@cosmicdrift/kumiko-bundled-features 0.340.0 → 0.342.0

package/dist/renderer-simple/simple-renderer.d.ts

@@ -4,14 +4,21 @@ export type MailBranding = {
     readonly productName?: string;
     /** Hex color (#rgb, #rrggbb, #rrggbbaa); used for buttons and the header accent. */
     readonly primaryColor?: string;
-    /** Absolute http(s) URL; anything else is dropped. */
+    /** Absolute http(s) URL; anything else is dropped. Mutually exclusive with `logoPath`. */
     readonly logoUrl?: string;
-    readonly footerText?: string;
-    /** Absolute http(s) URLs only; other entries are dropped. */
+    /** Absolute path on `baseUrl` (e.g. "/logo.png"); use PNG/JPEG, mail clients block SVG. */
+    readonly logoPath?: string;
+    /** Absolute http(s) origin that `logoPath` is resolved against; same base as `auth.mail.baseUrl`. */
+    readonly baseUrl?: string;
+    /** Locale tried after the exact and language-part match when a localized field has no entry. */
+    readonly defaultLocale?: string;
+    readonly footerText?: LocalizedText;
+    /** Absolute http(s) URLs only; string URLs that are not are dropped, localized ones fail at boot. */
     readonly footerLinks?: readonly {
-        readonly label: string;
-        readonly url: string;
+        readonly label: LocalizedText;
+        readonly url: LocalizedText;
     }[];
 };
+export type LocalizedText = string | Readonly<Record<string, string>>;
 export declare function createSimpleRenderer(branding?: MailBranding): NotificationRenderer;
 export declare const simpleRenderer: NotificationRenderer;

package/dist/renderer-simple/simple-renderer.js

@@ -10,14 +10,61 @@ function isHttpUrl(value) {
         return false;
     }
 }
+function languagePart(locale) {
+    return locale.split("-")[0] ?? locale;
+}
+function pickByLocale(entries, locale) {
+    // Own keys only: a locale like "constructor" must not hit Object.prototype.
+    const ownEntry = (key) => Object.hasOwn(entries, key) ? entries[key] : undefined;
+    return ownEntry(locale) ?? ownEntry(languagePart(locale));
+}
+function resolveLocalized(value, locale, defaultLocale) {
+    if (value === undefined || typeof value === "string")
+        return value;
+    return ((locale !== undefined ? pickByLocale(value, locale) : undefined) ??
+        (defaultLocale !== undefined ? pickByLocale(value, defaultLocale) : undefined) ??
+        Object.values(value)[0]);
+}
+function assertLocalizedUrlsAreHttp(branding) {
+    for (const link of branding.footerLinks ?? []) {
+        if (typeof link.url === "string")
+            continue;
+        for (const [locale, url] of Object.entries(link.url)) {
+            if (!isHttpUrl(url)) {
+                throw new Error(`createSimpleRenderer: footerLinks url for locale "${locale}" must be an absolute http(s) URL`);
+            }
+        }
+    }
+}
+function resolveLogoUrl(branding) {
+    if (!branding)
+        return undefined;
+    const { logoUrl, logoPath, baseUrl } = branding;
+    if (logoPath === undefined) {
+        return logoUrl && isHttpUrl(logoUrl) ? logoUrl : undefined;
+    }
+    if (logoUrl !== undefined) {
+        throw new Error("createSimpleRenderer: logoPath and logoUrl are mutually exclusive");
+    }
+    if (baseUrl === undefined || !isHttpUrl(baseUrl)) {
+        throw new Error("createSimpleRenderer: logoPath requires an absolute http(s) baseUrl");
+    }
+    if (!/^\/(?![/\\])/.test(logoPath) || logoPath.includes("\\")) {
+        throw new Error('createSimpleRenderer: logoPath must start with a single "/"');
+    }
+    const resolved = new URL(logoPath, baseUrl);
+    if (resolved.origin !== new URL(baseUrl).origin) {
+        throw new Error("createSimpleRenderer: logoPath must stay on the baseUrl origin");
+    }
+    return resolved.href;
+}
 function resolvePrimaryColor(branding) {
     const color = branding?.primaryColor;
     return color && HEX_COLOR_PATTERN.test(color) ? color : DEFAULT_PRIMARY_COLOR;
 }
-function renderBrandingHeader(branding, primaryColor) {
+function renderBrandingHeader(branding, primaryColor, logoUrl) {
     if (!branding)
         return "";
-    const logoUrl = branding.logoUrl && isHttpUrl(branding.logoUrl) ? branding.logoUrl : undefined;
     if (!logoUrl && !branding.productName)
         return "";
     const logo = logoUrl
@@ -25,16 +72,20 @@ function renderBrandingHeader(branding, primaryColor) {
         : `<span style="font-size:18px;font-weight:700;color:${escapeHtmlAttr(primaryColor)}">${escapeHtml(branding.productName ?? "")}</span>`;
     return `<div style="margin:0 0 24px;padding:0 0 16px;border-bottom:3px solid ${escapeHtmlAttr(primaryColor)}">${logo}</div>`;
 }
-function renderBrandingFooter(branding) {
+function renderBrandingFooter(branding, locale) {
     if (!branding)
         return "";
-    const links = (branding.footerLinks ?? [])
-        .filter((link) => isHttpUrl(link.url))
-        .map((link) => `<a href="${escapeHtmlAttr(link.url)}" style="color:#999">${escapeHtml(link.label)}</a>`);
-    const footerPartsHtml = [
-        branding.footerText ? escapeHtml(branding.footerText) : "",
-        links.join(" · "),
-    ].filter((part) => part !== "");
+    const pick = (value) => resolveLocalized(value, locale, branding.defaultLocale);
+    const links = (branding.footerLinks ?? []).flatMap((link) => {
+        const url = pick(link.url);
+        if (url === undefined || !isHttpUrl(url))
+            return [];
+        return [
+            `<a href="${escapeHtmlAttr(url)}" style="color:#999">${escapeHtml(pick(link.label) ?? "")}</a>`,
+        ];
+    });
+    const footerText = pick(branding.footerText);
+    const footerPartsHtml = [footerText ? escapeHtml(footerText) : "", links.join(" · ")].filter((part) => part !== "");
     if (footerPartsHtml.length === 0)
         return "";
     const footerHtml = footerPartsHtml.join("<br />");
@@ -53,6 +104,9 @@ function renderSection(section, primaryColor) {
 // No external dependencies, no template engine — just string concatenation.
 export function createSimpleRenderer(branding) {
     const primaryColor = resolvePrimaryColor(branding);
+    const logoUrl = resolveLogoUrl(branding);
+    if (branding)
+        assertLocalizedUrlsAreHttp(branding);
     return {
         name: "simple",
         async render(input) {
@@ -63,7 +117,7 @@ export function createSimpleRenderer(branding) {
             const parts = [];
             parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
             parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
-            parts.push(renderBrandingHeader(branding, primaryColor));
+            parts.push(renderBrandingHeader(branding, primaryColor, logoUrl));
             if (header) {
                 parts.push(`<h1 style="margin:0 0 24px;color:#111;font-size:20px;font-weight:600">${escapeHtml(header)}</h1>`);
             }
@@ -75,7 +129,7 @@ export function createSimpleRenderer(branding) {
             if (data.footer) {
                 parts.push(`<p style="margin:24px 0 0;color:#999;font-size:12px;border-top:1px solid #eee;padding-top:16px">${escapeHtml(data.footer)}</p>`);
             }
-            parts.push(renderBrandingFooter(branding));
+            parts.push(renderBrandingFooter(branding, input.locale));
             parts.push("</div></body></html>");
             return parts.join("");
         },

package/dist/secrets/announce-secret-change.d.ts

@@ -0,0 +1,8 @@
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type CacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
+type AnnouncingContext = {
+    readonly cacheSync?: CacheSyncBus;
+    readonly scheduleAfterCommit?: (hook: () => Promise<void>) => void;
+};
+export declare function announceSecretChange(ctx: AnnouncingContext, tenantId: TenantId, key: string): void;
+export {};

package/dist/secrets/announce-secret-change.js

@@ -0,0 +1,18 @@
+import { CACHE_SYNC_TOPICS, } from "@cosmicdrift/kumiko-framework/redis";
+// Secret writes bypass config:write:*, yet provider caches (e.g. the S3 secret
+// key) depend on them: announce on the tenant-config topic, after commit so a
+// replica reloading on the message sees the new value.
+export function announceSecretChange(ctx, tenantId, key) {
+    const bus = ctx.cacheSync;
+    // skip: no bus wired (single-process setup), nothing to announce
+    if (!bus)
+        return;
+    const message = { tenantId, key };
+    const publish = async () => {
+        bus.publish(CACHE_SYNC_TOPICS.tenantConfig, message);
+    };
+    if (ctx.scheduleAfterCommit)
+        ctx.scheduleAfterCommit(publish);
+    else
+        bus.publish(CACHE_SYNC_TOPICS.tenantConfig, message);
+}

package/dist/secrets/feature.js

@@ -54,7 +54,7 @@ export function requireSecretsContext(ctx, handlerName) {
     if (!ctx.secrets) {
         throw new InternalError({
             message: `[${handlerName}] ctx.secrets missing — pass ` +
-                "createSecretsContext({db, masterKeyProvider}) via extraContext.secrets at boot.",
+                "createSecretsContext({db, masterKeyProvider, registry}) via extraContext.secrets at boot.",
         });
     }
     const raw = ctx.secrets;

package/dist/secrets/handlers/delete.write.js

@@ -1,6 +1,7 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite } from "../write-gate.js";
@@ -23,6 +24,7 @@ export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
             });
             if (!removed)
                 return failNotFound("tenant-secret", event.payload.key);
+            announceSecretChange(ctx, event.user.tenantId, event.payload.key);
             return { isSuccess: true, data: { key: event.payload.key } };
         },
     });

package/dist/secrets/handlers/set.write.js

@@ -1,8 +1,9 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
-import { checkSecretKeyWrite } from "../write-gate.js";
+import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.js";
 export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
         name: "set",
@@ -30,6 +31,9 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
             const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, key);
             if (!gate.ok)
                 return gate.failure;
+            const invalidValue = checkSecretValue(ctx.registry, key, value);
+            if (invalidValue)
+                return invalidValue;
             const featureRedact = gate.keyDef?.redact;
             const redactFn = redactedPreview
                 ? () => redactedPreview
@@ -39,6 +43,7 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
                 ...(hint ? { hint } : {}),
                 updatedBy: event.user.id,
             });
+            announceSecretChange(ctx, event.user.tenantId, key);
             return {
                 isSuccess: true,
                 data: { key, redactedPreview: redactedPreview ?? redactFn(value) },

package/dist/secrets/i18n.d.ts

@@ -7,4 +7,8 @@ export declare const SECRETS_I18N: {
         readonly en: "You are not allowed to change this secret.";
         readonly de: "Dieses Geheimnis darf nicht geändert werden.";
     };
+    readonly "secrets.errors.invalidValue": {
+        readonly en: "This value is not valid for this secret.";
+        readonly de: "Dieser Wert ist für dieses Geheimnis nicht gültig.";
+    };
 };

package/dist/secrets/i18n.js

@@ -7,4 +7,8 @@ export const SECRETS_I18N = {
         en: "You are not allowed to change this secret.",
         de: "Dieses Geheimnis darf nicht geändert werden.",
     },
+    "secrets.errors.invalidValue": {
+        en: "This value is not valid for this secret.",
+        de: "Dieser Wert ist für dieses Geheimnis nicht gültig.",
+    },
 };

package/dist/secrets/secrets-context.d.ts

@@ -1,10 +1,12 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type DekCache, type MasterKeyProvider, type SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import * as z from "zod";
+import { type SecretValueSchemaSource } from "./write-gate.js";
 export type { Secret, SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 export type SecretsContextOptions = {
     readonly db: DbConnection;
     readonly masterKeyProvider: MasterKeyProvider;
+    readonly registry: SecretValueSchemaSource;
     readonly dekCache?: DekCache;
 };
 export declare const TENANT_SECRET_READ_EVENT = "secrets:event:read";

package/dist/secrets/secrets-context.js

@@ -20,6 +20,7 @@ import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { selectTenantSecretEnvelope } from "./db/queries/read.js";
 import { tenantSecretEntity, tenantSecretsTable, } from "./table.js";
+import { invalidSecretValueError, isSecretValueValid, } from "./write-gate.js";
 // Synthetic actor identity for set/delete — the executor wants a full
 // SessionUser, but the secrets-context API takes only a user-id string
 // (via opts.updatedBy / opts.deletedBy). `system`-role mirrors how jobs
@@ -114,6 +115,8 @@ export function createSecretsContext(opts) {
         },
         async set(tenantId, keyOrHandle, value, setOpts = {}) {
             const key = resolveKey(keyOrHandle);
+            if (!isSecretValueValid(opts.registry, key, value))
+                throw invalidSecretValueError();
             const envelope = await encryptValue(value, masterKeyProvider);
             const stored = encodeStoredEnvelope(envelope);
             const metadata = {

package/dist/secrets/write-gate.d.ts

@@ -1,5 +1,5 @@
 import type { Registry, SecretKeyDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { ValidationError, type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 export type SecretKeyWriteCheck = {
     readonly ok: true;
     readonly keyDef: SecretKeyDefinition | undefined;
@@ -8,3 +8,7 @@ export type SecretKeyWriteCheck = {
     readonly failure: WriteFailure;
 };
 export declare function checkSecretKeyWrite(registry: Registry, userRoles: readonly string[], key: string): SecretKeyWriteCheck;
+export type SecretValueSchemaSource = Pick<Registry, "getSecretKey" | "findSecretNamespace">;
+export declare function invalidSecretValueError(): ValidationError;
+export declare function isSecretValueValid(schemas: SecretValueSchemaSource, key: string, value: string): boolean;
+export declare function checkSecretValue(registry: SecretValueSchemaSource, key: string, value: string): WriteFailure | undefined;

package/dist/secrets/write-gate.js

@@ -1,4 +1,4 @@
-import { AccessDeniedError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { AccessDeniedError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 function unknownKeyFailure(key) {
     return {
         ok: false,
@@ -34,3 +34,26 @@ export function checkSecretKeyWrite(registry, userRoles, key) {
     }
     return { ok: true, keyDef };
 }
+// Carries neither the value nor the schema's issues.
+export function invalidSecretValueError() {
+    return new ValidationError({
+        fields: [
+            {
+                path: "value",
+                code: "invalid_secret_value",
+                i18nKey: "secrets.errors.invalidValue",
+            },
+        ],
+    }, { i18nKey: "secrets.errors.invalidValue" });
+}
+export function isSecretValueValid(schemas, key, value) {
+    const valueSchema = schemas.getSecretKey(key)?.valueSchema ?? schemas.findSecretNamespace(key)?.valueSchema;
+    return valueSchema === undefined || valueSchema.safeParse(value).success;
+}
+// Runs after checkSecretKeyWrite, so a caller without the write role never learns
+// whether a value would have passed.
+export function checkSecretValue(registry, key, value) {
+    if (isSecretValueValid(registry, key, value))
+        return undefined;
+    return writeFailure(invalidSecretValueError());
+}

package/dist/tenant/constants.d.ts

@@ -39,4 +39,5 @@ export declare const TenantErrors: {
     readonly membershipAlreadyExists: "membership_already_exists";
     readonly lastTenantAdmin: "last_tenant_admin";
     readonly invitationSuperseded: "invitation_superseded";
+    readonly crossTenantMembershipDenied: "cross_tenant_membership_denied";
 };

package/dist/tenant/constants.js

@@ -65,4 +65,5 @@ export const TenantErrors = {
     membershipAlreadyExists: "membership_already_exists",
     lastTenantAdmin: "last_tenant_admin",
     invitationSuperseded: "invitation_superseded",
+    crossTenantMembershipDenied: "cross_tenant_membership_denied",
 };

package/dist/tenant/handlers/add-member.write.js

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { ConflictError, InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { defineWriteHandler, SYSTEM_ROLE, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, ConflictError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { TenantErrors } from "../constants.js";
 import { findForbiddenMembershipRole, reservedMembershipRoleError } from "../membership-roles.js";
@@ -9,6 +9,11 @@ import { tenantMembershipEntity, tenantMembershipsTable } from "../membership-ta
 const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembershipEntity, {
     entityName: "tenant-membership",
 });
+// Both halves: test stacks can mint JWTs with the "system" role, but only the
+// framework operator carries SYSTEM_USER_ID.
+function isFrameworkSystemUser(user) {
+    return user.id === SYSTEM_USER_ID && user.roles.includes(SYSTEM_ROLE);
+}
 export const addMemberWrite = defineWriteHandler({
     name: "addMember",
     schema: z.object({
@@ -16,7 +21,7 @@ export const addMemberWrite = defineWriteHandler({
         tenantId: z.string(),
         roles: z.array(z.string()).min(1),
     }),
-    access: { roles: ["SystemAdmin"] },
+    access: { roles: [SYSTEM_ROLE, "SystemAdmin"] },
     description: "Grants an existing user membership in a tenant with the given roles, refusing reserved role names and a user who is already a member; use it to add someone to a workspace without going through an invitation.",
     handler: async (event, ctx) => {
         if (!ctx.systemDb) {
@@ -25,6 +30,12 @@ export const addMemberWrite = defineWriteHandler({
             });
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin manages memberships across tenants");
+        if (!isFrameworkSystemUser(event.user) && event.payload.tenantId !== event.user.tenantId) {
+            return writeFailure(new AccessDeniedError({
+                message: "only the system context may add members to another tenant",
+                details: { reason: TenantErrors.crossTenantMembershipDenied },
+            }));
+        }
         const forbidden = findForbiddenMembershipRole(event.payload.roles);
         if (forbidden !== undefined)
             return writeFailure(reservedMembershipRoleError(forbidden));

package/dist/tenant/handlers/invitations.query.d.ts

@@ -1,5 +1,13 @@
 import * as z from "zod";
 export declare const invitationsQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"invitations", z.ZodObject<{}, z.core.$strip>, {
+    id: unknown;
+    tenantId: unknown;
     email: unknown;
+    role: unknown;
+    status: unknown;
     invitedBy: unknown;
+    expiresAt: unknown;
+    insertedAt: unknown;
+    version: unknown;
+    globalRoles?: unknown;
 }[], import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/tenant/handlers/invitations.query.js

@@ -4,6 +4,7 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
 import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table.js";
+import { isSystemAdmin } from "./is-system-admin.js";
 // Bounded, not Promise.all/sequential: each decrypt hits the KMS adapter's
 // own small dedicated pool (PgKmsAdapter default max: 4). Promise.all fires
 // one call per row unbounded and exhausts the pool once invitation counts
@@ -46,7 +47,20 @@ export const invitationsQuery = defineQueryHandler({
             const decryptedInvitedBy = typeof invitedBy === "string"
                 ? await decryptStoredPii(invitedBy, "invitedBy", "tenant:invitations")
                 : invitedBy;
-            return { ...row, email: decryptedEmail, invitedBy: decryptedInvitedBy };
+            // Explicit allowlist: the raw row also carries blind-index columns and
+            // globalRoles, which only a SystemAdmin may see.
+            return {
+                id: row["id"],
+                tenantId: row["tenantId"],
+                email: decryptedEmail,
+                role: row["role"],
+                status: row["status"],
+                invitedBy: decryptedInvitedBy,
+                expiresAt: row["expiresAt"],
+                insertedAt: row["insertedAt"],
+                version: row["version"],
+                ...(isSystemAdmin(query.user) && { globalRoles: row["globalRoles"] }),
+            };
         });
     },
 });

package/dist/tenant/index.d.ts

@@ -1,3 +1,4 @@
+export { cancelPendingInvitation } from "./cancel-pending-invitation.js";
 export { TenantCommandSchemas } from "./command-schemas.js";
 export { OWNER_INVITE_ROLE_OPTIONS, TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries, } from "./constants.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";

package/dist/tenant/index.js

@@ -1,3 +1,4 @@
+export { cancelPendingInvitation } from "./cancel-pending-invitation.js";
 export { TenantCommandSchemas } from "./command-schemas.js";
 export { OWNER_INVITE_ROLE_OPTIONS, TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries, } from "./constants.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";

package/dist/tenant/invitation-table.d.ts

@@ -49,6 +49,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
+    globalRoles: import("@cosmicdrift/kumiko-types/fields").MultiSelectFieldDef<readonly ["SystemAdmin"]>;
     status: {
         readonly type: "select";
         readonly description?: string;
@@ -151,6 +152,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
+    globalRoles: import("@cosmicdrift/kumiko-types/fields").MultiSelectFieldDef<readonly ["SystemAdmin"]>;
     status: {
         readonly type: "select";
         readonly description?: string;

package/dist/tenant/invitation-table.js

@@ -22,7 +22,9 @@
 // pending → re-use existing row + refresh Redis-token + send mail
 // (analog zu signup-Resend).
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
-import { createEntity, createSelectField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+import { createEntity, createMultiSelectField, createSelectField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
+import { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
 // Status-const-Object damit Handler-Code keine Magic-Strings nutzt.
 // Bei rename (z.B. "cancelled" → "revoked") fällt jeder caller auf
 // einmal auf statt verstreut über 5 Stellen.
@@ -57,6 +59,13 @@ export const tenantInvitationEntity = createEntity({
             personal: false,
             reason: "technical_reference",
         }),
+        // Global (users.roles) roles granted on accept, on top of the membership
+        // role. Only the system-only invite variant sets them; every tenant-admin
+        // re-invite resets them to [] so a resend can never carry them over.
+        globalRoles: createMultiSelectField({
+            options: GLOBAL_ROLE_OPTIONS,
+            default: [],
+        }),
         // Lifecycle-State. Default "pending"; transitions:
         //   pending → accepted | cancelled | expired
         status: createSelectField({

package/dist/tenant-lifecycle/lifecycle-gate.d.ts

@@ -4,6 +4,7 @@ export type TenantLifecycleGate = {
     readonly status: string;
     readonly gracePeriodEnd: string | null;
 };
+export declare const TEARDOWN_GATE_SETTLE_MS = 60000;
 /** @internal exported for the bounded-cache test */
 export declare const GATE_CACHE_MAX_ENTRIES = 5000;
 export declare function invalidateTenantLifecycleGate(tenantId: TenantId): void;

package/dist/tenant-lifecycle/lifecycle-gate.js

@@ -15,6 +15,8 @@ import { tenantTable } from "../tenant/index.js";
 // (cached as null) must not grow the Map without bound: past the cap, expired
 // entries are swept and, if still full, the oldest-inserted entries are evicted.
 const GATE_TTL_MS = 3000;
+// Covers other pods' GATE_TTL_MS plus requests still in flight when the grace period (0 under a compliance override) ends.
+export const TEARDOWN_GATE_SETTLE_MS = 60_000;
 /** @internal exported for the bounded-cache test */
 export const GATE_CACHE_MAX_ENTRIES = 5000;
 const gateCache = new Map();

package/dist/tenant-lifecycle/run-tenant-destroy.js

@@ -6,7 +6,7 @@ import { append, loadAggregate, VersionConflictError, } from "@cosmicdrift/kumik
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantEntity, tenantTable } from "../tenant/index.js";
 import { TENANT_AGGREGATE_TYPE, TENANT_DESTRUCTION_COMPLETED_EVENT_QN, TENANT_DESTRUCTION_FAILED_EVENT_QN, TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT, TENANT_DESTRUCTION_STARTED_EVENT_SHORT, } from "./constants.js";
-import { invalidateTenantLifecycleGate } from "./lifecycle-gate.js";
+import { invalidateTenantLifecycleGate, TEARDOWN_GATE_SETTLE_MS } from "./lifecycle-gate.js";
 import { isDestructionPipelineComplete, pickNextStage, } from "./stages.js";
 const tenantCrud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
 const FEATURE_PREFIX = "tenant-lifecycle:event:";
@@ -173,7 +173,7 @@ export async function runTenantDestructionSweep(args) {
     const now = args.now ?? T.Now.instant();
     const due = await selectMany(args.db, tenantTable, {
         status: "destroyRequested",
-        gracePeriodEnd: { lte: now },
+        gracePeriodEnd: { lte: now.subtract({ milliseconds: TEARDOWN_GATE_SETTLE_MS }) },
     });
     let triggered = 0;
     for (const row of due) {