@cosmicdrift/kumiko-samples 0.339.0 → 0.341.0

package/packages/bundled-features/src/renderer-simple/simple-renderer.ts

@@ -6,13 +6,24 @@ export type MailBranding = {
   readonly productName?: string;
   /** Hex color (#rgb, #rrggbb, #rrggbbaa); used for buttons and the header accent. */
   readonly primaryColor?: string;
-  /** Absolute http(s) URL; anything else is dropped. */
+  /** Absolute http(s) URL; anything else is dropped. Mutually exclusive with `logoPath`. */
   readonly logoUrl?: string;
-  readonly footerText?: string;
-  /** Absolute http(s) URLs only; other entries are dropped. */
-  readonly footerLinks?: readonly { readonly label: string; readonly url: string }[];
+  /** Absolute path on `baseUrl` (e.g. "/logo.png"); use PNG/JPEG, mail clients block SVG. */
+  readonly logoPath?: string;
+  /** Absolute http(s) origin that `logoPath` is resolved against; same base as `auth.mail.baseUrl`. */
+  readonly baseUrl?: string;
+  /** Locale tried after the exact and language-part match when a localized field has no entry. */
+  readonly defaultLocale?: string;
+  readonly footerText?: LocalizedText;
+  /** Absolute http(s) URLs only; string URLs that are not are dropped, localized ones fail at boot. */
+  readonly footerLinks?: readonly {
+    readonly label: LocalizedText;
+    readonly url: LocalizedText;
+  }[];
 };
 
+export type LocalizedText = string | Readonly<Record<string, string>>;
+
 const DEFAULT_PRIMARY_COLOR = "#2563eb";
 const HEX_COLOR_PATTERN = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
 
@@ -25,14 +36,79 @@ function isHttpUrl(value: string): boolean {
   }
 }
 
+function languagePart(locale: string): string {
+  return locale.split("-")[0] ?? locale;
+}
+
+function pickByLocale(
+  entries: Readonly<Record<string, string>>,
+  locale: string,
+): string | undefined {
+  // Own keys only: a locale like "constructor" must not hit Object.prototype.
+  const ownEntry = (key: string): string | undefined =>
+    Object.hasOwn(entries, key) ? entries[key] : undefined;
+  return ownEntry(locale) ?? ownEntry(languagePart(locale));
+}
+
+function resolveLocalized(
+  value: LocalizedText | undefined,
+  locale: string | undefined,
+  defaultLocale: string | undefined,
+): string | undefined {
+  if (value === undefined || typeof value === "string") return value;
+  return (
+    (locale !== undefined ? pickByLocale(value, locale) : undefined) ??
+    (defaultLocale !== undefined ? pickByLocale(value, defaultLocale) : undefined) ??
+    Object.values(value)[0]
+  );
+}
+
+function assertLocalizedUrlsAreHttp(branding: MailBranding): void {
+  for (const link of branding.footerLinks ?? []) {
+    if (typeof link.url === "string") continue;
+    for (const [locale, url] of Object.entries(link.url)) {
+      if (!isHttpUrl(url)) {
+        throw new Error(
+          `createSimpleRenderer: footerLinks url for locale "${locale}" must be an absolute http(s) URL`,
+        );
+      }
+    }
+  }
+}
+
+function resolveLogoUrl(branding: MailBranding | undefined): string | undefined {
+  if (!branding) return undefined;
+  const { logoUrl, logoPath, baseUrl } = branding;
+  if (logoPath === undefined) {
+    return logoUrl && isHttpUrl(logoUrl) ? logoUrl : undefined;
+  }
+  if (logoUrl !== undefined) {
+    throw new Error("createSimpleRenderer: logoPath and logoUrl are mutually exclusive");
+  }
+  if (baseUrl === undefined || !isHttpUrl(baseUrl)) {
+    throw new Error("createSimpleRenderer: logoPath requires an absolute http(s) baseUrl");
+  }
+  if (!/^\/(?![/\\])/.test(logoPath) || logoPath.includes("\\")) {
+    throw new Error('createSimpleRenderer: logoPath must start with a single "/"');
+  }
+  const resolved = new URL(logoPath, baseUrl);
+  if (resolved.origin !== new URL(baseUrl).origin) {
+    throw new Error("createSimpleRenderer: logoPath must stay on the baseUrl origin");
+  }
+  return resolved.href;
+}
+
 function resolvePrimaryColor(branding: MailBranding | undefined): string {
   const color = branding?.primaryColor;
   return color && HEX_COLOR_PATTERN.test(color) ? color : DEFAULT_PRIMARY_COLOR;
 }
 
-function renderBrandingHeader(branding: MailBranding | undefined, primaryColor: string): string {
+function renderBrandingHeader(
+  branding: MailBranding | undefined,
+  primaryColor: string,
+  logoUrl: string | undefined,
+): string {
   if (!branding) return "";
-  const logoUrl = branding.logoUrl && isHttpUrl(branding.logoUrl) ? branding.logoUrl : undefined;
   if (!logoUrl && !branding.productName) return "";
   const logo = logoUrl
     ? `<img src="${escapeHtmlAttr(logoUrl)}" alt="${escapeHtmlAttr(branding.productName ?? "")}" style="display:block;max-height:40px;max-width:200px;border:0" />`
@@ -40,18 +116,24 @@ function renderBrandingHeader(branding: MailBranding | undefined, primaryColor:
   return `<div style="margin:0 0 24px;padding:0 0 16px;border-bottom:3px solid ${escapeHtmlAttr(primaryColor)}">${logo}</div>`;
 }
 
-function renderBrandingFooter(branding: MailBranding | undefined): string {
+function renderBrandingFooter(
+  branding: MailBranding | undefined,
+  locale: string | undefined,
+): string {
   if (!branding) return "";
-  const links = (branding.footerLinks ?? [])
-    .filter((link) => isHttpUrl(link.url))
-    .map(
-      (link) =>
-        `<a href="${escapeHtmlAttr(link.url)}" style="color:#999">${escapeHtml(link.label)}</a>`,
-    );
-  const footerPartsHtml = [
-    branding.footerText ? escapeHtml(branding.footerText) : "",
-    links.join(" · "),
-  ].filter((part) => part !== "");
+  const pick = (value: LocalizedText | undefined): string | undefined =>
+    resolveLocalized(value, locale, branding.defaultLocale);
+  const links = (branding.footerLinks ?? []).flatMap((link) => {
+    const url = pick(link.url);
+    if (url === undefined || !isHttpUrl(url)) return [];
+    return [
+      `<a href="${escapeHtmlAttr(url)}" style="color:#999">${escapeHtml(pick(link.label) ?? "")}</a>`,
+    ];
+  });
+  const footerText = pick(branding.footerText);
+  const footerPartsHtml = [footerText ? escapeHtml(footerText) : "", links.join(" · ")].filter(
+    (part) => part !== "",
+  );
   if (footerPartsHtml.length === 0) return "";
   const footerHtml = footerPartsHtml.join("<br />");
   return `<p style="margin:16px 0 0;color:#999;font-size:12px">${footerHtml}</p>`;
@@ -85,6 +167,8 @@ function renderSection(section: Section, primaryColor: string): string {
 // No external dependencies, no template engine — just string concatenation.
 export function createSimpleRenderer(branding?: MailBranding): NotificationRenderer {
   const primaryColor = resolvePrimaryColor(branding);
+  const logoUrl = resolveLogoUrl(branding);
+  if (branding) assertLocalizedUrlsAreHttp(branding);
   return {
     name: "simple",
 
@@ -98,7 +182,7 @@ export function createSimpleRenderer(branding?: MailBranding): NotificationRende
       const parts: string[] = [];
       parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
       parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
-      parts.push(renderBrandingHeader(branding, primaryColor));
+      parts.push(renderBrandingHeader(branding, primaryColor, logoUrl));
 
       if (header) {
         parts.push(
@@ -118,7 +202,7 @@ export function createSimpleRenderer(branding?: MailBranding): NotificationRende
         );
       }
 
-      parts.push(renderBrandingFooter(branding));
+      parts.push(renderBrandingFooter(branding, input.locale));
       parts.push("</div></body></html>");
       return parts.join("");
     },

package/packages/bundled-features/src/secrets/announce-secret-change.ts

@@ -0,0 +1,30 @@
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  CACHE_SYNC_TOPICS,
+  type CacheSyncBus,
+  type TenantConfigSyncMessage,
+} from "@cosmicdrift/kumiko-framework/redis";
+
+type AnnouncingContext = {
+  readonly cacheSync?: CacheSyncBus;
+  readonly scheduleAfterCommit?: (hook: () => Promise<void>) => void;
+};
+
+// Secret writes bypass config:write:*, yet provider caches (e.g. the S3 secret
+// key) depend on them: announce on the tenant-config topic, after commit so a
+// replica reloading on the message sees the new value.
+export function announceSecretChange(
+  ctx: AnnouncingContext,
+  tenantId: TenantId,
+  key: string,
+): void {
+  const bus = ctx.cacheSync;
+  // skip: no bus wired (single-process setup), nothing to announce
+  if (!bus) return;
+  const message: TenantConfigSyncMessage = { tenantId, key };
+  const publish = async (): Promise<void> => {
+    bus.publish(CACHE_SYNC_TOPICS.tenantConfig, message);
+  };
+  if (ctx.scheduleAfterCommit) ctx.scheduleAfterCommit(publish);
+  else bus.publish(CACHE_SYNC_TOPICS.tenantConfig, message);
+}

package/packages/bundled-features/src/secrets/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Chat channel secret values are validated on write",
+    "detail": "`r.secret` and `r.secretNamespace` accept a `valueSchema`. `secrets:write:set` checks the value against it after the key and role checks and answers a failure with a 400 validation error on field `value` (`secrets.errors.invalidValue`); the response never contains the value or the schema's issues. `secrets:write:delete` is unaffected.\nThe chat channels use it: Slack, Discord and Teams webhook secrets must be URLs that pass the channel's host allowlist (including the Discord `/api/webhooks/` path), and the Telegram bot token must have the `<bot id>:<secret>` shape. The allowlist comes from the same options as the channel, so `createChannelSlackFeature({ allowedHosts })` also governs what can be stored.\n`channel-slack`, `channel-discord`, `channel-teams` and `channel-telegram` now export their secret keys (`SLACK_SECRET_KEYS`, `DISCORD_SECRET_KEYS`, `TEAMS_SECRET_KEYS`, `TELEGRAM_SECRET_KEYS`), allowlist constants and `isTelegramChatId` / `isTelegramBotToken`. `delivery` exports `checkChatWebhookTarget`, `chatWebhookUrlSchema` and `resolveChatWebhookTarget`, so apps can validate an address or URL when a user creates a channel.\nExisting invalid secrets stay stored; only new writes are checked. Writes through `ctx.secrets.set` in feature code run through the same check."
+  },
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "ctx.secrets.set validates against the declared valueSchema",
+    "migration": "Code that calls createSecretsContext({ db, masterKeyProvider }) must also pass registry (the booted Registry). Programmatic ctx.secrets.set calls with a value that fails the key's valueSchema now throw a ValidationError instead of storing it."
+  },
   {
     "version": "0.337.0",
     "type": "breaking",

package/packages/bundled-features/src/secrets/feature.ts

@@ -76,7 +76,7 @@ export function requireSecretsContext(
     throw new InternalError({
       message:
         `[${handlerName}] ctx.secrets missing — pass ` +
-        "createSecretsContext({db, masterKeyProvider}) via extraContext.secrets at boot.",
+        "createSecretsContext({db, masterKeyProvider, registry}) via extraContext.secrets at boot.",
     });
   }
   const raw = ctx.secrets;

package/packages/bundled-features/src/secrets/handlers/delete.write.ts

@@ -1,6 +1,7 @@
 import { type AccessRule, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite } from "../write-gate.js";
@@ -23,6 +24,7 @@ export function createDeleteHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS)
         deletedBy: event.user.id,
       });
       if (!removed) return failNotFound("tenant-secret", event.payload.key);
+      announceSecretChange(ctx, event.user.tenantId, event.payload.key);
       return { isSuccess: true, data: { key: event.payload.key } };
     },
   });

package/packages/bundled-features/src/secrets/handlers/set.write.ts

@@ -1,8 +1,9 @@
 import { type AccessRule, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
-import { checkSecretKeyWrite } from "../write-gate.js";
+import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.js";
 
 export function createSetHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
   return defineWriteHandler({
@@ -32,6 +33,8 @@ export function createSetHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
       // framework default unless the caller sent a specific preview.
       const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, key);
       if (!gate.ok) return gate.failure;
+      const invalidValue = checkSecretValue(ctx.registry, key, value);
+      if (invalidValue) return invalidValue;
       const featureRedact = gate.keyDef?.redact;
       const redactFn: (v: string) => string = redactedPreview
         ? () => redactedPreview
@@ -42,6 +45,7 @@ export function createSetHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
         ...(hint ? { hint } : {}),
         updatedBy: event.user.id,
       });
+      announceSecretChange(ctx, event.user.tenantId, key);
 
       return {
         isSuccess: true,

package/packages/bundled-features/src/secrets/i18n.ts

@@ -7,4 +7,8 @@ export const SECRETS_I18N = {
     en: "You are not allowed to change this secret.",
     de: "Dieses Geheimnis darf nicht geändert werden.",
   },
+  "secrets.errors.invalidValue": {
+    en: "This value is not valid for this secret.",
+    de: "Dieser Wert ist für dieses Geheimnis nicht gültig.",
+  },
 } as const;

package/packages/bundled-features/src/secrets/secrets-context.ts

@@ -42,6 +42,11 @@ import {
   tenantSecretEntity,
   tenantSecretsTable,
 } from "./table.js";
+import {
+  invalidSecretValueError,
+  isSecretValueValid,
+  type SecretValueSchemaSource,
+} from "./write-gate.js";
 
 // Re-export the framework interface so consumers of bundled-features/secrets
 // don't need to reach into @cosmicdrift/kumiko-framework/secrets separately.
@@ -50,6 +55,9 @@ export type { Secret, SecretsContext } from "@cosmicdrift/kumiko-framework/secre
 export type SecretsContextOptions = {
   readonly db: DbConnection;
   readonly masterKeyProvider: MasterKeyProvider;
+  // Source of the declared `valueSchema`s: programmatic `set` enforces the same
+  // check as the write handler. Required so a context can't silently skip it.
+  readonly registry: SecretValueSchemaSource;
   // Shared DEK cache. Default: a fresh 5-min TTL cache. Pass in a shared
   // instance if several features decrypt overlapping secret sets — lowers
   // provider-call count across the app.
@@ -164,6 +172,7 @@ export function createSecretsContext(opts: SecretsContextOptions): SecretsContex
 
     async set(tenantId, keyOrHandle, value, setOpts = {}) {
       const key = resolveKey(keyOrHandle);
+      if (!isSecretValueValid(opts.registry, key, value)) throw invalidSecretValueError();
       const envelope = await encryptValue(value, masterKeyProvider);
       const stored: StoredEnvelope = encodeStoredEnvelope(envelope);
       const metadata: StoredMetadata = {

package/packages/bundled-features/src/secrets/write-gate.ts

@@ -6,6 +6,7 @@ import type {
 import {
   AccessDeniedError,
   NotFoundError,
+  ValidationError,
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
@@ -60,3 +61,43 @@ export function checkSecretKeyWrite(
   }
   return { ok: true, keyDef };
 }
+
+// The registry surface the value check needs; lets ctx.secrets validate without a full Registry.
+export type SecretValueSchemaSource = Pick<Registry, "getSecretKey" | "findSecretNamespace">;
+
+// Carries neither the value nor the schema's issues.
+export function invalidSecretValueError(): ValidationError {
+  return new ValidationError(
+    {
+      fields: [
+        {
+          path: "value",
+          code: "invalid_secret_value",
+          i18nKey: "secrets.errors.invalidValue",
+        },
+      ],
+    },
+    { i18nKey: "secrets.errors.invalidValue" },
+  );
+}
+
+export function isSecretValueValid(
+  schemas: SecretValueSchemaSource,
+  key: string,
+  value: string,
+): boolean {
+  const valueSchema =
+    schemas.getSecretKey(key)?.valueSchema ?? schemas.findSecretNamespace(key)?.valueSchema;
+  return valueSchema === undefined || valueSchema.safeParse(value).success;
+}
+
+// Runs after checkSecretKeyWrite, so a caller without the write role never learns
+// whether a value would have passed.
+export function checkSecretValue(
+  registry: SecretValueSchemaSource,
+  key: string,
+  value: string,
+): WriteFailure | undefined {
+  if (isSecretValueValid(registry, key, value)) return undefined;
+  return writeFailure(invalidSecretValueError());
+}

package/packages/bundled-features/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Harden system role, invitations query, tenant teardown and addMember",
+    "detail": "The system role can no longer be minted into a session through a user's global roles. invitations.query returns an explicit field allowlist and exposes globalRoles only to a SystemAdmin. The tenant destruction sweep waits 60 seconds after the grace period ends so the teardown gate can settle. Behaviour change: tenant:write:addMember now adds members to a foreign tenant only from the framework system context; a SystemAdmin request user is limited to their own tenant and gets 403 otherwise."
+  },
   {
     "version": "0.336.1",
     "type": "fix",

package/packages/bundled-features/src/tenant/constants.ts

@@ -75,4 +75,5 @@ export const TenantErrors = {
   membershipAlreadyExists: "membership_already_exists",
   lastTenantAdmin: "last_tenant_admin",
   invitationSuperseded: "invitation_superseded",
+  crossTenantMembershipDenied: "cross_tenant_membership_denied",
 } as const;

package/packages/bundled-features/src/tenant/handlers/add-member.write.ts

@@ -1,7 +1,17 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { ConflictError, InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  defineWriteHandler,
+  type SessionUser,
+  SYSTEM_ROLE,
+  SYSTEM_USER_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AccessDeniedError,
+  ConflictError,
+  InternalError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { TenantErrors } from "../constants.js";
 import { findForbiddenMembershipRole, reservedMembershipRoleError } from "../membership-roles.js";
@@ -11,6 +21,12 @@ const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembersh
   entityName: "tenant-membership",
 });
 
+// Both halves: test stacks can mint JWTs with the "system" role, but only the
+// framework operator carries SYSTEM_USER_ID.
+function isFrameworkSystemUser(user: SessionUser): boolean {
+  return user.id === SYSTEM_USER_ID && user.roles.includes(SYSTEM_ROLE);
+}
+
 export const addMemberWrite = defineWriteHandler({
   name: "addMember",
   schema: z.object({
@@ -18,7 +34,7 @@ export const addMemberWrite = defineWriteHandler({
     tenantId: z.string(),
     roles: z.array(z.string()).min(1),
   }),
-  access: { roles: ["SystemAdmin"] },
+  access: { roles: [SYSTEM_ROLE, "SystemAdmin"] },
   description:
     "Grants an existing user membership in a tenant with the given roles, refusing reserved role names and a user who is already a member; use it to add someone to a workspace without going through an invitation.",
   handler: async (event, ctx) => {
@@ -31,6 +47,14 @@ export const addMemberWrite = defineWriteHandler({
     const db = ctx.systemDb.acknowledgeCrossTenant(
       "SystemAdmin manages memberships across tenants",
     );
+    if (!isFrameworkSystemUser(event.user) && event.payload.tenantId !== event.user.tenantId) {
+      return writeFailure(
+        new AccessDeniedError({
+          message: "only the system context may add members to another tenant",
+          details: { reason: TenantErrors.crossTenantMembershipDenied },
+        }),
+      );
+    }
     const forbidden = findForbiddenMembershipRole(event.payload.roles);
     if (forbidden !== undefined) return writeFailure(reservedMembershipRoleError(forbidden));
     const existing = await fetchOne(db, tenantMembershipsTable, {

package/packages/bundled-features/src/tenant/handlers/invitations.query.ts

@@ -4,6 +4,7 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
 import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table.js";
+import { isSystemAdmin } from "./is-system-admin.js";
 
 // Bounded, not Promise.all/sequential: each decrypt hits the KMS adapter's
 // own small dedicated pool (PgKmsAdapter default max: 4). Promise.all fires
@@ -52,7 +53,20 @@ export const invitationsQuery = defineQueryHandler({
         typeof invitedBy === "string"
           ? await decryptStoredPii(invitedBy, "invitedBy", "tenant:invitations")
           : invitedBy;
-      return { ...row, email: decryptedEmail, invitedBy: decryptedInvitedBy };
+      // Explicit allowlist: the raw row also carries blind-index columns and
+      // globalRoles, which only a SystemAdmin may see.
+      return {
+        id: row["id"],
+        tenantId: row["tenantId"],
+        email: decryptedEmail,
+        role: row["role"],
+        status: row["status"],
+        invitedBy: decryptedInvitedBy,
+        expiresAt: row["expiresAt"],
+        insertedAt: row["insertedAt"],
+        version: row["version"],
+        ...(isSystemAdmin(query.user) && { globalRoles: row["globalRoles"] }),
+      };
     });
   },
 });

package/packages/bundled-features/src/tenant/index.ts

@@ -1,3 +1,4 @@
+export { cancelPendingInvitation } from "./cancel-pending-invitation.js";
 export { TenantCommandSchemas } from "./command-schemas.js";
 export {
   OWNER_INVITE_ROLE_OPTIONS,

package/packages/bundled-features/src/tenant/invitation-table.ts

@@ -25,10 +25,13 @@
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
+  createMultiSelectField,
   createSelectField,
   createTextField,
   createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
+// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
+import { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
 
 // Status-const-Object damit Handler-Code keine Magic-Strings nutzt.
 // Bei rename (z.B. "cancelled" → "revoked") fällt jeder caller auf
@@ -67,6 +70,13 @@ export const tenantInvitationEntity = createEntity({
       personal: false,
       reason: "technical_reference",
     }),
+    // Global (users.roles) roles granted on accept, on top of the membership
+    // role. Only the system-only invite variant sets them; every tenant-admin
+    // re-invite resets them to [] so a resend can never carry them over.
+    globalRoles: createMultiSelectField({
+      options: GLOBAL_ROLE_OPTIONS,
+      default: [],
+    }),
     // Lifecycle-State. Default "pending"; transitions:
     //   pending → accepted | cancelled | expired
     status: createSelectField({

package/packages/bundled-features/src/tenant-lifecycle/lifecycle-gate.ts

@@ -23,6 +23,8 @@ export type TenantLifecycleGate = {
 // (cached as null) must not grow the Map without bound: past the cap, expired
 // entries are swept and, if still full, the oldest-inserted entries are evicted.
 const GATE_TTL_MS = 3000;
+// Covers other pods' GATE_TTL_MS plus requests still in flight when the grace period (0 under a compliance override) ends.
+export const TEARDOWN_GATE_SETTLE_MS = 60_000;
 /** @internal exported for the bounded-cache test */
 export const GATE_CACHE_MAX_ENTRIES = 5000;
 const gateCache = new Map<

package/packages/bundled-features/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -26,7 +26,7 @@ import {
   TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT,
   TENANT_DESTRUCTION_STARTED_EVENT_SHORT,
 } from "./constants.js";
-import { invalidateTenantLifecycleGate } from "./lifecycle-gate.js";
+import { invalidateTenantLifecycleGate, TEARDOWN_GATE_SETTLE_MS } from "./lifecycle-gate.js";
 import {
   type DestructionStageCtx,
   isDestructionPipelineComplete,
@@ -321,7 +321,7 @@ export async function runTenantDestructionSweep(args: {
   const now = args.now ?? T.Now.instant();
   const due = await selectMany<{ id: string }>(args.db, tenantTable, {
     status: "destroyRequested",
-    gracePeriodEnd: { lte: now },
+    gracePeriodEnd: { lte: now.subtract({ milliseconds: TEARDOWN_GATE_SETTLE_MS }) },
   });
 
   let triggered = 0;