@cosmicdrift/kumiko-bundled-features 0.328.0 → 0.329.0

package/src/secrets/__tests__/secrets.integration.test.ts

@@ -1,111 +0,0 @@
-// Feature-level integration test for secrets. Pins that the CRUD handlers
-// actually encrypt end-to-end: set stores an envelope (no plaintext), list
-// returns the redactedPreview only, get decrypts back. The sample
-// (samples/secrets-demo) shows the broader rotation + cross-feature flow;
-// this test covers just the feature's own handlers.
-
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { randomBytes } from "node:crypto";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  createEnvMasterKeyProvider,
-  type MasterKeyProvider,
-} from "@cosmicdrift/kumiko-framework/secrets";
-import {
-  createTestUser,
-  setupTestStack,
-  type TestStack,
-  unsafePushTables,
-} from "@cosmicdrift/kumiko-framework/stack";
-import { createSecretsFeature } from "../feature";
-import { createSecretsContext } from "../secrets-context";
-import { type StoredEnvelope, tenantSecretsTable } from "../table";
-
-const admin = createTestUser({
-  id: "00000000-0000-4000-8000-000000000010",
-  tenantId: "00000000-0000-4000-8000-000000000001",
-  roles: ["TenantAdmin"],
-});
-
-let stack: TestStack;
-
-beforeAll(async () => {
-  const provider: MasterKeyProvider = createEnvMasterKeyProvider({
-    env: {
-      KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),
-      KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
-    },
-  });
-
-  stack = await setupTestStack({
-    features: [createSecretsFeature()],
-    extraContext: ({ db }) => ({
-      secrets: createSecretsContext({ db, masterKeyProvider: provider }),
-    }),
-  });
-  // Post-ES: the pre-ES audit table is gone — read-audit rides on the
-  // events-table as tenantSecretRead domain-events. Only the projection
-  // table (tenant_secrets) still needs an explicit push here, since it
-  // belongs to an ES entity (and entity-tables aren't auto-pushed by
-  // setupTestStack).
-  await unsafePushTables(stack.db, { tenant_secrets: tenantSecretsTable });
-});
-
-afterAll(async () => {
-  await stack.cleanup();
-});
-
-describe("secrets feature — CRUD round-trip", () => {
-  test("set + list + delete over HTTP", async () => {
-    // SET: encrypts and stores
-    await stack.http.writeOk(
-      "secrets:write:set",
-      { key: "api.key.x", value: "this-is-secret-value-xyz" },
-      admin,
-    );
-
-    // LIST: preview only, never plaintext
-    const list = await stack.http.queryOk<
-      Array<{ key: string; redactedPreview: string | null; kekVersion: number }>
-    >("secrets:query:list", {}, admin);
-    const row = list.find((r) => r.key === "api.key.x");
-    expect(row).toBeDefined();
-    expect(row?.redactedPreview).not.toBe("this-is-secret-value-xyz");
-    expect(row?.kekVersion).toBe(1);
-
-    // DB row holds an envelope, no plaintext
-    const [dbRow] = await selectMany(stack.db, tenantSecretsTable, {
-      tenantId: admin.tenantId,
-      key: "api.key.x",
-    });
-    if (!dbRow) throw new Error("row missing");
-    const env = dbRow.envelope as StoredEnvelope;
-    expect(env.ciphertext).toBeTruthy();
-    expect(env.kekVersion).toBe(1);
-    expect(JSON.stringify(dbRow)).not.toContain("this-is-secret-value-xyz");
-
-    // DELETE: removes row
-    await stack.http.writeOk("secrets:write:delete", { key: "api.key.x" }, admin);
-    const afterDelete = await stack.http.queryOk<Array<{ key: string }>>(
-      "secrets:query:list",
-      {},
-      admin,
-    );
-    expect(afterDelete.some((r) => r.key === "api.key.x")).toBe(false);
-  });
-
-  test("delete on missing key returns 404", async () => {
-    const err = await stack.http.writeErr("secrets:write:delete", { key: "never.set.this" }, admin);
-    expect(err.code).toBe("not_found");
-  });
-
-  test("non-TenantAdmin cannot set", async () => {
-    const user = createTestUser({
-      id: "00000000-0000-4000-8000-000000000099",
-      tenantId: admin.tenantId,
-      roles: ["User"],
-    });
-    const err = await stack.http.writeErr("secrets:write:set", { key: "attack", value: "x" }, user);
-    expect(err.code).toBe("access_denied");
-  });
-});

package/src/secrets/__tests__/settings-hub-i18n.test.ts

@@ -1,27 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
-import { createConfigFeature } from "../../config/feature";
-import { createSecretsFeature } from "../feature";
-
-// `secrets` is a foundation feature auto-mounted even when `config` is not
-// (dev-server scaffold-app.ts FOUNDATION_FEATURES). A declared r.secret()
-// makes buildConfigFeatureSchema emit a secretsEdit screen + Settings-Hub
-// chrome navs, whose dot-form labels (config.settings.title, etc.) must
-// resolve at boot without the config feature present (fw#2577).
-function stripeSecret() {
-  return defineFeature("stripe", (r) => {
-    r.secret("apiKey", { label: { en: "Stripe API Key" }, scope: "tenant" });
-  });
-}
-
-describe("Settings-Hub chrome i18n keys — secrets without config", () => {
-  test("boots with only the secrets feature mounted (no config feature)", () => {
-    expect(() => validateBoot([createSecretsFeature(), stripeSecret()])).not.toThrow();
-  });
-
-  test("boots with both secrets and config mounted", () => {
-    expect(() =>
-      validateBoot([createSecretsFeature(), createConfigFeature(), stripeSecret()]),
-    ).not.toThrow();
-  });
-});

package/src/secrets/constants.ts

@@ -1,12 +0,0 @@
-// @runtime client
-// secrets bundle constants — default RBAC for set/delete/list (#2296).
-
-import type { AccessRule } from "@cosmicdrift/kumiko-framework/engine";
-
-// Default-RBAC of the set/delete/list handlers, hard-wired to ["TenantAdmin"]
-// before #2296. Apps with their own role vocabulary override via
-// createSecretsFeature({ roles }) or createSecretsFeature({ access }) — the
-// rotate job stays untouched, it's a manual/ops path across all tenants by
-// design, not a per-tenant RBAC surface.
-export const DEFAULT_SECRETS_ROLES = ["TenantAdmin"] as const;
-export const DEFAULT_SECRETS_ACCESS: AccessRule = { roles: DEFAULT_SECRETS_ROLES };

package/src/secrets/db/queries/read.ts

@@ -1,16 +0,0 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { StoredEnvelope } from "../../table";
-
-export async function selectTenantSecretEnvelope(
-  db: DbRunner,
-  tenantId: TenantId,
-  key: string,
-): Promise<StoredEnvelope | undefined> {
-  const rows = await asRawClient(db).unsafe<{ envelope: StoredEnvelope }>(
-    `SELECT envelope FROM read_tenant_secrets WHERE tenant_id = $1 AND key = $2 LIMIT 1`,
-    [tenantId, key],
-  );
-  return rows[0]?.envelope;
-}

package/src/secrets/feature.ts

@@ -1,195 +0,0 @@
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import {
-  type AccessRule,
-  defineFeature,
-  type FeatureDefinition,
-} from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
-import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import * as z from "zod";
-import { DEFAULT_SECRETS_ACCESS } from "./constants";
-import { createDeleteHandler } from "./handlers/delete.write";
-import { createListHandler } from "./handlers/list.query";
-import { rotateJob } from "./handlers/rotate.job";
-import { createSetHandler } from "./handlers/set.write";
-import { secretReadSchema } from "./secrets-context";
-import { tenantSecretEntity, tenantSecretsTable } from "./table";
-
-/**
- * Env-vars contract for the `secrets` feature. Apps merge this via
- * `composeEnvSchema({ features: [secretsFeature, ...] })` so boot-time
- * validation catches a missing/short KEK before the first `.get()` call.
- *
- * Rotation: declare additional versions (V2, V3, …) in the app's `extend`
- * block — the env-master-key-provider scans the env for any
- * `KUMIKO_SECRETS_MASTER_KEY_V<n>` matching `/^KUMIKO_SECRETS_MASTER_KEY_V(\d+)$/`
- * and picks the highest as the active KEK unless
- * `KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION` pins one explicitly.
- */
-export const SECRETS_FEATURE_NAME = "secrets";
-
-export const secretsEnvSchema = z.object({
-  KUMIKO_SECRETS_MASTER_KEY_V1: z
-    .string()
-    .refine((v) => Buffer.from(v, "base64").length === 32, {
-      message: "must be base64-encoded 32 bytes (AES-256 KEK)",
-    })
-    .describe("AES-256 master-key (KEK) for tenant-secrets encryption.")
-    .meta({
-      kumiko: { kms: true, pulumi: { generator: "openssl rand -base64 32", secret: true } },
-    }),
-  KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: z
-    .string()
-    .regex(/^[1-9]\d*$/, "must be a positive integer (V<n> selector)")
-    .default("1")
-    .describe(
-      "Pins the active KEK version. Default '1'. Bump after writing a higher KUMIKO_SECRETS_MASTER_KEY_V<n>.",
-    ),
-});
-
-export {
-  createSecretsContext,
-  type SecretsContext,
-  type SecretsContextOptions,
-  TENANT_SECRET_READ_EVENT,
-} from "./secrets-context";
-export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./table";
-
-// AppContext carries ctx.secrets via extraContext. requireSecretsContext
-// wraps that raw context so every `.get(...)` call auto-includes the
-// current user + handler as audit metadata — feature code can't forget
-// to log the read (silent bypass of audit was the v1 gap).
-//
-// Surface bewusst minimal: HandlerContext-Pfade (Set/Delete-Handler) +
-// FileProviderContext-Pfade (S3-Plugin im Worker) liefern dieselben
-// zwei Felder, also reicht die schmale ctx-shape — kein voller
-// HandlerContext-Import noetig.
-export function requireSecretsContext(
-  ctx: { readonly secrets?: SecretsContext; readonly _userId?: string | undefined },
-  handlerName: string,
-): SecretsContext {
-  if (!ctx.secrets) {
-    throw new InternalError({
-      message:
-        `[${handlerName}] ctx.secrets missing — pass ` +
-        "createSecretsContext({db, masterKeyProvider}) via extraContext.secrets at boot.",
-    });
-  }
-  const raw = ctx.secrets;
-  const userId = ctx._userId;
-  if (!userId) {
-    throw new InternalError({
-      message: `[${handlerName}] ctx._userId missing — cannot audit secret reads without a caller identity.`,
-    });
-  }
-  return {
-    get: (tenantId, key, overrideAudit) =>
-      raw.get(tenantId, key, overrideAudit ?? { userId, handlerName }),
-    // No audit injection: has() is metadata-only and never logs a read.
-    has: raw.has.bind(raw),
-    set: raw.set.bind(raw),
-    delete: raw.delete.bind(raw),
-  };
-}
-
-export type SecretsFeatureOptions = {
-  /** Access rule for the `set`, `delete` and `list` handlers. Default
-   *  { roles: ["TenantAdmin"] }. Adopt the host's role vocabulary with
-   *  { roles: [...] }, or { openToAll: { reason: "..." } } to let any authenticated tenant
-   *  user manage secrets — note this is a much larger blast radius than the
-   *  default: tenant credentials (API keys, tokens) become writable/deletable,
-   *  and their previews/hints listable, by every tenant member, not just
-   *  admins. Mutually exclusive with `roles`. The `rotate` job is unaffected —
-   *  it's a manual, cross-tenant ops path, not per-tenant RBAC. */
-  readonly access?: AccessRule;
-  /** Shorthand for { access: { roles } }. Mutually exclusive with `access`. */
-  readonly roles?: readonly string[];
-};
-
-function resolveSecretsAccess(opts: SecretsFeatureOptions): AccessRule {
-  if (opts.access !== undefined && opts.roles !== undefined) {
-    throw new InternalError({
-      message:
-        "createSecretsFeature: pass either `access` or `roles`, not both — " +
-        "`access` previously silently discarded `roles`, which looks like a refinement.",
-    });
-  }
-  if (opts.access !== undefined) return opts.access;
-  if (opts.roles !== undefined) return { roles: opts.roles };
-  return DEFAULT_SECRETS_ACCESS;
-}
-
-export function createSecretsFeature(opts: SecretsFeatureOptions = {}): FeatureDefinition {
-  const access = resolveSecretsAccess(opts);
-  return defineFeature(SECRETS_FEATURE_NAME, (r) => {
-    r.describe(
-      'Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins).',
-    );
-    r.uiHints({
-      displayLabel: "Tenant Secrets",
-      category: "infrastructure",
-      recommended: true,
-    });
-    r.envSchema(secretsEnvSchema);
-
-    // `secrets` is a foundation feature auto-mounted even when `config` is
-    // not (see FOUNDATION_FEATURES, dev-server scaffold-app.ts), so it must
-    // ship the Settings-Hub chrome keys itself — server-authored
-    // r.translations are projected into FeatureSchema.translations and used
-    // as a client fallback bundle (create-app.tsx schemaTranslations),
-    // covering both boot-time validation and rendering without a web
-    // client-plugin for this feature.
-    r.translations({ keys: SETTINGS_HUB_I18N });
-
-    // ES entity: set/delete go through the executor, `tenantSecret.created/
-    // .updated/.deleted` events land on the aggregate stream. Reads fire a
-    // separate `tenantSecretRead` event per call (see secrets-context.get
-    // for the one-event-per-read rationale).
-    // Backing table: envelope/metadata/last_rotated_at + the (tenant,key)
-    // uniqueIndex are not expressible via the field-DSL (jsonb-without-default,
-    // now()-default), so the physical table is the DDL truth. Without this the
-    // generated migration omitted those columns → prod-500 (publicstatus#116).
-    r.entity("tenant-secret", tenantSecretEntity, { table: tenantSecretsTable });
-
-    // Read-audit domain-event. Registered here so ops tools + MSPs can
-    // discover the type; secrets-context.get parses payloads against
-    // `secretReadSchema` at write time because the low-level append() path
-    // skips ctx.appendEvent's schema-validation guard.
-    r.defineEvent("read", secretReadSchema, { piiFields: "none" });
-
-    // Per-tenant handlers (set/delete/list) run in the default tenant-scope,
-    // giving them the automatic ctx.db tenant-filter as extra defense.
-    // The rotation job deliberately reaches for ctx.db.unsafeRaw() (raw,
-    // cross-tenant) because rotation is a deployment-wide operation — no
-    // feature-wide r.systemScope() needed.
-    r.writeHandler(createSetHandler(access));
-    r.writeHandler(createDeleteHandler(access));
-    r.queryHandler(createListHandler(access));
-    // Manual-only by design: ops triggers rotation after a KEK version flip.
-    // BullMQ delivers to exactly one worker, so running it against a busy
-    // table on multiple instances is still safe.
-    r.job({
-      name: "rotate",
-      trigger: { manual: true },
-      escapeHatch: {
-        reason: "re-encrypts every tenant's secrets with the new master key",
-      },
-      handler: (payload, ctx) =>
-        rotateJob(
-          payload,
-          ctx,
-          ctx.db.unsafeRaw(
-            "re-encrypts every tenant's secrets with the new master key",
-          ) as DbConnection, // @cast-boundary db-operator — jobs never run inside a DbTx
-        ),
-    });
-
-    // Pre-ES had a separate `retention-cleanup` job scrubbing the audit
-    // table on a compliance-driven schedule (90d default). Post-ES the
-    // read-audit lives on the events-table as tenantSecretRead events;
-    // retention for those flows through the framework-wide `pruneEvents`
-    // ops-tool (see docs/plans/architecture/event-dispatcher.md §retention).
-    // No per-feature retention-job anymore.
-  });
-}

package/src/secrets/handlers/delete.write.ts

@@ -1,26 +0,0 @@
-import { type AccessRule, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
-import * as z from "zod";
-import { DEFAULT_SECRETS_ACCESS } from "../constants";
-import { requireSecretsContext } from "../feature";
-
-export function createDeleteHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
-  return defineWriteHandler({
-    name: "delete",
-    description:
-      "Permanently removes the stored secret under the given key for the caller's tenant, breaking every feature that depends on that credential.",
-    agent: { risk: "high" },
-    schema: z.object({
-      key: z.string().min(1).max(100),
-    }),
-    access,
-    handler: async (event, ctx) => {
-      const secrets = requireSecretsContext(ctx, "secrets:write:delete");
-      const removed = await secrets.delete(event.user.tenantId, event.payload.key, {
-        deletedBy: event.user.id,
-      });
-      if (!removed) return failNotFound("tenant-secret", event.payload.key);
-      return { isSuccess: true, data: { key: event.payload.key } };
-    },
-  });
-}

package/src/secrets/handlers/list.query.ts

@@ -1,40 +0,0 @@
-import { type AccessRule, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import * as z from "zod";
-import { DEFAULT_SECRETS_ACCESS } from "../constants";
-import { tenantSecretsTable } from "../table";
-
-// Lists all secrets for the current tenant. Returns redactedPreview, never
-// the plaintext. Decryption would be pointless here anyway — this is the
-// TenantAdmin UI, not feature code that needs the value.
-export function createListHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
-  return defineQueryHandler({
-    name: "list",
-    description:
-      "Lists the secrets stored for the caller's tenant by key with a redacted preview, hint, key version and rotation date — never the plaintext; use it to check which credentials are set.",
-    schema: z.object({}),
-    access,
-    handler: async (event, ctx) => {
-      const rows = await ctx.db.selectMany<{
-        key: string;
-        kekVersion: number;
-        metadata: { redactedPreview?: string; hint?: string };
-        lastRotatedAt: unknown;
-        insertedAt: unknown;
-      }>(
-        tenantSecretsTable,
-        { tenantId: event.user.tenantId },
-        {
-          orderBy: { col: "key", direction: "asc" },
-        },
-      );
-      return rows.map((r) => ({
-        key: r.key,
-        redactedPreview: r.metadata.redactedPreview ?? null,
-        hint: r.metadata.hint ?? null,
-        kekVersion: r.kekVersion,
-        lastRotatedAt: r.lastRotatedAt,
-        createdAt: r.insertedAt,
-      }));
-    },
-  });
-}

package/src/secrets/handlers/rotate.job.ts

@@ -1,166 +0,0 @@
-// Rotation job. Scans tenant_secrets for rows whose kekVersion is older
-// than provider.currentVersion() and rewraps their DEK under the new KEK
-// — the ciphertext itself never changes, only the 60-byte DEK wrapper
-// and the kek_version column. See architecture/core-secrets.md for the
-// full rotation story.
-//
-// The job is idempotent: re-running it after a partial failure picks up
-// the remaining old-version rows. Consumers that want a time-bound run
-// pass a maxDurationMs in the payload.
-//
-// Post-ES pivot: each rotation is an executor.update against the
-// tenantSecret aggregate. The resulting `.updated` event carries
-// {changes, previous} with BOTH envelopes — useful for a full rotation
-// audit trail (when did row X flip from v1 to v2, who triggered it).
-// Concurrency-guard shifts from the pre-ES `WHERE kek_version = old`
-// check to the executor's stream-version check; a parallel secrets.set
-// that landed the row on the new kekVersion first surfaces here as a
-// version_conflict error (counted as "skipped", not "failed").
-
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  createEventStoreExecutor,
-  createTenantDb,
-  type DbConnection,
-  type TenantDb,
-} from "@cosmicdrift/kumiko-framework/db";
-import type { JobContext, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import {
-  decodeStoredEnvelope,
-  encodeStoredEnvelope,
-  rewrapDek,
-} from "@cosmicdrift/kumiko-framework/secrets";
-import { type ChunkedMigrationStopReason, runChunkedMigration } from "../../shared";
-import { type StoredEnvelope, tenantSecretEntity, tenantSecretsTable } from "../table";
-
-const DEFAULT_BATCH_SIZE = 100;
-const DEFAULT_MAX_FAILURES = 10;
-const SYSTEM_ROLES = ["system"] as const;
-
-const executor = createEventStoreExecutor(tenantSecretsTable, tenantSecretEntity, {
-  entityName: "tenant-secret",
-});
-
-export type RotateJobPayload = {
-  readonly batchSize?: number;
-  readonly maxDurationMs?: number;
-  readonly maxFailures?: number;
-};
-
-export type RotateJobResult = {
-  readonly migrated: number;
-  readonly failed: number;
-  readonly batchesProcessed: number;
-  readonly stoppedReason: ChunkedMigrationStopReason;
-};
-
-export async function rotateJob(
-  rawPayload: Record<string, unknown>,
-  ctx: JobContext,
-  db: DbConnection,
-): Promise<void> {
-  const payload = rawPayload as RotateJobPayload; // @cast-boundary engine-payload
-  if (!ctx.masterKeyProvider) {
-    throw new InternalError({
-      message:
-        "[secrets:rotate] ctx.masterKeyProvider missing — wire it via extraContext.masterKeyProvider at boot.",
-    });
-  }
-  const provider = ctx.masterKeyProvider;
-  const batchSize = payload.batchSize ?? DEFAULT_BATCH_SIZE;
-  const maxFailures = payload.maxFailures ?? DEFAULT_MAX_FAILURES;
-  const deadline = payload.maxDurationMs
-    ? Date.now() + payload.maxDurationMs
-    : Number.POSITIVE_INFINITY;
-
-  // Reuse a TenantDb-per-tenant map so we don't rebuild the wrapper for
-  // each row in the same tenant. Rotation typically hits one tenant in a
-  // batch; the map trims an allocation without adding complexity.
-  const tdbCache = new Map<TenantId, TenantDb>();
-  function tdbFor(tenantId: TenantId): TenantDb {
-    let existing = tdbCache.get(tenantId);
-    if (!existing) {
-      existing = createTenantDb(db, tenantId, "system");
-      tdbCache.set(tenantId, existing);
-    }
-    return existing;
-  }
-
-  type SecretRow = {
-    id: string;
-    tenantId: string;
-    version: number;
-    envelope: StoredEnvelope;
-    kekVersion: number;
-  };
-
-  // A partial batch means the ne-filter is exhausted — the next re-query
-  // would only re-serve rows that failed above; end the run instead.
-  let sawPartialBatch = false;
-  async function nextBatch(): Promise<readonly SecretRow[]> {
-    if (sawPartialBatch) return [];
-    const batch = await selectMany<SecretRow>(
-      db,
-      tenantSecretsTable,
-      { kekVersion: { ne: provider.currentVersion() } },
-      { limit: batchSize },
-    );
-    if (batch.length < batchSize) sawPartialBatch = true;
-    return batch;
-  }
-
-  async function migrateRow(row: SecretRow): Promise<"migrated" | "skipped" | "failed"> {
-    const rotated = await rewrapDek(decodeStoredEnvelope(row.envelope), provider);
-    if (rotated.kekVersion === row.kekVersion) return "skipped";
-
-    const actor: SessionUser = {
-      id: "system",
-      tenantId: row.tenantId as TenantId,
-      roles: SYSTEM_ROLES,
-    };
-    const result = await executor.update(
-      {
-        id: row.id,
-        version: row.version,
-        changes: {
-          envelope: encodeStoredEnvelope(rotated),
-          kekVersion: rotated.kekVersion,
-        },
-      },
-      actor,
-      tdbFor(row.tenantId as TenantId),
-    );
-
-    // version_conflict == another writer (secrets.set or a parallel
-    // rotation worker) beat us — the row is already in a valid state,
-    // potentially even past target.
-    if (!result.isSuccess) {
-      if (result.error.code === "version_conflict") return "skipped";
-      ctx.log?.warn?.(`[secrets:rotate] executor rejected row ${row.id}`, {
-        code: result.error.code,
-      });
-      return "failed";
-    }
-    return "migrated";
-  }
-
-  const outcome = await runChunkedMigration<SecretRow>({
-    nextBatch,
-    migrateRow,
-    maxFailures,
-    deadlineAt: deadline,
-    signal: ctx.signal,
-    onRowError: (row, err) => {
-      ctx.log?.warn?.(`[secrets:rotate] failed to rotate row ${row.id}`, { err });
-    },
-  });
-
-  const result: RotateJobResult = {
-    migrated: outcome.migrated,
-    failed: outcome.failed,
-    batchesProcessed: outcome.batchesProcessed,
-    stoppedReason: outcome.stoppedReason,
-  };
-  ctx.log?.info?.(`[secrets:rotate] complete: ${JSON.stringify(result)}`);
-}

package/src/secrets/handlers/set.write.ts

@@ -1,58 +0,0 @@
-import { type AccessRule, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import * as z from "zod";
-import { DEFAULT_SECRETS_ACCESS } from "../constants";
-import { requireSecretsContext } from "../feature";
-
-export function createSetHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
-  return defineWriteHandler({
-    name: "set",
-    description:
-      "Stores or replaces one encrypted secret for the caller's tenant under the given key, together with a redacted preview and optional hint; use it to enter or rotate a credential.",
-    // `value` is the plaintext credential: as a tool call it would travel to
-    // the model provider before it is ever encrypted at rest.
-    agent: { expose: false },
-    schema: z.object({
-      key: z.string().min(1).max(100),
-      value: z.string(),
-      // Optional fixed-length preview — if the caller's UI wants a domain-
-      // specific redaction ("sk_live_abc…xyz") it can send it here; else the
-      // handler derives a generic one (first-3-chars + bullets).
-      redactedPreview: z.string().max(50).optional(),
-      hint: z.string().max(200).optional(),
-    }),
-    access,
-    handler: async (event, ctx) => {
-      const secrets = requireSecretsContext(ctx, "secrets:write:set");
-      const { key, value, redactedPreview, hint } = event.payload;
-
-      // Preview-priority: explicit payload param > feature-declared redact
-      // (via r.secret()) > generic default. A feature that declared a
-      // domain-aware redact (Stripe keys: "sk_test...2345") wins over the
-      // framework default unless the caller sent a specific preview.
-      const keyDef = ctx.registry.getSecretKey(key);
-      const featureRedact = keyDef?.redact;
-      const redactFn: (v: string) => string = redactedPreview
-        ? () => redactedPreview
-        : (featureRedact ?? defaultRedact);
-
-      await secrets.set(event.user.tenantId, key, value, {
-        redact: redactFn,
-        ...(hint ? { hint } : {}),
-        updatedBy: event.user.id,
-      });
-
-      return {
-        isSuccess: true,
-        data: { key, redactedPreview: redactedPreview ?? redactFn(value) },
-      };
-    },
-  });
-}
-
-// Fallback redaction: show at most the first 3 chars + trailing bullets.
-// Deliberately conservative — a too-generous preview defeats the point.
-function defaultRedact(value: string): string {
-  if (value.length === 0) return "";
-  const prefix = value.slice(0, Math.min(3, value.length));
-  return `${prefix}${"•".repeat(Math.max(1, value.length - 3))}`;
-}