@cosmicdrift/kumiko-framework 0.149.0 → 0.149.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.149.0",
+  "version": "0.149.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -193,7 +193,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.149.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.149.1",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/db/event-store-executor-context.ts

@@ -271,15 +271,22 @@ export function buildExecutorContext(
     return out;
   }
 
+  // Mirror of encryptForStorage IN REVERSE — a field that carries both
+  // `encrypted: true` and a subject marker (userOwned/tenantOwned/pii) is
+  // written as PII(envelope(plaintext)) (envelope wraps first, PII wraps
+  // that as its outer layer). Decrypt must peel the OUTER layer first: PII
+  // unwrap before envelope decrypt, or the envelope cipher chokes on a
+  // still-PII-wrapped string (auth-mfa.totpSecret/recoveryCodes combine both
+  // markers; see pii-subject-encryption.integration.test.ts).
   async function decryptForRead(row: Record<string, unknown>): Promise<Record<string, unknown>> {
     let out = row;
-    if (hasEncryptedFields) {
-      out = await decryptEntityFieldValues(out, encryptedFields, fieldCipher());
-    }
     const kms = piiKms();
     if (hasPiiFields && kms) {
       out = await decryptPiiFieldValues(out, piiSubjectFields, kms, kmsContextFor());
     }
+    if (hasEncryptedFields) {
+      out = await decryptEntityFieldValues(out, encryptedFields, fieldCipher());
+    }
     return out;
   }