@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -12,15 +12,38 @@
 // einem separaten Test mit Hono-mock geprüft.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  configurePiiSubjectKms,
+  decryptPiiFieldValues,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  PII_ERASED_SENTINEL,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { createEventsTable, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createEventsTable,
+  isStreamArchived,
+  loadAggregate,
+} from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
   setupTestStack,
   type TestStack,
   testTenantId,
+  unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import {
+  ComplianceProfileHandlers,
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { subscriptionAggregateId } from "../aggregate-id";
 import {
   SubscriptionEventTypes,
@@ -28,6 +51,8 @@ import {
   SubscriptionStatuses,
 } from "../constants";
 import { billingFoundationFeature } from "../feature";
+import { subscriptionsProjectionTable } from "../projection";
+import { subscriptionTenantDestroyHook } from "../tenant-destroy-hook";
 import type { SubscriptionProviderPlugin } from "../types";
 
 // =============================================================================
@@ -80,16 +105,30 @@ let db: DbConnection;
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [billingFoundationFeature, mockProviderFeature],
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      billingFoundationFeature,
+      mockProviderFeature,
+    ],
   });
   db = stack.db;
   // subscriptionsProjectionTable wird von setupTestStack automatisch
   // gepusht (r.projection mit `table`-Property → auto-push).
   await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
+  // providerCustomerId/providerSubscriptionId are `tenantOwned` PII-subject
+  // fields — no executor wires the KMS automatically here (raw r.projection,
+  // see feature.ts), so process-event.write.ts calls configuredPiiSubjectKms()
+  // directly and needs one configured, same as run{Prod,Dev}App do at boot.
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
 });
 
 afterAll(async () => {
   await stack.cleanup();
+  resetPiiSubjectKmsForTests();
 });
 
 function adminFor(tenantNumber: number) {
@@ -566,3 +605,168 @@ describe("scenario 8: cancel-event setzt status auf canceled, behält subscripti
     expect(subs.rows[0]?.["tier"]).toBe("free");
   });
 });
+
+describe("scenario 9: subscriptionTenantDestroyHook (#800 tenant-destroy PII erasure)", () => {
+  test("default profile → row hard-deleted, stream archived", async () => {
+    const admin = adminFor(3009);
+    await stack.http.writeOk(
+      SubscriptionFoundationHandlers.processEvent,
+      buildEvent({
+        providerEventId: "evt_3009_create",
+        providerCustomerId: "cus_3009",
+        providerSubscriptionId: "sub_3009",
+      }),
+      admin,
+    );
+
+    await subscriptionTenantDestroyHook({ db, tenantId: admin.tenantId });
+
+    const rows = await selectMany(db, subscriptionsProjectionTable, {
+      id: subscriptionAggregateId(admin.tenantId),
+    });
+    expect(rows).toHaveLength(0);
+    expect(
+      await isStreamArchived(db, admin.tenantId, subscriptionAggregateId(admin.tenantId)),
+    ).toBe(true);
+  });
+
+  test("HGB profile → PII redacted, accounting fields + row survive, stream archived", async () => {
+    const admin = adminFor(3010);
+    await stack.http.writeOk(
+      ComplianceProfileHandlers.setProfile,
+      { profileKey: "de-hr-dsgvo-hgb" },
+      admin,
+    );
+    await stack.http.writeOk(
+      SubscriptionFoundationHandlers.processEvent,
+      buildEvent({
+        providerEventId: "evt_3010_create",
+        providerCustomerId: "cus_3010",
+        providerSubscriptionId: "sub_3010",
+        tier: "pro",
+      }),
+      admin,
+    );
+
+    await subscriptionTenantDestroyHook({ db, tenantId: admin.tenantId });
+
+    const rows = await selectMany<{
+      providerCustomerId: string;
+      providerSubscriptionId: string;
+      tier: string;
+      status: string;
+    }>(db, subscriptionsProjectionTable, { id: subscriptionAggregateId(admin.tenantId) });
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.providerCustomerId).toBe("[erased]");
+    expect(rows[0]?.providerSubscriptionId).toBe("[erased]");
+    // accounting facts survive — that's the point of the HGB retention branch
+    expect(rows[0]?.tier).toBe("pro");
+    expect(
+      await isStreamArchived(db, admin.tenantId, subscriptionAggregateId(admin.tenantId)),
+    ).toBe(true);
+  });
+});
+
+describe("scenario 10: PII is encrypted at rest, not just erasable on destroy", () => {
+  test("raw event-log payload and raw projection row both hold ciphertext, not the plaintext provider id", async () => {
+    const admin = adminFor(3011);
+    await stack.http.writeOk(
+      SubscriptionFoundationHandlers.processEvent,
+      buildEvent({
+        providerEventId: "evt_3011_create",
+        providerCustomerId: "cus_3011",
+        providerSubscriptionId: "sub_3011",
+      }),
+      admin,
+    );
+
+    // Raw event-log row (kumiko_events) — archiveStream only stops REPLAY,
+    // it never deletes rows, so if this were plaintext it would sit here
+    // forever regardless of what a later tenant-destroy hook does.
+    const esEvents = await loadAggregate(
+      db,
+      subscriptionAggregateId(admin.tenantId),
+      admin.tenantId,
+    );
+    const createdPayload = esEvents[0]?.payload as
+      | { providerCustomerId?: string; providerSubscriptionId?: string }
+      | undefined;
+    expect(createdPayload?.providerCustomerId).not.toBe("cus_3011");
+    expect(createdPayload?.providerSubscriptionId).not.toBe("sub_3011");
+    expect(isPiiCiphertext(createdPayload?.providerCustomerId)).toBe(true);
+    expect(isPiiCiphertext(createdPayload?.providerSubscriptionId)).toBe(true);
+
+    // Raw projection row — same story, decrypt-on-read (list-query,
+    // get-subscription-for-tenant) is the only path that sees plaintext.
+    const rawRows = await selectMany(db, subscriptionsProjectionTable, {
+      id: subscriptionAggregateId(admin.tenantId),
+    });
+    expect(isPiiCiphertext(rawRows[0]?.["providerCustomerId"])).toBe(true);
+
+    // But the decrypt-on-read query path still returns plaintext to callers.
+    const subs = (await stack.http.queryOk(
+      "billing-foundation:query:subscription:list",
+      {},
+      admin,
+    )) as { rows: Array<Record<string, unknown>> };
+    expect(subs.rows[0]?.["providerCustomerId"]).toBe("cus_3011");
+  });
+
+  test("crypto-shredding: erasing the tenant's subject key makes the event-log payload permanently unreadable (#800)", async () => {
+    const admin = adminFor(3012);
+    await stack.http.writeOk(
+      SubscriptionFoundationHandlers.processEvent,
+      buildEvent({
+        providerEventId: "evt_3012_create",
+        providerCustomerId: "cus_3012",
+        providerSubscriptionId: "sub_3012",
+      }),
+      admin,
+    );
+    const esEventsBefore = await loadAggregate(
+      db,
+      subscriptionAggregateId(admin.tenantId),
+      admin.tenantId,
+    );
+    const ciphertextBefore = (esEventsBefore[0]?.payload as { providerCustomerId?: string })
+      .providerCustomerId as string;
+
+    // This is exactly what tenant-lifecycle's "subject-keys" pipeline stage
+    // (eraseSubjectKeys, stages.ts) does on tenant-destroy — same kms
+    // instance, same subject shape, called directly instead of through the
+    // full destroy pipeline so this test doesn't need to drive 8 stages.
+    const kms = configuredPiiSubjectKms();
+    if (!kms) throw new Error("expected a configured PII-subject KMS in this test stack");
+    await kms.eraseKey(
+      { kind: "tenant", tenantId: admin.tenantId },
+      { requestId: "test:crypto-shred", eraseReason: "test" },
+    );
+
+    // The DEK is gone — the SAME ciphertext that decrypted cleanly a moment
+    // ago now resolves to the erased sentinel, not the original value and
+    // not a crash. That's the actual #800 guarantee: not "redacted in the
+    // read model" but "cryptographically impossible to recover", including
+    // from the raw event-log row nothing in this feature ever deletes.
+    const decrypted = await decryptPiiFieldValues(
+      { providerCustomerId: ciphertextBefore },
+      ["providerCustomerId"],
+      kms,
+      { requestId: "test:crypto-shred-verify" },
+    );
+    expect(decrypted["providerCustomerId"]).toBe(PII_ERASED_SENTINEL);
+    expect(decrypted["providerCustomerId"]).not.toBe("cus_3012");
+  });
+
+  // No backfill job here on purpose: billing-foundation has never shipped
+  // with a live subject KMS, so there is no pre-existing plaintext
+  // subscription data anywhere to migrate — every row that will ever exist
+  // is written through the encrypted path above. If that changes (billing-
+  // foundation goes live before a KMS is configured somewhere), note for
+  // whoever builds the backfill: the existing backfillEventPiiEncryption
+  // (#799, db/queries/backfill-pii.ts) does NOT cover this feature yet —
+  // its lifecycle-event matcher expects `<aggregateType>.<verb>` event
+  // names (billing's are `billing-foundation:event:subscription-created`)
+  // and its custom-event catalog only supports user-subject fields
+  // (`{kind: "user"}`), not the tenant-subject fields billing uses. Closing
+  // that gap is new framework capability, not a wiring fix.
+});

package/src/billing-foundation/__tests__/subscription-provider-contract.ts

@@ -0,0 +1,93 @@
+import { describe, expect, test } from "bun:test";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import type { SubscriptionProviderPlugin } from "../types";
+
+export type SubscriptionProviderContractFixture = {
+  readonly plugin: SubscriptionProviderPlugin;
+  readonly ctx: HandlerContext;
+  readonly checkout: Parameters<
+    NonNullable<SubscriptionProviderPlugin["createCheckoutSession"]>
+  >[1];
+  // Providers without a customer-portal (e.g. Mollie) omit this — the
+  // portal-test then skips, mirroring `createPortalSession` being optional.
+  readonly portal?: Parameters<NonNullable<SubscriptionProviderPlugin["createPortalSession"]>>[1];
+  readonly cancelSubscriptionId?: string;
+  // A real, provider-signed/verifiable webhook payload for the happy path.
+  // Providers without a fixture skip the webhook-parsing test — building one
+  // needs provider-specific signing (Stripe HMAC) or a mocked API client
+  // (Mollie lazy-fetch), which the provider's own verify-webhook.test.ts
+  // already assembles.
+  readonly webhook?: {
+    readonly rawBody: string;
+    readonly headers: Record<string, string>;
+    readonly expectedTenantId: string;
+    readonly expectedTier: string;
+  };
+};
+
+export type SubscriptionProviderContractOptions = {
+  // Providers without portal/cancel support (e.g. Mollie) must say so
+  // explicitly — a bare `if (!plugin.x) return` inside the test body makes
+  // the skip invisible in test output (a coverage illusion: Stripe's
+  // portal/cancel tests and Mollie's "skip" both show as green) (#1339).
+  readonly hasPortal: boolean;
+  readonly hasCancel: boolean;
+};
+
+export function describeSubscriptionProviderContract(
+  name: string,
+  factory: () => SubscriptionProviderContractFixture | Promise<SubscriptionProviderContractFixture>,
+  options: SubscriptionProviderContractOptions,
+): void {
+  describe(`${name} — SubscriptionProviderPlugin contract`, () => {
+    test("implements verifyAndParseWebhook", async () => {
+      const { plugin } = await factory();
+      expect(typeof plugin.verifyAndParseWebhook).toBe("function");
+    });
+
+    test("verifyAndParseWebhook parses a valid provider event into a SubscriptionEvent", async () => {
+      const { plugin, webhook } = await factory();
+      if (!webhook) return;
+      const event = await plugin.verifyAndParseWebhook(webhook.rawBody, webhook.headers);
+      expect(event).not.toBeNull();
+      expect(event?.tenantId).toBe(webhook.expectedTenantId);
+      expect(event?.tier).toBe(webhook.expectedTier);
+    });
+
+    test("createCheckoutSession returns a hosted-page url", async () => {
+      const { plugin, ctx, checkout } = await factory();
+      if (!plugin.createCheckoutSession) return;
+      const result = await plugin.createCheckoutSession(ctx, checkout);
+      expect(typeof result.url).toBe("string");
+      expect(result.url.length).toBeGreaterThan(0);
+    });
+
+    (options.hasPortal ? test : test.skip)(
+      "createPortalSession returns a hosted-page url",
+      async () => {
+        const { plugin, ctx, portal } = await factory();
+        if (!plugin.createPortalSession || !portal) {
+          throw new Error(
+            "describeSubscriptionProviderContract: hasPortal:true but the fixture has no createPortalSession/portal",
+          );
+        }
+        const result = await plugin.createPortalSession(ctx, portal);
+        expect(typeof result.url).toBe("string");
+        expect(result.url.length).toBeGreaterThan(0);
+      },
+    );
+
+    (options.hasCancel ? test : test.skip)(
+      "cancelSubscription resolves without throwing",
+      async () => {
+        const { plugin, ctx, cancelSubscriptionId } = await factory();
+        if (!plugin.cancelSubscription || !cancelSubscriptionId) {
+          throw new Error(
+            "describeSubscriptionProviderContract: hasCancel:true but the fixture has no cancelSubscription/cancelSubscriptionId",
+          );
+        }
+        await expect(plugin.cancelSubscription(ctx, cancelSubscriptionId)).resolves.toBeUndefined();
+      },
+    );
+  });
+}

package/src/billing-foundation/entities.ts

@@ -1,10 +1,9 @@
+import { collectPiiSubjectFields } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   createEntity,
   createTextField,
   createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
-
-// =============================================================================
 // `subscription` — current state pro Plattform-Tenant (= Read-Model)
 // =============================================================================
 //
@@ -41,10 +40,35 @@ export const subscriptionEntity = createEntity({
   table: "read_subscriptions",
   fields: {
     providerName: createTextField({ required: true, maxLength: 50 }),
-    providerCustomerId: createTextField({ required: true, maxLength: 200 }),
-    providerSubscriptionId: createTextField({ required: true, maxLength: 200 }),
+    // tenantOwned (not `encrypted`): the field must crypto-shred when
+    // eraseSubjectKeys erases the tenant's subject key on tenant-destroy
+    // (#800). `encrypted: true` uses the app-wide master key instead — that
+    // key is never erased per-tenant, so it would only add encryption-at-
+    // rest, not the erasure guarantee #800 actually asks for.
+    // maxLength 1000, not 200: the stored value is PII-ciphertext
+    // (`kumiko-pii:v1:<subject>:<blob>`), not the raw provider id — a
+    // 200-char plaintext id becomes ~300+ chars of ciphertext. Matches
+    // subscriptionEventPayloadSchema in events.ts.
+    providerCustomerId: createTextField({
+      required: true,
+      maxLength: 1000,
+      tenantOwned: true,
+    }),
+    providerSubscriptionId: createTextField({
+      required: true,
+      maxLength: 1000,
+      tenantOwned: true,
+    }),
     status: createTextField({ required: true, maxLength: 30 }),
     tier: createTextField({ required: true, maxLength: 50 }),
     currentPeriodEnd: createTimestampField({ required: true }),
   },
 });
+
+// No executor manages this table (raw r.projection, see feature.ts) — the
+// process-event write-handler and every read site must encrypt/decrypt
+// these fields manually via the PII-subject-KMS path (same mechanism
+// eraseSubjectKeys erases). Single source of truth so a future third
+// `tenantOwned`/`pii`/`userOwned` field doesn't need a matching manual
+// update at each call site.
+export const SUBSCRIPTION_PII_FIELDS = collectPiiSubjectFields(subscriptionEntity);

package/src/billing-foundation/events.ts

@@ -51,8 +51,12 @@ const statusEnum = z.enum([
 // payload — payload ist domain-clean, metadata ist provider-truth).
 export const subscriptionEventPayloadSchema = z.object({
   providerName: z.string().min(1).max(50),
-  providerCustomerId: z.string().min(1).max(200),
-  providerSubscriptionId: z.string().min(1).max(200),
+  // 1000, not 200: these two are `tenantOwned: true` on the entity (see
+  // entities.ts — crypto-shreds on tenant-destroy, unlike `encrypted`).
+  // process-event.write.ts stores the PII-ciphertext here, not the raw
+  // provider id. A 200-char plaintext id becomes ~300+ chars of ciphertext.
+  providerCustomerId: z.string().min(1).max(1000),
+  providerSubscriptionId: z.string().min(1).max(1000),
   status: statusEnum,
   tier: z.string().min(1).max(50),
   currentPeriodEndIso: z.string().min(1),

package/src/billing-foundation/feature.ts

@@ -41,8 +41,9 @@
 // (z.B. für analytics: "wie viele Wechsel im Monat?"), kommt ein
 // `subscription-provider-changed`-event-type später.
 
-import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, EXT_TENANT_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { BILLING_FOUNDATION_FEATURE, SUBSCRIPTION_PROVIDER_EXTENSION } from "./constants";
+import { subscriptionEntity } from "./entities";
 import {
   INVOICE_PAID_EVENT_QN,
   INVOICE_PAID_EVENT_SHORT,
@@ -69,6 +70,7 @@ import {
   applySubscriptionUpdated,
   subscriptionsProjectionTable,
 } from "./projection";
+import { subscriptionTenantDestroyHook } from "./tenant-destroy-hook";
 
 export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE, (r) => {
   r.describe(
@@ -79,6 +81,7 @@ export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE
     category: "billing",
     recommended: false,
   });
+  r.requires("tenant-lifecycle", "compliance-profiles");
   // 5 fine-grained domain-events. Alle 5 nutzen denselben payload-
   // shape (= subscription-state-snapshot); der event-type taggt was
   // passiert ist. Future-consumer (billing-history, accounting)
@@ -96,6 +99,7 @@ export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE
     name: "subscription",
     source: SUBSCRIPTION_AGGREGATE_TYPE,
     table: subscriptionsProjectionTable,
+    entity: subscriptionEntity,
     apply: {
       [SUBSCRIPTION_CREATED_EVENT_QN]: applySubscriptionCreated,
       [SUBSCRIPTION_UPDATED_EVENT_QN]: applySubscriptionUpdated,
@@ -124,4 +128,8 @@ export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE
   // Custom list-query auf der subscription-projection (raw drizzle-
   // table; kein r.entity weil Schreiben via projection-apply läuft).
   r.queryHandler(listSubscriptionsQuery);
+
+  r.useExtension(EXT_TENANT_DATA, "subscription", {
+    destroy: subscriptionTenantDestroyHook,
+  });
 });

package/src/billing-foundation/get-subscription-for-tenant.ts

@@ -1,8 +1,13 @@
 // Resolver-helper: liest die current subscription-row für einen Tenant
 // aus der read_subscriptions-projection.
 
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { subscriptionAggregateId } from "./aggregate-id";
+import { SUBSCRIPTION_PII_FIELDS } from "./entities";
 import { subscriptionsProjectionTable } from "./projection";
 
 export type SubscriptionView = {
@@ -24,12 +29,18 @@ export async function getSubscriptionForTenant(
   const rows = await ctx.db.selectMany(subscriptionsProjectionTable, { id: aggId }, { limit: 1 });
   const row = rows[0];
   if (!row) return null;
+  const piiKms = configuredPiiSubjectKms();
+  const decrypted = piiKms
+    ? await decryptPiiFieldValues(row as Record<string, unknown>, SUBSCRIPTION_PII_FIELDS, piiKms, {
+        requestId: `billing-foundation:get-subscription:${tenantId}`,
+      })
+    : (row as Record<string, unknown>);
   // @cast-boundary db-row — drizzle-row carries column-as-unknown
   return {
-    tier: row["tier"] as string,
-    status: row["status"] as string,
-    providerName: row["providerName"] as string,
-    providerCustomerId: row["providerCustomerId"] as string,
-    providerSubscriptionId: row["providerSubscriptionId"] as string,
+    tier: decrypted["tier"] as string,
+    status: decrypted["status"] as string,
+    providerName: decrypted["providerName"] as string,
+    providerCustomerId: decrypted["providerCustomerId"] as string,
+    providerSubscriptionId: decrypted["providerSubscriptionId"] as string,
   };
 }

package/src/billing-foundation/handlers/create-portal-session.write.ts

@@ -10,10 +10,15 @@
 // kennt.
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import { subscriptionAggregateId } from "../aggregate-id";
 import { SUBSCRIPTION_PROVIDER_EXTENSION } from "../constants";
+import { SUBSCRIPTION_PII_FIELDS } from "../entities";
 import { subscriptionsProjectionTable as subTable } from "../projection";
 import type { SubscriptionProviderPlugin } from "../types";
 
@@ -41,8 +46,19 @@ export const createPortalSessionHandler: WriteHandlerDef = {
         "subscription-foundation: no active subscription for this tenant. Create one via create-checkout-session first.",
       );
     }
+    const piiKms = configuredPiiSubjectKms();
+    const decrypted = piiKms
+      ? await decryptPiiFieldValues(
+          row as Record<string, unknown>,
+          SUBSCRIPTION_PII_FIELDS,
+          piiKms,
+          {
+            requestId: `billing-foundation:create-portal-session:${tenantId}`,
+          },
+        )
+      : (row as Record<string, unknown>);
     const providerName = row["providerName"] as string; // @cast-boundary db-row
-    const providerCustomerId = row["providerCustomerId"] as string; // @cast-boundary db-row
+    const providerCustomerId = decrypted["providerCustomerId"] as string; // @cast-boundary db-row
 
     // 2. Plugin-Lookup
     const usages = ctx.registry.getExtensionUsages(SUBSCRIPTION_PROVIDER_EXTENSION);

package/src/billing-foundation/handlers/list-subscriptions.query.ts

@@ -4,8 +4,13 @@
 // tenant-scoped, gibt automatisch nur die row des Callers zurück).
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { SUBSCRIPTION_PII_FIELDS } from "../entities";
 import { subscriptionsProjectionTable } from "../projection";
 
 const listSchema = z.object({}).strict();
@@ -18,6 +23,15 @@ export const listSubscriptionsQuery: QueryHandlerDef = {
     const rows = await selectMany(ctx.db.raw, subscriptionsProjectionTable, {
       tenantId: ctx.user.tenantId,
     });
-    return { rows };
+    const piiKms = configuredPiiSubjectKms();
+    if (!piiKms) return { rows };
+    const decryptedRows = await Promise.all(
+      rows.map((row) =>
+        decryptPiiFieldValues(row as Record<string, unknown>, SUBSCRIPTION_PII_FIELDS, piiKms, {
+          requestId: `billing-foundation:list-subscriptions:${ctx.user.tenantId}`,
+        }),
+      ),
+    );
+    return { rows: decryptedRows };
   },
 };

package/src/billing-foundation/handlers/process-event.write.ts

@@ -12,10 +12,15 @@
 //   3. ctx.unsafeAppendEvent — Inline-projection materialisiert die
 //      `read_subscriptions`-row in derselben TX.
 
+import {
+  configuredPiiSubjectKms,
+  encryptPiiFieldValues,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import { subscriptionAggregateId } from "../aggregate-id";
 import { SubscriptionEventTypes, SubscriptionStatuses } from "../constants";
+import { SUBSCRIPTION_PII_FIELDS, subscriptionEntity } from "../entities";
 import {
   INVOICE_PAID_EVENT_QN,
   INVOICE_PAYMENT_FAILED_EVENT_QN,
@@ -125,13 +130,44 @@ export const processEventHandler: WriteHandlerDef = {
     }
 
     // ---------------------------------------------------------------
-    // 3. Append event auf den subscription-stream. Inline-projection
+    // 3. Encrypt the two provider-subject PII fields before they touch
+    //    storage — this is the ONLY write path onto the subscription
+    //    stream, so encrypting here covers both the event-log payload AND
+    //    (via projection.ts copying the event fields as-is) the
+    //    read_subscriptions row with a single call. The subject is the
+    //    TENANT (tenantOwned) — tenant-destroy's subject-keys stage
+    //    (eraseSubjectKeys) erases exactly this key, so both copies become
+    //    genuinely unreadable (#800) once that stage runs, not just
+    //    "encrypted at rest". No adapter configured = engine off (fields
+    //    stay plaintext, pre-#724-phase-C behavior) — mirrors how the
+    //    event-store-executor treats an absent piiKms().
+    // ---------------------------------------------------------------
+    const piiKms = configuredPiiSubjectKms();
+    const encryptedFields = piiKms
+      ? await encryptPiiFieldValues(
+          {
+            tenantId,
+            providerCustomerId: payload.providerCustomerId,
+            providerSubscriptionId: payload.providerSubscriptionId,
+          },
+          subscriptionEntity,
+          SUBSCRIPTION_PII_FIELDS,
+          piiKms,
+          { requestId: `billing-foundation:process-event:${payload.providerEventId}`, tenantId },
+        )
+      : {
+          providerCustomerId: payload.providerCustomerId,
+          providerSubscriptionId: payload.providerSubscriptionId,
+        };
+
+    // ---------------------------------------------------------------
+    // 4. Append event auf den subscription-stream. Inline-projection
     //    materialisiert die read_subscriptions-row in derselben TX.
     // ---------------------------------------------------------------
     const eventPayload: SubscriptionEventPayload = {
       providerName: payload.providerName,
-      providerCustomerId: payload.providerCustomerId,
-      providerSubscriptionId: payload.providerSubscriptionId,
+      providerCustomerId: encryptedFields["providerCustomerId"] as string,
+      providerSubscriptionId: encryptedFields["providerSubscriptionId"] as string,
       status: payload.status,
       tier: payload.tier,
       currentPeriodEndIso: payload.currentPeriodEndIso,

package/src/billing-foundation/tenant-destroy-hook.ts

@@ -0,0 +1,46 @@
+import { deleteMany, type EntityTableMeta, updateMany } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { archiveStream } from "@cosmicdrift/kumiko-framework/event-store";
+import { resolveProfileForTenant } from "../compliance-profiles";
+import { subscriptionAggregateId } from "./aggregate-id";
+import { SUBSCRIPTION_AGGREGATE_TYPE } from "./events";
+import { subscriptionsProjectionTable } from "./projection";
+
+// providerCustomerId/providerSubscriptionId are `tenantOwned: true` on the
+// entity (envelope-encrypted with the tenant subject key, see entities.ts) —
+// eraseSubjectKeys crypto-shreds them for tenants that hard-delete. HGB
+// can not: it needs the accounting facts (status/tier/period) to survive, so
+// it redacts the projection row directly instead of relying on key erasure.
+const REDACTED_PII_VALUE = "[erased]";
+
+/** Tenant-destroy hook for billing PII (#800). HGB retains the accounting
+ *  row but redacts the two provider-subject PII fields; other profiles
+ *  hard-delete the row. Either way the subscription stream is archived so a
+ *  future projection rebuild can't resurrect what was erased. */
+export async function subscriptionTenantDestroyHook(ctx: {
+  readonly db: import("@cosmicdrift/kumiko-framework/db").DbRunner;
+  readonly tenantId: TenantId;
+}): Promise<void> {
+  const { profile } = await resolveProfileForTenant({
+    db: ctx.db,
+    tenantId: ctx.tenantId,
+  });
+  const aggregateId = subscriptionAggregateId(ctx.tenantId);
+  if (profile.key === "de-hr-dsgvo-hgb") {
+    await updateMany(
+      ctx.db,
+      subscriptionsProjectionTable as EntityTableMeta,
+      { providerCustomerId: REDACTED_PII_VALUE, providerSubscriptionId: REDACTED_PII_VALUE },
+      { id: aggregateId },
+    );
+  } else {
+    await deleteMany(ctx.db, subscriptionsProjectionTable as EntityTableMeta, { id: aggregateId });
+  }
+  await archiveStream(ctx.db, {
+    tenantId: ctx.tenantId,
+    aggregateId,
+    aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
+    archivedBy: "tenant-lifecycle:destroy",
+    reason: "tenant_destroy",
+  });
+}