@cosmicdrift/kumiko-bundled-features 0.312.0 → 0.313.0

package/src/subscription-stripe/__tests__/plugin-methods.test.ts

@@ -143,9 +143,53 @@ describe("createStripeCheckoutSession", () => {
       payment_intent_data: {
         metadata: { tenantId: "tenant-003" },
       },
+      // Default-on: without the runtime option, mode:"payment" gets a
+      // Stripe invoice.
+      invoice_creation: { enabled: true },
     });
   });
 
+  test("mode='payment' + paymentInvoiceCreation:false: invoice_creation.enabled is false", async () => {
+    const stripe = buildStripe();
+    const createMock = spyOn(stripe.checkout.sessions, "create")
+      // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
+      .mockResolvedValue({ url: "https://checkout.stripe.com/c/pay/topup" } as any);
+
+    const checkout = createStripeCheckoutSession(ctxRuntime(stripe), {
+      paymentInvoiceCreation: false,
+    });
+    await checkout(stubCtx, {
+      priceId: "price_credits_topup",
+      tenantId: "tenant-003",
+      successUrl: "https://example.com/success",
+      cancelUrl: "https://example.com/cancel",
+      mode: "payment",
+    });
+
+    expect(createMock).toHaveBeenCalledWith(
+      expect.objectContaining({ invoice_creation: { enabled: false } }),
+    );
+  });
+
+  test("mode='subscription': NIE invoice_creation — Stripe rejects es außerhalb payment-mode", async () => {
+    const stripe = buildStripe();
+    const createMock = spyOn(stripe.checkout.sessions, "create")
+      // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
+      .mockResolvedValue({ url: "https://x" } as any);
+
+    const checkout = createStripeCheckoutSession(ctxRuntime(stripe));
+    await checkout(stubCtx, {
+      priceId: "price_x",
+      tenantId: "tenant-005",
+      successUrl: "https://x/s",
+      cancelUrl: "https://x/c",
+      mode: "subscription",
+    });
+
+    const callArgs = createMock.mock.calls[0]?.[0] as Record<string, unknown>;
+    expect(callArgs).not.toHaveProperty("invoice_creation");
+  });
+
   test("mode omitted defaults to 'subscription' (Regression-Pin für bestehende Aufrufer)", async () => {
     const stripe = buildStripe();
     const createMock = spyOn(stripe.checkout.sessions, "create")

package/src/subscription-stripe/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.313.0",
+    "type": "breaking",
+    "title": "subscription-stripe mode:\"payment\" checkouts now get a Stripe invoice by default",
+    "detail": "createCheckoutSession's mode:\"payment\" call (one-off top-ups etc.) never\npassed invoice_creation, so Stripe never generated an invoice document for\nthose payments. It now defaults to `invoice_creation: { enabled: true }`\nfor mode:\"payment\" — mode:\"subscription\" is unaffected, Stripe rejects\ninvoice_creation there. Stripe Invoicing charges a per-invoice fee on top\nof the payment itself, so an existing high-volume, low-value payment flow\nmay see new fees appear.",
+    "migration": "Pass `createSubscriptionStripeFeature({ paymentInvoiceCreation: false })`\nto opt out and keep the old no-invoice behaviour for mode:\"payment\" checkouts."
+  }
+]

package/src/subscription-stripe/feature.ts

@@ -95,6 +95,14 @@ export type SubscriptionStripeOptions = {
    *  App-spezifisch → bleibt factory-option. Fehlt die price-id im Mapping
    *  → null (event ignored). */
   readonly priceToTier?: Readonly<Record<string, string>>;
+  /** Whether a mode:"payment" checkout (one-off top-ups etc.) gets a Stripe
+   *  invoice — a receipt/invoice document Stripe generates and sends to the
+   *  customer for that payment. Default true. Stripe Invoicing charges a
+   *  per-invoice fee on top of the payment itself, so a high-volume,
+   *  low-value payment flow may want `false` to opt out. Never applied in
+   *  mode:"subscription" — Stripe rejects invoice_creation there; the
+   *  subscription's own invoicing covers it. */
+  readonly paymentInvoiceCreation?: boolean;
 };
 
 /**
@@ -185,7 +193,11 @@ export function createSubscriptionStripeFeature(
       verifyAndParseWebhook: verifyAndParseStripeWebhook(runtimes.webhook, {
         priceToTier: options.priceToTier ?? {},
       }),
-      createCheckoutSession: createStripeCheckoutSession(runtimes.ctx),
+      createCheckoutSession: createStripeCheckoutSession(runtimes.ctx, {
+        ...(options.paymentInvoiceCreation !== undefined && {
+          paymentInvoiceCreation: options.paymentInvoiceCreation,
+        }),
+      }),
       createPortalSession: createStripePortalSession(runtimes.ctx),
       cancelSubscription: createStripeCancelSubscription(runtimes.ctx),
     };

package/src/subscription-stripe/plugin-methods.ts

@@ -32,7 +32,16 @@ export type StripeCheckoutOptions = Parameters<
   NonNullable<SubscriptionProviderPlugin["createCheckoutSession"]>
 >[1];
 
-export function createStripeCheckoutSession(runtime: StripeCtxRuntime) {
+export type StripeCheckoutSessionRuntimeOptions = {
+  /** Whether a mode:"payment" checkout gets a Stripe invoice. Default true.
+   *  Never applied in mode:"subscription" — Stripe rejects invoice_creation there. */
+  readonly paymentInvoiceCreation?: boolean;
+};
+
+export function createStripeCheckoutSession(
+  runtime: StripeCtxRuntime,
+  { paymentInvoiceCreation = true }: StripeCheckoutSessionRuntimeOptions = {},
+) {
   return async (ctx: HandlerContext, options: StripeCheckoutOptions): Promise<{ url: string }> => {
     // #104-Invariante: ohne billing-live darf keine Stripe-Session
     // entstehen (sk_test_-Keys in prod erzeugen sonst einen Test-Mode-
@@ -52,9 +61,15 @@ export function createStripeCheckoutSession(runtime: StripeCtxRuntime) {
       // payment-mode) — the subsequent webhook reads metadata.tenantId off
       // the subscription it creates. payment-mode has no subscription, so
       // tenantId travels via payment_intent_data.metadata instead.
+      // invoice_creation is payment-mode-only for the same reason — Stripe
+      // rejects it in subscription-mode, which invoices via the subscription
+      // itself.
       ...(mode === "subscription"
         ? { subscription_data: { metadata: { tenantId: options.tenantId } } }
-        : { payment_intent_data: { metadata: { tenantId: options.tenantId } } }),
+        : {
+            payment_intent_data: { metadata: { tenantId: options.tenantId } },
+            invoice_creation: { enabled: paymentInvoiceCreation },
+          }),
       ...(options.providerCustomerId && { customer: options.providerCustomerId }),
     });
 

package/src/tenant/__tests__/is-tenant-serving-public-content.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, test } from "bun:test";
+import { isTenantServingPublicContent } from "../is-tenant-serving-public-content";
+import { TENANT_LIFECYCLE_STATUSES, type TenantLifecycleStatus } from "../schema/tenant";
+
+describe("isTenantServingPublicContent", () => {
+  test("true only for an enabled, active tenant", () => {
+    expect(isTenantServingPublicContent({ isEnabled: true, status: "active" })).toBe(true);
+  });
+
+  test("false when disabled, even if active", () => {
+    expect(isTenantServingPublicContent({ isEnabled: false, status: "active" })).toBe(false);
+  });
+
+  test.each(
+    TENANT_LIFECYCLE_STATUSES.filter(
+      (status): status is Exclude<TenantLifecycleStatus, "active"> => status !== "active",
+    ),
+  )("false for enabled tenant with status '%s'", (status) => {
+    expect(isTenantServingPublicContent({ isEnabled: true, status })).toBe(false);
+  });
+});

package/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.313.0",
+    "type": "fix",
+    "title": "Team member status and roles now translate instead of showing the raw enum value",
+    "detail": "member-status-cell and member-roles-cell rendered the raw status/role\nenum values (e.g. \"active\", \"TenantAdmin\") straight into the table —\nnon-English admin UIs showed English words next to translated column\nlabels. Both cells now resolve through useTranslation against the\nexisting tenant.members.filter.status.option.<status> and\ntenant:entity:__action-form__:field:roles:option:<role> keys, falling\nback to the raw value for any status/role not covered by those keys."
+  },
   {
     "version": "0.296.0",
     "type": "improvement",

package/src/tenant/index.ts

@@ -8,6 +8,7 @@ export {
   tenantInvitationEntity,
   tenantInvitationsTable,
 } from "./invitation-table";
+export { isTenantServingPublicContent } from "./is-tenant-serving-public-content";
 export { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table";
 export {
   TENANT_LIFECYCLE_STATUSES,

package/src/tenant/is-tenant-serving-public-content.ts

@@ -0,0 +1,13 @@
+import type { TenantLifecycleStatus } from "./schema/tenant";
+
+/** Whether a tenant still serves content to anonymous/public callers.
+ *  `destroyRequested` is deliberately blocked too, not just `destroying`
+ *  onward — secure by default: the tenant already asked to be removed, so
+ *  its data should stop being publicly reachable immediately rather than
+ *  during the grace period. */
+export function isTenantServingPublicContent(row: {
+  readonly isEnabled: boolean;
+  readonly status: TenantLifecycleStatus;
+}): boolean {
+  return row.isEnabled && row.status === "active";
+}

package/src/tenant/web/__tests__/member-roles-cell.test.tsx

@@ -0,0 +1,59 @@
+import { describe, expect, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+  translationsByLocaleFromKeys,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { TENANT_I18N } from "../../i18n";
+import { MemberRolesCell } from "../member-roles-cell";
+
+const fallbackBundles = [translationsByLocaleFromKeys(TENANT_I18N)];
+
+function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
+  return (
+    <LocaleProvider resolver={createStaticLocaleResolver()} fallbackBundles={fallbackBundles}>
+      <PrimitivesProvider value={defaultPrimitives}>{children}</PrimitivesProvider>
+    </LocaleProvider>
+  );
+}
+
+describe("MemberRolesCell", () => {
+  test("translates known roles, joined by comma", () => {
+    render(
+      <Wrapper>
+        <MemberRolesCell
+          value={["TenantAdmin", "Editor"]}
+          row={{ roles: ["TenantAdmin", "Editor"] }}
+          column={{ field: "roles" }}
+        />
+      </Wrapper>,
+    );
+    expect(screen.getByText("Tenant Admin, Editor")).toBeTruthy();
+  });
+
+  test("falls back to the raw name for an unknown, app-defined role", () => {
+    render(
+      <Wrapper>
+        <MemberRolesCell
+          value={["AppCustomRole"]}
+          row={{ roles: ["AppCustomRole"] }}
+          column={{ field: "roles" }}
+        />
+      </Wrapper>,
+    );
+    expect(screen.getByText("AppCustomRole")).toBeTruthy();
+  });
+
+  test("renders nothing for a non-array roles value", () => {
+    render(
+      <Wrapper>
+        <MemberRolesCell value={undefined} row={{}} column={{ field: "roles" }} />
+      </Wrapper>,
+    );
+    expect(screen.queryByText(/./)).toBeNull();
+  });
+});

package/src/tenant/web/__tests__/member-status-cell.test.tsx

@@ -0,0 +1,46 @@
+import { describe, expect, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+  translationsByLocaleFromKeys,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { TENANT_I18N } from "../../i18n";
+import { MemberStatusCell } from "../member-status-cell";
+
+const fallbackBundles = [translationsByLocaleFromKeys(TENANT_I18N)];
+
+function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
+  return (
+    <LocaleProvider resolver={createStaticLocaleResolver()} fallbackBundles={fallbackBundles}>
+      <PrimitivesProvider value={defaultPrimitives}>{children}</PrimitivesProvider>
+    </LocaleProvider>
+  );
+}
+
+describe("MemberStatusCell", () => {
+  test("translates a known status", () => {
+    render(
+      <Wrapper>
+        <MemberStatusCell value="active" row={{ status: "active" }} column={{ field: "status" }} />
+      </Wrapper>,
+    );
+    expect(screen.getByText("Active")).toBeTruthy();
+  });
+
+  test("falls back to the raw value for an unknown status", () => {
+    render(
+      <Wrapper>
+        <MemberStatusCell
+          value="app-custom"
+          row={{ status: "app-custom" }}
+          column={{ field: "status" }}
+        />
+      </Wrapper>,
+    );
+    expect(screen.getByText("app-custom")).toBeTruthy();
+  });
+});

package/src/tenant/web/member-roles-cell.tsx

@@ -3,10 +3,19 @@
 // `readonly string[]` on TeamRow (see team-list.query.ts), and DataTable has
 // no default array-to-cell formatting, so this joins it into one string.
 
-import type { ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import { type ColumnRendererProps, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import type { ReactNode } from "react";
+import { translateOrRaw } from "./translate-or-raw";
 
 export function MemberRolesCell({ row }: ColumnRendererProps): ReactNode {
+  const t = useTranslation();
   const roles = row["roles"];
-  return Array.isArray(roles) ? roles.join(", ") : "";
+  if (!Array.isArray(roles)) return "";
+  return roles
+    .map((role) =>
+      typeof role === "string"
+        ? translateOrRaw(t, `tenant:entity:__action-form__:field:roles:option:${role}`, role)
+        : "",
+    )
+    .join(", ");
 }

package/src/tenant/web/member-status-cell.tsx

@@ -4,9 +4,10 @@
 // screens.ts). The list frame itself is the generic declarative
 // projectionList renderer — only this one cell stays TSX.
 
-import type { ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import { type ColumnRendererProps, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { StatusBadge, type StatusTone } from "@cosmicdrift/kumiko-renderer-web";
 import type { ReactNode } from "react";
+import { translateOrRaw } from "./translate-or-raw";
 
 const STATUS_TONE: Readonly<Record<string, StatusTone>> = {
   active: "ok",
@@ -14,10 +15,13 @@ const STATUS_TONE: Readonly<Record<string, StatusTone>> = {
 };
 
 export function MemberStatusCell({ row }: ColumnRendererProps): ReactNode {
+  const t = useTranslation();
   const status = typeof row["status"] === "string" ? row["status"] : "";
+  const label =
+    status === "" ? "" : translateOrRaw(t, `tenant.members.filter.status.option.${status}`, status);
   return (
     <StatusBadge tone={STATUS_TONE[status] ?? "muted"} testId="member-status-cell">
-      {status}
+      {label}
     </StatusBadge>
   );
 }

package/src/tenant/web/translate-or-raw.ts

@@ -0,0 +1,13 @@
+// @runtime client
+import type { useTranslation } from "@cosmicdrift/kumiko-renderer";
+
+type Translate = ReturnType<typeof useTranslation>;
+
+/** `t(key)` returns the key itself when the key is missing from every
+ *  bundle — the convention every cell that translates an open-ended,
+ *  app-extensible value (a status, a role name) relies on to fall back to
+ *  the raw value instead of showing a dot-form key to the user. */
+export function translateOrRaw(t: Translate, key: string, raw: string): string {
+  const translated = t(key);
+  return translated === key ? raw : translated;
+}

package/src/tenant-handover/__tests__/claim-storage-usage.integration.test.ts

@@ -0,0 +1,201 @@
+// tenant-handover's `claim` moving a fileRef's OWN event history + its share
+// of the tenant-storage-usage counters (item 4): before this, moveFileRefs
+// only flipped the file_refs row's tenant_id, so the fileRef aggregate's
+// events in kumiko_events stayed under the source tenant — a later write
+// against the moved fileRef couldn't load its stream, and a projection
+// rebuild put the row back into the source tenant. See ../move-entity-graph.ts
+// and framework/src/files/storage-tracking.ts for the fix.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import {
+  asRawClient,
+  buildEntityTable,
+  createEventStoreExecutor,
+  createTenantDb,
+  selectMany,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntity,
+  createSystemUser,
+  createTextField,
+  defineFeature,
+  type EntityDefinition,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createFilesFeature,
+  fileRefEntity,
+  fileRefsTable,
+  filesStorageTrackingFeature,
+  tenantStorageUsageTable,
+} from "@cosmicdrift/kumiko-framework/files";
+import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { signTenantHandoverGrant } from "../grant";
+import { createTenantHandoverFeature } from "../index";
+
+const CLAIM = "tenant-handover:write:claim";
+const SECRET = "tenant-handover-storage-usage-secret";
+// files feature -> r.entity("fileRef", ...) -> implicit projection name
+// (registry-validate.ts's buildImplicitProjections naming convention).
+const FILE_REF_PROJECTION = "files:projection:file-ref-entity";
+
+const runEntity: EntityDefinition = createEntity({
+  table: "handover_storage_run",
+  idType: "uuid",
+  transferable: true,
+  fields: {
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
+  },
+});
+
+const handoverStorageFixturesFeature = defineFeature("handover-storage-fixtures", (r) => {
+  r.entity("run", runEntity);
+});
+
+const runTable = buildEntityTable("run", runEntity);
+const runCrud = createEventStoreExecutor(runTable, runEntity, { entityName: "run" });
+
+const fileRefCrud = createEventStoreExecutor(fileRefsTable, fileRefEntity, {
+  entityName: "fileRef",
+});
+
+let stack: TestStack;
+
+const SOURCE_TENANT = testTenantId(4);
+let nextUserId = 1000;
+
+function destinationUser(tenantN: number) {
+  return createTestUser({ id: nextUserId++, tenantId: testTenantId(tenantN), roles: ["User"] });
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createTenantHandoverFeature({ grantSecret: SECRET }),
+      handoverStorageFixturesFeature,
+      createFilesFeature(),
+      filesStorageTrackingFeature,
+    ],
+  });
+  await unsafeCreateEntityTable(stack.db, runEntity, "run");
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  stack.events.reset();
+  await asRawClient(stack.db).unsafe(
+    `TRUNCATE kumiko_events, kumiko_snapshots, kumiko_event_consumers, handover_storage_run, file_refs, read_tenant_storage_usage RESTART IDENTITY CASCADE`,
+  );
+  await stack.eventDispatcher?.ensureRegistered();
+});
+
+async function seedRun(tenantId: TenantId, name: string): Promise<string> {
+  const user = createSystemUser(tenantId);
+  const db = createTenantDb(stack.db, tenantId, "system");
+  const result = await runCrud.create({ name }, user, db);
+  if (!result.isSuccess) throw new Error(`seedRun failed: ${result.error.message}`);
+  return String(result.data.id);
+}
+
+async function attachFile(tenantId: TenantId, entityId: string, size: number): Promise<string> {
+  const user = createSystemUser(tenantId);
+  const db = createTenantDb(stack.db, tenantId, "system");
+  const result = await fileRefCrud.create(
+    {
+      storageKey: `${tenantId}/run/${entityId}/photo/x.jpg`,
+      fileName: "photo.jpg",
+      mimeType: "image/jpeg",
+      size,
+      entityType: "run",
+      entityId,
+      fieldName: "photo",
+    },
+    user,
+    db,
+  );
+  if (!result.isSuccess) throw new Error(`attachFile failed: ${result.error.message}`);
+  return String(result.data.id);
+}
+
+function grantFor(rowId: string): string {
+  return signTenantHandoverGrant({
+    entityType: "run",
+    rowId,
+    sourceTenantId: SOURCE_TENANT,
+    ttlMinutes: 30,
+    secret: SECRET,
+  }).token;
+}
+
+async function usageFor(tenantId: string): Promise<{ totalBytes: number; fileCount: number }> {
+  const [row] = await selectMany(stack.db, tenantStorageUsageTable, { tenantId });
+  return row
+    ? { totalBytes: Number(row["totalBytes"]) ?? 0, fileCount: Number(row["fileCount"]) ?? 0 }
+    : { totalBytes: 0, fileCount: 0 };
+}
+
+describe("tenant-handover :: claim moves fileRef event history + storage usage", () => {
+  test("moves the fileRef aggregate's own event history and storage-usage counters, leaving the moved fileRef writable and rebuild-stable", async () => {
+    const runId = await seedRun(SOURCE_TENANT, "my run");
+    const FILE_SIZE = 42;
+    const fileId = await attachFile(SOURCE_TENANT, runId, FILE_SIZE);
+
+    // Let the dispatcher apply fileRef.created before the claim, so the
+    // counters this test asserts on are the MSP's real applied state, not
+    // just the write-tx's own effect.
+    await stack.eventDispatcher?.runOnce();
+    expect(await usageFor(SOURCE_TENANT)).toEqual({ totalBytes: FILE_SIZE, fileCount: 1 });
+
+    const dest = destinationUser(1);
+    const data = await stack.http.writeOk<{ movedEntities: Record<string, number> }>(
+      CLAIM,
+      { token: grantFor(runId), entityType: "run" },
+      dest,
+    );
+    expect(data.movedEntities).toEqual({ run: 1, fileRef: 1 });
+
+    // Let the dispatcher settle again — the transfer already moved the
+    // counters synchronously inside the claim's own transaction, so this
+    // pass must be a no-op, not a double-apply.
+    await stack.eventDispatcher?.runOnce();
+
+    expect(await usageFor(SOURCE_TENANT)).toEqual({ totalBytes: 0, fileCount: 0 });
+    expect(await usageFor(dest.tenantId)).toEqual({ totalBytes: FILE_SIZE, fileCount: 1 });
+
+    // The fileRef aggregate's OWN event history moved too — a write against
+    // it in the destination tenant must succeed (it couldn't load its
+    // stream before this fix).
+    const deleteUser = createSystemUser(dest.tenantId as TenantId);
+    const deleteDb = createTenantDb(stack.db, dest.tenantId as TenantId, "system");
+    const deleteResult = await fileRefCrud.delete({ id: fileId }, deleteUser, deleteDb);
+    expect(deleteResult.isSuccess).toBe(true);
+
+    // A projection rebuild must not resurrect the row under the source
+    // tenant — before the fix, the fileRef.created event still carried the
+    // source tenant_id and the rebuild would put file_refs.tenant_id back.
+    await rebuildProjection(FILE_REF_PROJECTION, { db: stack.db, registry: stack.registry });
+
+    const rows = await asRawClient(stack.db).unsafe(
+      `SELECT tenant_id AS "tenantId", is_deleted AS "isDeleted" FROM file_refs WHERE id = $1`,
+      [fileId],
+    );
+    const row = (rows as Array<{ tenantId: string; isDeleted: boolean }>)[0];
+    expect(row?.tenantId).toBe(dest.tenantId);
+    expect(row?.isDeleted).toBe(true);
+
+    // Independently of the read-model rebuild above, the dispatcher applies
+    // the pending fileRef.deleted event against the tenant-storage-usage MSP.
+    await stack.eventDispatcher?.runOnce();
+    expect(await usageFor(dest.tenantId)).toEqual({ totalBytes: 0, fileCount: 0 });
+  });
+});