Expand portal onboarding and administration

src/user_engine/ports.py

@@ -75,6 +75,24 @@ class IdentityDriftResult:
     changed: tuple[str, ...] = ()
 
 
+@dataclass(frozen=True)
+class TenantProvisioningResult:
+    tenant: str
+    status: str
+    resumed: bool = False
+    external_ref: str | None = None
+
+
+class TenantManagementPort(Protocol):
+    """Provider-neutral seam to the tenant authority (normally tenant-engine)."""
+
+    def create_tenant(
+        self, *, tenant: str, display_name: str, idempotency_key: str,
+        correlation_id: str,
+    ) -> TenantProvisioningResult:
+        """Create or resume a tenant without making user-engine authoritative."""
+
+
 class IdentityProvisioningPort(Protocol):
     """Lifecycle seam owned by NetKingdom adapters, not the user domain."""
 
@@ -205,6 +223,11 @@ class UserEngineStore(Protocol):
     ) -> tuple[FamilyInvitation, ...]:
         """Return family invitations for a user."""
 
+    def family_invitations_for_tenant(
+        self, tenant: str
+    ) -> tuple[FamilyInvitation, ...]:
+        """Return invitations visible in one tenant."""
+
     def save_registration_session(self, session: RegistrationSession) -> None:
         """Create or replace a registration session."""
 
@@ -308,6 +331,12 @@ class UserEngineStore(Protocol):
     def pending_outbox(self) -> tuple[OutboxEvent, ...]:
         """Return pending outbox events in write order."""
 
+    def save_outbox(self, event: OutboxEvent) -> None:
+        """Persist outbox delivery state."""
+
+    def outbox_event(self, event_id: str) -> OutboxEvent | None:
+        """Return an outbox event including delivery state."""
+
     def record_counts(self) -> Mapping[str, int]:
         """Return adapter-neutral record counts for diagnostics."""