@cosmicdrift/kumiko-bundled-features 0.328.0 → 0.329.0

package/src/compliance-profiles-ops/handlers/tenants-missing-profile.query.ts

@@ -1,56 +0,0 @@
-import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
-import { defineQueryHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import * as z from "zod";
-import { tenantComplianceProfileTable } from "../../compliance-profiles";
-import { tenantTable } from "../../tenant";
-
-// SystemAdmin platform-wide counterpart to needs-profile (#2089).
-//
-// #2084 stopped needs-profile from nagging a TenantAdmin who can no longer
-// reach a picker narrowed to access.systemAdmin — correct, but it left no
-// one else able to notice: needs-profile stays TenantAdmin-only on purpose
-// (widening its call-access was explicitly rejected in #2084), so a
-// SystemAdmin who owns the platform-only picker has no way to see which
-// tenants still run on minimal-no-region. This query fills that gap
-// instead of touching needs-profile: every enabled tenant that has no row
-// in tenantComplianceProfile at all, tenant-wide rather than for the
-// caller's own tenant.
-export const tenantsMissingProfileQuery = defineQueryHandler({
-  name: "tenants-missing-profile",
-  schema: z.object({}),
-  access: { roles: [ROLES.SystemAdmin] },
-  description:
-    "Lists every enabled tenant that has never selected a compliance profile, for the platform operator sweeping the whole installation; needs-profile answers the same question but only for the caller's own tenant.",
-  handler: async (_query, ctx): Promise<TenantsMissingProfileResponse> => {
-    if (!ctx.systemDb) {
-      throw new InternalError({
-        message:
-          "[compliance-profiles-ops] tenants-missing-profile requires ctx.systemDb — the " +
-          "compliance-profiles-ops feature must stay r.systemScope() (see feature.ts).",
-      });
-    }
-    const db = ctx.systemDb.acknowledgeCrossTenant(
-      "platform operator scans every tenant for a missing compliance-profile selection",
-    );
-
-    const tenants = await db.selectMany<{ id: TenantId; name: string }>(tenantTable, {
-      isEnabled: true,
-    });
-    const profileRows = await db.selectMany<{ tenantId: TenantId }>(
-      tenantComplianceProfileTable,
-      {},
-    );
-    const tenantIdsWithProfile = new Set(profileRows.map((row) => row.tenantId));
-
-    return {
-      tenants: tenants
-        .filter((tenant) => !tenantIdsWithProfile.has(tenant.id))
-        .map((tenant) => ({ id: tenant.id, name: tenant.name })),
-    };
-  },
-});
-
-interface TenantsMissingProfileResponse {
-  readonly tenants: readonly { readonly id: TenantId; readonly name: string }[];
-}

package/src/compliance-profiles-ops/index.ts

@@ -1,34 +0,0 @@
-// compliance-profiles-ops — platform-wide SystemAdmin visibility into
-// tenants missing a compliance-profile selection (#2089).
-//
-// needs-profile (compliance-profiles) tells a TenantAdmin they must pick a
-// profile, but stays TenantAdmin-only by design (#2084) — a SystemAdmin who
-// owns a picker narrowed to access.systemAdmin has no query at all. Kept as
-// a separate feature (mirrors folders-user-data/notes-history-user-data)
-// rather than folded into compliance-profiles: this is the one genuinely
-// cross-tenant capability in the picker's orbit, and it alone needs
-// r.systemScope() + a hard r.requires("tenant") — apps that only want the
-// per-tenant picker (the vast majority) stay unaffected.
-
-import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { tenantsMissingProfileQuery } from "./handlers/tenants-missing-profile.query";
-
-export const complianceProfilesOpsFeature = defineFeature("compliance-profiles-ops", (r) => {
-  r.describe(
-    "Platform-wide SystemAdmin counterpart to `compliance-profiles`' `needs-profile` query (#2089): `tenants-missing-profile` lists every enabled tenant with no row in `tenantComplianceProfile` at all, tenant-wide instead of scoped to the caller's own tenant. Mount alongside `compliance-profiles` and `tenant` when an operator UI needs to see which tenants still silently run on `minimal-no-region`.",
-  );
-  r.uiHints({
-    displayLabel: "Compliance Profiles · Operator Visibility",
-    category: "compliance",
-    recommended: false,
-  });
-  r.systemScope();
-  r.requires("compliance-profiles");
-  r.requires("tenant");
-
-  const queries = {
-    tenantsMissingProfile: r.queryHandler(tenantsMissingProfileQuery),
-  };
-
-  return { queries };
-});

package/src/config/__tests__/app-override-visibility.integration.test.ts

@@ -1,149 +0,0 @@
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import {
-  access,
-  type ConfigCascade,
-  createTenantConfig,
-  defineFeature,
-} from "@cosmicdrift/kumiko-framework/engine";
-import {
-  createTestUser,
-  setupTestStack,
-  type TestStack,
-  TestUsers,
-  unsafePushTables,
-} from "@cosmicdrift/kumiko-framework/stack";
-import { ConfigHandlers, ConfigQueries } from "../constants";
-import { createConfigAccessorFactory, createConfigFeature } from "../feature";
-import { buildEnvConfigOverrides, createConfigResolver } from "../resolver";
-import { configValuesTable } from "../table";
-
-// Proves the ENV→app-override bridge end-to-end over real HTTP:
-//   - a transparently-inherited key (default inheritedToTenant) surfaces the
-//     ENV-bridged app-override to a tenant (the D3 fix — values.query used to
-//     fall to keyDef.default and never showed the inherited app-override);
-//   - an inheritedToTenant:false key must NOT leak the platform ENV value to a
-//     tenant-side viewer through the app-override rung (the regression guard
-//     for the #376 redaction, which previously only stripped system-row);
-//   - a tenant's own row still beats the app-override.
-
-let stack: TestStack;
-let db: DbConnection;
-
-const systemAdmin = TestUsers.systemAdmin; // roles ["SystemAdmin"]
-const tenantAdmin = createTestUser({ id: 2 }); // roles ["Admin"]
-
-const PAGE_SIZE = "appcfg:config:page-size";
-const API_BASE = "appcfg:config:api-base";
-
-const FAKE_ENV = {
-  APPCFG_PAGE_SIZE: "25",
-  APPCFG_API_BASE: "https://internal.example.com",
-};
-
-const appcfgFeature = defineFeature("appcfg", (r) => {
-  r.requires("config");
-  return r.config({
-    keys: {
-      // Transparent inheritance + ENV-bridged: a tenant sees the platform's
-      // ENV default until it sets its own value.
-      pageSize: createTenantConfig("number", {
-        env: "APPCFG_PAGE_SIZE",
-        default: 10,
-        read: access.admin,
-        write: access.admin,
-      }),
-      // inheritedToTenant:false + ENV-bridged: the platform value must stay
-      // hidden from tenant-side viewers — including via app-override.
-      apiBase: createTenantConfig("text", {
-        env: "APPCFG_API_BASE",
-        inheritedToTenant: false,
-        read: access.admin,
-        write: access.systemAdmin,
-      }),
-    },
-  });
-});
-
-type Values = Record<string, { value: unknown; source: string }>;
-type Cascades = Record<string, ConfigCascade>;
-const overrideLevel = (c: Cascades, key: string) =>
-  c[key]?.levels.find((l) => l.source === "app-override");
-
-beforeAll(async () => {
-  stack = await setupTestStack({
-    features: [createConfigFeature(), appcfgFeature],
-    extraContext: ({ registry }) => {
-      const resolver = createConfigResolver({
-        appOverrides: buildEnvConfigOverrides(registry, FAKE_ENV),
-      });
-      return {
-        configResolver: resolver,
-        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
-      };
-    },
-  });
-  db = stack.db;
-  await unsafePushTables(db, { configValuesTable });
-});
-
-afterAll(async () => {
-  await stack.cleanup();
-});
-
-describe("ENV→app-override bridge — config:query:values", () => {
-  test("D3: a transparently-inherited key surfaces the ENV app-override, not keyDef.default", async () => {
-    const res = await stack.http.queryOk<Values>(ConfigQueries.values, {}, tenantAdmin);
-    expect(res[PAGE_SIZE]?.value).toBe(25); // number, coerced from env — not 10 (default)
-    expect(res[PAGE_SIZE]?.source).toBe("app-override");
-  });
-
-  test("leak guard: inheritedToTenant:false hides the ENV app-override from a tenant", async () => {
-    const res = await stack.http.queryOk<Values>(ConfigQueries.values, {}, tenantAdmin);
-    expect(res[API_BASE]).toBeDefined();
-    expect(res[API_BASE]?.value).not.toBe("https://internal.example.com");
-    expect(res[API_BASE]?.source).not.toBe("app-override");
-    // Positive anchor: API_BASE has no keyDef.default → after redaction the key
-    // resolves as genuinely unset ("missing"), NOT absent for some other reason
-    // (e.g. an access-deny would drop the key entirely and leave the negative
-    // asserts above vacuously green).
-    expect(res[API_BASE]?.source).toBe("missing");
-  });
-});
-
-describe("ENV→app-override bridge — config:query:cascade", () => {
-  test("leak guard: the app-override level is redacted for a tenant on an inheritedToTenant:false key", async () => {
-    const res = await stack.http.queryOk<Cascades>(
-      ConfigQueries.cascade,
-      { keys: [API_BASE] },
-      tenantAdmin,
-    );
-    const ov = overrideLevel(res, API_BASE);
-    expect(ov?.value).toBeUndefined();
-    expect(ov?.hasValue).toBe(false);
-    expect(res[API_BASE]?.value).not.toBe("https://internal.example.com");
-  });
-
-  test("SystemAdmin still sees the inherited ENV app-override", async () => {
-    const res = await stack.http.queryOk<Cascades>(
-      ConfigQueries.cascade,
-      { keys: [API_BASE] },
-      systemAdmin,
-    );
-    expect(overrideLevel(res, API_BASE)?.value).toBe("https://internal.example.com");
-    expect(res[API_BASE]?.value).toBe("https://internal.example.com");
-  });
-});
-
-describe("ENV→app-override bridge — precedence", () => {
-  test("a tenant's own row beats the ENV app-override", async () => {
-    await stack.http.writeOk(
-      ConfigHandlers.set,
-      { key: PAGE_SIZE, value: 50, scope: "tenant" },
-      tenantAdmin,
-    );
-    const res = await stack.http.queryOk<Values>(ConfigQueries.values, {}, tenantAdmin);
-    expect(res[PAGE_SIZE]?.value).toBe(50);
-    expect(res[PAGE_SIZE]?.source).toBe("tenant-row");
-  });
-});

package/src/config/__tests__/app-overrides.test.ts

@@ -1,129 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { createTenantConfig, createUserConfig } from "@cosmicdrift/kumiko-framework/engine";
-import { validateAppOverrides } from "../resolver";
-
-// Minimal registry stub — validateAppOverrides only reads getConfigKey.
-// Cast keeps the test isolated from the rest of the Registry surface.
-function registryStub(keys: Record<string, unknown>) {
-  return {
-    getConfigKey: (key: string) => keys[key] as never,
-  };
-}
-
-describe("validateAppOverrides", () => {
-  test("accepts a typed override that matches an existing key", () => {
-    const reg = registryStub({
-      "files:config:max-size": createTenantConfig("number"),
-    });
-    const validated = validateAppOverrides(reg, {
-      "files:config:max-size": 50,
-    });
-    expect(validated.get("files:config:max-size")).toBe(50);
-    expect(validated.size).toBe(1);
-  });
-
-  test("throws on unknown key", () => {
-    const reg = registryStub({});
-    expect(() =>
-      validateAppOverrides(reg, {
-        "missing:config:x": 1,
-      }),
-    ).toThrow(/unknown config key.*missing:config:x/i);
-  });
-
-  test("throws on type mismatch — number key, string value", () => {
-    const reg = registryStub({
-      "a:config:x": createTenantConfig("number"),
-    });
-    expect(() =>
-      validateAppOverrides(reg, {
-        "a:config:x": "not-a-number",
-      }),
-    ).toThrow(/expected number, got string/i);
-  });
-
-  test("throws on type mismatch — boolean key, number value", () => {
-    const reg = registryStub({
-      "a:config:flag": createTenantConfig("boolean"),
-    });
-    expect(() =>
-      validateAppOverrides(reg, {
-        "a:config:flag": 1,
-      }),
-    ).toThrow(/expected boolean, got number/i);
-  });
-
-  test("select key — accepts value in options, rejects anything else", () => {
-    const reg = registryStub({
-      "a:config:theme": createTenantConfig("select", { options: ["light", "dark", "auto"] }),
-    });
-    // ok
-    expect(() => validateAppOverrides(reg, { "a:config:theme": "dark" })).not.toThrow();
-    // not in options
-    expect(() => validateAppOverrides(reg, { "a:config:theme": "purple" })).toThrow(
-      /not in options/i,
-    );
-  });
-
-  test("throws on bounds violation — below min", () => {
-    const reg = registryStub({
-      "a:config:n": createTenantConfig("number", { bounds: { min: 1, max: 100 } }),
-    });
-    expect(() => validateAppOverrides(reg, { "a:config:n": 0 })).toThrow(/below bounds\.min/i);
-  });
-
-  test("throws on bounds violation — above max", () => {
-    const reg = registryStub({
-      "a:config:n": createTenantConfig("number", { bounds: { min: 1, max: 100 } }),
-    });
-    expect(() => validateAppOverrides(reg, { "a:config:n": 101 })).toThrow(/above bounds\.max/i);
-  });
-
-  test("passes multiple overrides at once and preserves all", () => {
-    const reg = registryStub({
-      "a:config:n": createTenantConfig("number"),
-      "a:config:s": createTenantConfig("text"),
-      "a:config:b": createUserConfig("boolean"),
-    });
-    const result = validateAppOverrides(reg, {
-      "a:config:n": 42,
-      "a:config:s": "hello",
-      "a:config:b": true,
-    });
-    expect(result.size).toBe(3);
-    expect(result.get("a:config:n")).toBe(42);
-    expect(result.get("a:config:s")).toBe("hello");
-    expect(result.get("a:config:b")).toBe(true);
-  });
-
-  test("empty overrides map passes through without validation cost", () => {
-    const reg = registryStub({});
-    const result = validateAppOverrides(reg, {});
-    expect(result.size).toBe(0);
-  });
-
-  test("rejects override for a computed key — plan-logic may not be silently bypassed", () => {
-    const reg = registryStub({
-      "plan:config:quota": createTenantConfig("number", {
-        default: 10,
-        computed: async () => 100,
-      }),
-    });
-    expect(() =>
-      validateAppOverrides(reg, {
-        "plan:config:quota": 999,
-      }),
-    ).toThrow(/computed resolver.*app-overrides would silently bypass/i);
-  });
-
-  test("throws on type mismatch — text key, number value", () => {
-    const reg = registryStub({
-      "a:config:s": createTenantConfig("text"),
-    });
-    expect(() =>
-      validateAppOverrides(reg, {
-        "a:config:s": 42,
-      }),
-    ).toThrow(/expected string, got number/i);
-  });
-});

package/src/config/__tests__/backing-secrets.integration.test.ts

@@ -1,245 +0,0 @@
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { randomBytes } from "node:crypto";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  access,
-  type ConfigCascade,
-  createSystemConfig,
-  defineFeature,
-} from "@cosmicdrift/kumiko-framework/engine";
-import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
-import {
-  setupTestStack,
-  type TestStack,
-  TestUsers,
-  unsafePushTables,
-} from "@cosmicdrift/kumiko-framework/stack";
-import * as z from "zod";
-import { createSecretsContext } from "../../secrets/secrets-context";
-import { tenantSecretsTable } from "../../secrets/table";
-import { ConfigHandlers, ConfigQueries } from "../constants";
-import { createConfigAccessorFactory, createConfigFeature } from "../feature";
-import { createConfigResolver } from "../resolver";
-import { configValuesTable } from "../table";
-
-// Proves the generic backing="secrets" dispatch end-to-end over real HTTP:
-// a system-scoped config key with backing:"secrets" stores/reads/clears through
-// the secrets store (envelope-encrypted, system tenant) instead of the
-// config_values projection — while the value is masked in the query handlers
-// yet revealed for the owning feature's internal ctx.config read.
-
-const SYSTEM_TENANT = "00000000-0000-4000-8000-000000000000";
-const API_KEY = "billing:config:api-key";
-const PLAIN_KEY = "billing:config:webhook-path";
-
-const systemAdmin = TestUsers.systemAdmin; // roles ["SystemAdmin"]
-
-const billingFeature = defineFeature("billing", (r) => {
-  r.requires("config");
-  r.config({
-    keys: {
-      // backing:"secrets" — value lives in the secrets store, not config_values.
-      apiKey: createSystemConfig("text", {
-        backing: "secrets",
-        write: access.systemAdmin,
-        read: access.admin,
-      }),
-      // Control: a plain system config key (config_values, no secrets dispatch).
-      webhookPath: createSystemConfig("text", {
-        default: "/hooks",
-        write: access.systemAdmin,
-        read: access.admin,
-      }),
-    },
-  });
-  // Internal-read probe: a handler that reads its own secrets-backed key via
-  // ctx.config — must receive the revealed plaintext, not the mask.
-  r.queryHandler(
-    "peek-api-key",
-    z.object({}),
-    async (_query, ctx) => {
-      if (!ctx.config) throw new Error("ctx.config not wired");
-      return { value: await ctx.config(API_KEY) };
-    },
-    { access: { roles: ["SystemAdmin"] } },
-  );
-});
-
-let stack: TestStack;
-
-beforeAll(async () => {
-  const masterKeyProvider = createEnvMasterKeyProvider({
-    env: {
-      KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),
-      KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
-    },
-  });
-
-  stack = await setupTestStack({
-    features: [createConfigFeature(), billingFeature],
-    extraContext: ({ db, registry }) => {
-      const resolver = createConfigResolver();
-      return {
-        configResolver: resolver,
-        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
-        secrets: createSecretsContext({ db, masterKeyProvider }),
-      };
-    },
-  });
-  await unsafePushTables(stack.db, { configValuesTable, tenantSecretsTable });
-});
-
-afterAll(async () => {
-  await stack.cleanup();
-});
-
-type Cascades = Record<string, ConfigCascade>;
-
-describe("config backing=secrets — write dispatch", () => {
-  test("set routes the value into the secrets store, not config_values", async () => {
-    await stack.http.writeOk(
-      ConfigHandlers.set,
-      { key: API_KEY, value: "sk-live-abc123", scope: "system" },
-      systemAdmin,
-    );
-
-    const secretRows = await selectMany(stack.db, tenantSecretsTable, {
-      tenantId: SYSTEM_TENANT,
-      key: API_KEY,
-    });
-    expect(secretRows).toHaveLength(1);
-
-    const configRows = await selectMany(stack.db, configValuesTable, { key: API_KEY });
-    expect(configRows).toHaveLength(0);
-  });
-
-  test("the stored secret is an envelope, never the plaintext", async () => {
-    const [row] = await selectMany(stack.db, tenantSecretsTable, {
-      tenantId: SYSTEM_TENANT,
-      key: API_KEY,
-    });
-    // No column of the stored row may carry the plaintext — the secrets
-    // envelope must have encrypted it.
-    expect(JSON.stringify(row)).not.toContain("sk-live-abc123");
-  });
-});
-
-describe("config backing=secrets — read dispatch", () => {
-  test("the owning feature reads the revealed plaintext via ctx.config", async () => {
-    const res = await stack.http.queryOk<{ value: unknown }>(
-      "billing:query:peek-api-key",
-      {},
-      systemAdmin,
-    );
-    // JSON round-trip: set serialized "sk-live-abc123" → resolver reveals +
-    // deserializes back to the original string.
-    expect(res.value).toBe("sk-live-abc123");
-  });
-
-  test("config:query:cascade masks the value AND every level", async () => {
-    const res = await stack.http.queryOk<Cascades>(
-      ConfigQueries.cascade,
-      { keys: [API_KEY] },
-      systemAdmin,
-    );
-    const cascade = res[API_KEY];
-    expect(cascade?.value).toBe("••••••");
-    expect(cascade?.source).toBe("system-row");
-    const systemLevel = cascade?.levels.find((l) => l.source === "system-row");
-    expect(systemLevel?.hasValue).toBe(true);
-    expect(systemLevel?.value).toBe("••••••");
-    expect(JSON.stringify(cascade)).not.toContain("sk-live-abc123");
-  });
-
-  test("config:query:values masks the value", async () => {
-    const res = await stack.http.queryOk<Record<string, { value: unknown; source: string }>>(
-      ConfigQueries.values,
-      {},
-      systemAdmin,
-    );
-    expect(res[API_KEY]?.value).toBe("••••••");
-    expect(res[API_KEY]?.source).toBe("system-row");
-    // The plain control key still resolves transparently.
-    expect(res[PLAIN_KEY]?.value).toBe("/hooks");
-    expect(res[PLAIN_KEY]?.source).toBe("default");
-  });
-});
-
-describe("config backing=secrets — fail-loud when secrets unwired", () => {
-  // The PR's central safety promise: a backing="secrets" key throws loudly at
-  // request time when ctx.secrets is absent — it never silently degrades into
-  // a config_values write. One write exercises the set.write throw site; the
-  // resolver and reset.write guards share the identical `!ctx.secrets` shape.
-  test("set on a backing=secrets key throws internal_error when ctx.secrets is absent", async () => {
-    const unwired = await setupTestStack({
-      features: [createConfigFeature(), billingFeature],
-      extraContext: ({ registry }) => {
-        const resolver = createConfigResolver();
-        return {
-          configResolver: resolver,
-          _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
-          // No `secrets` — the backing="secrets" path must fail loudly.
-        };
-      },
-    });
-    await unsafePushTables(unwired.db, { configValuesTable, tenantSecretsTable });
-
-    try {
-      const err = await unwired.http.writeErr(
-        ConfigHandlers.set,
-        { key: API_KEY, value: "sk-live-should-not-persist", scope: "system" },
-        systemAdmin,
-      );
-      expect(err.code).toBe("internal_error");
-      expect(err.httpStatus).toBe(500);
-
-      // It must NOT have silently fallen back to a config_values row.
-      const configRows = await selectMany(unwired.db, configValuesTable, { key: API_KEY });
-      expect(configRows).toHaveLength(0);
-    } finally {
-      await unwired.cleanup();
-    }
-  });
-
-  test("cascade read on backing=secrets without secretsReader throws", async () => {
-    // Write succeeds on the wired stack; then resolve via a bare resolver
-    // (no secretsReader) so readBackingSecret fails loud on the cascade path.
-    // Direct resolver call is deliberate here, not a bypass: stack.http always
-    // uses a properly-wired resolver (secretsReader present) — there's no
-    // HTTP path that reaches an unwired resolver, so this is the only way to
-    // exercise the missing-secretsReader failure mode (kumiko-framework#1437).
-    await stack.http.writeOk(
-      ConfigHandlers.set,
-      { key: API_KEY, value: "sk-live-planted", scope: "system" },
-      systemAdmin,
-    );
-
-    const bare = createConfigResolver();
-    const keyDef = stack.registry.getConfigKey(API_KEY);
-    expect(keyDef).toBeDefined();
-
-    await expect(
-      bare.getCascade(API_KEY, keyDef!, systemAdmin.tenantId, systemAdmin.id, stack.db),
-    ).rejects.toThrow(/backing="secrets".*without a secrets/);
-  });
-});
-
-describe("config backing=secrets — reset dispatch", () => {
-  test("reset clears the secret; the key falls back to unset", async () => {
-    await stack.http.writeOk(ConfigHandlers.reset, { key: API_KEY, scope: "system" }, systemAdmin);
-
-    const secretRows = await selectMany(stack.db, tenantSecretsTable, {
-      tenantId: SYSTEM_TENANT,
-      key: API_KEY,
-    });
-    expect(secretRows).toHaveLength(0);
-
-    const res = await stack.http.queryOk<{ value: unknown }>(
-      "billing:query:peek-api-key",
-      {},
-      systemAdmin,
-    );
-    // No keyDef.default on apiKey → genuinely unset after the secret is gone.
-    expect(res.value).toBeUndefined();
-  });
-});