@cosmicdrift/kumiko-bundled-features 0.158.2 → 0.159.1

package/src/user-data-rights/feature.ts

@@ -5,6 +5,7 @@ import {
   type FeatureDefinition,
   SYSTEM_USER_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { validateGdprHookCompleteness, validateGdprPiiHookCoverage } from "./boot-checks";
 import { PRIVACY_CENTER_SCREEN_ID } from "./constants";
 import { cancelDeletionWrite } from "./handlers/cancel-deletion.write";
 import { createConfirmDeletionByTokenHandler } from "./handlers/confirm-deletion-by-token.write";
@@ -87,7 +88,7 @@ export type UserDataRightsOptions = {
   readonly sendExportFailedEmail?: SendExportFailedEmailFn;
   /** Base-URL fuer den Magic-Link, z.B.
    *  "https://app.example.com/user-export/by-token". Worker bauen
-   *  `${appExportDownloadUrl}?token=<plain>`. Required wenn
+   *  a URL fragment (`#token=<plain>`, issue #1271). Required wenn
    *  sendExportReadyEmail gesetzt. Per-Tenant via reverse-proxy host
    *  routing — nicht via per-Tenant-config-key (App-Author-Decision). */
   readonly appExportDownloadUrl?: string;
@@ -155,6 +156,13 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
 
     r.extendsRegistrar(EXT_USER_DATA, {});
 
+    // GDPR-storage guards V2+V3 (#1314) — moved off the framework-internal
+    // boot-validator onto this feature's own r.bootCheck(), since it's the
+    // EXT_USER_DATA channel owner: any r.useExtension(EXT_USER_DATA, ...)
+    // usage already requires user-data-rights to be mounted.
+    r.bootCheck(({ features }) => validateGdprHookCompleteness(features));
+    r.bootCheck(({ features }) => validateGdprPiiHookCoverage(features));
+
     // App-level tenant-occupancy model. Default "multi-user" → tenant-scoped
     // contributors (e.g. credit) NEVER erase tenant data on a per-user forget
     // (would harm co-members). An app with one user per tenant sets this to
@@ -282,10 +290,16 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       access: { openToAll: true },
     });
 
-    // Magic-Link-Pfad (anonymous): GET /user-export/by-token?token=<plain>.
-    // Ruft via app.fetch /api/query → success: 302-Redirect zur signed-URL →
-    // Browser folgt → Download startet beim Object-Store. Bei error:
-    // passthrough (404/410/501) als JSON.
+    // Magic-link path (anonymous): the email link carries the token as a
+    // URL fragment (`#token=<plain>`) instead of a query param — fragments
+    // never leave the browser, so they never hit proxy/access logs
+    // (issue #1271). This route only serves the interstitial page; the
+    // external script reads the fragment client-side and exchanges the
+    // token via POST for the signed URL.
+    //
+    // The old token-in-query format stays supported as a fallback (not a
+    // transitional shim — permanent): emails sent before this deploy still
+    // use the old format and must keep working until their TTL expires.
     //
     // Path liegt AUSSERHALB /api/* weil r.httpRoute den /api-namespace nicht
     // claimen darf (reserved fuer write/query/batch/auth/sse-dispatcher).
@@ -302,7 +316,9 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
         const url = new URL(c.req.url);
         const token = url.searchParams.get("token");
         if (!token) {
-          return c.json({ error: "missing_token" }, 400);
+          return c.body(TOKEN_EXCHANGE_PAGE_HTML, 200, {
+            "content-type": "text/html; charset=utf-8",
+          });
         }
         const queryRes = await app.fetch(
           new Request(`${url.origin}/api/query`, {
@@ -318,6 +334,59 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       },
     });
 
+    // External script for the interstitial page above — same-origin file
+    // instead of inline <script>, so the page also works under a strict
+    // `script-src 'self'` CSP (apps set CSP via the security-headers
+    // option, without assuming `unsafe-inline`).
+    r.httpRoute({
+      method: "GET",
+      path: "/user-export/by-token.js",
+      anonymous: true,
+      handler: async (c) => {
+        return c.body(TOKEN_EXCHANGE_PAGE_JS, 200, {
+          "content-type": "application/javascript; charset=utf-8",
+        });
+      },
+    });
+
+    // Exchange endpoint for the interstitial page: the token arrives here
+    // as a POST body instead of a query string (issue #1271). A dedicated
+    // route rather than letting the browser JS call /api/query directly,
+    // for two reasons:
+    //   1. IP/UA audit — extractAuditMeta needs the raw request headers,
+    //      which only the server has, not the browser (see the GET path
+    //      above). Without this route every fragment-path download would
+    //      land in download-attempt with lastUsedFromIp/UA = null.
+    //   2. /api/query is the reserved dispatcher namespace for
+    //      authenticated writes/queries — an anonymous cross-origin POST
+    //      there isn't guaranteed to be reachable (origin guard).
+    r.httpRoute({
+      method: "POST",
+      path: "/user-export/by-token",
+      anonymous: true,
+      handler: async (c, { app }) => {
+        const url = new URL(c.req.url);
+        const parsedBody = await c.req.json().catch(() => null);
+        const token =
+          parsedBody && typeof parsedBody === "object" && "token" in parsedBody
+            ? (parsedBody as { token?: unknown }).token
+            : undefined;
+        if (typeof token !== "string" || token.length === 0) {
+          return c.json({ error: "missing_token" }, 400);
+        }
+        return app.fetch(
+          new Request(`${url.origin}/api/query`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+              type: "user-data-rights:query:download-by-token",
+              payload: { token, auditMeta: extractAuditMeta(c.req.raw.headers) },
+            }),
+          }),
+        );
+      },
+    });
+
     // S2.U3 Atom 3b — Worker fuer Async Export-Pipeline. Cron-getriggert.
     r.job(
       "run-export-jobs",
@@ -504,3 +573,44 @@ function extractAuditMeta(headers: Headers): { ip: string | null; userAgent: str
   }
   return { ip, userAgent: headers.get("user-agent") };
 }
+
+// Interstitial page for the magic-link fragment exchange (see the
+// httpRoute above). Plain static markup — no build step, no i18n lookup
+// (the server doesn't know a user locale here; anonymous path).
+const TOKEN_EXCHANGE_PAGE_HTML = `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><title>Export Download</title></head>
+<body>
+<p id="status">Preparing your download…</p>
+<script src="/user-export/by-token.js"></script>
+</body>
+</html>`;
+
+// Reads the token client-side from the URL fragment (never sent to the
+// server) and exchanges it via POST for the signed URL. Same-origin
+// external file instead of inline <script>, so the page also works under
+// a strict `script-src 'self'` CSP.
+const TOKEN_EXCHANGE_PAGE_JS = `(async () => {
+  const status = document.getElementById("status");
+  const params = new URLSearchParams(location.hash.slice(1));
+  const token = params.get("token");
+  if (!token) {
+    status.textContent = "Invalid download link.";
+    return;
+  }
+  try {
+    const res = await fetch("/user-export/by-token", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ token }),
+    });
+    const body = await res.json();
+    if (!res.ok || !body || !body.data || !body.data.url) {
+      status.textContent = "This download link is invalid or has expired.";
+      return;
+    }
+    location.href = body.data.url;
+  } catch {
+    status.textContent = "Could not start the download.";
+  }
+})();`;

package/src/user-data-rights/handlers/deletion-grace-period.ts

@@ -75,7 +75,7 @@ export async function startDeletionGracePeriod(
     ok: true,
     gracePeriodEnd,
     userEmail: userRow["email"]
-      ? await decryptStoredPii(userRow["email"], "user-data-rights:grace-period")
+      ? await decryptStoredPii(userRow["email"], "email", "user-data-rights:grace-period")
       : "",
     userLocale: userRow["locale"] ?? null,
   };

package/src/user-data-rights/handlers/download-by-token.query.ts

@@ -1,7 +1,7 @@
 // GET /api/query → user-data-rights:query:download-by-token (S2.U3 Atom 4b).
 //
 // **Magic-Link-Pfad** (anonymous): User klickt Email-Link mit
-// `?token=<plain>`. Worker hat beim done-flip Token-Hash in DB
+// `#token=<plain>` (URL fragment, issue #1271). Worker hat beim done-flip Token-Hash in DB
 // persistiert (Atom 4a). Verify-Pipeline:
 //
 //   1. hashDownloadToken(plain) → fetchOne in download-tokens

package/src/user-data-rights/handlers/lift-restriction.write.ts

@@ -1,5 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { USER_STATUS, userTable } from "../../user";
@@ -7,18 +7,11 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 
 // POST /api/user/lift-restriction (S2.U6) — DSGVO Art. 18 Reverse.
 //
-// **Wichtige Eigenheit:** Der User kann diesen Endpoint NICHT selber
-// aufrufen weil sein Login geblockt ist (Restricted-Status, siehe
-// login.write.ts Atom 3). Wer ein Restricted-Konto wieder aktiviert,
-// muss dafuer einen anderen Pfad nutzen — typisch Operator-Tool oder
-// Email-Magic-Link an die User-Email. App-Author entscheidet das per
-// access-Konfig oder Custom-Wrapper.
-//
-// MVP-Default: openToAll mit Self-Service-Semantik. Die Asymmetrie
-// (User koennte sich selbst freischalten WENN er einen Weg ohne Login
-// hat — z.B. valid Magic-Link aus pre-Restriction) ist akzeptabel:
-// Restriction ist *Verarbeitungs-Pause*, nicht *Sperre durch Operator*.
-// User der "ich will doch wieder mitmachen" sagt, soll das koennen.
+// Operator-only. A Restricted user's own session is unconditionally
+// rejected by sessionChecker (BLOCKED_STATUSES) the moment their status
+// flips — their JWT/login can't reach this or any other authenticated
+// endpoint. There is no self-service path today, so lifting a restriction
+// always targets someone else's account by id.
 //
 // State-Transitions:
 //   Restricted → Active        ✓
@@ -27,17 +20,18 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 //   Deleted → ...              ✗ 422 not_restricted
 export const liftRestrictionWrite = defineWriteHandler({
   name: "lift-restriction",
-  schema: z.object({}),
-  access: { openToAll: true },
+  schema: z.object({ userId: z.string() }),
+  access: { roles: access.admin },
   handler: async (event, ctx) => {
+    const targetUserId = event.payload.userId;
     const userRow = await fetchOne<{ status: string }>(ctx.db.raw, userTable, {
-      id: event.user.id,
+      id: targetUserId,
     });
 
     if (!userRow) {
       return writeFailure(
         new UnprocessableError("user_not_found", {
-          details: { reason: "user_not_found", userId: event.user.id },
+          details: { reason: "user_not_found", userId: targetUserId },
         }),
       );
     }
@@ -51,12 +45,12 @@ export const liftRestrictionWrite = defineWriteHandler({
       );
     }
 
-    await updateUserLifecycle(ctx.db.raw, event.user.id, { status: USER_STATUS.Active });
+    await updateUserLifecycle(ctx.db.raw, targetUserId, { status: USER_STATUS.Active });
 
     return {
       isSuccess: true as const,
       data: {
-        userId: event.user.id,
+        userId: targetUserId,
         status: USER_STATUS.Active,
       },
     };

package/src/user-data-rights/handlers/restrict-account.write.ts

@@ -1,6 +1,10 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { access, createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AccessDeniedError,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { USER_STATUS, userTable } from "../../user";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";
@@ -15,6 +19,12 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 //     muss gemountet sein). App-Author ohne sessions-feature kriegt einen
 //     Boot-Resolver-Error via r.usesApi("sessions.revokeAllForUser").
 //
+// Self-service by default (userId omitted → event.user.id). An admin can
+// also target someone else's account — needed once a user is already
+// Restricted, since their own session is then unconditionally rejected by
+// sessionChecker and they can no longer call this (or any) endpoint
+// themselves; only an operator path reaches it at that point.
+//
 // State-Transitions:
 //   Active → Restricted        ✓ (dieser Handler)
 //   Restricted → Restricted    ✗ 422 already_restricted (Idempotenz-Guard)
@@ -22,19 +32,31 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 //   Deleted → ...              ✗ 422 user_not_in_active_state
 export const restrictAccountWrite = defineWriteHandler({
   name: "restrict-account",
-  schema: z.object({}),
+  schema: z.object({ userId: z.string().optional() }),
   access: { openToAll: true },
   handler: async (event, ctx) => {
+    const targetUserId = event.payload.userId ?? event.user.id;
+    if (targetUserId !== event.user.id) {
+      const isAdmin = event.user.roles.some((role) => access.admin.includes(role));
+      if (!isAdmin) {
+        return writeFailure(
+          new AccessDeniedError({
+            details: { reason: "admin_required_for_other_user" },
+          }),
+        );
+      }
+    }
+
     // ctx.db.raw weil User-Entity tenant-agnostisch ist (analog
     // request-deletion.write.ts Cross-Tenant-Section).
     const userRow = await fetchOne<{ status: string }>(ctx.db.raw, userTable, {
-      id: event.user.id,
+      id: targetUserId,
     });
 
     if (!userRow) {
       return writeFailure(
         new UnprocessableError("user_not_found", {
-          details: { reason: "user_not_found", userId: event.user.id },
+          details: { reason: "user_not_found", userId: targetUserId },
         }),
       );
     }
@@ -55,7 +77,7 @@ export const restrictAccountWrite = defineWriteHandler({
       );
     }
 
-    await updateUserLifecycle(ctx.db.raw, event.user.id, { status: USER_STATUS.Restricted });
+    await updateUserLifecycle(ctx.db.raw, targetUserId, { status: USER_STATUS.Restricted });
 
     // Cross-Feature: alle live sessions revoken — sonst koennte der User
     // mit existierendem JWT bis zur Token-Expiry weiter schreiben.
@@ -63,13 +85,13 @@ export const restrictAccountWrite = defineWriteHandler({
     // System-User-Roles im access-gate hat.
     const systemUser = createSystemUser(event.user.tenantId);
     await ctx.writeAs(systemUser, "sessions:write:user-session:revoke-all-for-user", {
-      userId: event.user.id,
+      userId: targetUserId,
     });
 
     return {
       isSuccess: true as const,
       data: {
-        userId: event.user.id,
+        userId: targetUserId,
         status: USER_STATUS.Restricted,
       },
     };

package/src/user-data-rights/run-export-jobs.ts

@@ -152,7 +152,7 @@ export interface RunExportJobsArgs {
   readonly sendExportFailedEmail?: SendExportFailedEmailFn;
   /** Base-URL fuer den Magic-Link. App-Author setzt das (z.B.
    *  "https://app.example.com/user-export/by-token"). Worker baut
-   *  `${appExportDownloadUrl}?token=<plain>` und reicht das im
+   *  a URL fragment (not a query param — see issue #1271) and passes that
    *  Callback durch. Required wenn sendExportReadyEmail gesetzt. */
   readonly appExportDownloadUrl?: string;
 }
@@ -801,7 +801,7 @@ async function lookupUserContact(
     locale: string | null;
   } | null;
   if (!row?.email) return null;
-  const email = await decryptStoredPii(row.email, "user-data-rights:export-ready");
+  const email = await decryptStoredPii(row.email, "email", "user-data-rights:export-ready");
   if (email === PII_ERASED_SENTINEL) return null;
   return { email, locale: row.locale ?? null };
 }
@@ -844,7 +844,7 @@ async function fireExportReadyCallback(args: {
       "user-data-rights: sendExportReadyEmail gesetzt aber appExportDownloadUrl fehlt — beide muessen zusammen konfiguriert sein",
     );
   }
-  const downloadUrl = `${baseUrl}?token=${encodeURIComponent(args.plainToken)}`;
+  const downloadUrl = `${baseUrl}#token=${encodeURIComponent(args.plainToken)}`;
   await args.send({
     userId: args.job.userId,
     userEmail: contact.email,

package/src/user-data-rights/run-forget-cleanup.ts

@@ -281,7 +281,7 @@ async function processUser(args: {
   });
   const userEmailBeforeDelete =
     userPreTx?.email && userPreTx.email.length > 0
-      ? await decryptStoredPii(userPreTx.email, "user-data-rights:forget-cleanup")
+      ? await decryptStoredPii(userPreTx.email, "email", "user-data-rights:forget-cleanup")
       : null;
   const userLocaleBeforeDelete = userPreTx?.locale ?? null;
 

package/src/user-data-rights-defaults/__tests__/bundled-entities.userdata-hooks.integration.test.ts

@@ -19,6 +19,7 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { authFoundationFeature } from "../../auth-foundation";
 import { createChannelInAppFeature, inAppMessagesTable } from "../../channel-in-app";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { configValueEntity, createConfigFeature } from "../../config";
@@ -72,6 +73,7 @@ beforeAll(async () => {
       createConfigFeature(),
       createTenantFeature(),
       createPersonalAccessTokensFeature({ scopes: PAT_SCOPES }),
+      authFoundationFeature,
       createDeliveryFeature(),
       createChannelInAppFeature(),
       createJobsFeature(),
@@ -93,6 +95,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),

package/src/user-data-rights-defaults/__tests__/feature-mounted.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, test } from "bun:test";
+import type { UserDataHookCtx } from "@cosmicdrift/kumiko-framework/engine";
+import { featureMounted } from "../hooks/feature-mounted";
+
+function ctxWithFeatures(mounted: readonly string[]): UserDataHookCtx {
+  return {
+    registry: {
+      getFeature: (name: string) => (mounted.includes(name) ? { name } : undefined),
+      // @cast-boundary test fixture — featureMounted only reads ctx.registry.getFeature
+    } as unknown as UserDataHookCtx["registry"],
+  } as unknown as UserDataHookCtx;
+}
+
+describe("featureMounted", () => {
+  test("returns true when the feature is registered", () => {
+    const ctx = ctxWithFeatures(["sessions"]);
+    expect(featureMounted(ctx, "sessions")).toBe(true);
+  });
+
+  test("returns false when the feature is not registered", () => {
+    const ctx = ctxWithFeatures(["sessions"]);
+    expect(featureMounted(ctx, "channel-email")).toBe(false);
+  });
+});

package/src/user-data-rights-defaults/__tests__/user-data-rights-defaults.integration.test.ts

@@ -11,6 +11,7 @@
 //     fileRef-Forget beruehrt Tenant B's Files nicht)
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
@@ -43,6 +44,7 @@ const features = [
   createFilesFeature(),
   createDataRetentionFeature(),
   createComplianceProfilesFeature(),
+  authFoundationFeature,
   createSessionsFeature(),
   createUserDataRightsFeature(),
   createUserDataRightsDefaultsFeature(),

package/src/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.ts

@@ -42,7 +42,7 @@ async function resolveUserEmail(ctx: UserDataHookCtx): Promise<string | null> {
   if (!row) return null;
   // Stored value is ciphertext with an active KMS; lowercasing a base64
   // blob would break both lookup arms — decrypt first.
-  const email = await decryptStoredPii(row.email, "user-data-rights:invitation-hook");
+  const email = await decryptStoredPii(row.email, "email", "user-data-rights:invitation-hook");
   return email.toLowerCase();
 }
 

package/src/user-profile/__tests__/change-email.integration.test.ts

@@ -4,6 +4,7 @@
 // dispatcht genau diese Strings).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -60,6 +61,7 @@ beforeAll(async () => {
       createAuthEmailPasswordFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createFilesFeature(),
       createUserDataRightsFeature(),

package/src/user-profile/handlers/change-email.write.ts

@@ -54,7 +54,7 @@ export const changeEmailWrite = defineWriteHandler({
     }
 
     const newEmail = event.payload.newEmail.toLowerCase();
-    const currentEmail = await decryptStoredPii(me.email, "user-profile:change-email");
+    const currentEmail = await decryptStoredPii(me.email, "email", "user-profile:change-email");
     if (newEmail === currentEmail.toLowerCase()) {
       return writeFailure(
         new UnprocessableError(UserProfileErrors.emailUnchanged, {

package/src/config/__tests__/encrypted-legacy-migration.integration.test.ts

@@ -1,179 +0,0 @@
-// Pins the legacy → envelope migration story for encrypted config values:
-//   1. rows written under the old CONFIG_ENCRYPTION_KEY format stay readable
-//      as long as the legacy key is wired as the cipher's fallback,
-//   2. reading an encrypted row WITHOUT any cipher throws (the pre-envelope
-//      code silently returned the ciphertext as the value),
-//   3. the reencrypt job migrates legacy rows onto the envelope format
-//      through the event-store executor (event payload carries the new
-//      envelope, so a projection rebuild no longer needs the legacy key),
-//      and is idempotent on re-run.
-
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { randomBytes } from "node:crypto";
-import { asRawClient, fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  createEncryptionProvider,
-  createEventStoreExecutor,
-  createTenantDb,
-} from "@cosmicdrift/kumiko-framework/db";
-import {
-  type AppContext,
-  access,
-  createRegistry,
-  createSystemUser,
-  createTenantConfig,
-  defineFeature,
-  type TenantId,
-} from "@cosmicdrift/kumiko-framework/engine";
-import {
-  createEnvelopeCipher,
-  type EnvelopeCipher,
-  isStoredEnvelope,
-} from "@cosmicdrift/kumiko-framework/secrets";
-import {
-  setupTestStack,
-  type TestStack,
-  testTenantId,
-  unsafePushTables,
-} from "@cosmicdrift/kumiko-framework/stack";
-import { createTestMasterKeyProvider } from "@cosmicdrift/kumiko-framework/testing";
-import { createConfigFeature } from "../feature";
-import { reencryptJob } from "../handlers/reencrypt.job";
-import { createConfigResolver } from "../resolver";
-import { configValueEntity, configValuesTable } from "../table";
-
-const KEY = "enc-mig:config:secret-pass";
-const TENANT: TenantId = testTenantId(1);
-const PLAINTEXT = "legacy-smtp-password";
-
-const keyDef = createTenantConfig("text", {
-  encrypted: true,
-  read: access.all,
-  write: access.all,
-});
-
-// legacy single-key provider — the pre-envelope CONFIG_ENCRYPTION_KEY world
-const legacy = createEncryptionProvider(randomBytes(32).toString("base64"));
-const masterKeyProvider = createTestMasterKeyProvider();
-const cipherWithLegacy = createEnvelopeCipher(masterKeyProvider, { legacy });
-const cipherWithoutLegacy = createEnvelopeCipher(masterKeyProvider);
-
-const encMigFeature = defineFeature("enc-mig", (r) => {
-  r.config({ keys: { "secret-pass": keyDef } });
-});
-
-const executor = createEventStoreExecutor(configValuesTable, configValueEntity, {
-  entityName: "config-value",
-});
-
-let stack: TestStack;
-
-async function seedLegacyRow(): Promise<string> {
-  const legacyValue = legacy.encrypt(JSON.stringify(PLAINTEXT));
-  const systemUser = createSystemUser(TENANT);
-  const tdb = createTenantDb(stack.db, TENANT, "system");
-  const result = await executor.create(
-    { key: KEY, value: legacyValue, tenantId: TENANT, userId: null },
-    systemUser,
-    tdb,
-  );
-  if (!result.isSuccess) throw new Error(`seed failed: ${result.error.code}`);
-  return (result.data as { id: string }).id;
-}
-
-async function readStoredValue(): Promise<string> {
-  const row = await fetchOne<{ value: string }>(stack.db, configValuesTable, {
-    key: KEY,
-    tenantId: TENANT,
-  });
-  if (!row) throw new Error("row missing");
-  return row.value;
-}
-
-type ReencryptCtx = Pick<AppContext, "db" | "masterKeyProvider" | "configEncryption" | "registry">;
-function jobCtx(cipher: EnvelopeCipher): Parameters<typeof reencryptJob>[1] {
-  const ctx: ReencryptCtx = {
-    db: stack.db,
-    masterKeyProvider,
-    configEncryption: cipher,
-    registry: stack.registry,
-  };
-  return ctx as unknown as Parameters<typeof reencryptJob>[1];
-}
-
-beforeAll(async () => {
-  stack = await setupTestStack({ features: [createConfigFeature(), encMigFeature] });
-  await unsafePushTables(stack.db, { configValuesTable });
-  await seedLegacyRow();
-});
-
-afterAll(async () => {
-  await stack.cleanup();
-});
-
-describe("legacy encrypted config rows", () => {
-  test("stay readable through the cipher's legacy fallback (get + cascade path)", async () => {
-    const resolver = createConfigResolver({ cipher: cipherWithLegacy });
-    const value = await resolver.get(KEY, keyDef, TENANT, "u1", stack.db);
-    expect(value).toBe(PLAINTEXT);
-
-    const cascade = await resolver.getCascade(KEY, keyDef, TENANT, "u1", stack.db);
-    const active = cascade.levels.find((l) => l.hasValue);
-    expect(active?.value).toBe(PLAINTEXT);
-  });
-
-  test("throw without any cipher instead of leaking ciphertext as the value", async () => {
-    const resolver = createConfigResolver({});
-    await expect(resolver.get(KEY, keyDef, TENANT, "u1", stack.db)).rejects.toThrow(
-      /encrypted but no cipher/,
-    );
-    await expect(resolver.getCascade(KEY, keyDef, TENANT, "u1", stack.db)).rejects.toThrow(
-      /encrypted but no cipher/,
-    );
-  });
-
-  test("throw with a remediation hint when the legacy key is missing", async () => {
-    const resolver = createConfigResolver({ cipher: cipherWithoutLegacy });
-    await expect(resolver.get(KEY, keyDef, TENANT, "u1", stack.db)).rejects.toThrow(/legacy/);
-  });
-});
-
-describe("config:reencrypt job", () => {
-  test("migrates the legacy row to envelope format via the executor", async () => {
-    expect((await readStoredValue()).startsWith("{")).toBe(false);
-
-    await reencryptJob({}, jobCtx(cipherWithLegacy));
-
-    const stored = await readStoredValue();
-    expect(stored.startsWith("{")).toBe(true);
-    expect(isStoredEnvelope(JSON.parse(stored))).toBe(true);
-
-    // decryptable WITHOUT the legacy key now — retiring CONFIG_ENCRYPTION_KEY
-    // after a clean run is safe
-    const resolver = createConfigResolver({ cipher: cipherWithoutLegacy });
-    expect(await resolver.get(KEY, keyDef, TENANT, "u1", stack.db)).toBe(PLAINTEXT);
-  });
-
-  test("event payload carries the new envelope — rebuild-safe without legacy key", async () => {
-    // The migration wrote a configValue.updated event whose payload holds
-    // the envelope value; replaying events verbatim reproduces the
-    // migrated state, so the final projection never needs the legacy key.
-    const registryCheck = createRegistry([createConfigFeature(), encMigFeature]);
-    expect(registryCheck.getConfigKey(KEY)?.encrypted).toBe(true);
-
-    const events = await asRawClient(stack.db).unsafe<{
-      payload: { changes?: { value?: string } };
-    }>(
-      `SELECT payload FROM kumiko_events WHERE aggregate_type = 'config-value' AND type LIKE '%.updated' ORDER BY created_at DESC LIMIT 1`,
-    );
-    const lastValue = events[0]?.payload?.changes?.value;
-    expect(typeof lastValue).toBe("string");
-    expect((lastValue as string).startsWith("{")).toBe(true);
-  });
-
-  test("is idempotent — a second run migrates nothing", async () => {
-    const before = await readStoredValue();
-    await reencryptJob({}, jobCtx(cipherWithLegacy));
-    expect(await readStoredValue()).toBe(before);
-  });
-});