@cosmicdrift/kumiko-samples 0.389.0 → 0.390.1

package/packages/bundled-features/src/billing-foundation/events.ts

@@ -19,7 +19,7 @@ import { CONSENT_LOCALES } from "./web/consumer-protection/consent-locale.ts";
 export const SUBSCRIPTION_AGGREGATE_TYPE = "subscription" as const;
 
 // Event-name constants — short form (for r.defineEvent) and qualified
-// FQN (for ctx.unsafeAppendEvent and projection-apply keys).
+// FQN (for ctx.events.unsafeAppend and projection-apply keys).
 export const SUBSCRIPTION_CREATED_EVENT_SHORT = "subscription-created" as const;
 export const SUBSCRIPTION_UPDATED_EVENT_SHORT = "subscription-updated" as const;
 export const SUBSCRIPTION_CANCELED_EVENT_SHORT = "subscription-canceled" as const;

package/packages/bundled-features/src/billing-foundation/feature.ts

@@ -172,7 +172,7 @@ export function createBillingFoundationFeature<TTier extends string = string>(
       r.defineEvent(PAYMENT_RECEIVED_EVENT_SHORT, paymentEventPayloadSchema, { piiFields: "none" });
 
       // Inline projection: materialized current state in `read_subscriptions`.
-      // Apply runs in the same TX as ctx.unsafeAppendEvent — read-your-own-
+      // Apply runs in the same TX as ctx.events.unsafeAppend — read-your-own-
       // write without a dispatcher tick.
       r.projection({
         name: "subscription",
@@ -260,13 +260,18 @@ export function createBillingFoundationFeature<TTier extends string = string>(
         perTenant: true,
         runOnBoot: true,
         handler: async (_payload, ctx) => {
-          const result = await ctx.write(SubscriptionFoundationHandlers.syncSubscription, {});
+          const result = await ctx.dispatch.write(
+            SubscriptionFoundationHandlers.syncSubscription,
+            {},
+          );
           if (!result.isSuccess) {
             throw new Error(
               `billing-foundation:sync-subscriptions: sync-subscription write failed: ${JSON.stringify(result.error)}`,
             );
           }
-          ctx.log.info(`[billing-foundation:sync-subscriptions] ${JSON.stringify(result.data)}`);
+          ctx.obs.log.info(
+            `[billing-foundation:sync-subscriptions] ${JSON.stringify(result.data)}`,
+          );
         },
       });
 

package/packages/bundled-features/src/billing-foundation/get-subscription-for-tenant.ts

@@ -29,7 +29,7 @@ export type SubscriptionView = {
  *  aggregate ID), or null if the tenant has never subscribed. The status
  *  may be active/canceled/past_due/etc.; the caller decides what to do. */
 export async function getSubscriptionForTenant(
-  ctx: HandlerContext,
+  ctx: Pick<HandlerContext, "db">,
   tenantId: string,
 ): Promise<SubscriptionView | null> {
   const aggId = subscriptionAggregateId(tenantId);

package/packages/bundled-features/src/billing-foundation/handlers/process-event.write.ts

@@ -9,7 +9,7 @@
 //      with no second append.
 //   2. Type mapping: SubscriptionEvent.type (= normalized by the plugin)
 //      → one of the 5 ES event types.
-//   3. ctx.unsafeAppendEvent — the inline projection materializes the
+//   3. ctx.events.unsafeAppend — the inline projection materializes the
 //      `read_subscriptions` row in the same TX.
 
 import {
@@ -175,7 +175,7 @@ export async function appendSubscriptionEvent(
   //    streams, optimize via snapshot or a per-tenant dedup table as the
   //    idempotency anchor (like cap-counter).
   // ---------------------------------------------------------------
-  const existingEvents = await ctx.loadAggregate(aggId);
+  const existingEvents = await ctx.events.load(aggId);
   const alreadySeen = existingEvents.some((e) => {
     const headers = e.metadata.headers ?? {};
     return (
@@ -191,7 +191,7 @@ export async function appendSubscriptionEvent(
   // late delivery: appending it would roll the row back (a canceled subscription
   // would come back active). Invoice events carry the live state, not a snapshot.
   if (isLateStateEvent(existingEvents, payload)) {
-    ctx.log?.warn(
+    ctx.obs.log?.warn(
       `[billing-foundation:process-event] dropped late ${payload.type} ${payload.providerEventId}: a newer provider event is already stored`,
     );
     return { duplicate: false, stale: true, subscriptionAggregateId: aggId };
@@ -260,7 +260,7 @@ export async function appendSubscriptionEvent(
     providerEventId: payload.providerEventId,
     providerName: payload.providerName,
   };
-  await ctx.unsafeAppendEvent({
+  await ctx.events.unsafeAppend({
     aggregateId: aggId,
     aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
     type: esEventType,
@@ -311,7 +311,7 @@ export function createProcessEventHandler(now: () => Temporal.Instant): WriteHan
       const payload = event.payload as ProcessEventPayload;
       const current = await getSubscriptionForTenant(ctx, event.user.tenantId);
       if (isStaleSubscriptionEvent(current, payload, now())) {
-        ctx.log?.warn(
+        ctx.obs.log?.warn(
           `[billing-foundation:process-event] dropped stale ${payload.type} ${payload.providerEventId}: tenant already tracks another subscription`,
         );
         return {

package/packages/bundled-features/src/billing-foundation/handlers/process-payment-event.write.ts

@@ -6,7 +6,7 @@
 //   1. Idempotency-check: loads the payment-stream and scans for an
 //      already-seen `metadata.providerEventId`. A provider-replay with
 //      the same event-id → duplicate=true, no second append.
-//   2. ctx.unsafeAppendEvent — inline-projection materializes a new
+//   2. ctx.events.unsafeAppend — inline-projection materializes a new
 //      `read_payments`-row (INSERT-once, not UPSERT — every payment is
 //      its own fact, not a state-update).
 
@@ -55,7 +55,7 @@ export const processPaymentEventHandler: WriteHandlerDef = {
     //    (a tenant with hundreds of purchases scans hundreds of events;
     //    optimize via a per-tenant providerEventId-index if that bites).
     // ---------------------------------------------------------------
-    const existingEvents = await ctx.loadAggregate(aggId);
+    const existingEvents = await ctx.events.load(aggId);
     const alreadySeen = existingEvents.some((e) => {
       const headers = e.metadata.headers ?? {};
       return (
@@ -106,7 +106,7 @@ export const processPaymentEventHandler: WriteHandlerDef = {
         providerCheckoutId: payload.providerCheckoutId,
       }),
     };
-    await ctx.unsafeAppendEvent({
+    await ctx.events.unsafeAppend({
       aggregateId: aggId,
       aggregateType: PAYMENT_AGGREGATE_TYPE,
       type: PAYMENT_RECEIVED_EVENT_QN,

package/packages/bundled-features/src/billing-foundation/plan-catalog.ts

@@ -77,7 +77,7 @@ export async function resolvePlanPrices(
     prices = await plugin.retrievePrices(ctx, allPriceIds);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    ctx.log?.warn("billing-foundation: retrievePrices threw, all plan prices unavailable", {
+    ctx.obs.log?.warn("billing-foundation: retrievePrices threw, all plan prices unavailable", {
       message,
     });
     return result;
@@ -93,7 +93,7 @@ export async function resolvePlanPrices(
       const chosen = active[0];
       if (chosen) result.set(tier, { priceId: chosen.priceId, price: chosen });
     } else if (active.length > 1) {
-      ctx.log?.warn(
+      ctx.obs.log?.warn(
         `billing-foundation: tier "${tier}" has ${active.length} active flat-amount prices — expected exactly one, price stays unavailable`,
       );
     }

package/packages/bundled-features/src/billing-foundation/projection.ts

@@ -1,7 +1,7 @@
 // Inline projection for `read_subscriptions`. Materializes the 5
 // subscription events into one row per tenant.
 //
-// Apply runs in the same transaction as ctx.unsafeAppendEvent, so the caller
+// Apply runs in the same transaction as ctx.events.unsafeAppend, so the caller
 // sees its write state immediately (no dispatcher tick required). The PK is
 // event.aggregateId (= deterministic uuidv5 per tenant), so replays collide
 // on the PK instead of creating duplicate rows.

package/packages/bundled-features/src/billing-foundation/types.ts

@@ -18,7 +18,7 @@
 //   2. **Post-tenant-resolution:** `createPortalSession` +
 //      `cancelSubscription` are called from regular write handlers with
 //      a fully resolved HandlerContext. The plugin can use ctx.config +
-//      ctx.secrets for tenant-specific configuration (e.g. tenant-owned
+//      ctx.services.secrets for tenant-specific configuration (e.g. tenant-owned
 //      customer-id mappings).
 //
 // Foundation uses only the common subset of provider functionality;

package/packages/bundled-features/src/cap-counter/aggregate-id.ts

@@ -38,7 +38,7 @@ export function capCounterAggregateId(
  * different uuidv5 namespace, different output UUID. This also prevents an
  * accidental calendar increment from landing on the rolling stream.
  *
- * **Caller:** `CapCounterHandlers.incrementRolling` (via `ctx.write`) calls
+ * **Caller:** `CapCounterHandlers.incrementRolling` (via `ctx.dispatch.write`) calls
  * this with tenantId + capName and appends increment events to the stream.
  * Race-free because the event store appends with an auto-incrementing version.
  */

package/packages/bundled-features/src/cap-counter/book-cap-usage.ts

@@ -5,6 +5,7 @@ import {
   createEntityExecutor,
   type HandlerContext,
   type JobContext,
+  type ReservationContext,
   type SessionUser,
   type TenantId,
   type WriteResult,
@@ -84,7 +85,7 @@ export type BookCapUsageOptions = {
   readonly guardCurrentValue?: (currentValue: number) => void;
 };
 
-export type CapCounterContext = HandlerContext | JobContext;
+export type CapCounterContext = HandlerContext | JobContext | ReservationContext;
 
 export type CapCounterScope = {
   readonly user: SessionUser;
@@ -104,7 +105,7 @@ function assertDbServesUser(db: TenantDb, user: SessionUser): TenantDb {
 }
 
 // Jobs write in place (their db is not transaction-bound); systemScope handlers reach both dbs via
-// systemDb, because their ctx.db / ctx.dbOutsideTransaction are fail-closed proxies.
+// systemDb, because their ctx.db / ctx.db.outsideTransaction are fail-closed proxies.
 export function resolveCapCounterScope(
   ctx: CapCounterContext,
   outsideTransaction: boolean,
@@ -130,11 +131,11 @@ export function resolveCapCounterScope(
       : readDb;
     return { user, readDb, writeDb };
   }
-  const writeDb = outsideTransaction ? ctx.dbOutsideTransaction : ctx.db;
+  const writeDb = outsideTransaction ? ctx.db.outsideTransaction : ctx.db;
   if (!writeDb) {
     throw new Error(
       outsideTransaction
-        ? "cap-counter: outsideTransaction requested but ctx.dbOutsideTransaction is undefined"
+        ? "cap-counter: outsideTransaction requested but ctx.db.outsideTransaction is undefined"
         : "cap-counter: ctx.db missing — run inside a handler context",
     );
   }

package/packages/bundled-features/src/cap-counter/cap-reservation.ts

@@ -612,7 +612,7 @@ export async function releaseExpiredCapReservations(
     try {
       await releaseCapReservation(ctx, id, outsideTransaction);
     } catch (error) {
-      ctx.log?.error("releasing an expired cap reservation failed", { id, capName, error });
+      ctx.obs.log?.error("releasing an expired cap reservation failed", { id, capName, error });
     }
   }
 }

package/packages/bundled-features/src/cap-counter/constants.ts

@@ -13,7 +13,7 @@ export const CAP_COUNTER_ROLLING_AGGREGATE_TYPE = "cap-counter-rolling" as const
 // Custom event types for rolling-window counters. The pair is symmetric:
 //   _SHORT  — matches `r.defineEvent(short, schema)` in the registrar
 //             (the framework automatically prefixes it to the QN)
-//   _QN     — qualified form for `ctx.unsafeAppendEvent({type})`, the
+//   _QN     — qualified form for `ctx.events.unsafeAppend({type})`, the
 //             `events.type` column, and `registry.getEvent(qn)` lookups
 // Both MUST stay consistent; the feature test pins against drift.
 export const ROLLING_INCREMENTED_EVENT_SHORT = "rolling-incremented" as const;

package/packages/bundled-features/src/cap-counter/feature.ts

@@ -31,7 +31,7 @@
 //     ai-foundation are BYOK by default and currently have no platform pool
 //     to count. cap-counter is generic: an app owner who wants to use the
 //     counter calls `bookCapUsage(...)` /
-//     `ctx.write(CapCounterHandlers.incrementRolling, ...)` from their own handler.
+//     `ctx.dispatch.write(CapCounterHandlers.incrementRolling, ...)` from their own handler.
 //   - **No reset cron for the calendar period.** It works without one: the
 //     periodStartIso part of the aggregate id rolls over to a fresh counter
 //     at the period boundary. Old rows remain for auditing.
@@ -86,7 +86,7 @@ export function createCapCounterFeature() {
       });
 
       // Custom domain event for the rolling counter. r.defineEvent registers the
-      // schema with the registry; ctx.unsafeAppendEvent in the handler reuses the
+      // schema with the registry; ctx.events.unsafeAppend in the handler reuses the
       // same schema for append-time validation. QN after prefixing:
       // "cap-counter:event:rolling-incremented" (see
       // ROLLING_INCREMENTED_EVENT_QN).

package/packages/bundled-features/src/cap-counter/handlers/increment-rolling.write.ts

@@ -71,7 +71,7 @@ export const incrementRollingCapHandler: WriteHandlerDef = {
     // unsafeAppendEvent: the strict appendEvent is bound to an app's own event map, which
     // bundled-features cannot see. Schema validation still runs because r.defineEvent
     // registered the schema.
-    await ctx.unsafeAppendEvent({
+    await ctx.events.unsafeAppend({
       aggregateId,
       aggregateType: CAP_COUNTER_ROLLING_AGGREGATE_TYPE,
       type: ROLLING_INCREMENTED_EVENT_QN,

package/packages/bundled-features/src/cap-counter/reservation-chain.ts

@@ -30,7 +30,7 @@ export function chainReservations(
       try {
         await innerHandle.release();
       } catch (releaseError) {
-        ctx.log?.error("releasing the inner cap reservation failed", { error: releaseError });
+        ctx.obs.log?.error("releasing the inner cap reservation failed", { error: releaseError });
       }
       throw error;
     }

package/packages/bundled-features/src/cap-counter/with-cap-enforcement.ts

@@ -12,7 +12,7 @@
 // after a rollback, failure result or failed COMMIT only gives back what is still booked, so an
 // unknown COMMIT outcome cannot under-count. No connection is held across the handler. Rows a
 // crashed process left behind expire after CAP_RESERVATION_TTL_MINUTES and are given back before the
-// next reserve of the same cap. Reached through a nested ctx.write the cap is not reserved, so the
+// next reserve of the same cap. Reached through a nested ctx.dispatch.write the cap is not reserved, so the
 // dispatcher rejects that call unless the top-level batch reserved the same handler.
 //
 // The wrapper spreads the wrapped handler and chains its reserveBeforeTransaction: inner reserves
@@ -25,7 +25,7 @@
 // (enforce-cap.ts).
 
 import type {
-  HandlerContext,
+  ReservationContext,
   WriteEvent,
   WriteHandlerDef,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -67,7 +67,7 @@ export type CalendarCapDef = {
  *  tier from DB. */
 export type CalendarCapResolver = (
   event: WriteEvent,
-  ctx: HandlerContext,
+  ctx: ReservationContext,
 ) => Promise<CalendarCapDef> | CalendarCapDef;
 
 /**
@@ -111,7 +111,7 @@ export type RollingCapDef = {
 
 export type RollingCapResolver = (
   event: WriteEvent,
-  ctx: HandlerContext,
+  ctx: ReservationContext,
 ) => Promise<RollingCapDef> | RollingCapDef;
 
 /**

package/packages/bundled-features/src/cap-overview/handlers/caps-usage.query.ts

@@ -76,7 +76,7 @@ export function createCapsUsageQuery(
 
       // Override path: limits must read the TARGET tenant's config, not the
       // SystemAdmin caller's.
-      const config = override === undefined ? ctx.config : ctx.configFor?.(targetTenantId);
+      const config = override === undefined ? ctx.config : ctx.tenants.config?.(targetTenantId);
 
       const rows: CapUsageWithMeta[] = await Promise.all(
         caps.map(async (cap) => {

package/packages/bundled-features/src/cap-overview/handlers/tenant-caps-list.query.ts

@@ -251,7 +251,7 @@ export function createTenantCapsListQuery(caps: readonly CapSpec[], listCaps: re
       const limitByTenantAndCap = await resolveLimitsByTenantAndCap(
         listedCaps,
         page,
-        ctx.configFor,
+        ctx.tenants.config,
       );
 
       const rows: TenantCapsListRow[] = page.map((row) => {

package/packages/bundled-features/src/compliance-profiles/seeding.ts

@@ -20,12 +20,12 @@ import {
   type DbConnection,
   fetchOne,
 } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
-  runEventStoreSeed,
-  type SeedIfExists,
-  TestUsers,
-} from "@cosmicdrift/kumiko-framework/seeding";
+  createSystemUser,
+  type SessionUser,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { runEventStoreSeed, type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
 
 import {
   tenantComplianceProfileEntity,
@@ -52,8 +52,13 @@ export async function seedComplianceProfile(
 ): Promise<{ id: string }> {
   // user.tenantId must equal opts.tenantId so the Event Store stream
   // and projection remain in the same tenant bucket.
-  const by = opts.by ?? { ...TestUsers.systemAdmin, tenantId: opts.tenantId };
-  const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
+  const by = opts.by ?? createSystemUser(opts.tenantId);
+  const tdb = createTenantDb({
+    db,
+    tenantId: opts.tenantId,
+    mode: "system",
+    reason: "seeding writes the compliance profile into an explicitly named tenant",
+  });
   const overrideJson = opts.override !== undefined ? JSON.stringify(opts.override) : null;
 
   const existing = (await fetchOne(db, tenantComplianceProfileTable, {

package/packages/bundled-features/src/config/feature.ts

@@ -111,15 +111,15 @@ export function createConfigAccessorFactory(
 // session reads "config feature not wired into AppContext" instead of a
 // generic "configResolver missing".
 export function requireConfigResolver(ctx: HandlerContext, handlerName: string): ConfigResolver {
-  if (!ctx.configResolver) {
+  if (!ctx.services.configResolver) {
     throw new InternalError({
       message:
-        `[${handlerName}] ctx.configResolver missing — pass createConfigAccessorFactory's ` +
+        `[${handlerName}] ctx.services.configResolver missing — pass createConfigAccessorFactory's ` +
         `output via extraContext.configAccessorFactory and the resolver via ` +
         `extraContext.configResolver at boot.`,
     });
   }
-  return ctx.configResolver;
+  return ctx.services.configResolver;
 }
 
 // Config declares r.systemScope() (raw ctx.db is unfiltered across tenants
@@ -156,14 +156,14 @@ export function requireSystemDb(
 // if a handler tries to write an encrypted key without the provider in
 // place, pointing at the exact wiring gap).
 export function requireConfigEncryption(ctx: HandlerContext, handlerName: string): EnvelopeCipher {
-  if (!ctx.configEncryption) {
+  if (!ctx.services.configEncryption) {
     throw new InternalError({
       message:
-        `[${handlerName}] ctx.configEncryption missing — at least one config key declares ` +
+        `[${handlerName}] ctx.services.configEncryption missing — at least one config key declares ` +
         `encrypted: true, so the boot wiring must pass an EnvelopeCipher via ` +
         `extraContext.configEncryption (run{Prod,Dev}App wire it automatically from ` +
         `KUMIKO_SECRETS_MASTER_KEY_V<n>; same instance the resolver was built with).`,
     });
   }
-  return ctx.configEncryption;
+  return ctx.services.configEncryption;
 }

package/packages/bundled-features/src/config/handlers/cascade.query.ts

@@ -59,7 +59,7 @@ export const cascadeQuery = defineQueryHandler({
       query.user.tenantId,
       query.user.id,
       db,
-      ctx.secrets,
+      ctx.services.secrets,
     );
 
     const result: Record<string, ConfigCascade> = {};

package/packages/bundled-features/src/config/handlers/readiness.query.ts

@@ -106,7 +106,7 @@ export async function collectMissingRequiredConfig(
     user.tenantId,
     user.id,
     db,
-    ctx.secrets,
+    ctx.services.secrets,
   );
   for (const [qualifiedKey, keyDef] of candidates) {
     // Deliberately the unredacted cascade value: readiness asks "does this

package/packages/bundled-features/src/config/handlers/reencrypt.job.ts

@@ -69,22 +69,22 @@ export type ReencryptJobResult = {
 
 export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
   const payload = rawPayload as ReencryptJobPayload; // @cast-boundary engine-payload
-  const maybeCipher = ctx.configEncryption;
+  const maybeCipher = ctx.services.configEncryption;
   if (!maybeCipher) {
     throw new InternalError({
       message:
-        "[config:reencrypt] ctx.configEncryption missing — provide a master key " +
+        "[config:reencrypt] ctx.services.configEncryption missing — provide a master key " +
         "(KUMIKO_SECRETS_MASTER_KEY_V<n>) so the boot wires the envelope cipher.",
     });
   }
   // hoisted function declarations below capture these — pin the narrowed
   // type explicitly so TS keeps it inside the closures
   const cipher: EnvelopeCipher = maybeCipher;
-  const provider = ctx.masterKeyProvider;
+  const provider = ctx.services.masterKeyProvider;
   if (!provider) {
     throw new InternalError({
       message:
-        "[config:reencrypt] ctx.masterKeyProvider missing — wire it via extraContext.masterKeyProvider at boot.",
+        "[config:reencrypt] ctx.services.masterKeyProvider missing — wire it via extraContext.masterKeyProvider at boot.",
     });
   }
   if (!ctx.registry) {
@@ -116,8 +116,8 @@ export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void>
       handler: "config:job:reencrypt",
       tenantId,
       actor: "system",
-      sink: ctx._escapeHatchAuditSink,
-      log: ctx.log,
+      sink: ctx.services._escapeHatchAuditSink,
+      log: ctx.obs.log,
     });
   }
 
@@ -125,7 +125,12 @@ export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void>
   function tdbFor(tenantId: TenantId): TenantDb {
     let existing = tdbCache.get(tenantId);
     if (!existing) {
-      existing = createTenantDb({ db, tenantId, mode: "system" });
+      existing = createTenantDb({
+        db,
+        tenantId,
+        mode: "system",
+        reason: "KEK rotation job re-encrypts config values of every tenant",
+      });
       tdbCache.set(tenantId, existing);
     }
     return existing;
@@ -146,7 +151,12 @@ export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void>
   // tenant's writes — sharing it with sdbFor(SYSTEM_TENANT_ID) would make a
   // write-path cache entry double as the scan's ack gate.
   const scanDb = createSystemDbView(
-    createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" }),
+    createTenantDb({
+      db,
+      tenantId: SYSTEM_TENANT_ID,
+      mode: "system",
+      reason: "KEK rotation scan enumerates config values across all tenants",
+    }),
     undefined,
     reportEscapeHatchFor(SYSTEM_TENANT_ID),
   );
@@ -219,7 +229,7 @@ export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void>
       // format) — never a supported re-encrypt input, so fail loudly
       // instead of relying on cipher.decrypt to reject it. Log only the
       // row id, never the value (ciphertext-adjacent).
-      ctx.log?.warn?.(
+      ctx.obs.log?.warn?.(
         `[config:reencrypt] row ${row.id} is not a current-cipher envelope, not re-encryptable`,
       );
       return "failed";
@@ -244,7 +254,7 @@ export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void>
     // holds a fresh envelope written by the set handler — already fine.
     if (!result.isSuccess) {
       if (result.error.code === "version_conflict") return "skipped";
-      ctx.log?.warn?.(`[config:reencrypt] executor rejected row ${row.id}`, {
+      ctx.obs.log?.warn?.(`[config:reencrypt] executor rejected row ${row.id}`, {
         code: result.error.code,
       });
       return "failed";
@@ -257,9 +267,9 @@ export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void>
     migrateRow,
     maxFailures,
     deadlineAt: deadline,
-    signal: ctx.signal,
+    signal: ctx.lifecycle.signal,
     onRowError: ({ row }, err) => {
-      ctx.log?.warn?.(`[config:reencrypt] failed to re-encrypt row ${row.id}`, { err });
+      ctx.obs.log?.warn?.(`[config:reencrypt] failed to re-encrypt row ${row.id}`, { err });
     },
   });
 
@@ -269,5 +279,5 @@ export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void>
     alreadyCurrent,
     stoppedReason: outcome.stoppedReason,
   };
-  ctx.log?.info?.(`[config:reencrypt] complete: ${JSON.stringify(result)}`);
+  ctx.obs.log?.info?.(`[config:reencrypt] complete: ${JSON.stringify(result)}`);
 };

package/packages/bundled-features/src/config/handlers/reset.write.ts

@@ -48,14 +48,14 @@ export const resetWrite = defineWriteHandler({
     // backing="secrets": clear the secret from the secrets store. delete() is
     // idempotent (returns false if absent) — mirrors the config no-op contract.
     if (keyDef.backing === "secrets") {
-      if (!ctx.secrets) {
+      if (!ctx.services.secrets) {
         throw new InternalError({
           message:
             `[config:write:reset] key "${event.payload.key}" declares backing="secrets" but ` +
-            `ctx.secrets is not wired — provide extraContext.secrets (and a MasterKeyProvider).`,
+            `ctx.services.secrets is not wired — provide extraContext.secrets (and a MasterKeyProvider).`,
         });
       }
-      await ctx.secrets.delete(SYSTEM_TENANT_ID, event.payload.key, {
+      await ctx.services.secrets.delete(SYSTEM_TENANT_ID, event.payload.key, {
         deletedBy: event.user.id,
       });
       return { isSuccess: true, data: { key: event.payload.key, scope } };

package/packages/bundled-features/src/config/handlers/selected-extensions.query.ts

@@ -53,7 +53,7 @@ export const selectedExtensionsQuery = defineQueryHandler({
       query.user.tenantId,
       query.user.id,
       db,
-      ctx.secrets,
+      ctx.services.secrets,
     );
     const selected: Record<string, string> = {};
     for (const [selectorKey, keyDef] of readableSelectors) {

package/packages/bundled-features/src/config/handlers/set.write.ts

@@ -127,7 +127,7 @@ export const setWrite = defineWriteHandler({
               tenantId,
               event.user.id,
               validateDb,
-              ctx.secrets,
+              ctx.services.secrets,
             );
           },
         });
@@ -146,14 +146,14 @@ export const setWrite = defineWriteHandler({
     // serialization as a config row so the read path round-trips via
     // deserializeValue. system-scope is guaranteed by the boot-guard.
     if (keyDef.backing === "secrets") {
-      if (!ctx.secrets) {
+      if (!ctx.services.secrets) {
         throw new InternalError({
           message:
             `[config:write:set] key "${event.payload.key}" declares backing="secrets" but ` +
-            `ctx.secrets is not wired — provide extraContext.secrets (and a MasterKeyProvider).`,
+            `ctx.services.secrets is not wired — provide extraContext.secrets (and a MasterKeyProvider).`,
         });
       }
-      await ctx.secrets.set(
+      await ctx.services.secrets.set(
         SYSTEM_TENANT_ID,
         event.payload.key,
         JSON.stringify(event.payload.value),

package/packages/bundled-features/src/config/handlers/values.query.ts

@@ -59,7 +59,7 @@ export const valuesQuery = defineQueryHandler({
       query.user.tenantId,
       query.user.id,
       db,
-      ctx.secrets,
+      ctx.services.secrets,
     );
 
     const result: Record<