@cosmicdrift/kumiko-bundled-features 0.365.0 → 0.366.0

package/dist/step-dispatcher/feature.js

@@ -1,22 +1,19 @@
 // step-dispatcher — bundled-feature that drains deferred Tier-2 step
 // requests (webhook.send, mail.send, ...) after their TX commits.
 //
-// Listens on the `kumiko:system:step.dispatch-requested` system event
-// (registry-bypassed, see SYSTEM_EVENT_PREFIX).
-// Performs the side-effect and emits `kumiko:system:step.dispatched`
-// or `kumiko:system:step.dispatch-failed` back onto the same stream so
-// the audit trail lives in the event log only — no separate status table.
-import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
-import { defineFeature, STEP_DISPATCH_AGGREGATE_TYPE, STEP_DISPATCH_FAILED_TYPE, STEP_DISPATCH_REQUESTED_TYPE, STEP_DISPATCHED_TYPE, } from "@cosmicdrift/kumiko-framework/engine";
-import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
-import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-types/identifiers";
+// The `kumiko:system:step.dispatch-requested` system event (registry-bypassed,
+// see SYSTEM_EVENT_PREFIX) is picked up by an MSP that only enqueues a
+// per-dispatch job. The job performs the side-effect and emits
+// `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back
+// onto the same stream so the audit trail lives in the event log only — no
+// separate status table. The job's Redis data carries only the stream id and
+// tenant, never the (encrypted) request payload.
+import { defineFeature, STEP_DISPATCH_AGGREGATE_TYPE, STEP_DISPATCH_REQUESTED_TYPE, } from "@cosmicdrift/kumiko-framework/engine";
+import { createMultiStreamApplyContext } from "@cosmicdrift/kumiko-framework/pipeline";
 import * as z from "zod";
-import { redactEmailAddresses } from "../shared/index.js";
-import { buildDispatchSpec, dispatchRequestedPayloadSchema, rawStepKindOf, readPayloadFields, } from "./dispatch-payload.js";
-import { performMailDispatch } from "./mail-runner.js";
-import { performWebhookDispatch, WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS, } from "./webhook-runner.js";
-const log = createFallbackLogger("step-dispatcher");
+import { DELIVER_MAX_PER_TENANT, DELIVER_RETRIES, deliverJobId, STEP_DISPATCHER_FEATURE, StepDispatcherJobs, } from "./constants.js";
+import { deliverDispatchRequest, eraseDispatchKey, isDispatchOutcome, } from "./deliver-dispatch-request.js";
+import { WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS, } from "./webhook-runner.js";
 export const stepDispatcherEnvSchema = z.object({
     [WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR]: z
         .string()
@@ -24,20 +21,12 @@ export const stepDispatcherEnvSchema = z.object({
         .describe("Comma-separated operator allowlist of private/internal hosts (e.g. a local webhook-receiver for dev/test) that bypass the public-address check for webhook.send targets. Never a tenant-config value."),
 });
 export { STEP_DISPATCH_AGGREGATE_TYPE };
-// zod issue messages can echo the invalid value (e.g. a rejected url) back
-// into the tenant-visible dispatch-failed event — keep this generic.
-const INVALID_DISPATCH_PAYLOAD_ERROR = "invalid dispatch payload";
-const PAYLOAD_UNREADABLE_ERROR = "dispatch payload is not readable";
-// Adapter errors (e.g. SMTP 550) usually echo the recipient address; the
-// dispatch-failed text outlives the payload erase, so only this is persisted.
-const MAIL_DELIVERY_FAILED_ERROR = "mail delivery failed";
-const PAYLOAD_ERASED_ERROR = "dispatch payload erased before an outcome was recorded";
-function isDispatchOutcome(e) {
-    return e.type === STEP_DISPATCHED_TYPE || e.type === STEP_DISPATCH_FAILED_TYPE;
-}
+const NEEDS_JOB_RUNNER_ERROR = "step-dispatcher needs a job runner (Redis) to deliver";
+const DELIVER_ESCAPE_HATCH_REASON = "reads the dispatch stream and appends its outcome event, which needs a raw connection";
+const deliverJobPayloadSchema = z.object({ aggregateId: z.string() });
 export function createStepDispatcherFeature() {
     return defineFeature("step-dispatcher", (r) => {
-        r.describe("Internal system feature that drains deferred Tier-2 side-effects (currently `webhook.send` and `mail.send`) after their originating transaction commits. Listens via `r.multiStreamProjection` on the `kumiko:system:step.dispatch-requested` system event, performs the actual HTTP or mail delivery, then appends `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back onto the same stream so the outcome is recorded in the event log without a separate status table. Mount this feature explicitly via `createStepDispatcherFeature()` in your app's feature list alongside any features that use `r.step.webhook.send` or `r.step.mail.send`. Requires the `secrets` feature (`createSecretsFeature()`) to be mounted — `webhook.send` auth resolves per-tenant through it, under `step-dispatcher:webhook-auth.<name>`. Every `webhook.send` request carries `Idempotency-Key: <dispatch stream id>`, stable across redeliveries of the same dispatch request; an explicit `Idempotency-Key` in `headers` takes precedence.");
+        r.describe("Internal system feature that drains deferred Tier-2 side-effects (currently `webhook.send` and `mail.send`) after their originating transaction commits. An `r.multiStreamProjection` on the `kumiko:system:step.dispatch-requested` system event enqueues one `step-dispatcher:job:deliver` BullMQ job per dispatch (Redis carries only the stream id and tenant, never the request payload). The job performs the actual HTTP or mail delivery and appends `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back onto the same stream, so the outcome is recorded in the event log without a separate status table. Transient failures (network error, timeout, 5xx, 408, 429, any mail adapter failure) are retried 3 times with exponential backoff; the outcome is recorded after the final attempt and the payload key is erased only then. Permanent failures (invalid url, blocked host, other 4xx, unavailable auth secret) are recorded immediately. At most 2 deliveries per tenant run at once (`maxPerTenant` with `onLimit: \"defer\"`), so a slow receiver of one tenant does not delay other tenants. Requires a job runner (Redis) and a worker consuming the job's default `worker` lane; without a job runner the projection fails loudly. Mount this feature explicitly via `createStepDispatcherFeature()` in your app's feature list alongside any features that use `r.step.webhook.send` or `r.step.mail.send`. Requires the `secrets` feature (`createSecretsFeature()`) to be mounted — `webhook.send` auth resolves per-tenant through it, under `step-dispatcher:webhook-auth.<name>`. Every `webhook.send` request carries `Idempotency-Key: <dispatch stream id>`, stable across retries and redeliveries of the same dispatch request; an explicit `Idempotency-Key` in `headers` takes precedence.");
         r.secretNamespace("webhook-auth", WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS);
         r.uiHints({
             displayLabel: "Step Dispatcher · Deferred Side-Effects",
@@ -45,89 +34,47 @@ export function createStepDispatcherFeature() {
             recommended: false,
         });
         r.envSchema(stepDispatcherEnvSchema);
-        r.requires("secrets");
+        r.requires({ features: ["secrets"] });
+        // Literal name: the few-shot corpus parser only reads string-literal job names.
+        // StepDispatcherJobNames.deliver mirrors it; feature.boot.test.ts pins the two together.
+        r.job("deliver", {
+            trigger: { manual: true },
+            retries: DELIVER_RETRIES,
+            backoff: "exponential",
+            maxPerTenant: { limit: DELIVER_MAX_PER_TENANT, onLimit: "defer" },
+            escapeHatch: { reason: DELIVER_ESCAPE_HATCH_REASON },
+        }, async (payload, ctx) => {
+            const { aggregateId } = deliverJobPayloadSchema.parse(payload);
+            const db = ctx.db.unsafeRaw(); // @cast-boundary db-operator — jobs never run inside a DbTx
+            const tenantId = ctx.systemUser.tenantId;
+            await deliverDispatchRequest({
+                aggregateId,
+                tenantId,
+                attempt: ctx.attempt,
+                finalAttempt: ctx.finalAttempt,
+                applyContextFor: (userId) => createMultiStreamApplyContext({
+                    registry: ctx.registry,
+                    db,
+                    tenantId,
+                    userId,
+                    callerFeature: STEP_DISPATCHER_FEATURE,
+                    ...(ctx.secrets && { secrets: ctx.secrets }),
+                }),
+            });
+        });
         r.multiStreamProjection({
             name: "step-dispatcher",
             apply: {
                 [STEP_DISPATCH_REQUESTED_TYPE]: async (event, _tx, ctx) => {
-                    const kms = configuredPiiSubjectKms();
-                    const requestId = requestContext.get()?.requestId ?? "step-dispatcher";
-                    const eraseDispatchKey = async () => {
-                        await kms?.eraseKey({ kind: "record", entity: STEP_DISPATCH_AGGREGATE_TYPE, id: event.aggregateId }, { requestId, eraseReason: "step-dispatch-outcome-recorded" });
-                    };
-                    // Outcome events are plaintext and generic; the request payload's
-                    // per-dispatch key is erased right after, so the PII dies with the
-                    // dispatch instead of living in the event log. The outcome is
-                    // appended before the erase on purpose: if the erase throws, the
-                    // outcome survives and a redelivery only repeats the erase. A crash
-                    // between the send and the outcome append still re-sends under the
-                    // same Idempotency-Key — the one remaining double-send case.
-                    const recordOutcome = async (type, payload) => {
-                        await ctx.unsafeAppendEvent({
-                            aggregateId: event.aggregateId,
-                            aggregateType: STEP_DISPATCH_AGGREGATE_TYPE,
-                            type,
-                            payload,
-                        });
-                        await eraseDispatchKey();
-                    };
-                    const recordFailure = (stepKind, error) => recordOutcome(STEP_DISPATCH_FAILED_TYPE, { stepKind, error, attempt: 1 });
                     const stream = await ctx.loadAggregate(event.aggregateId);
                     if (stream.some(isDispatchOutcome)) {
-                        await eraseDispatchKey();
+                        await eraseDispatchKey(event.aggregateId);
                         // skip: redelivery after an outcome was recorded — only the erase is repeated
                         return;
                     }
-                    const parsed = dispatchRequestedPayloadSchema.safeParse(event.payload);
-                    if (!parsed.success) {
-                        await recordFailure(rawStepKindOf(event.payload), INVALID_DISPATCH_PAYLOAD_ERROR);
-                        // skip: invalid payload already recorded via step.dispatch-failed above, nothing left to dispatch
-                        return;
-                    }
-                    const payload = parsed.data;
-                    const read = await readPayloadFields(payload);
-                    if (read.kind === "unreadable") {
-                        await recordFailure(payload.stepKind, PAYLOAD_UNREADABLE_ERROR);
-                        // skip: unreadable payload already recorded via step.dispatch-failed above
-                        return;
-                    }
-                    if (read.kind === "erased") {
-                        await recordFailure(payload.stepKind, PAYLOAD_ERASED_ERROR);
-                        // skip: erased payload recorded via step.dispatch-failed above
-                        return;
-                    }
-                    const dispatchSpec = buildDispatchSpec(payload, read.fields);
-                    if (!dispatchSpec) {
-                        await recordFailure(payload.stepKind, INVALID_DISPATCH_PAYLOAD_ERROR);
-                        // skip: unparseable payload already recorded via step.dispatch-failed above
-                        return;
-                    }
-                    const result = dispatchSpec.stepKind === "webhook.send"
-                        ? await performWebhookDispatch(dispatchSpec.spec, {
-                            tenantId: event.tenantId,
-                            userId: event.metadata.userId || SYSTEM_USER_ID,
-                            secrets: ctx.secrets,
-                            idempotencyKey: event.aggregateId,
-                        })
-                        : await performMailDispatch(dispatchSpec.spec);
-                    if (result.ok) {
-                        await recordOutcome(STEP_DISPATCHED_TYPE, {
-                            stepKind: payload.stepKind,
-                            status: result.status,
-                        });
-                    }
-                    else {
-                        if (payload.stepKind === "mail.send") {
-                            log.warn("mail dispatch failed", {
-                                aggregateId: event.aggregateId,
-                                reason: redactEmailAddresses(result.error),
-                            });
-                            await recordFailure(payload.stepKind, MAIL_DELIVERY_FAILED_ERROR);
-                        }
-                        else {
-                            await recordFailure(payload.stepKind, result.error);
-                        }
-                    }
+                    if (!ctx.jobs)
+                        throw new Error(NEEDS_JOB_RUNNER_ERROR);
+                    await ctx.jobs.dispatch(StepDispatcherJobs.deliver, { aggregateId: event.aggregateId, _tenantId: event.tenantId }, { jobId: deliverJobId(event.aggregateId) });
                 },
             },
         });

package/dist/step-dispatcher/webhook-runner.d.ts

@@ -33,13 +33,15 @@ export declare const webhookSpecSchema: z.ZodObject<{
     }, z.core.$strip>]>>;
 }, z.core.$strip>;
 export type WebhookSpec = z.infer<typeof webhookSpecSchema>;
-export type WebhookDispatchResult = {
-    readonly ok: true;
-    readonly status: number;
-} | {
+type WebhookDispatchFailure = {
     readonly ok: false;
     readonly error: string;
+    readonly retryable: boolean;
 };
+export type WebhookDispatchResult = {
+    readonly ok: true;
+    readonly status: number;
+} | WebhookDispatchFailure;
 export declare function setWebhookFetch(fn: typeof fetch): void;
 export type WebhookDispatchDeps = {
     readonly tenantId: TenantId;
@@ -51,3 +53,4 @@ export type WebhookDispatchDeps = {
 export declare const WEBHOOK_REQUEST_TIMEOUT_MS = 10000;
 export declare const WEBHOOK_IDEMPOTENCY_KEY_HEADER = "idempotency-key";
 export declare function performWebhookDispatch(spec: WebhookSpec, deps: WebhookDispatchDeps): Promise<WebhookDispatchResult>;
+export {};

package/dist/step-dispatcher/webhook-runner.js

@@ -75,12 +75,14 @@ export const webhookSpecSchema = z.object({
     ])
         .optional(),
 });
+function isRetryableHttpStatus(status) {
+    return status >= 500 || status === 408 || status === 429;
+}
 let fetchImpl = globalThis.fetch.bind(globalThis);
 export function setWebhookFetch(fn) {
     fetchImpl = fn;
 }
-// Bounds a single hanging tenant-controlled receiver to this long. The consumer
-// is sequential and shared, so N hanging requests still delay other tenants by N times this.
+// Bounds a single hanging tenant-controlled receiver to this long per attempt.
 export const WEBHOOK_REQUEST_TIMEOUT_MS = 10_000;
 // Never includes the secret name or value — spec.auth.secret is a
 // tenant-chosen name, but the error still reaches the tenant via the
@@ -110,10 +112,10 @@ async function buildWebhookHeaders(spec, deps) {
     if (!spec.auth)
         return { ok: true, headers };
     if (!deps.secrets)
-        return { ok: false, error: WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR };
+        return { ok: false, error: WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR, retryable: false };
     // A throwing get (corrupt envelope, rotated key, KMS error) must become a
-    // dispatch-failed event; rethrowing would retry and dead-letter the whole
-    // step-dispatcher consumer for every tenant.
+    // dispatch-failed event; rethrowing would burn the job's retries on a
+    // failure a retry cannot fix.
     let secret;
     try {
         const revealed = await deps.secrets.get(deps.tenantId, webhookAuthSecretKey(spec.auth.secret), {
@@ -121,12 +123,12 @@ async function buildWebhookHeaders(spec, deps) {
             handlerName: "step-dispatcher:webhook.send",
         });
         if (!revealed)
-            return { ok: false, error: WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR };
+            return { ok: false, error: WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR, retryable: false };
         secret = revealed.reveal();
     }
     catch {
         log.warn("webhook auth secret lookup failed", { tenantId: deps.tenantId });
-        return { ok: false, error: WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR };
+        return { ok: false, error: WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR, retryable: false };
     }
     if (spec.auth.kind === "bearer") {
         setHeader(headers, "authorization", `Bearer ${secret}`);
@@ -148,7 +150,11 @@ async function resolveWebhookFetchTarget(rawUrl, url, headers) {
         const reason = err instanceof Error ? err.message : String(err);
         if (err instanceof BlockedHostError || err instanceof HostResolutionError) {
             log.warn("webhook host unreachable", { host: url.hostname, reason });
-            return { ok: false, error: "webhook host is not reachable or not allowed" };
+            return {
+                ok: false,
+                error: "webhook host is not reachable or not allowed",
+                retryable: false,
+            };
         }
         throw err;
     }
@@ -165,10 +171,14 @@ export async function performWebhookDispatch(spec, deps) {
         url = new URL(spec.url);
     }
     catch {
-        return { ok: false, error: "invalid url" };
+        return { ok: false, error: "invalid url", retryable: false };
     }
     if (url.protocol !== "http:" && url.protocol !== "https:") {
-        return { ok: false, error: `unsupported url scheme "${url.protocol}"` };
+        return {
+            ok: false,
+            error: `unsupported url scheme "${url.protocol}"`,
+            retryable: false,
+        };
     }
     const headers = await buildWebhookHeaders(spec, deps);
     if (!headers.ok)
@@ -187,7 +197,11 @@ export async function performWebhookDispatch(spec, deps) {
         // Only the status is used; an unread body would pin the socket until the timeout fires.
         await res.body?.cancel().catch(() => { });
         if (!res.ok) {
-            return { ok: false, error: `HTTP ${res.status}: ${res.statusText}` };
+            return {
+                ok: false,
+                error: `HTTP ${res.status}: ${res.statusText}`,
+                retryable: isRetryableHttpStatus(res.status),
+            };
         }
         return { ok: true, status: res.status };
     }
@@ -196,6 +210,7 @@ export async function performWebhookDispatch(spec, deps) {
         return {
             ok: false,
             error: `webhook request failed (${err instanceof Error ? err.name : "unknown error"})`,
+            retryable: true,
         };
     }
 }

package/dist/subscription-mollie/feature.js

@@ -102,7 +102,7 @@ export function createSubscriptionMollieFeature(options) {
             category: "billing",
             recommended: false,
         });
-        r.requires("billing-foundation");
+        r.requires({ features: ["billing-foundation"] });
         r.envSchema(subscriptionMollieEnvSchema);
         const plugin = {
             verifyAndParseWebhook: verifyAndParse,

package/dist/subscription-stripe/feature.js

@@ -93,9 +93,9 @@ export function createSubscriptionStripeFeature(options = {}) {
         // Hard-deps: billing-foundation (plugin-host) + config (billing-live +
         // backing:"secrets" credentials) + secrets (the store the backing:secrets
         // dispatch reads/writes + its tenant_secrets table).
-        r.requires("billing-foundation");
-        r.requires("config");
-        r.requires("secrets");
+        r.requires({ features: ["billing-foundation"] });
+        r.requires({ features: ["config"] });
+        r.requires({ features: ["secrets"] });
         r.envSchema(subscriptionStripeEnvSchema);
         // Runtime config. api-key + webhook-secret declare backing:"secrets" —
         // the value lives envelope-encrypted in the secrets store under

package/dist/tags/feature.js

@@ -41,8 +41,8 @@ function registerTags(r, access, toggleable, ownership, parents) {
     if (toggleable !== undefined)
         r.toggleable(toggleable);
     const tagAssignmentEntity = createTagAssignmentEntity(ownership, parents);
-    r.entity("tag", tagEntity);
-    r.entity("tag-assignment", tagAssignmentEntity);
+    r.entity({ name: "tag", ...tagEntity });
+    r.entity({ name: "tag-assignment", ...tagAssignmentEntity });
     r.writeHandler(createCreateTagHandler(access));
     r.writeHandler(createUpdateTagHandler(access));
     r.writeHandler(createDeleteTagHandler(access));

package/dist/template-resolver/feature.js

@@ -63,13 +63,13 @@ export function createTemplateResolverFeature(opts = {}) {
                 resourceMaxBytes: createSystemConfig("number", { default: 2_097_152, bounds: { min: 1 } }),
             },
         });
-        r.entity("template-resource", templateResourceEntity);
+        r.entity({ name: "template-resource", ...templateResourceEntity });
         // Only when the app actually mounts a user-owned collection: the entity's
         // `content` is `userOwned`, which makes it subject data — the boot guard
         // then requires an EXT_USER_DATA hook (mount `template-resolver-user-data`).
         // Registering it unconditionally would impose that on every app.
         if (hasUserOwned)
-            r.entity("user-content-entry", userContentEntryEntity);
+            r.entity({ name: "user-content-entry", ...userContentEntryEntity });
         const handlers = {
             upsertSystem: r.writeHandler(upsertSystemWrite),
             upsertTenant: r.writeHandler(upsertTenantWrite),

package/dist/template-resolver-user-data/index.js

@@ -12,7 +12,7 @@ export const templateResolverUserDataFeature = defineFeature("template-resolver-
     // template-resolver is optional for the same reason as in
     // notes-history-user-data: a toggleable mount would otherwise trip the
     // "effectively disabled" boot warning even though the entity is there.
-    r.requires("user-data-rights");
+    r.requires({ features: ["user-data-rights"] });
     r.optionalRequires("template-resolver");
     r.useExtension(EXT_USER_DATA, "user-content-entry", {
         export: userContentExportHook,

package/dist/tenant/feature.js

@@ -38,7 +38,7 @@ export function createTenantFeature(options) {
             recommended: true,
         });
         r.systemScope();
-        r.requires("config");
+        r.requires({ features: ["config"] });
         r.extendsRegistrar(EXT_ASSIGNABLE_ROLE, {});
         // The elevation guards read the registry, the screens only these options: a role the
         // server accepts but the screen omits is silently stripped on the next member-roles save.
@@ -49,9 +49,9 @@ export function createTenantFeature(options) {
                 throw new Error(`[tenant] assignable app role "${role}" (assignableFrom "${assignableFrom}") is declared but missing from the tenant screens' options; pass assignableAppRoles: collectAssignableAppRoles(appFeatures) to createTenantFeature.`);
             }
         });
-        r.entity("tenant", tenantEntity);
-        r.entity("tenant-membership", tenantMembershipEntity);
-        r.entity("tenant-invitation", tenantInvitationEntity);
+        r.entity({ name: "tenant", ...tenantEntity });
+        r.entity({ name: "tenant-membership", ...tenantMembershipEntity });
+        r.entity({ name: "tenant-invitation", ...tenantInvitationEntity });
         r.config({
             keys: {
                 // Stammdaten-Settings — Tenant-Admin darf ändern, alle dürfen lesen.

package/dist/tenant/seeding.js

@@ -185,7 +185,7 @@ export async function seedTenant(db, options, hooks) {
     }
     // "tenant:seed" matches no handler-scoped hook, only entity-scoped ones
     // (keyed by result.entityName === "tenant") — that's exactly what
-    // tier-engine's `r.hook("postSave", { allOf: "tenant" }, ...)` needs.
+    // tier-engine's `r.hook({ type: "postSave", target: { allOf: "tenant" }, ... })` needs.
     await fireEntityPostSave(hooks, "tenant:seed", result.data, { tenantId: options.id, db });
     return { id: options.id };
 }

package/dist/tenant-lifecycle/feature.js

@@ -19,7 +19,7 @@ export function createTenantLifecycleFeature() {
             category: "compliance",
             recommended: false,
         });
-        r.requires("tenant", "compliance-profiles");
+        r.requires({ features: ["tenant", "compliance-profiles"] });
         r.optionalRequires("sessions");
         r.usesApi("compliance.forTenant");
         r.extendsRegistrar(EXT_TENANT_DATA, {});
@@ -74,8 +74,7 @@ export function createTenantLifecycleFeature() {
                 if (!ctx.registry) {
                     throw new Error("run-tenant-destruction: ctx.registry required (JobContext incomplete)");
                 }
-                const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
-                const now = T.Now.instant();
+                const now = ctx.tz.now();
                 // Without crossTenantReads (undeclared hatch) fall through to the sweep.
                 if (ctx.crossTenantReads && !(await hasTenantDestructionWork(ctx.crossTenantReads, now))) {
                     // skip: no tenant is due, so the sweep would not touch anything

package/dist/tenant-lifecycle/stages.js

@@ -126,7 +126,7 @@ async function tombstoneTenantRow(ctx) {
             throw new Error(`tenant-lifecycle: failed to forget membership ${membership.id} for tenant ${ctx.tenantId}: ${result.error.message}`);
         }
     }
-    await tenantCrud.update({
+    const tombstone = await tenantCrud.update({
         id: ctx.tenantId,
         changes: {
             status: "destroyed",
@@ -134,6 +134,9 @@ async function tombstoneTenantRow(ctx) {
             isEnabled: false,
         },
     }, user, db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
+    if (!tombstone.isSuccess) {
+        throw new Error(`tenant-lifecycle: failed to mark tenant ${ctx.tenantId} destroyed: ${tombstone.error.message}`);
+    }
     invalidateTenantLifecycleGate(ctx.tenantId);
     return STAGE_DONE;
 }

package/dist/tenant-settings/feature.js

@@ -16,7 +16,7 @@ import { buildTenantSettingsKeys } from "./config.js";
 import { TENANT_SETTINGS_FEATURE_NAME } from "./constants.js";
 export function createTenantSettingsFeature(opts = {}) {
     return defineFeature(TENANT_SETTINGS_FEATURE_NAME, (r) => {
-        r.requires("config");
+        r.requires({ features: ["config"] });
         r.describe("Per-tenant Currency + Locale defaults, exposed as two config keys (tenant-settings:config:currency, tenant-settings:config:locale) that surface in the self-populating Settings-Hub via `mask`. Pair with defineCreateWithTenantDefaults to auto-fill a money field's currency or a locale field on create instead of hard-coding a literal per entity.");
         r.config({ keys: buildTenantSettingsKeys(opts) });
         r.translations({