@cosmicdrift/kumiko-samples 0.389.0 → 0.390.1

package/packages/bundled-features/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -119,16 +119,16 @@ async function claimBoundHandover(
 ): Promise<ClaimedHandover | undefined> {
   const provider = findSignupHandoverProvider(ctx.registry);
   if (!provider) {
-    ctx.log?.warn(
+    ctx.obs.log?.warn(
       "signup-confirm: handover binding present but no signupHandover provider mounted",
     );
     return undefined;
   }
   const claim = provider.mintClaim(binding);
-  const claimResult = await ctx.writeAs(session, claim.qualifiedName, claim.payload);
+  const claimResult = await ctx.dispatch.writeAs(session, claim.qualifiedName, claim.payload);
   if (claimResult.isSuccess) return { entityType: binding.entityType, id: binding.rowId };
   if (!isBenignClaimRejection(claimResult.error)) throw reraiseAsKumikoError(claimResult.error);
-  ctx.log?.warn("signup-confirm: handover grant did not redeem", {
+  ctx.obs.log?.warn("signup-confirm: handover grant did not redeem", {
     entityType: binding.entityType,
   });
   return undefined;
@@ -146,22 +146,22 @@ export function createSignupConfirmHandler(opts: SignupConfirmOptions = {}) {
       reason: SIGNUP_CONFIRM_PROVISION_REASON,
     },
     handler: async (event, ctx) => {
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
           new InternalError({
-            message: "signup-confirm requires ctx.redis for token consumption",
+            message: "signup-confirm requires ctx.services.redis for token consumption",
           }),
         );
       }
 
       // Token lookup: nonexistent, expired, and already-consumed tokens all
       // collapse to invalid_signup_token to prevent enumeration.
-      const email = await getEmailForSignupToken(ctx.redis, event.payload.token);
+      const email = await getEmailForSignupToken(ctx.services.redis, event.payload.token);
       if (!email) return invalidSignupToken();
 
       // Single-use burn: of two parallel confirmations from different tabs,
       // one succeeds and the other receives invalid_signup_token.
-      const burn = await burnSignupToken(ctx.redis, event.payload.token);
+      const burn = await burnSignupToken(ctx.services.redis, event.payload.token);
       if (burn === "already-used") return invalidSignupToken();
 
       let committed = false;
@@ -229,7 +229,7 @@ export function createSignupConfirmHandler(opts: SignupConfirmOptions = {}) {
         // Claim BEFORE spending the signup token or the binding below and
         // before `committed` flips: if the claim throws, the `finally` still
         // unburns and the activation link stays retryable.
-        const handoverBinding = await getSignupHandover(ctx.redis, event.payload.token);
+        const handoverBinding = await getSignupHandover(ctx.services.redis, event.payload.token);
         const handover = handoverBinding
           ? await claimBoundHandover(ctx, session, handoverBinding)
           : undefined;
@@ -245,8 +245,8 @@ export function createSignupConfirmHandler(opts: SignupConfirmOptions = {}) {
 
         // Drop both token lookup keys; the burn key stays for its remaining
         // TTL as replay protection.
-        await deleteSignupToken(ctx.redis, { email, token: event.payload.token });
-        if (handoverBinding) await deleteSignupHandover(ctx.redis, event.payload.token);
+        await deleteSignupToken(ctx.services.redis, { email, token: event.payload.token });
+        if (handoverBinding) await deleteSignupHandover(ctx.services.redis, event.payload.token);
 
         if (mfaGate !== undefined) {
           committed = true;
@@ -275,10 +275,10 @@ export function createSignupConfirmHandler(opts: SignupConfirmOptions = {}) {
           },
         };
       } finally {
-        if (!committed && ctx.redis) {
+        if (!committed && ctx.services.redis) {
           // Release the burn so a retry after a DB hiccup is not blocked.
           // Keep the token lookup keys so the user can click the email link again.
-          await unburnSignupToken(ctx.redis, event.payload.token);
+          await unburnSignupToken(ctx.services.redis, event.payload.token);
         }
       }
     },

package/packages/bundled-features/src/auth-email-password/handlers/signup-request.write.ts

@@ -105,13 +105,13 @@ export function createSignupRequestHandler(opts: SignupRequestOptions) {
         // No email address here — this fires on every no-op request, PII
         // must not accumulate in logs just for the "was this toggled off"
         // signal a support ticket needs.
-        ctx.log?.info("signup-request skipped: self-registration disabled");
+        ctx.obs.log?.info("signup-request skipped: self-registration disabled");
         return { isSuccess: true, data: { kind: "no-op" } };
       }
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
           new InternalError({
-            message: "signup-request requires ctx.redis for the activation-token store",
+            message: "signup-request requires ctx.services.redis for the activation-token store",
           }),
         );
       }
@@ -125,10 +125,10 @@ export function createSignupRequestHandler(opts: SignupRequestOptions) {
       // resend without a fresh `handover` in the payload (the common case:
       // the visitor just retyped their email) must still carry the earlier
       // verified grant over to the new token instead of silently dropping it.
-      const priorBinding = await takeOverSignupHandoverForResend(ctx.redis, email);
+      const priorBinding = await takeOverSignupHandoverForResend(ctx.services.redis, email);
 
       const locale = resolveHandlerMailLocale(ctx, opts.locale);
-      const redis = ctx.redis;
+      const redis = ctx.services.redis;
 
       const issued = await issueSignupActivation({
         redis,
@@ -153,7 +153,7 @@ export function createSignupRequestHandler(opts: SignupRequestOptions) {
             const { entityType, token: grantToken } = event.payload.handover;
             const provider = findSignupHandoverProvider(ctx.registry);
             if (!provider) {
-              ctx.log?.warn(
+              ctx.obs.log?.warn(
                 "signup-request: handover payload present but no signupHandover provider mounted",
               );
             } else {
@@ -167,10 +167,14 @@ export function createSignupRequestHandler(opts: SignupRequestOptions) {
                 if (verified) {
                   binding = verified;
                 } else {
-                  ctx.log?.warn("signup-request: handover grant did not verify", { entityType });
+                  ctx.obs.log?.warn("signup-request: handover grant did not verify", {
+                    entityType,
+                  });
                 }
               } catch {
-                ctx.log?.warn("signup-request: handover grant verification threw", { entityType });
+                ctx.obs.log?.warn("signup-request: handover grant verification threw", {
+                  entityType,
+                });
               }
             }
           }

package/packages/bundled-features/src/auth-email-password/handlers/switch-tenant-mfa-gate.write.ts

@@ -43,10 +43,12 @@ export function createSwitchTenantMfaGateHandler(
       "Runs the MFA gate of the login for a tenant switch and answers with an MFA challenge, a setup requirement, or clearance.",
     handler: async (event, ctx) => {
       const { userId, tenantId } = event.payload;
-      const active = await ctx.resolveActiveMembership(userId, tenantId);
+      const active = await ctx.auth.resolveActiveMembership(userId, tenantId);
       if (active.kind === "rejected") return noMembership();
       const userRow = parseAuthUserRow(
-        await ctx.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, { id: userId }),
+        await ctx.dispatch.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, {
+          id: userId,
+        }),
       );
       const roles = buildSessionRoles(parseRoles(userRow?.roles ?? null), active.membership.roles);
       const mfaGate = await gateEnforceMfa(ctx, opts, userId, tenantId, roles);

package/packages/bundled-features/src/auth-email-password/handlers/token-request-handler.ts

@@ -111,7 +111,7 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
       grants: ["systemIdentity"],
       reason:
         "Anonymous requester has no session — looks up the target user by email via " +
-        "ctx.queryAs(SYSTEM, user:findForAuth) to mint the out-of-band token.",
+        "ctx.dispatch.queryAs(SYSTEM, user:findForAuth) to mint the out-of-band token.",
     },
     description: spec.description,
     handler: async (event, ctx) => {
@@ -128,7 +128,7 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
       const systemUser = createSystemUser(event.user.tenantId);
 
       const user = parseAuthUserRow(
-        await ctx.queryAs(systemUser, UserQueries.findForAuth, {
+        await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
           email: event.payload.email,
         }),
       );

package/packages/bundled-features/src/auth-email-password/handlers/verify-email.write.ts

@@ -32,7 +32,7 @@ export function createVerifyEmailHandler(opts: VerifyEmailOptions) {
       grants: ["systemIdentity"],
       reason:
         "Anonymous token holder has no session — runConfirmTokenFlow loads and updates the " +
-        "target user via ctx.writeAs(SYSTEM, user:update) to set emailVerified.",
+        "target user via ctx.dispatch.writeAs(SYSTEM, user:update) to set emailVerified.",
     },
     agent: { expose: false },
     handler: async (event, ctx) => {
@@ -49,7 +49,8 @@ export function createVerifyEmailHandler(opts: VerifyEmailOptions) {
 
       return runConfirmTokenFlow<VerifyEmailData>(ctx, verify.userId, verify.expiresAtMs, {
         purpose: "verify",
-        redisRequiredMessage: "email-verification requires ctx.redis to enforce token single-use",
+        redisRequiredMessage:
+          "email-verification requires ctx.services.redis to enforce token single-use",
         invalidToken: invalidVerificationToken,
         buildChanges: async () => ({ emailVerified: true }),
         successData: { kind: "verified" },

package/packages/bundled-features/src/auth-email-password/seeding.ts

@@ -20,10 +20,14 @@ import {
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createSystemUser,
+  type SessionUser,
+  SYSTEM_TENANT_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError } from "@cosmicdrift/kumiko-framework/errors";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
 import { hashPassword } from "../shared/index.ts";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
 import { type SeedTenantHooks, seedTenant, seedTenantMembership } from "../tenant/seeding.ts";
@@ -224,10 +228,10 @@ export async function seedAdmin(
   db: DbConnection,
   options: SeedAdminOptions,
 ): Promise<{ id: string }> {
-  const by = options.by ?? TestUsers.systemAdmin;
+  const byOption = options.by === undefined ? {} : { by: options.by };
 
   for (const m of options.memberships) {
-    await seedTenant(db, { id: m.tenantId, key: m.tenantKey, name: m.tenantName, by });
+    await seedTenant(db, { id: m.tenantId, key: m.tenantKey, name: m.tenantName, ...byOption });
   }
 
   const { id: userId } = await seedUserWithPassword(db, {
@@ -236,7 +240,7 @@ export async function seedAdmin(
     displayName: options.displayName,
     ...(options.globalRoles !== undefined && { roles: options.globalRoles }),
     ...(options.emailVerified !== undefined && { emailVerified: options.emailVerified }),
-    by,
+    ...byOption,
   });
 
   for (const m of options.memberships) {
@@ -244,7 +248,7 @@ export async function seedAdmin(
       userId,
       tenantId: m.tenantId,
       roles: m.roles,
-      by,
+      ...byOption,
     });
   }
 
@@ -372,7 +376,8 @@ export async function seedAdminGuarded(
   const existingId = await findExistingUserIdForEmail(db, kms, options.email);
   if (existingId === undefined) return seedAdmin(db, options);
 
-  const by = options.by ?? TestUsers.systemAdmin;
+  const byOption = options.by === undefined ? {} : { by: options.by };
+  const by = options.by ?? createSystemUser(SYSTEM_TENANT_ID);
   const existingRow = await fetchOne(db, userTable, { id: existingId });
   if (existingRow) {
     // Re-write the email so email_bidx is recomputed; without it the account
@@ -384,12 +389,12 @@ export async function seedAdminGuarded(
     }
   }
   for (const m of options.memberships) {
-    await seedTenant(db, { id: m.tenantId, key: m.tenantKey, name: m.tenantName, by });
+    await seedTenant(db, { id: m.tenantId, key: m.tenantKey, name: m.tenantName, ...byOption });
     await seedTenantMembership(db, {
       userId: existingId,
       tenantId: m.tenantId,
       roles: m.roles,
-      by,
+      ...byOption,
     });
   }
   return { id: existingId };

package/packages/bundled-features/src/auth-foundation/feature.ts

@@ -12,6 +12,7 @@
 
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { defineFeature, type Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { systemScopedRunner } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import {
   validateSessionStoreMultiplicity,
   validateTenantExistenceMultiplicity,
@@ -90,6 +91,14 @@ export function createAuthFoundationFeature() {
   );
 }
 
+// Providers run before any tenant or session exists (token verify, host to tenant), so their reads are cross-tenant by nature.
+function systemScopedDeps<T extends AuthProviderBuildDeps>(deps: T): T {
+  return {
+    ...deps,
+    db: systemScopedRunner(deps.db, "auth lookups run before a tenant is established"),
+  };
+}
+
 /**
  * Tries every registered tokenVerifier provider's shape against `rawToken`
  * in registration order and calls the first match's verifier. Returns null
@@ -104,7 +113,7 @@ export async function resolveTokenVerifier(
   for (const usage of usages) {
     if (!isAuthProviderPlugin(usage.options)) continue;
     if (!tokenShapeMatches(usage.options.shape, rawToken)) continue;
-    const verify = await usage.options.build(deps);
+    const verify = await usage.options.build(systemScopedDeps(deps));
     return verify(rawToken);
   }
   return null;
@@ -125,7 +134,7 @@ export async function resolveSessionStore(
       "[auth-foundation] no sessionStore provider registered — did the boot validator run?",
     );
   }
-  return usage.options.build(deps);
+  return usage.options.build(systemScopedDeps(deps));
 }
 
 export type ResolvedTenantResolver = {
@@ -144,7 +153,7 @@ export async function resolveTenantResolver(
       "[auth-foundation] tenantResolver provider registered without a valid TenantResolverProvider",
     );
   }
-  const resolve = await usage.options.build(deps);
+  const resolve = await usage.options.build(systemScopedDeps(deps));
   return { resolve, trust: usage.options.trust };
 }
 
@@ -159,5 +168,5 @@ export async function resolveTenantExistence(
       "[auth-foundation] tenantExistence provider registered without a valid TenantExistenceProvider",
     );
   }
-  return usage.options.build(deps);
+  return usage.options.build(systemScopedDeps(deps));
 }

package/packages/bundled-features/src/auth-mfa/handlers/disable.write.ts

@@ -45,20 +45,20 @@ export function createDisableHandler(opts: DisableOptions) {
       if (!row) return mfaNotEnabled();
 
       // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts
-      // without ctx.redis, verifyMfaFactor's TOTP-replay burn is skipped, and
+      // without ctx.services.redis, verifyMfaFactor's TOTP-replay burn is skipped, and
       // a code observed once (phishing proxy/shoulder-surfing) could be
       // replayed within the ±1-step window to disable MFA outright.
-      // "no ctx.redis means no one gets through MFA login" doesn't cover
+      // "no ctx.services.redis means no one gets through MFA login" doesn't cover
       // this route — it's session-authed, and JWTs issued before Redis was
       // unwired stay valid until they expire.
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
           new InternalError({
-            message: "disable (mfa) requires ctx.redis for TOTP replay protection",
+            message: "disable (mfa) requires ctx.services.redis for TOTP replay protection",
           }),
         );
       }
-      const replay = { redis: ctx.redis, userId: event.user.id };
+      const replay = { redis: ctx.services.redis, userId: event.user.id };
       const verify = await verifyMfaFactor(row, event.payload.code, replay);
       if (!verify.ok) return invalidTotpCode();
 

package/packages/bundled-features/src/auth-mfa/handlers/enable-confirm-preauth.write.ts

@@ -73,8 +73,8 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
     escapeHatch: {
       grants: ["systemIdentity", "unsafeRaw"],
       reason:
-        "Pre-auth MFA enrollment step has no session yet — re-checks status via ctx.queryAs(SYSTEM, " +
-        "user:findForAuth) and membership via ctx.resolveActiveMembership for the setup token's user. " +
+        "Pre-auth MFA enrollment step has no session yet — re-checks status via ctx.dispatch.queryAs(SYSTEM, " +
+        "user:findForAuth) and membership via ctx.auth.resolveActiveMembership for the setup token's user. " +
         "Also reads the MFA enrollment of the tenant named in the signed login/setup token, not the " +
         "guest dispatch tenant.",
     },
@@ -96,15 +96,15 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       // endpoint has NO gate before it (access: { roles: ["anonymous"] }, no JWT,
       // no prior challenge-token from a successful login) — its only secret
       // is a 6-digit TOTP code. Silently skipping the brute-force cap and
-      // single-use burn when ctx.redis is absent would let the setup token
+      // single-use burn when ctx.services.redis is absent would let the setup token
       // be guessed against unboundedly until its TTL expires. The route's
       // IP rate limiter is not a substitute: it's IP-scoped and resets on
       // every success.
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
           new InternalError({
             message:
-              "enable-confirm-preauth requires ctx.redis for the brute-force cap and single-use burn",
+              "enable-confirm-preauth requires ctx.services.redis for the brute-force cap and single-use burn",
           }),
         );
       }
@@ -112,7 +112,7 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       // Same guessing surface as /auth/mfa/verify (a short TOTP code) and
       // the same per-userId cap — deliberately shared counter, see
       // mfa-verify-attempts.ts.
-      const state = await getMfaVerifyLockoutState(ctx.redis, userId);
+      const state = await getMfaVerifyLockoutState(ctx.services.redis, userId);
       if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {
         const now = Date.now();
         if (state.lockedUntil > now) {
@@ -123,18 +123,28 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
 
       const secret = base32Decode(verify.payload.totpSecretBase32);
       if (verifyTotp(secret, event.payload.code) === false) {
-        await recordFailedMfaVerifyAttempt(ctx.redis, userId, maxAttempts, lockoutMinutes);
+        await recordFailedMfaVerifyAttempt(ctx.services.redis, userId, maxAttempts, lockoutMinutes);
         return invalidTotpCode();
       }
 
       // Burn the setup token on the first successful confirm — same
       // single-use guarantee as enable-confirm.write.ts.
-      const burnResult = await burnToken(ctx.redis, "mfa-setup", userId, verify.expiresAtMs);
+      const burnResult = await burnToken(
+        ctx.services.redis,
+        "mfa-setup",
+        userId,
+        verify.expiresAtMs,
+      );
       if (burnResult === "already-used") return invalidSetupToken();
 
       // "system" mode: no session exists yet, tenantId comes from the
       // verified token, mirroring enable-start-preauth.write.ts.
-      const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
+      const scopedDb = createTenantDb({
+        db: ctx.db.unsafeRaw(),
+        tenantId,
+        mode: "system",
+        reason: "pre-auth MFA setup has no session, the tenant comes from the verified setup token",
+      });
       const scopedUser: SessionUser = { id: userId, tenantId, roles: ["User"] };
       const existing = await findUserMfaRow(scopedDb, scopedUser);
       if (existing) return mfaAlreadyEnabled();
@@ -154,7 +164,7 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       // existing userId-unique-constraint backstop between the
       // `existing` check above and executor.create() below.
       const systemUser = createSystemUser(tenantId, ["SystemAdmin"]);
-      const userRow = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
+      const userRow = (await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
         id: userId,
       })) as {
         roles?: string | null;
@@ -174,7 +184,7 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
 
       const globalRoles = parseRoles(userRow?.roles ?? null);
 
-      const active = await ctx.resolveActiveMembership(userId, tenantId);
+      const active = await ctx.auth.resolveActiveMembership(userId, tenantId);
       if (active.kind === "rejected") return invalidSetupToken();
 
       const result = await executor.create(
@@ -190,8 +200,8 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       );
       if (!result.isSuccess) return result;
 
-      // ctx.redis is guaranteed by the fail-closed check above.
-      await clearMfaVerifyAttempts(ctx.redis, userId);
+      // ctx.services.redis is guaranteed by the fail-closed check above.
+      await clearMfaVerifyAttempts(ctx.services.redis, userId);
 
       // Re-derive the full session the way verify.write.ts does — the
       // setupToken only proves "password + new TOTP secret", not roles;
@@ -214,7 +224,7 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
         ...sessionTimezoneField(userRow?.timezone),
         ...sessionLocaleField(userRow?.locale),
       };
-      const claims = await ctx.resolveAuthClaims(baseSession);
+      const claims = await ctx.auth.resolveClaims(baseSession);
       const session: SessionUser =
         Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;
 

package/packages/bundled-features/src/auth-mfa/handlers/enable-confirm.write.ts

@@ -63,10 +63,11 @@ export function createEnableConfirmHandler(opts: EnableConfirmOptions) {
       // second seeing invalidSetupToken(). Checked before the TOTP verify
       // for the same reason the other two handlers check it early: fail
       // closed before doing any of the guarded work, not partway through.
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
           new InternalError({
-            message: "enable-confirm requires ctx.redis for the single-use setup-token burn",
+            message:
+              "enable-confirm requires ctx.services.redis for the single-use setup-token burn",
           }),
         );
       }
@@ -86,7 +87,12 @@ export function createEnableConfirmHandler(opts: EnableConfirmOptions) {
       // concurrent mfa_already_enabled() write) is meant to leave the burn
       // standing. Add unburnToken here if create-failure retries turn out
       // to matter.
-      const burnResult = await burnToken(ctx.redis, "mfa-setup", event.user.id, verify.expiresAtMs);
+      const burnResult = await burnToken(
+        ctx.services.redis,
+        "mfa-setup",
+        event.user.id,
+        verify.expiresAtMs,
+      );
       if (burnResult === "already-used") return invalidSetupToken();
 
       const existing = await findUserMfaRow(ctx.db, event.user);

package/packages/bundled-features/src/auth-mfa/handlers/enable-start-preauth.write.ts

@@ -62,7 +62,12 @@ export function createEnableStartPreauthHandler(opts: EnableStartPreauthOptions)
       // "system" mode: the guest dispatch identity's own tenantId is
       // meaningless here — the preauthSetupToken is the source of truth
       // for which tenant's row to read, mirroring verify.write.ts.
-      const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
+      const scopedDb = createTenantDb({
+        db: ctx.db.unsafeRaw(),
+        tenantId,
+        mode: "system",
+        reason: "pre-auth MFA setup has no session, the tenant comes from the verified setup token",
+      });
       const scopedUser: SessionUser = { id: userId, tenantId, roles: ["User"] };
       const existing = await findUserMfaRow(scopedDb, scopedUser);
       if (existing) return mfaAlreadyEnabled();

package/packages/bundled-features/src/auth-mfa/handlers/enable-start.write.ts

@@ -61,7 +61,9 @@ export function createEnableStartHandler(opts: EnableStartOptions) {
       if (!accountLabel) {
         // The declarative secretMint screen has no client component left to
         // read the session email off — derive the otpauth label server-side.
-        accountLabel = readableAccountLabel(await ctx.queryAs(event.user, UserQueries.me, {}));
+        accountLabel = readableAccountLabel(
+          await ctx.dispatch.queryAs(event.user, UserQueries.me, {}),
+        );
       }
 
       const secret = generateTotpSecret();

package/packages/bundled-features/src/auth-mfa/handlers/reencrypt.job.ts

@@ -88,13 +88,13 @@ export async function mfaReencryptJob(
   // hoisted function declarations below capture this — pin the narrowed
   // type explicitly so TS keeps it inside the closures.
   const cipher: EnvelopeCipher = maybeCipher;
-  if (!ctx.masterKeyProvider) {
+  if (!ctx.services.masterKeyProvider) {
     throw new InternalError({
       message:
-        "[auth-mfa:reencrypt] ctx.masterKeyProvider missing — wire it via extraContext.masterKeyProvider at boot.",
+        "[auth-mfa:reencrypt] ctx.services.masterKeyProvider missing — wire it via extraContext.masterKeyProvider at boot.",
     });
   }
-  const provider = ctx.masterKeyProvider;
+  const provider = ctx.services.masterKeyProvider;
   // Undefined = per-subject crypto-shredding isn't configured for this app —
   // both fields are then plain envelope strings, no PII layer to peel.
   const piiKms = configuredPiiSubjectKms();
@@ -109,7 +109,12 @@ export async function mfaReencryptJob(
   function tdbFor(tenantId: TenantId): TenantDb {
     let existing = tdbCache.get(tenantId);
     if (!existing) {
-      existing = createTenantDb({ db, tenantId, mode: "system" });
+      existing = createTenantDb({
+        db,
+        tenantId,
+        mode: "system",
+        reason: "MFA key re-encryption job rewrites enrollments of every tenant",
+      });
       tdbCache.set(tenantId, existing);
     }
     return existing;
@@ -158,7 +163,7 @@ export async function mfaReencryptJob(
     const totpClass = classifyStoredEnvelope(envelopeValues.totpSecret, targetVersion);
     const recoveryClass = classifyStoredEnvelope(envelopeValues.recoveryCodes, targetVersion);
     if (totpClass === "unrecognized" || recoveryClass === "unrecognized") {
-      ctx.log?.warn?.(
+      ctx.obs.log?.warn?.(
         `[auth-mfa:reencrypt] row ${row.id} has a field that is not a current-cipher envelope, not re-encryptable`,
       );
       return "failed";
@@ -193,7 +198,7 @@ export async function mfaReencryptJob(
     // the row now holds a fresh write, already fine.
     if (!result.isSuccess) {
       if (result.error.code === "version_conflict") return "skipped";
-      ctx.log?.warn?.(`[auth-mfa:reencrypt] executor rejected row ${row.id}`, {
+      ctx.obs.log?.warn?.(`[auth-mfa:reencrypt] executor rejected row ${row.id}`, {
         code: result.error.code,
       });
       return "failed";
@@ -206,9 +211,9 @@ export async function mfaReencryptJob(
     migrateRow,
     maxFailures,
     deadlineAt: deadline,
-    signal: ctx.signal,
+    signal: ctx.lifecycle.signal,
     onRowError: (row, err) => {
-      ctx.log?.warn?.(`[auth-mfa:reencrypt] failed to re-encrypt row ${row.id}`, { err });
+      ctx.obs.log?.warn?.(`[auth-mfa:reencrypt] failed to re-encrypt row ${row.id}`, { err });
     },
   });
 
@@ -219,5 +224,5 @@ export async function mfaReencryptJob(
     batchesProcessed: outcome.batchesProcessed,
     stoppedReason: outcome.stoppedReason,
   };
-  ctx.log?.info?.(`[auth-mfa:reencrypt] complete: ${JSON.stringify(result)}`);
+  ctx.obs.log?.info?.(`[auth-mfa:reencrypt] complete: ${JSON.stringify(result)}`);
 }

package/packages/bundled-features/src/auth-mfa/handlers/regenerate-recovery.write.ts

@@ -48,18 +48,19 @@ export function createRegenerateRecoveryHandler(opts: RegenerateRecoveryOptions)
       // afterward.
       //
       // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts:
-      // without ctx.redis, verifyMfaFactor's TOTP-replay burn is skipped,
+      // without ctx.services.redis, verifyMfaFactor's TOTP-replay burn is skipped,
       // letting an observed code be replayed within the ±1-step window to
       // regenerate (and thus invalidate) recovery codes — a session-authed
       // route, so pre-unwiring JWTs stay a valid attack path.
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
           new InternalError({
-            message: "regenerate-recovery (mfa) requires ctx.redis for TOTP replay protection",
+            message:
+              "regenerate-recovery (mfa) requires ctx.services.redis for TOTP replay protection",
           }),
         );
       }
-      const replay = { redis: ctx.redis, userId: event.user.id };
+      const replay = { redis: ctx.services.redis, userId: event.user.id };
       const verify = await verifyMfaFactor(row, event.payload.code, replay);
       if (!verify.ok) return invalidTotpCode();