@cosmicdrift/kumiko-bundled-features 0.165.0 → 2.0.0

package/src/shared/map-with-concurrency.ts

@@ -0,0 +1,38 @@
+// Bounded-concurrency map — runs `fn` over `items` with at most `limit`
+// calls in flight. `Promise.all(items.map(fn))` is unbounded (as many
+// calls as rows); a plain sequential loop caps concurrency at 1, which
+// under-uses a resource pool that allows more (e.g. PgKmsAdapter's
+// default `max: 4` — sequential decrypt-per-row leaves 3 pool slots idle
+// and turns each query into 2N serial round-trips instead of ~2N/4).
+// Order of `results` matches `items`, independent of completion order.
+// On rejection: the returned promise rejects with the first error, and
+// remaining workers stop claiming new items (`failed` flag). In-flight
+// calls already past the claim still run to completion (their promises
+// stay in the `Promise.all` array, so a later rejection can't surface as
+// an unhandled rejection — verified in `mapWithConcurrency.test.ts`).
+export async function mapWithConcurrency<T, R>(
+  items: readonly T[],
+  limit: number,
+  fn: (item: T, index: number) => Promise<R>,
+): Promise<R[]> {
+  const results: R[] = new Array(items.length);
+  let nextIndex = 0;
+  let failed = false;
+  async function worker(): Promise<void> {
+    for (;;) {
+      // skip: another worker already failed — stop claiming new items.
+      if (failed) return;
+      const index = nextIndex++;
+      // skip: cursor exhausted, normal worker-loop exit
+      if (index >= items.length) return;
+      try {
+        results[index] = await fn(items[index] as T, index);
+      } catch (err) {
+        failed = true;
+        throw err;
+      }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  return results;
+}

package/src/subscription-mollie/__tests__/feature.test.ts

@@ -2,7 +2,11 @@
 
 import { describe, expect, test } from "bun:test";
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
-import type { MollieClient } from "@mollie/api-client";
+import type {
+  MollieClient,
+  Payment as MolliePayment,
+  Subscription as MollieSubscription,
+} from "@mollie/api-client";
 import { describeSubscriptionProviderContract } from "../../billing-foundation/__tests__/subscription-provider-contract";
 import { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "../constants";
 import { createSubscriptionMollieFeature } from "../feature";
@@ -132,16 +136,18 @@ function buildMollieContractFixture() {
     nextPaymentDate: "2026-06-15",
     startDate: "2026-05-15",
     metadata: { tenantId: CONTRACT_TENANT_ID, priceId: CONTRACT_PRICE_ID },
-    // biome-ignore lint/suspicious/noExplicitAny: minimal Mollie-SDK-shape mock
-  } as any;
+    // Minimal Mollie-SDK-shape mock — full Subscription has more fields
+    // than the plugin reads; double-cast at the test/SDK boundary instead
+    // of `as any` per coding-standards.
+  } as unknown as MollieSubscription;
   const payment = {
     id: "tr_contract_001",
     customerId: "cst_contract_001",
     subscriptionId: "sub_contract_001",
     sequenceType: "first",
     status: "paid",
-    // biome-ignore lint/suspicious/noExplicitAny: minimal Mollie-SDK-shape mock
-  } as any;
+    // Minimal Mollie-SDK-shape mock, see subscription above.
+  } as unknown as MolliePayment;
 
   const webhookClient: MollieClientShape = {
     payments: { get: async () => payment },
@@ -190,4 +196,8 @@ function buildMollieContractFixture() {
   };
 }
 
-describeSubscriptionProviderContract("subscription-mollie", buildMollieContractFixture);
+describeSubscriptionProviderContract("subscription-mollie", buildMollieContractFixture, {
+  // Mollie has no customer-portal or programmatic cancel API.
+  hasPortal: false,
+  hasCancel: false,
+});

package/src/subscription-mollie/__tests__/verify-webhook.test.ts

@@ -347,6 +347,27 @@ describe("verifyAndParseMollieWebhook — error + ignore paths", () => {
   });
 });
 
+describe("verifyAndParseMollieWebhook — kumiko-framework#1525: no ambient Temporal global", () => {
+  const verify = (client: MollieClientShape) =>
+    verifyAndParseMollieWebhook(client, {
+      priceToTier: { plan_pro: "pro" },
+      priceToConfig: TEST_PRICE_CONFIG,
+    });
+
+  test("computes currentPeriodEnd without relying on globalThis.Temporal", async () => {
+    const client = buildClient();
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const event = await verify(client)("id=tr_test_001", {});
+      expect(event?.currentPeriodEnd).toBe("2026-06-15T00:00:00Z");
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});
+
 // =============================================================================
 // Mapping-helpers
 // =============================================================================

package/src/subscription-mollie/verify-webhook.ts

@@ -25,6 +25,7 @@ import type {
   Payment as MolliePayment,
   Subscription as MollieSubscription,
 } from "@mollie/api-client";
+import { Temporal } from "temporal-polyfill";
 import { MOLLIE_PROVIDER_NAME } from "./constants";
 import type { MolliePriceConfig } from "./plugin-methods";
 

package/src/subscription-stripe/__tests__/feature.test.ts

@@ -134,17 +134,21 @@ async function buildStripeContractFixture() {
   const stripe = new Stripe(CONTRACT_API_KEY);
   spyOn(stripe.checkout.sessions, "create").mockResolvedValue({
     url: "https://checkout.stripe.com/c/pay/contract-test",
-    // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
-  } as any);
+    // Only `.url` is read by createStripeCheckoutSession. mockResolvedValue
+    // wants Stripe.Response<Session> (adds lastResponse metadata) — the SDK
+    // wrapper type makes a structural mock impractical, so double-cast at
+    // the test/SDK boundary instead of `as any`.
+  } as unknown as Stripe.Response<Stripe.Checkout.Session>);
   spyOn(stripe.billingPortal.sessions, "create").mockResolvedValue({
     url: "https://billing.stripe.com/p/session/contract-test",
-    // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
-  } as any);
+    // Only `.url` is read by createStripePortalSession, see above.
+  } as unknown as Stripe.Response<Stripe.BillingPortal.Session>);
   spyOn(stripe.subscriptions, "cancel").mockResolvedValue({
     id: "sub_contract",
     status: "canceled",
-    // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
-  } as any);
+    // Return value isn't read by createStripeCancelSubscription (fire-and-
+    // forget) — double-cast at the test/SDK boundary instead of `as any`.
+  } as unknown as Stripe.Response<Stripe.Subscription>);
   const runtime = contractCtxRuntime(stripe);
 
   const stripeForWebhookFixture = new Stripe(CONTRACT_API_KEY);
@@ -218,4 +222,7 @@ async function buildStripeContractFixture() {
   };
 }
 
-describeSubscriptionProviderContract("subscription-stripe", buildStripeContractFixture);
+describeSubscriptionProviderContract("subscription-stripe", buildStripeContractFixture, {
+  hasPortal: true,
+  hasCancel: true,
+});

package/src/subscription-stripe/__tests__/verify-webhook.test.ts

@@ -255,6 +255,26 @@ describe("verifyAndParseStripeWebhook — tenant-resolution + price-to-tier", ()
   });
 });
 
+describe("verifyAndParseStripeWebhook — kumiko-framework#1525: no ambient Temporal global", () => {
+  test("computes currentPeriodEnd without relying on globalThis.Temporal", async () => {
+    const verify = verifyAndParseStripeWebhook(webhookRuntime(), {
+      priceToTier: { price_pro_monthly: "pro" },
+    });
+    const payload = JSON.stringify(buildSubscriptionEvent({ currentPeriodEndUnix: 1_780_000_000 }));
+    const sig = await signEvent(payload);
+
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const event = await verify(payload, { "stripe-signature": sig });
+      expect(event?.currentPeriodEnd).toBe("2026-05-28T20:26:40Z");
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});
+
 // =============================================================================
 // Mapping-helpers (pure functions, kein Stripe-mock nötig)
 // =============================================================================

package/src/subscription-stripe/verify-webhook.ts

@@ -40,6 +40,7 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type Stripe from "stripe";
+import { Temporal } from "temporal-polyfill";
 import { STRIPE_PROVIDER_NAME, StripeEventTypes } from "./constants";
 import type { StripeWebhookRuntime } from "./runtime";
 
@@ -138,8 +139,8 @@ export function verifyAndParseStripeWebhook(
     const status = mapStripeStatus(sub.status);
     const periodEndUnixSec = sub.items.data[0]?.current_period_end ?? 0;
     // Stripe returns Unix-seconds; Temporal.Instant.fromEpochMilliseconds
-    // expects ms. Multiply, then ISO. (No-Date-API-Guard verbietet
-    // `new Date()` — Temporal ist global verfügbar via polyfill.)
+    // expects ms. Multiply, then ISO. (No-Date-API-Guard forbids
+    // `new Date()` — static import above, not the ambient global, see #1490.)
     const currentPeriodEnd = Temporal.Instant.fromEpochMilliseconds(
       periodEndUnixSec * 1000,
     ).toString();

package/src/tenant/__tests__/members-query-kms.integration.test.ts

@@ -13,7 +13,7 @@ import {
   isPiiCiphertext,
   resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
   type TestStack,
@@ -33,7 +33,7 @@ import { tenantMembershipsTable } from "../membership-table";
 import { tenantEntity } from "../schema/tenant";
 import { seedTenant, seedTenantMembership } from "../seeding";
 
-const tenantId = testTenantId(1) as TenantId;
+const tenantId = testTenantId(1);
 
 let stack: TestStack;
 

package/src/tenant/__tests__/multi-tenant.integration.test.ts

@@ -96,7 +96,7 @@ beforeAll(async () => {
           ...bridgeStub(),
         },
       );
-      return result as number[];
+      return result as TenantId[];
     },
   });
 

package/src/tenant/handlers/active-tenant-ids.query.ts

@@ -1,5 +1,9 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler, SYSTEM_ROLE } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  defineQueryHandler,
+  SYSTEM_ROLE,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import { tenantTable } from "../schema/tenant";
 
@@ -8,7 +12,9 @@ export const activeTenantIdsQuery = defineQueryHandler({
   schema: z.object({}),
   access: { roles: [SYSTEM_ROLE, "SystemAdmin"] },
   handler: async (_query, ctx) => {
-    const rows = await selectMany<{ id: number }>(ctx.db, tenantTable, { isEnabled: true });
+    // tenants.id is a uuid string (TenantId), not a numeric surrogate.
+    // Brand at the DB parse boundary — getActiveTenantIds consumers expect TenantId[].
+    const rows = await selectMany<{ id: TenantId }>(ctx.db, tenantTable, { isEnabled: true });
     return rows.map((r) => r.id);
   },
 });

package/src/tenant/handlers/invitations.query.ts

@@ -1,9 +1,16 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
-import { decryptStoredPii } from "../../shared";
+import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table";
 
+// Bounded, not Promise.all/sequential: each decrypt hits the KMS adapter's
+// own small dedicated pool (PgKmsAdapter default max: 4). Promise.all fires
+// one call per row unbounded and exhausts the pool once invitation counts
+// exceed a handful, surfacing as "the connection was closed"; a strict
+// sequential loop caps concurrency at 1 and leaves 3 pool slots idle.
+const KMS_POOL_CONCURRENCY = 4;
+
 // Pending-Invitations-Liste für den aktuellen Tenant. Admin-only.
 // Filter: status="pending" — accepted/cancelled/expired sind für die
 // UI uninteressant (UI zeigt nur "ausstehende Einladungen"; Audit-Log
@@ -22,24 +29,15 @@ export const invitationsQuery = defineQueryHandler({
       tenantId: query.user.tenantId,
       status: INVITATION_STATUS.pending,
     });
-    // Sequential, not Promise.all: each decrypt hits the KMS adapter's own
-    // small dedicated pool (PgKmsAdapter default max: 4) — firing 2 calls
-    // per row concurrently for every row exhausts it once invitation counts
-    // exceed a handful, surfacing as "the connection was closed".
-    const out: Record<string, unknown>[] = [];
-    for (const row of rows ?? []) {
+    return mapWithConcurrency(rows ?? [], KMS_POOL_CONCURRENCY, async (row) => {
       const email = row["email"];
-      const invitedBy = row["invitedBy"];
       const decryptedEmail =
         typeof email === "string"
           ? await decryptStoredPii(email, "email", "tenant:invitations")
           : email;
-      const decryptedInvitedBy =
-        typeof invitedBy === "string"
-          ? await decryptStoredPii(invitedBy, "invitedBy", "tenant:invitations")
-          : invitedBy;
-      out.push({ ...row, email: decryptedEmail, invitedBy: decryptedInvitedBy });
-    }
-    return out;
+      // invitedBy is a plain userId (invitation-table.ts: no `pii: true`) —
+      // never encrypted at write time, so it needs no decrypt (#1252).
+      return { ...row, email: decryptedEmail };
+    });
   },
 });

package/src/tenant/handlers/members.query.ts

@@ -2,12 +2,19 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
-import { decryptStoredPii } from "../../shared";
+import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { userTable } from "../../user";
 import { tenantMembershipsTable } from "../membership-table";
 
 type UserRow = { readonly id: unknown; readonly email?: unknown; readonly displayName?: unknown };
 
+// Bounded, not Promise.all/sequential: each decrypt hits the KMS adapter's
+// own small dedicated pool (PgKmsAdapter default max: 4). Promise.all fires
+// one call per user unbounded and exhausts the pool once membership counts
+// exceed a handful, surfacing as "the connection was closed"; a strict
+// sequential loop caps concurrency at 1 and leaves 3 pool slots idle.
+const KMS_POOL_CONCURRENCY = 4;
+
 export const membersQuery = defineQueryHandler({
   name: "members",
   schema: z.object({}),
@@ -22,15 +29,7 @@ export const membersQuery = defineQueryHandler({
       userIds.length > 0 ? await selectMany<UserRow>(ctx.db, userTable, { id: userIds }) : [];
     const userById = new Map(users.map((u) => [String(u.id), u]));
 
-    // Sequential, not Promise.all: each decrypt hits the KMS adapter's own
-    // small dedicated pool (PgKmsAdapter default max: 4) — firing 2 calls
-    // per row concurrently for every row exhausts it once membership counts
-    // exceed a handful, surfacing as "the connection was closed".
-    const decryptedByUserId = new Map<
-      string,
-      { email: string | null; displayName: string | null }
-    >();
-    for (const user of users) {
+    const decrypted = await mapWithConcurrency(users, KMS_POOL_CONCURRENCY, async (user) => {
       const email =
         typeof user.email === "string"
           ? await decryptStoredPii(user.email, "email", "tenant:members")
@@ -39,8 +38,9 @@ export const membersQuery = defineQueryHandler({
         typeof user.displayName === "string"
           ? await decryptStoredPii(user.displayName, "displayName", "tenant:members")
           : null;
-      decryptedByUserId.set(String(user.id), { email, displayName });
-    }
+      return { userId: String(user.id), email, displayName };
+    });
+    const decryptedByUserId = new Map(decrypted.map((d) => [d.userId, d]));
 
     return rows.map((row) => {
       const user = userById.get(String(row["userId"]));

package/src/tenant/seeding.ts

@@ -38,6 +38,7 @@ import {
   type AppContext,
   HookPhases,
   type Registry,
+  type SaveContext,
   type SessionUser,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -94,6 +95,104 @@ export type SeedTenantHooks = {
   readonly context: AppContext;
 };
 
+// Shared by seedTenant/seedTenantMembership/auth-email-password's
+// seedUserWithPassword: fires the same entity-scoped postSave hooks the
+// real dispatcher would (registry.getEntityPostSaveHooks by entityName),
+// just without the full HTTP/JWT roundtrip a fixture doesn't need. Fresh
+// lifecycle-hooks instance per call, no systemHooks — only feature-
+// registered entity/handler hooks fire (search-index/SSE system hooks are
+// wired at server-boot and out of reach here).
+//
+// Tenant re-scope (#1566): when `targetTenantId` is set we rebuild the
+// tenant-bound pieces of the context (`_tenantId`, `db`, `notify`,
+// `hasFeature`, `user.tenantId`) — a shallow `{ ...ctx, _tenantId }` left
+// closures over the caller's tenant (self-signup is anonymous/system).
+// `query`/`write` bridges still share the caller's identity; hooks that
+// need a full identity switch use `writeAs`/`queryAs`.
+//
+// afterCommit (#1566): when `hooks.context.scheduleAfterCommit` is present
+// (HandlerContext from a live write), afterCommit hooks are queued onto the
+// dispatcher's sink and flush post-commit. Without a sink (fixture / plain
+// Connection) they still fire immediately — there is no outer TX to wait for.
+function resolveRawDb(db: AppContext["db"]): DbRunner | undefined {
+  if (!db) return undefined;
+  if (typeof db === "object" && "raw" in db) {
+    return (db as { raw: DbRunner }).raw;
+  }
+  return db as DbRunner;
+}
+
+function scopeSeedHookContext(context: AppContext, targetTenantId: TenantId): AppContext {
+  const raw = resolveRawDb(context.db);
+  const db = raw
+    ? createTenantDb(raw, targetTenantId, "system", context.tracer, context.meter, context.signal)
+    : context.db;
+
+  // HandlerContext carries `user`; AppContext only `systemUser`. Prefer the
+  // live handler user when present so notify/hasFeature keep a real SessionUser.
+  const handlerUser = (context as { user?: SessionUser }).user;
+  const baseUser: SessionUser | undefined = handlerUser ?? context.systemUser;
+  const scopedUser: SessionUser | undefined = baseUser
+    ? { ...baseUser, tenantId: targetTenantId }
+    : undefined;
+
+  const notify =
+    context._notifyFactory && scopedUser
+      ? context._notifyFactory(scopedUser, targetTenantId)
+      : context.notify;
+
+  const features = context.effectiveFeatures as
+    | (((tenantId: TenantId) => ReadonlySet<string>) & {
+        trialGate?: (tenantId: TenantId, featureName: string) => Promise<boolean>;
+      })
+    | undefined;
+  const hasFeature = features
+    ? async (featureName: string): Promise<boolean> => {
+        if (features(targetTenantId).has(featureName)) return true;
+        if (!features.trialGate) return false;
+        return features.trialGate(targetTenantId, featureName);
+      }
+    : "hasFeature" in context
+      ? // Keep caller's hasFeature when no effectiveFeatures (always-on apps).
+        (context as { hasFeature?: (n: string) => Promise<boolean> }).hasFeature
+      : undefined;
+
+  return {
+    ...context,
+    _tenantId: targetTenantId,
+    ...(db !== undefined ? { db } : {}),
+    ...(notify !== undefined ? { notify } : {}),
+    ...(scopedUser && "user" in context ? { user: scopedUser } : {}),
+    ...(hasFeature ? { hasFeature } : {}),
+  };
+}
+
+export async function fireEntityPostSave(
+  hooks: SeedTenantHooks | undefined,
+  pseudoType: string,
+  entityData: SaveContext,
+  // Undefined for tenant-agnostic entities (user has no tenant_id column at
+  // seed time) — keeps hooks.context._tenantId as the caller passed it.
+  targetTenantId?: TenantId,
+): Promise<void> {
+  // skip: caller opted out of hooks (existing fixture/test call-sites that
+  // don't pass them keep today's hook-less behavior, see seedTenant's doc).
+  if (!hooks) return;
+  const lifecycle = createLifecycleHooks(hooks.registry);
+  const scopedContext =
+    targetTenantId === undefined
+      ? hooks.context
+      : scopeSeedHookContext(hooks.context, targetTenantId);
+  await lifecycle.runPostSave(pseudoType, entityData, scopedContext, HookPhases.inTransaction);
+  const runAfterCommit = () =>
+    lifecycle.runPostSave(pseudoType, entityData, scopedContext, HookPhases.afterCommit);
+  if (scopedContext.scheduleAfterCommit) {
+    scopedContext.scheduleAfterCommit(runAfterCommit);
+  } else {
+    await runAfterCommit();
+  }
+}
+
 /**
  * Seed a tenant through the event-store executor. Idempotent add-only:
  * a second call for the same `id` is a no-op (no update path). Same
@@ -134,22 +233,10 @@ export async function seedTenant(
     );
   }
 
-  if (hooks) {
-    // Fresh instance per call, no systemHooks — only feature-registered
-    // entity/handler hooks fire (search-index/SSE system hooks are wired
-    // at server-boot and out of reach here, same as before this fix).
-    // "tenant:seed" matches no handler-scoped hook, only entity-scoped ones
-    // (keyed by result.entityName === "tenant") — that's exactly what
-    // tier-engine's `r.hook("postSave", { allOf: "tenant" }, ...)` needs.
-    const lifecycle = createLifecycleHooks(hooks.registry);
-    await lifecycle.runPostSave(
-      "tenant:seed",
-      result.data,
-      hooks.context,
-      HookPhases.inTransaction,
-    );
-    await lifecycle.runPostSave("tenant:seed", result.data, hooks.context, HookPhases.afterCommit);
-  }
+  // "tenant:seed" matches no handler-scoped hook, only entity-scoped ones
+  // (keyed by result.entityName === "tenant") — that's exactly what
+  // tier-engine's `r.hook("postSave", { allOf: "tenant" }, ...)` needs.
+  await fireEntityPostSave(hooks, "tenant:seed", result.data, options.id);
 
   return { id: options.id };
 }
@@ -166,6 +253,12 @@ export async function seedTenant(
 export async function seedTenantMembership(
   db: DbRunner,
   options: SeedTenantMembershipOptions,
+  // Optional, append-only — same rationale as seedTenant's hooks param
+  // (#1478): fires tenantMembership's postSave hooks (e.g. a Welcome-
+  // notification or default-notification-preferences hook keyed off
+  // `allOf: "tenantMembership"`) for fixtures/self-signup that opt in.
+  // Omit to keep today's hook-less behavior.
+  hooks?: SeedTenantHooks,
 ): Promise<{ id: string }> {
   // Chokepoint: invite-accept (×3) + seedAdmin/provisionSignup all flow
   // through here — reject reserved/global roles before they ever persist.
@@ -203,6 +296,7 @@ export async function seedTenantMembership(
       `seedTenantMembership failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
     );
   }
+  await fireEntityPostSave(hooks, "tenant-membership:seed", result.data, options.tenantId);
   return { id: extractMembershipId(result.data) };
 }
 

package/src/tenant-lifecycle/boot-checks.ts

@@ -12,6 +12,16 @@ import { entitiesOf } from "../shared";
 // (r.extendsRegistrar), so its own mount is the trigger, matching the
 // original guard's "tenant-lifecycle mounted" gate exactly (unlike gating on
 // a sibling feature, which would silently narrow coverage).
+
+function hasTenantOwned(field: unknown): field is PiiAnnotations {
+  return (
+    typeof field === "object" &&
+    field !== null &&
+    "tenantOwned" in field &&
+    (field as { tenantOwned?: unknown }).tenantOwned === true
+  );
+}
+
 export function validateTenantDataHookCoverage(features: readonly FeatureDefinition[]): void {
   const hookedEntities = new Set<string>();
   for (const f of features) {
@@ -24,10 +34,7 @@ export function validateTenantDataHookCoverage(features: readonly FeatureDefinit
     for (const [entityName, entity] of entitiesOf(feature)) {
       if (hookedEntities.has(entityName)) continue;
       const tenantSubjectFields = Object.entries(entity.fields)
-        .filter(([, field]) => {
-          const annot = field as PiiAnnotations;
-          return Boolean(annot.tenantOwned);
-        })
+        .filter(([, field]) => hasTenantOwned(field))
         .map(([name]) => name);
       if (tenantSubjectFields.length === 0) continue;
       throw new Error(

package/src/tenant-lifecycle/handlers/cancel-destruction.write.ts

@@ -2,12 +2,14 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
+import { isWithinGracePeriod } from "../../shared";
 import { type TenantLifecycleStatus, tenantEntity, tenantTable } from "../../tenant";
 import { DESTRUCTION_CANCELLED_EVENT_QN } from "../constants";
 import { invalidateTenantLifecycleGate } from "../lifecycle-gate";
 
+export { isWithinGracePeriod };
+
 const crud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
 
 type TenantLifecycleRow = {
@@ -33,11 +35,7 @@ export const cancelDestructionWrite = defineWriteHandler({
       );
     }
 
-    const gracePeriodEnd = row.gracePeriodEnd;
-    const inGrace =
-      gracePeriodEnd != null &&
-      Temporal.Instant.compare(gracePeriodEnd, getTemporal().Now.instant()) > 0;
-    if (!inGrace) {
+    if (!isWithinGracePeriod(row.gracePeriodEnd)) {
       return writeFailure(
         new UnprocessableError("grace_period_expired", {
           details: { reason: "grace_period_expired" },