@cosmicdrift/kumiko-bundled-features 0.109.0 → 0.111.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.109.0",
+  "version": "0.111.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -95,11 +95,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.109.0",
-    "@cosmicdrift/kumiko-framework": "0.109.0",
-    "@cosmicdrift/kumiko-headless": "0.109.0",
-    "@cosmicdrift/kumiko-renderer": "0.109.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.109.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.111.0",
+    "@cosmicdrift/kumiko-framework": "0.111.0",
+    "@cosmicdrift/kumiko-headless": "0.111.0",
+    "@cosmicdrift/kumiko-renderer": "0.111.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.111.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/__tests__/account-lockout-no-redis.integration.test.ts

@@ -13,7 +13,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -22,6 +21,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -42,8 +42,8 @@ const systemAdmin = TestUsers.systemAdmin;
 const encryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/account-lockout.integration.test.ts

@@ -12,7 +12,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -21,6 +20,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -48,8 +48,8 @@ const MAX_ATTEMPTS = 3;
 const LOCK_MINUTES = 1;
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/auth-claims.integration.test.ts

@@ -1,7 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -12,7 +11,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { createTestEnvelopeCipher, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -68,8 +67,8 @@ const segmentsByUserAndTenant = new Map<string, string>();
 const plansByTenant = new Map<TenantId, string>();
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [
@@ -260,8 +259,8 @@ describe("scenario 2: switch-tenant recomputes claims (no stale tenant-A claims
 
 describe("scenario 2.5: reserved separator + multi-feature isolation", () => {
   test("one feature returns key with ':' → only that key dropped, other features merge cleanly", async () => {
-    const localEncryption = createEncryptionProvider(encryptionKey);
-    const localResolver = createConfigResolver({ encryption: localEncryption });
+    const localEncryption = createTestEnvelopeCipher(encryptionKey);
+    const localResolver = createConfigResolver({ cipher: localEncryption });
     // A polluted feature that tries to smuggle in a qualified-name-shaped
     // inner key (injecting ":" would otherwise let it spoof another
     // feature's prefix). Plus a clean companion to prove the drop is
@@ -337,8 +336,8 @@ describe("scenario 2.5: reserved separator + multi-feature isolation", () => {
 
 describe("scenario 2.6: multi-feature drift warnings fire independently", () => {
   test("feature A + feature B both return undeclared keys → each logs its own warning", async () => {
-    const localEncryption = createEncryptionProvider(encryptionKey);
-    const localResolver = createConfigResolver({ encryption: localEncryption });
+    const localEncryption = createTestEnvelopeCipher(encryptionKey);
+    const localResolver = createConfigResolver({ cipher: localEncryption });
 
     // Capture warn() calls to verify drift warnings fire per-feature, not
     // globally collapsed.
@@ -425,8 +424,8 @@ describe("scenario 2.6: multi-feature drift warnings fire independently", () =>
 
 describe("scenario 3: a broken claims hook does not break login", () => {
   test("hook throws → login still succeeds, broken feature simply contributes nothing, warn logged with featureName+err", async () => {
-    const localEncryption = createEncryptionProvider(encryptionKey);
-    const localResolver = createConfigResolver({ encryption: localEncryption });
+    const localEncryption = createTestEnvelopeCipher(encryptionKey);
+    const localResolver = createConfigResolver({ cipher: localEncryption });
 
     // Capture warn-calls so the test can verify the resolver actually
     // logged the broken hook with featureName + err.message — previously

package/src/auth-email-password/__tests__/auth.integration.test.ts

@@ -1,7 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createTestUser,
@@ -13,6 +12,7 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
+  createTestEnvelopeCipher,
   expectErrorIncludes,
   getSetCookieRaw,
   getSetCookieValue,
@@ -37,8 +37,8 @@ const systemAdmin = TestUsers.systemAdmin;
 const encryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [
@@ -374,8 +374,8 @@ describe("scenario 7b: login rate limiting", () => {
   let rlStack: TestStack;
 
   beforeAll(async () => {
-    const encryption = createEncryptionProvider(encryptionKey);
-    const resolver = createConfigResolver({ encryption });
+    const encryption = createTestEnvelopeCipher(encryptionKey);
+    const resolver = createConfigResolver({ cipher: encryption });
     const { createInMemoryLoginRateLimiter } = await import("@cosmicdrift/kumiko-framework/api");
 
     rlStack = await setupTestStack({

package/src/auth-email-password/__tests__/email-verification.integration.test.ts

@@ -1,7 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -10,7 +9,11 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { seedRow, updateRows } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createTestEnvelopeCipher,
+  seedRow,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
@@ -50,8 +53,8 @@ const appVerifyUrl = "https://app.example.com/verify";
 const appResetUrl = "https://app.example.com/reset";
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/feature-options.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, test } from "bun:test";
+import { MIN_HMAC_SECRET_LENGTH } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+
+// A short HMAC secret makes reset/verify tokens forgeable (account takeover),
+// so the factory must fail fast — same bar as the ≥32-char JWT_SECRET check.
+
+const okSecret = "x".repeat(MIN_HMAC_SECRET_LENGTH);
+const shortSecret = "x".repeat(MIN_HMAC_SECRET_LENGTH - 1);
+const appUrl = "https://app.example.com/flow";
+
+describe("createAuthEmailPasswordFeature hmacSecret validation", () => {
+  test("rejects a short passwordReset.hmacSecret", () => {
+    expect(() =>
+      createAuthEmailPasswordFeature({ passwordReset: { hmacSecret: shortSecret, appUrl } }),
+    ).toThrow(/passwordReset\.hmacSecret must be/);
+  });
+
+  test("rejects a short emailVerification.hmacSecret", () => {
+    expect(() =>
+      createAuthEmailPasswordFeature({ emailVerification: { hmacSecret: shortSecret, appUrl } }),
+    ).toThrow(/emailVerification\.hmacSecret must be/);
+  });
+
+  test("accepts secrets at the minimum length", () => {
+    expect(() =>
+      createAuthEmailPasswordFeature({
+        passwordReset: { hmacSecret: okSecret, appUrl },
+        emailVerification: { hmacSecret: okSecret, appUrl },
+      }),
+    ).not.toThrow();
+  });
+});

package/src/auth-email-password/__tests__/identity-v3-login.integration.test.ts

@@ -8,7 +8,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { pbkdf2Sync, randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -18,6 +17,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -50,8 +50,8 @@ function buildBmcStyleV3Hash(password: string, salt: Buffer): string {
 }
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/password-reset.integration.test.ts

@@ -1,7 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -10,7 +9,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { createTestEnvelopeCipher, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
@@ -51,8 +50,8 @@ const resetSecret = randomBytes(32).toString("base64");
 const appResetUrl = "https://app.example.com/reset";
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/public-routes-rate-limit.integration.test.ts

@@ -7,13 +7,13 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -40,8 +40,8 @@ const resetSecret = randomBytes(32).toString("base64");
 const verifySecret = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/session-callbacks.integration.test.ts

@@ -1,7 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -10,6 +9,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import * as jose from "jose";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -90,8 +90,8 @@ const TENANT_A: TenantId = "00000000-0000-4000-8000-0000000000a1";
 const TENANT_B: TenantId = "00000000-0000-4000-8000-0000000000b1";
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   store = createFakeStore();
   sidStream = deterministicSids();

package/src/auth-email-password/constants.ts

@@ -6,6 +6,10 @@
 // der server-side Zugriff (handlers, dispatcher) erhalten.
 export const AUTH_EMAIL_PASSWORD_FEATURE = "auth-email-password" as const;
 
+// Minimum length for reset/verify hmacSecret — mirrors the ≥32-char
+// JWT_SECRET env check (HMAC-SHA256 key material).
+export const MIN_HMAC_SECRET_LENGTH = 32;
+
 // Qualified handler names. Non-CRUD handlers, no entity prefix.
 export const AuthHandlers = {
   login: "auth-email-password:write:login",

package/src/auth-email-password/feature.ts

@@ -1,5 +1,6 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { MIN_HMAC_SECRET_LENGTH } from "./constants";
 import type { AuthMailLocale } from "./email-templates";
 import { changePasswordWrite } from "./handlers/change-password.write";
 import { createInviteAcceptHandler } from "./handlers/invite-accept.write";
@@ -122,14 +123,17 @@ export type AuthEmailPasswordOptions = {
 export function createAuthEmailPasswordFeature(
   opts: AuthEmailPasswordOptions = {},
 ): FeatureDefinition {
-  if (opts.passwordReset && !opts.passwordReset.hmacSecret) {
+  // ≥32 chars, symmetric to the JWT_SECRET env check: a short HMAC secret
+  // makes reset/verify tokens forgeable — that's account takeover, so the
+  // factory fails fast instead of trusting the caller.
+  if (opts.passwordReset && opts.passwordReset.hmacSecret.length < MIN_HMAC_SECRET_LENGTH) {
     throw new Error(
-      "[auth-email-password] passwordReset.hmacSecret must be non-empty when passwordReset is configured",
+      `[auth-email-password] passwordReset.hmacSecret must be ≥${MIN_HMAC_SECRET_LENGTH} chars (HMAC-SHA256 token signing)`,
     );
   }
-  if (opts.emailVerification && !opts.emailVerification.hmacSecret) {
+  if (opts.emailVerification && opts.emailVerification.hmacSecret.length < MIN_HMAC_SECRET_LENGTH) {
     throw new Error(
-      "[auth-email-password] emailVerification.hmacSecret must be non-empty when emailVerification is configured",
+      `[auth-email-password] emailVerification.hmacSecret must be ≥${MIN_HMAC_SECRET_LENGTH} chars (HMAC-SHA256 token signing)`,
     );
   }
 

package/src/config/__tests__/config.integration.test.ts

@@ -1,11 +1,7 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  createEncryptionProvider,
-  type DbConnection,
-  seedConfigValues,
-} from "@cosmicdrift/kumiko-framework/db";
+import { type DbConnection, seedConfigValues } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createSeed,
@@ -24,7 +20,10 @@ import {
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { expectErrorIncludes } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createTestEnvelopeCipher,
+  expectErrorIncludes,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { z } from "zod";
 import { ConfigHandlers, ConfigQueries } from "../constants";
 import { createConfigAccessor, createConfigAccessorFactory, createConfigFeature } from "../feature";
@@ -257,8 +256,8 @@ const transportFeature = defineFeature("transport", (r) => {
 const testEncryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(testEncryptionKey);
-  resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(testEncryptionKey);
+  resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [

package/src/config/__tests__/encrypted-legacy-migration.integration.test.ts

@@ -0,0 +1,179 @@
+// Pins the legacy → envelope migration story for encrypted config values:
+//   1. rows written under the old CONFIG_ENCRYPTION_KEY format stay readable
+//      as long as the legacy key is wired as the cipher's fallback,
+//   2. reading an encrypted row WITHOUT any cipher throws (the pre-envelope
+//      code silently returned the ciphertext as the value),
+//   3. the reencrypt job migrates legacy rows onto the envelope format
+//      through the event-store executor (event payload carries the new
+//      envelope, so a projection rebuild no longer needs the legacy key),
+//      and is idempotent on re-run.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { asRawClient, fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEncryptionProvider,
+  createEventStoreExecutor,
+  createTenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  type AppContext,
+  access,
+  createRegistry,
+  createSystemUser,
+  createTenantConfig,
+  defineFeature,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createEnvelopeCipher,
+  type EnvelopeCipher,
+  isStoredEnvelope,
+} from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestMasterKeyProvider } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../feature";
+import { reencryptJob } from "../handlers/reencrypt.job";
+import { createConfigResolver } from "../resolver";
+import { configValueEntity, configValuesTable } from "../table";
+
+const KEY = "enc-mig:config:secret-pass";
+const TENANT: TenantId = testTenantId(1);
+const PLAINTEXT = "legacy-smtp-password";
+
+const keyDef = createTenantConfig("text", {
+  encrypted: true,
+  read: access.all,
+  write: access.all,
+});
+
+// legacy single-key provider — the pre-envelope CONFIG_ENCRYPTION_KEY world
+const legacy = createEncryptionProvider(randomBytes(32).toString("base64"));
+const masterKeyProvider = createTestMasterKeyProvider();
+const cipherWithLegacy = createEnvelopeCipher(masterKeyProvider, { legacy });
+const cipherWithoutLegacy = createEnvelopeCipher(masterKeyProvider);
+
+const encMigFeature = defineFeature("enc-mig", (r) => {
+  r.config({ keys: { "secret-pass": keyDef } });
+});
+
+const executor = createEventStoreExecutor(configValuesTable, configValueEntity, {
+  entityName: "config-value",
+});
+
+let stack: TestStack;
+
+async function seedLegacyRow(): Promise<string> {
+  const legacyValue = legacy.encrypt(JSON.stringify(PLAINTEXT));
+  const systemUser = createSystemUser(TENANT);
+  const tdb = createTenantDb(stack.db, TENANT, "system");
+  const result = await executor.create(
+    { key: KEY, value: legacyValue, tenantId: TENANT, userId: null },
+    systemUser,
+    tdb,
+  );
+  if (!result.isSuccess) throw new Error(`seed failed: ${result.error.code}`);
+  return (result.data as { id: string }).id;
+}
+
+async function readStoredValue(): Promise<string> {
+  const row = await fetchOne<{ value: string }>(stack.db, configValuesTable, {
+    key: KEY,
+    tenantId: TENANT,
+  });
+  if (!row) throw new Error("row missing");
+  return row.value;
+}
+
+type ReencryptCtx = Pick<AppContext, "db" | "masterKeyProvider" | "configEncryption" | "registry">;
+function jobCtx(cipher: EnvelopeCipher): Parameters<typeof reencryptJob>[1] {
+  const ctx: ReencryptCtx = {
+    db: stack.db,
+    masterKeyProvider,
+    configEncryption: cipher,
+    registry: stack.registry,
+  };
+  return ctx as unknown as Parameters<typeof reencryptJob>[1];
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [createConfigFeature(), encMigFeature] });
+  await unsafePushTables(stack.db, { configValuesTable });
+  await seedLegacyRow();
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("legacy encrypted config rows", () => {
+  test("stay readable through the cipher's legacy fallback (get + cascade path)", async () => {
+    const resolver = createConfigResolver({ cipher: cipherWithLegacy });
+    const value = await resolver.get(KEY, keyDef, TENANT, "u1", stack.db);
+    expect(value).toBe(PLAINTEXT);
+
+    const cascade = await resolver.getCascade(KEY, keyDef, TENANT, "u1", stack.db);
+    const active = cascade.levels.find((l) => l.hasValue);
+    expect(active?.value).toBe(PLAINTEXT);
+  });
+
+  test("throw without any cipher instead of leaking ciphertext as the value", async () => {
+    const resolver = createConfigResolver({});
+    await expect(resolver.get(KEY, keyDef, TENANT, "u1", stack.db)).rejects.toThrow(
+      /encrypted but no cipher/,
+    );
+    await expect(resolver.getCascade(KEY, keyDef, TENANT, "u1", stack.db)).rejects.toThrow(
+      /encrypted but no cipher/,
+    );
+  });
+
+  test("throw with a remediation hint when the legacy key is missing", async () => {
+    const resolver = createConfigResolver({ cipher: cipherWithoutLegacy });
+    await expect(resolver.get(KEY, keyDef, TENANT, "u1", stack.db)).rejects.toThrow(/legacy/);
+  });
+});
+
+describe("config:reencrypt job", () => {
+  test("migrates the legacy row to envelope format via the executor", async () => {
+    expect((await readStoredValue()).startsWith("{")).toBe(false);
+
+    await reencryptJob({}, jobCtx(cipherWithLegacy));
+
+    const stored = await readStoredValue();
+    expect(stored.startsWith("{")).toBe(true);
+    expect(isStoredEnvelope(JSON.parse(stored))).toBe(true);
+
+    // decryptable WITHOUT the legacy key now — retiring CONFIG_ENCRYPTION_KEY
+    // after a clean run is safe
+    const resolver = createConfigResolver({ cipher: cipherWithoutLegacy });
+    expect(await resolver.get(KEY, keyDef, TENANT, "u1", stack.db)).toBe(PLAINTEXT);
+  });
+
+  test("event payload carries the new envelope — rebuild-safe without legacy key", async () => {
+    // The migration wrote a configValue.updated event whose payload holds
+    // the envelope value; replaying events verbatim reproduces the
+    // migrated state, so the final projection never needs the legacy key.
+    const registryCheck = createRegistry([createConfigFeature(), encMigFeature]);
+    expect(registryCheck.getConfigKey(KEY)?.encrypted).toBe(true);
+
+    const events = await asRawClient(stack.db).unsafe<{
+      payload: { changes?: { value?: string } };
+    }>(
+      `SELECT payload FROM kumiko_events WHERE aggregate_type = 'config-value' AND type LIKE '%.updated' ORDER BY created_at DESC LIMIT 1`,
+    );
+    const lastValue = events[0]?.payload?.changes?.value;
+    expect(typeof lastValue).toBe("string");
+    expect((lastValue as string).startsWith("{")).toBe(true);
+  });
+
+  test("is idempotent — a second run migrates nothing", async () => {
+    const before = await readStoredValue();
+    await reencryptJob({}, jobCtx(cipherWithLegacy));
+    expect(await readStoredValue()).toBe(before);
+  });
+});

package/src/config/__tests__/inherited-redaction.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   type ConfigCascade,
@@ -14,6 +14,7 @@ import {
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { ConfigHandlers, ConfigQueries } from "../constants";
 import { createConfigAccessorFactory, createConfigFeature } from "../feature";
 import { type ConfigResolver, createConfigResolver } from "../resolver";
@@ -76,8 +77,8 @@ const platformFeature = defineFeature("platform", (r) => {
 });
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(randomBytes(32).toString("base64"));
-  resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [configFeature, platformFeature],