@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/shared/map-with-concurrency.test.ts

@@ -0,0 +1,104 @@
+import { describe, expect, test } from "bun:test";
+import { mapWithConcurrency } from "./map-with-concurrency";
+
+describe("mapWithConcurrency", () => {
+  test("preserves result order regardless of completion order", async () => {
+    const delays = [30, 10, 20, 0];
+    const results = await mapWithConcurrency(delays, 4, async (delay, index) => {
+      await new Promise((resolve) => setTimeout(resolve, delay));
+      return index;
+    });
+    expect(results).toEqual([0, 1, 2, 3]);
+  });
+
+  test("never runs more than `limit` calls concurrently", async () => {
+    let active = 0;
+    let maxActive = 0;
+    const items = Array.from({ length: 12 }, (_, i) => i);
+    await mapWithConcurrency(items, 4, async (item) => {
+      active++;
+      maxActive = Math.max(maxActive, active);
+      await new Promise((resolve) => setTimeout(resolve, 5));
+      active--;
+      return item;
+    });
+    expect(maxActive).toBeLessThanOrEqual(4);
+    expect(maxActive).toBeGreaterThan(1);
+  });
+
+  test("propagates the first rejection", async () => {
+    const items = [1, 2, 3];
+    await expect(
+      mapWithConcurrency(items, 4, async (item) => {
+        if (item === 2) throw new Error("boom");
+        return item;
+      }),
+    ).rejects.toThrow("boom");
+  });
+
+  // Two workers rejecting at different times, under 4-way concurrency —
+  // regression guard for the #1398 hazard (an eagerly-fired, never-awaited
+  // Promise surfacing as an unattributed unhandled rejection). Every
+  // worker promise here is an element of the internal `Promise.all` array,
+  // so both rejections are always handled even though the aggregate
+  // `mapWithConcurrency` call already settled on the first one.
+  test("a second rejection after the first doesn't surface as an unhandled rejection", async () => {
+    const unhandled: unknown[] = [];
+    const onUnhandledRejection = (reason: unknown): void => {
+      unhandled.push(reason);
+    };
+    process.on("unhandledRejection", onUnhandledRejection);
+    try {
+      const items = [1, 2, 3, 4, 5, 6, 7, 8];
+      await expect(
+        mapWithConcurrency(items, 4, async (item) => {
+          if (item === 2) {
+            await new Promise((resolve) => setTimeout(resolve, 5));
+            throw new Error("boom-early");
+          }
+          if (item === 5) {
+            await new Promise((resolve) => setTimeout(resolve, 20));
+            throw new Error("boom-late");
+          }
+          await new Promise((resolve) => setTimeout(resolve, 10));
+          return item;
+        }),
+      ).rejects.toThrow("boom-early");
+      // Give the later-rejecting worker's promise a chance to settle and
+      // for a real unhandled rejection (if any) to fire.
+      await new Promise((resolve) => setTimeout(resolve, 50));
+    } finally {
+      process.off("unhandledRejection", onUnhandledRejection);
+    }
+    expect(unhandled).toEqual([]);
+  });
+
+  test("does not claim new items after the first rejection", async () => {
+    const started: number[] = [];
+    const items = Array.from({ length: 20 }, (_, i) => i);
+    await expect(
+      mapWithConcurrency(items, 2, async (item) => {
+        started.push(item);
+        if (item === 0) throw new Error("boom");
+        // Slow enough that without fail-fast, more workers would drain the list.
+        await new Promise((resolve) => setTimeout(resolve, 30));
+        return item;
+      }),
+    ).rejects.toThrow("boom");
+    // At most `limit` in-flight when the first throw sets `failed`; without
+    // the flag the other worker would keep claiming the rest of the 20.
+    expect(started.length).toBeLessThan(items.length);
+    expect(started.length).toBeLessThanOrEqual(3);
+  });
+
+  test("empty input resolves to an empty array without running the worker", async () => {
+    const results = await mapWithConcurrency<number, number>([], 4, async (item) => item);
+    expect(results).toEqual([]);
+  });
+
+  test("limit larger than item count doesn't over-spawn workers", async () => {
+    const items = [1, 2];
+    const results = await mapWithConcurrency(items, 10, async (item) => item * 2);
+    expect(results).toEqual([2, 4]);
+  });
+});

package/src/shared/map-with-concurrency.ts

@@ -0,0 +1,38 @@
+// Bounded-concurrency map — runs `fn` over `items` with at most `limit`
+// calls in flight. `Promise.all(items.map(fn))` is unbounded (as many
+// calls as rows); a plain sequential loop caps concurrency at 1, which
+// under-uses a resource pool that allows more (e.g. PgKmsAdapter's
+// default `max: 4` — sequential decrypt-per-row leaves 3 pool slots idle
+// and turns each query into 2N serial round-trips instead of ~2N/4).
+// Order of `results` matches `items`, independent of completion order.
+// On rejection: the returned promise rejects with the first error, and
+// remaining workers stop claiming new items (`failed` flag). In-flight
+// calls already past the claim still run to completion (their promises
+// stay in the `Promise.all` array, so a later rejection can't surface as
+// an unhandled rejection — verified in `mapWithConcurrency.test.ts`).
+export async function mapWithConcurrency<T, R>(
+  items: readonly T[],
+  limit: number,
+  fn: (item: T, index: number) => Promise<R>,
+): Promise<R[]> {
+  const results: R[] = new Array(items.length);
+  let nextIndex = 0;
+  let failed = false;
+  async function worker(): Promise<void> {
+    for (;;) {
+      // skip: another worker already failed — stop claiming new items.
+      if (failed) return;
+      const index = nextIndex++;
+      // skip: cursor exhausted, normal worker-loop exit
+      if (index >= items.length) return;
+      try {
+        results[index] = await fn(items[index] as T, index);
+      } catch (err) {
+        failed = true;
+        throw err;
+      }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  return results;
+}

package/src/shared/password-hashing.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+import { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
+
+const medianMs = async (fn: () => Promise<unknown>, runs = 5): Promise<number> => {
+  const samples: number[] = [];
+  for (let i = 0; i < runs; i++) {
+    const start = performance.now();
+    await fn();
+    samples.push(performance.now() - start);
+  }
+  samples.sort((a, b) => a - b);
+  return samples[Math.floor(samples.length / 2)] ?? 0;
+};
+
+// #774: the login no-user path must cost the same argon2 latency as a real
+// verify, otherwise response timing leaks whether an email is registered.
+describe("verifyDummyPassword (anti-enumeration timing)", () => {
+  test("resolves to void, never matches", async () => {
+    expect(await verifyDummyPassword("whatever")).toBeUndefined();
+  });
+
+  test("burns real argon2 cost, comparable to a failed verify (not a no-op)", async () => {
+    const realHash = await hashPassword("correct-horse-battery");
+    // warm the lazily-cached dummy hash so we time the verify, not the one-off hash
+    await verifyDummyPassword("warmup");
+
+    const realMs = await medianMs(() => verifyPassword(realHash, "wrong-password"));
+    const dummyMs = await medianMs(() => verifyDummyPassword("wrong-password"));
+
+    // A skipped miss-path (the bug) is sub-millisecond; a real argon2 verify
+    // is ~20ms. A half-of-real floor is a wide, non-flaky bound that still
+    // fails hard if the dummy verify is ever removed.
+    expect(dummyMs).toBeGreaterThan(realMs * 0.5);
+  });
+});

package/src/{auth-email-password → shared}/password-hashing.ts

@@ -42,3 +42,14 @@ export async function verifyPassword(hashString: string, password: string): Prom
     return false;
   }
 }
+
+// Anti-enumeration timing equaliser (#774). The login handler runs this on
+// the no-user / no-hash path so a missing account costs the same argon2
+// latency as a real verify — otherwise response timing leaks whether an
+// email is registered. Derived from hashPassword once and cached, so it
+// always tracks HASH_OPTIONS; the password never matches, result discarded.
+let dummyHash: Promise<string> | undefined;
+export async function verifyDummyPassword(password: string): Promise<void> {
+  dummyHash ??= hashPassword("anti-enumeration-dummy");
+  await verifyPassword(await dummyHash, password);
+}

package/src/shared/system-query.ts

@@ -0,0 +1,5 @@
+// Minimal shape of the httpRoute handler's `{ systemQuery }` dep — mirrors
+// http-route.ts's signature. Not importing HttpRouteHandlerDeps itself: it
+// isn't part of the engine's public surface (only the httpRoute-
+// registration types are).
+export type SystemQueryFn = (type: string, payload: unknown, tenantId: string) => Promise<unknown>;

package/src/{auth-email-password → shared}/token-burn-store.ts

@@ -1,5 +1,5 @@
 // Single-use enforcement for HMAC-signed auth tokens (password-reset,
-// email-verification).
+// email-verification, MFA setup/challenge).
 //
 // Problem: the token itself carries only userId + expiry + signature.
 // Without server-side burn, the same token can be replayed within its

package/src/subscription-mollie/__tests__/feature.test.ts

@@ -1,8 +1,17 @@
 // feature.ts contract tests for subscription-mollie.
 
 import { describe, expect, test } from "bun:test";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import type {
+  MollieClient,
+  Payment as MolliePayment,
+  Subscription as MollieSubscription,
+} from "@mollie/api-client";
+import { describeSubscriptionProviderContract } from "../../billing-foundation/__tests__/subscription-provider-contract";
 import { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "../constants";
 import { createSubscriptionMollieFeature } from "../feature";
+import { createMollieCheckoutSession } from "../plugin-methods";
+import { type MollieClientShape, verifyAndParseMollieWebhook } from "../verify-webhook";
 
 const VALID_OPTIONS = {
   apiKey: "test_dummy_apikey",
@@ -98,9 +107,97 @@ describe("subscription-mollie — plugin-registration", () => {
       createPortalSession?: unknown;
       cancelSubscription?: unknown;
     };
+    // Checks the mounted feature (the contract below builds its plugin
+    // by hand-wiring and would not catch a wiring gap here).
     expect(typeof plugin?.verifyAndParseWebhook).toBe("function");
     expect(typeof plugin?.createCheckoutSession).toBe("function");
     expect(plugin?.createPortalSession).toBeUndefined();
     expect(plugin?.cancelSubscription).toBeUndefined();
   });
 });
+
+// =============================================================================
+// SubscriptionProviderPlugin contract
+// =============================================================================
+//
+// Built directly from the plugin-method constructors (not from
+// createSubscriptionMollieFeature's mounted plugin) — same reasoning as
+// subscription-stripe's contract fixture: keeps SDK-call mocking local to
+// the fixture instead of routing through the full feature-mount.
+
+const CONTRACT_TENANT_ID = "tenant-contract";
+const CONTRACT_PRICE_ID = "plan_pro";
+
+function buildMollieContractFixture() {
+  const subscription = {
+    id: "sub_contract_001",
+    customerId: "cst_contract_001",
+    status: "active",
+    nextPaymentDate: "2026-06-15",
+    startDate: "2026-05-15",
+    metadata: { tenantId: CONTRACT_TENANT_ID, priceId: CONTRACT_PRICE_ID },
+    // Minimal Mollie-SDK-shape mock — full Subscription has more fields
+    // than the plugin reads; double-cast at the test/SDK boundary instead
+    // of `as any` per coding-standards.
+  } as unknown as MollieSubscription;
+  const payment = {
+    id: "tr_contract_001",
+    customerId: "cst_contract_001",
+    subscriptionId: "sub_contract_001",
+    sequenceType: "first",
+    status: "paid",
+    // Minimal Mollie-SDK-shape mock, see subscription above.
+  } as unknown as MolliePayment;
+
+  const webhookClient: MollieClientShape = {
+    payments: { get: async () => payment },
+    customerSubscriptions: {
+      get: async () => subscription,
+      list: async () => [],
+      create: async () => subscription,
+    },
+  };
+
+  const checkoutClient = {
+    customers: { create: async () => ({ id: "cus_contract" }) },
+    payments: {
+      create: async () => ({
+        getCheckoutUrl: () => "https://www.mollie.com/checkout/contract-test",
+      }),
+    },
+  } as unknown as MollieClient;
+
+  return {
+    plugin: {
+      verifyAndParseWebhook: verifyAndParseMollieWebhook(webhookClient, {
+        priceToTier: VALID_OPTIONS.priceToTier,
+        priceToConfig: VALID_OPTIONS.priceToConfig,
+      }),
+      createCheckoutSession: createMollieCheckoutSession(
+        checkoutClient,
+        VALID_OPTIONS.priceToConfig,
+        VALID_OPTIONS.webhookUrl,
+      ),
+      // createPortalSession + cancelSubscription deliberately omitted — Mollie limitation.
+    },
+    ctx: {} as HandlerContext,
+    checkout: {
+      priceId: CONTRACT_PRICE_ID,
+      tenantId: CONTRACT_TENANT_ID,
+      successUrl: "https://example.com/success",
+      cancelUrl: "https://example.com/cancel",
+    },
+    webhook: {
+      rawBody: JSON.stringify({ id: "tr_contract_001" }),
+      headers: { "content-type": "application/json" },
+      expectedTenantId: CONTRACT_TENANT_ID,
+      expectedTier: "pro",
+    },
+  };
+}
+
+describeSubscriptionProviderContract("subscription-mollie", buildMollieContractFixture, {
+  // Mollie has no customer-portal or programmatic cancel API.
+  hasPortal: false,
+  hasCancel: false,
+});

package/src/subscription-mollie/__tests__/mollie-foundation.integration.test.ts

@@ -39,6 +39,10 @@ import type {
   Subscription as MollieSubscription,
 } from "@mollie/api-client";
 import { Hono } from "hono";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { createSubscriptionMollieFeature } from "../feature";
 import type { MollieClientShape } from "../verify-webhook";
 
@@ -133,7 +137,14 @@ beforeAll(async () => {
   });
 
   stack = await setupTestStack({
-    features: [billingFoundationFeature, mollieFeature],
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      billingFoundationFeature,
+      mollieFeature,
+    ],
   });
   db = stack.db;
   // subscriptionsProjectionTable wird von setupTestStack automatisch

package/src/subscription-mollie/__tests__/verify-webhook.test.ts

@@ -347,6 +347,27 @@ describe("verifyAndParseMollieWebhook — error + ignore paths", () => {
   });
 });
 
+describe("verifyAndParseMollieWebhook — kumiko-framework#1525: no ambient Temporal global", () => {
+  const verify = (client: MollieClientShape) =>
+    verifyAndParseMollieWebhook(client, {
+      priceToTier: { plan_pro: "pro" },
+      priceToConfig: TEST_PRICE_CONFIG,
+    });
+
+  test("computes currentPeriodEnd without relying on globalThis.Temporal", async () => {
+    const client = buildClient();
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const event = await verify(client)("id=tr_test_001", {});
+      expect(event?.currentPeriodEnd).toBe("2026-06-15T00:00:00Z");
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});
+
 // =============================================================================
 // Mapping-helpers
 // =============================================================================

package/src/subscription-mollie/verify-webhook.ts

@@ -25,6 +25,7 @@ import type {
   Payment as MolliePayment,
   Subscription as MollieSubscription,
 } from "@mollie/api-client";
+import { Temporal } from "temporal-polyfill";
 import { MOLLIE_PROVIDER_NAME } from "./constants";
 import type { MolliePriceConfig } from "./plugin-methods";
 

package/src/subscription-stripe/__tests__/feature.test.ts

@@ -1,8 +1,18 @@
 // feature.ts contract tests for subscription-stripe.
 
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import Stripe from "stripe";
+import { describeSubscriptionProviderContract } from "../../billing-foundation/__tests__/subscription-provider-contract";
 import { STRIPE_PROVIDER_NAME, StripeEventTypes, SUBSCRIPTION_STRIPE_FEATURE } from "../constants";
 import { createSubscriptionStripeFeature } from "../feature";
+import {
+  createStripeCancelSubscription,
+  createStripeCheckoutSession,
+  createStripePortalSession,
+} from "../plugin-methods";
+import type { StripeCtxRuntime } from "../runtime";
+import { verifyAndParseStripeWebhook } from "../verify-webhook";
 
 const OPTIONS = {
   priceToTier: { price_test: "pro" },
@@ -69,6 +79,8 @@ describe("subscription-stripe — plugin-registration", () => {
     // "method not supported"-error brechen — type-check würde es nicht
     // fangen weil die useExtension-options als `unknown` durchgereicht
     // werden.
+    // Checks the mounted feature — the contract below builds its plugin
+    // by hand-wiring, so it would not catch a wiring gap here.
     const feature = createSubscriptionStripeFeature(OPTIONS);
     const usage = feature.extensionUsages.find((u) => u.entityName === STRIPE_PROVIDER_NAME);
     expect(usage).toBeDefined();
@@ -100,3 +112,117 @@ describe("constants — Stripe-event-types die wir mappen", () => {
     ]);
   });
 });
+
+// =============================================================================
+// SubscriptionProviderPlugin contract
+// =============================================================================
+//
+// Built directly from the plugin-method constructors (not from
+// createSubscriptionStripeFeature's mounted plugin) — the mounted plugin
+// resolves its Stripe client per-call from ctx.config/ctx.secrets, which
+// can't be spied on from outside. plugin-methods.test.ts already exercises
+// this same runtime-injection pattern for the individual methods.
+
+const CONTRACT_API_KEY = "sk_test_contract_dummy";
+const CONTRACT_WEBHOOK_SECRET = "whsec_contract_test_secret";
+
+function contractCtxRuntime(stripe: Stripe): StripeCtxRuntime {
+  return { clientForCtx: async () => stripe, assertBillingLive: async () => {} };
+}
+
+async function buildStripeContractFixture() {
+  const stripe = new Stripe(CONTRACT_API_KEY);
+  spyOn(stripe.checkout.sessions, "create").mockResolvedValue({
+    url: "https://checkout.stripe.com/c/pay/contract-test",
+    // Only `.url` is read by createStripeCheckoutSession. mockResolvedValue
+    // wants Stripe.Response<Session> (adds lastResponse metadata) — the SDK
+    // wrapper type makes a structural mock impractical, so double-cast at
+    // the test/SDK boundary instead of `as any`.
+  } as unknown as Stripe.Response<Stripe.Checkout.Session>);
+  spyOn(stripe.billingPortal.sessions, "create").mockResolvedValue({
+    url: "https://billing.stripe.com/p/session/contract-test",
+    // Only `.url` is read by createStripePortalSession, see above.
+  } as unknown as Stripe.Response<Stripe.BillingPortal.Session>);
+  spyOn(stripe.subscriptions, "cancel").mockResolvedValue({
+    id: "sub_contract",
+    status: "canceled",
+    // Return value isn't read by createStripeCancelSubscription (fire-and-
+    // forget) — double-cast at the test/SDK boundary instead of `as any`.
+  } as unknown as Stripe.Response<Stripe.Subscription>);
+  const runtime = contractCtxRuntime(stripe);
+
+  const stripeForWebhookFixture = new Stripe(CONTRACT_API_KEY);
+  const webhookEvent = {
+    id: "evt_contract_001",
+    object: "event",
+    api_version: "2026-04-22.dahlia",
+    created: 1_770_000_000,
+    type: StripeEventTypes.customerSubscriptionCreated,
+    livemode: false,
+    pending_webhooks: 1,
+    request: { id: null, idempotency_key: null },
+    data: {
+      object: {
+        id: "sub_contract_001",
+        object: "subscription",
+        customer: "cus_contract_001",
+        status: "active",
+        metadata: { tenantId: "tenant-contract" },
+        items: {
+          object: "list",
+          data: [
+            {
+              id: "si_contract",
+              object: "subscription_item",
+              current_period_end: 1_780_000_000,
+              price: { id: "price_test", object: "price" },
+            },
+          ],
+          has_more: false,
+        },
+      },
+    },
+  };
+  const rawBody = JSON.stringify(webhookEvent);
+  const signature = await stripeForWebhookFixture.webhooks.generateTestHeaderStringAsync({
+    payload: rawBody,
+    secret: CONTRACT_WEBHOOK_SECRET,
+  });
+
+  return {
+    plugin: {
+      verifyAndParseWebhook: verifyAndParseStripeWebhook(
+        {
+          resolve: async () => ({
+            stripe: stripeForWebhookFixture,
+            webhookSecret: CONTRACT_WEBHOOK_SECRET,
+          }),
+        },
+        { priceToTier: OPTIONS.priceToTier },
+      ),
+      createCheckoutSession: createStripeCheckoutSession(runtime),
+      createPortalSession: createStripePortalSession(runtime),
+      cancelSubscription: createStripeCancelSubscription(runtime),
+    },
+    ctx: {} as HandlerContext,
+    checkout: {
+      priceId: "price_test",
+      tenantId: "tenant-contract",
+      successUrl: "https://example.com/success",
+      cancelUrl: "https://example.com/cancel",
+    },
+    portal: { providerCustomerId: "cus_contract", returnUrl: "https://example.com/return" },
+    cancelSubscriptionId: "sub_contract",
+    webhook: {
+      rawBody,
+      headers: { "stripe-signature": signature },
+      expectedTenantId: "tenant-contract",
+      expectedTier: "pro",
+    },
+  };
+}
+
+describeSubscriptionProviderContract("subscription-stripe", buildStripeContractFixture, {
+  hasPortal: true,
+  hasCancel: true,
+});

package/src/subscription-stripe/__tests__/runtime.test.ts

@@ -44,34 +44,24 @@ const BILLING_LIVE_HANDLE: ConfigKeyHandle<"boolean"> = {
 
 /** Stub-SecretsContext: liest aus einer in-memory-map, matcht per
  *  qualified-name. backing:"secrets" persistiert config-Werte JSON-
- *  serialisiert — der Stub spiegelt das, damit der Runtime-parseStoredSecret
- *  denselben Pfad nimmt wie gegen den echten Store. Ignoriert auditCtx. */
-function stubSecrets(values: Record<string, string>): SecretsContext {
+ *  serialisiert — der Stub spiegelt das per Default, damit der Runtime-
+ *  parseStoredSecret denselben Pfad nimmt wie gegen den echten Store.
+ *  `raw: true` speichert UN-serialisiert (482/1) — um parseStoredSecret's
+ *  Fehlerpfad zu treffen: ein Credential, das der Store un-JSON-kodiert
+ *  zurückgibt (Korruption oder außerhalb des backing:"secrets"-Roundtrips
+ *  geschrieben) muss laut failen, nicht still Müll liefern. Ignoriert
+ *  auditCtx. */
+function stubSecrets(
+  values: Record<string, string>,
+  opts?: { readonly raw?: boolean },
+): SecretsContext {
   const nameOf = (k: string | { readonly name: string }): string =>
     typeof k === "string" ? k : k.name;
   return {
     get: async (_tenantId, key) => {
       const value = values[nameOf(key)];
-      return value === undefined ? undefined : createSecret(JSON.stringify(value));
-    },
-    has: async (_tenantId, key) => values[nameOf(key)] !== undefined,
-    set: async () => undefined,
-    delete: async () => false,
-  };
-}
-
-/** Wie stubSecrets, aber speichert den Wert ROH (kein JSON.stringify) — um
- *  parseStoredSecret's Fehlerpfad zu treffen: ein Credential, das der Store
- *  un-JSON-kodiert zurückgibt (Korruption oder ein außerhalb des
- *  backing:"secrets"-Roundtrips geschriebener Wert) muss laut failen, nicht
- *  still Müll liefern. */
-function rawSecretsStub(values: Record<string, string>): SecretsContext {
-  const nameOf = (k: string | { readonly name: string }): string =>
-    typeof k === "string" ? k : k.name;
-  return {
-    get: async (_tenantId, key) => {
-      const value = values[nameOf(key)];
-      return value === undefined ? undefined : createSecret(value); // RAW, not JSON
+      if (value === undefined) return undefined;
+      return createSecret(opts?.raw ? value : JSON.stringify(value));
     },
     has: async (_tenantId, key) => values[nameOf(key)] !== undefined,
     set: async () => undefined,
@@ -164,7 +154,7 @@ describe("StripeCtxRuntime.clientForCtx", () => {
     // throw, not silently fall through to undefined/fallback.
     const rt = makeRuntimes({ apiKey: "sk_test_fallback" });
     const ctx = stubCtx({
-      secrets: rawSecretsStub({ [API_KEY_HANDLE.name]: "sk_test_raw_unquoted" }),
+      secrets: stubSecrets({ [API_KEY_HANDLE.name]: "sk_test_raw_unquoted" }, { raw: true }),
     });
     await expect(rt.ctx.clientForCtx(ctx)).rejects.toThrow(
       /Invalid JSON in subscription-stripe credential/,

package/src/subscription-stripe/__tests__/stripe-foundation.integration.test.ts

@@ -20,7 +20,7 @@ import {
   type SubscriptionProviderPlugin,
   subscriptionAggregateId,
 } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
-import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
 import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
@@ -31,8 +31,10 @@ import {
   testTenantId,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { Hono } from "hono";
 import Stripe from "stripe";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { configValuesTable, createConfigFeature } from "../../config";
 import { createConfigAccessorFactory } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
@@ -42,6 +44,8 @@ import {
   type SecretsContext,
   tenantSecretsTable,
 } from "../../secrets";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { createSubscriptionStripeFeature } from "../feature";
 
 // Qualified-names der runtime-keys (drift-pin: müssen 1:1 dem entsprechen,
@@ -79,8 +83,8 @@ beforeAll(async () => {
     priceToTier: PRICE_TO_TIER,
   });
 
-  const encryption = createEncryptionProvider(randomBytes(32).toString("base64"));
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  const resolver = createConfigResolver({ cipher: encryption });
   const masterKeyProvider = createEnvMasterKeyProvider({
     env: {
       KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),
@@ -92,6 +96,9 @@ beforeAll(async () => {
     features: [
       createConfigFeature(),
       createSecretsFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
       billingFoundationFeature,
       stripeFeature,
     ],
@@ -470,8 +477,8 @@ describe("scenario 6: billing-live gate end-to-end (#104)", () => {
 
   beforeAll(async () => {
     const stripeFeature = createSubscriptionStripeFeature({ priceToTier: PRICE_TO_TIER });
-    const encryption = createEncryptionProvider(randomBytes(32).toString("base64"));
-    const resolver = createConfigResolver({ encryption });
+    const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+    const resolver = createConfigResolver({ cipher: encryption });
     const masterKeyProvider = createEnvMasterKeyProvider({
       env: {
         KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),
@@ -482,6 +489,9 @@ describe("scenario 6: billing-live gate end-to-end (#104)", () => {
       features: [
         createConfigFeature(),
         createSecretsFeature(),
+        createTenantFeature(),
+        createComplianceProfilesFeature(),
+        createTenantLifecycleFeature(),
         billingFoundationFeature,
         stripeFeature,
       ],