@cosmicdrift/kumiko-samples 0.389.0 → 0.390.1

package/packages/bundled-features/src/auth-mfa/handlers/verify.write.ts

@@ -50,8 +50,8 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
     escapeHatch: {
       grants: ["systemIdentity", "unsafeRaw"],
       reason:
-        "Pre-auth MFA step has no session yet — re-derives it via ctx.queryAs(SYSTEM, " +
-        "user:findForAuth) and ctx.resolveActiveMembership for the user the challenge token names. " +
+        "Pre-auth MFA step has no session yet — re-derives it via ctx.dispatch.queryAs(SYSTEM, " +
+        "user:findForAuth) and ctx.auth.resolveActiveMembership for the user the challenge token names. " +
         "Also reads the MFA enrollment of the tenant named in the signed login/setup token, not the " +
         "guest dispatch tenant.",
     },
@@ -71,14 +71,15 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // this route sits behind a challenge token from a successful login,
       // but its own secret is still just a short TOTP/recovery code —
       // silently skipping the brute-force cap and single-use burn when
-      // ctx.redis is absent would let a stolen challenge token be guessed
+      // ctx.services.redis is absent would let a stolen challenge token be guessed
       // against unboundedly, and let a recovery code be replayed via a
       // reissued challenge (mfa-verify-attempts.ts's counter is deliberately
       // NOT reset by reissuance, precisely to survive this).
-      if (!ctx.redis) {
+      if (!ctx.services.redis) {
         return writeFailure(
           new InternalError({
-            message: "verify (mfa) requires ctx.redis for the brute-force cap and single-use burn",
+            message:
+              "verify (mfa) requires ctx.services.redis for the brute-force cap and single-use burn",
           }),
         );
       }
@@ -86,7 +87,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // Per-account brute-force cap — survives challenge-token reissuance
       // on purpose (see mfa-verify-attempts.ts header). Checked BEFORE the
       // TOTP/recovery verify so a locked account can't be guessed against.
-      const state = await getMfaVerifyLockoutState(ctx.redis, userId);
+      const state = await getMfaVerifyLockoutState(ctx.services.redis, userId);
       if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {
         const now = Date.now();
         if (state.lockedUntil > now) {
@@ -98,7 +99,12 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // "system" mode: this handler runs with a guest identity whose own
       // tenantId is meaningless here — the challenge token is the source
       // of truth for which tenant's row to read.
-      const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
+      const scopedDb = createTenantDb({
+        db: ctx.db.unsafeRaw(),
+        tenantId,
+        mode: "system",
+        reason: "MFA challenge has no session, the tenant comes from the verified challenge token",
+      });
       const scopedUser: SessionUser = { id: userId, tenantId, roles: ["User"] };
       const row = await findUserMfaRow(scopedDb, scopedUser);
       // MFA got disabled between login and verify (race, or a stale
@@ -106,10 +112,10 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // bad code, no detail leak about account state.
       if (!row) return invalidChallengeToken();
 
-      const replay = { redis: ctx.redis, userId };
+      const replay = { redis: ctx.services.redis, userId };
       const verify = await verifyMfaFactor(row, event.payload.code, replay);
       if (!verify.ok) {
-        await recordFailedMfaVerifyAttempt(ctx.redis, userId, maxAttempts, lockoutMinutes);
+        await recordFailedMfaVerifyAttempt(ctx.services.redis, userId, maxAttempts, lockoutMinutes);
         return invalidTotpCode();
       }
 
@@ -121,7 +127,12 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // is reached, so this burn only needs to guard a DIFFERENT code
       // (recovery, or a still-valid-but-not-yet-burned TOTP step) reused
       // against the same challenge token.
-      const burnResult = await burnToken(ctx.redis, "mfa-challenge", userId, verified.expiresAtMs);
+      const burnResult = await burnToken(
+        ctx.services.redis,
+        "mfa-challenge",
+        userId,
+        verified.expiresAtMs,
+      );
       if (burnResult === "already-used") return invalidChallengeToken();
 
       // Recovery-code use consumes the code — persist the reduced hash-list
@@ -140,13 +151,13 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
         if (!updateResult.isSuccess) return updateResult;
       }
 
-      await clearMfaVerifyAttempts(ctx.redis, userId);
+      await clearMfaVerifyAttempts(ctx.services.redis, userId);
 
       // Re-derive the full session the way login.write.ts would have, for
       // the SAME tenant the challenge token already committed to (no
       // "pick a tenant" step here — that already happened at login time).
       const systemUser = createSystemUser(tenantId, ["SystemAdmin"]);
-      const userRow = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
+      const userRow = (await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
         id: userId,
       })) as {
         roles?: string | null;
@@ -174,7 +185,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
 
       // Membership revoked or principal blocked between login and verify —
       // mirror login.write.ts's refusal instead of falling back to globalRoles only.
-      const active = await ctx.resolveActiveMembership(userId, tenantId);
+      const active = await ctx.auth.resolveActiveMembership(userId, tenantId);
       if (active.kind === "rejected") return invalidChallengeToken();
       // buildSessionRoles calls stripForbiddenMembershipRoles to strip reserved
       // roles from the membership portion (globalRoles keeps SystemAdmin) —
@@ -188,7 +199,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
         ...sessionTimezoneField(userRow?.timezone),
         ...sessionLocaleField(userRow?.locale),
       };
-      const claims = await ctx.resolveAuthClaims(baseSession);
+      const claims = await ctx.auth.resolveClaims(baseSession);
       const session: SessionUser =
         Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;
 

package/packages/bundled-features/src/auth-mfa/mfa-code-verifier.ts

@@ -29,13 +29,19 @@ export function createMfaCodeVerifier(): MfaCodeVerifier {
       reason:
         "reads the MFA enrollment of the user being re-authenticated on the caller's handler context; the calling handler declares its own escapeHatch",
     });
-    const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
+    const scopedDb = createTenantDb({
+      db: ctx.db.unsafeRaw(),
+      tenantId,
+      mode: "system",
+      reason:
+        "re-authentication reads the MFA enrollment of the user's own tenant, not the handler's dispatch tenant",
+    });
     const row = await findUserMfaRow(scopedDb, { id: userId, tenantId, roles: [] });
     if (!row) return { enrolled: false, ok: false };
-    // Fail closed without ctx.redis, matching disable.write.ts/verify.write.ts —
+    // Fail closed without ctx.services.redis, matching disable.write.ts/verify.write.ts —
     // skipping the TOTP-replay burn would let an observed code be replayed.
-    if (!code || !ctx.redis) return { enrolled: true, ok: false };
-    const verify = await verifyMfaFactor(row, code, { redis: ctx.redis, userId });
+    if (!code || !ctx.services.redis) return { enrolled: true, ok: false };
+    const verify = await verifyMfaFactor(row, code, { redis: ctx.services.redis, userId });
     return { enrolled: true, ok: verify.ok && verify.method === "totp" };
   };
 }

package/packages/bundled-features/src/auth-mfa/mfa-status-checker.ts

@@ -48,7 +48,13 @@ export function createMfaStatusChecker(opts: {
       reason:
         "reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant, on the caller's handler context; the calling handler declares its own escapeHatch",
     });
-    const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
+    const scopedDb = createTenantDb({
+      db: ctx.db.unsafeRaw(),
+      tenantId,
+      mode: "system",
+      reason:
+        "login/setup token names the tenant to check, the guest dispatch tenant is meaningless",
+    });
     const scopedUser: SessionUser = { id: userId, tenantId, roles: ["User"] };
     const row = await findUserMfaRow(scopedDb, scopedUser);
 
@@ -65,12 +71,12 @@ export function createMfaStatusChecker(opts: {
     }
 
     // ctx.config is bound to the CALLING user's tenant (the anonymous
-    // identity's tenant for login) — wrong tenant here. ctx.configResolver takes tenantId
+    // identity's tenant for login) — wrong tenant here. ctx.services.configResolver takes tenantId
     // explicitly, which is what a pre-session check against the LOGGING-IN
     // user's tenant needs.
     // @cast-boundary engine-payload — "select" config values are validated
     // against the declared `options` at write-time by the config feature.
-    const policy = ((await ctx.configResolver?.get(
+    const policy = ((await ctx.services.configResolver?.get(
       mfaRequiredConfigHandle.name,
       mfaRequiredConfigKey(opts.requiredPolicy),
       tenantId,

package/packages/bundled-features/src/auth-mfa/verify-factor.ts

@@ -21,7 +21,7 @@ export type MfaFactorVerifyResult =
 // must not verify again within its ±1-step window — otherwise a code an
 // attacker observed once, via phishing proxy or shoulder-surfing, stays
 // usable for ~90s of parallel logins). Omitted where a caller has no
-// ctx.redis available; the code-verify itself still works, just without
+// ctx.services.redis available; the code-verify itself still works, just without
 // replay protection for that call.
 export async function verifyMfaFactor(
   row: UserMfaRow,

package/packages/bundled-features/src/billing-foundation/billing-info-query.ts

@@ -68,8 +68,8 @@ export function createBillingInfoQueryConfig<TTier extends string>(
       const billingLive = ctx.config
         ? (await ctx.config(STRIPE_BILLING_LIVE_CONFIG_QN)) === true
         : false;
-      const apiKeySet = ctx.secrets
-        ? await ctx.secrets.has(SYSTEM_TENANT_ID, STRIPE_API_KEY_CONFIG_QN)
+      const apiKeySet = ctx.services.secrets
+        ? await ctx.services.secrets.has(SYSTEM_TENANT_ID, STRIPE_API_KEY_CONFIG_QN)
         : false;
 
       const sub = await ctx.db.fetchOne<{

package/packages/bundled-features/src/billing-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Revoking one termination no longer resumes a subscription another termination still cancels",
+    "detail": "A revocation only resumes the subscription at the provider when no other recorded termination still cancels it. Recording and revoking a termination now run one at a time per tenant, so provider calls can no longer interleave with the event stream."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/packages/bundled-features/src/billing-foundation/consumer-protection/consent-gate.ts

@@ -172,7 +172,7 @@ export async function recordConsent(
   };
   const tenantId = ctx.user.tenantId;
   const isSubscription = prepared.mode === "subscription";
-  await ctx.unsafeAppendEvent({
+  await ctx.events.unsafeAppend({
     aggregateId: isSubscription ? subscriptionAggregateId(tenantId) : paymentAggregateId(tenantId),
     aggregateType: isSubscription ? SUBSCRIPTION_AGGREGATE_TYPE : PAYMENT_AGGREGATE_TYPE,
     type: CHECKOUT_CONSENT_RECORDED_EVENT_QN,

package/packages/bundled-features/src/billing-foundation/consumer-protection/issue-confirmation.ts

@@ -102,7 +102,7 @@ export function createIssueContractConfirmationHandler(
         });
       }
 
-      const stream = await ctx.fetchForWriting({
+      const stream = await ctx.events.fetchForWriting({
         aggregateId: payload.sourceAggregateId,
         aggregateType: isSubscription ? SUBSCRIPTION_AGGREGATE_TYPE : PAYMENT_AGGREGATE_TYPE,
       });
@@ -119,7 +119,7 @@ export function createIssueContractConfirmationHandler(
         }
       }
       if (!consentEvent || !consent) {
-        ctx.log?.warn(
+        ctx.obs.log?.warn(
           `[billing-foundation:issue-contract-confirmation] no recorded consent ${payload.consentId} on the stream; no mail sent`,
         );
         return {
@@ -150,7 +150,7 @@ export function createIssueContractConfirmationHandler(
       // Everything that can fail runs before the append, so a failed run
       // leaves no marker behind and the job retry starts clean.
       const recipient = recipientRowSchema.safeParse(
-        await ctx.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, {
+        await ctx.dispatch.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, {
           id: consent.actorUserId,
         }),
       );
@@ -162,7 +162,7 @@ export function createIssueContractConfirmationHandler(
             )
           : null;
       if (!recipient.success || recipientEmail === null) {
-        ctx.log?.warn(
+        ctx.obs.log?.warn(
           `[billing-foundation:issue-contract-confirmation] recipient of consent ${payload.consentId} not found; no mail sent`,
         );
         return {
@@ -182,7 +182,7 @@ export function createIssueContractConfirmationHandler(
         locale,
       });
       if (terms.version !== consent.termsTemplateVersion) {
-        ctx.log?.warn(
+        ctx.obs.log?.warn(
           `[billing-foundation:issue-contract-confirmation] terms text block changed since consent ${payload.consentId} (version ${consent.termsTemplateVersion} -> ${terms.version}); the mail carries the current text`,
         );
       }

package/packages/bundled-features/src/billing-foundation/consumer-protection/register-consent.ts

@@ -76,13 +76,16 @@ export function registerConsumerProtection(
         // user), never from payload data.
         const tenantId = ctx.systemUser.tenantId;
         const currentPeriodEndIso = payload["currentPeriodEndIso"];
-        const result = await ctx.write(SubscriptionFoundationHandlers.issueContractConfirmation, {
-          consentId,
-          sourceAggregateId: isSubscriptionEvent
-            ? subscriptionAggregateId(tenantId)
-            : paymentAggregateId(tenantId),
-          ...(typeof currentPeriodEndIso === "string" && { currentPeriodEndIso }),
-        });
+        const result = await ctx.dispatch.write(
+          SubscriptionFoundationHandlers.issueContractConfirmation,
+          {
+            consentId,
+            sourceAggregateId: isSubscriptionEvent
+              ? subscriptionAggregateId(tenantId)
+              : paymentAggregateId(tenantId),
+            ...(typeof currentPeriodEndIso === "string" && { currentPeriodEndIso }),
+          },
+        );
         if (!result.isSuccess) {
           throw new Error(
             `billing-foundation:${trigger.jobName}: issue-contract-confirmation failed: ${JSON.stringify(result.error)}`,

package/packages/bundled-features/src/billing-foundation/consumer-protection/register-termination.ts

@@ -80,18 +80,21 @@ export function registerContractTermination(
       const declared = contractTerminationDeclaredPayloadSchema.safeParse(payload);
       // skip: trigger event carries no usable declaration
       if (!declared.success) return;
-      const result = await ctx.write(SubscriptionFoundationHandlers.recordContractTermination, {
-        requestId: declared.data.requestId,
-        declarationType: declared.data.declarationType,
-        terminationKind: declared.data.terminationKind,
-        channel: "public",
-        when:
-          declared.data.declarationType === "withdrawal"
-            ? "none"
-            : SubscriptionCancelTimings.periodEnd,
-        receivedAtIso: declared.data.receivedAtIso,
-        locale: declared.data.locale,
-      });
+      const result = await ctx.dispatch.write(
+        SubscriptionFoundationHandlers.recordContractTermination,
+        {
+          requestId: declared.data.requestId,
+          declarationType: declared.data.declarationType,
+          terminationKind: declared.data.terminationKind,
+          channel: "public",
+          when:
+            declared.data.declarationType === "withdrawal"
+              ? "none"
+              : SubscriptionCancelTimings.periodEnd,
+          receivedAtIso: declared.data.receivedAtIso,
+          locale: declared.data.locale,
+        },
+      );
       if (!result.isSuccess) {
         throw new Error(
           `billing-foundation:cancel-on-public-termination-declared: record-contract-termination failed: ${JSON.stringify(result.error)}`,

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-open-cancels.ts

@@ -0,0 +1,22 @@
+import {
+  CONTRACT_TERMINATION_REQUESTED_EVENT_QN,
+  contractTerminationRequestedPayloadSchema,
+} from "../events.ts";
+import { hasRevocation } from "./termination-record.ts";
+
+// A revoked declaration must not resume a subscription another declaration still cancels at the provider.
+export function hasOtherOpenProviderCancel(
+  events: readonly { type: string; payload: unknown }[],
+  requestId: string,
+): boolean {
+  return events.some((e) => {
+    if (e.type !== CONTRACT_TERMINATION_REQUESTED_EVENT_QN) return false;
+    const recorded = contractTerminationRequestedPayloadSchema.safeParse(e.payload).data;
+    return (
+      recorded !== undefined &&
+      recorded.requestId !== requestId &&
+      recorded.providerCancel !== "none" &&
+      !hasRevocation(events, recorded.requestId)
+    );
+  });
+}

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-provider-lock.ts

@@ -0,0 +1,4 @@
+// pg_advisory_xact_lock namespace (int4): 'btpl' as ASCII, disjoint from the other fixed advisory-lock keys.
+export const TERMINATION_PROVIDER_LOCK_NAMESPACE = 0x6274706c;
+
+export const TERMINATION_PROVIDER_LOCK_KEY = "subscription";

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-receipt-limit.ts

@@ -24,22 +24,22 @@ export async function mayMailReceipt(
   email: string,
 ): Promise<ReceiptMailVerdict> {
   // skip: no rate limiter wired, nothing to count against
-  if (!ctx.rateLimit) return "allowed";
+  if (!ctx.services.rateLimit) return "allowed";
   try {
     const bucketKey = receiptBucketKey(ctx, email);
     if (bucketKey === undefined) {
-      ctx.log?.warn(
+      ctx.obs.log?.warn(
         "[billing-foundation:termination] no rate-limit digest available, receipt mail withheld",
       );
       return "unavailable";
     }
-    const decision = await ctx.rateLimit.check(bucketKey, {
+    const decision = await ctx.services.rateLimit.check(bucketKey, {
       limit: RECEIPT_MAILS_PER_RECIPIENT,
       windowSeconds: RECEIPT_WINDOW_SECONDS,
     });
     return decision.allowed ? "allowed" : "limited";
   } catch (error) {
-    ctx.log?.warn(
+    ctx.obs.log?.warn(
       `[billing-foundation:termination] receipt rate limiter failed: ${error instanceof Error ? error.message : String(error)}`,
     );
     return "unavailable";

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-record.ts

@@ -39,6 +39,10 @@ import {
   FALLBACK_CONSENT_LOCALE,
 } from "../web/consumer-protection/consent-locale.ts";
 import { notifyOperator } from "./termination-notify.ts";
+import {
+  TERMINATION_PROVIDER_LOCK_KEY,
+  TERMINATION_PROVIDER_LOCK_NAMESPACE,
+} from "./termination-provider-lock.ts";
 import type { OperatorNoticeReason } from "./termination-texts.ts";
 import { isWithinWithdrawalPeriod } from "./withdrawal-period.ts";
 
@@ -141,7 +145,7 @@ async function cancelAtProvider(
       when,
     });
   } catch (error) {
-    ctx.log?.warn(
+    ctx.obs.log?.warn(
       `[billing-foundation:record-contract-termination] provider cancel failed for tenant ${tenantId}: ${error instanceof Error ? error.message : String(error)}`,
     );
     return { providerCancel: "none", effectiveAtIso: null, noticeReason: "provider_error" };
@@ -165,7 +169,7 @@ export function createDeclareContractTerminationHandler(): WriteHandlerDef {
     handler: async (event, ctx) => {
       // @cast-boundary engine-payload — dispatcher-zod-validated payload
       const payload = event.payload as z.infer<typeof declareContractTerminationSchema>;
-      const stream = await ctx.fetchForWriting({
+      const stream = await ctx.events.fetchForWriting({
         aggregateId: subscriptionAggregateId(event.user.tenantId),
         aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
       });
@@ -189,38 +193,6 @@ function revokedRecordResult(receivedAtIso: string) {
   };
 }
 
-// A revocation that landed during the provider cancel found nothing to take back yet.
-async function takeBackLateRevokedCancel(
-  ctx: HandlerContext,
-  consumerProtection: ConsumerProtectionOptions,
-  args: {
-    readonly payload: z.infer<typeof recordContractTerminationSchema>;
-    readonly tenantId: string;
-    readonly receivedAtIso: string;
-    readonly providerCancel: ProviderCancelOutcome;
-  },
-): Promise<void> {
-  const { payload, tenantId, receivedAtIso, providerCancel } = args;
-  // skip: nothing was cancelled at the provider, nothing to resume
-  if (providerCancel !== "period-end") return;
-  const reasons = await resumeAtProvider(ctx, await getSubscriptionForTenant(ctx, tenantId));
-  // skip: resumed cleanly, the revocation notice already tells the operator
-  if (reasons.length === 0) return;
-  await notifyOperator(ctx, consumerProtection, {
-    locale: payload.locale ?? FALLBACK_CONSENT_LOCALE,
-    requestId: payload.requestId,
-    receivedAtIso,
-    channel: "public",
-    declaration: {
-      declarationType: payload.declarationType,
-      terminationKind: payload.terminationKind,
-    },
-    reasons,
-    tenantId,
-    providerCancel,
-  });
-}
-
 export function createRecordContractTerminationHandler(
   options: ResolvedBillingFoundationOptions,
   consumerProtection: ConsumerProtectionOptions,
@@ -234,6 +206,11 @@ export function createRecordContractTerminationHandler(
       // @cast-boundary engine-payload — dispatcher-zod-validated payload
       const payload = event.payload as z.infer<typeof recordContractTerminationSchema>;
       const tenantId = event.user.tenantId;
+      // The provider cancel/resume and the stream append must not interleave across declarations of the same subscription.
+      await ctx.db.advisoryXactLock(
+        TERMINATION_PROVIDER_LOCK_NAMESPACE,
+        TERMINATION_PROVIDER_LOCK_KEY,
+      );
       if (payload.channel === "public" && payload.when === SubscriptionCancelTimings.immediately) {
         throw new UnprocessableError("immediate_cancel_not_allowed", {
           message:
@@ -242,7 +219,7 @@ export function createRecordContractTerminationHandler(
       }
 
       const receivedAtIso = payload.receivedAtIso ?? options.now().toString();
-      const stream = await ctx.fetchForWriting({
+      const stream = await ctx.events.fetchForWriting({
         aggregateId: subscriptionAggregateId(tenantId),
         aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
       });
@@ -277,30 +254,12 @@ export function createRecordContractTerminationHandler(
         effectiveAtIso,
         providerCancel,
       };
-      // Re-fetch after the external call: a webhook appended meanwhile would
-      // otherwise fail the append on a stale expectedVersion although the
-      // provider already cancelled.
-      const streamAfterProviderCall = await ctx.fetchForWriting({
+      // Re-fetch after the external call: webhooks append to this stream without the lock, so a
+      // stale expectedVersion would fail the append although the provider already cancelled.
+      const streamAfterProviderCall = await ctx.events.fetchForWriting({
         aggregateId: subscriptionAggregateId(tenantId),
         aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
       });
-      // A concurrent run with the same requestId may have recorded while we were
-      // at the provider; a second append would duplicate the event and the notice.
-      const recordedMeanwhile = findRecordedTermination(
-        streamAfterProviderCall.events,
-        payload.requestId,
-      );
-      if (recordedMeanwhile) return recordedTerminationResult(recordedMeanwhile);
-      // A revocation that landed during the provider call found no cancel to take back.
-      if (hasRevocation(streamAfterProviderCall.events, payload.requestId)) {
-        await takeBackLateRevokedCancel(ctx, consumerProtection, {
-          payload,
-          tenantId,
-          receivedAtIso,
-          providerCancel,
-        });
-        return revokedRecordResult(receivedAtIso);
-      }
       await streamAfterProviderCall.appendOne({
         type: CONTRACT_TERMINATION_REQUESTED_EVENT_QN,
         payload: recorded,
@@ -389,7 +348,7 @@ export async function resumeAtProvider(
       providerSubscriptionId: subscription.providerSubscriptionId,
     });
   } catch (error) {
-    ctx.log?.warn(
+    ctx.obs.log?.warn(
       `[billing-foundation:revoke-contract-termination] provider resume failed: ${error instanceof Error ? error.message : String(error)}`,
     );
     return ["revocation_resume_failed"];
@@ -414,7 +373,7 @@ export function createRecordUnmatchedContractTerminationHandler(): WriteHandlerD
     handler: async (event, ctx) => {
       // @cast-boundary engine-payload — dispatcher-zod-validated payload
       const payload = event.payload as z.infer<typeof recordUnmatchedContractTerminationSchema>;
-      const stream = await ctx.fetchForWriting({
+      const stream = await ctx.events.fetchForWriting({
         aggregateId: terminationUnmatchedAggregateId(payload.requestId),
         aggregateType: CONTRACT_TERMINATION_UNMATCHED_AGGREGATE_TYPE,
       });

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-request.ts

@@ -160,11 +160,13 @@ async function findTerminableTenantIds(
       "anonymous declarant has no session — finds the contract by email via user:find-for-auth and tenant:memberships as a system user; the calling handler declares its own escapeHatch",
   });
   const user = authUserRowSchema.safeParse(
-    await ctx.queryAs(createSystemUser(requestTenantId), UserQueries.findForAuth, { email }),
+    await ctx.dispatch.queryAs(createSystemUser(requestTenantId), UserQueries.findForAuth, {
+      email,
+    }),
   );
   if (!user.success || user.data.isDeleted === true) return [];
   const memberships = membershipRowsSchema.safeParse(
-    await ctx.queryAs(createSystemUser(requestTenantId), TenantQueries.memberships, {
+    await ctx.dispatch.queryAs(createSystemUser(requestTenantId), TenantQueries.memberships, {
       userId: user.data.id,
     }),
   );
@@ -180,7 +182,7 @@ async function findTerminableTenantIds(
   const terminable: string[] = [];
   for (const tenantId of adminTenantIds) {
     const probe = terminableResultSchema.safeParse(
-      await ctx.queryAs(
+      await ctx.dispatch.queryAs(
         createSystemUser(tenantId),
         SubscriptionFoundationQueries.terminableSubscription,
         {},
@@ -205,7 +207,7 @@ export function createRequestContractTerminationHandler(
     ...(consumerProtection.terminationScope === "platform" && { tenantlessAnonymous: true }),
     escapeHatch: {
       reason:
-        "Anonymous declarant has no session — finds the contract by email via ctx.queryAs(system, user:find-for-auth) and tenant:memberships; the tenant written to comes only from those lookups.",
+        "Anonymous declarant has no session — finds the contract by email via ctx.dispatch.queryAs(system, user:find-for-auth) and tenant:memberships; the tenant written to comes only from those lookups.",
     },
     handler: async (event, ctx) => {
       // @cast-boundary engine-payload — dispatcher-zod-validated payload
@@ -228,7 +230,7 @@ export function createRequestContractTerminationHandler(
       if (candidates.length === 1 && onlyCandidate !== undefined) {
         matchedTenantId = onlyCandidate;
         const revocation = createRevocationToken();
-        const declared = await ctx.writeAs(
+        const declared = await ctx.dispatch.writeAs(
           createSystemUser(onlyCandidate),
           SubscriptionFoundationHandlers.declareContractTermination,
           {
@@ -253,7 +255,7 @@ export function createRequestContractTerminationHandler(
         }
       } else {
         reasons.push(candidates.length === 0 ? "unmatched" : "ambiguous");
-        const recorded = await ctx.writeAs(
+        const recorded = await ctx.dispatch.writeAs(
           createSystemUser(SYSTEM_TENANT_ID),
           SubscriptionFoundationHandlers.recordUnmatchedContractTermination,
           {
@@ -318,7 +320,7 @@ export function createTerminateContractHandler(
       const { declarationType, terminationKind } = payload;
 
       const caller = authUserRowSchema.safeParse(
-        await ctx.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, {
+        await ctx.dispatch.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, {
           id: event.user.id,
         }),
       );
@@ -332,7 +334,7 @@ export function createTerminateContractHandler(
         });
       }
 
-      const recorded = await ctx.writeAs(
+      const recorded = await ctx.dispatch.writeAs(
         createSystemUser(tenantId),
         SubscriptionFoundationHandlers.recordContractTermination,
         {

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-revoke.ts

@@ -24,6 +24,11 @@ import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from
 import { SubscriptionFoundationHandlers } from "../web/constants.ts";
 import type { ConsentLocale } from "./consent-text.ts";
 import { notifyOperator } from "./termination-notify.ts";
+import { hasOtherOpenProviderCancel } from "./termination-open-cancels.ts";
+import {
+  TERMINATION_PROVIDER_LOCK_KEY,
+  TERMINATION_PROVIDER_LOCK_NAMESPACE,
+} from "./termination-provider-lock.ts";
 import { findRecordedTermination, hasRevocation, resumeAtProvider } from "./termination-record.ts";
 import type { OperatorNoticeReason } from "./termination-texts.ts";
 
@@ -103,7 +108,7 @@ export function createRevokeContractTerminationHandler(): WriteHandlerDef {
     handler: async (event, ctx) => {
       // @cast-boundary engine-payload — dispatcher-zod-validated payload
       const payload = event.payload as z.infer<typeof revokeContractTerminationSchema>;
-      const result = await ctx.writeAs(
+      const result = await ctx.dispatch.writeAs(
         createSystemUser(payload.tenantId),
         SubscriptionFoundationHandlers.recordContractTerminationRevocation,
         { requestId: payload.requestId, token: payload.token },
@@ -129,11 +134,16 @@ export function createRecordContractTerminationRevocationHandler(
       // @cast-boundary engine-payload — dispatcher-zod-validated payload
       const payload = event.payload as z.infer<typeof recordContractTerminationRevocationSchema>;
       const tenantId = event.user.tenantId;
+      // The provider cancel/resume and the stream append must not interleave across declarations of the same subscription.
+      await ctx.db.advisoryXactLock(
+        TERMINATION_PROVIDER_LOCK_NAMESPACE,
+        TERMINATION_PROVIDER_LOCK_KEY,
+      );
       const outcome = (value: RevocationOutcome) => ({
         isSuccess: true as const,
         data: { outcome: value },
       });
-      const stream = await ctx.fetchForWriting({
+      const stream = await ctx.events.fetchForWriting({
         aggregateId: subscriptionAggregateId(tenantId),
         aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
       });
@@ -162,25 +172,18 @@ export function createRecordContractTerminationRevocationHandler(
       }
 
       const reasons: OperatorNoticeReason[] = ["revoked"];
-      if (requested?.providerCancel === "period-end") {
+      if (
+        requested?.providerCancel === "period-end" &&
+        !hasOtherOpenProviderCancel(stream.events, payload.requestId)
+      ) {
         reasons.push(...(await resumeAtProvider(ctx, subscription)));
       }
       // Re-fetch after the external call, like record-contract-termination.
-      const streamAfterProviderCall = await ctx.fetchForWriting({
+      const streamAfterProviderCall = await ctx.events.fetchForWriting({
         aggregateId: subscriptionAggregateId(tenantId),
         aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
       });
-      // A cancel recorded between the first fetch and now was never resumed above.
-      const requestedMeanwhile =
-        requested === undefined
-          ? findRecordedTermination(streamAfterProviderCall.events, payload.requestId)
-          : undefined;
-      if (requestedMeanwhile?.providerCancel === "period-end") {
-        reasons.push(
-          ...(await resumeAtProvider(ctx, await getSubscriptionForTenant(ctx, tenantId))),
-        );
-      }
-      const providerCancel = (requested ?? requestedMeanwhile)?.providerCancel;
+      const providerCancel = requested?.providerCancel;
       const revoked: ContractTerminationRevokedPayload = {
         requestId: payload.requestId,
         revokedAtIso: now.toString(),