@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -0,0 +1,368 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type Registry,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  append,
+  loadAggregate,
+  VersionConflictError,
+} from "@cosmicdrift/kumiko-framework/event-store";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { tenantEntity, tenantTable } from "../tenant";
+import {
+  TENANT_AGGREGATE_TYPE,
+  TENANT_DESTRUCTION_COMPLETED_EVENT_QN,
+  TENANT_DESTRUCTION_FAILED_EVENT_QN,
+  TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT,
+  TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT,
+  TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT,
+  TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT,
+  TENANT_DESTRUCTION_STARTED_EVENT_SHORT,
+} from "./constants";
+import { invalidateTenantLifecycleGate } from "./lifecycle-gate";
+import { type DestructionStageCtx, isDestructionPipelineComplete, pickNextStage } from "./stages";
+
+const tenantCrud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
+
+const FEATURE_PREFIX = "tenant-lifecycle:event:";
+
+type StageEventName =
+  | typeof TENANT_DESTRUCTION_STARTED_EVENT_SHORT
+  | typeof TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT
+  | typeof TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT
+  | typeof TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT
+  | typeof TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT;
+
+function qualified(short: StageEventName): string {
+  return `${FEATURE_PREFIX}${short}`;
+}
+
+function replayStageState(
+  events: ReadonlyArray<{ type: string; payload: Record<string, unknown> }>,
+): {
+  completed: Set<string>;
+  abandoned: Set<string>;
+  attemptsByStage: Map<string, number>;
+} {
+  const completed = new Set<string>();
+  const abandoned = new Set<string>();
+  const attemptsByStage = new Map<string, number>();
+  for (const event of events) {
+    const payload = event.payload;
+    const stage = String(payload["stage"] ?? "");
+    if (event.type === qualified(TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT)) {
+      completed.add(stage);
+      continue;
+    }
+    if (event.type === qualified(TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT)) {
+      abandoned.add(stage);
+      continue;
+    }
+    if (event.type === qualified(TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT)) {
+      const prev = attemptsByStage.get(stage) ?? 0;
+      attemptsByStage.set(stage, Math.max(prev, Number(payload["attempts"] ?? prev + 1)));
+    }
+  }
+  return { completed, abandoned, attemptsByStage };
+}
+
+function lastEventVersion(events: ReadonlyArray<{ version: number }>): number {
+  const last = events.at(-1);
+  return last?.version ?? 0;
+}
+
+function stageOutcomeRecorded(
+  events: ReadonlyArray<{ type: string; payload: Record<string, unknown> }>,
+  stageName: string,
+  outcomeShort:
+    | typeof TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT
+    | typeof TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT
+    | typeof TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT,
+): boolean {
+  return events.some(
+    (event) => event.type === qualified(outcomeShort) && event.payload["stage"] === stageName,
+  );
+}
+
+async function appendTenantStageEvent(
+  db: DbRunner,
+  tenantId: TenantId,
+  type: string,
+  payload: Record<string, unknown>,
+  expectedVersion: number,
+): Promise<void> {
+  await append(db, {
+    aggregateId: tenantId,
+    aggregateType: TENANT_AGGREGATE_TYPE,
+    tenantId,
+    expectedVersion,
+    type,
+    payload,
+    metadata: {
+      userId: "system",
+      requestId: `tenant-lifecycle:${type}`,
+    },
+  });
+}
+
+async function appendTenantStageEventIdempotent(
+  db: DbRunner,
+  tenantId: TenantId,
+  type: string,
+  payload: Record<string, unknown>,
+  expectedVersion: number,
+  alreadyRecorded: boolean,
+): Promise<number> {
+  if (alreadyRecorded) {
+    const events = await loadAggregate(db, tenantId, tenantId);
+    return lastEventVersion(events);
+  }
+  try {
+    await appendTenantStageEvent(db, tenantId, type, payload, expectedVersion);
+  } catch (err) {
+    if (!(err instanceof VersionConflictError)) throw err;
+    const events = await loadAggregate(db, tenantId, tenantId);
+    const stage = String(payload["stage"] ?? "");
+    if (stageOutcomeRecorded(events, stage, TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT)) {
+      // skip: idempotent retry — stage already recorded before version conflict
+      return lastEventVersion(events);
+    }
+    throw err;
+  }
+  const events = await loadAggregate(db, tenantId, tenantId);
+  return lastEventVersion(events);
+}
+
+async function markTenantDestroyFailed(db: DbRunner, tenantId: TenantId): Promise<void> {
+  const user = createSystemUser(tenantId);
+  const scopedDb = createTenantDb(db, tenantId, "system");
+  await tenantCrud.update(
+    {
+      id: tenantId,
+      changes: { status: "destroyFailed" },
+    },
+    user,
+    scopedDb,
+    { skipOptimisticLock: true },
+  );
+  invalidateTenantLifecycleGate(tenantId);
+}
+
+async function haltPipelineOnAbandon(args: {
+  readonly db: DbRunner;
+  readonly tenantId: TenantId;
+  readonly stage: string;
+  readonly attempts: number;
+  readonly error: string;
+}): Promise<void> {
+  const T = getTemporal();
+  const failedAt = T.Now.instant();
+  // Reload fresh instead of trusting a caller-supplied version: the failed
+  // stage's own run() may have appended to this same aggregate (e.g.
+  // tombstoneTenantRow's tenantCrud.update) before throwing, so any version
+  // captured earlier in the pipeline is stale and would VersionConflict here.
+  const eventsBeforeAbandon = await loadAggregate(args.db, args.tenantId, args.tenantId);
+  await appendTenantStageEvent(
+    args.db,
+    args.tenantId,
+    qualified(TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT),
+    { stage: args.stage, attempts: args.attempts, error: args.error },
+    lastEventVersion(eventsBeforeAbandon),
+  );
+  const eventsAfterAbandon = await loadAggregate(args.db, args.tenantId, args.tenantId);
+  const versionAfterAbandon = lastEventVersion(eventsAfterAbandon);
+  await appendTenantStageEvent(
+    args.db,
+    args.tenantId,
+    TENANT_DESTRUCTION_FAILED_EVENT_QN,
+    { stage: args.stage, error: args.error, failedAt: failedAt.toString() },
+    versionAfterAbandon,
+  );
+  await markTenantDestroyFailed(args.db, args.tenantId);
+}
+
+async function maybeAppendDestructionCompleted(
+  db: DbRunner,
+  tenantId: TenantId,
+  completed: ReadonlySet<string>,
+): Promise<void> {
+  if (!isDestructionPipelineComplete(completed)) {
+    // skip: pipeline still has pending stages
+    return;
+  }
+  const events = await loadAggregate(db, tenantId, tenantId);
+  if (events.some((event) => event.type === TENANT_DESTRUCTION_COMPLETED_EVENT_QN)) {
+    // skip: idempotent — completion event already recorded
+    return;
+  }
+  const T = getTemporal();
+  await appendTenantStageEvent(
+    db,
+    tenantId,
+    TENANT_DESTRUCTION_COMPLETED_EVENT_QN,
+    { destroyedAt: T.Now.instant().toString() },
+    lastEventVersion(events),
+  );
+}
+
+export async function runNextDestructionStage(args: {
+  readonly db: DbRunner;
+  readonly registry: Registry;
+  readonly tenantId: TenantId;
+  readonly log?: (message: string) => void;
+}): Promise<{ readonly done: boolean; readonly error?: string; readonly halted?: boolean }> {
+  const events = await loadAggregate(args.db, args.tenantId, args.tenantId);
+  const { completed, abandoned, attemptsByStage } = replayStageState(events);
+
+  if (abandoned.size > 0) {
+    return { done: false, error: "pipeline_abandoned", halted: true };
+  }
+
+  const next = pickNextStage(completed, abandoned);
+  if (!next) {
+    await maybeAppendDestructionCompleted(args.db, args.tenantId, completed);
+    return { done: isDestructionPipelineComplete(completed) };
+  }
+
+  const priorAttempts = attemptsByStage.get(next.name) ?? 0;
+  const attempt = priorAttempts + 1;
+  const ctx: DestructionStageCtx = {
+    db: args.db,
+    registry: args.registry,
+    tenantId: args.tenantId,
+    log: args.log,
+  };
+
+  let version = lastEventVersion(events);
+  version = await appendTenantStageEventIdempotent(
+    args.db,
+    args.tenantId,
+    qualified(TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT),
+    { stage: next.name, attempts: attempt },
+    version,
+    stageOutcomeRecorded(events, next.name, TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT),
+  );
+
+  try {
+    await next.run(ctx);
+    // next.run() may itself have appended events to this aggregate (e.g.
+    // tombstoneTenantRow updates the tenant row on the same stream) — reload
+    // the version fresh instead of trusting the pre-run `version`, or this
+    // append throws VersionConflictError on every stage whose run() writes.
+    const eventsAfterRun = await loadAggregate(args.db, args.tenantId, args.tenantId);
+    version = await appendTenantStageEventIdempotent(
+      args.db,
+      args.tenantId,
+      qualified(TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT),
+      { stage: next.name, attempts: attempt },
+      lastEventVersion(eventsAfterRun),
+      stageOutcomeRecorded(
+        eventsAfterRun,
+        next.name,
+        TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT,
+      ),
+    );
+
+    const completedAfter = new Set([...completed, next.name]);
+    await maybeAppendDestructionCompleted(args.db, args.tenantId, completedAfter);
+    return { done: isDestructionPipelineComplete(completedAfter) };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const isFinal = attempt >= next.maxAttempts;
+    if (isFinal) {
+      await haltPipelineOnAbandon({
+        db: args.db,
+        tenantId: args.tenantId,
+        stage: next.name,
+        attempts: attempt,
+        error: message,
+      });
+      return { done: false, error: message, halted: true };
+    }
+    await appendTenantStageEvent(
+      args.db,
+      args.tenantId,
+      qualified(TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT),
+      { stage: next.name, attempts: attempt, error: message },
+      version,
+    );
+    return { done: false, error: message };
+  }
+}
+
+/** Cron entry: start destruction for tenants past grace, then advance stages. */
+export async function runTenantDestructionSweep(args: {
+  readonly db: DbRunner;
+  readonly registry: Registry;
+  readonly now?: Temporal.Instant;
+  readonly log?: (message: string) => void;
+}): Promise<{ readonly triggered: number; readonly advanced: number }> {
+  const T = getTemporal();
+  const now = args.now ?? T.Now.instant();
+  const due = await selectMany<{ id: string }>(args.db, tenantTable, {
+    status: "destroyRequested",
+    gracePeriodEnd: { lte: now },
+  });
+
+  let triggered = 0;
+  for (const row of due) {
+    const tenantId = row.id as TenantId;
+    const events = await loadAggregate(args.db, tenantId, tenantId);
+    const version = lastEventVersion(events);
+    const user = createSystemUser(tenantId);
+    const scopedDb = createTenantDb(args.db, tenantId, "system");
+    // Version-guarded (no skipOptimisticLock): a concurrent cancel-destruction
+    // between the `due` select above and this write also appends to the same
+    // tenant stream, so an unguarded overwrite here would silently revert the
+    // cancellation. A version conflict means we lost that race — skip, the
+    // tenant is no longer due and the next tick re-evaluates it.
+    const result = await tenantCrud.update(
+      { id: tenantId, version, changes: { status: "destroying", destroyStartedAt: now } },
+      user,
+      scopedDb,
+    );
+    if (!result.isSuccess) continue;
+    invalidateTenantLifecycleGate(tenantId);
+    await appendTenantStageEvent(
+      args.db,
+      tenantId,
+      qualified(TENANT_DESTRUCTION_STARTED_EVENT_SHORT),
+      { startedAt: now.toString() },
+      version + 1,
+    );
+    triggered++;
+  }
+
+  let advanced = 0;
+  const destroying = await selectMany<{ id: string }>(args.db, tenantTable, {
+    status: "destroying",
+  });
+  for (const row of destroying) {
+    try {
+      const result = await runNextDestructionStage({
+        db: args.db,
+        registry: args.registry,
+        tenantId: row.id as TenantId,
+        log: args.log,
+      });
+      if (!result.error && !result.halted) advanced++;
+    } catch (err) {
+      // Isolate the failure to this tenant — an uncaught throw here must not
+      // abort the whole sweep tick and starve every other "destroying" tenant
+      // of progress. The tenant stays "destroying" and the next tick retries.
+      args.log?.(
+        `[tenant-lifecycle] sweep: unexpected error advancing tenant ${row.id}: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+    }
+  }
+
+  return { triggered, advanced };
+}
+
+export { invalidateTenantLifecycleGate, resolveTenantLifecycleGate } from "./lifecycle-gate";

package/src/tenant-lifecycle/stages.ts

@@ -0,0 +1,206 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configuredPiiSubjectKms, type SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type DbRunner,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  EXT_EXTERNAL_RESOURCE,
+  EXT_INFRA_RESOURCE,
+  EXT_SEARCH_ADAPTER,
+  EXT_STORAGE_PROVIDER,
+  EXT_TENANT_DATA,
+  type Registry,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import {
+  tenantEntity,
+  tenantMembershipEntity,
+  tenantMembershipsTable,
+  tenantTable,
+} from "../tenant";
+import type { TenantDestructionStageName } from "./constants";
+import { invalidateTenantLifecycleGate } from "./lifecycle-gate";
+
+export type DestructionStageCtx = {
+  readonly db: DbRunner;
+  readonly registry: Registry;
+  readonly tenantId: TenantId;
+  readonly log?: (message: string) => void;
+};
+
+export type DestructionStage = {
+  readonly name: TenantDestructionStageName;
+  readonly maxAttempts: number;
+  readonly run: (ctx: DestructionStageCtx) => Promise<void>;
+};
+
+const tenantCrud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
+const tenantMembershipCrud = createEventStoreExecutor(
+  tenantMembershipsTable,
+  tenantMembershipEntity,
+  {
+    entityName: "tenant-membership",
+  },
+);
+
+async function runExtensionDestroyHooks(
+  registry: Registry,
+  extensionName: string,
+  hookKey: "destroyTenant",
+  ctx: DestructionStageCtx,
+): Promise<void> {
+  const usages = registry.getExtensionUsages(extensionName);
+  for (const usage of usages) {
+    const hook = usage.options?.[hookKey];
+    if (typeof hook !== "function") continue;
+    await (hook as (tenantId: TenantId, hookCtx: DestructionStageCtx) => Promise<void>)(
+      ctx.tenantId,
+      ctx,
+    );
+  }
+}
+
+async function runTenantDataHooks(ctx: DestructionStageCtx): Promise<void> {
+  const usages = ctx.registry.getExtensionUsages(EXT_TENANT_DATA);
+  for (const usage of usages) {
+    const destroy = usage.options?.["destroy"] as
+      | ((ctx: DestructionStageCtx) => Promise<void>)
+      | undefined;
+    if (!destroy) continue;
+    await destroy(ctx);
+  }
+}
+
+async function eraseSubjectKeys(ctx: DestructionStageCtx): Promise<void> {
+  const kms = configuredPiiSubjectKms();
+  if (!kms) {
+    ctx.log?.("[tenant-lifecycle] subject-keys stage skipped: no KMS adapter configured");
+    // skip: KMS optional — apps without crypto-shredding still run other destroy stages
+    return;
+  }
+  const memberships = await selectMany<{ userId: string }>(ctx.db, tenantMembershipsTable, {
+    tenantId: ctx.tenantId,
+  });
+  const subjects: SubjectId[] = [
+    { kind: "tenant", tenantId: ctx.tenantId },
+    ...memberships.map((m) => ({ kind: "user" as const, userId: m.userId })),
+  ];
+  for (const subject of subjects) {
+    await kms.eraseKey(subject, {
+      requestId: `tenant-lifecycle:destroy:${ctx.tenantId}`,
+      eraseReason: "tenant-destroy stage subject-keys",
+    });
+  }
+}
+
+async function purgeTenantCache(ctx: DestructionStageCtx): Promise<void> {
+  // ponytail: Redis SCAN+DEL is wired when ctx carries a redis client; until
+  // then this stage is a documented no-op (no cache layer in test stack).
+  ctx.log?.("[tenant-lifecycle] cache stage: no redis client in ctx — skipped");
+}
+
+async function tombstoneTenantRow(ctx: DestructionStageCtx): Promise<void> {
+  const now = getTemporal().Now.instant();
+  const user = createSystemUser(ctx.tenantId);
+  const db = createTenantDb(ctx.db, ctx.tenantId, "system");
+  // Per-row forget() through the executor, not a bulk deleteMany: memberships
+  // are an ES-managed projection (add/remove/update-roles all go through
+  // tenantMembershipCrud), so a store table write here is eventless — a future
+  // projection rebuild would replay the historical add-member events and
+  // resurrect rows this stage removed. forget() (Art.17 hard-purge) keeps the
+  // erasure rebuild-safe and gives each membership its own audit event.
+  const memberships = await selectMany<{ id: string }>(ctx.db, tenantMembershipsTable, {
+    tenantId: ctx.tenantId,
+  });
+  for (const membership of memberships) {
+    const result = await tenantMembershipCrud.forget({ id: membership.id }, user, db);
+    // executor writes return {isSuccess:false} on failure, they don't throw —
+    // a silently-discarded result here would report this stage "succeeded"
+    // while membership PII survives. Throw so the pipeline's retry/abandon
+    // handling (runNextDestructionStage) sees it instead.
+    if (!result.isSuccess) {
+      throw new Error(
+        `tenant-lifecycle: failed to forget membership ${membership.id} for tenant ${ctx.tenantId}: ${result.error.message}`,
+      );
+    }
+  }
+  await tenantCrud.update(
+    {
+      id: ctx.tenantId,
+      changes: {
+        status: "destroyed",
+        destroyedAt: now,
+        isEnabled: false,
+      },
+    },
+    user,
+    db,
+    { skipOptimisticLock: true },
+  );
+  invalidateTenantLifecycleGate(ctx.tenantId);
+}
+
+export const DESTRUCTION_STAGES: readonly DestructionStage[] = [
+  {
+    name: "external-resources",
+    maxAttempts: 3,
+    run: (ctx) =>
+      runExtensionDestroyHooks(ctx.registry, EXT_EXTERNAL_RESOURCE, "destroyTenant", ctx),
+  },
+  {
+    name: "search-indices",
+    maxAttempts: 3,
+    run: (ctx) => runExtensionDestroyHooks(ctx.registry, EXT_SEARCH_ADAPTER, "destroyTenant", ctx),
+  },
+  {
+    name: "cache",
+    maxAttempts: 1,
+    run: purgeTenantCache,
+  },
+  {
+    name: "app-data",
+    maxAttempts: 3,
+    run: runTenantDataHooks,
+  },
+  {
+    name: "subject-keys",
+    maxAttempts: 3,
+    run: eraseSubjectKeys,
+  },
+  {
+    name: "files",
+    maxAttempts: 3,
+    run: (ctx) =>
+      runExtensionDestroyHooks(ctx.registry, EXT_STORAGE_PROVIDER, "destroyTenant", ctx),
+  },
+  {
+    name: "infra-resources",
+    maxAttempts: 3,
+    run: (ctx) => runExtensionDestroyHooks(ctx.registry, EXT_INFRA_RESOURCE, "destroyTenant", ctx),
+  },
+  {
+    name: "tenant-row",
+    maxAttempts: 1,
+    run: tombstoneTenantRow,
+  },
+];
+
+export function pickNextStage(
+  completedStages: ReadonlySet<string>,
+  abandonedStages: ReadonlySet<string>,
+): DestructionStage | null {
+  if (abandonedStages.size > 0) return null;
+  for (const stage of DESTRUCTION_STAGES) {
+    if (completedStages.has(stage.name)) continue;
+    return stage;
+  }
+  return null;
+}
+
+export function isDestructionPipelineComplete(completedStages: ReadonlySet<string>): boolean {
+  return DESTRUCTION_STAGES.every((stage) => completedStages.has(stage.name));
+}

package/src/tenant-settings/__tests__/tenant-settings.integration.test.ts

@@ -0,0 +1,115 @@
+// Verifies the core promise: set a tenant's tenant-settings:config:currency
+// to CHF, and a new entity without an explicit currency inherits CHF instead
+// of a hard-coded EUR literal.
+
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import {
+  configValuesTable,
+  createConfigAccessorFactory,
+  createConfigFeature,
+  createConfigResolver,
+} from "@cosmicdrift/kumiko-bundled-features/config";
+import {
+  createEntity,
+  createMoneyField,
+  createSelectField,
+  createTextField,
+  defineFeature,
+  type SessionUser,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  pushEntityProjectionTables,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTenantSettingsFeature } from "../feature";
+import { defineCreateWithTenantDefaults } from "../tenant-defaults";
+
+const invoiceEntity = createEntity({
+  table: "read_invoices",
+  fields: {
+    title: createTextField({ required: true }),
+    amount: createMoneyField({ required: true }),
+    language: createSelectField({ options: ["en", "de"] as const }),
+  },
+});
+
+const ACCESS = { roles: ["Admin"] } as const;
+
+const invoiceFeature = defineFeature("invoice", (r) => {
+  r.entity("invoice", invoiceEntity);
+  r.writeHandler(
+    defineCreateWithTenantDefaults("invoice", invoiceEntity, {
+      access: ACCESS,
+      currencyFields: ["amount"],
+      localeField: "language",
+    }),
+  );
+});
+
+const tenantId = testTenantId(1);
+const admin: SessionUser = { id: "admin-1", tenantId, roles: ["Admin"] };
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  const resolver = createConfigResolver();
+  stack = await setupTestStack({
+    features: [createConfigFeature(), createTenantSettingsFeature(), invoiceFeature],
+    extraContext: ({ registry }) => ({
+      configResolver: resolver,
+      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+    }),
+  });
+  await unsafePushTables(stack.db, { configValuesTable });
+  await unsafeCreateEntityTable(stack.db, invoiceEntity);
+  await createEventsTable(stack.db);
+  await pushEntityProjectionTables(stack, stack.registry);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+test("ohne Tenant-Override übernimmt eine neue Entity den Feature-Default (EUR/en)", async () => {
+  const invoice = await stack.http.writeOk<{
+    data: { amount: { amount: number; currency: string }; language: string };
+  }>("invoice:write:invoice:create", { title: "Rechnung 1", amount: { amount: 1000 } }, admin);
+  expect(invoice.data.amount).toEqual({ amount: 1000, currency: "EUR" });
+  expect(invoice.data.language).toBe("en");
+});
+
+test("Tenant setzt CHF/de — neue Entity ohne explizite Werte übernimmt die Tenant-Config, nicht das Feature-Default", async () => {
+  await stack.http.writeOk(
+    "config:write:set",
+    { key: "tenant-settings:config:currency", value: "CHF" },
+    admin,
+  );
+  await stack.http.writeOk(
+    "config:write:set",
+    { key: "tenant-settings:config:locale", value: "de" },
+    admin,
+  );
+
+  const invoice = await stack.http.writeOk<{
+    data: { amount: { amount: number; currency: string }; language: string };
+  }>("invoice:write:invoice:create", { title: "Rechnung 2", amount: { amount: 2000 } }, admin);
+
+  expect(invoice.data.amount).toEqual({ amount: 2000, currency: "CHF" });
+  expect(invoice.data.language).toBe("de");
+});
+
+test("expliziter Wert im Payload gewinnt gegen die Tenant-Config", async () => {
+  const invoice = await stack.http.writeOk<{
+    data: { amount: { amount: number; currency: string } };
+  }>(
+    "invoice:write:invoice:create",
+    { title: "Rechnung 3", amount: { amount: 3000, currency: "USD" } },
+    admin,
+  );
+  expect(invoice.data.amount).toEqual({ amount: 3000, currency: "USD" });
+});