furystack
diff --git a/‎.cursor/rules/CODE_STYLE.mdc‎
Lines changed: 4 additions & 4 deletions b/‎.cursor/rules/CODE_STYLE.mdc‎
Lines changed: 4 additions & 4 deletions
diff --git a/‎.cursor/rules/REST_SERVICE.mdc‎
Lines changed: 95 additions & 27 deletions b/‎.cursor/rules/REST_SERVICE.mdc‎
Lines changed: 95 additions & 27 deletions
@@ -180,7 +180,7 @@ function getData() {}
 ```typescript
 // ✅ Good - Shades component with event handlers
 const MyComponent = Shade({
-  shadowDomName: 'my-component',
+  customElementName: 'my-component',
   render: ({ props, injector }) => {
     const handleButtonClick = () => {
       // Internal logic
@@ -267,7 +267,7 @@ type UserProfileProps = {
 };
 
 export const UserProfile = Shade<UserProfileProps>({
-  shadowDomName: 'user-profile',
+  customElementName: 'user-profile',
   render: ({ props }) => {
     // Component implementation
   },
@@ -501,7 +501,7 @@ const formatDate = (date: Date): string => {
 
 // 5. Main component
 export const UserProfile = Shade<UserProfileProps>({
-  shadowDomName: 'user-profile',
+  customElementName: 'user-profile',
   render: ({ props, injector, useObservable, useDisposable }) => {
     // Services
     const userService = injector.getInstance(UserService);
@@ -646,7 +646,7 @@ export const formatCurrency = (value: number, currency: string): string => {
  * UserProfile component displays user information and allows editing
  */
 export const UserProfile = Shade<UserProfileProps>({
-  shadowDomName: 'user-profile',
+  customElementName: 'user-profile',
   render: ({ props }) => {
     // Component implementation
   },
 
@@ -21,11 +21,8 @@ import StackCraftApiSchemas from 'common/schemas/stack-craft-api.json' with { ty
 import { useHttpAuthentication, useRestService, useStaticFiles } from '@furystack/rest-service'
 import { injector } from './config.js'
 
-// Set up authentication
-useHttpAuthentication(injector, {
-  getUserStore: (sm) => sm.getStoreFor(User, 'username'),
-  getSessionStore: (sm) => sm.getStoreFor(DefaultSession, 'sessionId'),
-})
+// Set up authentication (requires DataSets for User and DefaultSession to be pre-registered)
+useHttpAuthentication(injector)
 
 // Set up REST API
 useRestService<StackCraftApi>({
@@ -185,8 +182,8 @@ import { FileSystemStore } from '@furystack/filesystem-store'
 import { Injector } from '@furystack/inject'
 import { useLogging, VerboseConsoleLogger } from '@furystack/logging'
 import { getRepository } from '@furystack/repository'
-import { usePasswordPolicy } from '@furystack/security'
 import { DefaultSession } from '@furystack/rest-service'
+import { PasswordResetToken, usePasswordPolicy } from '@furystack/security'
 import { User } from 'common'
 
 export const injector = new Injector()
@@ -204,13 +201,12 @@ addStore(
   }),
 )
 
-addStore(
-  injector,
-  new InMemoryStore({
-    model: DefaultSession,
-    primaryKey: 'sessionId',
-  }),
-)
+addStore(injector, new InMemoryStore({ model: DefaultSession, primaryKey: 'sessionId' }))
+  .addStore(new InMemoryStore({ model: PasswordResetToken, primaryKey: 'token' }))
+
+// Create DataSets (required before useHttpAuthentication and usePasswordPolicy)
+getRepository(injector).createDataSet(DefaultSession, 'sessionId')
+getRepository(injector).createDataSet(PasswordResetToken, 'token')
 
 // Set up password policy
 usePasswordPolicy(injector)
@@ -237,6 +233,74 @@ export const authorizedDataSet: Partial<DataSetSettings<unknown, unknown>> = {
 }
 ```
 
+## Data Access
+
+### NEVER Use `getStoreManager()` or `StoreManager` Directly
+
+All data access **must** go through the Repository layer (`getRepository()`) using DataSets. Direct `StoreManager` / `getStoreManager()` usage bypasses authorization and is **forbidden**.
+
+```typescript
+// ❌ FORBIDDEN - bypasses authorization
+import { getStoreManager } from '@furystack/core'
+const sm = getStoreManager(injector)
+const users = await sm.getStoreFor(User, 'username').find({})
+
+// ❌ FORBIDDEN - direct StoreManager injection
+@Injected(StoreManager)
+declare private storeManager: StoreManager
+
+// ✅ Good - use Repository DataSets
+import { getRepository } from '@furystack/repository'
+const repository = getRepository(injector)
+const users = await repository.getDataSetFor(User, 'username').find(injector, {})
+```
+
+### REST Action Handlers
+
+REST action handlers receive a scoped `injector` with an `IdentityContext` already set up per-request. Pass it directly to DataSet methods:
+
+```typescript
+const MyAction: RequestAction<MyEndpoint> = async ({ injector }) => {
+  const repository = getRepository(injector)
+  const items = await repository.getDataSetFor(MyModel, 'id').find(injector, {})
+  return JsonResult({ items })
+}
+```
+
+### Elevated Context for Background Operations
+
+Background services, middleware, and startup code have no HTTP request context. Use `useSystemIdentityContext()` from `@furystack/core` to create a child injector with system-level privileges:
+
+```typescript
+import { useSystemIdentityContext } from '@furystack/core'
+import { getRepository } from '@furystack/repository'
+import { usingAsync } from '@furystack/utils'
+
+// One-off operation (automatic cleanup with usingAsync)
+await usingAsync(useSystemIdentityContext({ injector }), async (elevated) => {
+  const repository = getRepository(elevated)
+  const items = await repository.getDataSetFor(MyModel, 'id').find(elevated, {})
+  await repository.getDataSetFor(MyModel, 'id').update(elevated, id, changes)
+})
+
+// Singleton services (cache and dispose with service)
+@Injectable({ lifetime: 'singleton' })
+export class MyService {
+  private elevatedInjector?: Injector
+
+  private getElevatedInjector(): Injector {
+    if (!this.elevatedInjector) {
+      this.elevatedInjector = useSystemIdentityContext({ injector: getInjectorReference(this) })
+    }
+    return this.elevatedInjector
+  }
+
+  public async [Symbol.asyncDispose]() {
+    await this.elevatedInjector?.[Symbol.asyncDispose]()
+  }
+}
+```
+
 ## Store Types
 
 ### FileSystemStore
@@ -316,26 +380,25 @@ void attachShutdownHandler(injector)
 
 ### Seed Script
 
-Create a seed script for initial data:
+Create a seed script for initial data using elevated context:
 
 ```typescript
 // service/src/seed.ts
-import { StoreManager } from '@furystack/core'
+import { useSystemIdentityContext } from '@furystack/core'
+import { getRepository } from '@furystack/repository'
+import { usingAsync } from '@furystack/utils'
 import { PasswordAuthenticator, PasswordCredential } from '@furystack/security'
 import { User } from 'common'
 import { injector } from './config.js'
 
 export const seed = async (i: Injector): Promise<void> => {
-  const sm = i.getInstance(StoreManager)
-  const userStore = sm.getStoreFor(User, 'username')
-  const pwcStore = sm.getStoreFor(PasswordCredential, 'userName')
-
-  // Create default user credentials
-  const cred = await i.getInstance(PasswordAuthenticator).hasher.createCredential('testuser', 'password')
+  await usingAsync(useSystemIdentityContext({ injector: i }), async (elevated) => {
+    const repository = getRepository(elevated)
+    const cred = await i.getInstance(PasswordAuthenticator).hasher.createCredential('testuser', 'password')
 
-  // Save to stores
-  await pwcStore.add(cred)
-  await userStore.add({ username: 'testuser', roles: [] })
+    await repository.getDataSetFor(PasswordCredential, 'userName').add(elevated, cred)
+    await repository.getDataSetFor(User, 'username').add(elevated, { username: 'testuser', roles: [] })
+  })
 }
 
 await seed(injector)
@@ -375,16 +438,21 @@ useRestService<StackCraftApi>({
 3. **Validate requests** - Use `Validate` wrapper with JSON schemas
 4. **Configure stores** - `FileSystemStore` for persistence, `InMemoryStore` for sessions
 5. **Handle authorization** - Define authorization functions for data sets
-6. **Graceful shutdown** - Implement proper cleanup with `Symbol.asyncDispose`
-7. **CORS setup** - Configure for frontend origins
+6. **NEVER use `getStoreManager()` or `StoreManager` directly** - Always use `getRepository().getDataSetFor()` for data access
+7. **Use `useSystemIdentityContext()` from `@furystack/core`** for background services, middleware, and startup operations that lack an HTTP request context
+8. **Graceful shutdown** - Implement proper cleanup with `Symbol.asyncDispose`
+9. **CORS setup** - Configure for frontend origins
 
 **Service Checklist:**
 
 - [ ] API types defined in `common` package
 - [ ] JSON schemas generated for validation
 - [ ] Stores configured for all models
-- [ ] Authentication set up with `useHttpAuthentication`
+- [ ] DataSets created for all models via `getRepository().createDataSet()` (including `DefaultSession` and `PasswordResetToken`)
+- [ ] Authentication set up with `useHttpAuthentication` (no options needed — uses DataSets by default)
 - [ ] Authorization functions defined
+- [ ] No `getStoreManager()` or `StoreManager` usage — all data access via Repository
+- [ ] Background services use `useSystemIdentityContext()` for data access
 - [ ] CORS configured for frontend
 - [ ] Graceful shutdown handler attached
 - [ ] Error handling for startup failures