@cosmicdrift/kumiko-framework 0.327.0 → 0.328.1

package/src/crypto/pg-kms-adapter.ts

@@ -1,303 +0,0 @@
-import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-import postgres from "postgres";
-import { DEFAULT_DB_CLOSE_TIMEOUT_SECONDS } from "../db/api";
-import {
-  KeyAlreadyExistsError,
-  KeyErasedError,
-  KeyNotFoundError,
-  type KmsContext,
-  type KmsHealth,
-  type LocalKeyKmsAdapter,
-  type SubjectDek,
-  type SubjectId,
-  subjectIdToKey,
-} from "./kms-adapter";
-
-const IV_LENGTH = 12;
-const TAG_LENGTH = 16;
-
-// Envelope layout [iv:12][tag:16][ct] — the platform KEK wraps each subject
-// DEK at rest, so a subject-keys-DB dump alone reveals no key material.
-function wrapDek(kek: Buffer, dek: Buffer): Buffer {
-  const iv = randomBytes(IV_LENGTH);
-  const cipher = createCipheriv("aes-256-gcm", kek, iv);
-  const ciphertext = Buffer.concat([cipher.update(dek), cipher.final()]);
-  return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]);
-}
-
-function unwrapDek(kek: Buffer, wrapped: Uint8Array): SubjectDek {
-  const envelope = Buffer.from(wrapped);
-  const iv = envelope.subarray(0, IV_LENGTH);
-  const tag = envelope.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
-  const ciphertext = envelope.subarray(IV_LENGTH + TAG_LENGTH);
-  const decipher = createDecipheriv("aes-256-gcm", kek, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-}
-
-function decodePlatformKek(base64: string): Buffer {
-  const kek = Buffer.from(base64, "base64");
-  if (kek.length !== 32) {
-    throw new Error(
-      `PgKmsAdapter: platformKek must decode to 32 bytes, got ${kek.length} — expected a base64-encoded AES-256 key (openssl rand -base64 32)`,
-    );
-  }
-  return kek;
-}
-
-const PG_UNIQUE_VIOLATION = "23505";
-
-// pg_advisory_xact_lock key for createSchema — serializes concurrent cold-start
-// DDL across processes sharing one subject-keys DB.
-const SCHEMA_ADVISORY_LOCK_KEY = 0x6b_6d_73_31; // 'kms1'
-
-function isPgUniqueViolation(error: unknown): boolean {
-  return (
-    typeof error === "object" &&
-    error !== null &&
-    "code" in error &&
-    error.code === PG_UNIQUE_VIOLATION
-  );
-}
-
-interface SubjectKeyRow {
-  cipher_key: Uint8Array | null;
-  kek_version: number;
-  erased: boolean;
-}
-
-export interface PgKmsAdapterOptions {
-  /** Connection string of the DEDICATED subject-keys cluster — never the app DB (its backup retention must stay shorter, see kms-adapter.md). */
-  readonly databaseUrl: string;
-  /** Base64-encoded 32-byte platform KEK (PLATFORM_KEK env var). */
-  readonly platformKek: string;
-  /** Version of `platformKek` as stored in kumiko_subject_keys.kek_version.
-   *  Bump on rotation; new wraps carry this version. Default 1. */
-  readonly kekVersion?: number;
-  /** Older KEKs by version, kept ONLY during a rotation window so rows not
-   *  yet re-wrapped stay readable. Drop after rewrapSubjectKeys reports the
-   *  estate fully on the active version (runbook: kek-rotation.md). */
-  readonly previousKeks?: Readonly<Record<number, string>>;
-  readonly maxConnections?: number;
-}
-
-// Default production adapter: DEKs live in a separate Postgres cluster,
-// KEK-wrapped at rest. Schema is created lazily on first use — the
-// subject-keys cluster has no drizzle migration pipeline of its own.
-export class PgKmsAdapter implements LocalKeyKmsAdapter {
-  readonly capabilities = { mode: "local-key" } as const;
-
-  private readonly sql: ReturnType<typeof postgres>;
-  private readonly kek: Buffer;
-  private readonly kekVersion: number;
-  private readonly previousKeks: ReadonlyMap<number, Buffer>;
-  private schemaReady: Promise<void> | undefined;
-
-  constructor(options: PgKmsAdapterOptions) {
-    this.kek = decodePlatformKek(options.platformKek);
-    this.kekVersion = options.kekVersion ?? 1;
-    const previous = new Map<number, Buffer>();
-    for (const [version, kek] of Object.entries(options.previousKeks ?? {})) {
-      const v = Number(version);
-      if (v >= this.kekVersion) {
-        throw new Error(
-          `PgKmsAdapter: previousKeks[${v}] must be older than the active kekVersion ${this.kekVersion}`,
-        );
-      }
-      previous.set(v, decodePlatformKek(kek));
-    }
-    this.previousKeks = previous;
-    this.sql = postgres(options.databaseUrl, {
-      max: options.maxConnections ?? 4,
-      // The connection is exclusive to this adapter and its only DDL is
-      // idempotent IF NOT EXISTS — notices are pure boot-log noise.
-      onnotice: () => {},
-    });
-  }
-
-  async createKey(subject: SubjectId, ctx: KmsContext): Promise<void> {
-    await this.ensureSchema();
-    const wrapped = wrapDek(this.kek, randomBytes(32));
-    try {
-      await this.sql`
-        INSERT INTO kumiko_subject_keys (subject_id, cipher_key, kek_version, created_by)
-        VALUES (${subjectIdToKey(subject)}, ${wrapped}, ${this.kekVersion}, ${ctx.userId ?? null})`;
-    } catch (error) {
-      if (isPgUniqueViolation(error)) throw new KeyAlreadyExistsError(subject);
-      throw error;
-    }
-  }
-
-  async getKey(subject: SubjectId, _ctx: KmsContext): Promise<SubjectDek> {
-    await this.ensureSchema();
-    const rows = await this.sql<SubjectKeyRow[]>`
-      SELECT cipher_key, kek_version, (erased_at IS NOT NULL) AS erased
-      FROM kumiko_subject_keys
-      WHERE subject_id = ${subjectIdToKey(subject)}`;
-    const row = rows[0];
-    if (!row) throw new KeyNotFoundError(subject);
-    if (row.erased || row.cipher_key === null) throw new KeyErasedError(subject);
-    return unwrapDek(this.kekFor(row.kek_version, subject), row.cipher_key);
-  }
-
-  // Rows keep working mid-rotation: not-yet-rewrapped DEKs name their KEK
-  // generation and unwrap with the matching previous key. A version with no
-  // configured key is a hard config error — NOT a shredded subject.
-  private kekFor(version: number, subject: SubjectId): Buffer {
-    if (version === this.kekVersion) return this.kek;
-    const previous = this.previousKeks.get(version);
-    if (previous) return previous;
-    throw new Error(
-      `PgKmsAdapter: subject ${subjectIdToKey(subject)} is wrapped with KEK version ${version} but only version ${this.kekVersion}${this.previousKeks.size > 0 ? ` (+previous ${[...this.previousKeks.keys()].join(",")})` : ""} is configured — pass previousKeks during rotation (runbook: kek-rotation.md).`,
-    );
-  }
-
-  async eraseKey(subject: SubjectId, ctx: KmsContext): Promise<void> {
-    await this.ensureSchema();
-    // Guard on erased_at IS NULL keeps repeat erases from overwriting the
-    // original tombstone audit fields; unknown subjects update zero rows.
-    await this.sql`
-      UPDATE kumiko_subject_keys
-      SET cipher_key = NULL,
-          erased_at = now(),
-          erased_by = ${ctx.userId ?? null},
-          erase_reason = ${ctx.eraseReason ?? null}
-      WHERE subject_id = ${subjectIdToKey(subject)} AND erased_at IS NULL`;
-  }
-
-  async health(): Promise<KmsHealth> {
-    const start = Date.now();
-    await this.ensureSchema();
-    await this.sql`SELECT 1`;
-    return { ok: true, latencyMs: Date.now() - start };
-  }
-
-  async close(): Promise<void> {
-    await this.sql.end({ timeout: DEFAULT_DB_CLOSE_TIMEOUT_SECONDS });
-  }
-
-  private ensureSchema(): Promise<void> {
-    // A failed attempt resets the memo so a transient DB outage does not
-    // poison the adapter for the rest of the process lifetime.
-    this.schemaReady ??= this.createSchema().catch((error) => {
-      this.schemaReady = undefined;
-      throw error;
-    });
-    return this.schemaReady;
-  }
-
-  private async createSchema(): Promise<void> {
-    await this.sql.begin(async (tx) => {
-      await tx`SELECT pg_advisory_xact_lock(${SCHEMA_ADVISORY_LOCK_KEY})`;
-      await tx`
-        CREATE TABLE IF NOT EXISTS kumiko_subject_keys (
-          subject_id    TEXT        PRIMARY KEY,
-          cipher_key    BYTEA,
-          kek_version   INTEGER     NOT NULL DEFAULT 1,
-          created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
-          created_by    TEXT,
-          erased_at     TIMESTAMPTZ,
-          erased_by     TEXT,
-          erase_reason  TEXT
-        )`;
-      await tx`
-        CREATE INDEX IF NOT EXISTS kumiko_subject_keys_erased_idx
-        ON kumiko_subject_keys (erased_at) WHERE erased_at IS NOT NULL`;
-      await tx`
-        CREATE INDEX IF NOT EXISTS kumiko_subject_keys_audit_idx
-        ON kumiko_subject_keys (created_at, erased_at)`;
-    });
-  }
-}
-
-export function createPgKmsAdapter(options: PgKmsAdapterOptions): PgKmsAdapter {
-  return new PgKmsAdapter(options);
-}
-
-export interface RewrapOptions {
-  readonly databaseUrl: string;
-  /** Older KEKs by version — every version still present in the table must be covered. */
-  readonly fromKeks: Readonly<Record<number, string>>;
-  /** The new active KEK and its version (previous active version + 1). */
-  readonly toKek: string;
-  readonly toKekVersion: number;
-  readonly batchSize?: number;
-  readonly dryRun?: boolean;
-}
-
-export interface RewrapResult {
-  readonly scanned: number;
-  readonly rewrapped: number;
-  readonly skippedErased: number;
-  readonly failures: ReadonlyArray<{ readonly subjectId: string; readonly reason: string }>;
-}
-
-// One-time KEK rotation (runbook: kek-rotation.md). Unwraps every live DEK
-// wrapped with an older KEK generation and re-wraps it under the new KEK,
-// bumping kek_version. Idempotent: rows already on toKekVersion are not
-// selected; a second run reports 0. Erased tombstones (cipher_key NULL) are
-// never touched. The UPDATE is guarded on the row's old kek_version, so a
-// concurrent app writing fresh keys on the new version is never clobbered.
-export async function rewrapSubjectKeys(options: RewrapOptions): Promise<RewrapResult> {
-  const toKek = decodePlatformKek(options.toKek);
-  const fromKeks = new Map<number, Buffer>();
-  for (const [version, kek] of Object.entries(options.fromKeks)) {
-    fromKeks.set(Number(version), decodePlatformKek(kek));
-  }
-  const batchSize = options.batchSize ?? 200;
-  const sql = postgres(options.databaseUrl, { max: 2, onnotice: () => {} });
-
-  const result = {
-    scanned: 0,
-    rewrapped: 0,
-    skippedErased: 0,
-    failures: [] as Array<{ subjectId: string; reason: string }>,
-  };
-  try {
-    let cursor = "";
-    for (;;) {
-      const rows = await sql<
-        Array<{ subject_id: string; cipher_key: Uint8Array | null; kek_version: number }>
-      >`
-        SELECT subject_id, cipher_key, kek_version
-        FROM kumiko_subject_keys
-        WHERE kek_version <> ${options.toKekVersion} AND subject_id > ${cursor}
-        ORDER BY subject_id ASC
-        LIMIT ${batchSize}`;
-      if (rows.length === 0) break;
-
-      for (const row of rows) {
-        result.scanned++;
-        if (row.cipher_key === null) {
-          result.skippedErased++;
-          continue;
-        }
-        try {
-          const fromKek = fromKeks.get(row.kek_version);
-          if (!fromKek) {
-            throw new Error(`no fromKek configured for kek_version ${row.kek_version}`);
-          }
-          const rewrapped = wrapDek(toKek, unwrapDek(fromKek, row.cipher_key));
-          if (!options.dryRun) {
-            await sql`
-              UPDATE kumiko_subject_keys
-              SET cipher_key = ${rewrapped}, kek_version = ${options.toKekVersion}
-              WHERE subject_id = ${row.subject_id} AND kek_version = ${row.kek_version}`;
-          }
-          result.rewrapped++;
-        } catch (error) {
-          result.failures.push({
-            subjectId: row.subject_id,
-            reason: error instanceof Error ? error.message : String(error),
-          });
-        }
-      }
-      const last = rows[rows.length - 1];
-      if (last === undefined) break;
-      cursor = last.subject_id;
-    }
-  } finally {
-    await sql.end();
-  }
-  return result;
-}

package/src/crypto/pii-field-encryption.ts

@@ -1,266 +0,0 @@
-// PII field encryption with per-subject DEKs (crypto-shredding, #724 phase C).
-// Same executor hook points as `encrypted: true`, but the key belongs to the
-// erase subject — kms.eraseKey(subject) makes every value unreadable at once.
-// Storage format is a sniffable string that fits existing text columns and
-// names its subject inline, so decrypt needs no schema change and no resolver:
-//   kumiko-pii:v2:<subjectKey>:<base64(iv|tag|ciphertext)>
-// v2 GCM-binds the ciphertext to `subjectKey|field` as AAD (#1263) — subject
-// selects the DEK, field stops a cut-and-paste between two fields of the
-// SAME subject (same DEK, so key selection alone can't catch that) from
-// decrypting silently. v1 (no AAD) stays decrypt-only for pre-#1263 rows;
-// every new write emits v2.
-
-import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-import type { EntityDefinition } from "../engine/types/fields";
-import type { TenantId } from "../engine/types/identifiers";
-import { assertIrreversibleOperationAllowed } from "../pipeline/irreversible-operation-gate";
-import {
-  isLocalKeyKmsAdapter,
-  KeyAlreadyExistsError,
-  KeyErasedError,
-  KeyNotFoundError,
-  type KmsAdapter,
-  type KmsContext,
-  type LocalKeyKmsAdapter,
-  type SubjectDek,
-  type SubjectId,
-  subjectIdFromKey,
-  subjectIdToKey,
-} from "./kms-adapter";
-import { resolveSubjectForField } from "./subject-resolver";
-
-// Spec value (crypto-shredding.md) — renderers show it verbatim.
-export const PII_ERASED_SENTINEL = "[[erased]]";
-
-const PII_CIPHERTEXT_PREFIX_V1 = "kumiko-pii:v1:";
-export const PII_CIPHERTEXT_PREFIX = "kumiko-pii:v2:";
-const IV_LENGTH = 12;
-const AUTH_TAG_LENGTH = 16;
-
-export function isPiiCiphertext(value: unknown): value is string {
-  return (
-    typeof value === "string" &&
-    (value.startsWith(PII_CIPHERTEXT_PREFIX) || value.startsWith(PII_CIPHERTEXT_PREFIX_V1))
-  );
-}
-
-function buildAad(subject: SubjectId, field: string): Buffer {
-  return Buffer.from(`${subjectIdToKey(subject)}|${field}`, "utf8");
-}
-
-function encryptValue(
-  subject: SubjectId,
-  dek: SubjectDek,
-  plaintext: string,
-  field: string,
-): string {
-  const iv = randomBytes(IV_LENGTH);
-  const cipher = createCipheriv("aes-256-gcm", dek, iv);
-  cipher.setAAD(buildAad(subject, field));
-  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  const blob = Buffer.concat([iv, cipher.getAuthTag(), ciphertext]);
-  return `${PII_CIPHERTEXT_PREFIX}${subjectIdToKey(subject)}:${blob.toString("base64")}`;
-}
-
-function parseCiphertext(value: string): { subject: SubjectId; blob: Buffer; hasAad: boolean } {
-  const hasAad = value.startsWith(PII_CIPHERTEXT_PREFIX);
-  const prefix = hasAad ? PII_CIPHERTEXT_PREFIX : PII_CIPHERTEXT_PREFIX_V1;
-  const rest = value.slice(prefix.length);
-  // subjectKey itself contains ":" ("user:<id>") — base64 never does, so the
-  // last ":" is always the key/blob separator.
-  const sep = rest.lastIndexOf(":");
-  if (sep === -1) throw new Error(`Malformed PII ciphertext (no subject/blob separator)`);
-  return {
-    subject: subjectIdFromKey(rest.slice(0, sep)),
-    blob: Buffer.from(rest.slice(sep + 1), "base64"),
-    hasAad,
-  };
-}
-
-function decryptValue(
-  dek: SubjectDek,
-  blob: Buffer,
-  subject: SubjectId,
-  field: string,
-  hasAad: boolean,
-): string {
-  const iv = blob.subarray(0, IV_LENGTH);
-  const tag = blob.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
-  const ciphertext = blob.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
-  const decipher = createDecipheriv("aes-256-gcm", dek, iv);
-  if (hasAad) decipher.setAAD(buildAad(subject, field));
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
-}
-
-// First write to a PII field of a new subject creates the key implicitly
-// (user-signup / tenant-create need no extra hook). The AlreadyExists catch
-// covers the concurrent-first-write race; a tombstoned subject re-throws
-// KeyErasedError from the final getKey — writes to a forgotten subject fail.
-async function getOrCreateDek(
-  kms: LocalKeyKmsAdapter,
-  subject: SubjectId,
-  ctx: KmsContext,
-): Promise<SubjectDek> {
-  try {
-    return await kms.getKey(subject, ctx);
-  } catch (e) {
-    if (!(e instanceof KeyNotFoundError)) throw e;
-  }
-  try {
-    await kms.createKey(subject, ctx);
-  } catch (e) {
-    if (!(e instanceof KeyAlreadyExistsError)) throw e;
-  }
-  return kms.getKey(subject, ctx);
-}
-
-// Single-value encrypt for callers that resolve the subject themselves
-// (event-pii catalog, backfill). Ciphertext/sentinel inputs pass through —
-// idempotent like the field-map variant. `field` names the value's storage
-// slot (payload field / config key) — part of the AAD, so it must match the
-// `field` passed to decryptPiiValueForSubject for the same value.
-export async function encryptPiiValueForSubject(
-  kms: LocalKeyKmsAdapter,
-  subject: SubjectId,
-  value: string,
-  kmsCtx: KmsContext,
-  field: string,
-): Promise<string> {
-  if (isPiiCiphertext(value) || value === PII_ERASED_SENTINEL) return value;
-  const dek = await getOrCreateDek(kms, subject, kmsCtx);
-  return encryptValue(subject, dek, value, field);
-}
-
-// Single-value decrypt for callers that don't have an entity/field-map to
-// pass through decryptPiiFieldValues (config values). The subject lives
-// inside the ciphertext itself, so no subject/scope resolution is needed
-// on this side — only the encrypt direction has to pick one. `field` must
-// match the one used at encrypt time (AAD) or decrypt fails loud.
-export async function decryptPiiValueForSubject(
-  kms: LocalKeyKmsAdapter,
-  value: string,
-  kmsCtx: KmsContext,
-  field: string,
-): Promise<string> {
-  if (!isPiiCiphertext(value)) return value;
-  const { subject, blob, hasAad } = parseCiphertext(value);
-  try {
-    return decryptValue(await kms.getKey(subject, kmsCtx), blob, subject, field, hasAad);
-  } catch (e) {
-    if (!(e instanceof KeyErasedError)) throw e;
-    return PII_ERASED_SENTINEL;
-  }
-}
-
-export interface EncryptPiiOptions {
-  readonly onlyKeys?: Iterable<string>;
-  // Write-time tenant for tenantOwned fields on rows without a tenantId column.
-  readonly tenantId?: TenantId;
-  // Row to resolve subjects from when `row` is a partial (update changes may
-  // carry a pii field without its ownerField — the merged row still has it).
-  readonly subjectSource?: Record<string, unknown>;
-  // Canonical registry entity name — required to resolve recordOwned fields.
-  readonly entityName: string;
-}
-
-export async function encryptPiiFieldValues(
-  row: Record<string, unknown>,
-  entity: EntityDefinition,
-  piiFields: readonly string[],
-  kms: LocalKeyKmsAdapter,
-  kmsCtx: KmsContext,
-  opts: EncryptPiiOptions,
-): Promise<Record<string, unknown>> {
-  if (piiFields.length === 0) return row;
-  const only = opts.onlyKeys ? new Set(opts.onlyKeys) : null;
-  const subjectSource = opts.subjectSource ?? row;
-  const out = { ...row };
-  for (const name of piiFields) {
-    if (only && !only.has(name)) continue;
-    if (!(name in out)) continue;
-    const value = out[name];
-    if (value === null || value === undefined) continue;
-    // Re-encrypt paths (update previous, detail cache) may see values that
-    // are already ciphertext or the erased sentinel — both stay as-is.
-    if (isPiiCiphertext(value) || value === PII_ERASED_SENTINEL) continue;
-    if (typeof value !== "string") {
-      throw new Error(`PII field "${name}" must be a string, got ${typeof value}`);
-    }
-    const subject = resolveSubjectForField(entity, name, subjectSource, {
-      entityName: opts.entityName,
-      ...(opts.tenantId !== undefined && { tenantId: opts.tenantId }),
-    });
-    // skip: collectPiiSubjectFields only yields annotated fields — null is unreachable, kept as a type guard
-    if (subject === null) continue;
-    const dek = await getOrCreateDek(kms, subject, kmsCtx);
-    out[name] = encryptValue(subject, dek, value, name);
-  }
-  return out;
-}
-
-export async function decryptPiiFieldValues(
-  row: Record<string, unknown>,
-  piiFields: readonly string[],
-  kms: LocalKeyKmsAdapter,
-  kmsCtx: KmsContext,
-): Promise<Record<string, unknown>> {
-  if (piiFields.length === 0) return row;
-  const out = { ...row };
-  for (const name of piiFields) {
-    const value = out[name];
-    // Pre-engine plaintext rows pass through unchanged (mixed-state reads
-    // work during rollout; backfill is tracked in kumiko-framework#799).
-    if (!isPiiCiphertext(value)) continue;
-    const { subject, blob, hasAad } = parseCiphertext(value);
-    try {
-      out[name] = decryptValue(await kms.getKey(subject, kmsCtx), blob, subject, name, hasAad);
-    } catch (e) {
-      // KeyNotFound deliberately propagates: ciphertext without a key row
-      // means the key store is wrong (not shredded) — fail loud.
-      if (!(e instanceof KeyErasedError)) throw e;
-      out[name] = PII_ERASED_SENTINEL;
-    }
-  }
-  return out;
-}
-
-// Boot-injected app-wide subject KMS, mirroring configureEntityFieldEncryption:
-// run{Prod,Dev}App call configurePiiSubjectKms once; executors resolve lazily.
-// Absent adapter = engine off (pii fields stay plaintext, pre-phase-C
-// behavior) — the hard boot gate arrives with the prod-grade PgKmsAdapter
-// (phase E); until then no production deployment can satisfy it.
-let injectedKms: LocalKeyKmsAdapter | undefined;
-
-// Explicit delegation: adapters are class instances with prototype methods (no spread/Object.create).
-function gateIrreversibleKmsErase(adapter: LocalKeyKmsAdapter): LocalKeyKmsAdapter {
-  return {
-    capabilities: adapter.capabilities,
-    createKey: (subject, ctx) => adapter.createKey(subject, ctx),
-    getKey: (subject, ctx) => adapter.getKey(subject, ctx),
-    health: () => adapter.health(),
-    eraseKey: async (subject, ctx) => {
-      assertIrreversibleOperationAllowed("kms.eraseKey");
-      await adapter.eraseKey(subject, ctx);
-    },
-  };
-}
-
-export function configurePiiSubjectKms(adapter: KmsAdapter | undefined): void {
-  if (adapter !== undefined && !isLocalKeyKmsAdapter(adapter)) {
-    throw new Error(
-      "PII field encryption requires a local-key KMS adapter — remote-crypto " +
-        "(Vault transit) support lands with the BYOK adapter.",
-    );
-  }
-  injectedKms = adapter && gateIrreversibleKmsErase(adapter);
-}
-
-export function configuredPiiSubjectKms(): LocalKeyKmsAdapter | undefined {
-  return injectedKms;
-}
-
-/** @internal test-only */
-export function resetPiiSubjectKmsForTests(): void {
-  injectedKms = undefined;
-}

package/src/crypto/request-kms-cache.ts

@@ -1,38 +0,0 @@
-import type {
-  KmsContext,
-  LocalKeyKmsAdapter,
-  SubjectDek,
-  SubjectId,
-  SubjectKey,
-} from "./kms-adapter";
-import { subjectIdToKey } from "./kms-adapter";
-
-// Per-request DEK cache: a list rendering 50 comments of one author does one
-// adapter round-trip, not 50. Only meaningful for local-key adapters —
-// remote-crypto backends never release keys, every call is a round-trip.
-export interface RequestKmsCache {
-  getKey(subject: SubjectId, ctx: KmsContext): Promise<SubjectDek>;
-  /** Drops one subject's cached DEK — called when its key is shredded mid-request. */
-  invalidate(subject: SubjectId): void;
-  clear(): void;
-}
-
-export function createRequestKmsCache(adapter: LocalKeyKmsAdapter): RequestKmsCache {
-  const cache = new Map<SubjectKey, SubjectDek>();
-  return {
-    async getKey(subject, ctx) {
-      const subjectKey = subjectIdToKey(subject);
-      const hit = cache.get(subjectKey);
-      if (hit !== undefined) return hit;
-      const dek = await adapter.getKey(subject, ctx);
-      cache.set(subjectKey, dek);
-      return dek;
-    },
-    invalidate(subject) {
-      cache.delete(subjectIdToKey(subject));
-    },
-    clear() {
-      cache.clear();
-    },
-  };
-}