@cosmicdrift/kumiko-samples 0.389.0 → 0.390.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.389.0",
+  "version": "0.390.1",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.389.0",
+  "version": "0.390.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -18,7 +18,9 @@
     "runtime": "runtime",
     "bunOnlyExports": [
       "./template-resolver/testing",
-      "./tenant-lifecycle/testing"
+      "./tenant-lifecycle/testing",
+      "./tenant/testing",
+      "./user/testing"
     ]
   },
   "exports": {
@@ -101,12 +103,14 @@
     "./user-profile/web": "./src/user-profile/web/index.ts",
     "./auth-email-password": "./src/auth-email-password/index.ts",
     "./auth-email-password/constants": "./src/auth-email-password/web/constants.ts",
+    "./auth-email-password/return-path": "./src/auth-email-password/web/return-path.ts",
     "./auth-email-password/email-templates": "./src/auth-email-password/email-templates.ts",
     "./auth-email-password/seeding": "./src/auth-email-password/seeding.ts",
     "./auth-email-password/testing": "./src/auth-email-password/testing.ts",
     "./auth-email-password/web": "./src/auth-email-password/web/index.ts",
     "./shared/single-use-token-store": "./src/shared/single-use-token-store.ts",
     "./shared/signed-token": "./src/shared/signed-token.ts",
+    "./shared/stream-tenant-backfill": "./src/shared/stream-tenant-backfill.ts",
     "./shared/row-bound-grant": "./src/shared/row-bound-grant.ts",
     "./shared/mail-template-body": "./src/shared/mail-template-body.ts",
     "./delivery": "./src/delivery/index.ts",
@@ -160,27 +164,27 @@
     "@cosmicdrift/kumiko-types": "workspace:*",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
-    "@tiptap/core": "3.31.3",
-    "@tiptap/extension-link": "3.31.3",
-    "@tiptap/extension-list": "3.31.3",
-    "@tiptap/extension-table": "3.31.3",
-    "@tiptap/html": "3.31.3",
-    "@tiptap/extensions": "3.31.3",
-    "@tiptap/pm": "3.31.3",
-    "@tiptap/react": "3.31.3",
-    "@tiptap/starter-kit": "3.31.3",
+    "@tiptap/core": "^3.31.3",
+    "@tiptap/extension-link": "^3.31.3",
+    "@tiptap/extension-list": "^3.31.3",
+    "@tiptap/extension-table": "^3.31.3",
+    "@tiptap/html": "^3.31.3",
+    "@tiptap/extensions": "^3.31.3",
+    "@tiptap/pm": "^3.31.3",
+    "@tiptap/react": "^3.31.3",
+    "@tiptap/starter-kit": "^3.31.3",
     "@types/mailparser": "^3.4.6",
     "@types/qrcode": "^1.5.5",
     "clsx": "^2.1.1",
-    "happy-dom": "^20.11.2",
+    "happy-dom": "^21.0.4",
     "hono": "^4.13.1",
     "imapflow": "^1.7.8",
     "ioredis": "^5.10.1",
     "jose": "^6.2.3",
     "lucide-react": "^1.14.0",
-    "mailparser": "^3.9.32",
+    "mailparser": "^3.12.4",
     "marked": "^18.0.3",
-    "nodemailer": "^10.0.13",
+    "nodemailer": "^10.2.1",
     "pdf-lib": "^1.17.1",
     "qrcode": "^1.5.4",
     "react": "^19.2.6",
@@ -190,7 +194,7 @@
     "tailwind-merge": "^3.6.0",
     "temporal-polyfill": "^0.3.2",
     "uuid": "^14.0.0",
-    "zod": "^4.4.3"
+    "zod": "^4.6.7"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -516,6 +520,10 @@
         "types": "./dist/auth-email-password/web/constants.d.ts",
         "default": "./dist/auth-email-password/web/constants.js"
       },
+      "./auth-email-password/return-path": {
+        "types": "./dist/auth-email-password/web/return-path.d.ts",
+        "default": "./dist/auth-email-password/web/return-path.js"
+      },
       "./auth-email-password/seeding": {
         "types": "./dist/auth-email-password/seeding.d.ts",
         "default": "./dist/auth-email-password/seeding.js"
@@ -536,6 +544,10 @@
         "types": "./dist/shared/signed-token.d.ts",
         "default": "./dist/shared/signed-token.js"
       },
+      "./shared/stream-tenant-backfill": {
+        "types": "./dist/shared/stream-tenant-backfill.d.ts",
+        "default": "./dist/shared/stream-tenant-backfill.js"
+      },
       "./shared/row-bound-grant": {
         "types": "./dist/shared/row-bound-grant.d.ts",
         "default": "./dist/shared/row-bound-grant.js"

package/packages/bundled-features/src/audit/feature.ts

@@ -93,7 +93,7 @@ export function createAuditFeature(): FeatureDefinition {
           await runEscapeHatchRetention({
             db: ctx.db.unsafeRaw(),
             registry: ctx.registry,
-            configResolver: ctx.configResolver,
+            configResolver: ctx.services.configResolver,
             userId: SYSTEM_USER_ID,
           });
         },

package/packages/bundled-features/src/auth-email-password/auth-user-row.ts

@@ -1,4 +1,4 @@
-// Narrow cross-feature query results (ctx.queryAs → Promise<unknown>) into
+// Narrow cross-feature query results (ctx.dispatch.queryAs → Promise<unknown>) into
 // the shape the auth handlers actually read. Replaces a bare
 // `as AuthUserRow | null` at the system boundary — the coding standard
 // requires a TypeGuard in place of unchecked casts from unknown.

package/packages/bundled-features/src/auth-email-password/bootstrap.ts

@@ -19,6 +19,7 @@ import {
   type TenantId,
   type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
@@ -293,7 +294,18 @@ function isMailingOutcome(outcome: BootstrapInviteOutcome): boolean {
   return outcome === "invited" || outcome === "resent";
 }
 
-export async function bootstrapTenants(
+// A one-shot operator process, not a tenant request: it looks up users, memberships and invitations across tenants.
+export function bootstrapTenants(
+  deps: BootstrapDeps,
+  plan: BootstrapPlan,
+): Promise<BootstrapReport> {
+  return runInSystemRowLevelSecurityScope(
+    "boot tenant bootstrap creates tenants and memberships before any tenant exists",
+    () => bootstrapTenantsInScope(deps, plan),
+  );
+}
+
+async function bootstrapTenantsInScope(
   deps: BootstrapDeps,
   plan: BootstrapPlan,
 ): Promise<BootstrapReport> {

package/packages/bundled-features/src/auth-email-password/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "isSafeReturnPath has its own light subpath",
+    "detail": "Importing @cosmicdrift/kumiko-bundled-features/auth-email-password/return-path gives isSafeReturnPath, readReturnToFromSearch, RETURN_TO_QUERY_PARAM and MAX_RETURN_PATH_LENGTH without loading the web barrel, for example in Astro pages that run without the Kumiko runtime."
+  },
   {
     "version": "0.389.0",
     "type": "improvement",

package/packages/bundled-features/src/auth-email-password/feature.ts

@@ -105,7 +105,7 @@ export type EmailVerificationOptions = {
 // Brute-force protection on the login handler. Omit for the defaults
 // (5 failures → 15-minute lock). Set the dial knobs to override.
 //
-// Storage: Redis (keyed by userId). Without ctx.redis the handler skips
+// Storage: Redis (keyed by userId). Without ctx.services.redis the handler skips
 // lockout entirely — login still works, but brute-force protection falls
 // back to the IP-rate-limiter. Counter is monotonic: only a successful
 // login resets it, so after a lockout expires the next wrong password
@@ -149,7 +149,7 @@ export type AuthEmailPasswordOptions = {
 };
 
 // Auth feature — email+password login. Depends on the user feature for
-// identity lookups (via ctx.queryAs) and on the tenant feature for
+// identity lookups (via ctx.dispatch.queryAs) and on the tenant feature for
 // membership resolution. No direct imports of foreign tables.
 export function createAuthEmailPasswordFeature(
   opts: AuthEmailPasswordOptions = {},

package/packages/bundled-features/src/auth-email-password/handlers/change-password.write.ts

@@ -10,7 +10,7 @@ import { invalidCredentials } from "../errors.ts";
 import { passwordSchema } from "../password-policy.ts";
 
 // Change-password — authenticated. The user supplies their current password
-// (re-auth) and the new one. The new hash is written via ctx.writeAs(system)
+// (re-auth) and the new one. The new hash is written via ctx.dispatch.writeAs(system)
 // against the user feature's update handler; field-access on passwordHash
 // (privileged-only) lets the system identity through.
 export const changePasswordWrite = defineWriteHandler({
@@ -28,8 +28,8 @@ export const changePasswordWrite = defineWriteHandler({
   escapeHatch: {
     grants: ["systemIdentity"],
     reason:
-      "Reads the caller's own passwordHash (privileged-only field) via ctx.queryAs(SYSTEM, ...) " +
-      "and writes the new hash via ctx.writeAs(SYSTEM, user:update) — the caller's own " +
+      "Reads the caller's own passwordHash (privileged-only field) via ctx.dispatch.queryAs(SYSTEM, ...) " +
+      "and writes the new hash via ctx.dispatch.writeAs(SYSTEM, user:update) — the caller's own " +
       "identity can't reach either, field-access on passwordHash is privileged-only.",
   },
   // Payload carries the old and new password.
@@ -40,7 +40,7 @@ export const changePasswordWrite = defineWriteHandler({
     const systemUser = createSystemUser(event.user.tenantId);
 
     // Load self with passwordHash — only visible to the privileged caller.
-    const me = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
+    const me = (await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
       id: event.user.id,
     })) as { id: number; passwordHash: string | null; version: number } | null; // @cast-boundary db-runner
 
@@ -56,14 +56,14 @@ export const changePasswordWrite = defineWriteHandler({
     const newHash = await hashPassword(event.payload.newPassword);
 
     // The user aggregate is systemStream: its event stream lives on
-    // SYSTEM_TENANT_ID deterministically. Previously scattered streams need the
-    // one-time backfillUserStreamTenants migration.
+    // SYSTEM_TENANT_ID deterministically. Previously scattered streams are moved by the
+    // boot-time stream-tenant backfill (runStreamTenantBackfillOnBoot).
     const writer = createSystemUser(SYSTEM_TENANT_ID);
 
     // Apply via user feature's update handler — writeAs(system) satisfies
     // the privileged-only write rule on passwordHash. Pass the current version
     // through so optimistic locking still applies end-to-end.
-    const writeRes = await ctx.writeAs(writer, UserHandlers.update, {
+    const writeRes = await ctx.dispatch.writeAs(writer, UserHandlers.update, {
       id: me.id,
       version: me.version,
       changes: { passwordHash: newHash },

package/packages/bundled-features/src/auth-email-password/handlers/confirm-account-unlock.write.ts

@@ -40,10 +40,10 @@ export function createConfirmAccountUnlockHandler(opts: ConfirmAccountUnlockOpti
           }),
         );
       }
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
           new InternalError({
-            message: "account-unlock requires ctx.redis to clear lockout state",
+            message: "account-unlock requires ctx.services.redis to clear lockout state",
           }),
         );
       }
@@ -54,7 +54,7 @@ export function createConfirmAccountUnlockHandler(opts: ConfirmAccountUnlockOpti
       const verify = verifyUnlockToken(event.payload.token, opts.hmacSecret);
       if (!verify.ok) return invalidUnlockToken();
 
-      await clearLockoutState(ctx.redis, verify.userId);
+      await clearLockoutState(ctx.services.redis, verify.userId);
       return { isSuccess: true, data: { kind: "account-unlocked" as const } };
     },
   });

package/packages/bundled-features/src/auth-email-password/handlers/confirm-token-flow.ts

@@ -42,7 +42,7 @@ export type ConfirmTokenFlowSpec<TSuccessData> = {
   // other token flows — "reset" vs "verify" keeps cross-flow replay
   // impossible at both layers (HMAC-purpose AND burn-purpose).
   readonly purpose: string;
-  // Used verbatim in the 5xx body when ctx.redis is missing — the feature
+  // Used verbatim in the 5xx body when ctx.services.redis is missing — the feature
   // is misconfigured, not the caller's fault.
   readonly redisRequiredMessage: string;
   // Standard failure returned for every "token can't be consumed" path
@@ -74,10 +74,10 @@ export async function runConfirmTokenFlow<TSuccessData>(
     reason:
       "writes the confirming user's row via UserHandlers.update on the caller's handler context, using a SYSTEM_TENANT-scoped identity; the calling handler declares its own escapeHatch",
   });
-  if (!ctx.redis) {
+  if (!ctx.services.redis) {
     return writeFailure(new InternalError({ message: spec.redisRequiredMessage }));
   }
-  const redis: Redis = ctx.redis;
+  const redis: Redis = ctx.services.redis;
 
   const burn = await burnToken(redis, spec.purpose, userId, expiresAtMs);
   if (burn === "already-used") return spec.invalidToken();
@@ -99,7 +99,7 @@ export async function runConfirmTokenFlow<TSuccessData>(
     }
 
     const changes = await spec.buildChanges(me);
-    const writeRes = await ctx.writeAs(systemUser, UserHandlers.update, {
+    const writeRes = await ctx.dispatch.writeAs(systemUser, UserHandlers.update, {
       id: me.id,
       version: me.version,
       changes,
@@ -141,7 +141,7 @@ async function loadValidatedUser(
       "reads the confirming user's row via UserQueries.findForAuth on the caller's handler context, using a SYSTEM_TENANT-scoped identity; the calling handler declares its own escapeHatch",
   });
   const me = parseAuthUserRow(
-    await ctx.queryAs(systemUser, UserQueries.findForAuth, { id: userId }),
+    await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, { id: userId }),
   );
   if (!me || me.isDeleted || me.version === undefined || me.version < 1) return null;
   return { ...me, version: me.version };

package/packages/bundled-features/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -133,16 +133,16 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
     agent: { expose: false },
     // kumiko-lint-ignore complexity-budget reuses login.write.ts's gate chain (lockout/password/email/status/membership/mfa) plus invite-specific branches (email match, already-member check, invitation update, unburn-on-failure) — splitting would scatter gate order across functions without reducing risk
     handler: async (event, ctx) => {
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
-          new InternalError({ message: "invite-accept-with-login requires ctx.redis" }),
+          new InternalError({ message: "invite-accept-with-login requires ctx.services.redis" }),
         );
       }
 
-      const invitationId = await getInvitationIdForToken(ctx.redis, event.payload.token);
+      const invitationId = await getInvitationIdForToken(ctx.services.redis, event.payload.token);
       if (!invitationId) return invalidInviteToken();
 
-      const burn = await burnInviteToken(ctx.redis, event.payload.token);
+      const burn = await burnInviteToken(ctx.services.redis, event.payload.token);
       if (burn === "already-used") return invalidInviteToken();
 
       type InvitationRow = {
@@ -242,6 +242,8 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
           db: dbConn,
           tenantId: invitationTenantId,
           mode: "system",
+          reason:
+            "invitation tenant differs from the caller's tenant, the accept step updates the invitation row there",
         });
         const updateResult = await invitationExecutor.update(
           {
@@ -254,7 +256,7 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
         );
         if (!updateResult.isSuccess) return updateResult;
 
-        await deleteInviteToken(ctx.redis, { invitationId, token: event.payload.token });
+        await deleteInviteToken(ctx.services.redis, { invitationId, token: event.payload.token });
 
         // buildSessionRoles calls stripForbiddenMembershipRoles internally —
         // a reserved role on an existing membership must never reach the session.
@@ -296,8 +298,8 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
           },
         };
       } finally {
-        if (!committed && ctx.redis) {
-          await unburnInviteToken(ctx.redis, event.payload.token);
+        if (!committed && ctx.services.redis) {
+          await unburnInviteToken(ctx.services.redis, event.payload.token);
         }
       }
     },

package/packages/bundled-features/src/auth-email-password/handlers/invite-accept.write.ts

@@ -94,16 +94,18 @@ export function createInviteAcceptHandler() {
     },
     // kumiko-lint-ignore complexity-budget invite branches (auth/anon/burn) stay in one handler
     handler: async (event, ctx) => {
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
-          new InternalError({ message: "invite-accept requires ctx.redis for token consumption" }),
+          new InternalError({
+            message: "invite-accept requires ctx.services.redis for token consumption",
+          }),
         );
       }
 
-      const invitationId = await getInvitationIdForToken(ctx.redis, event.payload.token);
+      const invitationId = await getInvitationIdForToken(ctx.services.redis, event.payload.token);
       if (!invitationId) return invalidInviteToken();
 
-      const burn = await burnInviteToken(ctx.redis, event.payload.token);
+      const burn = await burnInviteToken(ctx.services.redis, event.payload.token);
       if (burn === "already-used") return invalidInviteToken();
 
       type InvitationRow = {
@@ -177,6 +179,8 @@ export function createInviteAcceptHandler() {
           db: dbConn,
           tenantId: invitationTenantId,
           mode: "system",
+          reason:
+            "invitation tenant differs from the caller's tenant, the accept step updates the invitation row there",
         });
         const updateResult = await invitationExecutor.update(
           {
@@ -189,7 +193,7 @@ export function createInviteAcceptHandler() {
         );
         if (!updateResult.isSuccess) return updateResult;
 
-        await deleteInviteToken(ctx.redis, { invitationId, token: event.payload.token });
+        await deleteInviteToken(ctx.services.redis, { invitationId, token: event.payload.token });
 
         committed = true;
         return {
@@ -202,8 +206,8 @@ export function createInviteAcceptHandler() {
           },
         };
       } finally {
-        if (!committed && ctx.redis) {
-          await unburnInviteToken(ctx.redis, event.payload.token);
+        if (!committed && ctx.services.redis) {
+          await unburnInviteToken(ctx.services.redis, event.payload.token);
         }
       }
     },

package/packages/bundled-features/src/auth-email-password/handlers/invite-create.write.ts

@@ -168,9 +168,9 @@ async function issueInvitation(
   ctx: HandlerContext,
   refuseAccepted = false,
 ): Promise<WriteResult<InviteCreateData>> {
-  if (!ctx.redis) {
+  if (!ctx.services.redis) {
     return writeFailure(
-      new InternalError({ message: "invite-create requires ctx.redis for token store" }),
+      new InternalError({ message: "invite-create requires ctx.services.redis for token store" }),
     );
   }
 
@@ -197,7 +197,7 @@ async function issueInvitation(
     const existingVersion = existing["version"] as number; // @cast-boundary db-row
     // At most one live invite token per invitation: invalidate
     // whatever's there before minting the new one.
-    await invalidateExistingInviteToken(ctx.redis, invitationId);
+    await invalidateExistingInviteToken(ctx.services.redis, invitationId);
 
     const updateResult = await executor.update(
       {
@@ -237,7 +237,7 @@ async function issueInvitation(
   }
 
   const token = generateToken();
-  await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
+  await storeInviteToken(ctx.services.redis, { invitationId, token, ttlSeconds });
 
   const locale = request.locale ?? resolveHandlerMailLocale(ctx, opts.locale);
 

package/packages/bundled-features/src/auth-email-password/handlers/invite-info.query.ts

@@ -52,9 +52,9 @@ export const inviteInfoQuery = defineQueryHandler({
     "Anonymous, read-only invite lookup for the invite-acceptance page: reveals the invited " +
     "email and whether an account already exists for it, without consuming the token.",
   handler: async (query, ctx) => {
-    if (!ctx.redis) throwInvalidInviteToken();
+    if (!ctx.services.redis) throwInvalidInviteToken();
 
-    const invitationId = await getInvitationIdForToken(ctx.redis, query.payload.token);
+    const invitationId = await getInvitationIdForToken(ctx.services.redis, query.payload.token);
     if (!invitationId) throwInvalidInviteToken();
 
     type InvitationRow = {

package/packages/bundled-features/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -103,16 +103,16 @@ export function createInviteSignupCompleteHandler(opts: InviteSignupCompleteOpti
       reason: INVITE_SIGNUP_COMPLETE_ESCAPE_HATCH_REASON,
     },
     handler: async (event, ctx) => {
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
-          new InternalError({ message: "invite-signup-complete requires ctx.redis" }),
+          new InternalError({ message: "invite-signup-complete requires ctx.services.redis" }),
         );
       }
 
-      const invitationId = await getInvitationIdForToken(ctx.redis, event.payload.token);
+      const invitationId = await getInvitationIdForToken(ctx.services.redis, event.payload.token);
       if (!invitationId) return invalidInviteToken();
 
-      const burn = await burnInviteToken(ctx.redis, event.payload.token);
+      const burn = await burnInviteToken(ctx.services.redis, event.payload.token);
       if (burn === "already-used") return invalidInviteToken();
 
       type InvitationRow = {
@@ -187,6 +187,8 @@ export function createInviteSignupCompleteHandler(opts: InviteSignupCompleteOpti
           db: dbConn,
           tenantId: invitationTenantId,
           mode: "system",
+          reason:
+            "invitation tenant differs from the caller's tenant, the accept step updates the invitation row there",
         });
         const updateResult = await invitationExecutor.update(
           {
@@ -214,7 +216,7 @@ export function createInviteSignupCompleteHandler(opts: InviteSignupCompleteOpti
           mergedRoles,
         );
 
-        await deleteInviteToken(ctx.redis, { invitationId, token: event.payload.token });
+        await deleteInviteToken(ctx.services.redis, { invitationId, token: event.payload.token });
 
         if (mfaGate !== undefined) {
           committed = true;
@@ -239,8 +241,8 @@ export function createInviteSignupCompleteHandler(opts: InviteSignupCompleteOpti
           },
         };
       } finally {
-        if (!committed && ctx.redis) {
-          await unburnInviteToken(ctx.redis, event.payload.token);
+        if (!committed && ctx.services.redis) {
+          await unburnInviteToken(ctx.services.redis, event.payload.token);
         }
       }
     },

package/packages/bundled-features/src/auth-email-password/handlers/login.write.ts

@@ -35,7 +35,7 @@ export type LoginHandlerOptions = {
   readonly strictEmailVerification?: boolean;
   // Brute-force protection: after N wrong-password attempts the account
   // locks for the configured duration. State lives in Redis (see
-  // lockout-store.ts) — if ctx.redis is unset, lockout is skipped and the
+  // lockout-store.ts) — if ctx.services.redis is unset, lockout is skipped and the
   // handler falls back to classic invalid-credentials. Counter is monotonic
   // and only resets on a successful login, so a re-lock after the cooldown
   // happens on the FIRST miss, not the Nth (strict semantic — favours
@@ -123,10 +123,10 @@ export async function gateCountUnknownUser(
   lockoutDurationMinutes: number,
 ): Promise<GateOutcome<undefined>> {
   const subject = unknownEmailLockoutSubject(ctx, email);
-  if (!ctx.redis || subject === undefined) return ok(undefined);
+  if (!ctx.services.redis || subject === undefined) return ok(undefined);
   const locked = await gateEnforceLockout(ctx, subject);
   if (!locked.ok) return locked;
-  await recordFailedAttempt(ctx.redis, subject, maxFailedAttempts, lockoutDurationMinutes);
+  await recordFailedAttempt(ctx.services.redis, subject, maxFailedAttempts, lockoutDurationMinutes);
   return ok(undefined);
 }
 
@@ -138,8 +138,8 @@ export async function gateEnforceLockout(
   ctx: HandlerContext,
   userId: string,
 ): Promise<GateOutcome<undefined>> {
-  if (!ctx.redis) return ok(undefined);
-  const state = await getLockoutState(ctx.redis, userId);
+  if (!ctx.services.redis) return ok(undefined);
+  const state = await getLockoutState(ctx.services.redis, userId);
   if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {
     const now = Date.now();
     if (state.lockedUntil > now) {
@@ -160,15 +160,20 @@ export async function gateVerifyPassword(
 ): Promise<GateOutcome<undefined>> {
   const passwordOk = await verifyPassword(found.passwordHash, password);
   if (!passwordOk) {
-    if (ctx.redis) {
-      await recordFailedAttempt(ctx.redis, found.id, maxFailedAttempts, lockoutDurationMinutes);
+    if (ctx.services.redis) {
+      await recordFailedAttempt(
+        ctx.services.redis,
+        found.id,
+        maxFailedAttempts,
+        lockoutDurationMinutes,
+      );
     }
     return reject(invalidCredentials());
   }
   // Clear before MFA — MFA has its own attempt-cap; don't password-lock
   // users who occasionally mistype across otherwise-successful logins.
-  if (ctx.redis) {
-    await clearLockoutState(ctx.redis, found.id);
+  if (ctx.services.redis) {
+    await clearLockoutState(ctx.services.redis, found.id);
   }
   return ok(undefined);
 }
@@ -216,7 +221,7 @@ export async function gateResolveMembership(
   const globalRoles = parseRoles(found.roles ?? null);
 
   for (const candidate of candidates) {
-    const active = await ctx.resolveActiveMembership(found.id, candidate.tenantId);
+    const active = await ctx.auth.resolveActiveMembership(found.id, candidate.tenantId);
     if (active.kind === "rejected") {
       // A blocked principal is blocked for every tenant, so stop here;
       // not_a_member/tenant_teardown are per-tenant — try the next candidate.
@@ -275,7 +280,7 @@ export async function gateBuildSession(
     ...(timezone !== null && timezone !== undefined && { timezone }),
     ...(locale !== null && locale !== undefined && { locale }),
   };
-  const claims = await ctx.resolveAuthClaims(baseSession);
+  const claims = await ctx.auth.resolveClaims(baseSession);
   const session: SessionUser =
     Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;
   return { kind: "auth-session", session };
@@ -284,7 +289,7 @@ export async function gateBuildSession(
 // Login — unauthenticated entry point. The route is wired public (no JWT
 // middleware), dispatching with the framework's anonymous identity for the
 // handler's access check. Everything inside the handler goes through
-// ctx.queryAs(system, ...) so the user feature stays the single owner of its
+// ctx.dispatch.queryAs(system, ...) so the user feature stays the single owner of its
 // table.
 export function createLoginHandler(opts: LoginHandlerOptions = {}) {
   const strictVerification = opts.strictEmailVerification === true;
@@ -305,8 +310,8 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
       grants: ["systemIdentity", "unsafeRaw"],
       reason:
         "Unauthenticated login has no caller identity yet — it looks up the user row by " +
-        "email via ctx.queryAs(SYSTEM, ...) and resolves tenant membership via " +
-        "ctx.resolveActiveMembership before a session exists. It also reads the MFA " +
+        "email via ctx.dispatch.queryAs(SYSTEM, ...) and resolves tenant membership via " +
+        "ctx.auth.resolveActiveMembership before a session exists. It also reads the MFA " +
         "enrollment of the tenant named in the signed login/setup token, not the guest " +
         "dispatch tenant, via the mfaStatusChecker callback.",
     },
@@ -318,7 +323,9 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
       const systemUser = createSystemUser(SYSTEM_USER_ID);
 
       const foundRow = parseAuthUserRow(
-        await ctx.queryAs(systemUser, UserQueries.findForAuth, { email: event.payload.email }),
+        await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
+          email: event.payload.email,
+        }),
       );
       if (!foundRow?.passwordHash || foundRow.isDeleted) {
         const unknown = await gateCountUnknownUser(
@@ -352,7 +359,7 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
       if (!statusGate.ok) return statusGate.result;
 
       // Still needed for candidate ORDER (preferred tenant first) in gateResolveMembership.
-      const memberships = (await ctx.queryAs(systemUser, TENANT_MEMBERSHIPS_QUERY, {
+      const memberships = (await ctx.dispatch.queryAs(systemUser, TENANT_MEMBERSHIPS_QUERY, {
         userId: found.id,
       })) as Array<Membership>; // @cast-boundary db-runner
 

package/packages/bundled-features/src/auth-email-password/handlers/reset-password.write.ts

@@ -31,7 +31,7 @@ export function createResetPasswordHandler(opts: ResetPasswordOptions) {
       grants: ["systemIdentity"],
       reason:
         "Anonymous token holder has no session — runConfirmTokenFlow loads and updates the " +
-        "target user via ctx.writeAs(SYSTEM, user:update) to set the new password hash.",
+        "target user via ctx.dispatch.writeAs(SYSTEM, user:update) to set the new password hash.",
     },
     agent: { expose: false },
     handler: async (event, ctx) => {
@@ -51,7 +51,8 @@ export function createResetPasswordHandler(opts: ResetPasswordOptions) {
 
       return runConfirmTokenFlow(ctx, verify.userId, verify.expiresAtMs, {
         purpose: "reset",
-        redisRequiredMessage: "password-reset requires ctx.redis to enforce token single-use",
+        redisRequiredMessage:
+          "password-reset requires ctx.services.redis to enforce token single-use",
         invalidToken: invalidResetToken,
         buildChanges: async () => ({
           passwordHash: await hashPassword(event.payload.newPassword),