@cosmicdrift/kumiko-bundled-features 0.113.1 → 1.0.0

package/src/auth-email-password/stream-tenant.ts

@@ -0,0 +1,31 @@
+// user-feature runs with r.systemScope() but events land on a concrete
+// tenant stream. The row.version tracks whichever stream the user's last
+// modification wrote to — and that tenant is NOT discoverable from the
+// row alone.
+//
+// Strategy: prioritize lastActiveTenantId (most likely holds the latest
+// event), fall through to the remaining memberships in insertion order,
+// and let the caller try each one in sequence. The first stream whose
+// version matches row.version wins; the rest are bypassed.
+//
+// This is pragmatic — the real fix is to scope user events to
+// SYSTEM_TENANT_ID when the feature is r.systemScope(), which is a
+// framework-level change tracked separately. Until then, "try each
+// tenant the user belongs to" is robust against non-deterministic
+// memberships-query ordering (tenant:query:memberships has no ORDER BY).
+
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+
+export function orderTenantsByPreference(
+  memberships: readonly { readonly tenantId: TenantId }[],
+  lastActiveTenantId: string | null | undefined,
+): TenantId[] {
+  if (memberships.length === 0) return [];
+  const ids = memberships.map((m) => m.tenantId);
+  if (!lastActiveTenantId) return ids;
+  // Move lastActiveTenantId to the front; preserve relative order of rest.
+  const preferred = ids.find((id) => id === lastActiveTenantId);
+  if (!preferred) return ids;
+  const rest = ids.filter((id) => id !== preferred);
+  return [preferred, ...rest];
+}

package/src/auth-email-password/web/auth-form-primitives.tsx

@@ -17,7 +17,7 @@
 
 import { usePrimitives } from "@cosmicdrift/kumiko-renderer";
 import { BareFormProvider, cn } from "@cosmicdrift/kumiko-renderer-web";
-import { createContext, type ReactNode, useContext, useEffect, useState } from "react";
+import { createContext, type ReactNode, useContext } from "react";
 
 // Wrappt die zentrierte Auth-Card in ihre Umgebung. Default = Fullscreen-
 // zentriert (Standalone-Auth-Page). Eine Apex-/Marketing-Chrome reicht über
@@ -106,20 +106,3 @@ export function parseUrlToken(paramName = "token"): string {
   if (typeof window === "undefined") return "";
   return new URLSearchParams(window.location.search).get(paramName) ?? "";
 }
-
-// Reads the magic-link token from `?<paramName>=` once on mount, then strips
-// that param from the URL via history.replaceState so the single-use token
-// doesn't linger in browser history / Referer (#774). An explicit `override`
-// (server-injected token) short-circuits both the URL read and the scrub.
-export function useUrlToken(override?: string, paramName = "token"): string {
-  const [token] = useState(() => override ?? parseUrlToken(paramName));
-  useEffect(() => {
-    if (override !== undefined) return;
-    if (typeof window === "undefined") return;
-    const url = new URL(window.location.href);
-    if (!url.searchParams.has(paramName)) return;
-    url.searchParams.delete(paramName);
-    window.history.replaceState(window.history.state, "", url.toString());
-  }, [override, paramName]);
-  return token;
-}

package/src/auth-email-password/web/auth-gate.tsx

@@ -32,9 +32,10 @@ export function makeAuthGate(
   return AuthGate;
 }
 
-// SessionProvider + AuthGate as one gate, so a public gate in front (e.g.
-// /calculator) doesn't mount the session bootstrap — createKumikoApp stacks
-// providers outside all gates, so SessionProvider can't be a provider anymore.
+/** SessionProvider + AuthGate als ein Gate — damit öffentliche Gates davor
+ *  (z.B. /rechner) den Session-Bootstrap nicht mounten. createKumikoApp
+ *  stackt providers außerhalb aller gates; SessionProvider darf deshalb
+ *  kein provider mehr sein. */
 export function makeSessionAuthGate(
   LoginComponent: ComponentType<LoginScreenProps> = LoginScreen,
   loginProps?: LoginScreenProps,

package/src/auth-email-password/web/invite-accept-screen.tsx

@@ -19,7 +19,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useContext, useState } from "react";
 import { csrfHeader } from "./auth-client";
-import { AuthCard, authMutedLinkClass, useUrlToken } from "./auth-form-primitives";
+import { AuthCard, authMutedLinkClass, parseUrlToken } from "./auth-form-primitives";
 import { SessionContext, UNAUTHENTICATED } from "./session";
 
 export type InviteAcceptScreenProps = {
@@ -47,7 +47,7 @@ export function InviteAcceptScreen({
   // <SessionProvider> ancestor. Read the context directly and fall back to
   // the anonymous state when no provider wraps this screen (632/1).
   const session = useContext(SessionContext) ?? UNAUTHENTICATED;
-  const token = useUrlToken(tokenProp);
+  const [token] = useState(() => tokenProp ?? parseUrlToken());
   const [mode, setMode] = useState<Mode>(() =>
     session.status === "authenticated" ? "loggedin" : "anon-existing",
   );

package/src/auth-email-password/web/reset-password-screen.tsx

@@ -5,15 +5,20 @@
 // Code (anti-enumeration); UI zeigt unified "Link ungültig oder
 // abgelaufen"-message.
 //
-// Token-Quelle ist read-once via useUrlToken(): liest `?token=...` beim
-// Mount und scrubbt den Param danach aus der URL (#774). Apps die das
-// anders brauchen (server-injected Token-Prop) reichen `token` als Prop
-// durch — dann bleibt die URL unangetastet.
+// Token-Quelle ist read-once: wir lesen via parseUrlToken() einmalig
+// im useState-Initializer. Apps die das anders brauchen (server-
+// injected Token-Prop, andere Parameter-Namen) reichen einen
+// expliziten `token` als Prop durch.
 
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { resetPassword } from "./auth-client";
-import { AuthCard, authButtonClass, authMutedLinkClass, useUrlToken } from "./auth-form-primitives";
+import {
+  AuthCard,
+  authButtonClass,
+  authMutedLinkClass,
+  parseUrlToken,
+} from "./auth-form-primitives";
 
 export type ResetPasswordScreenProps = {
   readonly title?: string;
@@ -32,7 +37,7 @@ export function ResetPasswordScreen({
 }: ResetPasswordScreenProps): ReactNode {
   const t = useTranslation();
   const { Form, Field, Input, Button, Banner } = usePrimitives();
-  const token = useUrlToken(tokenProp);
+  const [token] = useState(() => tokenProp ?? parseUrlToken());
   const [newPassword, setNewPassword] = useState("");
   const [confirmPassword, setConfirmPassword] = useState("");
   const [submitting, setSubmitting] = useState(false);

package/src/auth-email-password/web/signup-complete-screen.tsx

@@ -6,9 +6,9 @@
 // Server JWT + Cookies (Auto-Login!) und liefert tenantKey für den
 // Post-Signup-Redirect.
 //
-// Token-Quelle ist read-once via useUrlToken: liest `?token=...` beim
-// Mount und scrubbt den Param danach aus der URL (#774). Apps die einen
-// server-injected Token nutzen, reichen `token` als Prop durch.
+// Token-Quelle ist read-once: parseUrlToken im useState-Initializer.
+// Apps die einen anderen URL-Param nutzen, reichen `token` als Prop
+// durch.
 //
 // Nach success: redirect via window.location.assign zu loggedInHref.
 // Default-Pattern ist "/<tenantKey>/" — die App reicht ein Template
@@ -18,7 +18,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { confirmSignup } from "./auth-client";
-import { AuthCard, authMutedLinkClass, useUrlToken } from "./auth-form-primitives";
+import { AuthCard, authMutedLinkClass, parseUrlToken } from "./auth-form-primitives";
 
 export type SignupCompleteScreenProps = {
   readonly title?: string;
@@ -44,7 +44,7 @@ export function SignupCompleteScreen({
 }: SignupCompleteScreenProps): ReactNode {
   const t = useTranslation();
   const { Form, Field, Input, Button, Banner } = usePrimitives();
-  const token = useUrlToken(tokenProp);
+  const [token] = useState(() => tokenProp ?? parseUrlToken());
   const [password, setPassword] = useState("");
   const [confirmPassword, setConfirmPassword] = useState("");
   const [submitting, setSubmitting] = useState(false);

package/src/auth-email-password/web/user-menu.tsx

@@ -33,9 +33,7 @@ export type UserMenuProps = {
    *  controlliert der Caller — wir packen nur den Frame drumrum. */
   readonly children?: ReactNode;
   /** "pill" (Default) = kompakter Topbar-Trigger; "sidebar" = volle NavUser-
-   *  Row (Avatar + Name + Email) für den `sidebarFooter`-Slot der App-Shell.
-   *  Requires a `SidebarProvider` ancestor (547/3) — the default App-Shell
-   *  `sidebarFooter` slot already provides one. */
+   *  Row (Avatar + Name + Email) für den `sidebarFooter`-Slot der App-Shell. */
   readonly variant?: UserMenuVariant;
 };
 

package/src/auth-email-password/web/verify-email-screen.tsx

@@ -13,7 +13,12 @@
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useEffect, useRef, useState } from "react";
 import { verifyEmail } from "./auth-client";
-import { AuthCard, authButtonClass, authMutedLinkClass, useUrlToken } from "./auth-form-primitives";
+import {
+  AuthCard,
+  authButtonClass,
+  authMutedLinkClass,
+  parseUrlToken,
+} from "./auth-form-primitives";
 
 export type VerifyEmailScreenProps = {
   readonly title?: string;
@@ -31,7 +36,7 @@ export function VerifyEmailScreen({
   loginHref = "/login",
 }: VerifyEmailScreenProps): ReactNode {
   const t = useTranslation();
-  const token = useUrlToken(tokenProp);
+  const [token] = useState(() => tokenProp ?? parseUrlToken());
   const [status, setStatus] = useState<Status>(token === "" ? "missing-token" : "verifying");
   const startedRef = useRef(false);
 

package/src/config/__tests__/config.integration.test.ts

@@ -1,7 +1,11 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { type DbConnection, seedConfigValues } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEncryptionProvider,
+  type DbConnection,
+  seedConfigValues,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createSeed,
@@ -20,10 +24,7 @@ import {
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import {
-  createTestEnvelopeCipher,
-  expectErrorIncludes,
-} from "@cosmicdrift/kumiko-framework/testing";
+import { expectErrorIncludes } from "@cosmicdrift/kumiko-framework/testing";
 import { z } from "zod";
 import { ConfigHandlers, ConfigQueries } from "../constants";
 import { createConfigAccessor, createConfigAccessorFactory, createConfigFeature } from "../feature";
@@ -256,8 +257,8 @@ const transportFeature = defineFeature("transport", (r) => {
 const testEncryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(testEncryptionKey);
-  resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(testEncryptionKey);
+  resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [

package/src/config/__tests__/deserialize-value.test.ts

@@ -1,9 +1,12 @@
 import { describe, expect, test } from "bun:test";
 import { deserializeValue } from "../resolver";
 
-// Type mismatches are coerced, not rejected (number via Number(), boolean
-// only via literal true/"true", text via String()) — pinned so a refactor
-// can't quietly change that.
+// deserializeValue is the read boundary for every config value: the DB stores
+// the JSON-encoded raw string, this turns it back into a typed primitive per the
+// key's declared `type`. The coercion has non-obvious paths worth pinning so a
+// refactor can't quietly change them: a stored value whose JSON type disagrees
+// with the declared type is NOT rejected — it is coerced (number via Number(),
+// boolean only via literal true / the string "true", text via String()).
 
 describe("deserializeValue", () => {
   test("null raw short-circuits to undefined before any parse", () => {

package/src/config/__tests__/inherited-redaction.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   type ConfigCascade,
@@ -14,7 +14,6 @@ import {
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { ConfigHandlers, ConfigQueries } from "../constants";
 import { createConfigAccessorFactory, createConfigFeature } from "../feature";
 import { type ConfigResolver, createConfigResolver } from "../resolver";
@@ -77,8 +76,8 @@ const platformFeature = defineFeature("platform", (r) => {
 });
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
-  resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(randomBytes(32).toString("base64"));
+  resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [configFeature, platformFeature],

package/src/config/feature.ts

@@ -1,4 +1,4 @@
-import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection, EncryptionProvider, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   type ConfigAccessor,
   type ConfigAccessorFactory,
@@ -13,10 +13,8 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import { cascadeQuery } from "./handlers/cascade.query";
 import { readinessQuery } from "./handlers/readiness.query";
-import { reencryptJob } from "./handlers/reencrypt.job";
 import { resetWrite } from "./handlers/reset.write";
 import { schemaQuery } from "./handlers/schema.query";
 import { setWrite } from "./handlers/set.write";
@@ -29,7 +27,7 @@ export type ConfigContext = { readonly config: ConfigAccessor };
 export function createConfigFeature(): FeatureDefinition {
   return defineFeature("config", (r) => {
     r.describe(
-      "Stores per-tenant (and optionally per-user) configuration values with a multi-layer cascade: user-row \u2192 tenant-row \u2192 system-row \u2192 app-override (deploy-time `AppConfigOverrides`) \u2192 computed \u2192 feature default. Access a value in handlers via `ctx.config(handle)`, declare keys with `r.config({ keys: { ... } })` inside a feature's registry callback, and optionally mark them `encrypted: true` to route storage through the envelope cipher (versioned master key). Use this feature whenever a tenant admin needs to customise behaviour at runtime without a code deploy.",
+      "Stores per-tenant (and optionally per-user) configuration values with a multi-layer cascade: user-row \u2192 tenant-row \u2192 system-row \u2192 app-override (deploy-time `AppConfigOverrides`) \u2192 computed \u2192 feature default. Access a value in handlers via `ctx.config(handle)`, declare keys with `r.config({ keys: { ... } })` inside a feature's registry callback, and optionally mark them `encrypted: true` to route storage through an `EncryptionProvider`. Use this feature whenever a tenant admin needs to customise behaviour at runtime without a code deploy.",
     );
     r.uiHints({
       displayLabel: "Tenant Config Store",
@@ -57,12 +55,6 @@ export function createConfigFeature(): FeatureDefinition {
       readiness: r.queryHandler(readinessQuery),
     };
 
-    // Migration + KEK-rotation for encrypted values (legacy-format →
-    // envelope, old kekVersion → current). Manual trigger — ops runs it
-    // once after adding a new master key version or before retiring the
-    // legacy CONFIG_ENCRYPTION_KEY.
-    r.job("reencrypt", { trigger: { manual: true } }, reencryptJob);
-
     return { handlers, queries };
   });
 }
@@ -124,14 +116,16 @@ export function requireConfigResolver(ctx: HandlerContext, handlerName: string):
 // lazily so apps that never wire encryption still boot (and only crash
 // if a handler tries to write an encrypted key without the provider in
 // place, pointing at the exact wiring gap).
-export function requireConfigEncryption(ctx: HandlerContext, handlerName: string): EnvelopeCipher {
+export function requireConfigEncryption(
+  ctx: HandlerContext,
+  handlerName: string,
+): EncryptionProvider {
   if (!ctx.configEncryption) {
     throw new InternalError({
       message:
         `[${handlerName}] ctx.configEncryption missing — at least one config key declares ` +
-        `encrypted: true, so the boot wiring must pass an EnvelopeCipher via ` +
-        `extraContext.configEncryption (run{Prod,Dev}App wire it automatically from ` +
-        `KUMIKO_SECRETS_MASTER_KEY_V<n>; same instance the resolver was built with).`,
+        `encrypted: true, so the boot wiring must pass an EncryptionProvider via ` +
+        `extraContext.configEncryption (same instance the resolver was built with).`,
     });
   }
   return ctx.configEncryption;

package/src/config/handlers/set.write.ts

@@ -88,8 +88,8 @@ export const setWrite = defineWriteHandler({
 
     let serialized = JSON.stringify(event.payload.value);
     if (keyDef.encrypted) {
-      const cipher = requireConfigEncryption(ctx, "config:write:set");
-      serialized = await cipher.encrypt(serialized, { tenantId });
+      const encryption = requireConfigEncryption(ctx, "config:write:set");
+      serialized = encryption.encrypt(serialized);
     }
 
     const existing = await findConfigRow(db, event.payload.key, tenantId, userId);

package/src/config/index.ts

@@ -1,7 +1,6 @@
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection, EncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { seedConfigValues } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
-import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import { configValueEntity, configValuesTable } from "./table";
 
 export {
@@ -31,8 +30,8 @@ export { configValuesTable } from "./table";
 export function seedAllConfigValues(
   registry: Registry,
   db: DbConnection,
-  cipher?: EnvelopeCipher,
+  encryption?: EncryptionProvider,
 ): Promise<{ created: number; skipped: number }> {
   const seeds = registry.getAllConfigSeeds();
-  return seedConfigValues(seeds, configValuesTable, configValueEntity, registry, db, cipher);
+  return seedConfigValues(seeds, configValuesTable, configValueEntity, registry, db, encryption);
 }

package/src/config/resolver.ts

@@ -1,5 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection, EncryptionProvider, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type {
   ConfigCascade,
   ConfigCascadeLevel,
@@ -12,7 +12,6 @@ import type {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import { assertUnreachable, parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
 import { selectConfigRowsForKeys, selectConfigRowsForScope } from "./db/queries/resolver";
 import { configValuesTable } from "./table";
@@ -64,33 +63,10 @@ export function deserializeValue(
 export type AppConfigOverrides = ReadonlyMap<string, string | number | boolean>;
 
 export type ConfigResolverOptions = {
-  // Envelope cipher for `encrypted: true` keys. run{Prod,Dev}App wire it
-  // automatically from the secrets master key — apps only pass their own
-  // to override (tests, custom providers).
-  cipher?: EnvelopeCipher;
+  encryption?: EncryptionProvider;
   appOverrides?: AppConfigOverrides;
 };
 
-// Decrypt gate for encrypted keys: an encrypted row without a cipher MUST
-// throw — passing the ciphertext through as the "value" (the pre-envelope
-// behavior) silently feeds base64 garbage to whatever consumes the key
-// (e.g. an SMTP password) and is a debugging nightmare.
-async function decryptEncrypted(
-  cipher: EnvelopeCipher | undefined,
-  raw: string,
-  qualifiedKey: string,
-): Promise<string> {
-  if (!cipher) {
-    throw new InternalError({
-      message:
-        `[config] key "${qualifiedKey}" is encrypted but no cipher is wired — the boot must ` +
-        `provide a master key (KUMIKO_SECRETS_MASTER_KEY_V<n>) or pass ConfigResolverOptions.cipher.`,
-      i18nKey: "config.errors.cipher_missing",
-    });
-  }
-  return cipher.decrypt(raw);
-}
-
 // backing="secrets" keys store their value in the secrets store (flat per
 // (tenant,key) at SYSTEM_TENANT_ID), not in config_values. Both read paths
 // (getWithSource + buildCascade) route the system rung here. Missing reader =
@@ -125,7 +101,7 @@ async function buildCascade(
     userId: string | null,
   ) => Promise<ConfigRow | null> | ConfigRow | null,
   appOverrides: AppConfigOverrides | undefined,
-  cipher: EnvelopeCipher | undefined,
+  encryption: EncryptionProvider | undefined,
   secretsReader: ConfigSecretsReader | undefined,
 ): Promise<ConfigCascade> {
   type Lookup = {
@@ -203,8 +179,8 @@ async function buildCascade(
     const row = await fetchRow(lookup.tenantId, lookup.userId);
     if (row?.value !== null && row?.value !== undefined) {
       let raw = row.value;
-      if (keyDef.encrypted) {
-        raw = await decryptEncrypted(cipher, raw, qualifiedKey);
+      if (keyDef.encrypted && encryption) {
+        raw = encryption.decrypt(raw);
       }
       if (activeIndex === -1) activeIndex = levels.length;
       levels.push({
@@ -289,7 +265,7 @@ async function buildCascade(
 }
 
 export function createConfigResolver(options: ConfigResolverOptions = {}): ConfigResolver {
-  const { cipher, appOverrides } = options;
+  const { encryption, appOverrides } = options;
   async function findRow(
     key: string,
     tenantId: string,
@@ -380,8 +356,8 @@ export function createConfigResolver(options: ConfigResolverOptions = {}): Confi
         const row = await findRow(qualifiedKey, lookup.tenantId, lookup.userId, db);
         if (row?.value !== null && row?.value !== undefined) {
           let raw = row.value;
-          if (keyDef.encrypted) {
-            raw = await decryptEncrypted(cipher, raw, qualifiedKey);
+          if (keyDef.encrypted && encryption) {
+            raw = encryption.decrypt(raw);
           }
           return { value: deserializeValue(raw, keyDef.type), source: lookup.source };
         }
@@ -494,7 +470,7 @@ export function createConfigResolver(options: ConfigResolverOptions = {}): Confi
         db,
         (tid, uid) => findRow(qualifiedKey, tid, uid, db),
         appOverrides,
-        cipher,
+        encryption,
         secretsReader,
       );
     },
@@ -536,7 +512,7 @@ export function createConfigResolver(options: ConfigResolverOptions = {}): Confi
           (tid, uid) =>
             keyRows.find((r) => r.tenantId === tid && (r.userId ?? null) === uid) ?? null,
           appOverrides,
-          cipher,
+          encryption,
           secretsReader,
         );
         result.set(key, cascade);

package/src/custom-fields/__tests__/custom-fields.integration.test.ts

@@ -22,10 +22,6 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
-import {
-  createProjectionStateTable,
-  rebuildProjection,
-} from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   createTestUser,
   setupTestStack,
@@ -88,7 +84,6 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, fieldDefinitionEntity);
   await unsafeCreateEntityTable(stack.db, propertyEntity);
   await createEventsTable(stack.db);
-  await createProjectionStateTable(stack.db);
 });
 
 afterAll(async () => {
@@ -924,63 +919,3 @@ describe("custom-fields integration — update-tenant-field (Bug-Bash D2)", () =
     expect(causeMessage).toContain("update-tenant-field");
   });
 });
-
-describe("custom-fields integration — official host-entity rebuild (#759)", () => {
-  test("rebuildProjection replays customField.set/cleared + fieldDefinition.deleted", async () => {
-    await defineField("property", "color", "text");
-    await defineField("property", "doomed", "text");
-    const propId = "dddddddd-dddd-4000-8000-00000000000d";
-    await createProperty(propId, "RebuildOfficial");
-    await setCustomField("property", propId, "color", "blue");
-    await setCustomField("property", propId, "doomed", "bye");
-    // fieldDef-delete cascade removes the key — the rebuild must preserve the
-    // removal (fieldDefinition.deleted rides the extra "field-definition" source).
-    await stack.http.writeOk(
-      "custom-fields:write:delete-tenant-field",
-      { entityName: "property", fieldKey: "doomed" },
-      admin,
-    );
-    await stack.eventDispatcher?.runOnce();
-
-    let row = (await listProperties()).rows.find((r) => r["id"] === propId);
-    expect(row?.["color"]).toBe("blue");
-    expect(row?.["doomed"]).toBeUndefined();
-
-    // The routine schema-migration path: full official rebuild of the host
-    // entity's implicit projection. Pre-#759 this reset every custom_fields
-    // jsonb to its default '{}' with no recovery path.
-    const result = await rebuildProjection("property-test:projection:property-entity", {
-      db: stack.db,
-      registry: stack.registry,
-    });
-    expect(result.eventsProcessed).toBeGreaterThan(0);
-
-    row = (await listProperties()).rows.find((r) => r["id"] === propId);
-    expect(row?.["name"]).toBe("RebuildOfficial");
-    expect(row?.["color"]).toBe("blue");
-    expect(row?.["doomed"]).toBeUndefined();
-  });
-
-  test("clear-custom-field removal survives the official rebuild", async () => {
-    await defineField("property", "flag", "text");
-    await defineField("property", "keep", "text");
-    const propId = "eeeeeeee-eeee-4000-8000-00000000000e";
-    await createProperty(propId, "ClearSurvives");
-    await setCustomField("property", propId, "flag", "on");
-    await setCustomField("property", propId, "keep", "yes");
-    await clearCustomField("property", propId, "flag");
-    await stack.eventDispatcher?.runOnce();
-
-    await rebuildProjection("property-test:projection:property-entity", {
-      db: stack.db,
-      registry: stack.registry,
-    });
-
-    const row = (await listProperties()).rows.find((r) => r["id"] === propId);
-    // Kontrollfeld beweist dass der Rebuild die set-Events real replayt hat —
-    // ein leeres {} wuerde "flag undefined" trivial erfuellen.
-    expect(row?.["keep"]).toBe("yes");
-    expect(row?.["flag"]).toBeUndefined();
-    expect(row?.["name"]).toBe("ClearSurvives");
-  });
-});

package/src/custom-fields/constants.ts

@@ -31,7 +31,6 @@ export const CUSTOM_FIELDS_FORM_EXTENSION_NAME = "CustomFieldsFormSection";
 // Entity-CRUD auto-events for the `field-definition` entity. registry.ts emits
 // these as `${entityName}.created`/`.updated` (dot form) — they do NOT run
 // through r.defineEvent/toKebab, so the dot MUST stay.
-export const FIELD_DEFINITION_AGGREGATE_TYPE = "field-definition";
 export const FIELD_DEFINITION_CREATED_EVENT = "field-definition.created";
 export const FIELD_DEFINITION_UPDATED_EVENT = "field-definition.updated";
 // Qualified at registration via r.defineEvent — final name is

package/src/custom-fields/events.ts

@@ -15,12 +15,6 @@ export const customFieldSetSchema = z.object({
   // self-projected into the host row by the write handler and must never enter
   // the immutable log. Non-sensitive sets always carry the value.
   value: z.unknown().optional(),
-  // Explicit protocol marker (527/1) — `value === undefined` alone is also a
-  // valid-looking "clear" shape; `_sensitive` names the reason so a future
-  // reader can't mistake one for the other. Optional so historical events
-  // (persisted before this field existed) still parse: apply-side readers
-  // keep `value === undefined` as their actual branch condition.
-  _sensitive: z.literal(true).optional(),
 });
 export type CustomFieldSetPayload = z.infer<typeof customFieldSetSchema>;
 

package/src/custom-fields/handlers/delete-system-field.write.ts

@@ -1,6 +1,5 @@
 import { SYSTEM_TENANT_ID, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionAggregateId } from "../aggregate-id";
-import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants";
 import { fieldDefinitionExecutor } from "../executor";
 import { customFieldsFeature } from "../feature";
 import { type DeleteFieldPayload, deleteFieldPayloadSchema } from "../schemas";
@@ -31,7 +30,7 @@ export const deleteSystemFieldHandler: WriteHandlerDef = {
     if (result.isSuccess) {
       await ctx.unsafeAppendEvent({
         aggregateId,
-        aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
+        aggregateType: "field-definition",
         type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
         payload: {
           entityName: payload.entityName,

package/src/custom-fields/handlers/delete-tenant-field.write.ts

@@ -1,6 +1,5 @@
 import { isSystemTenant, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionAggregateId } from "../aggregate-id";
-import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants";
 import { fieldDefinitionExecutor } from "../executor";
 import { customFieldsFeature } from "../feature";
 import { type DeleteFieldPayload, deleteFieldPayloadSchema } from "../schemas";
@@ -39,7 +38,7 @@ export const deleteTenantFieldHandler: WriteHandlerDef = {
     if (result.isSuccess) {
       await ctx.unsafeAppendEvent({
         aggregateId,
-        aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
+        aggregateType: "field-definition",
         type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
         payload: { entityName: payload.entityName, fieldKey: payload.fieldKey, tenantId },
       });

package/src/custom-fields/handlers/set-custom-field.write.ts

@@ -135,7 +135,7 @@ export const setCustomFieldHandler: WriteHandlerDef = {
       aggregateType: payload.entityName,
       type: customFieldsFeature.exports.setEvent.name,
       payload: sensitive
-        ? { fieldKey: payload.fieldKey, _sensitive: true as const }
+        ? { fieldKey: payload.fieldKey }
         : { fieldKey: payload.fieldKey, value: payload.value },
     });