@cosmicdrift/kumiko-bundled-features 0.125.2 → 0.126.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.125.2",
+  "version": "0.126.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -62,6 +62,7 @@
     "./tenant/constants": "./src/tenant/constants.ts",
     "./tenant/web": "./src/tenant/web/index.ts",
     "./tenant/seeding": "./src/tenant/seeding.ts",
+    "./tenant-lifecycle": "./src/tenant-lifecycle/index.ts",
     "./tenant/testing": "./src/tenant/testing.ts",
     "./user": "./src/user/index.ts",
     "./user/seeding": "./src/user/seeding.ts",
@@ -106,11 +107,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.125.2",
-    "@cosmicdrift/kumiko-framework": "0.125.2",
-    "@cosmicdrift/kumiko-headless": "0.125.2",
-    "@cosmicdrift/kumiko-renderer": "0.125.2",
-    "@cosmicdrift/kumiko-renderer-web": "0.125.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.126.0",
+    "@cosmicdrift/kumiko-framework": "0.126.0",
+    "@cosmicdrift/kumiko-headless": "0.126.0",
+    "@cosmicdrift/kumiko-renderer": "0.126.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.126.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -21,6 +21,10 @@ import {
   type TestStack,
   testTenantId,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { subscriptionAggregateId } from "../aggregate-id";
 import {
   SubscriptionEventTypes,
@@ -80,7 +84,14 @@ let db: DbConnection;
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [billingFoundationFeature, mockProviderFeature],
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      billingFoundationFeature,
+      mockProviderFeature,
+    ],
   });
   db = stack.db;
   // subscriptionsProjectionTable wird von setupTestStack automatisch

package/src/billing-foundation/entities.ts

@@ -3,8 +3,6 @@ import {
   createTextField,
   createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
-
-// =============================================================================
 // `subscription` — current state pro Plattform-Tenant (= Read-Model)
 // =============================================================================
 //
@@ -41,8 +39,8 @@ export const subscriptionEntity = createEntity({
   table: "read_subscriptions",
   fields: {
     providerName: createTextField({ required: true, maxLength: 50 }),
-    providerCustomerId: createTextField({ required: true, maxLength: 200 }),
-    providerSubscriptionId: createTextField({ required: true, maxLength: 200 }),
+    providerCustomerId: createTextField({ required: true, maxLength: 200, tenantOwned: true }),
+    providerSubscriptionId: createTextField({ required: true, maxLength: 200, tenantOwned: true }),
     status: createTextField({ required: true, maxLength: 30 }),
     tier: createTextField({ required: true, maxLength: 50 }),
     currentPeriodEnd: createTimestampField({ required: true }),

package/src/billing-foundation/feature.ts

@@ -41,7 +41,7 @@
 // (z.B. für analytics: "wie viele Wechsel im Monat?"), kommt ein
 // `subscription-provider-changed`-event-type später.
 
-import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, EXT_TENANT_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { BILLING_FOUNDATION_FEATURE, SUBSCRIPTION_PROVIDER_EXTENSION } from "./constants";
 import {
   INVOICE_PAID_EVENT_QN,
@@ -69,6 +69,7 @@ import {
   applySubscriptionUpdated,
   subscriptionsProjectionTable,
 } from "./projection";
+import { subscriptionTenantDestroyHook } from "./tenant-destroy-hook";
 
 export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE, (r) => {
   r.describe(
@@ -79,6 +80,7 @@ export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE
     category: "billing",
     recommended: false,
   });
+  r.requires("tenant-lifecycle", "compliance-profiles");
   // 5 fine-grained domain-events. Alle 5 nutzen denselben payload-
   // shape (= subscription-state-snapshot); der event-type taggt was
   // passiert ist. Future-consumer (billing-history, accounting)
@@ -124,4 +126,8 @@ export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE
   // Custom list-query auf der subscription-projection (raw drizzle-
   // table; kein r.entity weil Schreiben via projection-apply läuft).
   r.queryHandler(listSubscriptionsQuery);
+
+  r.useExtension(EXT_TENANT_DATA, "subscription", {
+    destroy: subscriptionTenantDestroyHook,
+  });
 });

package/src/billing-foundation/tenant-destroy-hook.ts

@@ -0,0 +1,24 @@
+import { deleteMany, type EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { resolveProfileForTenant } from "../compliance-profiles";
+import { subscriptionAggregateId } from "./aggregate-id";
+import { subscriptionsProjectionTable } from "./projection";
+
+/** Tenant-destroy hook for billing PII (#800). HGB keeps ciphertext row
+ *  (subject-keys stage erases tenant DEK); other profiles hard-delete. */
+export async function subscriptionTenantDestroyHook(ctx: {
+  readonly db: import("@cosmicdrift/kumiko-framework/db").DbRunner;
+  readonly tenantId: TenantId;
+}): Promise<void> {
+  const { profile } = await resolveProfileForTenant({
+    db: ctx.db,
+    tenantId: ctx.tenantId,
+  });
+  if (profile.key === "de-hr-dsgvo-hgb") {
+    // skip: HGB retention — row stays until crypto-shredded by subject-keys stage
+    return;
+  }
+  await deleteMany(ctx.db, subscriptionsProjectionTable as EntityTableMeta, {
+    id: subscriptionAggregateId(ctx.tenantId),
+  });
+}

package/src/subscription-mollie/__tests__/mollie-foundation.integration.test.ts

@@ -39,6 +39,10 @@ import type {
   Subscription as MollieSubscription,
 } from "@mollie/api-client";
 import { Hono } from "hono";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { createSubscriptionMollieFeature } from "../feature";
 import type { MollieClientShape } from "../verify-webhook";
 
@@ -133,7 +137,14 @@ beforeAll(async () => {
   });
 
   stack = await setupTestStack({
-    features: [billingFoundationFeature, mollieFeature],
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      billingFoundationFeature,
+      mollieFeature,
+    ],
   });
   db = stack.db;
   // subscriptionsProjectionTable wird von setupTestStack automatisch

package/src/subscription-stripe/__tests__/stripe-foundation.integration.test.ts

@@ -34,6 +34,7 @@ import {
 import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { Hono } from "hono";
 import Stripe from "stripe";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { configValuesTable, createConfigFeature } from "../../config";
 import { createConfigAccessorFactory } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
@@ -43,6 +44,8 @@ import {
   type SecretsContext,
   tenantSecretsTable,
 } from "../../secrets";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { createSubscriptionStripeFeature } from "../feature";
 
 // Qualified-names der runtime-keys (drift-pin: müssen 1:1 dem entsprechen,
@@ -93,6 +96,9 @@ beforeAll(async () => {
     features: [
       createConfigFeature(),
       createSecretsFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
       billingFoundationFeature,
       stripeFeature,
     ],
@@ -483,6 +489,9 @@ describe("scenario 6: billing-live gate end-to-end (#104)", () => {
       features: [
         createConfigFeature(),
         createSecretsFeature(),
+        createTenantFeature(),
+        createComplianceProfilesFeature(),
+        createTenantLifecycleFeature(),
         billingFoundationFeature,
         stripeFeature,
       ],

package/src/tenant/__tests__/members-screens.boot.test.ts

@@ -5,6 +5,7 @@ import { AuthHandlers } from "../../auth-email-password/constants";
 import { createConfigFeature } from "../../config/feature";
 import { MEMBERS_SCREEN_ID, TenantHandlers, TenantQueries } from "../constants";
 import { createTenantFeature } from "../feature";
+import { defaultTranslations } from "../web/i18n";
 
 describe("tenant members screen + handler access alignment", () => {
   const features = [createConfigFeature(), createTenantFeature()];
@@ -34,6 +35,12 @@ describe("tenant members screen + handler access alignment", () => {
     void TenantQueries;
   });
 
+  test("members nav label uses tenantClient i18n key (not feature:nav.* alias)", () => {
+    const nav = createTenantFeature().navs["members"];
+    expect(nav?.label).toBe("tenant.nav.members");
+    expect(defaultTranslations["de"]?.["tenant.nav.members"]).toBe("Team");
+  });
+
   test("updateMemberRoles stays SystemAdmin/system-only (not on members screen)", () => {
     const tenant = createTenantFeature();
     expect(rolesOf(tenant.writeHandlers["updateMemberRoles"]?.access)).toEqual([

package/src/tenant/feature.ts

@@ -145,7 +145,7 @@ export function createTenantFeature(): FeatureDefinition {
     });
     r.nav({
       id: "members",
-      label: "tenant:nav.members",
+      label: "tenant.nav.members",
       icon: "users",
       screen: "tenant:screen:members",
       order: 20,

package/src/tenant/index.ts

@@ -9,4 +9,9 @@ export {
   tenantInvitationsTable,
 } from "./invitation-table";
 export { tenantMembershipsTable } from "./membership-table";
-export { tenantEntity, tenantTable } from "./schema/tenant";
+export {
+  TENANT_LIFECYCLE_STATUSES,
+  type TenantLifecycleStatus,
+  tenantEntity,
+  tenantTable,
+} from "./schema/tenant";

package/src/tenant/schema/tenant.ts

@@ -2,9 +2,21 @@ import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   createBooleanField,
   createEntity,
+  createSelectField,
   createTextField,
+  createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
 
+export const TENANT_LIFECYCLE_STATUSES = [
+  "active",
+  "destroyRequested",
+  "destroying",
+  "destroyFailed",
+  "destroyed",
+] as const;
+
+export type TenantLifecycleStatus = (typeof TENANT_LIFECYCLE_STATUSES)[number];
+
 export const tenantEntity = createEntity({
   table: "read_tenants",
   // tenant.id IS the tenantId-value that every other table references as FK.
@@ -14,6 +26,19 @@ export const tenantEntity = createEntity({
     key: createTextField({ required: true, maxLength: 50 }),
     name: createTextField({ required: true, maxLength: 200, searchable: true }),
     isEnabled: createBooleanField({ default: true }),
+    // Tenant-destroy lifecycle (tenant-lifecycle feature). Defaults keep
+    // existing tenants valid when the feature is not mounted.
+    status: createSelectField({
+      options: TENANT_LIFECYCLE_STATUSES,
+      default: "active",
+      required: true,
+      filterable: true,
+    }),
+    destroyRequestedAt: createTimestampField({}),
+    destroyRequestedBy: createTextField({ maxLength: 36 }),
+    gracePeriodEnd: createTimestampField({}),
+    destroyStartedAt: createTimestampField({}),
+    destroyedAt: createTimestampField({}),
   },
   // tenant.key wird in Admin-URLs verwendet (`admin.<host>/<key>/...`) und
   // muss eindeutig sein. Ohne unique-constraint hätte ein konkurrenter

package/src/tenant-lifecycle/__tests__/stages.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, test } from "bun:test";
+import { DESTRUCTION_STAGES, isDestructionPipelineComplete, pickNextStage } from "../stages";
+
+describe("tenant-lifecycle stages", () => {
+  test("pickNextStage halts when any stage was abandoned", () => {
+    const completed = new Set(["external-resources", "search-indices"]);
+    const abandoned = new Set(["app-data"]);
+    expect(pickNextStage(completed, abandoned)).toBeNull();
+  });
+
+  test("pickNextStage returns first incomplete stage when healthy", () => {
+    const completed = new Set(["external-resources"]);
+    expect(pickNextStage(completed, new Set())?.name).toBe("search-indices");
+  });
+
+  test("isDestructionPipelineComplete requires every stage", () => {
+    const partial = new Set(DESTRUCTION_STAGES.slice(0, 3).map((s) => s.name));
+    expect(isDestructionPipelineComplete(partial)).toBe(false);
+    const all = new Set(DESTRUCTION_STAGES.map((s) => s.name));
+    expect(isDestructionPipelineComplete(all)).toBe(true);
+  });
+});

package/src/tenant-lifecycle/__tests__/tenant-lifecycle.integration.test.ts

@@ -0,0 +1,309 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import {
+  defineFeature,
+  EXT_TENANT_DATA,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  append,
+  createEventsTable,
+  eventsTable,
+  loadAggregate,
+} from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createTestEnvelopeCipher,
+  resetTestTables,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createSessionsFeature } from "../../sessions";
+import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
+import { TenantHandlers, TenantQueries } from "../../tenant/constants";
+import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { createUserFeature } from "../../user/feature";
+import {
+  TENANT_AGGREGATE_TYPE,
+  TENANT_DESTRUCTION_FAILED_EVENT_QN,
+  TENANT_DESTRUCTION_STARTED_EVENT_QN,
+} from "../constants";
+import {
+  createTenantLifecycleFeature,
+  resolveTenantLifecycleGate,
+  TenantLifecycleHandlers,
+} from "../index";
+import { runNextDestructionStage } from "../run-tenant-destroy";
+
+const REQUEST = TenantLifecycleHandlers.requestDestruction;
+const CANCEL = TenantLifecycleHandlers.cancelDestruction;
+const SET_PROFILE = "compliance-profiles:write:set-profile";
+
+let stack: TestStack;
+let db: DbConnection;
+const tenantAdmin = TestUsers.admin;
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  const resolver = createConfigResolver({ cipher: encryption });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createSessionsFeature(),
+      createTenantLifecycleFeature(),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      resolveTenantLifecycleStatus: async (tenantId: TenantId) => {
+        const gate = await resolveTenantLifecycleGate(stack.db, tenantId);
+        return gate ? { status: gate.status } : null;
+      },
+    } as import("@cosmicdrift/kumiko-framework/api").AuthRoutesConfig,
+  });
+  db = stack.db;
+
+  await unsafeCreateEntityTable(db, tenantEntity);
+  await unsafeCreateEntityTable(db, userSessionEntity);
+  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
+  await createEventsTable(db);
+  await unsafePushTables(db, { configValuesTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  stack.events.reset();
+  await resetTestTables(db, [
+    tenantTable,
+    tenantComplianceProfileTable,
+    userSessionTable,
+    eventsTable,
+  ]);
+});
+
+async function seedTenant(): Promise<void> {
+  await stack.http.writeOk(
+    TenantHandlers.create,
+    { id: tenantAdmin.tenantId, key: "acme", name: "ACME Corp" },
+    TestUsers.systemAdmin,
+  );
+  await stack.http.writeOk(SET_PROFILE, { profileKey: "eu-dsgvo" }, tenantAdmin);
+}
+
+describe("tenant-lifecycle :: request / cancel / 410 gate", () => {
+  test("request destruction sets destroyRequested + grace", async () => {
+    await seedTenant();
+    const result = await stack.http.writeOk<{
+      status: string;
+      gracePeriodEnd: string;
+    }>(REQUEST, {}, tenantAdmin);
+    expect(result.status).toBe("destroyRequested");
+    expect(result.gracePeriodEnd).toBeTruthy();
+
+    const rows = await selectMany(db, tenantTable, { id: tenantAdmin.tenantId });
+    expect(rows[0]?.["status"]).toBe("destroyRequested");
+  });
+
+  test("API returns 410 after destruction requested", async () => {
+    await seedTenant();
+    await stack.http.writeOk(REQUEST, {}, tenantAdmin);
+
+    const res = await stack.http.query(TenantQueries.me, {}, tenantAdmin);
+    expect(res.status).toBe(410);
+  });
+
+  test("cancel within grace restores active tenant", async () => {
+    await seedTenant();
+    await stack.http.writeOk(REQUEST, {}, tenantAdmin);
+    const cancelled = await stack.http.writeOk<{ status: string }>(CANCEL, {}, tenantAdmin);
+    expect(cancelled.status).toBe("active");
+
+    const me = await stack.http.queryOk(TenantQueries.me, {}, tenantAdmin);
+    expect(me).not.toBeNull();
+  });
+
+  test("cancel after grace expired returns grace_period_expired", async () => {
+    await seedTenant();
+    await stack.http.writeOk(REQUEST, {}, tenantAdmin);
+    const past = (await import("@cosmicdrift/kumiko-framework/time"))
+      .getTemporal()
+      .Now.instant()
+      .subtract({
+        hours: 1,
+      });
+    await updateRows(db, tenantTable, { gracePeriodEnd: past }, { id: tenantAdmin.tenantId });
+
+    const err = await stack.http.writeErr(CANCEL, {}, tenantAdmin);
+    expect(err.httpStatus).toBe(422);
+    expect((err.details as { reason?: string } | undefined)?.reason).toBe("grace_period_expired");
+  });
+
+  test("non-admin cannot request destruction", async () => {
+    await seedTenant();
+    const member = createTestUser({ id: 99, roles: ["Member"] });
+    const err = await stack.http.writeErr(REQUEST, {}, member);
+    expect(err.httpStatus).toBe(403);
+  });
+});
+
+function createPoisonTenantDataFeature() {
+  return defineFeature("test-poison-tenant-data", (r) => {
+    r.requires("tenant-lifecycle");
+    r.useExtension(EXT_TENANT_DATA, "poison-pill", {
+      destroy: async () => {
+        throw new Error("poison-pill");
+      },
+    });
+  });
+}
+
+describe("tenant-lifecycle :: pipeline abandon / destroyFailed", () => {
+  let poisonStack: TestStack;
+
+  beforeAll(async () => {
+    const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+    const resolver = createConfigResolver({ cipher: encryption });
+    poisonStack = await setupTestStack({
+      features: [
+        createConfigFeature(),
+        createTenantFeature(),
+        createComplianceProfilesFeature(),
+        createTenantLifecycleFeature(),
+        createPoisonTenantDataFeature(),
+      ],
+      extraContext: { configResolver: resolver, configEncryption: encryption },
+      authConfig: {
+        resolveTenantLifecycleStatus: async (tenantId: TenantId) => {
+          const gate = await resolveTenantLifecycleGate(poisonStack.db, tenantId);
+          return gate ? { status: gate.status } : null;
+        },
+      } as import("@cosmicdrift/kumiko-framework/api").AuthRoutesConfig,
+    });
+    await unsafeCreateEntityTable(poisonStack.db, tenantEntity);
+    await unsafeCreateEntityTable(poisonStack.db, tenantComplianceProfileEntity);
+    await createEventsTable(poisonStack.db);
+    await unsafePushTables(poisonStack.db, { configValuesTable });
+  });
+
+  afterAll(async () => {
+    await poisonStack.cleanup();
+  });
+
+  beforeEach(async () => {
+    poisonStack.events.reset();
+    await resetTestTables(poisonStack.db, [tenantTable, tenantComplianceProfileTable, eventsTable]);
+  });
+
+  async function seedDestroyingTenant(): Promise<void> {
+    await poisonStack.http.writeOk(
+      TenantHandlers.create,
+      { id: tenantAdmin.tenantId, key: "acme", name: "ACME Corp" },
+      TestUsers.systemAdmin,
+    );
+    await poisonStack.http.writeOk(SET_PROFILE, { profileKey: "eu-dsgvo" }, tenantAdmin);
+    const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
+    const now = T.Now.instant();
+    await updateRows(
+      poisonStack.db,
+      tenantTable,
+      { status: "destroying", destroyStartedAt: now },
+      { id: tenantAdmin.tenantId },
+    );
+    await append(poisonStack.db, {
+      aggregateId: tenantAdmin.tenantId,
+      aggregateType: TENANT_AGGREGATE_TYPE,
+      tenantId: tenantAdmin.tenantId,
+      expectedVersion:
+        (await loadAggregate(poisonStack.db, tenantAdmin.tenantId, tenantAdmin.tenantId)).at(-1)
+          ?.version ?? 0,
+      type: TENANT_DESTRUCTION_STARTED_EVENT_QN,
+      payload: { startedAt: now.toString() },
+      metadata: { userId: "system", requestId: "test:destruction-started" },
+    });
+  }
+
+  test("abandoned app-data stage halts pipeline as destroyFailed without tombstone", async () => {
+    await seedDestroyingTenant();
+    let halted = false;
+    for (let i = 0; i < 12; i++) {
+      const result = await runNextDestructionStage({
+        db: poisonStack.db,
+        registry: poisonStack.registry,
+        tenantId: tenantAdmin.tenantId,
+      });
+      if (result.halted) {
+        halted = true;
+        break;
+      }
+      if (result.done) break;
+    }
+    expect(halted).toBe(true);
+
+    const rows = await selectMany(poisonStack.db, tenantTable, { id: tenantAdmin.tenantId });
+    expect(rows[0]?.["status"]).toBe("destroyFailed");
+    expect(rows[0]?.["destroyedAt"]).toBeNull();
+
+    const events = await selectMany(poisonStack.db, eventsTable, {
+      aggregateId: tenantAdmin.tenantId,
+    });
+    expect(events.some((e) => e["type"] === TENANT_DESTRUCTION_FAILED_EVENT_QN)).toBe(true);
+    expect(events.some((e) => String(e["type"]).includes("tenant-destruction-completed"))).toBe(
+      false,
+    );
+  });
+
+  test("destroyFailed tenant returns 410 on API", async () => {
+    await seedDestroyingTenant();
+    for (let i = 0; i < 12; i++) {
+      const result = await runNextDestructionStage({
+        db: poisonStack.db,
+        registry: poisonStack.registry,
+        tenantId: tenantAdmin.tenantId,
+      });
+      if (result.halted || result.done) break;
+    }
+    const res = await poisonStack.http.query(TenantQueries.me, {}, tenantAdmin);
+    expect(res.status).toBe(410);
+  });
+});
+
+describe("tenant-lifecycle :: batch cancel exemption", () => {
+  test("cancel via /api/batch during grace succeeds", async () => {
+    await seedTenant();
+    await stack.http.writeOk(REQUEST, {}, tenantAdmin);
+    const res = await stack.http.batch([{ type: CANCEL, payload: {} }], tenantAdmin);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      isSuccess: boolean;
+      results: Array<{ isSuccess: boolean }>;
+    };
+    expect(body.isSuccess).toBe(true);
+    expect(body.results[0]?.isSuccess).toBe(true);
+
+    const rows = await selectMany(db, tenantTable, { id: tenantAdmin.tenantId });
+    expect(rows[0]?.["status"]).toBe("active");
+  });
+});

package/src/tenant-lifecycle/constants.ts

@@ -0,0 +1,56 @@
+export const TENANT_LIFECYCLE_FEATURE = "tenant-lifecycle" as const;
+
+export const TENANT_AGGREGATE_TYPE = "tenant" as const;
+
+const EVENT_PREFIX = `${TENANT_LIFECYCLE_FEATURE}:event:` as const;
+
+export const DESTRUCTION_REQUESTED_EVENT_SHORT = "destruction-requested" as const;
+export const DESTRUCTION_CANCELLED_EVENT_SHORT = "destruction-cancelled" as const;
+export const TENANT_DESTRUCTION_STARTED_EVENT_SHORT = "tenant-destruction-started" as const;
+export const TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT =
+  "tenant-destruction-stage-started" as const;
+export const TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT =
+  "tenant-destruction-stage-succeeded" as const;
+export const TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT =
+  "tenant-destruction-stage-failed" as const;
+export const TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT =
+  "tenant-destruction-stage-abandoned" as const;
+export const TENANT_DESTRUCTION_COMPLETED_EVENT_SHORT = "tenant-destruction-completed" as const;
+export const TENANT_DESTRUCTION_FAILED_EVENT_SHORT = "tenant-destruction-failed" as const;
+
+export const DESTRUCTION_REQUESTED_EVENT_QN =
+  `${EVENT_PREFIX}${DESTRUCTION_REQUESTED_EVENT_SHORT}` as const;
+export const DESTRUCTION_CANCELLED_EVENT_QN =
+  `${EVENT_PREFIX}${DESTRUCTION_CANCELLED_EVENT_SHORT}` as const;
+export const TENANT_DESTRUCTION_STARTED_EVENT_QN =
+  `${EVENT_PREFIX}${TENANT_DESTRUCTION_STARTED_EVENT_SHORT}` as const;
+export const TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_QN =
+  `${EVENT_PREFIX}${TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT}` as const;
+export const TENANT_DESTRUCTION_STAGE_FAILED_EVENT_QN =
+  `${EVENT_PREFIX}${TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT}` as const;
+export const TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_QN =
+  `${EVENT_PREFIX}${TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT}` as const;
+export const TENANT_DESTRUCTION_COMPLETED_EVENT_QN =
+  `${EVENT_PREFIX}${TENANT_DESTRUCTION_COMPLETED_EVENT_SHORT}` as const;
+export const TENANT_DESTRUCTION_FAILED_EVENT_QN =
+  `${EVENT_PREFIX}${TENANT_DESTRUCTION_FAILED_EVENT_SHORT}` as const;
+export const TENANT_DESTRUCTION_STAGE_STARTED_EVENT_QN =
+  `${EVENT_PREFIX}${TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT}` as const;
+
+export const TenantLifecycleHandlers = {
+  requestDestruction: `${TENANT_LIFECYCLE_FEATURE}:write:request-destruction`,
+  cancelDestruction: `${TENANT_LIFECYCLE_FEATURE}:write:cancel-destruction`,
+} as const;
+
+export const TENANT_DESTRUCTION_STAGES = [
+  "external-resources",
+  "search-indices",
+  "cache",
+  "app-data",
+  "subject-keys",
+  "files",
+  "infra-resources",
+  "tenant-row",
+] as const;
+
+export type TenantDestructionStageName = (typeof TENANT_DESTRUCTION_STAGES)[number];