@cosmicdrift/kumiko-bundled-features 0.105.1 → 0.108.0

package/src/folders-user-data/__tests__/hooks.integration.test.ts

@@ -0,0 +1,69 @@
+// folderAssignmentExportHook — GDPR export must not surface cleared
+// (soft-deleted) folder-assignment rows. Regression (658/3): the hook read
+// via selectMany without an isDeleted filter — folderAssignmentEntity is
+// softDelete: true, so a cleared assignment (clear-folder) still had a row
+// in read_folder_assignments and rode along in the export.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createFoldersFeature, FoldersHandlers } from "../../folders";
+import { folderAssignmentEntity, folderEntity } from "../../folders/entity";
+import { folderAssignmentExportHook } from "../hooks";
+
+let stack: TestStack;
+const admin = createTestUser({ roles: ["TenantAdmin"] });
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [createFoldersFeature()] });
+  await unsafeCreateEntityTable(stack.db, folderEntity);
+  await unsafeCreateEntityTable(stack.db, folderAssignmentEntity);
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("folderAssignmentExportHook", () => {
+  test("excludes a cleared (soft-deleted) assignment from the export", async () => {
+    const folder = await stack.http.writeOk<{ id: string }>(
+      FoldersHandlers.createFolder,
+      { name: "Active loans" },
+      admin,
+    );
+
+    await stack.http.writeOk(
+      FoldersHandlers.setFolder,
+      { folderId: folder.id, entityType: "credit", entityId: "credit-kept" },
+      admin,
+    );
+    await stack.http.writeOk(
+      FoldersHandlers.setFolder,
+      { folderId: folder.id, entityType: "credit", entityId: "credit-cleared" },
+      admin,
+    );
+    // clear-folder soft-deletes the assignment row (isDeleted: true).
+    await stack.http.writeOk(
+      FoldersHandlers.clearFolder,
+      { entityType: "credit", entityId: "credit-cleared" },
+      admin,
+    );
+
+    const snippet = await folderAssignmentExportHook({
+      db: stack.db,
+      tenantId: admin.tenantId,
+      userId: admin.id,
+    });
+
+    expect(snippet).not.toBeNull();
+    const entityIds = (snippet?.rows ?? []).map((r) => r["entityId"]);
+    expect(entityIds).toContain("credit-kept");
+    expect(entityIds).not.toContain("credit-cleared");
+  });
+});

package/src/folders-user-data/hooks.ts

@@ -4,16 +4,21 @@
 // Mirrors credit-user-data — standard tenant-scoped pattern, no name-stripping
 // (a folder name is tenant data, not per-user PII).
 
-import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb, type EventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntityExecutor,
+  createSystemUser,
   type UserDataDeleteHook,
   type UserDataExportHook,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { folderAssignmentEntity, folderEntity } from "../folders";
 
-const { table: folderTable } = createEntityExecutor("folder", folderEntity);
-const { table: folderAssignmentTable } = createEntityExecutor(
+const { table: folderTable, executor: folderExecutor } = createEntityExecutor(
+  "folder",
+  folderEntity,
+);
+const { table: folderAssignmentTable, executor: folderAssignmentExecutor } = createEntityExecutor(
   "folder-assignment",
   folderAssignmentEntity,
 );
@@ -30,8 +35,12 @@ export const folderExportHook: UserDataExportHook = async (ctx) => {
 };
 
 export const folderAssignmentExportHook: UserDataExportHook = async (ctx) => {
+  // folderAssignmentEntity is softDelete: true — a cleared assignment
+  // (isDeleted: true) is a removed folder membership, not something the GDPR
+  // export should still surface as current data.
   const rows = await selectMany<Record<string, unknown>>(ctx.db, folderAssignmentTable, {
     tenantId: ctx.tenantId,
+    isDeleted: false,
   });
   if (rows.length === 0) return null;
   return { entity: "folder-assignment", rows };
@@ -43,16 +52,30 @@ export const folderAssignmentExportHook: UserDataExportHook = async (ctx) => {
 // tenant would destroy co-members' folders. anonymize is also a no-op — folder
 // rows carry no person-link to strip (name is tenant data, not PII), so a
 // retention hold simply keeps them.
-function tenantScopedDelete(table: typeof folderTable): UserDataDeleteHook {
+function tenantScopedDelete(
+  table: typeof folderTable,
+  executor: EventStoreExecutor,
+): UserDataDeleteHook {
   return async (ctx, strategy) => {
     // skip: multi-user tenant — a tenant-wide delete would destroy co-members' folders
     if (ctx.tenantModel !== "single-user") return;
     // skip: anonymize is a no-op — folder rows carry no per-user PII to strip
     if (strategy === "anonymize") return;
-    await deleteMany(ctx.db, table, { tenantId: ctx.tenantId });
+    // Per-row via the executor (event -> rebuild-safe): a bulk deleteMany is
+    // eventless, so a projection rebuild resurrects the rows. Bounded — forget
+    // only fires for single-user tenants.
+    const systemUser = createSystemUser(ctx.tenantId);
+    // The executor needs a TenantDb (loadById → db.fetchOne), not the raw ctx.db.
+    const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+    const rows = await selectMany<{ id: string }>(ctx.db, table, { tenantId: ctx.tenantId });
+    for (const row of rows) {
+      await executor.delete({ id: row.id }, systemUser, tdb);
+    }
   };
 }
 
-export const folderDeleteHook: UserDataDeleteHook = tenantScopedDelete(folderTable);
-export const folderAssignmentDeleteHook: UserDataDeleteHook =
-  tenantScopedDelete(folderAssignmentTable);
+export const folderDeleteHook: UserDataDeleteHook = tenantScopedDelete(folderTable, folderExecutor);
+export const folderAssignmentDeleteHook: UserDataDeleteHook = tenantScopedDelete(
+  folderAssignmentTable,
+  folderAssignmentExecutor,
+);

package/src/folders-user-data/index.ts

@@ -16,10 +16,10 @@ export const foldersUserDataFeature = defineFeature("folders-user-data", (r) =>
   r.describe(
     "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `folders` feature's `folder` + `folder-assignment` entities. Mounts the EXT_USER_DATA export + delete hooks so a tenant's folder tree and its entity-to-folder assignments are included in the user-data export bundle and erased on a tenant-scoped forget (single-user tenants only; multi-user + anonymize are no-ops since folder rows carry no per-user PII). Kept separate from `folders` so folder consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `folders`.",
   );
-  // user-data-rights ist die harte Abhängigkeit (EXT_USER_DATA-Host). `folders` ist
-  // OPTIONAL: ist es toggleable(default=false) gemountet (z.B. per-Tenant via Tier),
-  // würde ein hartes r.requires eine „effectively disabled"-Boot-Warnung werfen,
-  // obwohl die folder-Entities existieren und die Hooks korrekt greifen.
+  // user-data-rights is the hard dependency (EXT_USER_DATA host). `folders` is
+  // OPTIONAL: if it's mounted toggleable(default=false) (e.g. per-tenant via
+  // tier), a hard r.requires would throw an "effectively disabled" boot
+  // warning even though the folder entities exist and the hooks work fine.
   r.requires("user-data-rights");
   r.optionalRequires("folders");
   r.useExtension(EXT_USER_DATA, "folder", {

package/src/jobs/feature.ts

@@ -57,9 +57,9 @@ export function createJobsFeature(): FeatureDefinition {
       table: jobRunsTable,
       apply: {
         [JOB_RUN_STARTED_EVENT]: defineApply<z.infer<typeof runStartedSchema>>(
-          async (event, tx) => {
+          async (event, tx, table) => {
             const p = event.payload;
-            await insertOne(tx, jobRunsTable, {
+            await insertOne(tx, table, {
               id: event.aggregateId,
               tenantId: event.tenantId,
               version: event.version,
@@ -76,11 +76,11 @@ export function createJobsFeature(): FeatureDefinition {
           },
         ),
         [JOB_RUN_COMPLETED_EVENT]: defineApply<z.infer<typeof runCompletedSchema>>(
-          async (event, tx) => {
+          async (event, tx, table) => {
             const p = event.payload;
             await updateMany(
               tx,
-              jobRunsTable,
+              table,
               {
                 status: "completed",
                 duration: p.duration,
@@ -93,23 +93,25 @@ export function createJobsFeature(): FeatureDefinition {
             );
           },
         ),
-        [JOB_RUN_FAILED_EVENT]: defineApply<z.infer<typeof runFailedSchema>>(async (event, tx) => {
-          const p = event.payload;
-          await updateMany(
-            tx,
-            jobRunsTable,
-            {
-              status: "failed",
-              error: p.error,
-              duration: p.duration,
-              finishedAt: Temporal.Instant.from(p.finishedAt),
-              version: event.version,
-              modifiedAt: event.createdAt,
-              modifiedById: event.metadata?.userId ?? "system",
-            },
-            { id: event.aggregateId },
-          );
-        }),
+        [JOB_RUN_FAILED_EVENT]: defineApply<z.infer<typeof runFailedSchema>>(
+          async (event, tx, table) => {
+            const p = event.payload;
+            await updateMany(
+              tx,
+              table,
+              {
+                status: "failed",
+                error: p.error,
+                duration: p.duration,
+                finishedAt: Temporal.Instant.from(p.finishedAt),
+                version: event.version,
+                modifiedAt: event.createdAt,
+                modifiedById: event.metadata?.userId ?? "system",
+              },
+              { id: event.aggregateId },
+            );
+          },
+        ),
       },
     });
 

package/src/jobs/handlers/projection-rebuild.job.ts

@@ -6,10 +6,15 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
 import { z } from "zod";
 
-export const projectionRebuildPayloadSchema = z.object({ projection: z.string().min(1) });
+export const projectionRebuildPayloadSchema = z.object({
+  projection: z.string().min(1),
+  // Quarantine mode (#760): skip + dead-letter poison events instead of
+  // failing the whole rebuild. Operator opt-in per run.
+  skipApplyErrors: z.boolean().optional(),
+});
 
 export const projectionRebuildJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
-  const { projection } = projectionRebuildPayloadSchema.parse(rawPayload);
+  const { projection, skipApplyErrors } = projectionRebuildPayloadSchema.parse(rawPayload);
   if (!ctx.db) {
     throw new InternalError({
       message:
@@ -23,8 +28,13 @@ export const projectionRebuildJob: JobHandlerFn = async (rawPayload, ctx): Promi
     });
   }
   const db = ctx.db as DbConnection; // @cast-boundary db-operator
-  const result = await rebuildProjection(projection, { db, registry: ctx.registry });
+  const result = await rebuildProjection(projection, {
+    db,
+    registry: ctx.registry,
+    ...(skipApplyErrors === true && { errorPolicy: { skipApplyErrors: true } }),
+  });
   ctx.log?.info?.(
-    `[jobs:projection-rebuild] rebuilt ${projection}: ${result.eventsProcessed} events in ${result.durationMs}ms`,
+    `[jobs:projection-rebuild] rebuilt ${projection}: ${result.eventsProcessed} events` +
+      `${result.eventsSkipped > 0 ? ` (${result.eventsSkipped} quarantined)` : ""} in ${result.durationMs}ms`,
   );
 };

package/src/ledger/__tests__/ledger.integration.test.ts

@@ -188,6 +188,50 @@ describe("ledger integration — reverse-transaction (Storno)", () => {
     // Original + Storno cancel → books net to zero.
     expect(trialBalance(rows)).toBe(0);
   });
+
+  test("reversing a draft transaction is rejected (only posted entries count)", async () => {
+    const bank = await createAccount("Bank Draft", "asset");
+    const rent = await createAccount("Draft Income", "income");
+    const draft = await stack.http.writeOk<{ id: string }>(
+      LedgerHandlers.createTransaction,
+      {
+        date: "2026-01-15",
+        description: "Draft entry",
+        status: "draft",
+        lines: [
+          { accountId: bank, amount: 5000 },
+          { accountId: rent, amount: -5000 },
+        ],
+      },
+      admin,
+    );
+
+    const err = await stack.http.writeErr(
+      LedgerHandlers.reverseTransaction,
+      { id: draft.id },
+      admin,
+    );
+    expect(err.code).toBe("unprocessable");
+
+    // No Storno booked — the draft is the only row.
+    expect(await listTransactions()).toHaveLength(1);
+  });
+
+  test("reversing the same transaction twice is rejected on the second call", async () => {
+    const bank = await createAccount("Bank Dup", "asset");
+    const rent = await createAccount("Dup Income", "income");
+    const tx = await createTransaction([
+      { accountId: bank, amount: 20000 },
+      { accountId: rent, amount: -20000 },
+    ]);
+
+    await stack.http.writeOk(LedgerHandlers.reverseTransaction, { id: tx.id }, admin);
+    const err = await stack.http.writeErr(LedgerHandlers.reverseTransaction, { id: tx.id }, admin);
+    expect(err.code).toBe("conflict");
+
+    // Original + exactly ONE Storno — a second reverse must not book again.
+    expect(await listTransactions()).toHaveLength(2);
+  });
 });
 
 describe("ledger integration — trial balance (golden invariant)", () => {

package/src/ledger/__tests__/reports.test.ts

@@ -5,6 +5,7 @@ import {
   incomeStatement,
   type LedgerAccount,
   type LedgerEntry,
+  normalizeLines,
 } from "../reports";
 
 // Pure report math — no DB. A small but complete set of books:
@@ -50,6 +51,25 @@ function balanceOf(report: ReturnType<typeof accountBalances>, id: string): numb
   return report.accounts.find((a) => a.id === id)?.balance ?? Number.NaN;
 }
 
+describe("normalizeLines — jsonb array-or-string driver surfacing", () => {
+  test("passes an already-parsed array through unchanged", () => {
+    const lines = [{ accountId: "bank", amount: 100 }];
+    expect(normalizeLines(lines)).toEqual(lines);
+  });
+
+  test("parses a JSON-string-encoded array (the other driver path)", () => {
+    const lines = [{ accountId: "bank", amount: 100 }];
+    expect(normalizeLines(JSON.stringify(lines))).toEqual(lines);
+  });
+
+  test("falls back to [] for malformed JSON or a non-array value", () => {
+    expect(normalizeLines("not json")).toEqual([]);
+    expect(normalizeLines(null)).toEqual([]);
+    expect(normalizeLines(undefined)).toEqual([]);
+    expect(normalizeLines(42)).toEqual([]);
+  });
+});
+
 describe("accountBalances — natural balances + trial balance", () => {
   test("natural balances are sign-corrected by account type", () => {
     const r = accountBalances(accounts, posted);

package/src/ledger/entity.ts

@@ -73,7 +73,7 @@ export const scheduleEntity = createEntity({
     // Absent → open-ended (projects to the window's end).
     endDate: createDateField(),
     interval: createSelectField({ options: SCHEDULE_INTERVALS, required: true }),
-    amount: createNumberField({ required: true }),
+    amount: createNumberField({ required: true, min: 1, integer: true }),
     debitAccountId: createTextField({ required: true, maxLength: 64 }),
     creditAccountId: createTextField({ required: true, maxLength: 64 }),
   },

package/src/ledger/handlers/confirm-schedule-period.write.ts

@@ -13,7 +13,7 @@ import {
   transactionExecutor,
   transactionTable,
 } from "../executor";
-import { scheduleReference } from "../recurring";
+import { findReversedIds, isoMonth, scheduleReference } from "../recurring";
 import { type ConfirmSchedulePeriodPayload, confirmSchedulePeriodPayloadSchema } from "../schemas";
 
 // confirm-schedule-period — turn ONE projected period of a schedule into a posted,
@@ -42,6 +42,13 @@ export function createConfirmSchedulePeriodHandler(
       );
       if (!schedule) return writeFailure(new NotFoundError("schedule", payload.scheduleId));
 
+      if (
+        payload.period < isoMonth(String(schedule["startDate"])) ||
+        (schedule["endDate"] != null && payload.period > isoMonth(String(schedule["endDate"])))
+      ) {
+        return writeFailure(new NotFoundError("schedule-period", payload.period));
+      }
+
       const debitAccountId = String(schedule["debitAccountId"]);
       const creditAccountId = String(schedule["creditAccountId"]);
       for (const accountId of [debitAccountId, creditAccountId]) {
@@ -51,24 +58,33 @@ export function createConfirmSchedulePeriodHandler(
 
       const reference = scheduleReference(payload.scheduleId, payload.period);
 
-      // Scan this tenant's transactions (same full-tenant read the reports do) to
-      // find an active booking for this reference. A tx is reversed when another
-      // tx's reference names its id (the Storno mirror).
+      // Two targeted reads instead of a full-tenant transaction scan: (1) any
+      // booking that already carries this exact schedule-period reference —
+      // normally 0 or 1 row, never O(tenant's-full-history); (2) any Storno
+      // that mirrors one of those candidates (a tx is reversed when ANOTHER
+      // tx's `reference` names its id).
       // ponytail: read-then-write, so two confirms racing the same period could
       // double-book; add a unique index on (tenantId, reference) when concurrent
       // confirms become real.
-      const txRows = await selectMany(ctx.db.raw, transactionTable, {
+      const candidates = await selectMany(ctx.db.raw, transactionTable, {
         tenantId: event.user.tenantId,
+        reference,
       });
-      const txIds = new Set(txRows.map((r) => String(r["id"])));
-      const reversedTxIds = new Set(
-        txRows
-          .filter((r) => r["reference"] != null && txIds.has(String(r["reference"])))
-          .map((r) => String(r["reference"])),
-      );
-      const active = txRows.find(
-        (r) => r["reference"] === reference && !reversedTxIds.has(String(r["id"])),
+      const candidateIds = candidates.map((r) => String(r["id"]));
+      const stornos =
+        candidateIds.length > 0
+          ? await selectMany(ctx.db.raw, transactionTable, {
+              tenantId: event.user.tenantId,
+              reference: { in: candidateIds },
+            })
+          : [];
+      const reversedIds = findReversedIds(
+        [...candidates, ...stornos].map((r) => ({
+          id: String(r["id"]),
+          reference: r["reference"] === null ? null : String(r["reference"]),
+        })),
       );
+      const active = candidates.find((r) => !reversedIds.has(String(r["id"])));
       if (active) {
         const ok: WriteResult<{ id: string; alreadyBooked: true }> = {
           isSuccess: true,

package/src/ledger/handlers/reverse-transaction.write.ts

@@ -1,9 +1,15 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  ConflictError,
+  NotFoundError,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { DEFAULT_LEDGER_ACCESS } from "../constants";
-import { transactionExecutor } from "../executor";
-import type { Posting } from "../schemas";
+import { transactionExecutor, transactionTable } from "../executor";
+import { normalizeLines } from "../reports";
 import { type ReverseTransactionPayload, reverseTransactionPayloadSchema } from "../schemas";
 
 // reverse-transaction (Storno) — the ONLY correction path for a posted entry.
@@ -24,8 +30,41 @@ export function createReverseTransactionHandler(
       const original = await transactionExecutor.detail({ id: payload.id }, event.user, ctx.db);
       if (!original) return writeFailure(new NotFoundError("transaction", payload.id));
 
-      const originalLines = original["lines"] as readonly Posting[]; // @cast-boundary db-row
-      const lines = originalLines.map((l) => ({ accountId: l.accountId, amount: -l.amount }));
+      // Only a posted entry contributes to the books (rawBalances skips
+      // anything else) — reversing a draft would book a real, balanced
+      // Storno entry against a booking that was never counted, creating a
+      // phantom balance with no corresponding original.
+      if (original["status"] !== "posted") {
+        return writeFailure(
+          new UnprocessableError("transaction_not_posted", {
+            details: { transactionId: payload.id, status: original["status"] },
+          }),
+        );
+      }
+
+      // Dedup guard: two reverse() calls on the same original would each book
+      // an independently-balanced Storno (the global trial balance stays 0
+      // either way, masking the bug), doubling the per-account effect. The
+      // reference column ties a Storno back to its original 1:1.
+      const alreadyReversed = await selectMany(ctx.db.raw, transactionTable, {
+        tenantId: event.user.tenantId,
+        reference: payload.id,
+      });
+      if (alreadyReversed.length > 0) {
+        return writeFailure(
+          new ConflictError({
+            message: "transaction already reversed",
+            details: { transactionId: payload.id },
+          }),
+        );
+      }
+
+      // jsonb `lines` may surface as a parsed array or a JSON string depending
+      // on the driver path — normalizeLines handles both (see reports.ts).
+      const lines = normalizeLines(original["lines"]).map((l) => ({
+        accountId: l.accountId,
+        amount: -l.amount,
+      }));
 
       return transactionExecutor.create(
         {

package/src/ledger/recurring.ts

@@ -53,10 +53,26 @@ export function scheduleReference(scheduleId: string, period: string): string {
   return `schedule:${scheduleId}:${period}`;
 }
 
+// A Storno mirror carries reference = the reversed tx's id, so any tx whose
+// reference names another tx in the set marks that other tx reversed. Shared
+// by mergeScheduleActuals (below) and confirm-schedule-period.write.ts's
+// idempotency check (684/4) — same detection, kept in one place so a fix
+// can't land in one call-site and drift from the other.
+export function findReversedIds(
+  rows: readonly { readonly id: string; readonly reference: string | null }[],
+): Set<string> {
+  const ids = new Set(rows.map((r) => r.id));
+  return new Set(
+    rows
+      .filter((r) => r.reference !== null && ids.has(r.reference))
+      .map((r) => r.reference as string),
+  );
+}
+
 // "YYYY-MM" ⇄ a month index (year*12 + monthOfYear), so window math is pure
 // integer arithmetic — no Date object (no-date-api guard) and no DST/timezone
 // drift. isoMonth tolerates a full ISO date ("2026-01-15" → "2026-01").
-function isoMonth(iso: string): string {
+export function isoMonth(iso: string): string {
   return iso.slice(0, 7);
 }
 
@@ -105,14 +121,7 @@ export function mergeScheduleActuals(
   transactions: readonly LedgerTxRow[],
   asOf: string,
 ): ScheduleMonth[] {
-  const txIds = new Set(transactions.map((t) => t.id));
-  // A Storno mirror carries reference = the reversed tx's id, so any tx whose
-  // reference names another tx marks that other tx reversed.
-  const reversedTxIds = new Set(
-    transactions
-      .filter((t) => t.reference != null && txIds.has(t.reference))
-      .map((t) => t.reference as string),
-  );
+  const reversedTxIds = findReversedIds(transactions);
   const asOfIndex = monthIndex(isoMonth(asOf));
 
   return projection.map((projected) => {

package/src/ledger/schemas.ts

@@ -57,7 +57,10 @@ export const confirmSchedulePeriodPayloadSchema = z.object({
   scheduleId: z.string().min(1).max(64),
   period: z.string().regex(/^\d{4}-\d{2}$/, "period must be YYYY-MM"),
   amount: z.number().int().positive().optional(),
-  date: z.string().min(1).max(32).optional(),
+  date: z
+    .string()
+    .regex(/^\d{4}-\d{2}-\d{2}$/, "date must be YYYY-MM-DD")
+    .optional(),
 });
 export type ConfirmSchedulePeriodPayload = z.infer<typeof confirmSchedulePeriodPayloadSchema>;
 

package/src/ledger/web/index.ts

@@ -1,6 +1,7 @@
 // @runtime client
-// Client-safe ledger surface: QN constants + the pure recurring helpers
-// (projection + Soll/Ist merge), nothing else. The full `../ledger` entry
+// Client-safe ledger surface: QN constants, the pure recurring helpers
+// (projection + Soll/Ist merge), and the Zod payload schemas (for client-side
+// pre-validation before dispatch) — nothing else. The full `../ledger` entry
 // re-exports the feature/handlers/executor, which pull bun-db/postgres — a
 // browser bundle that imports from there fails on Node builtins. A client screen
 // (e.g. a rent-cashflow view) imports the dispatch QNs + the pure forecast/merge

package/src/managed-pages/__tests__/branding-coerce.test.ts

@@ -2,12 +2,8 @@ import { describe, expect, test } from "bun:test";
 import { type BrandingTokens, EMPTY_BRANDING } from "../../page-render";
 import { coerceBranding } from "../branding";
 
-// coerceBranding is the IO boundary for the branding query's wire response:
-// untrusted `unknown` → BrandingTokens with no `as` cast. Every missing or
-// non-string field must collapse to "" so a malformed/empty response renders
-// the unbranded default rather than throwing — and an attacker-controlled
-// non-string (e.g. a logoUrl object) can never leak through as a live render
-// token. Exercised only indirectly by the integration path before this.
+// IO-boundary coercion: untrusted `unknown` → BrandingTokens, no `as` cast —
+// every missing/non-string field collapses to "" instead of throwing.
 
 describe("coerceBranding", () => {
   const FULL: BrandingTokens = {

package/src/managed-pages/__tests__/managed-pages.integration.test.ts

@@ -160,6 +160,16 @@ describe("managed-pages :: Cache + Security-Header", () => {
     });
     expect(second.status).toBe(304);
   });
+
+  test("HEAD → 200 without body, etag present", async () => {
+    // legal-pages got this HEAD-early-exit test alongside its identical
+    // Cache/Header pattern; managed-pages received the same HEAD codepath
+    // in the same PR but not the test.
+    const res = await stack.app.request("http://a.example.com/p/about", { method: "HEAD" });
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe("");
+    expect(res.headers.get("etag")).toBeTruthy();
+  });
 });
 
 describe("managed-pages :: XSS-Härtung", () => {