@cosmicdrift/kumiko-bundled-features 0.304.0 → 0.306.0

package/src/auth-email-password/web/__tests__/auth-gate.test.tsx

@@ -1,7 +1,15 @@
-import { describe, expect, mock, test } from "bun:test";
-import { fireEvent, screen, waitFor } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
 import type { ReactNode } from "react";
+import { defaultTranslations } from "../../i18n";
 import { createLoginRoute, makeAuthGate } from "../auth-gate";
+import { SessionProvider } from "../session";
 import { makeSessionApi, renderWithProviders } from "./test-utils";
 
 describe("makeAuthGate", () => {
@@ -236,3 +244,117 @@ describe("createLoginRoute", () => {
     );
   });
 });
+
+// Real SessionProvider (no mocked SessionContext) — proves the actual
+// bootstrap-failure wiring end to end: hasLikelyAuthSession → fetchTenants
+// throws → doRefresh catches → "error" status → SessionBootstrapErrorScreen.
+// Uses makeAuthGate + SessionProvider directly instead of makeSessionAuthGate:
+// client-plugin.test.tsx mocks makeSessionAuthGate process-wide via bun:test's
+// shared module registry, which would silently no-op it here too.
+describe("makeSessionAuthGate — session bootstrap failure", () => {
+  const resolver = createStaticLocaleResolver({ locale: "en" });
+  const originalFetch = globalThis.fetch;
+
+  function renderRealSession(ui: ReactNode) {
+    return render(
+      <PrimitivesProvider value={defaultPrimitives}>
+        <LocaleProvider resolver={resolver} fallbackBundles={[defaultTranslations]}>
+          <SessionProvider>{ui}</SessionProvider>
+        </LocaleProvider>
+      </PrimitivesProvider>,
+    );
+  }
+
+  beforeEach(() => {
+    document.cookie = "kumiko_csrf=gate-test-token";
+  });
+
+  afterEach(() => {
+    document.cookie = "kumiko_csrf=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/";
+    globalThis.fetch = originalFetch;
+  });
+
+  test("429 on GET /auth/tenants → error screen with data-http-status=429, children not rendered; retry recovers", async () => {
+    let tenantsCalls = 0;
+    globalThis.fetch = mock(async (input: RequestInfo | URL) => {
+      const url = typeof input === "string" ? input : input.toString();
+      if (url === "/api/auth/tenants") {
+        tenantsCalls++;
+        if (tenantsCalls === 1) return new Response(null, { status: 429 });
+        return new Response(JSON.stringify({ tenants: [], activeTenantId: "t1" }), {
+          status: 200,
+        });
+      }
+      if (url === "/api/query") {
+        return new Response(
+          JSON.stringify({
+            data: { id: "u1", email: "u@example.com", displayName: "U", roles: "[]" },
+          }),
+          { status: 200 },
+        );
+      }
+      return new Response(null, { status: 404 });
+    }) as unknown as typeof fetch;
+
+    const Gate = makeAuthGate();
+    renderRealSession(
+      <Gate>
+        <div data-testid="protected">secret</div>
+      </Gate>,
+    );
+
+    const errorScreen = await waitFor(() => screen.getByTestId("session-bootstrap-error"));
+    expect(errorScreen.getAttribute("data-http-status")).toBe("429");
+    expect(screen.queryByTestId("protected")).toBeNull();
+
+    fireEvent.click(screen.getByRole("button", { name: "Try again" }));
+
+    await waitFor(() => {
+      expect(screen.getByTestId("protected")).toBeTruthy();
+    });
+    expect(tenantsCalls).toBe(2);
+  });
+
+  test("500 on POST /api/query (user:me) → error screen with data-http-status=500, children not rendered", async () => {
+    globalThis.fetch = mock(async (input: RequestInfo | URL) => {
+      const url = typeof input === "string" ? input : input.toString();
+      if (url === "/api/auth/tenants") {
+        return new Response(JSON.stringify({ tenants: [], activeTenantId: "t1" }), {
+          status: 200,
+        });
+      }
+      if (url === "/api/query") {
+        return new Response(null, { status: 500 });
+      }
+      return new Response(null, { status: 404 });
+    }) as unknown as typeof fetch;
+
+    const Gate = makeAuthGate();
+    renderRealSession(
+      <Gate>
+        <div data-testid="protected">secret</div>
+      </Gate>,
+    );
+
+    const errorScreen = await waitFor(() => screen.getByTestId("session-bootstrap-error"));
+    expect(errorScreen.getAttribute("data-http-status")).toBe("500");
+    expect(screen.queryByTestId("protected")).toBeNull();
+  });
+
+  test("network failure on GET /auth/tenants → error screen with data-http-status=network", async () => {
+    globalThis.fetch = mock(async () => {
+      throw new TypeError("Failed to fetch");
+    }) as unknown as typeof fetch;
+
+    const Gate = makeAuthGate();
+    renderRealSession(
+      <Gate>
+        <div data-testid="protected">secret</div>
+      </Gate>,
+    );
+
+    const errorScreen = await waitFor(() => screen.getByTestId("session-bootstrap-error"));
+    expect(errorScreen.getAttribute("data-http-status")).toBe("network");
+    expect(screen.queryByTestId("protected")).toBeNull();
+  });
+});

package/src/auth-email-password/web/__tests__/session-bootstrap-error.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, test } from "bun:test";
+import type { SessionBootstrapFailure } from "../session";
+import { retryDelayMs } from "../session-bootstrap-error";
+
+describe("retryDelayMs", () => {
+  test("Retry-After not yet elapsed → remaining delay in ms", () => {
+    const failure: SessionBootstrapFailure = {
+      httpStatus: 429,
+      retryAfterSeconds: 11,
+      failedAtEpochMs: 1000,
+    };
+    expect(retryDelayMs(failure, 3000)).toBe(9000);
+  });
+
+  test("Retry-After already elapsed → 0, never negative", () => {
+    const failure: SessionBootstrapFailure = {
+      httpStatus: 429,
+      retryAfterSeconds: 11,
+      failedAtEpochMs: 1000,
+    };
+    expect(retryDelayMs(failure, 20_000)).toBe(0);
+  });
+
+  test("no retryAfterSeconds → 0 (retry immediately)", () => {
+    const failure: SessionBootstrapFailure = {
+      httpStatus: 500,
+      retryAfterSeconds: null,
+      failedAtEpochMs: 1000,
+    };
+    expect(retryDelayMs(failure, 1000)).toBe(0);
+  });
+});

package/src/auth-email-password/web/__tests__/test-utils.tsx

@@ -41,6 +41,7 @@ export function makeSessionApi(overrides: MakeSessionApiOptions = {}): SessionAp
     activeTenantId: "tenant-1",
     tenants: [{ tenantId: "tenant-1", roles: ["Admin"] }],
     roles: ["Admin"],
+    bootstrapFailure: null,
     ...stateOverrides,
   };
   return {

package/src/auth-email-password/web/auth-client.ts

@@ -62,6 +62,26 @@ export function csrfHeader(): Record<string, string> {
   return token !== undefined ? { [CSRF_HEADER_NAME]: token } : {};
 }
 
+// Thrown by fetchTenants/fetchCurrentUser on a non-401 error status, distinguishable from a plain network failure by its status field.
+export class AuthRequestError extends Error {
+  readonly status: number;
+  readonly retryAfterSeconds: number | undefined;
+
+  constructor(message: string, status: number, retryAfterSeconds: number | undefined) {
+    super(message);
+    this.name = "AuthRequestError";
+    this.status = status;
+    this.retryAfterSeconds = retryAfterSeconds;
+  }
+}
+
+// Only a non-negative integer second count is usable; anything else is treated as absent.
+export function parseRetryAfterSeconds(header: string | null): number | undefined {
+  if (header === null) return undefined;
+  if (!/^\d+$/.test(header)) return undefined;
+  return Number(header);
+}
+
 // LoginResult mirrors the two-step login contract auth-routes.ts owns: a
 // straight success, an MFA challenge (auth-mfa mints the token), an
 // MFA-setup-required block (enforcement policy blocks an unenrolled user),
@@ -344,7 +364,13 @@ export async function fetchTenants(): Promise<{
     credentials: "same-origin",
   });
   if (res.status === 401) return null;
-  if (!res.ok) throw new Error(`auth/tenants failed: ${res.status}`);
+  if (!res.ok) {
+    throw new AuthRequestError(
+      `auth/tenants failed: ${res.status}`,
+      res.status,
+      parseRetryAfterSeconds(res.headers.get("Retry-After")),
+    );
+  }
   // @cast-boundary engine-payload — HTTP-API contract, server-side schema-validated
   return (await res.json()) as {
     tenants: readonly TenantSummary[];
@@ -392,7 +418,13 @@ export async function fetchCurrentUser(): Promise<CurrentUserProfile | null> {
     body: JSON.stringify({ type: "user:query:user:me", payload: {} }),
   });
   if (res.status === 401) return null;
-  if (!res.ok) throw new Error(`user:me failed: ${res.status}`);
+  if (!res.ok) {
+    throw new AuthRequestError(
+      `user:me failed: ${res.status}`,
+      res.status,
+      parseRetryAfterSeconds(res.headers.get("Retry-After")),
+    );
+  }
   // @cast-boundary engine-payload — HTTP-API contract, server-side schema-validated
   const body = (await res.json()) as {
     data?: {

package/src/auth-email-password/web/auth-gate.tsx

@@ -12,6 +12,7 @@
 import { type ComponentType, type ReactNode, useEffect, useState } from "react";
 import { LoginScreen, type LoginScreenProps } from "./login-screen";
 import { SessionProvider, useSession } from "./session";
+import { SessionBootstrapErrorScreen } from "./session-bootstrap-error";
 
 // Generic — NOT auth-mfa's MfaVerifyScreenProps directly, so this feature
 // stays unaware of auth-mfa's concrete shape (same coupling direction as
@@ -65,7 +66,7 @@ export function createLoginRoute(
   const MfaSetupComponent = opts.mfaSetupScreen;
 
   function LoginRoute(): ReactNode {
-    const { status, refresh } = useSession();
+    const { status, refresh, bootstrapFailure } = useSession();
     const { onAuthenticated } = opts;
     // Pending challenge-token from LoginScreen's onMfaChallenge. Lives here
     // (not in SessionState) because it's a UI-only transition — the server
@@ -86,6 +87,9 @@ export function createLoginRoute(
         <div className="min-h-screen flex items-center justify-center text-muted-foreground text-sm" />
       );
     }
+    if (status === "error" && bootstrapFailure !== null) {
+      return <SessionBootstrapErrorScreen failure={bootstrapFailure} onRetry={refresh} />;
+    }
     // A standalone mount (no parent gate, no onAuthenticated wired — e.g. an
     // apex/marketing surface that just places <LoginRoute /> directly) has no
     // way to navigate away once authenticated. Blanking the page there is a

package/src/auth-email-password/web/index.ts

@@ -18,6 +18,7 @@ export type {
   VerifyEmailFailure,
 } from "./auth-client";
 export {
+  AuthRequestError,
   confirmAccountUnlock,
   confirmSignup,
   requestAccountUnlock,
@@ -54,8 +55,10 @@ export type { RequestAccountUnlockScreenProps } from "./request-account-unlock-s
 export { RequestAccountUnlockScreen } from "./request-account-unlock-screen";
 export type { ResetPasswordScreenProps } from "./reset-password-screen";
 export { ResetPasswordScreen } from "./reset-password-screen";
-export type { SessionApi, SessionState, SessionStatus } from "./session";
+export type { SessionApi, SessionBootstrapFailure, SessionState, SessionStatus } from "./session";
 export { hasLikelyAuthSession, SessionContext, SessionProvider, useSession } from "./session";
+export type { SessionBootstrapErrorScreenProps } from "./session-bootstrap-error";
+export { retryDelayMs, SessionBootstrapErrorScreen } from "./session-bootstrap-error";
 export type { SignupCompleteScreenProps } from "./signup-complete-screen";
 export { SignupCompleteScreen } from "./signup-complete-screen";
 export type { SignupScreenProps } from "./signup-screen";

package/src/auth-email-password/web/session-bootstrap-error.tsx

@@ -0,0 +1,56 @@
+// @runtime client
+// Rendered by auth-gate's LoginRoute when the session bootstrap failed for a reason other than "not logged in".
+
+import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { type ReactNode, useState } from "react";
+import { AuthCard } from "./auth-form-primitives";
+import type { SessionBootstrapFailure } from "./session";
+
+export type SessionBootstrapErrorScreenProps = {
+  readonly failure: SessionBootstrapFailure;
+  readonly onRetry: () => Promise<void>;
+};
+
+/** Retry delay measured from failure time, not click time. */
+export function retryDelayMs(failure: SessionBootstrapFailure, nowEpochMs: number): number {
+  const retryAfterMs = (failure.retryAfterSeconds ?? 0) * 1000;
+  return Math.max(0, failure.failedAtEpochMs + retryAfterMs - nowEpochMs);
+}
+
+function wait(ms: number): Promise<void> {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+export function SessionBootstrapErrorScreen({
+  failure,
+  onRetry,
+}: SessionBootstrapErrorScreenProps): ReactNode {
+  const t = useTranslation();
+  const { Banner, Button } = usePrimitives();
+  const [retrying, setRetrying] = useState(false);
+
+  const handleRetry = (): void => {
+    setRetrying(true);
+    void wait(retryDelayMs(failure, Date.now()))
+      .then(onRetry)
+      .then(() => setRetrying(false));
+  };
+
+  return (
+    <div data-testid="session-bootstrap-error" data-http-status={failure.httpStatus ?? "network"}>
+      <AuthCard title={t("auth.sessionBootstrap.errorTitle")}>
+        <div className="flex flex-col gap-4 px-6 pb-4">
+          <Banner variant="error">
+            {failure.httpStatus === 429
+              ? t("auth.sessionBootstrap.rateLimitedBody")
+              : t("auth.sessionBootstrap.errorBody")}
+          </Banner>
+          <Button variant="primary" onClick={handleRetry} disabled={retrying}>
+            {retrying ? t("auth.sessionBootstrap.retrying") : t("auth.sessionBootstrap.retry")}
+          </Button>
+        </div>
+      </AuthCard>
+    </div>
+  );
+}

package/src/auth-email-password/web/session.tsx

@@ -12,6 +12,7 @@
 import { readCsrfToken } from "@cosmicdrift/kumiko-dispatcher-live";
 import { createContext, type ReactNode, useCallback, useContext, useEffect, useState } from "react";
 import {
+  AuthRequestError,
   type CurrentUserProfile,
   fetchCurrentUser,
   fetchTenants,
@@ -23,7 +24,14 @@ import {
   type TenantSummary,
 } from "./auth-client";
 
-export type SessionStatus = "loading" | "unauthenticated" | "authenticated";
+export type SessionStatus = "loading" | "unauthenticated" | "authenticated" | "error";
+
+// httpStatus null means the fetch itself threw (offline/DNS/CORS), not that the server answered.
+export type SessionBootstrapFailure = {
+  readonly httpStatus: number | null;
+  readonly retryAfterSeconds: number | null;
+  readonly failedAtEpochMs: number;
+};
 
 export type SessionState = {
   readonly status: SessionStatus;
@@ -36,6 +44,7 @@ export type SessionState = {
    *  Client computed dieselbe merge-Logik aus user.globalRoles +
    *  tenants[active].roles damit nav-filtering greift. Dedupliziert. */
   readonly roles: readonly string[];
+  readonly bootstrapFailure: SessionBootstrapFailure | null;
 };
 
 export type SessionApi = SessionState & {
@@ -58,6 +67,7 @@ export const UNAUTHENTICATED: SessionState = {
   activeTenantId: null,
   tenants: [],
   roles: [],
+  bootstrapFailure: null,
 };
 
 const INITIAL: SessionState = {
@@ -66,6 +76,7 @@ const INITIAL: SessionState = {
   activeTenantId: null,
   tenants: [],
   roles: [],
+  bootstrapFailure: null,
 };
 
 // kumiko_auth ist HttpOnly — kumiko_csrf wird beim Login gemeinsam gesetzt.
@@ -117,15 +128,33 @@ async function refresh(): Promise<SessionState> {
     activeTenantId: tenants.activeTenantId,
     tenants: tenants.tenants,
     roles: computeActiveRoles(user, tenants.activeTenantId, tenants.tenants),
+    bootstrapFailure: null,
   };
 }
 
+// Non-AuthRequestError throws (offline, DNS, CORS) have no status, so httpStatus stays null.
+function toBootstrapFailure(err: unknown): SessionBootstrapFailure {
+  if (err instanceof AuthRequestError) {
+    return {
+      httpStatus: err.status,
+      retryAfterSeconds: err.retryAfterSeconds ?? null,
+      failedAtEpochMs: Date.now(),
+    };
+  }
+  return { httpStatus: null, retryAfterSeconds: null, failedAtEpochMs: Date.now() };
+}
+
 export function SessionProvider({ children }: { readonly children: ReactNode }): ReactNode {
   const [state, setState] = useState<SessionState>(INITIAL);
 
+  // Never rejects, so bootstrap can't strand the UI on "loading" forever.
   const doRefresh = useCallback(async () => {
-    const next = await refresh();
-    setState(next);
+    try {
+      const next = await refresh();
+      setState(next);
+    } catch (err) {
+      setState({ ...UNAUTHENTICATED, status: "error", bootstrapFailure: toBootstrapFailure(err) });
+    }
   }, []);
 
   // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312

package/src/auth-foundation/__tests__/session-store.test.ts

@@ -67,6 +67,7 @@ describe("validateSessionStoreMultiplicity", () => {
 
   test("malformed registration (no build) → throws a malformed-plugin error", () => {
     const broken = defineFeature("mock-broken", (r) => {
+      // @ts-expect-error malformed plugin (no build) — proves the runtime guard rejects it too.
       r.useExtension(EXT_SESSION_STORE, "broken", {});
     });
     const registry = createRegistry([authFoundationFeature, broken]);

package/src/auth-foundation/__tests__/tenant-providers.test.ts

@@ -92,6 +92,7 @@ describe("validateTenantResolverMultiplicity", () => {
 
   test("malformed (no trust) → throws", () => {
     const broken = defineFeature("mock-broken-resolver", (r) => {
+      // @ts-expect-error malformed plugin (no trust) — proves the runtime guard rejects it too.
       r.useExtension(EXT_TENANT_RESOLVER, "broken", { build: () => () => null });
     });
     const registry = createRegistry([authFoundationFeature, broken]);

package/src/auth-foundation/__tests__/token-verifier.test.ts

@@ -127,6 +127,7 @@ describe("validateTokenVerifierMultiplicity", () => {
 
   test("wrong-shape registration → throws a malformed-plugin error", () => {
     const broken = defineFeature("mock-broken", (r) => {
+      // @ts-expect-error malformed plugin (no build) — proves the runtime guard rejects it too.
       r.useExtension(EXT_TOKEN_VERIFIER, "broken", { shape: { kind: "prefix" } });
     });
     const registry = createRegistry([authFoundationFeature, broken]);
@@ -138,6 +139,7 @@ describe("validateTokenVerifierMultiplicity", () => {
   test("malformed shape (build present, prefix missing) → throws a malformed-plugin error", () => {
     const broken = defineFeature("mock-broken-shape", (r) => {
       r.useExtension(EXT_TOKEN_VERIFIER, "broken-shape", {
+        // @ts-expect-error malformed shape (prefix missing) — proves the runtime guard rejects it too.
         shape: { kind: "prefix" },
         build: () => async () => null,
       });

package/src/auth-foundation/types.ts

@@ -22,7 +22,7 @@ import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 
 export type { SessionMassRevoker };
 
-export const EXT_TOKEN_VERIFIER = "tokenVerifier";
+export const EXT_TOKEN_VERIFIER = "tokenVerifier" as const;
 
 /**
  * Deps available to a provider's `build()`. DB access only — a hot-path
@@ -84,7 +84,7 @@ export function tokenShapeKey(shape: TokenShape): string {
 // single-provider — sessions have no per-provider shape to route on, so
 // exactly one implementation must be registered (boot-fails on 0 or ≥2).
 
-export const EXT_SESSION_STORE = "sessionStore";
+export const EXT_SESSION_STORE = "sessionStore" as const;
 
 /** Keep current sid (if any); revoke every other live session. Used by auth-mfa. */
 export type SessionRevokeAllOthers = (
@@ -117,8 +117,8 @@ export function isSessionStoreProvider(o: unknown): o is SessionStoreProvider {
 // optional — zero registered means today's single-tenant / header-cookie
 // path (no subdomain resolver, no existence check). ≥2 fails boot.
 
-export const EXT_TENANT_RESOLVER = "tenantResolver";
-export const EXT_TENANT_EXISTENCE = "tenantExistence";
+export const EXT_TENANT_RESOLVER = "tenantResolver" as const;
+export const EXT_TENANT_EXISTENCE = "tenantExistence" as const;
 
 /** Trust mode for a registered tenantResolver — mirrors AnonymousAccessConfig.resolverTrust. */
 export type TenantResolverTrust = "authoritative" | "fallback-only";
@@ -168,3 +168,13 @@ export function isTenantExistenceProvider(o: unknown): o is TenantExistenceProvi
     typeof (o as { build: unknown }).build === "function"
   );
 }
+
+// r.useExtension options-shape for auth-foundation's four extension points.
+declare module "@cosmicdrift/kumiko-framework/engine" {
+  interface KumikoExtensionOptionsMap {
+    [EXT_TOKEN_VERIFIER]: AuthProviderPlugin;
+    [EXT_SESSION_STORE]: SessionStoreProvider;
+    [EXT_TENANT_RESOLVER]: TenantResolverProvider;
+    [EXT_TENANT_EXISTENCE]: TenantExistenceProvider;
+  }
+}

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -23,7 +23,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { isStreamArchived, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
+import { loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
   setupTestStack,
@@ -33,7 +33,6 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
 import {
-  ComplianceProfileHandlers,
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
 } from "../../compliance-profiles";
@@ -50,7 +49,6 @@ import {
 } from "../constants";
 import { billingFoundationFeature } from "../feature";
 import { paymentsProjectionTable, subscriptionsProjectionTable } from "../projection";
-import { subscriptionTenantDestroyHook } from "../tenant-destroy-hook";
 import type { PaymentEvent, SubscriptionProviderPlugin } from "../types";
 import { createSubscriptionWebhookRoute } from "../webhook-handler";
 
@@ -669,66 +667,9 @@ describe("scenario 8: cancel-event setzt status auf canceled, behält subscripti
   });
 });
 
-describe("scenario 9: subscriptionTenantDestroyHook (#800 tenant-destroy PII erasure)", () => {
-  test("default profile → row hard-deleted, stream archived", async () => {
-    const admin = adminFor(3009);
-    await stack.http.writeOk(
-      SubscriptionFoundationHandlers.processEvent,
-      buildEvent({
-        providerEventId: "evt_3009_create",
-        providerCustomerId: "cus_3009",
-        providerSubscriptionId: "sub_3009",
-      }),
-      admin,
-    );
-
-    await subscriptionTenantDestroyHook({ db, tenantId: admin.tenantId });
-
-    const rows = await selectMany(db, subscriptionsProjectionTable, {
-      id: subscriptionAggregateId(admin.tenantId),
-    });
-    expect(rows).toHaveLength(0);
-    expect(
-      await isStreamArchived(db, admin.tenantId, subscriptionAggregateId(admin.tenantId)),
-    ).toBe(true);
-  });
-
-  test("HGB profile → PII redacted, accounting fields + row survive, stream archived", async () => {
-    const admin = adminFor(3010);
-    await stack.http.writeOk(
-      ComplianceProfileHandlers.setProfile,
-      { profileKey: "de-hr-dsgvo-hgb" },
-      admin,
-    );
-    await stack.http.writeOk(
-      SubscriptionFoundationHandlers.processEvent,
-      buildEvent({
-        providerEventId: "evt_3010_create",
-        providerCustomerId: "cus_3010",
-        providerSubscriptionId: "sub_3010",
-        tier: "pro",
-      }),
-      admin,
-    );
-
-    await subscriptionTenantDestroyHook({ db, tenantId: admin.tenantId });
-
-    const rows = await selectMany<{
-      providerCustomerId: string;
-      providerSubscriptionId: string;
-      tier: string;
-      status: string;
-    }>(db, subscriptionsProjectionTable, { id: subscriptionAggregateId(admin.tenantId) });
-    expect(rows).toHaveLength(1);
-    expect(rows[0]?.providerCustomerId).toBe("[erased]");
-    expect(rows[0]?.providerSubscriptionId).toBe("[erased]");
-    // accounting facts survive — that's the point of the HGB retention branch
-    expect(rows[0]?.tier).toBe("pro");
-    expect(
-      await isStreamArchived(db, admin.tenantId, subscriptionAggregateId(admin.tenantId)),
-    ).toBe(true);
-  });
-});
+// scenario 9 (subscriptionTenantDestroyHook direct-call, default+HGB branches) removed:
+// covered end-to-end by billing-foundation/__tests__/tenant-destroy.integration.test.ts,
+// which drives the real tenant-lifecycle sweep instead of hand-feeding the hook.
 
 describe("scenario 10: PII is encrypted at rest, not just erasable on destroy", () => {
   test("raw event-log payload and raw projection row both hold ciphertext, not the plaintext provider id", async () => {