@cosmicdrift/kumiko-framework 1.0.0 → 2.0.0

package/src/engine/__tests__/store-table.test.ts

@@ -0,0 +1,229 @@
+// Unit tests for r.storeTable() — declaration-time validation + registry
+// aggregation. Post-drizzle-cut merge of the former r.storeTable() (legacy
+// Drizzle PgTable) and r.unmanagedTable() (EntityTableMeta) — this file
+// absorbs the former unmanaged-table.test.ts coverage under the new name.
+// Full DB roundtrip (setupTestStack pushes the table → INSERT / SELECT)
+// lives in src/__tests__/store-table.integration.test.ts.
+
+import { describe, expect, test } from "bun:test";
+import {
+  buildEntityTableMeta,
+  defineUnmanagedTable,
+  resolveTableName,
+} from "../../db/entity-table-meta";
+import { defineFeature } from "../define-feature";
+import { createEntity, createTextField } from "../index";
+import { createRegistry } from "../registry";
+
+const probeMeta = defineUnmanagedTable({
+  tableName: "rt_probe",
+  columns: [{ name: "id", pgType: "text", notNull: true, primaryKey: true }],
+});
+const probeMetaTwo = defineUnmanagedTable({
+  tableName: "rt_probe_two",
+  columns: [{ name: "id", pgType: "text", notNull: true, primaryKey: true }],
+});
+
+describe("r.storeTable — declaration", () => {
+  test("rejects an invalid table name", () => {
+    const badMeta = defineUnmanagedTable({
+      tableName: "BadName",
+      columns: [{ name: "id", pgType: "text", notNull: true, primaryKey: true }],
+    });
+    expect(() =>
+      defineFeature("probe", (r) => {
+        r.storeTable(badMeta, { reason: "test" });
+      }),
+    ).toThrow(/must be a valid identifier/);
+  });
+
+  test("rejects duplicate registrations within one feature", () => {
+    expect(() =>
+      defineFeature("probe", (r) => {
+        r.storeTable(probeMeta, { reason: "test" });
+        r.storeTable(probeMeta, { reason: "test" });
+      }),
+    ).toThrow(/already registered/);
+  });
+
+  test("rejects empty reason", () => {
+    expect(() =>
+      defineFeature("probe", (r) => {
+        r.storeTable(probeMeta, { reason: "" });
+      }),
+    ).toThrow(/options\.reason must be a non-empty string/);
+  });
+
+  test("rejects whitespace-only reason", () => {
+    expect(() =>
+      defineFeature("probe", (r) => {
+        r.storeTable(probeMeta, { reason: "   " });
+      }),
+    ).toThrow(/options\.reason must be a non-empty string/);
+  });
+
+  test("rejects an EntityTableMeta whose source is not 'unmanaged' (#1209)", () => {
+    const managedEntity = createEntity({
+      table: "rt_probe_managed",
+      fields: { name: createTextField() },
+    });
+    const managedMeta = buildEntityTableMeta("rt-probe-managed", managedEntity);
+    expect(() =>
+      defineFeature("probe", (r) => {
+        r.storeTable(managedMeta, { reason: "test" });
+      }),
+    ).toThrow(/requires source: "unmanaged"/);
+  });
+
+  test("rejects a table name with the reserved read_ prefix (#1220)", () => {
+    const readPrefixed = defineUnmanagedTable({
+      tableName: "read_rt_probe",
+      columns: [{ name: "id", pgType: "text", notNull: true, primaryKey: true }],
+    });
+    expect(() =>
+      defineFeature("probe", (r) => {
+        r.storeTable(readPrefixed, { reason: "test" });
+      }),
+    ).toThrow(/the "read_" prefix is reserved/);
+  });
+
+  test("accepts valid registration and stores meta + reason", () => {
+    const feature = defineFeature("probe", (r) => {
+      r.storeTable(probeMeta, {
+        reason: "read-side projection of an event-stream",
+      });
+    });
+    expect(feature.storeTables).toHaveProperty("rt_probe");
+    expect(feature.storeTables["rt_probe"]?.reason).toBe("read-side projection of an event-stream");
+    expect(feature.storeTables["rt_probe"]?.meta).toBe(probeMeta);
+  });
+
+  test("two store tables on one feature register under their tableName", () => {
+    const feature = defineFeature("dual", (r) => {
+      r.storeTable(probeMeta, { reason: "one" });
+      r.storeTable(probeMetaTwo, { reason: "two" });
+    });
+    expect(Object.keys(feature.storeTables).sort()).toEqual(["rt_probe", "rt_probe_two"]);
+  });
+
+  test("absent storeTables on a feature is ok", () => {
+    const feat = defineFeature("plain", () => {
+      // no r.storeTable calls
+    });
+    expect(feat.storeTables).toEqual({});
+  });
+});
+
+describe("createRegistry — storeTable aggregation", () => {
+  test("aggregates store tables across features and tags featureName", () => {
+    const featA = defineFeature("billing", (r) => {
+      r.storeTable(probeMeta, { reason: "external API cache" });
+    });
+    const featB = defineFeature("inventory", (r) => {
+      r.storeTable(probeMetaTwo, { reason: "imported pre-ES" });
+    });
+
+    const registry = createRegistry([featA, featB]);
+    const all = registry.getAllStoreTables();
+
+    expect(all.size).toBe(2);
+    expect(all.get("rt_probe")?.featureName).toBe("billing");
+    expect(all.get("rt_probe")?.reason).toBe("external API cache");
+    expect(all.get("rt_probe_two")?.featureName).toBe("inventory");
+  });
+
+  test("rejects cross-feature tableName collisions at boot", () => {
+    // Two features can't share the same physical tableName — migrate-runner
+    // would race two CREATE TABLE statements. Boot-validator catches it.
+    const featA = defineFeature("a", (r) => {
+      r.storeTable(probeMeta, { reason: "first" });
+    });
+    const featB = defineFeature("b", (r) => {
+      r.storeTable(probeMeta, { reason: "second" });
+    });
+    expect(() => createRegistry([featA, featB])).toThrow(
+      /Store-table "rt_probe" registered by both feature "a" and "b"/,
+    );
+  });
+
+  test("two features with distinct tableNames register cleanly", () => {
+    const featA = defineFeature("a", (r) => {
+      r.storeTable(probeMeta, { reason: "first" });
+    });
+    const featB = defineFeature("b", (r) => {
+      r.storeTable(probeMetaTwo, { reason: "second" });
+    });
+    expect(() => createRegistry([featA, featB])).not.toThrow();
+  });
+
+  test("rejects a store-table that collides with an entity's physical name", () => {
+    // Custom `table` override without the read_ prefix — resolveTableName's
+    // default would carry read_, which r.storeTable now rejects outright
+    // (#1220), so the collision case needs a table name storeTable can
+    // actually register.
+    const widget = createEntity({ table: "shop_widgets", fields: { name: createTextField() } });
+    // resolveTableName mirrors the migrate-runner — pin the exact physical name.
+    const physical = resolveTableName("widget", widget, "shop");
+    const clashing = defineUnmanagedTable({
+      tableName: physical,
+      columns: [{ name: "id", pgType: "text", notNull: true, primaryKey: true }],
+    });
+    const entityFeature = defineFeature("shop", (r) => {
+      r.entity("widget", widget);
+    });
+    const tableFeature = defineFeature("other", (r) => {
+      r.storeTable(clashing, { reason: "clash" });
+    });
+
+    // Entity registered first, then the colliding store table.
+    expect(() => createRegistry([entityFeature, tableFeature])).toThrow(
+      new RegExp(`Store-table "${physical}".*collides with the physical table of entity "widget"`),
+    );
+
+    // Order-independent: store table registered first, then the entity.
+    expect(() => createRegistry([tableFeature, entityFeature])).toThrow(
+      new RegExp(`Entity "widget".*collides with r.storeTable\\("${physical}"\\)`),
+    );
+  });
+});
+
+describe("createRegistry — store tables with PII-annotated fields (#820)", () => {
+  const piiEntity = createEntity({
+    table: "rt_pii_probe",
+    fields: {
+      userId: createTextField({ required: true }),
+      ip: createTextField({ userOwned: { ownerField: "userId" } }),
+    },
+  });
+  const piiMeta = buildEntityTableMeta("rt-pii-probe", piiEntity, { source: "unmanaged" });
+
+  test("buildEntityTableMeta records the subject-annotated field names", () => {
+    expect(piiMeta.piiSubjectFields).toEqual(["ip"]);
+  });
+
+  test("rejects a PII-carrying store table without piiEncryptedOnWrite", () => {
+    const feat = defineFeature("probe", (r) => {
+      r.storeTable(piiMeta, { reason: "direct-write store" });
+    });
+    expect(() => createRegistry([feat])).toThrow(
+      /has PII-annotated fields \(ip\) but direct writes bypass the executor's PII encryption/,
+    );
+  });
+
+  test("accepts it once the feature declares piiEncryptedOnWrite", () => {
+    const feat = defineFeature("probe", (r) => {
+      r.storeTable(piiMeta, {
+        reason: "direct-write store",
+        piiEncryptedOnWrite: true,
+      });
+    });
+    expect(() => createRegistry([feat])).not.toThrow();
+  });
+
+  test("a PII-free store table needs no declaration", () => {
+    const feat = defineFeature("probe", (r) => {
+      r.storeTable(probeMeta, { reason: "plain store" });
+    });
+    expect(() => createRegistry([feat])).not.toThrow();
+  });
+});

package/src/engine/__tests__/tier-resolver-extension.test.ts

@@ -5,7 +5,11 @@
 
 import { describe, expect, test } from "bun:test";
 import { createEntity, defineFeature } from "../index";
-import { findTierResolverUsage, TENANT_TIER_RESOLVER_EXT } from "../tier-resolver-extension";
+import {
+  findTierResolverUsage,
+  isTierResolverPlugin,
+  TENANT_TIER_RESOLVER_EXT,
+} from "../tier-resolver-extension";
 
 function tierResolverFeature(name: string) {
   return defineFeature(name, (r) => {
@@ -49,3 +53,17 @@ describe("findTierResolverUsage", () => {
     expect(findTierResolverUsage([])).toBeUndefined();
   });
 });
+
+describe("isTierResolverPlugin", () => {
+  test("true when build is a function", () => {
+    expect(isTierResolverPlugin({ build: async () => new Set() })).toBe(true);
+  });
+
+  test("false for null, non-objects, and missing/non-fn build", () => {
+    expect(isTierResolverPlugin(null)).toBe(false);
+    expect(isTierResolverPlugin(undefined)).toBe(false);
+    expect(isTierResolverPlugin("x")).toBe(false);
+    expect(isTierResolverPlugin({})).toBe(false);
+    expect(isTierResolverPlugin({ build: 1 })).toBe(false);
+  });
+});

package/src/engine/__tests__/{visual-tree-patterns.test.ts → tree-actions-patterns.test.ts}

@@ -1,15 +1,5 @@
 import { describe, expect, test } from "bun:test";
 import { buildTarget, createRegistry, defineFeature } from "../index";
-import type { TreeChildrenSubscribe, TreeNode } from "../types/tree-node";
-
-// Stub-Provider für Tests. Form: (ctx) => (emit) => unsubscribe.
-// Emittet einmal initial, kein Cleanup nötig (no-op unsubscribe).
-function makeStubProvider(nodes: readonly TreeNode[]): TreeChildrenSubscribe {
-  return () => (emit) => {
-    emit(nodes);
-    return () => {};
-  };
-}
 
 describe("r.treeActions — registrar slot", () => {
   test("feature without r.treeActions leaves the slot undefined", () => {
@@ -63,80 +53,12 @@ describe("r.treeActions — registrar slot", () => {
   });
 });
 
-describe("r.tree — registrar slot", () => {
-  test("feature without r.tree leaves the slot undefined", () => {
-    const feature = defineFeature("empty", () => {});
-    expect(feature.treeProvider).toBeUndefined();
-  });
-
-  test("single r.tree call stores the provider function on the FeatureDefinition", () => {
-    const provider = makeStubProvider([{ label: "Marketing" }]);
-    const feature = defineFeature("text-content", (r) => {
-      r.tree(provider);
-    });
-    expect(feature.treeProvider).toBe(provider);
-  });
-
-  test("second r.tree call throws — only-once-guard", () => {
-    expect(() =>
-      defineFeature("dupe", (r) => {
-        r.tree(makeStubProvider([]));
-        r.tree(makeStubProvider([]));
-      }),
-    ).toThrow(/r\.tree\(\) already called/);
-  });
-
-  test("treeActions and tree are independent slots — can declare one without the other", () => {
-    const onlyActions = defineFeature("a", (r) => {
-      r.treeActions({ list: {} });
-    });
-    expect(onlyActions.treeActions).toBeDefined();
-    expect(onlyActions.treeProvider).toBeUndefined();
-
-    const onlyProvider = defineFeature("b", (r) => {
-      r.tree(makeStubProvider([]));
-    });
-    expect(onlyProvider.treeActions).toBeUndefined();
-    expect(onlyProvider.treeProvider).toBeDefined();
-  });
-});
-
-describe("Registry.getTreeProviders + getTreeActions", () => {
-  test("empty registry returns empty providers map and undefined actions", () => {
+describe("Registry.getTreeActions", () => {
+  test("empty registry returns undefined actions", () => {
     const reg = createRegistry([]);
-    expect(reg.getTreeProviders().size).toBe(0);
     expect(reg.getTreeActions("nonexistent")).toBeUndefined();
   });
 
-  test("aggregates providers from multiple features keyed by feature name", () => {
-    const providerA = makeStubProvider([{ label: "A-root" }]);
-    const providerB = makeStubProvider([{ label: "B-root" }]);
-    const featureA = defineFeature("text-content", (r) => {
-      r.tree(providerA);
-    });
-    const featureB = defineFeature("legal-pages", (r) => {
-      r.tree(providerB);
-    });
-    const reg = createRegistry([featureA, featureB]);
-
-    const providers = reg.getTreeProviders();
-    expect(providers.size).toBe(2);
-    expect(providers.get("text-content")).toBe(providerA);
-    expect(providers.get("legal-pages")).toBe(providerB);
-  });
-
-  test("features without r.tree are absent from the providers map (Zero-Whitelist-Filter)", () => {
-    const featureWithProvider = defineFeature("text-content", (r) => {
-      r.tree(makeStubProvider([]));
-    });
-    const featureWithoutProvider = defineFeature("schema-editor", () => {});
-    const reg = createRegistry([featureWithProvider, featureWithoutProvider]);
-
-    const providers = reg.getTreeProviders();
-    expect(providers.has("text-content")).toBe(true);
-    expect(providers.has("schema-editor")).toBe(false);
-  });
-
   test("getTreeActions returns the erased map for a feature that declared r.treeActions", () => {
     const feature = defineFeature("text-content", (r) => {
       r.treeActions({
@@ -153,9 +75,7 @@ describe("Registry.getTreeProviders + getTreeActions", () => {
   });
 
   test("getTreeActions returns undefined for a feature without r.treeActions", () => {
-    const feature = defineFeature("no-actions", (r) => {
-      r.tree(makeStubProvider([]));
-    });
+    const feature = defineFeature("no-actions", () => {});
     const reg = createRegistry([feature]);
 
     expect(reg.getTreeActions("no-actions")).toBeUndefined();
@@ -169,7 +89,7 @@ describe("Registry.getTreeProviders + getTreeActions", () => {
 // returnt einen typed Handle, der via setup-export durch FeatureDefinition
 // fließt und compile-time-typisiert vom Schicht-1-buildTarget konsumiert
 // wird. Ohne diese Tests würde ein Type-Drift in einer der zwei Schichten
-// erst in V.1.1 sichtbar — siehe advisor-Verdict + Memory `[EventDef-
+// erst spät sichtbar — siehe advisor-Verdict + Memory `[EventDef-
 // Exports-Pattern]`.
 // =============================================================================
 
@@ -219,18 +139,10 @@ describe("Schicht-1↔Schicht-2 Bridge — buildTarget against real defineFeatur
     buildTarget({ target: textContent.exports.handle, action: "delet", args: { slug: "x" } });
 
     // @ts-expect-error — slug muss string sein, nicht number
-    buildTarget({
-      target: textContent.exports.handle,
-      action: "edit",
-      args: { slug: 42 },
-    });
+    buildTarget({ target: textContent.exports.handle, action: "edit", args: { slug: 42 } });
 
-    buildTarget({
-      target: textContent.exports.handle,
-      action: "list",
-      // @ts-expect-error — list hat keine args, args-Feld nicht erlaubt
-      args: { x: 1 },
-    });
+    // @ts-expect-error — list hat keine args, args-Feld nicht erlaubt
+    buildTarget({ target: textContent.exports.handle, action: "list", args: { x: 1 } });
 
     // @ts-expect-error — edit braucht args, fehlt
     buildTarget({ target: textContent.exports.handle, action: "edit" });

package/src/engine/__tests__/validate-projection-allowlist.test.ts

@@ -11,7 +11,7 @@ import { defineFeature } from "../define-feature";
 import { defineWriteHandler } from "../define-handler";
 import { defineStep } from "../define-step";
 import { createEntity, createTextField } from "../factories";
-import { pipeline } from "../pipeline";
+import { stepsPipeline } from "../pipeline";
 import { validateProjectionAllowlist } from "../validate-projection-allowlist";
 
 describe("validateProjectionAllowlist", () => {
@@ -28,7 +28,7 @@ describe("validateProjectionAllowlist", () => {
           name: "log",
           schema: z.object({ msg: z.string() }),
           access: { roles: ["User"] },
-          perform: pipeline<{ msg: string }, { ok: true }>(({ event, r }) => [
+          perform: stepsPipeline<{ msg: string }, { ok: true }>(({ event, r }) => [
             r.step.unsafeProjectionUpsert({
               table: demoLogTable,
               on: ["id"],
@@ -70,7 +70,7 @@ describe("validateProjectionAllowlist", () => {
           name: "sneaky",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.unsafeProjectionUpsert({
               table: widgetsTable,
               on: ["id"],
@@ -113,7 +113,7 @@ describe("validateProjectionAllowlist", () => {
           name: "sneaky-delete",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.unsafeProjectionDelete({
               table: widgetsTable,
               where: () => ({ id: "anything" }),
@@ -136,7 +136,7 @@ describe("validateProjectionAllowlist", () => {
           name: "purge",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.unsafeProjectionDelete({
               table: demoLogTable,
               where: () => ({ id: "anything" }),
@@ -162,7 +162,7 @@ describe("validateProjectionAllowlist", () => {
           name: "branchedWrite",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.branch({
               if: () => true,
               onTrue: [
@@ -195,7 +195,7 @@ describe("validateProjectionAllowlist", () => {
           name: "nestedWrite",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.forEach({
               over: () => [],
               as: "item",
@@ -230,7 +230,7 @@ describe("validateProjectionAllowlist", () => {
           name: "loopedWrite",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.forEach({
               over: () => [],
               as: "x",
@@ -267,7 +267,7 @@ describe("validateProjectionAllowlist", () => {
           name: "futureBuilder",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             // Hand-crafted StepInstance simulating a future builder
             // whose kind isn't registered via defineStep yet.
             {
@@ -316,7 +316,7 @@ describe("validateProjectionAllowlist", () => {
           name: "futureBuilder",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             {
               kind: futureKind,
               args: {
@@ -380,7 +380,7 @@ describe("validateProjectionAllowlist", () => {
           name: "sneak",
           schema: z.object({}),
           access: { roles: ["Admin"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.webhook.send({
               url: "https://hooks.example/sneak",
               mode: "deferred",
@@ -404,7 +404,7 @@ describe("validateProjectionAllowlist", () => {
           name: "sneak",
           schema: z.object({}),
           access: { roles: ["Admin"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.mail.send({
               to: "x@y.com",
               subject: "hi",
@@ -428,7 +428,7 @@ describe("validateProjectionAllowlist", () => {
           name: "sneak",
           schema: z.object({}),
           access: { roles: ["Admin"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.callFeature("subResult", {
               handler: "other:write:do",
               payload: () => ({}),
@@ -451,7 +451,7 @@ describe("validateProjectionAllowlist", () => {
           name: "ok",
           schema: z.object({}),
           access: { roles: ["Admin"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.webhook.send({
               url: "https://hooks.example/ok",
               mode: "deferred",
@@ -473,7 +473,7 @@ describe("validateProjectionAllowlist", () => {
           name: "log",
           schema: z.object({ msg: z.string() }),
           access: { roles: ["User"] },
-          perform: pipeline<{ msg: string }, { ok: true }>(({ event, r }) => [
+          perform: stepsPipeline<{ msg: string }, { ok: true }>(({ event, r }) => [
             r.step.unsafeProjectionUpsert({
               table: demoLogTable,
               on: ["id"],

package/src/engine/boot-validator/__tests__/config-deps.test.ts

@@ -0,0 +1,92 @@
+import { describe, expect, test } from "bun:test";
+import { createSystemConfig, createTenantConfig, createUserConfig } from "../../config-helpers";
+import type { FeatureDefinition } from "../../types";
+import {
+  validateConfigKeyAllowPerRequest,
+  validateConfigKeyComputed,
+  validateConfigKeyPiiEncrypted,
+} from "../config-deps";
+
+function fakeFeature(configKeys: FeatureDefinition["configKeys"]): FeatureDefinition {
+  return { name: "test-feature", configKeys } as unknown as FeatureDefinition;
+}
+
+describe("validateConfigKeyComputed", () => {
+  test("rejects computed + backing:secrets (encrypted-at-rest via backing, not the encrypted flag)", () => {
+    const feature = fakeFeature({
+      apiKey: createSystemConfig("text", { backing: "secrets", computed: async () => "x" }),
+    });
+    expect(() => validateConfigKeyComputed(feature)).toThrow(/mutually exclusive/);
+  });
+
+  test("rejects computed + encrypted:true", () => {
+    const feature = fakeFeature({
+      apiKey: createSystemConfig("text", { encrypted: true, computed: async () => "x" }),
+    });
+    expect(() => validateConfigKeyComputed(feature)).toThrow(/mutually exclusive/);
+  });
+
+  test("allows computed without encryption", () => {
+    const feature = fakeFeature({
+      apiKey: createSystemConfig("text", { computed: async () => "x" }),
+    });
+    expect(() => validateConfigKeyComputed(feature)).not.toThrow();
+  });
+});
+
+describe("validateConfigKeyAllowPerRequest", () => {
+  test("rejects allowPerRequest + backing:secrets on a number key", () => {
+    const feature = fakeFeature({
+      rateLimit: createSystemConfig("number", { backing: "secrets", allowPerRequest: true }),
+    });
+    expect(() => validateConfigKeyAllowPerRequest(feature)).toThrow(
+      /may not be set via query-params/,
+    );
+  });
+});
+
+describe("validateConfigKeyPiiEncrypted (kumiko-platform#231/#459)", () => {
+  test("allows piiEncrypted on a tenant-scoped text key", () => {
+    const feature = fakeFeature({
+      billingAddress: createTenantConfig("text", { piiEncrypted: true }),
+    });
+    expect(() => validateConfigKeyPiiEncrypted(feature)).not.toThrow();
+  });
+
+  test("allows piiEncrypted on a user-scoped text key", () => {
+    const feature = fakeFeature({
+      phoneNumber: createUserConfig("text", { piiEncrypted: true }),
+    });
+    expect(() => validateConfigKeyPiiEncrypted(feature)).not.toThrow();
+  });
+
+  test("rejects piiEncrypted on a non-text key", () => {
+    const feature = fakeFeature({
+      rateLimit: { ...createTenantConfig("number"), piiEncrypted: true },
+    });
+    expect(() => validateConfigKeyPiiEncrypted(feature)).toThrow(
+      /piiEncrypted.*only applies to text keys/,
+    );
+  });
+
+  test("rejects piiEncrypted + scope:system", () => {
+    const feature = fakeFeature({
+      apiKey: createSystemConfig("text", { piiEncrypted: true }),
+    });
+    expect(() => validateConfigKeyPiiEncrypted(feature)).toThrow(/piiEncrypted.*scope="system"/);
+  });
+
+  test("rejects piiEncrypted + encrypted", () => {
+    const feature = fakeFeature({
+      iban: createTenantConfig("text", { piiEncrypted: true, encrypted: true }),
+    });
+    expect(() => validateConfigKeyPiiEncrypted(feature)).toThrow(/piiEncrypted=true and encrypted/);
+  });
+
+  test("rejects piiEncrypted + backing:secrets", () => {
+    const feature = fakeFeature({
+      iban: { ...createTenantConfig("text", { piiEncrypted: true }), backing: "secrets" as const },
+    });
+    expect(() => validateConfigKeyPiiEncrypted(feature)).toThrow(/piiEncrypted=true and encrypted/);
+  });
+});