@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/compliance-profiles/web/compliance-profile-screen.tsx

@@ -0,0 +1,152 @@
+// @runtime client
+import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { FormScreenShell } from "@cosmicdrift/kumiko-renderer-web";
+import { type ReactNode, useCallback, useEffect, useState } from "react";
+import { ComplianceProfileHandlers, ComplianceProfileQueries } from "../constants";
+
+type ProfileSummary = {
+  readonly key: string;
+  readonly region: string;
+  readonly label: string;
+  readonly authorityContact: string;
+};
+
+type ListProfilesResponse = {
+  readonly profiles: readonly ProfileSummary[];
+};
+
+type CurrentProfileResponse = {
+  readonly key: string;
+  readonly label: string;
+  readonly region: string;
+  readonly warning?: string;
+};
+
+type State =
+  | { readonly kind: "loading" }
+  | { readonly kind: "error"; readonly message: string }
+  | {
+      readonly kind: "ready";
+      readonly profiles: readonly ProfileSummary[];
+      readonly current: CurrentProfileResponse | null;
+    };
+
+export function ComplianceProfileScreen(): ReactNode {
+  const t = useTranslation();
+  const { Banner, Button, Card, Field, Form, Heading, Input, Text } = usePrimitives();
+  const dispatcher = useDispatcher();
+  const [state, setState] = useState<State>({ kind: "loading" });
+  const [selected, setSelected] = useState("");
+  const [saving, setSaving] = useState(false);
+  const [actionError, setActionError] = useState<string | null>(null);
+
+  const load = useCallback(async (): Promise<void> => {
+    setState({ kind: "loading" });
+    const [profilesRes, currentRes] = await Promise.all([
+      dispatcher.query<ListProfilesResponse>(ComplianceProfileQueries.listProfiles, {}),
+      dispatcher.query<CurrentProfileResponse>(ComplianceProfileQueries.forTenant, {}),
+    ]);
+    if (!profilesRes.isSuccess) {
+      setState({ kind: "error", message: profilesRes.error.message });
+      return;
+    }
+    if (!currentRes.isSuccess) {
+      setState({ kind: "error", message: currentRes.error.message });
+      return;
+    }
+    setSelected(currentRes.data.key);
+    setState({ kind: "ready", profiles: profilesRes.data.profiles, current: currentRes.data });
+  }, [dispatcher]);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  const onSave = (): void => {
+    void (async (): Promise<void> => {
+      if (selected === "") return;
+      setActionError(null);
+      setSaving(true);
+      const res = await dispatcher.write(ComplianceProfileHandlers.setProfile, {
+        profileKey: selected,
+      });
+      setSaving(false);
+      if (!res.isSuccess) {
+        setActionError(res.error.message);
+        return;
+      }
+      await load();
+    })();
+  };
+
+  if (state.kind === "loading") {
+    return (
+      <FormScreenShell testId="compliance-profile-screen">
+        <Text variant="small">{t("compliance.profile.loading")}</Text>
+      </FormScreenShell>
+    );
+  }
+
+  if (state.kind === "error") {
+    return (
+      <FormScreenShell testId="compliance-profile-screen">
+        <Banner variant="error">{state.message}</Banner>
+      </FormScreenShell>
+    );
+  }
+
+  const profileOptions = state.profiles.map((profile) => ({
+    value: profile.key,
+    label: `${profile.label} (${profile.key})`,
+  }));
+
+  return (
+    <FormScreenShell testId="compliance-profile-screen" className="flex flex-col gap-6">
+      <Heading variant="page">{t("compliance.profile.title")}</Heading>
+
+      {state.current !== null && (
+        <Banner variant="info" testId="compliance-current-profile">
+          {t("compliance.profile.current")}: {state.current.label} ({state.current.key})
+        </Banner>
+      )}
+
+      <Form
+        onSubmit={onSave}
+        actions={
+          <Button
+            type="submit"
+            variant="primary"
+            disabled={saving || selected === ""}
+            loading={saving}
+            testId="compliance-profile-save"
+          >
+            {saving ? t("compliance.profile.saving") : t("compliance.profile.save")}
+          </Button>
+        }
+      >
+        <Field id="compliance-profile-select" label={t("compliance.profile.select")} required>
+          <Input
+            kind="select"
+            id="compliance-profile-select"
+            name="compliance-profile-select"
+            value={selected}
+            onChange={setSelected}
+            options={profileOptions}
+            required
+          />
+        </Field>
+        {actionError !== null && <Banner variant="error">{actionError}</Banner>}
+      </Form>
+
+      <Card slots={{ title: t("compliance.profile.catalog") }}>
+        <ul className="flex flex-col gap-2 text-sm">
+          {state.profiles.map((profile) => (
+            <li key={profile.key} data-profile-key={profile.key}>
+              <strong>{profile.label}</strong> — {profile.region} — {profile.authorityContact}
+            </li>
+          ))}
+        </ul>
+      </Card>
+    </FormScreenShell>
+  );
+}

package/src/compliance-profiles/web/i18n.ts

@@ -0,0 +1,25 @@
+// @runtime client
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+
+export const defaultTranslations: TranslationsByLocale = {
+  de: {
+    "compliance.profile.title": "Compliance-Profil",
+    "compliance.profile.loading": "Lade Compliance-Profile…",
+    "compliance.profile.current": "Aktuell",
+    "compliance.profile.select": "Profil",
+    "compliance.profile.save": "Profil speichern",
+    "compliance.profile.saving": "Speichert…",
+    "compliance.profile.catalog": "Verfügbare Profile",
+    "compliance-profiles:nav.profilePicker": "Compliance",
+  },
+  en: {
+    "compliance.profile.title": "Compliance profile",
+    "compliance.profile.loading": "Loading compliance profiles…",
+    "compliance.profile.current": "Current",
+    "compliance.profile.select": "Profile",
+    "compliance.profile.save": "Save profile",
+    "compliance.profile.saving": "Saving…",
+    "compliance.profile.catalog": "Available profiles",
+    "compliance-profiles:nav.profilePicker": "Compliance",
+  },
+};

package/src/compliance-profiles/web/index.ts

@@ -0,0 +1,6 @@
+// @runtime client
+export {
+  type ComplianceProfilesClientOptions,
+  complianceProfilesClient,
+} from "./client-plugin";
+export { ComplianceProfileScreen } from "./compliance-profile-screen";

package/src/config/__tests__/app-overrides.test.ts

@@ -115,4 +115,15 @@ describe("validateAppOverrides", () => {
       }),
     ).toThrow(/computed resolver.*app-overrides would silently bypass/i);
   });
+
+  test("throws on type mismatch — text key, number value", () => {
+    const reg = registryStub({
+      "a:config:s": createTenantConfig("text"),
+    });
+    expect(() =>
+      validateAppOverrides(reg, {
+        "a:config:s": 42,
+      }),
+    ).toThrow(/expected string, got number/i);
+  });
 });

package/src/config/__tests__/backing-secrets.integration.test.ts

@@ -203,6 +203,28 @@ describe("config backing=secrets — fail-loud when secrets unwired", () => {
       await unwired.cleanup();
     }
   });
+
+  test("cascade read on backing=secrets without secretsReader throws", async () => {
+    // Write succeeds on the wired stack; then resolve via a bare resolver
+    // (no secretsReader) so readBackingSecret fails loud on the cascade path.
+    // Direct resolver call is deliberate here, not a bypass: stack.http always
+    // uses a properly-wired resolver (secretsReader present) — there's no
+    // HTTP path that reaches an unwired resolver, so this is the only way to
+    // exercise the missing-secretsReader failure mode (kumiko-framework#1437).
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: API_KEY, value: "sk-live-planted", scope: "system" },
+      systemAdmin,
+    );
+
+    const bare = createConfigResolver();
+    const keyDef = stack.registry.getConfigKey(API_KEY);
+    expect(keyDef).toBeDefined();
+
+    await expect(
+      bare.getCascade(API_KEY, keyDef!, systemAdmin.tenantId, systemAdmin.id, stack.db),
+    ).rejects.toThrow(/backing="secrets".*without a secrets/);
+  });
 });
 
 describe("config backing=secrets — reset dispatch", () => {

package/src/config/__tests__/cascade.integration.test.ts

@@ -527,3 +527,38 @@ describe("config:query:cascade handler", () => {
     expect(data[TENANT_KEY]).toBeDefined();
   });
 });
+
+// getAll is public ConfigResolver surface (packages/types/src/config.ts)
+// for app authors that need every config key for a scope at once (bulk
+// export/backup tooling, admin dashboards) — NOT wired to any handler in
+// this repo. `resolver.getAll(...)` is the ONLY call site in the whole
+// codebase (verified via grep, kumiko-framework#1529); there is no handler
+// to route this through, so calling it directly isn't the
+// handfed-context/createTestDispatcher anti-pattern the "echte HTTP-Calls"
+// rule targets — that rule is about bypassing a REAL handler's dispatch
+// path, and none exists here to bypass. This deliberately stays in the
+// .integration.test.ts file rather than a standalone .test.ts because it
+// shares the cascadeFeature/seed fixture above (duplicating that ~100-line
+// setup just to rename the file would cost more than it buys — see
+// kumiko-framework#1437).
+describe("getAll", () => {
+  test("getAll picks the most specific row (user > tenant > system)", async () => {
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: TENANT_KEY, value: "TENANT_BULK" },
+      tenantAdmin,
+    );
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: USER_KEY, value: "USER_BULK" },
+      tenantAdmin,
+    );
+
+    const all = await resolver.getAll(tenantAdmin.tenantId, tenantAdmin.id, db);
+    // getAll returns raw stored strings (JSON-serialized); deserialize for asserts.
+    expect(JSON.parse(all.get(TENANT_KEY)?.value ?? "null")).toBe("TENANT_BULK");
+    expect(JSON.parse(all.get(USER_KEY)?.value ?? "null")).toBe("USER_BULK");
+    // System seed still present for keys without a more-specific row.
+    expect(JSON.parse(all.get(SYSTEM_KEY)?.value ?? "null")).toBe("SEED_SYSTEM");
+  });
+});

package/src/config/__tests__/config.integration.test.ts

@@ -1,11 +1,7 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  createEncryptionProvider,
-  type DbConnection,
-  seedConfigValues,
-} from "@cosmicdrift/kumiko-framework/db";
+import { type DbConnection, seedConfigValues } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createSeed,
@@ -24,7 +20,10 @@ import {
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { expectErrorIncludes } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createTestEnvelopeCipher,
+  expectErrorIncludes,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { z } from "zod";
 import { ConfigHandlers, ConfigQueries } from "../constants";
 import { createConfigAccessor, createConfigAccessorFactory, createConfigFeature } from "../feature";
@@ -132,17 +131,34 @@ const ordersFeature = defineFeature("orders", (r) => {
   });
 });
 
+// r.config() shorthand — single-key sibling of r.config({keys}), same
+// wiring end-to-end (registry → resolver → ctx.config). No seeds needed here.
+const configKeyDemoFeature = defineFeature("configkeydemo", (r) => {
+  r.requires("config");
+  const betaEnabled = r.config(
+    "betaEnabled",
+    createTenantConfig("boolean", { default: false, write: access.roles("Admin") }),
+  );
+  return { betaEnabled };
+});
+
 // Probe feature: a real writeHandler reads two configs through ctx.config
 // so the dispatcher-wiring path is exercised end-to-end (not just the
 // factory in isolation). Captures the resolved values for the test to assert.
-const probe: { orders: number | undefined; push: boolean | undefined } = {
+const probe: {
+  orders: number | undefined;
+  push: boolean | undefined;
+  betaEnabled: boolean | undefined;
+} = {
   orders: undefined,
   push: undefined,
+  betaEnabled: undefined,
 };
 const probeFeature = defineFeature("probe", (r) => {
   r.requires("config");
   r.requires("orders");
   r.requires("notifications");
+  r.requires("configkeydemo");
 
   r.writeHandler(
     "read-config",
@@ -151,7 +167,11 @@ const probeFeature = defineFeature("probe", (r) => {
       if (!ctx.config) throw new Error("ctx.config not wired — _configAccessorFactory missing");
       probe.orders = await ctx.config(ordersFeature.exports.maxOrderCount);
       probe.push = await ctx.config(notificationsFeature.exports.pushEnabled);
-      return { isSuccess: true, data: { orders: probe.orders, push: probe.push } };
+      probe.betaEnabled = await ctx.config(configKeyDemoFeature.exports.betaEnabled);
+      return {
+        isSuccess: true,
+        data: { orders: probe.orders, push: probe.push, betaEnabled: probe.betaEnabled },
+      };
     },
     { access: { openToAll: true } },
   );
@@ -257,8 +277,8 @@ const transportFeature = defineFeature("transport", (r) => {
 const testEncryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(testEncryptionKey);
-  resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(testEncryptionKey);
+  resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [
@@ -268,6 +288,7 @@ beforeAll(async () => {
       notificationsFeature,
       ordersFeature,
       integrationFeature,
+      configKeyDemoFeature,
       probeFeature,
       seedFeature,
       transportFeature,
@@ -782,12 +803,38 @@ describe("ctx.config() in handler context", () => {
     // Reset so prior test order doesn't pollute the assertion.
     probe.orders = undefined;
     probe.push = undefined;
+    probe.betaEnabled = undefined;
     await stack.http.writeOk("probe:write:read-config", {}, tenantAdmin);
     // The probe handler ran ctx.config(handle) for both keys — typeof
     // catches the regression where the handle path silently returns the
     // broad union instead of the narrowed primitive.
     expect(typeof probe.orders).toBe("number");
     expect(typeof probe.push).toBe("boolean");
+    // r.config()'s handle goes through the exact same ctx.config() path.
+    // (value-level check — true vs. false — is covered by the next test,
+    // which reads via configFn without the narrowing hazard of a plain
+    // `undefined`-initialized probe field.)
+    expect(typeof probe.betaEnabled).toBe("boolean");
+  });
+
+  test("r.config() single-key form value is settable/readable via ctx.config", async () => {
+    expect(configKeyDemoFeature.exports.betaEnabled.name).toBe("configkeydemo:config:beta-enabled");
+
+    const configFn = createConfigAccessor(
+      stack.registry,
+      resolver,
+      tenantAdmin.tenantId,
+      tenantAdmin.id,
+      db,
+    );
+    expect(await configFn(configKeyDemoFeature.exports.betaEnabled)).toBe(false);
+
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: "configkeydemo:config:beta-enabled", value: true },
+      tenantAdmin,
+    );
+    expect(await configFn(configKeyDemoFeature.exports.betaEnabled)).toBe(true);
   });
 });
 
@@ -1039,6 +1086,20 @@ describe("encrypted config", () => {
     const value = await configFn("integration:config:api-secret");
     expect(value).toBe("sk-super-secret-key-12345");
   });
+
+  test("reading an encrypted value with no cipher wired throws instead of leaking ciphertext", async () => {
+    const noCipherResolver = createConfigResolver({});
+    const configFn = createConfigAccessor(
+      stack.registry,
+      noCipherResolver,
+      "00000000-0000-4000-8000-000000000001",
+      systemAdmin.id,
+      db,
+    );
+    await expect(configFn("integration:config:api-secret")).rejects.toThrow(
+      /encrypted but no cipher/,
+    );
+  });
 });
 
 // --- Config lifecycle events ---

package/src/config/__tests__/deserialize-value.test.ts

@@ -1,12 +1,9 @@
 import { describe, expect, test } from "bun:test";
 import { deserializeValue } from "../resolver";
 
-// deserializeValue is the read boundary for every config value: the DB stores
-// the JSON-encoded raw string, this turns it back into a typed primitive per the
-// key's declared `type`. The coercion has non-obvious paths worth pinning so a
-// refactor can't quietly change them: a stored value whose JSON type disagrees
-// with the declared type is NOT rejected — it is coerced (number via Number(),
-// boolean only via literal true / the string "true", text via String()).
+// Type mismatches are coerced, not rejected (number via Number(), boolean
+// only via literal true/"true", text via String()) — pinned so a refactor
+// can't quietly change that.
 
 describe("deserializeValue", () => {
   test("null raw short-circuits to undefined before any parse", () => {
@@ -32,8 +29,8 @@ describe("deserializeValue", () => {
       expect(deserializeValue("true", "number")).toBe(1);
     });
 
-    test("an uncoercible value yields NaN rather than throwing", () => {
-      expect(deserializeValue('"abc"', "number")).toBeNaN();
+    test("an uncoercible value throws instead of silently returning NaN", () => {
+      expect(() => deserializeValue('"abc"', "number")).toThrow(/does not deserialize to a number/);
     });
   });
 

package/src/config/__tests__/inherited-redaction.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   type ConfigCascade,
@@ -14,6 +14,7 @@ import {
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { ConfigHandlers, ConfigQueries } from "../constants";
 import { createConfigAccessorFactory, createConfigFeature } from "../feature";
 import { type ConfigResolver, createConfigResolver } from "../resolver";
@@ -76,8 +77,8 @@ const platformFeature = defineFeature("platform", (r) => {
 });
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(randomBytes(32).toString("base64"));
-  resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [configFeature, platformFeature],

package/src/config/__tests__/pii-encrypted.integration.test.ts

@@ -0,0 +1,179 @@
+// piiEncrypted config keys (kumiko-platform#231/#459): the value is
+// subject-KMS-encrypted at rest (tenant-row → tenant subject, user-row →
+// user subject), decrypted on read for authorized readers — unlike
+// `encrypted`/`backing="secrets"`, which the `values` query always masks
+// regardless of role (see config/handlers/values.query.ts).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  PII_CIPHERTEXT_PREFIX,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import {
+  access,
+  createTenantConfig,
+  createUserConfig,
+  defineFeature,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { ConfigHandlers, ConfigQueries } from "../constants";
+import { createConfigAccessorFactory, createConfigFeature } from "../feature";
+import { createConfigResolver } from "../resolver";
+import { configValuesTable } from "../table";
+
+const BILLING_ADDRESS_KEY = "pii-cfg-test:config:billing-address";
+const PHONE_NUMBER_KEY = "pii-cfg-test:config:phone-number";
+
+const piiFeature = defineFeature("pii-cfg-test", (r) => {
+  r.requires("config");
+
+  r.config({
+    keys: {
+      billingAddress: createTenantConfig("text", {
+        piiEncrypted: true,
+        read: access.all,
+        write: access.all,
+      }),
+      phoneNumber: createUserConfig("text", {
+        piiEncrypted: true,
+        read: access.all,
+        write: access.all,
+      }),
+    },
+  });
+});
+
+const configFeature = createConfigFeature();
+
+let stack: TestStack;
+const kms = new InMemoryKmsAdapter();
+const tenantAdmin = createTestUser({ id: 2 });
+
+beforeAll(async () => {
+  const resolver = createConfigResolver();
+  stack = await setupTestStack({
+    features: [configFeature, piiFeature],
+    extraContext: ({ registry }) => ({
+      configResolver: resolver,
+      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+    }),
+  });
+  await unsafePushTables(stack.db, { configValuesTable });
+  // One shared KMS instance for the whole file, not beforeEach/afterEach:
+  // config rows persist in the same DB across tests in this file, so a
+  // fresh adapter per test would orphan the previous test's ciphertext
+  // (KeyNotFoundError) the moment the values query resolves more than the
+  // one key that test just wrote.
+  configurePiiSubjectKms(kms);
+});
+
+afterAll(async () => {
+  resetPiiSubjectKmsForTests();
+  await stack.cleanup();
+});
+
+describe("piiEncrypted config keys", () => {
+  test("tenant-scope value is stored as tenant-subject ciphertext, read back as plaintext", async () => {
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: BILLING_ADDRESS_KEY, value: "Musterstrasse 1, 12345 Berlin" },
+      tenantAdmin,
+    );
+
+    const row = await fetchOne<{ value: string }>(stack.db, configValuesTable, {
+      key: BILLING_ADDRESS_KEY,
+      tenantId: tenantAdmin.tenantId,
+    });
+    expect(row).toBeDefined();
+    expect(isPiiCiphertext(row?.value)).toBe(true);
+    expect(row?.value).toStartWith(`${PII_CIPHERTEXT_PREFIX}tenant:${tenantAdmin.tenantId}:`);
+
+    const values = await stack.http.queryOk<
+      Record<string, { value: unknown; scope: string; source: string }>
+    >(ConfigQueries.values, {}, tenantAdmin);
+    expect(values[BILLING_ADDRESS_KEY]?.value).toBe("Musterstrasse 1, 12345 Berlin");
+  });
+
+  test("user-scope value is stored as user-subject ciphertext, distinct from tenant subject", async () => {
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: PHONE_NUMBER_KEY, value: "+49 151 00000000" },
+      tenantAdmin,
+    );
+
+    const row = await fetchOne<{ value: string }>(stack.db, configValuesTable, {
+      key: PHONE_NUMBER_KEY,
+      tenantId: tenantAdmin.tenantId,
+      userId: String(tenantAdmin.id),
+    });
+    expect(row).toBeDefined();
+    expect(isPiiCiphertext(row?.value)).toBe(true);
+    expect(row?.value).toStartWith(`${PII_CIPHERTEXT_PREFIX}user:${tenantAdmin.id}:`);
+
+    const values = await stack.http.queryOk<
+      Record<string, { value: unknown; scope: string; source: string }>
+    >(ConfigQueries.values, {}, tenantAdmin);
+    expect(values[PHONE_NUMBER_KEY]?.value).toBe("+49 151 00000000");
+  });
+
+  test("write with scope override to system is rejected — no subject for system-row", async () => {
+    // SystemAdmin so checkScopeWriteAccess passes and the request actually
+    // reaches the piiEncrypted+scope="system" rejection, not an earlier
+    // generic "you can't write system scope" denial.
+    const err = await stack.http.writeErr(
+      ConfigHandlers.set,
+      { key: BILLING_ADDRESS_KEY, value: "irrelevant", scope: "system" },
+      TestUsers.systemAdmin,
+    );
+    expect(err.code).toBe("unprocessable");
+    expect((err.details as { reason?: string } | undefined)?.reason).toBe("invalid_scope");
+  });
+
+  test("write without a configured KMS fails loud instead of silently storing plaintext", async () => {
+    try {
+      resetPiiSubjectKmsForTests();
+      expect(configuredPiiSubjectKms()).toBeUndefined();
+
+      const res = await stack.http.write(
+        ConfigHandlers.set,
+        { key: BILLING_ADDRESS_KEY, value: "no-kms-value" },
+        tenantAdmin,
+      );
+      expect(res.status).toBe(500);
+    } finally {
+      // Restore for any test running after this one in the file.
+      configurePiiSubjectKms(kms);
+    }
+  });
+
+  test("read of stored piiEncrypted ciphertext without KMS fails loud", async () => {
+    // Plant ciphertext while KMS is wired, then strip it so the READ path
+    // (decryptPiiEncrypted) — not just the write path — fails loud.
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: BILLING_ADDRESS_KEY, value: "planted-for-read" },
+      tenantAdmin,
+    );
+
+    try {
+      resetPiiSubjectKmsForTests();
+      expect(configuredPiiSubjectKms()).toBeUndefined();
+
+      const res = await stack.http.query(ConfigQueries.values, {}, tenantAdmin);
+      expect(res.status).toBe(500);
+    } finally {
+      configurePiiSubjectKms(kms);
+    }
+  });
+});