@cosmicdrift/kumiko-bundled-features 0.155.1 → 0.156.1

package/src/auth-mfa/web/qrcode-browser.d.ts

@@ -2,6 +2,11 @@
 // subpath (see mfa-enable-screen.tsx's import — the main entry pulls in
 // Node-only deps like yargs/pngjs via qrcode's own package.json#browser
 // remap, which Metro doesn't honor). Same runtime shape, just re-typed.
+// `export *` never re-exports a default — `import QRCode from "..."`
+// resolving here relies on the consuming app's esModuleInterop/
+// allowSyntheticDefaultImports (which synthesizes a default from the
+// namespace). Copy this file into apps that need it, but note that
+// requirement — without it, the default import comes back undefined.
 declare module "qrcode/lib/browser" {
   export * from "qrcode";
 }

package/src/config/__tests__/pii-encrypted.integration.test.ts

@@ -0,0 +1,158 @@
+// piiEncrypted config keys (kumiko-platform#231/#459): the value is
+// subject-KMS-encrypted at rest (tenant-row → tenant subject, user-row →
+// user subject), decrypted on read for authorized readers — unlike
+// `encrypted`/`backing="secrets"`, which the `values` query always masks
+// regardless of role (see config/handlers/values.query.ts).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import {
+  access,
+  createTenantConfig,
+  createUserConfig,
+  defineFeature,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { ConfigHandlers, ConfigQueries } from "../constants";
+import { createConfigAccessorFactory, createConfigFeature } from "../feature";
+import { createConfigResolver } from "../resolver";
+import { configValuesTable } from "../table";
+
+const BILLING_ADDRESS_KEY = "pii-cfg-test:config:billing-address";
+const PHONE_NUMBER_KEY = "pii-cfg-test:config:phone-number";
+
+const piiFeature = defineFeature("pii-cfg-test", (r) => {
+  r.requires("config");
+
+  r.config({
+    keys: {
+      billingAddress: createTenantConfig("text", {
+        piiEncrypted: true,
+        read: access.all,
+        write: access.all,
+      }),
+      phoneNumber: createUserConfig("text", {
+        piiEncrypted: true,
+        read: access.all,
+        write: access.all,
+      }),
+    },
+  });
+});
+
+const configFeature = createConfigFeature();
+
+let stack: TestStack;
+const kms = new InMemoryKmsAdapter();
+const tenantAdmin = createTestUser({ id: 2 });
+
+beforeAll(async () => {
+  const resolver = createConfigResolver();
+  stack = await setupTestStack({
+    features: [configFeature, piiFeature],
+    extraContext: ({ registry }) => ({
+      configResolver: resolver,
+      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+    }),
+  });
+  await unsafePushTables(stack.db, { configValuesTable });
+  // One shared KMS instance for the whole file, not beforeEach/afterEach:
+  // config rows persist in the same DB across tests in this file, so a
+  // fresh adapter per test would orphan the previous test's ciphertext
+  // (KeyNotFoundError) the moment the values query resolves more than the
+  // one key that test just wrote.
+  configurePiiSubjectKms(kms);
+});
+
+afterAll(async () => {
+  resetPiiSubjectKmsForTests();
+  await stack.cleanup();
+});
+
+describe("piiEncrypted config keys", () => {
+  test("tenant-scope value is stored as tenant-subject ciphertext, read back as plaintext", async () => {
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: BILLING_ADDRESS_KEY, value: "Musterstrasse 1, 12345 Berlin" },
+      tenantAdmin,
+    );
+
+    const row = await fetchOne<{ value: string }>(stack.db, configValuesTable, {
+      key: BILLING_ADDRESS_KEY,
+      tenantId: tenantAdmin.tenantId,
+    });
+    expect(row).toBeDefined();
+    expect(isPiiCiphertext(row?.value)).toBe(true);
+    expect(row?.value).toStartWith(`kumiko-pii:v1:tenant:${tenantAdmin.tenantId}:`);
+
+    const values = await stack.http.queryOk<
+      Record<string, { value: unknown; scope: string; source: string }>
+    >(ConfigQueries.values, {}, tenantAdmin);
+    expect(values[BILLING_ADDRESS_KEY]?.value).toBe("Musterstrasse 1, 12345 Berlin");
+  });
+
+  test("user-scope value is stored as user-subject ciphertext, distinct from tenant subject", async () => {
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: PHONE_NUMBER_KEY, value: "+49 151 00000000" },
+      tenantAdmin,
+    );
+
+    const row = await fetchOne<{ value: string }>(stack.db, configValuesTable, {
+      key: PHONE_NUMBER_KEY,
+      tenantId: tenantAdmin.tenantId,
+      userId: String(tenantAdmin.id),
+    });
+    expect(row).toBeDefined();
+    expect(isPiiCiphertext(row?.value)).toBe(true);
+    expect(row?.value).toStartWith(`kumiko-pii:v1:user:${tenantAdmin.id}:`);
+
+    const values = await stack.http.queryOk<
+      Record<string, { value: unknown; scope: string; source: string }>
+    >(ConfigQueries.values, {}, tenantAdmin);
+    expect(values[PHONE_NUMBER_KEY]?.value).toBe("+49 151 00000000");
+  });
+
+  test("write with scope override to system is rejected — no subject for system-row", async () => {
+    // SystemAdmin so checkScopeWriteAccess passes and the request actually
+    // reaches the piiEncrypted+scope="system" rejection, not an earlier
+    // generic "you can't write system scope" denial.
+    const err = await stack.http.writeErr(
+      ConfigHandlers.set,
+      { key: BILLING_ADDRESS_KEY, value: "irrelevant", scope: "system" },
+      TestUsers.systemAdmin,
+    );
+    expect(err.code).toBe("unprocessable");
+    expect((err.details as { reason?: string } | undefined)?.reason).toBe("invalid_scope");
+  });
+
+  test("write without a configured KMS fails loud instead of silently storing plaintext", async () => {
+    resetPiiSubjectKmsForTests();
+    expect(configuredPiiSubjectKms()).toBeUndefined();
+
+    try {
+      const res = await stack.http.write(
+        ConfigHandlers.set,
+        { key: BILLING_ADDRESS_KEY, value: "no-kms-value" },
+        tenantAdmin,
+      );
+      expect(res.status).toBe(500);
+    } finally {
+      // Restore for any test running after this one in the file.
+      configurePiiSubjectKms(kms);
+    }
+  });
+});

package/src/config/__tests__/reencrypt-job-kek-rotation.integration.test.ts

@@ -0,0 +1,171 @@
+// Regression guard for kumiko-framework#1187: proves the config
+// KEK-rotation job handles a real version-N → version-N+1 rotation, not
+// just legacy-format → envelope (see encrypted-legacy-migration.integration
+// .test.ts for that story). Modeled directly on auth-mfa's
+// reencrypt-job.integration.test.ts, which is the reference regression
+// guard for this exact bug class (kumiko-framework#266 Step 8): rotation
+// must go through executor.update() (a real event), not a raw UPDATE on
+// the projection table — otherwise a full projection rebuild replays the
+// OLD event and resurrects the pre-rotation kekVersion.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  access,
+  createSystemConfig,
+  createSystemUser,
+  defineFeature,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
+import {
+  createEnvelopeCipher,
+  createEnvMasterKeyProvider,
+} from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createMutableMasterKeyProvider } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../feature";
+import { reencryptJob } from "../handlers/reencrypt.job";
+import { createConfigResolver } from "../resolver";
+import { configValueEntity, configValuesTable } from "../table";
+
+const KEY = "kek-rot:config:secret-pass";
+const PLAINTEXT = "rotate-me-please";
+const PROJECTION_NAME = "config:projection:config-value-entity";
+
+const v1Key = randomBytes(32).toString("base64");
+const v2Key = randomBytes(32).toString("base64");
+const mutableProvider = createMutableMasterKeyProvider(
+  createEnvMasterKeyProvider({
+    env: {
+      KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+      KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
+    },
+  }),
+);
+const cipher = createEnvelopeCipher(mutableProvider, {});
+const resolver = createConfigResolver({ cipher });
+
+const keyDef = createSystemConfig("text", {
+  encrypted: true,
+  read: access.systemAdmin,
+  write: access.systemAdmin,
+});
+
+const rotFeature = defineFeature("kek-rot", (r) => {
+  r.requires("config");
+  r.config({ keys: { "secret-pass": keyDef } });
+});
+
+const executor = createEventStoreExecutor(configValuesTable, configValueEntity, {
+  entityName: "config-value",
+});
+
+let stack: TestStack;
+
+async function seedV1Row(): Promise<void> {
+  const envelope = await cipher.encrypt(JSON.stringify(PLAINTEXT), { tenantId: SYSTEM_TENANT_ID });
+  const systemUser = createSystemUser(SYSTEM_TENANT_ID);
+  const tdb = createTenantDb(stack.db, SYSTEM_TENANT_ID, "system");
+  const result = await executor.create(
+    { key: KEY, value: envelope, tenantId: SYSTEM_TENANT_ID, userId: null },
+    systemUser,
+    tdb,
+  );
+  if (!result.isSuccess) throw new Error(`seed failed: ${result.error.code}`);
+}
+
+type RawConfigRow = { value: string };
+
+async function readRawValue(): Promise<RawConfigRow> {
+  const rows = await selectMany<RawConfigRow>(stack.db, configValuesTable, { key: KEY });
+  const row = rows[0];
+  if (!row) throw new Error("no config row");
+  return row;
+}
+
+const noopLog = {
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  debug: () => {},
+  child: () => noopLog,
+};
+
+function jobCtx(): Parameters<typeof reencryptJob>[1] {
+  return {
+    db: stack.db,
+    registry: stack.registry,
+    masterKeyProvider: mutableProvider,
+    configEncryption: cipher,
+    log: noopLog,
+  } as unknown as Parameters<typeof reencryptJob>[1]; // @cast-boundary test-seam — job only reads db/registry/masterKeyProvider/configEncryption/log
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createConfigFeature(), rotFeature],
+    masterKeyProvider: mutableProvider,
+    extraContext: { configResolver: resolver, configEncryption: cipher },
+  });
+  await unsafePushTables(stack.db, { configValuesTable });
+  await seedV1Row();
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("config KEK-rotation job — version-N to version-N+1 (kumiko-framework#1187)", () => {
+  test("rotation rewraps the value onto the current KEK, and a full projection rebuild still lands on it", async () => {
+    const beforeRow = await readRawValue();
+    expect(JSON.parse(beforeRow.value).kekVersion).toBe(1);
+
+    // "ops added a new master key version and flipped CURRENT=2" —
+    // same simulate-rotation-without-restart shape auth-mfa's test uses.
+    mutableProvider.replace(
+      createEnvMasterKeyProvider({
+        env: {
+          KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+          KUMIKO_SECRETS_MASTER_KEY_V2: v2Key,
+          KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "2",
+        },
+      }),
+    );
+
+    await reencryptJob({}, jobCtx());
+
+    const afterJobRow = await readRawValue();
+    expect(JSON.parse(afterJobRow.value).kekVersion).toBe(2);
+
+    // Vacuous-rebuild guard: confirm the projection name actually exists
+    // before trusting a silent no-op rebuild as a pass.
+    expect(stack.registry.getAllProjections().has(PROJECTION_NAME)).toBe(true);
+
+    const rebuildResult = await rebuildProjection(PROJECTION_NAME, {
+      db: stack.db,
+      registry: stack.registry,
+    });
+    expect(rebuildResult.eventsProcessed).toBeGreaterThan(0);
+
+    // The regression guard itself: a from-scratch rebuild replays every
+    // event for this row and must land on the V2 envelope from the
+    // rotation job's own .updated event — NOT a resurrected V1 wrap from
+    // the original seed event. Kept alive with the V1 key still present
+    // in the env on purpose: a resurrected V1 row would still decrypt
+    // cleanly, so only this version-tag check (not the decrypt below)
+    // catches the regression this issue describes.
+    const afterRebuildRow = await readRawValue();
+    expect(JSON.parse(afterRebuildRow.value).kekVersion).toBe(2);
+
+    // Decrypt-level proof, not just the version tag: the plaintext
+    // survived rotation + rebuild byte-identically.
+    expect(await resolver.get(KEY, keyDef, SYSTEM_TENANT_ID, "u1", stack.db)).toBe(PLAINTEXT);
+  });
+});

package/src/config/__tests__/write-helpers.test.ts

@@ -10,6 +10,7 @@ import type { KumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import {
   checkScopeWriteAccess,
   hasConfigAccess,
+  resolvePiiSubject,
   resolveScopeIds,
   validatePattern,
   validateScope,
@@ -101,6 +102,28 @@ describe("resolveScopeIds", () => {
   });
 });
 
+describe("resolvePiiSubject (kumiko-platform#231/#459)", () => {
+  const tenant = "tenant-9" as TenantId;
+
+  test("tenant scope resolves to the tenant subject", () => {
+    expect(resolvePiiSubject(ConfigScopes.tenant, tenant, null)).toEqual({
+      kind: "tenant",
+      tenantId: tenant,
+    });
+  });
+
+  test("user scope resolves to the user subject — the row's target user, not necessarily the writer", () => {
+    expect(resolvePiiSubject(ConfigScopes.user, tenant, "user-1")).toEqual({
+      kind: "user",
+      userId: "user-1",
+    });
+  });
+
+  test("user scope without a userId throws instead of silently falling back to tenant", () => {
+    expect(() => resolvePiiSubject(ConfigScopes.user, tenant, null)).toThrow(/userId is null/);
+  });
+});
+
 describe("validateType", () => {
   const numberKey = createTenantConfig("number", {});
   const boolKey = createTenantConfig("boolean", {});

package/src/config/handlers/set.write.ts

@@ -1,16 +1,27 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
+import {
+  configuredPiiSubjectKms,
+  encryptPiiValueForSubject,
+  type KmsContext,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
   ConfigScopes,
   defineWriteHandler,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  InternalError,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { requireConfigEncryption } from "../feature";
 import { configValueEntity, configValuesTable } from "../table";
 import {
   findConfigRow,
   prepareConfigWrite,
+  resolvePiiSubject,
   validateBounds,
   validatePattern,
   validateScope,
@@ -47,6 +58,19 @@ export const setWrite = defineWriteHandler({
     const scopeError = validateScope(scope, keyDef.scope, event.payload.key);
     if (scopeError) return writeFailure(scopeError);
 
+    // A piiEncrypted key can never be defined with scope="system" (boot-
+    // rejected), but an admin override write can still target scope=
+    // "system" for a tenant/user-scoped key (validateScope allows any
+    // requestedScope <= definedScope) — system-row has no subject.
+    if (keyDef.piiEncrypted && scope === ConfigScopes.system) {
+      return writeFailure(
+        new UnprocessableError("invalid_scope", {
+          i18nKey: "config.errors.invalidScope",
+          details: { key: event.payload.key, definedScope: keyDef.scope, requestedScope: scope },
+        }),
+      );
+    }
+
     const typeError = validateType(event.payload.value, keyDef);
     if (typeError) return writeFailure(typeError);
 
@@ -90,6 +114,28 @@ export const setWrite = defineWriteHandler({
     if (keyDef.encrypted) {
       const cipher = requireConfigEncryption(ctx, "config:write:set");
       serialized = await cipher.encrypt(serialized, { tenantId });
+    } else if (keyDef.piiEncrypted) {
+      const kms = configuredPiiSubjectKms();
+      if (!kms) {
+        throw new InternalError({
+          message:
+            `[config:write:set] key "${event.payload.key}" declares piiEncrypted=true but no ` +
+            `PII subject-KMS is configured — pass one via runProdApp({ kms }) / ` +
+            `configurePiiSubjectKms(adapter) at boot.`,
+        });
+      }
+      // scope="system" was already rejected above — narrow accordingly.
+      const subject = resolvePiiSubject(
+        scope as Exclude<typeof scope, "system">, // @cast-boundary runtime-checked above
+        tenantId,
+        userId,
+      );
+      const kmsCtx: KmsContext = {
+        requestId: requestContext.get()?.requestId ?? "config:write:set",
+        tenantId,
+        userId: String(event.user.id),
+      };
+      serialized = await encryptPiiValueForSubject(kms, subject, serialized, kmsCtx);
     }
 
     const existing = await findConfigRow(db, event.payload.key, tenantId, userId);

package/src/config/resolver.ts

@@ -1,4 +1,10 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  decryptPiiValueForSubject,
+  type KmsContext,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type {
   ConfigCascade,
@@ -96,6 +102,24 @@ async function decryptEncrypted(
   return cipher.decrypt(raw);
 }
 
+// Decrypt gate for piiEncrypted keys, mirroring decryptEncrypted above.
+// The subject lives inside the ciphertext (kumiko-pii:v1:<subject>:...),
+// so unlike the write side, no scope/subject resolution is needed here —
+// same call works for a user-row or a tenant-row value.
+async function decryptPiiEncrypted(raw: string, qualifiedKey: string): Promise<string> {
+  const kms = configuredPiiSubjectKms();
+  if (!kms) {
+    throw new InternalError({
+      message:
+        `[config] key "${qualifiedKey}" is piiEncrypted but no PII subject-KMS is wired — the ` +
+        `boot must configure one via runProdApp({ kms }) / configurePiiSubjectKms(adapter).`,
+      i18nKey: "config.errors.cipher_missing",
+    });
+  }
+  const kmsCtx: KmsContext = { requestId: requestContext.get()?.requestId ?? "config:resolver" };
+  return decryptPiiValueForSubject(kms, raw, kmsCtx);
+}
+
 // backing="secrets" keys store their value in the secrets store (flat per
 // (tenant,key) at SYSTEM_TENANT_ID), not in config_values. Both read paths
 // (getWithSource + buildCascade) route the system rung here. Missing reader =
@@ -210,6 +234,8 @@ async function buildCascade(
       let raw = row.value;
       if (keyDef.encrypted) {
         raw = await decryptEncrypted(cipher, raw, qualifiedKey);
+      } else if (keyDef.piiEncrypted) {
+        raw = await decryptPiiEncrypted(raw, qualifiedKey);
       }
       if (activeIndex === -1) activeIndex = levels.length;
       levels.push({
@@ -387,6 +413,8 @@ export function createConfigResolver(options: ConfigResolverOptions = {}): Confi
           let raw = row.value;
           if (keyDef.encrypted) {
             raw = await decryptEncrypted(cipher, raw, qualifiedKey);
+          } else if (keyDef.piiEncrypted) {
+            raw = await decryptPiiEncrypted(raw, qualifiedKey);
           }
           return { value: deserializeValue(raw, keyDef.type), source: lookup.source };
         }

package/src/config/write-helpers.ts

@@ -3,6 +3,7 @@
 // have to cross-import from another handler file.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   type ConfigKeyDefinition,
@@ -198,6 +199,27 @@ export function resolveScopeIds(
   }
 }
 
+// The subject a piiEncrypted config value is encrypted under, for the scope
+// actually written to (kumiko-platform#231/#459). Pure — no I/O — so a bug
+// here (e.g. picking the writer's identity instead of the row's target,
+// see entity fields' explicit userOwned.ownerField for why that
+// distinction matters) is caught by a fast unit test, not only the DB-
+// backed integration test. Caller has already rejected scope="system"
+// (no subject exists for it).
+export function resolvePiiSubject(
+  scope: Exclude<ConfigScope, "system">,
+  tenantId: TenantId,
+  userId: string | null,
+): SubjectId {
+  if (scope === ConfigScopes.user) {
+    if (userId === null) {
+      throw new Error('resolvePiiSubject: scope="user" but userId is null');
+    }
+    return { kind: "user", userId };
+  }
+  return { kind: "tenant", tenantId };
+}
+
 export function validateType(
   value: string | number | boolean,
   keyDef: ConfigKeyDefinition,

package/src/custom-fields/__tests__/audit-integration.integration.test.ts

@@ -127,7 +127,7 @@ describe("T1.5a: custom-fields events are visible in the audit log", () => {
 
     const res = await listAudit({ aggregateType: "field-definition" });
 
-    // The fieldDefinition is created via r.entity + r.crud, so the event-type
+    // The fieldDefinition is created via registerEntityCrud, so the event-type
     // follows the entity-CRUD convention `<entity>.created` (with a dot),
     // not the feature-emit-via-defineEvent convention used by set/cleared
     // (`custom-fields:event:<short>`).

package/src/delivery/feature.ts

@@ -36,7 +36,7 @@ export function createDeliveryFeature(): FeatureDefinition {
     r.entity("notification-preference", notificationPreferenceEntity, {
       table: notificationPreferencesTable,
     });
-    r.unmanagedTable(deliveryAttemptsTableMeta, {
+    r.rawTable(deliveryAttemptsTableMeta, {
       reason: "read_side.delivery_attempt_log",
     });
 

package/src/file-foundation/__tests__/feature.test.ts

@@ -20,7 +20,7 @@ describe("fileFoundationFeature — shape", () => {
 });
 
 describe("fileFoundationFeature.exports — typed handles", () => {
-  test("exposes only the provider-selector config-key", () => {
+  test("exposes the provider-selector handle", () => {
     expect(fileFoundationFeature.exports.providerConfigKey).toBeDefined();
     expect(fileFoundationFeature.exports.providerConfigKey.name).toBe(
       "file-foundation:config:provider",

package/src/files-provider-s3/__tests__/s3-provider.integration.test.ts

@@ -33,7 +33,9 @@ beforeAll(async () => {
   // Fail loud with an actionable message when Minio is down (otherwise
   // S3 networking errors look like provider bugs).
   try {
-    const health = await fetch(`${endpoint.replace(/\/$/, "")}/minio/health/live`);
+    const health = await fetch(`${endpoint.replace(/\/$/, "")}/minio/health/live`, {
+      signal: AbortSignal.timeout(2000),
+    });
     if (!health.ok) {
       throw new Error(`HTTP ${health.status}`);
     }

package/src/inbound-mail-foundation/__tests__/feature.test.ts

@@ -44,7 +44,7 @@ describe("inboundMailFoundationFeature — shape", () => {
   test("SyncCursor + SeenMessage sind unmanaged (NICHT event-sourced, Plan §3.4)", () => {
     // Drift-Pin: als r.entity würden die Tick-State-Tabellen (a) das
     // Event-Log fluten und (b) beim Projection-Rebuild gewischt.
-    const unmanaged = Object.keys(inboundMailFoundationFeature.unmanagedTables);
+    const unmanaged = Object.keys(inboundMailFoundationFeature.rawTables);
     expect(unmanaged.length).toBe(2);
   });
 });

package/src/inbound-mail-foundation/feature.ts

@@ -156,12 +156,12 @@ export const inboundMailFoundationFeature = defineFeature(INBOUND_MAIL_FOUNDATIO
   });
 
   // Sync-Maschinerie: hochfrequenter Tick-State, bewusst NICHT
-  // event-sourced — r.unmanagedTable hält die Migration-DDL, nimmt die
+  // event-sourced — r.rawTable hält die Migration-DDL, nimmt die
   // Tabellen aber aus dem Projection-Rebuild (#494/#498-Klasse).
-  r.unmanagedTable(syncCursorTable, {
+  r.rawTable(syncCursorTable, {
     reason: "read_side.mail_sync_cursors_direct_write",
   });
-  r.unmanagedTable(seenMessageTable, {
+  r.rawTable(seenMessageTable, {
     reason: "read_side.mail_seen_messages_direct_write",
   });
 

package/src/inbound-provider-imap/__tests__/imap-foundation.integration.test.ts

@@ -82,11 +82,11 @@ function probe(host: string, port: number): Promise<boolean> {
   });
 }
 
-const available = await probe(HOST, IMAP_PORT);
+const available = (await probe(HOST, IMAP_PORT)) && (await probe(HOST, SMTP_PORT));
 const liveTest = available ? test : test.skip;
 if (!available) {
   console.warn(
-    `imap-foundation: kein IMAP-Server auf ${HOST}:${IMAP_PORT} — Suite wird geskippt (greenmail starten)`,
+    `imap-foundation: kein IMAP/SMTP-Server auf ${HOST}:${IMAP_PORT}/${SMTP_PORT} — Suite wird geskippt (greenmail starten)`,
   );
 }
 
@@ -96,6 +96,7 @@ let secrets: ReturnType<typeof createSecretsContext>;
 let providerRef: MutableMasterKeyProvider;
 
 beforeAll(async () => {
+  if (!available) return;
   const initialKp = createEnvMasterKeyProvider({
     env: {
       KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),
@@ -131,6 +132,7 @@ beforeAll(async () => {
 });
 
 afterAll(async () => {
+  if (!available) return;
   await stack.cleanup();
   resetPiiSubjectKmsForTests();
 });
@@ -143,13 +145,13 @@ function adminFor(tenantNumber: number) {
   });
 }
 
-function credentialJson(): string {
+function credentialJson(passwordOverride?: string): string {
   return JSON.stringify({
     host: HOST,
     port: IMAP_PORT,
     secure: false,
     user: USER,
-    password: PASSWORD,
+    password: passwordOverride ?? PASSWORD,
   });
 }
 
@@ -256,13 +258,7 @@ describe("imap-foundation — greenmail + supervisor", () => {
       await secrets.set(
         admin.tenantId,
         inboundCredentialSecretKey(connected.accountId),
-        JSON.stringify({
-          host: HOST,
-          port: IMAP_PORT,
-          secure: false,
-          user: USER,
-          password: "definitely-wrong",
-        }),
+        credentialJson("definitely-wrong"),
       );
 
       const supervisor = createSupervisor();