@cosmicdrift/kumiko-bundled-features 0.158.2 → 0.159.1

package/src/shared/__tests__/chunked-entity-migration.test.ts

@@ -0,0 +1,145 @@
+import { describe, expect, test } from "bun:test";
+import { runChunkedMigration } from "../chunked-entity-migration";
+
+describe("runChunkedMigration", () => {
+  test("processes all batches and stops with 'done' when nextBatch returns empty", async () => {
+    const batches: readonly number[][] = [[1, 2], [3], []];
+    let call = 0;
+    const migrated: number[] = [];
+
+    const result = await runChunkedMigration<number>({
+      nextBatch: async () => batches[call++] ?? [],
+      migrateRow: async (row) => {
+        migrated.push(row);
+        return "migrated";
+      },
+      maxFailures: 10,
+      deadlineAt: Number.POSITIVE_INFINITY,
+    });
+
+    expect(migrated).toEqual([1, 2, 3]);
+    expect(result).toEqual({
+      migrated: 3,
+      skipped: 0,
+      failed: 0,
+      batchesProcessed: 2,
+      stoppedReason: "done",
+    });
+  });
+
+  test("counts skipped and failed outcomes separately from migrated", async () => {
+    let call = 0;
+    const rows = [
+      { id: 1, outcome: "migrated" as const },
+      { id: 2, outcome: "skipped" as const },
+      { id: 3, outcome: "failed" as const },
+    ];
+
+    const result = await runChunkedMigration({
+      nextBatch: async () => (call++ === 0 ? rows : []),
+      migrateRow: async (row) => row.outcome,
+      maxFailures: 10,
+      deadlineAt: Number.POSITIVE_INFINITY,
+    });
+
+    expect(result.migrated).toBe(1);
+    expect(result.skipped).toBe(1);
+    expect(result.failed).toBe(1);
+    expect(result.stoppedReason).toBe("done");
+  });
+
+  test("a thrown migrateRow counts as failed and invokes onRowError", async () => {
+    let call = 0;
+    const errors: unknown[] = [];
+    const boom = new Error("boom");
+
+    const result = await runChunkedMigration<number>({
+      nextBatch: async () => (call++ === 0 ? [1] : []),
+      migrateRow: async () => {
+        throw boom;
+      },
+      maxFailures: 10,
+      deadlineAt: Number.POSITIVE_INFINITY,
+      onRowError: (row, err) => errors.push([row, err]),
+    });
+
+    expect(result.failed).toBe(1);
+    expect(errors).toEqual([[1, boom]]);
+  });
+
+  test("stops with 'too_many_failures' once failed >= maxFailures, mid-batch", async () => {
+    let call = 0;
+    const seen: number[] = [];
+
+    const result = await runChunkedMigration<number>({
+      nextBatch: async () => (call++ === 0 ? [1, 2, 3] : []),
+      migrateRow: async (row) => {
+        seen.push(row);
+        return "failed";
+      },
+      maxFailures: 2,
+      deadlineAt: Number.POSITIVE_INFINITY,
+    });
+
+    // The circuit-breaker checks before each row — row 3 is never attempted.
+    expect(seen).toEqual([1, 2]);
+    expect(result.failed).toBe(2);
+    expect(result.stoppedReason).toBe("too_many_failures");
+  });
+
+  test("stops with 'too_many_failures' checked between batches too", async () => {
+    let call = 0;
+    const batches = [["a"], ["b"], ["c"]];
+
+    const result = await runChunkedMigration<string>({
+      nextBatch: async () => batches[call++] ?? [],
+      migrateRow: async () => "failed",
+      maxFailures: 1,
+      deadlineAt: Number.POSITIVE_INFINITY,
+    });
+
+    // Batch 1 processes "a" and pushes failed to 1; the breaker is only
+    // checked at the TOP of the loop, so batch 2 is fetched (batchesProcessed
+    // becomes 2) before the breaker trips and its row is never touched.
+    expect(result.batchesProcessed).toBe(2);
+    expect(result.stoppedReason).toBe("too_many_failures");
+  });
+
+  test("stops with 'timeout' once the deadline has passed, without calling nextBatch again", async () => {
+    let nextBatchCalls = 0;
+
+    const result = await runChunkedMigration<number>({
+      nextBatch: async () => {
+        nextBatchCalls++;
+        return [];
+      },
+      migrateRow: async () => "migrated",
+      maxFailures: 10,
+      deadlineAt: Date.now() - 1,
+    });
+
+    expect(nextBatchCalls).toBe(0);
+    expect(result.batchesProcessed).toBe(0);
+    expect(result.stoppedReason).toBe("timeout");
+  });
+
+  test("stops with 'signal' when the AbortSignal is already aborted", async () => {
+    const controller = new AbortController();
+    controller.abort();
+    let nextBatchCalls = 0;
+
+    const result = await runChunkedMigration<number>({
+      nextBatch: async () => {
+        nextBatchCalls++;
+        return [];
+      },
+      migrateRow: async () => "migrated",
+      maxFailures: 10,
+      deadlineAt: Number.POSITIVE_INFINITY,
+      signal: controller.signal,
+    });
+
+    expect(nextBatchCalls).toBe(0);
+    expect(result.stoppedReason).toBe("signal");
+  });
+});

package/src/shared/decrypt-stored-pii.ts

@@ -6,14 +6,21 @@ import {
 
 // Raw reads (fetchOne/selectMany) return the stored column value — with an
 // active KMS that is ciphertext (self-describing: it names its own subject,
-// so no entity/field context is needed). An erased subject yields the
-// sentinel, which matches no real value.
-export async function decryptStoredPii(value: string, fallbackRequestId: string): Promise<string> {
+// so no entity/field context is needed for key selection). `field` must
+// still match the field name used at encrypt time — it is part of the
+// AAD (#1263), so a mismatch fails decrypt loud rather than silently
+// letting ciphertext cut-and-pasted from another field decrypt. An erased
+// subject yields the sentinel, which matches no real value.
+export async function decryptStoredPii(
+  value: string,
+  field: string,
+  fallbackRequestId: string,
+): Promise<string> {
   const kms = configuredPiiSubjectKms();
   if (!kms) return value;
-  const out = await decryptPiiFieldValues({ value }, ["value"], kms, {
+  const out = await decryptPiiFieldValues({ [field]: value }, [field], kms, {
     requestId: requestContext.get()?.requestId ?? fallbackRequestId,
   });
-  const decrypted = out["value"];
+  const decrypted = out[field];
   return typeof decrypted === "string" ? decrypted : value;
 }

package/src/subscription-mollie/__tests__/feature.test.ts

@@ -1,8 +1,13 @@
 // feature.ts contract tests for subscription-mollie.
 
 import { describe, expect, test } from "bun:test";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import type { MollieClient } from "@mollie/api-client";
+import { describeSubscriptionProviderContract } from "../../billing-foundation/__tests__/subscription-provider-contract";
 import { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "../constants";
 import { createSubscriptionMollieFeature } from "../feature";
+import { createMollieCheckoutSession } from "../plugin-methods";
+import { type MollieClientShape, verifyAndParseMollieWebhook } from "../verify-webhook";
 
 const VALID_OPTIONS = {
   apiKey: "test_dummy_apikey",
@@ -98,9 +103,91 @@ describe("subscription-mollie — plugin-registration", () => {
       createPortalSession?: unknown;
       cancelSubscription?: unknown;
     };
+    // Checks the mounted feature (the contract below builds its plugin
+    // by hand-wiring and would not catch a wiring gap here).
     expect(typeof plugin?.verifyAndParseWebhook).toBe("function");
     expect(typeof plugin?.createCheckoutSession).toBe("function");
     expect(plugin?.createPortalSession).toBeUndefined();
     expect(plugin?.cancelSubscription).toBeUndefined();
   });
 });
+
+// =============================================================================
+// SubscriptionProviderPlugin contract
+// =============================================================================
+//
+// Built directly from the plugin-method constructors (not from
+// createSubscriptionMollieFeature's mounted plugin) — same reasoning as
+// subscription-stripe's contract fixture: keeps SDK-call mocking local to
+// the fixture instead of routing through the full feature-mount.
+
+const CONTRACT_TENANT_ID = "tenant-contract";
+const CONTRACT_PRICE_ID = "plan_pro";
+
+function buildMollieContractFixture() {
+  const subscription = {
+    id: "sub_contract_001",
+    customerId: "cst_contract_001",
+    status: "active",
+    nextPaymentDate: "2026-06-15",
+    startDate: "2026-05-15",
+    metadata: { tenantId: CONTRACT_TENANT_ID, priceId: CONTRACT_PRICE_ID },
+    // biome-ignore lint/suspicious/noExplicitAny: minimal Mollie-SDK-shape mock
+  } as any;
+  const payment = {
+    id: "tr_contract_001",
+    customerId: "cst_contract_001",
+    subscriptionId: "sub_contract_001",
+    sequenceType: "first",
+    status: "paid",
+    // biome-ignore lint/suspicious/noExplicitAny: minimal Mollie-SDK-shape mock
+  } as any;
+
+  const webhookClient: MollieClientShape = {
+    payments: { get: async () => payment },
+    customerSubscriptions: {
+      get: async () => subscription,
+      list: async () => [],
+      create: async () => subscription,
+    },
+  };
+
+  const checkoutClient = {
+    customers: { create: async () => ({ id: "cus_contract" }) },
+    payments: {
+      create: async () => ({
+        getCheckoutUrl: () => "https://www.mollie.com/checkout/contract-test",
+      }),
+    },
+  } as unknown as MollieClient;
+
+  return {
+    plugin: {
+      verifyAndParseWebhook: verifyAndParseMollieWebhook(webhookClient, {
+        priceToTier: VALID_OPTIONS.priceToTier,
+        priceToConfig: VALID_OPTIONS.priceToConfig,
+      }),
+      createCheckoutSession: createMollieCheckoutSession(
+        checkoutClient,
+        VALID_OPTIONS.priceToConfig,
+        VALID_OPTIONS.webhookUrl,
+      ),
+      // createPortalSession + cancelSubscription deliberately omitted — Mollie limitation.
+    },
+    ctx: {} as HandlerContext,
+    checkout: {
+      priceId: CONTRACT_PRICE_ID,
+      tenantId: CONTRACT_TENANT_ID,
+      successUrl: "https://example.com/success",
+      cancelUrl: "https://example.com/cancel",
+    },
+    webhook: {
+      rawBody: JSON.stringify({ id: "tr_contract_001" }),
+      headers: { "content-type": "application/json" },
+      expectedTenantId: CONTRACT_TENANT_ID,
+      expectedTier: "pro",
+    },
+  };
+}
+
+describeSubscriptionProviderContract("subscription-mollie", buildMollieContractFixture);

package/src/subscription-stripe/__tests__/feature.test.ts

@@ -1,8 +1,18 @@
 // feature.ts contract tests for subscription-stripe.
 
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import Stripe from "stripe";
+import { describeSubscriptionProviderContract } from "../../billing-foundation/__tests__/subscription-provider-contract";
 import { STRIPE_PROVIDER_NAME, StripeEventTypes, SUBSCRIPTION_STRIPE_FEATURE } from "../constants";
 import { createSubscriptionStripeFeature } from "../feature";
+import {
+  createStripeCancelSubscription,
+  createStripeCheckoutSession,
+  createStripePortalSession,
+} from "../plugin-methods";
+import type { StripeCtxRuntime } from "../runtime";
+import { verifyAndParseStripeWebhook } from "../verify-webhook";
 
 const OPTIONS = {
   priceToTier: { price_test: "pro" },
@@ -69,6 +79,8 @@ describe("subscription-stripe — plugin-registration", () => {
     // "method not supported"-error brechen — type-check würde es nicht
     // fangen weil die useExtension-options als `unknown` durchgereicht
     // werden.
+    // Checks the mounted feature — the contract below builds its plugin
+    // by hand-wiring, so it would not catch a wiring gap here.
     const feature = createSubscriptionStripeFeature(OPTIONS);
     const usage = feature.extensionUsages.find((u) => u.entityName === STRIPE_PROVIDER_NAME);
     expect(usage).toBeDefined();
@@ -100,3 +112,110 @@ describe("constants — Stripe-event-types die wir mappen", () => {
     ]);
   });
 });
+
+// =============================================================================
+// SubscriptionProviderPlugin contract
+// =============================================================================
+//
+// Built directly from the plugin-method constructors (not from
+// createSubscriptionStripeFeature's mounted plugin) — the mounted plugin
+// resolves its Stripe client per-call from ctx.config/ctx.secrets, which
+// can't be spied on from outside. plugin-methods.test.ts already exercises
+// this same runtime-injection pattern for the individual methods.
+
+const CONTRACT_API_KEY = "sk_test_contract_dummy";
+const CONTRACT_WEBHOOK_SECRET = "whsec_contract_test_secret";
+
+function contractCtxRuntime(stripe: Stripe): StripeCtxRuntime {
+  return { clientForCtx: async () => stripe, assertBillingLive: async () => {} };
+}
+
+async function buildStripeContractFixture() {
+  const stripe = new Stripe(CONTRACT_API_KEY);
+  spyOn(stripe.checkout.sessions, "create").mockResolvedValue({
+    url: "https://checkout.stripe.com/c/pay/contract-test",
+    // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
+  } as any);
+  spyOn(stripe.billingPortal.sessions, "create").mockResolvedValue({
+    url: "https://billing.stripe.com/p/session/contract-test",
+    // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
+  } as any);
+  spyOn(stripe.subscriptions, "cancel").mockResolvedValue({
+    id: "sub_contract",
+    status: "canceled",
+    // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
+  } as any);
+  const runtime = contractCtxRuntime(stripe);
+
+  const stripeForWebhookFixture = new Stripe(CONTRACT_API_KEY);
+  const webhookEvent = {
+    id: "evt_contract_001",
+    object: "event",
+    api_version: "2026-04-22.dahlia",
+    created: 1_770_000_000,
+    type: StripeEventTypes.customerSubscriptionCreated,
+    livemode: false,
+    pending_webhooks: 1,
+    request: { id: null, idempotency_key: null },
+    data: {
+      object: {
+        id: "sub_contract_001",
+        object: "subscription",
+        customer: "cus_contract_001",
+        status: "active",
+        metadata: { tenantId: "tenant-contract" },
+        items: {
+          object: "list",
+          data: [
+            {
+              id: "si_contract",
+              object: "subscription_item",
+              current_period_end: 1_780_000_000,
+              price: { id: "price_test", object: "price" },
+            },
+          ],
+          has_more: false,
+        },
+      },
+    },
+  };
+  const rawBody = JSON.stringify(webhookEvent);
+  const signature = await stripeForWebhookFixture.webhooks.generateTestHeaderStringAsync({
+    payload: rawBody,
+    secret: CONTRACT_WEBHOOK_SECRET,
+  });
+
+  return {
+    plugin: {
+      verifyAndParseWebhook: verifyAndParseStripeWebhook(
+        {
+          resolve: async () => ({
+            stripe: stripeForWebhookFixture,
+            webhookSecret: CONTRACT_WEBHOOK_SECRET,
+          }),
+        },
+        { priceToTier: OPTIONS.priceToTier },
+      ),
+      createCheckoutSession: createStripeCheckoutSession(runtime),
+      createPortalSession: createStripePortalSession(runtime),
+      cancelSubscription: createStripeCancelSubscription(runtime),
+    },
+    ctx: {} as HandlerContext,
+    checkout: {
+      priceId: "price_test",
+      tenantId: "tenant-contract",
+      successUrl: "https://example.com/success",
+      cancelUrl: "https://example.com/cancel",
+    },
+    portal: { providerCustomerId: "cus_contract", returnUrl: "https://example.com/return" },
+    cancelSubscriptionId: "sub_contract",
+    webhook: {
+      rawBody,
+      headers: { "stripe-signature": signature },
+      expectedTenantId: "tenant-contract",
+      expectedTier: "pro",
+    },
+  };
+}
+
+describeSubscriptionProviderContract("subscription-stripe", buildStripeContractFixture);

package/src/tenant/__tests__/members-query-kms.integration.test.ts

@@ -0,0 +1,98 @@
+// members.query.ts's decrypt-on-read fix (#1252): before the fix, an
+// active PII-subject KMS meant the query returned raw ciphertext for
+// email/displayName instead of decrypting them like every other PII read
+// path. This pins the decrypt-on-read roundtrip with a real KMS adapter
+// configured, so a later refactor can't silently re-introduce the
+// ciphertext leak.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { configValuesTable } from "../../config/table";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { seedUser } from "../../user/seeding";
+import { TenantQueries } from "../constants";
+import { createTenantFeature } from "../feature";
+import { tenantMembershipsTable } from "../membership-table";
+import { tenantEntity } from "../schema/tenant";
+import { seedTenant, seedTenantMembership } from "../seeding";
+
+const tenantId = testTenantId(1) as TenantId;
+
+let stack: TestStack;
+
+function tenantAdmin(userId: string): SessionUser {
+  return { id: userId, tenantId, roles: ["TenantAdmin"] };
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createConfigFeature(), createUserFeature(), createTenantFeature()],
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [userTable, tenantMembershipsTable]);
+  await seedTenant(stack.db, { id: tenantId, key: "tenant-kms-members", name: "KMS Tenant" });
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("members query — decrypt-on-read with an active KMS (#1252)", () => {
+  test("email and displayName come back as plaintext, not ciphertext", async () => {
+    // KMS active BEFORE the seed — seedUser runs through the executor, so
+    // the row reflects the encrypted prod state.
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+    const { id: userId } = await seedUser(stack.db, {
+      email: "kms-member@example.com",
+      displayName: "KMS Member",
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, { userId, tenantId, roles: ["User"] });
+
+    // Prove the row is actually ciphertext at rest — otherwise a no-op
+    // encryption path would make this test pass while proving nothing.
+    const rawRows = await selectMany<{ email: unknown; displayName: unknown }>(
+      stack.db,
+      userTable,
+      {
+        id: userId,
+      },
+    );
+    expect(isPiiCiphertext(rawRows[0]?.email)).toBe(true);
+    expect(isPiiCiphertext(rawRows[0]?.displayName)).toBe(true);
+
+    const members = await stack.http.queryOk<
+      readonly { userId: string; email: string | null; displayName: string | null }[]
+    >(TenantQueries.members, {}, tenantAdmin(userId));
+
+    const self = members.find((m) => m.userId === userId);
+    expect(self?.email).toBe("kms-member@example.com");
+    expect(self?.displayName).toBe("KMS Member");
+  });
+});

package/src/tenant/handlers/invitations.query.ts

@@ -31,10 +31,12 @@ export const invitationsQuery = defineQueryHandler({
       const email = row["email"];
       const invitedBy = row["invitedBy"];
       const decryptedEmail =
-        typeof email === "string" ? await decryptStoredPii(email, "tenant:invitations") : email;
+        typeof email === "string"
+          ? await decryptStoredPii(email, "email", "tenant:invitations")
+          : email;
       const decryptedInvitedBy =
         typeof invitedBy === "string"
-          ? await decryptStoredPii(invitedBy, "tenant:invitations")
+          ? await decryptStoredPii(invitedBy, "invitedBy", "tenant:invitations")
           : invitedBy;
       out.push({ ...row, email: decryptedEmail, invitedBy: decryptedInvitedBy });
     }

package/src/tenant/handlers/members.query.ts

@@ -33,11 +33,11 @@ export const membersQuery = defineQueryHandler({
     for (const user of users) {
       const email =
         typeof user.email === "string"
-          ? await decryptStoredPii(user.email, "tenant:members")
+          ? await decryptStoredPii(user.email, "email", "tenant:members")
           : null;
       const displayName =
         typeof user.displayName === "string"
-          ? await decryptStoredPii(user.displayName, "tenant:members")
+          ? await decryptStoredPii(user.displayName, "displayName", "tenant:members")
           : null;
       decryptedByUserId.set(String(user.id), { email, displayName });
     }

package/src/tenant/seeding.ts

@@ -35,7 +35,7 @@ import {
   type DbRunner,
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { getAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
+import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import { assertAssignableMembershipRoles } from "./membership-roles";
 import { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table";
@@ -99,7 +99,7 @@ export async function seedTenant(
   // (Projection-Drift nach rebuild, manuellem DELETE, oder async-lag). Wenn
   // Stream-Version > 0 → kein create() — wäre version_conflict. Caller
   // bekommt die ID, Projection wird beim nächsten Dispatcher-Cycle aufgebaut.
-  const streamVersion = await getAggregateStreamMaxVersion(db, options.id);
+  const streamVersion = await getUnscopedAggregateStreamMaxVersion(db, options.id);
   if (streamVersion > 0) return { id: options.id };
 
   const result = await tenantExecutor.create(

package/src/tenant-lifecycle/__tests__/tenant-lifecycle.integration.test.ts

@@ -1,5 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -76,6 +77,7 @@ beforeAll(async () => {
       createUserFeature(),
       createTenantFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createTenantLifecycleFeature(),
     ],

package/src/tenant-lifecycle/boot-checks.ts

@@ -0,0 +1,53 @@
+import {
+  type EntityDefinition,
+  EXT_TENANT_DATA,
+  type FeatureDefinition,
+  type PiiAnnotations,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// r.entity(...) is not the only way a feature exposes an entity shape:
+// r.projection(...) can carry an optional `entity` too (raw read-models with
+// no executor, e.g. billing-foundation's subscription table). Need every
+// entity a feature declares, not just the r.entity ones, or a tenantOwned
+// field on a projection-only entity is invisible to the guard below.
+function entitiesOf(
+  feature: FeatureDefinition,
+): ReadonlyArray<readonly [string, EntityDefinition]> {
+  const fromEntities = Object.entries(feature.entities ?? {});
+  const fromProjections = Object.values(feature.projections ?? {})
+    .filter((p): p is typeof p & { entity: EntityDefinition } => p.entity !== undefined)
+    .map((p) => [p.name, p.entity] as const);
+  return [...fromEntities, ...fromProjections];
+}
+
+// V4: tenantOwned-entity-without-hook gate. Mirrors user-data-rights' V3
+// (validateGdprPiiHookCoverage) but for EXT_TENANT_DATA. Registered as this
+// feature's own `r.bootCheck()` (#1314, moved off the framework-internal
+// boot-validator) — tenant-lifecycle owns EXT_TENANT_DATA
+// (r.extendsRegistrar), so its own mount is the trigger, matching the
+// original guard's "tenant-lifecycle mounted" gate exactly (unlike gating on
+// a sibling feature, which would silently narrow coverage).
+export function validateTenantDataHookCoverage(features: readonly FeatureDefinition[]): void {
+  const hookedEntities = new Set<string>();
+  for (const f of features) {
+    for (const usage of f.extensionUsages) {
+      if (usage.extensionName === EXT_TENANT_DATA) hookedEntities.add(usage.entityName);
+    }
+  }
+
+  for (const feature of features) {
+    for (const [entityName, entity] of entitiesOf(feature)) {
+      if (hookedEntities.has(entityName)) continue;
+      const tenantSubjectFields = Object.entries(entity.fields)
+        .filter(([, field]) => {
+          const annot = field as PiiAnnotations;
+          return Boolean(annot.tenantOwned);
+        })
+        .map(([name]) => name);
+      if (tenantSubjectFields.length === 0) continue;
+      throw new Error(
+        `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has tenant-subject fields (${tenantSubjectFields.join(", ")}) but no feature registers an EXT_TENANT_DATA destroy hook for it — tenant destroy never erases this data. Register r.useExtension(EXT_TENANT_DATA, "${entityName}", { destroy }) or a documented no-op if crypto-shredding covers it.`,
+      );
+    }
+  }
+}

package/src/tenant-lifecycle/feature.ts

@@ -7,6 +7,7 @@ import {
   EXT_TENANT_DATA,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { validateTenantDataHookCoverage } from "./boot-checks";
 import {
   DESTRUCTION_CANCELLED_EVENT_SHORT,
   DESTRUCTION_REQUESTED_EVENT_SHORT,
@@ -53,6 +54,12 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
     r.extendsRegistrar(EXT_STORAGE_PROVIDER, {});
     r.extendsRegistrar(EXT_INFRA_RESOURCE, {});
 
+    // GDPR-storage guard V4 (#1314) — moved off the framework-internal
+    // boot-validator onto this feature's own r.bootCheck(), since it owns
+    // EXT_TENANT_DATA: its own mount is the trigger, matching the original
+    // guard's "tenant-lifecycle mounted" gate exactly.
+    r.bootCheck(({ features }) => validateTenantDataHookCoverage(features));
+
     r.defineEvent(DESTRUCTION_REQUESTED_EVENT_SHORT, destructionRequestedSchema);
     r.defineEvent(DESTRUCTION_CANCELLED_EVENT_SHORT, destructionCancelledSchema);
     r.defineEvent(TENANT_DESTRUCTION_STARTED_EVENT_SHORT, tenantDestructionStartedSchema);

package/src/tenant-lifecycle/handlers/request-destruction.write.ts

@@ -67,7 +67,7 @@ export const requestDestructionWrite = defineWriteHandler({
       },
     });
 
-    if (ctx.hasFeature("sessions")) {
+    if (await ctx.hasFeature("sessions")) {
       await revokeTenantSessions(ctx.db.raw, tenantId);
     }