@cosmicdrift/kumiko-framework 0.114.0 → 1.0.0

package/src/db/__tests__/tenant-db.integration.test.ts

@@ -10,7 +10,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "../../stack";
-import { table as pgTable, serial, type TableColumns, text, timestamp } from "../dialect";
+import { table as pgTable, serial, text, timestamp } from "../dialect";
 import { buildEntityTable } from "../table-builder";
 import { createTenantDb } from "../tenant-db";
 
@@ -26,11 +26,7 @@ const entity = createEntity({
   softDelete: true,
 });
 
-// The ES-write brand (#742) is a compile-time phantom — no runtime property. This
-// suite exercises TenantDb method-form scoping on a real entity table, so the handle
-// is held at the unbranded TableColumns view: identical runtime shape, and both reads
-// and method-form writes accept it (a branded EntityTable is now rejected).
-const table: TableColumns = buildEntityTable("tenantDbItem", entity);
+const table = buildEntityTable("tenantDbItem", entity);
 
 // --- System table (no tenantId — like job_runs) ---
 

package/src/db/config-seed.ts

@@ -2,8 +2,8 @@ import { v5 as uuidv5 } from "uuid";
 import type { EntityDefinition } from "../engine";
 import { createSystemUser, SYSTEM_TENANT_ID } from "../engine";
 import type { ConfigSeedDef, Registry } from "../engine/types";
-import type { EnvelopeCipher } from "../secrets/envelope-cipher";
 import type { DbConnection } from "./connection";
+import type { EncryptionProvider } from "./encryption";
 import { createEventStoreExecutor } from "./event-store-executor";
 import type { EntityTable } from "./table-builder";
 import { createTenantDb } from "./tenant-db";
@@ -30,7 +30,7 @@ export async function seedConfigValues<E extends EntityDefinition>(
   entity: E,
   registry: Registry,
   db: DbConnection,
-  cipher?: EnvelopeCipher,
+  encryption?: EncryptionProvider,
 ): Promise<{ created: number; skipped: number }> {
   let created = 0;
   let skipped = 0;
@@ -48,12 +48,12 @@ export async function seedConfigValues<E extends EntityDefinition>(
       continue;
     }
 
-    // Encrypted keys without a cipher would silently write plaintext to a
-    // column the resolver later tries to decrypt — fail loud at boot, not
-    // on first read in prod.
-    if (keyDef.encrypted && !cipher) {
+    // Encrypted keys without an encryption provider would silently write
+    // plaintext to a column the resolver later tries to decrypt — fail
+    // loud at boot, not on first read in prod.
+    if (keyDef.encrypted && !encryption) {
       throw new Error(
-        `seedConfigValues: key "${seed.key}" is encrypted but no EnvelopeCipher was supplied.`,
+        `seedConfigValues: key "${seed.key}" is encrypted but no EncryptionProvider was supplied.`,
       );
     }
 
@@ -77,8 +77,8 @@ export async function seedConfigValues<E extends EntityDefinition>(
     const aggregateId = uuidv5(idSource, CONFIG_SEED_NS);
 
     let value = JSON.stringify(seed.value);
-    if (keyDef.encrypted && cipher) {
-      value = await cipher.encrypt(value, { tenantId });
+    if (keyDef.encrypted && encryption) {
+      value = encryption.encrypt(value);
     }
 
     const payload: Record<string, unknown> = {

package/src/db/encryption.ts

@@ -9,13 +9,6 @@ export type EncryptionProvider = {
   decrypt(ciphertext: string): string;
 };
 
-/**
- * @deprecated Legacy single-key format: base64(iv+tag+ct) with NO key id —
- * a key change makes existing ciphertexts permanently undecryptable. Use
- * `createEnvelopeCipher` (@cosmicdrift/kumiko-framework/secrets) for new code; this
- * provider remains only as the decrypt-fallback for pre-envelope values
- * (EnvelopeCipherOptions.legacy) until a re-encrypt job migrated them.
- */
 export function createEncryptionProvider(key: string): EncryptionProvider {
   // Key must be 32 bytes for AES-256
   const keyBuffer = Buffer.from(key, "base64");

package/src/db/entity-field-encryption.ts

@@ -1,13 +1,6 @@
-// Entity-field encryption (`encrypted: true` on text/longText fields),
-// backed by the same envelope cipher as encrypted config values: JSON
-// StoredEnvelope in the TEXT column, kekVersion per value, legacy
-// single-key ciphertexts (pre-envelope ENCRYPTION_KEY era) readable via
-// the cipher's legacy fallback until re-encrypted.
-
-import type { EntityDefinition, TenantId } from "../engine/types";
-import { createEnvMasterKeyProvider } from "../secrets/env-master-key-provider";
-import type { EnvelopeCipher } from "../secrets/envelope-cipher";
-import type { KeyScope } from "../secrets/types";
+import type { EntityDefinition } from "../engine/types";
+import type { EncryptionProvider } from "./encryption";
+import { createEncryptionProvider } from "./encryption";
 
 export function collectEncryptedFieldNames(entity: EntityDefinition): ReadonlySet<string> {
   const names = new Set<string>();
@@ -19,120 +12,70 @@ export function collectEncryptedFieldNames(entity: EntityDefinition): ReadonlySe
   return names;
 }
 
-// BYOK hook: thread the row's tenant to the cipher when the row carries one
-// (system-scope rows may not).
-function scopeOf(row: Record<string, unknown>): KeyScope | undefined {
-  const tenantId = row["tenantId"];
-  return typeof tenantId === "string" ? { tenantId: tenantId as TenantId } : undefined; // @cast-boundary db-row
-}
-
-async function encryptFieldValue(
+function encryptFieldValue(
   fieldName: string,
   value: unknown,
-  cipher: EnvelopeCipher,
-  scope: KeyScope | undefined,
-): Promise<string> {
+  encryption: EncryptionProvider,
+): string {
   if (value === null || value === undefined) {
     throw new Error(`encrypted field "${fieldName}" cannot be null or undefined`);
   }
   if (typeof value !== "string") {
     throw new Error(`encrypted field "${fieldName}" must be a string, got ${typeof value}`);
   }
-  return cipher.encrypt(value, scope);
+  return encryption.encrypt(value);
 }
 
-export async function encryptEntityFieldValues(
+export function encryptEntityFieldValues(
   row: Record<string, unknown>,
   encryptedFields: ReadonlySet<string>,
-  cipher: EnvelopeCipher,
+  encryption: EncryptionProvider,
   opts?: { onlyKeys?: Iterable<string> },
-): Promise<Record<string, unknown>> {
+): Record<string, unknown> {
   if (encryptedFields.size === 0) return row;
   const only = opts?.onlyKeys ? new Set(opts.onlyKeys) : null;
   const out = { ...row };
-  const scope = scopeOf(row);
   for (const name of encryptedFields) {
     if (only && !only.has(name)) continue;
     if (!(name in out)) continue;
     const value = out[name];
     if (value === null || value === undefined) continue;
-    out[name] = await encryptFieldValue(name, value, cipher, scope);
+    out[name] = encryptFieldValue(name, value, encryption);
   }
   return out;
 }
 
-export async function decryptEntityFieldValues(
+export function decryptEntityFieldValues(
   row: Record<string, unknown>,
   encryptedFields: ReadonlySet<string>,
-  cipher: EnvelopeCipher,
-): Promise<Record<string, unknown>> {
+  encryption: EncryptionProvider,
+): Record<string, unknown> {
   if (encryptedFields.size === 0) return row;
   const out = { ...row };
-  const scope = scopeOf(row);
   for (const name of encryptedFields) {
     const value = out[name];
     if (value === null || value === undefined) continue;
     if (typeof value !== "string") continue;
-    out[name] = await cipher.decrypt(value, scope);
+    out[name] = encryption.decrypt(value);
   }
   return out;
 }
 
-// Boot-injected app-wide cipher. run{Prod,Dev}App (and test setups that
-// exercise encrypted fields) call configureEntityFieldEncryption once with
-// the same cipher instance the config feature uses; executors resolve it
-// lazily so entities without encrypted fields never touch it.
-let injectedCipher: EnvelopeCipher | undefined;
+let cachedProvider: EncryptionProvider | undefined;
 
-export function configureEntityFieldEncryption(cipher: EnvelopeCipher | undefined): void {
-  injectedCipher = cipher;
-}
-
-export function resolveEntityFieldEncryption(): EnvelopeCipher {
-  if (!injectedCipher) {
+export function resolveEntityFieldEncryption(): EncryptionProvider {
+  if (cachedProvider) return cachedProvider;
+  const key = process.env["ENCRYPTION_KEY"];
+  if (!key) {
     throw new Error(
-      "entity-field encryption is not configured — encrypted entity fields need a master key " +
-        "(KUMIKO_SECRETS_MASTER_KEY_V<n>); run{Prod,Dev}App wire the cipher automatically, " +
-        "custom boots call configureEntityFieldEncryption(cipher).",
+      "ENCRYPTION_KEY environment variable is required (encrypted entity fields in use)",
     );
   }
-  return injectedCipher;
-}
-
-// Non-throwing probe for callers that degrade gracefully (DSGVO export
-// replaces encrypted fields with an explicit marker instead of failing
-// the whole export when no cipher is wired).
-export function configuredEntityFieldEncryption(): EnvelopeCipher | undefined {
-  return injectedCipher;
+  cachedProvider = createEncryptionProvider(key);
+  return cachedProvider;
 }
 
 /** @internal test-only */
 export function resetEntityFieldEncryptionCacheForTests(): void {
-  injectedCipher = undefined;
-}
-
-// Boot-time availability probe for validateBoot: either a cipher was
-// injected, or the env keyring must be constructible — eager construction
-// surfaces missing AND malformed keys (wrong length, bad base64) at boot
-// instead of on the first encrypted read in prod. validateBoot runs before
-// configureEntityFieldEncryption, so the env probe is the common path.
-export function validateEntityFieldEncryptionAvailable(): void {
-  // skip: an injected cipher (test seam / custom KMS) satisfies availability
-  if (injectedCipher) return;
-  try {
-    createEnvMasterKeyProvider({
-      env: {
-        ...process.env,
-        KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION:
-          process.env["KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION"] ?? "1",
-      },
-    });
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    throw new Error(
-      `encrypted entity fields in use but no usable master key (${reason}) — set ` +
-        "KUMIKO_SECRETS_MASTER_KEY_V1 (32 bytes, base64) or inject a cipher via " +
-        "configureEntityFieldEncryption().",
-    );
-  }
+  cachedProvider = undefined;
 }

package/src/db/event-store-executor.ts

@@ -39,13 +39,13 @@ import {
 } from "../event-store";
 import type { EntityCache } from "../pipeline/entity-cache";
 import type { SearchAdapter } from "../search/types";
-import type { EnvelopeCipher } from "../secrets/envelope-cipher";
 import { assertUnreachable, generateId } from "../utils";
 import { applyEntityEvent } from "./apply-entity-event";
 import { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types";
 import type { DbRow } from "./connection";
 import { decodeCursor, encodeCursor } from "./cursor";
 import type { TableColumns } from "./dialect";
+import type { EncryptionProvider } from "./encryption";
 import {
   collectEncryptedFieldNames,
   decryptEntityFieldValues,
@@ -119,8 +119,8 @@ export type EventStoreExecutorOptions = {
   searchAdapter?: SearchAdapter;
   entityName: string; // required — the aggregateType marker on every event
   entityCache?: EntityCache;
-  /** Override the boot-injected cipher for fields marked `encrypted: true`. */
-  encryption?: EnvelopeCipher;
+  /** Override ENCRYPTION_KEY for entity fields marked `encrypted: true`. */
+  encryption?: EncryptionProvider;
 };
 
 // F8 helper: PG-23505 (unique-violation) catched aus applyEntityEvent
@@ -307,28 +307,24 @@ export function createEventStoreExecutor(
   const encryptedFields = collectEncryptedFieldNames(entity);
   const hasEncryptedFields = encryptedFields.size > 0;
 
-  function fieldCipher(): EnvelopeCipher {
+  function encryptionProvider(): EncryptionProvider {
     if (options.encryption) return options.encryption;
     return resolveEntityFieldEncryption();
   }
 
-  // Async on purpose: the envelope cipher wraps/unwraps DEKs via the
-  // MasterKeyProvider. Callers MUST await — a missed await here writes
-  // "[object Promise]" into the projection, which the Promise return
-  // types turn into a compile error at every call site.
-  async function encryptForStorage(
+  function encryptForStorage(
     row: Record<string, unknown>,
     onlyKeys?: Iterable<string>,
-  ): Promise<Record<string, unknown>> {
+  ): Record<string, unknown> {
     if (!hasEncryptedFields) return row;
-    return encryptEntityFieldValues(row, encryptedFields, fieldCipher(), {
+    return encryptEntityFieldValues(row, encryptedFields, encryptionProvider(), {
       ...(onlyKeys !== undefined && { onlyKeys }),
     });
   }
 
-  async function decryptForRead(row: Record<string, unknown>): Promise<Record<string, unknown>> {
+  function decryptForRead(row: Record<string, unknown>): Record<string, unknown> {
     if (!hasEncryptedFields) return row;
-    return decryptEntityFieldValues(row, encryptedFields, fieldCipher());
+    return decryptEntityFieldValues(row, encryptedFields, encryptionProvider());
   }
 
   function applyDefaults(payload: Record<string, unknown>): Record<string, unknown> {
@@ -360,7 +356,7 @@ export function createEventStoreExecutor(
   async function loadById(id: EntityId, db: TenantDb): Promise<Record<string, unknown> | null> {
     const row = await db.fetchOne(table, idFilter(id));
     if (!row) return null;
-    return await decryptForRead(rehydrateCompoundTypes(row as DbRow, entity));
+    return decryptForRead(rehydrateCompoundTypes(row as DbRow, entity));
   }
 
   // Archive guard for the CRUD write paths. Archived streams are read-only —
@@ -469,7 +465,7 @@ export function createEventStoreExecutor(
       // Alle Compound-Types (locatedTimestamp, money, ...) gehen durch
       // dieselbe Pipeline. Caller schickt combined API-Form, Framework
       // speichert flat DB-Form. Siehe db/compound-types.ts.
-      const flatData = await encryptForStorage(flattenCompoundTypes(data, entity));
+      const flatData = encryptForStorage(flattenCompoundTypes(data, entity));
 
       // 1. Append event (same TX as the projection write — both must succeed
       //    or both roll back; the dispatcher wraps both in one transaction).
@@ -545,9 +541,7 @@ export function createEventStoreExecutor(
       const row = result.row;
       // Read-Side Auto-Convert: DB-Form → API-combined-Form für alle
       // Compound-Types in einem Pass.
-      const projection = await decryptForRead(
-        rehydrateCompoundTypes(row as DbRow, entity) as DbRow,
-      );
+      const projection = decryptForRead(rehydrateCompoundTypes(row as DbRow, entity) as DbRow);
 
       if (entityCache && entityName) {
         await entityCache.del(user.tenantId, entityName, aggregateId);
@@ -650,7 +644,7 @@ export function createEventStoreExecutor(
 
       try {
         // Compound-Types Auto-Convert (alle in einem Pass).
-        const flatChanges = await encryptForStorage(
+        const flatChanges = encryptForStorage(
           flattenCompoundTypes(payload.changes, entity),
           Object.keys(payload.changes),
         );
@@ -673,7 +667,7 @@ export function createEventStoreExecutor(
           type: entityEventName(entityName, "updated"),
           payload: {
             changes: stripSensitive(flatChanges),
-            previous: stripSensitive(await encryptForStorage(previous)),
+            previous: stripSensitive(encryptForStorage(previous)),
           },
           metadata: buildEventMetadata(user),
         });
@@ -701,7 +695,7 @@ export function createEventStoreExecutor(
           return writeFailure(new InternalError({ message: "projection update returned no row" }));
         }
         const row = result.row;
-        const data = await decryptForRead(rehydrateCompoundTypes(row as DbRow, entity) as DbRow);
+        const data = decryptForRead(rehydrateCompoundTypes(row as DbRow, entity) as DbRow);
 
         if (entityCache && entityName) {
           await entityCache.del(user.tenantId, entityName, payload.id);
@@ -783,7 +777,7 @@ export function createEventStoreExecutor(
         tenantId: streamTenantFor(user),
         expectedVersion: currentVersion,
         type: entityEventName(entityName, "deleted"),
-        payload: { previous: stripSensitive(await encryptForStorage(existing)) },
+        payload: { previous: stripSensitive(encryptForStorage(existing)) },
         metadata: buildEventMetadata(user),
       });
 
@@ -816,7 +810,7 @@ export function createEventStoreExecutor(
     async forget(payload, user, db) {
       const raw = await db.fetchOne<Record<string, unknown>>(table, { id: payload.id });
       if (!raw) return writeFailure(new NotFoundError(entityName, payload.id));
-      const existing = await decryptForRead(rehydrateCompoundTypes(raw as DbRow, entity) as DbRow);
+      const existing = decryptForRead(rehydrateCompoundTypes(raw as DbRow, entity) as DbRow);
 
       if (!userCanWriteFieldRow(user, entity.access?.write, existing, existing)) {
         return writeFailure(
@@ -943,7 +937,7 @@ export function createEventStoreExecutor(
       // row and `previous` snapshot must be plaintext for `encrypted` fields,
       // same as every other executor method — `data`/`restored` are raw rows
       // (selectMany / applyEntityEvent), never decrypted before this point.
-      const restoredHydrated = await decryptForRead(
+      const restoredHydrated = decryptForRead(
         rehydrateCompoundTypes(restored as DbRow, entity) as DbRow,
       );
 
@@ -954,7 +948,7 @@ export function createEventStoreExecutor(
           id: payload.id,
           data: restoredHydrated,
           changes: { isDeleted: false },
-          previous: await decryptForRead(data),
+          previous: decryptForRead(data),
           isNew: false,
           entityName,
           event,
@@ -1088,10 +1082,8 @@ export function createEventStoreExecutor(
       const rawRows = await executeRawQuery<Record<string, unknown>>(db.raw, listSql, params);
       // Read-Side rehydrate pro Row + snake→camel coercion für driver-agnostic Feldnamen
       const tableInfo = extractTableInfo(table);
-      const rows = await Promise.all(
-        rawRows.map(async (r) =>
-          coerceRow(await decryptForRead(rehydrateCompoundTypes(r, entity)), tableInfo),
-        ),
+      const rows = rawRows.map((r) =>
+        coerceRow(decryptForRead(rehydrateCompoundTypes(r, entity)), tableInfo),
       );
 
       // list rows carry the READ-ROW version (display-only), never an optimistic-lock
@@ -1164,24 +1156,19 @@ export function createEventStoreExecutor(
           // Cached rows are stored re-encrypted (see the `set` below) so an
           // `encrypted` field's plaintext never sits in a second at-rest
           // store (Redis) the field-encryption feature doesn't cover.
-          return withStreamVersion(await decryptForRead(cached));
+          return withStreamVersion(decryptForRead(cached));
         }
       }
 
       const rows = await loadWithOwnership(db, idWhere, ownership);
       const raw = rows[0];
       if (!raw) return null;
-      const row = await decryptForRead(rehydrateCompoundTypes(raw, entity));
+      const row = decryptForRead(rehydrateCompoundTypes(raw, entity));
       const rowInfo = extractTableInfo(table);
       const coerced = coerceRow(row, rowInfo);
 
       if (entityCache && entityName) {
-        await entityCache.set(
-          user.tenantId,
-          entityName,
-          payload.id,
-          await encryptForStorage(coerced),
-        );
+        await entityCache.set(user.tenantId, entityName, payload.id, encryptForStorage(coerced));
       }
 
       return withStreamVersion(coerced);

package/src/db/index.ts

@@ -38,11 +38,8 @@ export type { EncryptionProvider } from "./encryption";
 export { createEncryptionProvider } from "./encryption";
 export {
   collectEncryptedFieldNames,
-  configuredEntityFieldEncryption,
-  configureEntityFieldEncryption,
   decryptEntityFieldValues,
   encryptEntityFieldValues,
-  resetEntityFieldEncryptionCacheForTests,
 } from "./entity-field-encryption";
 export type {
   BuildEntityTableMetaOptions,

package/src/db/query.ts

@@ -17,7 +17,6 @@ export {
   insertMany,
   insertOne,
   type OrderByClause,
-  runInSavepoint,
   type SelectOptions,
   selectMany,
   type TableInfo,

package/src/db/tenant-db.ts

@@ -12,21 +12,10 @@ import { SYSTEM_TENANT_ID, type TenantId } from "../engine/types/identifiers";
 import { emitDbQuery, type Meter, registerStandardMetrics, type Tracer } from "../observability";
 import type { DbRunner } from "./connection";
 import type { TableColumns } from "./dialect";
-import type { EntityTableMeta } from "./entity-table-meta";
-import type { NotExecutorOnly } from "./table-builder";
 
 // biome-ignore lint/suspicious/noExplicitAny: Dynamic tables — keys depend on user-defined schema.
 type Table = TableColumns<any>;
 
-// Method-form writes reject the executor-only brand exactly like the free-function
-// helpers (#742): a managed EntityTable is a rebuildable projection, so writing it
-// directly — free-function OR method-form — drifts the row past its event stream and
-// a rebuild wipes it. The permissive base stays (raw pgTables AND unmanaged entity
-// metas are not projections → writable); `& NotExecutorOnly` strips only branded
-// EntityTables (its `[EXECUTOR_ONLY]: true` violates the optional-never). Reads keep
-// the plain `Table` param.
-type WritableTable = (Table | EntityTableMeta) & NotExecutorOnly;
-
 /**
  * TenantDb scope modes:
  *
@@ -56,15 +45,21 @@ export type TenantDb = {
   ): Promise<readonly T[]>;
   fetchOne<T = Record<string, unknown>>(table: Table, where: WhereObject): Promise<T | undefined>;
   insertOne<T = Record<string, unknown>>(
-    table: WritableTable,
+    table: Table,
     values: Record<string, unknown>,
   ): Promise<T | undefined>;
   updateMany<T = Record<string, unknown>>(
-    table: WritableTable,
+    table: Table,
     set: Record<string, unknown>,
     where: WhereObject,
   ): Promise<readonly T[]>;
-  deleteMany(table: WritableTable, where: WhereObject): Promise<void>;
+  // Method-form writes (ctx.db.insertOne/updateMany/deleteMany) keep the erased
+  // Table param: the executor-only brand is enforced on the free-function
+  // helpers (the reflexive path all production writes take), while method-form
+  // on a branded table is covered by the guard-direct-entity-writes AST guard
+  // (P5) — branding it here would force every push+write test into casts for
+  // zero production benefit (no prod code writes a projection via method-form).
+  deleteMany(table: Table, where: WhereObject): Promise<void>;
 };
 
 // @cast-boundary tenant-db-row

package/src/engine/__tests__/boot-validator-gdpr-storage.test.ts

@@ -10,7 +10,6 @@ import {
   validateGdprStoragePersistence,
 } from "../boot-validator/gdpr-storage";
 import { defineFeature } from "../define-feature";
-import { EXT_USER_DATA } from "../extension-names";
 
 const udr = () => defineFeature("user-data-rights", () => {});
 const fileProvider = (name: string) =>
@@ -95,7 +94,7 @@ describe("validateGdprHookCompleteness (V2)", () => {
 
   test("export + delete hooks → no warn", () => {
     const f = defineFeature("my-feature", (r) => {
-      r.useExtension(EXT_USER_DATA, "myEntity", { export: exportFn, delete: deleteFn });
+      r.useExtension("userData", "myEntity", { export: exportFn, delete: deleteFn });
     });
     validateGdprHookCompleteness([f]);
     expect(warnSpy).not.toHaveBeenCalled();
@@ -103,7 +102,7 @@ describe("validateGdprHookCompleteness (V2)", () => {
 
   test("export hook without delete hook → Art.17 warn", () => {
     const f = defineFeature("my-feature", (r) => {
-      r.useExtension(EXT_USER_DATA, "myEntity", { export: exportFn });
+      r.useExtension("userData", "myEntity", { export: exportFn });
     });
     validateGdprHookCompleteness([f]);
     expect(warnSpy).toHaveBeenCalledTimes(1);
@@ -115,7 +114,7 @@ describe("validateGdprHookCompleteness (V2)", () => {
 
   test("delete hook only (no export) → no warn", () => {
     const f = defineFeature("my-feature", (r) => {
-      r.useExtension(EXT_USER_DATA, "myEntity", { delete: deleteFn });
+      r.useExtension("userData", "myEntity", { delete: deleteFn });
     });
     validateGdprHookCompleteness([f]);
     expect(warnSpy).not.toHaveBeenCalled();
@@ -131,10 +130,10 @@ describe("validateGdprHookCompleteness (V2)", () => {
 
   test("multiple features, one missing delete → one warn per missing hook", () => {
     const good = defineFeature("good", (r) => {
-      r.useExtension(EXT_USER_DATA, "entityA", { export: exportFn, delete: deleteFn });
+      r.useExtension("userData", "entityA", { export: exportFn, delete: deleteFn });
     });
     const bad = defineFeature("bad", (r) => {
-      r.useExtension(EXT_USER_DATA, "entityB", { export: exportFn });
+      r.useExtension("userData", "entityB", { export: exportFn });
     });
     validateGdprHookCompleteness([good, bad]);
     expect(warnSpy).toHaveBeenCalledTimes(1);

package/src/engine/__tests__/boot-validator.test.ts

@@ -106,10 +106,8 @@ describe("boot-validator", () => {
     expect(() => validateBoot(features)).toThrow(/token.*cannot be both encrypted and sortable/i);
   });
 
-  test("allows encrypted field when a master key keyring is available", () => {
-    process.env["KUMIKO_SECRETS_MASTER_KEY_V1"] = Buffer.from(
-      "0123456789abcdef0123456789abcdef",
-    ).toString("base64");
+  test("allows encrypted field when ENCRYPTION_KEY is set", () => {
+    process.env["ENCRYPTION_KEY"] = "test-key";
     try {
       const features = [
         defineFeature("a", (r) => {
@@ -126,34 +124,12 @@ describe("boot-validator", () => {
       ];
       expect(() => validateBoot(features)).not.toThrow();
     } finally {
-      delete process.env["KUMIKO_SECRETS_MASTER_KEY_V1"];
-    }
-  });
-
-  test("throws at boot when the master key is malformed (not 32 bytes)", () => {
-    process.env["KUMIKO_SECRETS_MASTER_KEY_V1"] = Buffer.from("too-short").toString("base64");
-    try {
-      const features = [
-        defineFeature("a", (r) => {
-          r.entity(
-            "secret",
-            createEntity({
-              table: "Secrets",
-              fields: {
-                apiKey: { type: "text", encrypted: true },
-              },
-            }),
-          );
-        }),
-      ];
-      expect(() => validateBoot(features)).toThrow(/master key/i);
-    } finally {
-      delete process.env["KUMIKO_SECRETS_MASTER_KEY_V1"];
+      delete process.env["ENCRYPTION_KEY"];
     }
   });
 
-  test("throws when encrypted fields exist but no master key is available", () => {
-    delete process.env["KUMIKO_SECRETS_MASTER_KEY_V1"];
+  test("throws when encrypted fields exist but ENCRYPTION_KEY not set", () => {
+    delete process.env["ENCRYPTION_KEY"];
     const features = [
       defineFeature("a", (r) => {
         r.entity(
@@ -167,16 +143,16 @@ describe("boot-validator", () => {
         );
       }),
     ];
-    expect(() => validateBoot(features)).toThrow(/master key/i);
+    expect(() => validateBoot(features)).toThrow(/ENCRYPTION_KEY.*required/i);
   });
 
-  test("throws when longText encrypted field exists but no master key is available", () => {
+  test("throws when longText encrypted field exists but ENCRYPTION_KEY not set", () => {
     // Drift-pin Sprint-5b-vorab-Audit Issue 1: validateEncryptedFields
     // hatte `if (field.type !== "text") continue;` und ignorierte
     // longText-encrypted-fields silently — ENCRYPTION_KEY-check wurde
     // nie getriggert, encryption silent broken. Jetzt: beide string-
     // typed fields werden gechecked.
-    delete process.env["KUMIKO_SECRETS_MASTER_KEY_V1"];
+    delete process.env["ENCRYPTION_KEY"];
     const features = [
       defineFeature("a", (r) => {
         r.entity(
@@ -190,7 +166,7 @@ describe("boot-validator", () => {
         );
       }),
     ];
-    expect(() => validateBoot(features)).toThrow(/master key/i);
+    expect(() => validateBoot(features)).toThrow(/ENCRYPTION_KEY.*required/i);
   });
 
   test("rejects encrypted text field that is also filterable", () => {

package/src/engine/__tests__/build-config-feature-schema.test.ts

@@ -256,27 +256,6 @@ describe("buildConfigFeatureSchema — access + workspace", () => {
     expect(out.navs.find((n) => n.id === "audience-tenant")?.access).toEqual({ openToAll: true });
   });
 
-  test("openToAll collapse holds regardless of key declaration order (516/2)", () => {
-    // The test above only ever puts the openToAll key first, so
-    // unionAccessRules's short-circuit (`if ("openToAll" in rule) return`)
-    // never actually has to walk past a role-restricted rule to prove it —
-    // `gated` here comes FIRST so a hypothetical short-circuit-on-first-only
-    // implementation would fail this one even though it passed the other.
-    const mixedWriteReversed = defineFeature("mixedwritereversed", (r) => {
-      r.config({
-        keys: {
-          gated: createTenantConfig("text", { mask: { title: "mwr.gated" } }), // default admin write
-          open: createTenantConfig("text", { write: access.all, mask: { title: "mwr.open" } }),
-        },
-      });
-    });
-    const out = buildConfigFeatureSchema(createRegistry([mixedWriteReversed]));
-    const screen = out.screens.find((s) => s.id === "mixedwritereversed-tenant");
-    if (screen?.type !== "configEdit")
-      throw new Error('expected configEdit screen "mixedwritereversed-tenant"');
-    expect(screen.access).toEqual({ openToAll: true });
-  });
-
   test("returns empty (no workspace) when no key opts into the hub via mask", () => {
     const plain = defineFeature("plain", (r) => {
       r.config({ keys: { secret: createSystemConfig("text", {}) } });