { setupRequired: true, preauthSetupToken: buildSetupToken() };
-    // policy === "admins"
-    const isAdmin = roles.some((role) => access.admin.includes(role));
-    return isAdmin
+    const isEnforced =
+      policy === "systemAdmins"
+        ? roles.includes(ROLES.SystemAdmin)
+        : roles.some((role) => access.admin.includes(role));
+    return isEnforced
       ? { setupRequired: true, preauthSetupToken: buildSetupToken() }
       : { required: false };
   };

package/packages/bundled-features/src/auth-mfa/verify-factor.ts

@@ -21,7 +21,7 @@ export type MfaFactorVerifyResult =
 // must not verify again within its ±1-step window — otherwise a code an
 // attacker observed once, via phishing proxy or shoulder-surfing, stays
 // usable for ~90s of parallel logins). Omitted where a caller has no
-// ctx.redis available; the code-verify itself still works, just without
+// ctx.services.redis available; the code-verify itself still works, just without
 // replay protection for that call.
 export async function verifyMfaFactor(
   row: UserMfaRow,

package/packages/bundled-features/src/billing-foundation/billing-info-query.ts

@@ -68,8 +68,8 @@ export function createBillingInfoQueryConfig<TTier extends string>(
       const billingLive = ctx.config
         ? (await ctx.config(STRIPE_BILLING_LIVE_CONFIG_QN)) === true
         : false;
-      const apiKeySet = ctx.secrets
-        ? await ctx.secrets.has(SYSTEM_TENANT_ID, STRIPE_API_KEY_CONFIG_QN)
+      const apiKeySet = ctx.services.secrets
+        ? await ctx.services.secrets.has(SYSTEM_TENANT_ID, STRIPE_API_KEY_CONFIG_QN)
         : false;
 
       const sub = await ctx.db.fetchOne<{

package/packages/bundled-features/src/billing-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Revoking one termination no longer resumes a subscription another termination still cancels",
+    "detail": "A revocation only resumes the subscription at the provider when no other recorded termination still cancels it. Recording and revoking a termination now run one at a time per tenant, so provider calls can no longer interleave with the event stream."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/packages/bundled-features/src/billing-foundation/consumer-protection/consent-gate.ts

@@ -172,7 +172,7 @@ export async function recordConsent(
   };
   const tenantId = ctx.user.tenantId;
   const isSubscription = prepared.mode === "subscription";
-  await ctx.unsafeAppendEvent({
+  await ctx.events.unsafeAppend({
     aggregateId: isSubscription ? subscriptionAggregateId(tenantId) : paymentAggregateId(tenantId),
     aggregateType: isSubscription ? SUBSCRIPTION_AGGREGATE_TYPE : PAYMENT_AGGREGATE_TYPE,
     type: CHECKOUT_CONSENT_RECORDED_EVENT_QN,

package/packages/bundled-features/src/billing-foundation/consumer-protection/issue-confirmation.ts

@@ -102,7 +102,7 @@ export function createIssueContractConfirmationHandler(
         });
       }
 
-      const stream = await ctx.fetchForWriting({
+      const stream = await ctx.events.fetchForWriting({
         aggregateId: payload.sourceAggregateId,
         aggregateType: isSubscription ? SUBSCRIPTION_AGGREGATE_TYPE : PAYMENT_AGGREGATE_TYPE,
       });
@@ -119,7 +119,7 @@ export function createIssueContractConfirmationHandler(
         }
       }
       if (!consentEvent || !consent) {
-        ctx.log?.warn(
+        ctx.obs.log?.warn(
           `[billing-foundation:issue-contract-confirmation] no recorded consent ${payload.consentId} on the stream; no mail sent`,
         );
         return {
@@ -150,7 +150,7 @@ export function createIssueContractConfirmationHandler(
       // Everything that can fail runs before the append, so a failed run
       // leaves no marker behind and the job retry starts clean.
       const recipient = recipientRowSchema.safeParse(
-        await ctx.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, {
+        await ctx.dispatch.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, {
           id: consent.actorUserId,
         }),
       );
@@ -162,7 +162,7 @@ export function createIssueContractConfirmationHandler(
             )
           : null;
       if (!recipient.success || recipientEmail === null) {
-        ctx.log?.warn(
+        ctx.obs.log?.warn(
           `[billing-foundation:issue-contract-confirmation] recipient of consent ${payload.consentId} not found; no mail sent`,
         );
         return {
@@ -182,7 +182,7 @@ export function createIssueContractConfirmationHandler(
         locale,
       });
       if (terms.version !== consent.termsTemplateVersion) {
-        ctx.log?.warn(
+        ctx.obs.log?.warn(
           `[billing-foundation:issue-contract-confirmation] terms text block changed since consent ${payload.consentId} (version ${consent.termsTemplateVersion} -> ${terms.version}); the mail carries the current text`,
         );
       }

package/packages/bundled-features/src/billing-foundation/consumer-protection/register-consent.ts

@@ -76,13 +76,16 @@ export function registerConsumerProtection(
         // user), never from payload data.
         const tenantId = ctx.systemUser.tenantId;
         const currentPeriodEndIso = payload["currentPeriodEndIso"];
-        const result = await ctx.write(SubscriptionFoundationHandlers.issueContractConfirmation, {
-          consentId,
-          sourceAggregateId: isSubscriptionEvent
-            ? subscriptionAggregateId(tenantId)
-            : paymentAggregateId(tenantId),
-          ...(typeof currentPeriodEndIso === "string" && { currentPeriodEndIso }),
-        });
+        const result = await ctx.dispatch.write(
+          SubscriptionFoundationHandlers.issueContractConfirmation,
+          {
+            consentId,
+            sourceAggregateId: isSubscriptionEvent
+              ? subscriptionAggregateId(tenantId)
+              : paymentAggregateId(tenantId),
+            ...(typeof currentPeriodEndIso === "string" && { currentPeriodEndIso }),
+          },
+        );
         if (!result.isSuccess) {
           throw new Error(
             `billing-foundation:${trigger.jobName}: issue-contract-confirmation failed: ${JSON.stringify(result.error)}`,

package/packages/bundled-features/src/billing-foundation/consumer-protection/register-termination.ts

@@ -80,18 +80,21 @@ export function registerContractTermination(
       const declared = contractTerminationDeclaredPayloadSchema.safeParse(payload);
       // skip: trigger event carries no usable declaration
       if (!declared.success) return;
-      const result = await ctx.write(SubscriptionFoundationHandlers.recordContractTermination, {
-        requestId: declared.data.requestId,
-        declarationType: declared.data.declarationType,
-        terminationKind: declared.data.terminationKind,
-        channel: "public",
-        when:
-          declared.data.declarationType === "withdrawal"
-            ? "none"
-            : SubscriptionCancelTimings.periodEnd,
-        receivedAtIso: declared.data.receivedAtIso,
-        locale: declared.data.locale,
-      });
+      const result = await ctx.dispatch.write(
+        SubscriptionFoundationHandlers.recordContractTermination,
+        {
+          requestId: declared.data.requestId,
+          declarationType: declared.data.declarationType,
+          terminationKind: declared.data.terminationKind,
+          channel: "public",
+          when:
+            declared.data.declarationType === "withdrawal"
+              ? "none"
+              : SubscriptionCancelTimings.periodEnd,
+          receivedAtIso: declared.data.receivedAtIso,
+          locale: declared.data.locale,
+        },
+      );
       if (!result.isSuccess) {
         throw new Error(
           `billing-foundation:cancel-on-public-termination-declared: record-contract-termination failed: ${JSON.stringify(result.error)}`,

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-open-cancels.ts

@@ -0,0 +1,22 @@
+import {
+  CONTRACT_TERMINATION_REQUESTED_EVENT_QN,
+  contractTerminationRequestedPayloadSchema,
+} from "../events.ts";
+import { hasRevocation } from "./termination-record.ts";
+
+// A revoked declaration must not resume a subscription another declaration still cancels at the provider.
+export function hasOtherOpenProviderCancel(
+  events: readonly { type: string; payload: unknown }[],
+  requestId: string,
+): boolean {
+  return events.some((e) => {
+    if (e.type !== CONTRACT_TERMINATION_REQUESTED_EVENT_QN) return false;
+    const recorded = contractTerminationRequestedPayloadSchema.safeParse(e.payload).data;
+    return (
+      recorded !== undefined &&
+      recorded.requestId !== requestId &&
+      recorded.providerCancel !== "none" &&
+      !hasRevocation(events, recorded.requestId)
+    );
+  });
+}

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-provider-lock.ts

@@ -0,0 +1,4 @@
+// pg_advisory_xact_lock namespace (int4): 'btpl' as ASCII, disjoint from the other fixed advisory-lock keys.
+export const TERMINATION_PROVIDER_LOCK_NAMESPACE = 0x6274706c;
+
+export const TERMINATION_PROVIDER_LOCK_KEY = "subscription";

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-receipt-limit.ts

@@ -24,22 +24,22 @@ export async function mayMailReceipt(
   email: string,
 ): Promise<ReceiptMailVerdict> {
   // skip: no rate limiter wired, nothing to count against
-  if (!ctx.rateLimit) return "allowed";
+  if (!ctx.services.rateLimit) return "allowed";
   try {
     const bucketKey = receiptBucketKey(ctx, email);
     if (bucketKey === undefined) {
-      ctx.log?.warn(
+      ctx.obs.log?.warn(
         "[billing-foundation:termination] no rate-limit digest available, receipt mail withheld",
       );
       return "unavailable";
     }
-    const decision = await ctx.rateLimit.check(bucketKey, {
+    const decision = await ctx.services.rateLimit.check(bucketKey, {
       limit: RECEIPT_MAILS_PER_RECIPIENT,
       windowSeconds: RECEIPT_WINDOW_SECONDS,
     });
     return decision.allowed ? "allowed" : "limited";
   } catch (error) {
-    ctx.log?.warn(
+    ctx.obs.log?.warn(
       `[billing-foundation:termination] receipt rate limiter failed: ${error instanceof Error ? error.message : String(error)}`,
     );
     return "unavailable";