@cosmicdrift/kumiko-bundled-features 0.307.0 → 0.309.0

package/src/sessions/handlers/revoke-all-others.write.ts

@@ -3,7 +3,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { SessionErrors } from "../constants";
 import { userSessionTable } from "../schema/user-session";
 import { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN } from "../session-revoked-event";

package/src/sessions/handlers/revoke.write.ts

@@ -3,7 +3,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { SessionErrors } from "../constants";
 import { userSessionTable } from "../schema/user-session";
 import { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN } from "../session-revoked-event";

package/src/sessions/session-callbacks.ts

@@ -97,12 +97,36 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       // original timestamp. Double-revoke races land here via logout +
       // switch-tenant on the same sid. (Password-change uses a different
       // callback — sessionMassRevoker — and isn't in scope for this guard.)
-      await updateMany(
+      const result = await updateMany<{ userId: string }>(
         db,
         userSessionTable,
         { revokedAt: Temporal.Now.instant() },
         { id: sid, revokedAt: null },
       );
+
+      // This is the ONLY caller of sessionRevoker — logout and tenant-switch
+      // — so it's also the only source of streamScope: "revoked-sessions".
+      // Without this append, a live SSE stream on this exact sid outlives its
+      // own logout because the access-invalidation consumer never hears
+      // about it — same gap sessionMassRevoker closed for
+      // password-change.
+      const revoked = result[0];
+      if (revoked) {
+        const payload = sessionRevokedSchema.parse({
+          userId: revoked.userId,
+          sessionIds: [sid],
+          streamScope: "revoked-sessions",
+        });
+        await append(db, {
+          aggregateId: generateId(),
+          aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
+          tenantId: SYSTEM_TENANT_ID,
+          expectedVersion: 0,
+          type: SESSION_REVOKED_EVENT_QN,
+          payload,
+          metadata: { userId: revoked.userId },
+        });
+      }
     },
 
     // kumiko-lint-ignore complexity-budget session check + lastSeen refresh on hot path

package/src/sessions/session-revoked-event.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 
 // Lightweight custom event appended alongside the direct-write
 // updateMany() in revoke.write.ts / revoke-all-others.write.ts /
@@ -27,6 +27,11 @@ export const sessionRevokedSchema = z.object({
   // The caller's own session a "revoke all others" write spared. Optional so
   // events appended before it existed still replay.
   keptSessionId: z.uuid().optional(),
+  // Set only by the raw sessionRevoker callback (logout / tenant-switch) —
+  // tells the access-invalidation consumer to close exactly `sessionIds`
+  // instead of the userwide default every other source keeps using.
+  // Optional so events appended before it existed still replay unscoped.
+  streamScope: z.literal("revoked-sessions").optional(),
 });
 
 export type SessionRevokedPayload = z.infer<typeof sessionRevokedSchema>;

package/src/shared/__tests__/row-bound-grant.integration.test.ts

@@ -10,7 +10,7 @@ import { executeRawQuery } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { setupTestStack, type TestStack, testTenantId } from "@cosmicdrift/kumiko-framework/stack";
-import { z } from "zod";
+import * as z from "zod";
 import { redeemRowBoundGrant, signRowBoundGrant } from "../row-bound-grant";
 
 const TABLE = "row_bound_grant_demo";

package/src/step-dispatcher/mail-runner.ts

@@ -2,7 +2,7 @@
 // Production wiring (mail-foundation transport) is a follow-up; the
 // default impl throws so a missing setMailRunner is loud, not silent.
 
-import { z } from "zod";
+import * as z from "zod";
 
 export const mailSpecSchema = z.object({
   to: z.union([z.string(), z.array(z.string())]),

package/src/step-dispatcher/webhook-runner.ts

@@ -1,7 +1,7 @@
 // Webhook execution logic — separated from feature.ts so tests can stub
 // the fetch without touching the MSP wiring.
 
-import { z } from "zod";
+import * as z from "zod";
 
 export const webhookSpecSchema = z.object({
   url: z.string(),

package/src/subscription-mollie/feature.ts

@@ -42,7 +42,7 @@
 import type { SubscriptionProviderPlugin } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { createMollieClient } from "@mollie/api-client";
-import { z } from "zod";
+import * as z from "zod";
 import { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "./constants";
 import { createMollieCheckoutSession, type MolliePriceConfig } from "./plugin-methods";
 import { type MollieClientShape, verifyAndParseMollieWebhook } from "./verify-webhook";

package/src/subscription-stripe/feature.ts

@@ -38,7 +38,7 @@ import {
   defineFeature,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import {
   STRIPE_API_KEY_CONFIG,
   STRIPE_BILLING_LIVE_CONFIG,

package/src/tags/schemas.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 
 export const createTagPayloadSchema = z.object({
   name: z.string().trim().min(1).max(64),

package/src/template-resolver/handlers/by-slug.query.ts

@@ -3,7 +3,7 @@ import {
   crossTenantOverrideDenied,
   defineQueryHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { TEXT_BLOCK_KIND } from "../constants";
 import { type TemplateResourceRow, templateResourcesTable } from "../table";
 

package/src/template-resolver/handlers/by-tenant.query.ts

@@ -4,7 +4,7 @@ import {
   crossTenantOverrideDenied,
   defineQueryHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { TEXT_BLOCK_KIND } from "../constants";
 import { type TemplateResourceRow, templateResourcesTable } from "../table";
 

package/src/template-resolver/handlers/collection-item.query.ts

@@ -4,7 +4,7 @@ import {
   crossTenantOverrideDenied,
   defineQueryHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import {
   type CollectionEntryRow,
   collectionStore,

package/src/template-resolver/handlers/collection-list.query.ts

@@ -5,7 +5,7 @@ import {
   crossTenantOverrideDenied,
   defineQueryHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import {
   type CollectionEntryRow,
   collectionStore,

package/src/template-resolver/handlers/collection-set.write.ts

@@ -6,7 +6,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import {
   type CollectionEntryRow,
   collectionStore,

package/src/template-resolver/handlers/find-by-id.query.ts

@@ -1,6 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { type TemplateResourceRow, templateResourcesTable } from "../table";
 
 // Admin-Lookup für UI-Edit-Flow. Returnt das raw Template inkl. draft/

package/src/template-resolver/handlers/list.query.ts

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { RENDER_KINDS, TEMPLATE_STATUSES } from "../constants";
 import { type TemplateResourceRow, templateResourcesTable } from "../table";
 

package/src/template-resolver/handlers/set.write.ts

@@ -6,7 +6,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { TEMPLATE_KINDS, TEXT_BLOCK_KIND } from "../constants";
 import { type TemplateResourceRow, templateResourcesTable } from "../table";
 import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema } from "./shared";

package/src/template-resolver/handlers/shared.ts

@@ -1,5 +1,5 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { z } from "zod";
+import * as z from "zod";
 import { CONTENT_FORMATS, TEMPLATE_STATUSES, UPSERT_KINDS } from "../constants";
 import { templateResourceEntity, templateResourcesTable } from "../table";
 

package/src/template-resolver/handlers/toggle-status.write.ts

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import type { TemplateResourceRow } from "../table";
 import { templateResourcesTable } from "../table";
 import { executor } from "./shared";

package/src/template-resolver/handlers/upsert-tenant.write.ts

@@ -6,7 +6,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import type { TemplateResourceRow } from "../table";
 import { templateResourcesTable } from "../table";
 import { executor, upsertPayloadSchema } from "./shared";

package/src/tenant/__tests__/tenant-timezone-boot.integration.test.ts

@@ -13,7 +13,7 @@ import {
   testTenantId,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { z } from "zod";
+import * as z from "zod";
 import { createConfigAccessorFactory, createConfigFeature } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";

package/src/tenant/handlers/active-tenant-ids.query.ts

@@ -5,7 +5,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantTable } from "../schema/tenant";
 
 export const activeTenantIdsQuery = defineQueryHandler({

package/src/tenant/handlers/add-member.write.ts

@@ -2,7 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { TenantErrors } from "../constants";
 import { findForbiddenMembershipRole, reservedMembershipRoleError } from "../membership-roles";
 import { tenantMembershipEntity, tenantMembershipsTable } from "../membership-table";

package/src/tenant/handlers/cancel-invitation.write.ts

@@ -14,7 +14,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import cancel needs invite-token-store for Redis cleanup
 import { invalidateExistingInviteToken } from "../../auth-email-password/invite-token-store";
 import {

package/src/tenant/handlers/create.write.ts

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantEntity, tenantTable } from "../schema/tenant";
 
 const crud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });

package/src/tenant/handlers/invitations.query.ts

@@ -1,7 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table";
 

package/src/tenant/handlers/list.query.ts

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantEntity, tenantTable } from "../schema/tenant";
 
 const crud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });

package/src/tenant/handlers/me.query.ts

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantTable } from "../schema/tenant";
 
 // Direct query — query handlers don't have a tenant-crud handle. A direct

package/src/tenant/handlers/member-directory.query.ts

@@ -6,7 +6,7 @@ import {
   MAX_LIST_LIMIT,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { userTable } from "../../user";
 import { tenantMembershipsTable } from "../membership-table";

package/src/tenant/handlers/members.query.ts

@@ -2,7 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { userTable } from "../../user";
 import { tenantMembershipsTable } from "../membership-table";

package/src/tenant/handlers/memberships.query.ts

@@ -2,7 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler, SYSTEM_ROLE } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantMembershipsTable } from "../membership-table";
 import { tenantTable } from "../schema/tenant";
 

package/src/tenant/handlers/remove-member.write.ts

@@ -7,7 +7,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 import { assertNotLastTenantAdmin } from "../last-tenant-admin";
 import { tenantMembershipEntity, tenantMembershipsTable } from "../membership-table";
 

package/src/tenant/handlers/resolve-user-ids.query.ts

@@ -1,7 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler, SYSTEM_ROLE } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantMembershipsTable } from "../membership-table";
 
 // Cross-feature query: resolve user IDs by tenantId or userId.

package/src/tenant/handlers/team-list.query.ts

@@ -7,7 +7,7 @@ import {
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { userSessionTable } from "../../sessions";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { userTable } from "../../user";

package/src/tenant/handlers/tenant-directory.query.ts

@@ -5,7 +5,7 @@ import {
   MAX_LIST_LIMIT,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantTable } from "../schema/tenant";
 import { isSystemAdmin } from "./is-system-admin";
 

package/src/tenant/handlers/toggle-enabled.write.ts

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantEntity, tenantTable } from "../schema/tenant";
 
 const crud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });

package/src/tenant/handlers/update-member-roles.write.ts

@@ -14,7 +14,7 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 import { assertNotLastTenantAdmin } from "../last-tenant-admin";
 import {
   findForbiddenMembershipRole,

package/src/tenant/handlers/update.write.ts

@@ -6,7 +6,7 @@ import {
   NotFoundError,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantEntity, tenantTable } from "../schema/tenant";
 
 const crud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });

package/src/tenant-handover/events.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 
 // Audit trail for a completed claim (kumiko-framework#3035's audit-entry
 // requirement: names the source tenant, destination tenant, entities and

package/src/tenant-handover/handlers/claim.write.ts

@@ -7,7 +7,7 @@ import {
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 import { redeemRowBoundGrant } from "../../shared";
 import { TENANT_HANDOVER_CLAIM_AGGREGATE_TYPE, TENANT_HANDOVER_CLAIMED_EVENT_QN } from "../events";
 import { tenantHandoverPurpose } from "../grant";

package/src/tenant-lifecycle/__tests__/tenant-lifecycle.integration.test.ts

@@ -16,8 +16,6 @@ import {
   type TestStack,
   TestUsers,
   testTenantId,
-  unsafeCreateEntityTable,
-  unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createTestEnvelopeCipher,
@@ -27,18 +25,16 @@ import {
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
-  tenantComplianceProfileEntity,
   tenantComplianceProfileTable,
 } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
-import { configValuesTable } from "../../config/table";
 import { createSessionsFeature } from "../../sessions";
-import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
-import { tenantMembershipEntity, tenantMembershipsTable } from "../../tenant";
+import { userSessionTable } from "../../sessions/schema/user-session";
+import { tenantMembershipsTable } from "../../tenant";
 import { TenantHandlers, TenantQueries } from "../../tenant/constants";
 import { createTenantFeature } from "../../tenant/feature";
-import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { tenantTable } from "../../tenant/schema/tenant";
 import { seedTenantMembership } from "../../tenant/testing";
 import { createUserFeature } from "../../user/feature";
 import {
@@ -85,12 +81,6 @@ beforeAll(async () => {
     } as import("@cosmicdrift/kumiko-framework/api").AuthRoutesConfig,
   });
   db = stack.db;
-
-  await unsafeCreateEntityTable(db, tenantEntity);
-  await unsafeCreateEntityTable(db, userSessionEntity);
-  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
-  await unsafeCreateEntityTable(db, tenantMembershipEntity);
-  await unsafePushTables(db, { configValuesTable });
 });
 
 afterAll(async () => {
@@ -175,6 +165,11 @@ describe("tenant-lifecycle :: request / cancel / 410 gate", () => {
     const err = await stack.http.writeErr(REQUEST, {}, member);
     expect(err.httpStatus).toBe(403);
   });
+
+  test("authenticated read against an unseeded tenant doesn't 500 on a missing read_tenants table (fw#3102)", async () => {
+    const res = await stack.http.query(TenantQueries.me, {}, tenantAdmin);
+    expect(res.status).toBe(200);
+  });
 });
 
 function createPoisonTenantDataFeature() {
@@ -210,9 +205,6 @@ describe("tenant-lifecycle :: pipeline abandon / destroyFailed", () => {
         },
       } as import("@cosmicdrift/kumiko-framework/api").AuthRoutesConfig,
     });
-    await unsafeCreateEntityTable(poisonStack.db, tenantEntity);
-    await unsafeCreateEntityTable(poisonStack.db, tenantComplianceProfileEntity);
-    await unsafePushTables(poisonStack.db, { configValuesTable });
   });
 
   afterAll(async () => {
@@ -416,9 +408,6 @@ describe("tenant-lifecycle :: sweep isolates one tenant's failure from another's
       ],
       extraContext: { configResolver: resolver, configEncryption: encryption },
     });
-    await unsafeCreateEntityTable(isolationStack.db, tenantEntity);
-    await unsafeCreateEntityTable(isolationStack.db, tenantComplianceProfileEntity);
-    await unsafePushTables(isolationStack.db, { configValuesTable });
   });
 
   afterAll(async () => {
@@ -483,11 +472,6 @@ describe("tenant-lifecycle :: 410 gate derived from the mounted provider", () =>
       ],
       extraContext: { configResolver: resolver, configEncryption: encryption },
     });
-    await unsafeCreateEntityTable(derivedStack.db, tenantEntity);
-    await unsafeCreateEntityTable(derivedStack.db, userSessionEntity);
-    await unsafeCreateEntityTable(derivedStack.db, tenantComplianceProfileEntity);
-    await unsafeCreateEntityTable(derivedStack.db, tenantMembershipEntity);
-    await unsafePushTables(derivedStack.db, { configValuesTable });
   });
 
   afterAll(async () => {

package/src/tenant-lifecycle/events.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 
 export const destructionRequestedSchema = z.object({
   requestedBy: z.uuid(),

package/src/tenant-lifecycle/handlers/cancel-destruction.write.ts

@@ -2,7 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { isWithinGracePeriod } from "../../shared";
 import { type TenantLifecycleStatus, tenantEntity, tenantTable } from "../../tenant";
 import { DESTRUCTION_CANCELLED_EVENT_QN } from "../constants";

package/src/tenant-lifecycle/handlers/request-destruction.write.ts

@@ -4,7 +4,7 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { z } from "zod";
+import * as z from "zod";
 import { resolveProfileForTenant } from "../../compliance-profiles";
 import { type TenantLifecycleStatus, tenantEntity, tenantTable } from "../../tenant";
 import { DESTRUCTION_REQUESTED_EVENT_QN } from "../constants";

package/src/tenant-settings/tenant-defaults.ts

@@ -15,7 +15,7 @@ import {
   type EntityDefinition,
   type WriteHandlerDef,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { TenantSettingsConfig } from "./constants";
 
 const OPTIONAL_CURRENCY_MONEY = z.object({ amount: z.number(), currency: z.string().optional() });

package/src/tier-engine/__tests__/tier-resolver.integration.test.ts

@@ -19,7 +19,7 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
-import { z } from "zod";
+import * as z from "zod";
 import { tierAssignmentEntity } from "../entity";
 import { tierEngineFeature } from "../feature";
 import { createTierResolver } from "../tier-resolver";

package/src/tier-engine/feature.ts

@@ -64,7 +64,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantTable } from "../tenant";
 import { tierAssignmentAggregateId } from "./aggregate-id";
 import type { TierMap } from "./compose-app";

package/src/tier-engine/handlers/active-tier.query.ts

@@ -1,5 +1,5 @@
 import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 
 // get-active-tier — return the current tier-assignment for the calling tenant.
 //

package/src/tier-engine/handlers/get-tenant-tier.query.ts

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { type TierAssignmentRow, tierAssignmentEntity } from "../entity";
 
 // Liest das Tier-Assignment eines BELIEBIGEN Tenants (cross-tenant) für den

package/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -5,7 +5,7 @@ import {
   createTenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { tierAssignmentAggregateId } from "../aggregate-id";
 import { type TierAssignmentRow, tierAssignmentEntity } from "../entity";