@cosmicdrift/kumiko-bundled-features 0.125.2 → 0.127.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.125.2",
+  "version": "0.127.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -62,6 +62,7 @@
     "./tenant/constants": "./src/tenant/constants.ts",
     "./tenant/web": "./src/tenant/web/index.ts",
     "./tenant/seeding": "./src/tenant/seeding.ts",
+    "./tenant-lifecycle": "./src/tenant-lifecycle/index.ts",
     "./tenant/testing": "./src/tenant/testing.ts",
     "./user": "./src/user/index.ts",
     "./user/seeding": "./src/user/seeding.ts",
@@ -106,11 +107,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.125.2",
-    "@cosmicdrift/kumiko-framework": "0.125.2",
-    "@cosmicdrift/kumiko-headless": "0.125.2",
-    "@cosmicdrift/kumiko-renderer": "0.125.2",
-    "@cosmicdrift/kumiko-renderer-web": "0.125.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.127.0",
+    "@cosmicdrift/kumiko-framework": "0.127.0",
+    "@cosmicdrift/kumiko-headless": "0.127.0",
+    "@cosmicdrift/kumiko-renderer": "0.127.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.127.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/audit/__tests__/audit-security.integration.test.ts

@@ -149,3 +149,53 @@ describe("systemAdmin retains audit access", () => {
     expect(res.rows.length).toBeGreaterThanOrEqual(1);
   });
 });
+
+describe("tenant isolation", () => {
+  test("TenantAdmin does not see events from another tenant", async () => {
+    const otherTenant = testTenantId(2);
+    await seedTenant(stack.db, { id: otherTenant, key: "audit-other", name: "Other" });
+    await seedTenantMembership(stack.db, {
+      userId: tenantAdminId,
+      tenantId: otherTenant,
+      roles: ["TenantAdmin"],
+    });
+    await stack.http.writeOk(
+      "audit-sec-widgets:write:widget:create",
+      { name: "other-tenant" },
+      { id: tenantAdminId, tenantId: otherTenant, roles: ["TenantAdmin"] },
+    );
+
+    const ownTenantRes = await stack.http.queryOk<{ rows: readonly { type: string }[] }>(
+      AuditQueries.list,
+      {},
+      tenantAdmin(),
+    );
+    expect(ownTenantRes.rows.some((r) => r.type === "widget.created")).toBe(false);
+  });
+});
+
+describe("audit list filters", () => {
+  test("rejects from after to", async () => {
+    const res = await stack.http.query(
+      AuditQueries.list,
+      { from: "2026-01-02T00:00:00.000Z", to: "2026-01-01T00:00:00.000Z" },
+      tenantAdmin(),
+    );
+    expect([400, 422]).toContain(res.status);
+  });
+
+  test("filters by eventType within tenant", async () => {
+    await stack.http.writeOk(
+      "audit-sec-widgets:write:widget:create",
+      { name: "filter-me" },
+      tenantAdmin(),
+    );
+    const res = await stack.http.queryOk<{ rows: readonly { type: string }[] }>(
+      AuditQueries.list,
+      { eventType: "widget.created" },
+      tenantAdmin(),
+    );
+    expect(res.rows.length).toBeGreaterThanOrEqual(1);
+    expect(res.rows.every((r) => r.type === "widget.created")).toBe(true);
+  });
+});

package/src/audit/i18n.ts

@@ -15,4 +15,13 @@ export const AUDIT_I18N: Readonly<Record<string, LocalizedString>> = {
   "audit.log.col.type": { de: "Ereignis", en: "Event" },
   "audit.log.col.aggregate": { de: "Aggregate", en: "Aggregate" },
   "audit.log.col.actor": { de: "Akteur", en: "Actor" },
+  "audit.log.filter.eventType": { de: "Ereignistyp", en: "Event type" },
+  "audit.log.filter.aggregateType": { de: "Aggregate-Typ", en: "Aggregate type" },
+  "audit.log.filter.from": { de: "Von", en: "From" },
+  "audit.log.filter.to": { de: "Bis", en: "To" },
+  "audit.log.filter.apply": { de: "Filtern", en: "Filter" },
+  "audit.log.filter.reset": { de: "Zurücksetzen", en: "Reset" },
+  "audit.log.details": { de: "Details", en: "Details" },
+  "audit.log.detail.title": { de: "Ereignis-Payload", en: "Event payload" },
+  "audit.log.detail.close": { de: "Schließen", en: "Close" },
 };

package/src/audit/web/audit-log-screen.tsx

@@ -18,6 +18,13 @@ type AuditRow = {
 
 type AuditResponse = { readonly rows: readonly AuditRow[]; readonly nextBefore: string | null };
 
+type Filters = {
+  readonly eventType: string;
+  readonly aggregateType: string;
+  readonly from: string;
+  readonly to: string;
+};
+
 type State =
   | { readonly kind: "loading" }
   | { readonly kind: "error"; readonly message: string }
@@ -27,12 +34,16 @@ type State =
       readonly nextBefore: string | null;
     };
 
+const EMPTY_FILTERS: Filters = { eventType: "", aggregateType: "", from: "", to: "" };
+
 export function AuditLogScreen(): ReactNode {
   const t = useTranslation();
-  const { Banner, Button, Card, DataTable, Heading, Text } = usePrimitives();
+  const { Banner, Button, Card, DataTable, Field, Heading, Input, Text } = usePrimitives();
   const dispatcher = useDispatcher();
   const [state, setState] = useState<State>({ kind: "loading" });
   const [before, setBefore] = useState<string | undefined>(undefined);
+  const [filters, setFilters] = useState<Filters>(EMPTY_FILTERS);
+  const [detailId, setDetailId] = useState<string | null>(null);
 
   const load = useCallback(
     async (cursor?: string): Promise<void> => {
@@ -40,6 +51,12 @@ export function AuditLogScreen(): ReactNode {
       const res = await dispatcher.query<AuditResponse>(AuditQueries.list, {
         limit: 50,
         ...(cursor !== undefined && { before: cursor }),
+        ...(filters.eventType.trim() !== "" && { eventType: filters.eventType.trim() }),
+        ...(filters.aggregateType.trim() !== "" && {
+          aggregateType: filters.aggregateType.trim(),
+        }),
+        ...(filters.from !== "" && { from: toIsoStart(filters.from) }),
+        ...(filters.to !== "" && { to: toIsoEnd(filters.to) }),
       });
       if (!res.isSuccess) {
         setState({ kind: "error", message: res.error.message });
@@ -47,13 +64,15 @@ export function AuditLogScreen(): ReactNode {
       }
       setState({ kind: "ready", rows: res.data.rows, nextBefore: res.data.nextBefore });
     },
-    [dispatcher],
+    [dispatcher, filters],
   );
 
   useEffect(() => {
     void load(before);
   }, [load, before]);
 
+  const detailRow = state.kind === "ready" ? state.rows.find((r) => r.id === detailId) : undefined;
+
   if (state.kind === "loading") {
     return (
       <FormScreenShell testId="audit-log-screen">
@@ -74,6 +93,69 @@ export function AuditLogScreen(): ReactNode {
     <FormScreenShell testId="audit-log-screen" className="flex max-w-5xl flex-col gap-6">
       <Heading variant="page">{t("audit.log.title")}</Heading>
 
+      <div className="grid gap-4 sm:grid-cols-2 lg:grid-cols-4">
+        <Field id="audit-filter-event" label={t("audit.log.filter.eventType")}>
+          <Input
+            kind="text"
+            id="audit-filter-event"
+            name="audit-filter-event"
+            value={filters.eventType}
+            onChange={(v: string) => setFilters((f) => ({ ...f, eventType: v }))}
+          />
+        </Field>
+        <Field id="audit-filter-aggregate" label={t("audit.log.filter.aggregateType")}>
+          <Input
+            kind="text"
+            id="audit-filter-aggregate"
+            name="audit-filter-aggregate"
+            value={filters.aggregateType}
+            onChange={(v) => setFilters((f) => ({ ...f, aggregateType: v }))}
+          />
+        </Field>
+        <Field id="audit-filter-from" label={t("audit.log.filter.from")}>
+          <Input
+            kind="date"
+            id="audit-filter-from"
+            name="audit-filter-from"
+            value={filters.from}
+            onChange={(v) => setFilters((f) => ({ ...f, from: v ?? "" }))}
+          />
+        </Field>
+        <Field id="audit-filter-to" label={t("audit.log.filter.to")}>
+          <Input
+            kind="date"
+            id="audit-filter-to"
+            name="audit-filter-to"
+            value={filters.to}
+            onChange={(v) => setFilters((f) => ({ ...f, to: v ?? "" }))}
+          />
+        </Field>
+      </div>
+      <div className="flex gap-2">
+        <Button
+          type="button"
+          variant="primary"
+          onClick={() => {
+            setBefore(undefined);
+            void load(undefined);
+          }}
+          testId="audit-log-apply-filters"
+        >
+          {t("audit.log.filter.apply")}
+        </Button>
+        <Button
+          type="button"
+          variant="secondary"
+          onClick={() => {
+            setFilters(EMPTY_FILTERS);
+            setBefore(undefined);
+          }}
+          testId="audit-log-reset-filters"
+        >
+          {t("audit.log.filter.reset")}
+        </Button>
+      </div>
+
       <Card options={{ padded: false }}>
         <DataTable
           testId="audit-log-table"
@@ -97,10 +179,30 @@ export function AuditLogScreen(): ReactNode {
               actor: row.createdBy,
             },
           }))}
+          rowActions={[
+            {
+              id: "details",
+              label: t("audit.log.details"),
+              style: "secondary",
+              onTrigger: (row) => setDetailId(row.id),
+            },
+          ]}
+          rowActionMode="inline"
           emptyState={<Text variant="small">{t("audit.log.empty")}</Text>}
         />
       </Card>
 
+      {detailRow !== undefined && (
+        <Card slots={{ title: t("audit.log.detail.title") }} options={{ padded: true }}>
+          <pre className="max-h-96 overflow-auto whitespace-pre-wrap break-all text-xs">
+            {JSON.stringify(detailRow.payload, null, 2)}
+          </pre>
+          <Button type="button" variant="secondary" onClick={() => setDetailId(null)}>
+            {t("audit.log.detail.close")}
+          </Button>
+        </Card>
+      )}
+
       <div className="flex gap-2">
         {before !== undefined && (
           <Button
@@ -134,3 +236,11 @@ function formatWhen(value: string): string {
     return value;
   }
 }
+
+function toIsoStart(date: string): string {
+  return new Date(`${date}T00:00:00.000Z`).toISOString();
+}
+
+function toIsoEnd(date: string): string {
+  return new Date(`${date}T23:59:59.999Z`).toISOString();
+}

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -12,15 +12,38 @@
 // einem separaten Test mit Hono-mock geprüft.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  configurePiiSubjectKms,
+  decryptPiiFieldValues,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  PII_ERASED_SENTINEL,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { createEventsTable, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createEventsTable,
+  isStreamArchived,
+  loadAggregate,
+} from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
   setupTestStack,
   type TestStack,
   testTenantId,
+  unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import {
+  ComplianceProfileHandlers,
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { subscriptionAggregateId } from "../aggregate-id";
 import {
   SubscriptionEventTypes,
@@ -28,6 +51,8 @@ import {
   SubscriptionStatuses,
 } from "../constants";
 import { billingFoundationFeature } from "../feature";
+import { subscriptionsProjectionTable } from "../projection";
+import { subscriptionTenantDestroyHook } from "../tenant-destroy-hook";
 import type { SubscriptionProviderPlugin } from "../types";
 
 // =============================================================================
@@ -80,16 +105,30 @@ let db: DbConnection;
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [billingFoundationFeature, mockProviderFeature],
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      billingFoundationFeature,
+      mockProviderFeature,
+    ],
   });
   db = stack.db;
   // subscriptionsProjectionTable wird von setupTestStack automatisch
   // gepusht (r.projection mit `table`-Property → auto-push).
   await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
+  // providerCustomerId/providerSubscriptionId are `tenantOwned` PII-subject
+  // fields — no executor wires the KMS automatically here (raw r.projection,
+  // see feature.ts), so process-event.write.ts calls configuredPiiSubjectKms()
+  // directly and needs one configured, same as run{Prod,Dev}App do at boot.
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
 });
 
 afterAll(async () => {
   await stack.cleanup();
+  resetPiiSubjectKmsForTests();
 });
 
 function adminFor(tenantNumber: number) {
@@ -566,3 +605,168 @@ describe("scenario 8: cancel-event setzt status auf canceled, behält subscripti
     expect(subs.rows[0]?.["tier"]).toBe("free");
   });
 });
+
+describe("scenario 9: subscriptionTenantDestroyHook (#800 tenant-destroy PII erasure)", () => {
+  test("default profile → row hard-deleted, stream archived", async () => {
+    const admin = adminFor(3009);
+    await stack.http.writeOk(
+      SubscriptionFoundationHandlers.processEvent,
+      buildEvent({
+        providerEventId: "evt_3009_create",
+        providerCustomerId: "cus_3009",
+        providerSubscriptionId: "sub_3009",
+      }),
+      admin,
+    );
+
+    await subscriptionTenantDestroyHook({ db, tenantId: admin.tenantId });
+
+    const rows = await selectMany(db, subscriptionsProjectionTable, {
+      id: subscriptionAggregateId(admin.tenantId),
+    });
+    expect(rows).toHaveLength(0);
+    expect(
+      await isStreamArchived(db, admin.tenantId, subscriptionAggregateId(admin.tenantId)),
+    ).toBe(true);
+  });
+
+  test("HGB profile → PII redacted, accounting fields + row survive, stream archived", async () => {
+    const admin = adminFor(3010);
+    await stack.http.writeOk(
+      ComplianceProfileHandlers.setProfile,
+      { profileKey: "de-hr-dsgvo-hgb" },
+      admin,
+    );
+    await stack.http.writeOk(
+      SubscriptionFoundationHandlers.processEvent,
+      buildEvent({
+        providerEventId: "evt_3010_create",
+        providerCustomerId: "cus_3010",
+        providerSubscriptionId: "sub_3010",
+        tier: "pro",
+      }),
+      admin,
+    );
+
+    await subscriptionTenantDestroyHook({ db, tenantId: admin.tenantId });
+
+    const rows = await selectMany<{
+      providerCustomerId: string;
+      providerSubscriptionId: string;
+      tier: string;
+      status: string;
+    }>(db, subscriptionsProjectionTable, { id: subscriptionAggregateId(admin.tenantId) });
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.providerCustomerId).toBe("[erased]");
+    expect(rows[0]?.providerSubscriptionId).toBe("[erased]");
+    // accounting facts survive — that's the point of the HGB retention branch
+    expect(rows[0]?.tier).toBe("pro");
+    expect(
+      await isStreamArchived(db, admin.tenantId, subscriptionAggregateId(admin.tenantId)),
+    ).toBe(true);
+  });
+});
+
+describe("scenario 10: PII is encrypted at rest, not just erasable on destroy", () => {
+  test("raw event-log payload and raw projection row both hold ciphertext, not the plaintext provider id", async () => {
+    const admin = adminFor(3011);
+    await stack.http.writeOk(
+      SubscriptionFoundationHandlers.processEvent,
+      buildEvent({
+        providerEventId: "evt_3011_create",
+        providerCustomerId: "cus_3011",
+        providerSubscriptionId: "sub_3011",
+      }),
+      admin,
+    );
+
+    // Raw event-log row (kumiko_events) — archiveStream only stops REPLAY,
+    // it never deletes rows, so if this were plaintext it would sit here
+    // forever regardless of what a later tenant-destroy hook does.
+    const esEvents = await loadAggregate(
+      db,
+      subscriptionAggregateId(admin.tenantId),
+      admin.tenantId,
+    );
+    const createdPayload = esEvents[0]?.payload as
+      | { providerCustomerId?: string; providerSubscriptionId?: string }
+      | undefined;
+    expect(createdPayload?.providerCustomerId).not.toBe("cus_3011");
+    expect(createdPayload?.providerSubscriptionId).not.toBe("sub_3011");
+    expect(isPiiCiphertext(createdPayload?.providerCustomerId)).toBe(true);
+    expect(isPiiCiphertext(createdPayload?.providerSubscriptionId)).toBe(true);
+
+    // Raw projection row — same story, decrypt-on-read (list-query,
+    // get-subscription-for-tenant) is the only path that sees plaintext.
+    const rawRows = await selectMany(db, subscriptionsProjectionTable, {
+      id: subscriptionAggregateId(admin.tenantId),
+    });
+    expect(isPiiCiphertext(rawRows[0]?.["providerCustomerId"])).toBe(true);
+
+    // But the decrypt-on-read query path still returns plaintext to callers.
+    const subs = (await stack.http.queryOk(
+      "billing-foundation:query:subscription:list",
+      {},
+      admin,
+    )) as { rows: Array<Record<string, unknown>> };
+    expect(subs.rows[0]?.["providerCustomerId"]).toBe("cus_3011");
+  });
+
+  test("crypto-shredding: erasing the tenant's subject key makes the event-log payload permanently unreadable (#800)", async () => {
+    const admin = adminFor(3012);
+    await stack.http.writeOk(
+      SubscriptionFoundationHandlers.processEvent,
+      buildEvent({
+        providerEventId: "evt_3012_create",
+        providerCustomerId: "cus_3012",
+        providerSubscriptionId: "sub_3012",
+      }),
+      admin,
+    );
+    const esEventsBefore = await loadAggregate(
+      db,
+      subscriptionAggregateId(admin.tenantId),
+      admin.tenantId,
+    );
+    const ciphertextBefore = (esEventsBefore[0]?.payload as { providerCustomerId?: string })
+      .providerCustomerId as string;
+
+    // This is exactly what tenant-lifecycle's "subject-keys" pipeline stage
+    // (eraseSubjectKeys, stages.ts) does on tenant-destroy — same kms
+    // instance, same subject shape, called directly instead of through the
+    // full destroy pipeline so this test doesn't need to drive 8 stages.
+    const kms = configuredPiiSubjectKms();
+    if (!kms) throw new Error("expected a configured PII-subject KMS in this test stack");
+    await kms.eraseKey(
+      { kind: "tenant", tenantId: admin.tenantId },
+      { requestId: "test:crypto-shred", eraseReason: "test" },
+    );
+
+    // The DEK is gone — the SAME ciphertext that decrypted cleanly a moment
+    // ago now resolves to the erased sentinel, not the original value and
+    // not a crash. That's the actual #800 guarantee: not "redacted in the
+    // read model" but "cryptographically impossible to recover", including
+    // from the raw event-log row nothing in this feature ever deletes.
+    const decrypted = await decryptPiiFieldValues(
+      { providerCustomerId: ciphertextBefore },
+      ["providerCustomerId"],
+      kms,
+      { requestId: "test:crypto-shred-verify" },
+    );
+    expect(decrypted["providerCustomerId"]).toBe(PII_ERASED_SENTINEL);
+    expect(decrypted["providerCustomerId"]).not.toBe("cus_3012");
+  });
+
+  // No backfill job here on purpose: billing-foundation has never shipped
+  // with a live subject KMS, so there is no pre-existing plaintext
+  // subscription data anywhere to migrate — every row that will ever exist
+  // is written through the encrypted path above. If that changes (billing-
+  // foundation goes live before a KMS is configured somewhere), note for
+  // whoever builds the backfill: the existing backfillEventPiiEncryption
+  // (#799, db/queries/backfill-pii.ts) does NOT cover this feature yet —
+  // its lifecycle-event matcher expects `<aggregateType>.<verb>` event
+  // names (billing's are `billing-foundation:event:subscription-created`)
+  // and its custom-event catalog only supports user-subject fields
+  // (`{kind: "user"}`), not the tenant-subject fields billing uses. Closing
+  // that gap is new framework capability, not a wiring fix.
+});

package/src/billing-foundation/entities.ts

@@ -1,10 +1,9 @@
+import { collectPiiSubjectFields } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   createEntity,
   createTextField,
   createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
-
-// =============================================================================
 // `subscription` — current state pro Plattform-Tenant (= Read-Model)
 // =============================================================================
 //
@@ -41,10 +40,35 @@ export const subscriptionEntity = createEntity({
   table: "read_subscriptions",
   fields: {
     providerName: createTextField({ required: true, maxLength: 50 }),
-    providerCustomerId: createTextField({ required: true, maxLength: 200 }),
-    providerSubscriptionId: createTextField({ required: true, maxLength: 200 }),
+    // tenantOwned (not `encrypted`): the field must crypto-shred when
+    // eraseSubjectKeys erases the tenant's subject key on tenant-destroy
+    // (#800). `encrypted: true` uses the app-wide master key instead — that
+    // key is never erased per-tenant, so it would only add encryption-at-
+    // rest, not the erasure guarantee #800 actually asks for.
+    // maxLength 1000, not 200: the stored value is PII-ciphertext
+    // (`kumiko-pii:v1:<subject>:<blob>`), not the raw provider id — a
+    // 200-char plaintext id becomes ~300+ chars of ciphertext. Matches
+    // subscriptionEventPayloadSchema in events.ts.
+    providerCustomerId: createTextField({
+      required: true,
+      maxLength: 1000,
+      tenantOwned: true,
+    }),
+    providerSubscriptionId: createTextField({
+      required: true,
+      maxLength: 1000,
+      tenantOwned: true,
+    }),
     status: createTextField({ required: true, maxLength: 30 }),
     tier: createTextField({ required: true, maxLength: 50 }),
     currentPeriodEnd: createTimestampField({ required: true }),
   },
 });
+
+// No executor manages this table (raw r.projection, see feature.ts) — the
+// process-event write-handler and every read site must encrypt/decrypt
+// these fields manually via the PII-subject-KMS path (same mechanism
+// eraseSubjectKeys erases). Single source of truth so a future third
+// `tenantOwned`/`pii`/`userOwned` field doesn't need a matching manual
+// update at each call site.
+export const SUBSCRIPTION_PII_FIELDS = collectPiiSubjectFields(subscriptionEntity);

package/src/billing-foundation/events.ts

@@ -51,8 +51,12 @@ const statusEnum = z.enum([
 // payload — payload ist domain-clean, metadata ist provider-truth).
 export const subscriptionEventPayloadSchema = z.object({
   providerName: z.string().min(1).max(50),
-  providerCustomerId: z.string().min(1).max(200),
-  providerSubscriptionId: z.string().min(1).max(200),
+  // 1000, not 200: these two are `encrypted: true` on the entity (see
+  // entities.ts) — process-event.write.ts stores the envelope-cipher
+  // ciphertext here, not the raw provider id. A 200-char plaintext id
+  // becomes ~460+ chars of JSON envelope; 1000 leaves headroom.
+  providerCustomerId: z.string().min(1).max(1000),
+  providerSubscriptionId: z.string().min(1).max(1000),
   status: statusEnum,
   tier: z.string().min(1).max(50),
   currentPeriodEndIso: z.string().min(1),

package/src/billing-foundation/feature.ts

@@ -41,8 +41,9 @@
 // (z.B. für analytics: "wie viele Wechsel im Monat?"), kommt ein
 // `subscription-provider-changed`-event-type später.
 
-import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, EXT_TENANT_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { BILLING_FOUNDATION_FEATURE, SUBSCRIPTION_PROVIDER_EXTENSION } from "./constants";
+import { subscriptionEntity } from "./entities";
 import {
   INVOICE_PAID_EVENT_QN,
   INVOICE_PAID_EVENT_SHORT,
@@ -69,6 +70,7 @@ import {
   applySubscriptionUpdated,
   subscriptionsProjectionTable,
 } from "./projection";
+import { subscriptionTenantDestroyHook } from "./tenant-destroy-hook";
 
 export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE, (r) => {
   r.describe(
@@ -79,6 +81,7 @@ export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE
     category: "billing",
     recommended: false,
   });
+  r.requires("tenant-lifecycle", "compliance-profiles");
   // 5 fine-grained domain-events. Alle 5 nutzen denselben payload-
   // shape (= subscription-state-snapshot); der event-type taggt was
   // passiert ist. Future-consumer (billing-history, accounting)
@@ -96,6 +99,7 @@ export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE
     name: "subscription",
     source: SUBSCRIPTION_AGGREGATE_TYPE,
     table: subscriptionsProjectionTable,
+    entity: subscriptionEntity,
     apply: {
       [SUBSCRIPTION_CREATED_EVENT_QN]: applySubscriptionCreated,
       [SUBSCRIPTION_UPDATED_EVENT_QN]: applySubscriptionUpdated,
@@ -124,4 +128,8 @@ export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE
   // Custom list-query auf der subscription-projection (raw drizzle-
   // table; kein r.entity weil Schreiben via projection-apply läuft).
   r.queryHandler(listSubscriptionsQuery);
+
+  r.useExtension(EXT_TENANT_DATA, "subscription", {
+    destroy: subscriptionTenantDestroyHook,
+  });
 });

package/src/billing-foundation/get-subscription-for-tenant.ts

@@ -1,8 +1,13 @@
 // Resolver-helper: liest die current subscription-row für einen Tenant
 // aus der read_subscriptions-projection.
 
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { subscriptionAggregateId } from "./aggregate-id";
+import { SUBSCRIPTION_PII_FIELDS } from "./entities";
 import { subscriptionsProjectionTable } from "./projection";
 
 export type SubscriptionView = {
@@ -24,12 +29,18 @@ export async function getSubscriptionForTenant(
   const rows = await ctx.db.selectMany(subscriptionsProjectionTable, { id: aggId }, { limit: 1 });
   const row = rows[0];
   if (!row) return null;
+  const piiKms = configuredPiiSubjectKms();
+  const decrypted = piiKms
+    ? await decryptPiiFieldValues(row as Record<string, unknown>, SUBSCRIPTION_PII_FIELDS, piiKms, {
+        requestId: `billing-foundation:get-subscription:${tenantId}`,
+      })
+    : (row as Record<string, unknown>);
   // @cast-boundary db-row — drizzle-row carries column-as-unknown
   return {
-    tier: row["tier"] as string,
-    status: row["status"] as string,
-    providerName: row["providerName"] as string,
-    providerCustomerId: row["providerCustomerId"] as string,
-    providerSubscriptionId: row["providerSubscriptionId"] as string,
+    tier: decrypted["tier"] as string,
+    status: decrypted["status"] as string,
+    providerName: decrypted["providerName"] as string,
+    providerCustomerId: decrypted["providerCustomerId"] as string,
+    providerSubscriptionId: decrypted["providerSubscriptionId"] as string,
   };
 }