@cosmicdrift/kumiko-bundled-features 0.291.0 → 0.292.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.291.0",
+  "version": "0.292.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -133,12 +133,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.291.0",
-    "@cosmicdrift/kumiko-framework": "0.291.0",
-    "@cosmicdrift/kumiko-headless": "0.291.0",
-    "@cosmicdrift/kumiko-renderer": "0.291.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.291.0",
-    "@cosmicdrift/kumiko-types": "0.291.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.292.0",
+    "@cosmicdrift/kumiko-framework": "0.292.0",
+    "@cosmicdrift/kumiko-headless": "0.292.0",
+    "@cosmicdrift/kumiko-renderer": "0.292.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.292.0",
+    "@cosmicdrift/kumiko-types": "0.292.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -167,8 +167,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.291.0",
-    "@cosmicdrift/kumiko-locale-es": "0.291.0",
+    "@cosmicdrift/kumiko-locale-de": "0.292.0",
+    "@cosmicdrift/kumiko-locale-es": "0.292.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/audit/__tests__/audit-screens.boot.test.ts

@@ -1,19 +1,37 @@
 import { describe, expect, test } from "bun:test";
 import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  isFieldsEditSection,
+  normalizeEditField,
+  normalizeListColumn,
+  sectionFieldSpecs,
+} from "@cosmicdrift/kumiko-framework/ui-types";
 import { createConfigFeature } from "../../config/feature";
 import { createTenantFeature } from "../../tenant/feature";
+import { createUserFeature } from "../../user/feature";
 import { AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID, AuditQueries } from "../constants";
 import { createAuditFeature } from "../feature";
 import { AUDIT_I18N } from "../i18n";
 
 describe("audit log screen + handler access alignment", () => {
-  const features = [createConfigFeature(), createTenantFeature(), createAuditFeature()];
+  const features = [
+    createConfigFeature(),
+    createTenantFeature(),
+    createUserFeature(),
+    createAuditFeature(),
+  ];
 
   test("boot-validates with audit-log screen registered", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
+  test("the user:user actor reference makes `user` a hard boot dependency (fw#3103)", () => {
+    expect(() =>
+      validateBoot([createConfigFeature(), createTenantFeature(), createAuditFeature()]),
+    ).toThrow(/requires feature "user"/);
+  });
+
   test("audit-log screen is declarative, access.admin-gated", () => {
     const audit = createAuditFeature();
     const screen = audit.screens[AUDIT_LOG_SCREEN_ID];
@@ -63,6 +81,27 @@ describe("audit log screen + handler access alignment", () => {
     expect(AUDIT_I18N[aggregateTypeKey]?.en).not.toBe(AUDIT_I18N[aggregateIdKey]?.en);
   });
 
+  test("actor column and detail field declare the user:user reference (fw#3103)", () => {
+    const audit = createAuditFeature();
+    expect(audit.requires).toContain("user");
+
+    const list = audit.screens[AUDIT_LOG_SCREEN_ID];
+    if (list?.type !== "projectionList") throw new Error("expected a projectionList screen");
+    const actorColumn = list.columns.map(normalizeListColumn).find((c) => c.field === "createdBy");
+    expect(actorColumn?.refEntity).toBe("user:user");
+    expect(actorColumn?.refLabelField).toBe("displayName");
+
+    const detail = audit.screens[AUDIT_LOG_DETAIL_SCREEN_ID];
+    if (detail?.type !== "projectionDetail") throw new Error("expected a projectionDetail screen");
+    const actorField = detail.layout.sections
+      .filter(isFieldsEditSection)
+      .flatMap((section) => sectionFieldSpecs(section))
+      .map(normalizeEditField)
+      .find((f) => f.field === "createdBy");
+    expect(actorField?.refEntity).toBe("user:user");
+    expect(actorField?.refLabelField).toBe("displayName");
+  });
+
   test("audit queries use access.admin (screen ⊆ handler)", () => {
     const audit = createAuditFeature();
     expect(rolesOf(audit.queryHandlers["list"]?.access)).toEqual([...access.admin]);

package/src/audit/__tests__/audit.integration.test.ts

@@ -21,9 +21,11 @@ import {
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { withoutAmbientTemporal } from "@cosmicdrift/kumiko-framework/testing";
+import { buildDateRangePayload, resolveDateRangeFacets } from "@cosmicdrift/kumiko-renderer";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant";
-import { AuditQueries } from "../constants";
+import { createUserFeature } from "../../user";
+import { AUDIT_LOG_SCREEN_ID, AuditQueries } from "../constants";
 import { createAuditFeature } from "../feature";
 
 const widgetEntity = createEntity({
@@ -61,7 +63,13 @@ const otherTenantAdmin: SessionUser = createTestUser({
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [widgetFeature, createConfigFeature(), createTenantFeature(), createAuditFeature()],
+    features: [
+      widgetFeature,
+      createConfigFeature(),
+      createTenantFeature(),
+      createUserFeature(),
+      createAuditFeature(),
+    ],
   });
   await unsafeCreateEntityTable(stack.db, widgetEntity);
 });
@@ -251,6 +259,92 @@ describe("audit: list query", () => {
     expect((untilRow.payload as { name?: string }).name).toBe("before-window");
   });
 
+  // fw#3104: the audit screen's dateRange facet is the only UI that produces
+  // these bounds. The risk is not the handler (covered above) but the
+  // conversion of a calendar date into an instant: pick "the 14th" as the
+  // upper bound and an event at 23:59 local that day has to stay in the
+  // result. Bounds are derived from the live screen declaration, so a change
+  // to either end of the chain fails here.
+  test("dateRange facet bounds include an event at 23:59 of the `to` day", async () => {
+    const screen = createAuditFeature().screens[AUDIT_LOG_SCREEN_ID];
+    if (screen?.type !== "projectionList") throw new Error("expected a projectionList screen");
+    const specs = resolveDateRangeFacets(screen.facets, (key) => key);
+    expect(specs).toHaveLength(1);
+
+    await createWidget(admin, "late-on-the-14th");
+    await createWidget(admin, "just-after-midnight");
+
+    const listed = await stack.http.queryOk<AuditResponse>(AuditQueries.list, {}, admin);
+    const byName = new Map(
+      listed.rows
+        .filter((r) => r.type === "widget.created")
+        .map((r) => [(r.payload as { name?: string }).name ?? "", r.id]),
+    );
+    // 23:59 and 00:00 Europe/Vienna, expressed as the UTC instants the
+    // event store stores.
+    const stamps: ReadonlyArray<readonly [string, string]> = [
+      ["late-on-the-14th", "2020-06-14T21:59:00Z"],
+      ["just-after-midnight", "2020-06-14T22:00:00Z"],
+    ];
+    for (const [name, createdAt] of stamps) {
+      const id = byName.get(name);
+      if (!id) throw new Error(`missing event for ${name}`);
+      await asRawClient(stack.db).unsafe(
+        `UPDATE kumiko_events SET created_at = $1::timestamptz WHERE id = $2::bigint`,
+        [createdAt, id],
+      );
+    }
+
+    const bounds = buildDateRangePayload(
+      specs,
+      { "createdAt.from": ["2020-06-14"], "createdAt.to": ["2020-06-14"] },
+      "Europe/Vienna",
+    );
+    const inRange = await stack.http.queryOk<AuditResponse>(AuditQueries.list, bounds, admin);
+    const names = inRange.rows.map((r) => (r.payload as { name?: string }).name);
+    expect(names).toContain("late-on-the-14th");
+    expect(names).not.toContain("just-after-midnight");
+  });
+
+  // Open interval from the same declaration — only one bound set must still
+  // reach the handler as a single param.
+  test("dateRange facet with only the `from` bound sends an open interval", async () => {
+    const screen = createAuditFeature().screens[AUDIT_LOG_SCREEN_ID];
+    if (screen?.type !== "projectionList") throw new Error("expected a projectionList screen");
+    const specs = resolveDateRangeFacets(screen.facets, (key) => key);
+
+    await createWidget(admin, "old");
+    await createWidget(admin, "recent");
+    const listed = await stack.http.queryOk<AuditResponse>(AuditQueries.list, {}, admin);
+    const byName = new Map(
+      listed.rows
+        .filter((r) => r.type === "widget.created")
+        .map((r) => [(r.payload as { name?: string }).name ?? "", r.id]),
+    );
+    for (const [name, createdAt] of [
+      ["old", "2020-06-01T12:00:00Z"],
+      ["recent", "2020-06-20T12:00:00Z"],
+    ] as const) {
+      const id = byName.get(name);
+      if (!id) throw new Error(`missing event for ${name}`);
+      await asRawClient(stack.db).unsafe(
+        `UPDATE kumiko_events SET created_at = $1::timestamptz WHERE id = $2::bigint`,
+        [createdAt, id],
+      );
+    }
+
+    const bounds = buildDateRangePayload(
+      specs,
+      { "createdAt.from": ["2020-06-10"] },
+      "Europe/Vienna",
+    );
+    expect(Object.keys(bounds)).toEqual(["from"]);
+    const sinceFrom = await stack.http.queryOk<AuditResponse>(AuditQueries.list, bounds, admin);
+    const names = sinceFrom.rows.map((r) => (r.payload as { name?: string }).name);
+    expect(names).toContain("recent");
+    expect(names).not.toContain("old");
+  });
+
   test("rejects inverted from/to range with validation_error", async () => {
     // from > to would silently return empty — confusing. Schema-level refine
     // turns it into a clean 400 at the gate.

package/src/audit/__tests__/escape-hatch-audit.integration.test.ts

@@ -15,6 +15,7 @@ import {
 import { z } from "zod";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant";
+import { createUserFeature } from "../../user";
 import { AuditQueries } from "../constants";
 import { createEscapeHatchAuditSink, ESCAPE_HATCH_USED_EVENT } from "../escape-hatch-audit-sink";
 import { createAuditFeature } from "../feature";
@@ -41,7 +42,13 @@ const adminOfSameTenant: SessionUser = createTestUser({ id: 10, tenantId, roles:
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [probeFeature, createConfigFeature(), createTenantFeature(), createAuditFeature()],
+    features: [
+      probeFeature,
+      createConfigFeature(),
+      createTenantFeature(),
+      createUserFeature(),
+      createAuditFeature(),
+    ],
     extraContext: ({ db }) => ({ _escapeHatchAuditSink: createEscapeHatchAuditSink({ db }) }),
   });
 });

package/src/audit/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.292.0",
+    "type": "improvement",
+    "title": "Audit log shows actor display names instead of raw UUIDs (fw#3103)",
+    "detail": "The `Actor` column of `audit:screen:audit-log` and the `createdBy` field of its detail screen rendered the raw `createdBy` UUID. The framework primitive for this already existed — `ListColumnSpec.refEntity` / `refLabelField`, used by `sessions` and `delivery` — the audit feature just did not declare it. Both now carry `refEntity: \"user:user\"`, `refLabelField: \"displayName\"`, which also makes the `createdBy → user:user` relation machine-readable in the app schema instead of implicit.\n`audit:query:list` and `audit:query:details` are unchanged and still return the plain id.\nA system write (`SYSTEM_USER_ID`, the null UUID) has no `read_users` row, so the bulk reference lookup can never resolve it. `SYSTEM_REFERENCE_LABELS` gained a `user:user` entry with the new `kumiko.reference.system-user` key, so every screen referencing `user:user` — not just the audit log — renders \"System\" for it. An actor that resolves to no row at all (deleted user) keeps the existing generic fallback: the raw id, no throw.\n`SYSTEM_USER_ID` moved from `framework/engine/system-user` to `kumiko-types/identifiers`, next to `SYSTEM_TENANT_ID`, so the client-side reference-label map can read it without importing a runtime module. `engine/system-user` re-exports it — every existing import keeps working.",
+    "migration": "The audit feature now declares `r.requires(\"tenant\", \"user\")`. An app that mounts `createAuditFeature()` without the `user` feature fails at boot with `Feature \"audit\" requires feature \"user\" which is not registered` — mount `createUserFeature()`. Apps using `securityBaselineFeatures()` already had to mount it."
+  },
   {
     "version": "0.271.0",
     "type": "improvement",

package/src/audit/feature.ts

@@ -35,8 +35,7 @@ export function createAuditFeature(): FeatureDefinition {
         recommended: false,
       });
       r.translations({ keys: AUDIT_I18N });
-      // Screens resolve actor names via tenant:query:members.
-      r.requires("tenant");
+      r.requires("tenant", "user");
 
       // Registered so ops tools/MSPs can discover the type — escape-hatch-audit-sink.ts appends it via the low-level event-store API.
       r.defineEvent("escape-hatch-used", escapeHatchUsedSchema, { piiFields: "none" });
@@ -57,10 +56,25 @@ export function createAuditFeature(): FeatureDefinition {
             renderer: { format: "timestamp" },
           },
           { field: "type", label: i18nKey("audit.log.col.type") },
-          { field: "createdBy", label: i18nKey("audit.log.col.actor") },
+          {
+            field: "createdBy",
+            label: i18nKey("audit.log.col.actor"),
+            // Resolves only for SystemAdmin until fw#3107: the lookup QN this
+            // derives, user:query:user:list, is SystemAdmin-only.
+            refEntity: "user:user",
+            refLabelField: "displayName",
+          },
         ],
         searchable: true,
         defaultSort: { field: "createdAt", dir: "desc" },
+        facets: [
+          {
+            type: "dateRange",
+            field: "createdAt",
+            label: i18nKey("audit.log.col.when"),
+            params: { from: "from", to: "to" },
+          },
+        ],
         rowActions: [
           {
             kind: "navigate",
@@ -99,7 +113,7 @@ export function createAuditFeature(): FeatureDefinition {
                 { field: "createdAt", renderer: { format: "timestamp" } },
                 "aggregateType",
                 "aggregateId",
-                "createdBy",
+                { field: "createdBy", refEntity: "user:user", refLabelField: "displayName" },
                 "id",
               ],
             },

package/src/custom-fields/__tests__/audit-integration.integration.test.ts

@@ -33,6 +33,7 @@ import { AuditQueries } from "../../audit/constants";
 import { createAuditFeature } from "../../audit/feature";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant";
+import { createUserFeature } from "../../user";
 import { fieldDefinitionEntity } from "../entity";
 import { createCustomFieldsFeature } from "../feature";
 import { customFieldsField, wireCustomFieldsFor } from "../wire-for-entity";
@@ -86,6 +87,7 @@ beforeAll(async () => {
       propertyFeature,
       createConfigFeature(),
       createTenantFeature(),
+      createUserFeature(),
       createAuditFeature(),
     ],
   });

package/src/file-foundation/__tests__/file-foundation.integration.test.ts

@@ -5,7 +5,15 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  createTenantConfig,
+  defineFeature,
+  defineWriteHandler,
+  FILE_PROVIDER_CONFIG_KEY,
+  FILE_STORAGE_PROVIDER_BOOT_SENTINEL,
+  FILE_STORAGE_PROVIDER_ENV,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import {
@@ -25,7 +33,11 @@ import { z } from "zod";
 import { createConfigFeature } from "../../config";
 import { ConfigHandlers } from "../../config/constants";
 import { createConfigAccessorFactory } from "../../config/feature";
-import { type ConfigResolver, createConfigResolver } from "../../config/resolver";
+import {
+  buildEnvConfigOverrides,
+  type ConfigResolver,
+  createConfigResolver,
+} from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
 import { fileProviderS3Feature, S3_SECRET_ACCESS_KEY } from "../../file-provider-s3";
 import { fileProviderS3EnvFeature } from "../../file-provider-s3-env";
@@ -37,15 +49,30 @@ import { createFileProviderForTenant, fileFoundationFeature } from "../feature";
 // --- Test-Handler that exercises the factory end-to-end ---
 
 const TEST_HANDLER_QN = "file-test:write:build-provider";
+const PROBE_SECRET_KEY = "file-test:config:probe-secret";
 const testProbeFeature = defineFeature("file-test", (r) => {
   r.requires("config");
   r.requires("secrets");
+  // Envelope-cipher round-trip partner: proves the resolver still decrypts
+  // once it also carries ENV-bridged app-overrides.
+  r.config({
+    keys: {
+      probeSecret: createTenantConfig("text", {
+        encrypted: true,
+        default: "",
+        read: access.roles("TenantAdmin", "SystemAdmin"),
+        write: access.roles("TenantAdmin", "SystemAdmin"),
+      }),
+    },
+  });
   r.writeHandler(
     defineWriteHandler({
       name: "build-provider",
       schema: z.object({}),
       access: { roles: ["TenantAdmin", "SystemAdmin"] },
       handler: async (event, ctx) => {
+        const readConfig = ctx.config;
+        if (!readConfig) throw new Error(`${TEST_HANDLER_QN}: ctx.config is missing`);
         const provider = await createFileProviderForTenant(
           ctx,
           event.user.tenantId,
@@ -54,6 +81,8 @@ const testProbeFeature = defineFeature("file-test", (r) => {
         return {
           isSuccess: true,
           data: {
+            selectedProvider: await readConfig(FILE_PROVIDER_CONFIG_KEY),
+            probeSecret: await readConfig(PROBE_SECRET_KEY),
             hasWrite: typeof provider.write === "function",
             hasRead: typeof provider.read === "function",
             hasDelete: typeof provider.delete === "function",
@@ -72,10 +101,10 @@ let resolver: ConfigResolver;
 let providerRef: MutableMasterKeyProvider;
 
 const testEncryptionKey = randomBytes(32).toString("base64");
+const ENV_SELECTED_PROVIDER = "s3-env";
 
 beforeAll(async () => {
   const encryption = createTestEnvelopeCipher(testEncryptionKey);
-  resolver = createConfigResolver({ cipher: encryption });
 
   const initialKp = createEnvMasterKeyProvider({
     env: {
@@ -96,12 +125,22 @@ beforeAll(async () => {
       testProbeFeature,
     ],
     masterKeyProvider: providerRef,
-    extraContext: ({ db, registry }) => ({
-      configResolver: resolver,
-      configEncryption: encryption,
-      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
-      secrets: createSecretsContext({ db, masterKeyProvider: providerRef }),
-    }),
+    extraContext: ({ db, registry }) => {
+      // No app-side resolver rebuild: the provider key declares
+      // env: FILE_STORAGE_PROVIDER, so the generic ENV bridge selects it.
+      resolver = createConfigResolver({
+        cipher: encryption,
+        appOverrides: buildEnvConfigOverrides(registry, {
+          [FILE_STORAGE_PROVIDER_ENV]: ENV_SELECTED_PROVIDER,
+        }),
+      });
+      return {
+        configResolver: resolver,
+        configEncryption: encryption,
+        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+        secrets: createSecretsContext({ db, masterKeyProvider: providerRef }),
+      };
+    },
   });
   db = stack.db;
 
@@ -283,3 +322,87 @@ describe("scenario 4: s3-env provider (app-wide env, no secrets)", () => {
     }
   });
 });
+
+// --- Scenario 5: FILE_STORAGE_PROVIDER selects the provider, no app resolver ---
+//
+// The stack's resolver is the plain framework one — its only app-override
+// comes from buildEnvConfigOverrides reading the key's `env` declaration.
+// Before #3112 every app rebuilt createConfigResolver just to pin this key.
+
+describe("scenario 5: ENV-bridged provider selection", () => {
+  function withS3Env<T>(run: () => Promise<T>): Promise<T> {
+    const saved = S3_ENV_KEYS.map((k) => [k, process.env[k]] as const);
+    Object.assign(process.env, {
+      S3_BUCKET: "env-bridge-bucket",
+      S3_REGION: "fsn1",
+      S3_ACCESS_KEY: "AKIABRIDGE",
+      S3_SECRET_KEY: "env-secret-not-real",
+    });
+    return run().finally(() => {
+      for (const [k, v] of saved) {
+        if (v === undefined) delete process.env[k];
+        else process.env[k] = v;
+      }
+    });
+  }
+
+  test("no tenant row → FILE_STORAGE_PROVIDER wins and the factory builds that provider", async () => {
+    const admin = adminFor(506);
+
+    const result = await withS3Env(
+      async () => (await stack.http.writeOk(TEST_HANDLER_QN, {}, admin)) as Record<string, unknown>,
+    );
+    expect(result["selectedProvider"]).toBe(ENV_SELECTED_PROVIDER);
+    expect(result["hasWrite"]).toBe(true);
+  });
+
+  test("tenant row still overrides the ENV value (cascade unchanged)", async () => {
+    const admin = adminFor(507);
+
+    await selectS3Provider(admin);
+    await setConfig(admin, "file-provider-s3:config:bucket", "row-bucket");
+    await setConfig(admin, "file-provider-s3:config:region", "fsn1");
+    await setConfig(admin, "file-provider-s3:config:access-key-id", "AKIAROW");
+    await stack.http.writeOk(
+      "secrets:write:set",
+      { key: S3_SECRET_ACCESS_KEY.name, value: "row-secret" },
+      admin,
+    );
+
+    const result = await withS3Env(
+      async () => (await stack.http.writeOk(TEST_HANDLER_QN, {}, admin)) as Record<string, unknown>,
+    );
+    expect(result["selectedProvider"]).toBe("s3");
+  });
+
+  test("boot-gate sentinel selects no provider", async () => {
+    // What runDevApp writes into FILE_STORAGE_PROVIDER when options.files
+    // already wires a provider — it names no plugin, so the bridge must not
+    // turn it into a selection.
+    expect(
+      buildEnvConfigOverrides(stack.registry, {
+        [FILE_STORAGE_PROVIDER_ENV]: FILE_STORAGE_PROVIDER_BOOT_SENTINEL,
+      }).get(FILE_PROVIDER_CONFIG_KEY),
+    ).toBe(FILE_STORAGE_PROVIDER_BOOT_SENTINEL);
+
+    const admin = adminFor(508);
+    await setConfig(admin, FILE_PROVIDER_CONFIG_KEY, FILE_STORAGE_PROVIDER_BOOT_SENTINEL);
+
+    const error = await stack.http.writeErr(TEST_HANDLER_QN, {}, admin);
+    // The factory throw surfaces as internal_error; the original message sits
+    // in details.causeMessage.
+    expect(JSON.stringify(error)).toMatch(
+      /no provider selected — set the 'file-foundation:config:provider' config-key/,
+    );
+  });
+
+  test("encrypted config keys still round-trip through the same resolver", async () => {
+    const admin = adminFor(509);
+    await setConfig(admin, PROBE_SECRET_KEY, "cipher-round-trip");
+
+    const result = await withS3Env(
+      async () => (await stack.http.writeOk(TEST_HANDLER_QN, {}, admin)) as Record<string, unknown>,
+    );
+    expect(result["probeSecret"]).toBe("cipher-round-trip");
+  });
+});

package/src/file-foundation/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.292.0",
+    "type": "improvement",
+    "title": "FILE_STORAGE_PROVIDER selects the file provider, not just the boot gate",
+    "detail": "The `provider` config key declares `env: \"FILE_STORAGE_PROVIDER\"`, so the ENV→app-override bridge selects the provider at boot without an app-side `createConfigResolver` rebuild. Tenant rows still override the ENV value (cascade unchanged). The boot-gate placeholder `\"configured\"` that `runDevApp` writes names no plugin, so `createFileProviderForTenant` treats it as unset and raises \"no provider selected\"; both strings are exported as `FILE_STORAGE_PROVIDER_ENV` / `FILE_STORAGE_PROVIDER_BOOT_SENTINEL`.",
+    "migration": "Apps on the framework's default config resolver: make sure `FILE_STORAGE_PROVIDER` holds a registered provider name (`inmemory`, `s3`, `s3-env`) — it is now the provider selection, not only a presence check. Apps that pass their own `configResolver` are unaffected and can drop their hand-rolled `file-foundation:config:provider` app-override."
+  }
+]

package/src/file-foundation/feature.ts

@@ -21,6 +21,7 @@ import {
   createTenantConfig,
   defineFeature,
   EXT_FILE_PROVIDER,
+  FILE_STORAGE_PROVIDER_ENV,
 } from "@cosmicdrift/kumiko-framework/engine";
 
 export type {
@@ -58,6 +59,7 @@ export const fileFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
     "provider",
     createTenantConfig("text", {
       default: "",
+      env: FILE_STORAGE_PROVIDER_ENV,
       write: access.roles("TenantAdmin", "SystemAdmin"),
       read: access.roles("TenantAdmin", "SystemAdmin", "User"),
     }),