@cosmicdrift/kumiko-bundled-features 0.220.0 → 0.221.0

package/src/custom-fields/__tests__/feature.test.ts

@@ -203,12 +203,10 @@ describe("createCustomFieldsFeature access-options", () => {
     expect(writeAccess(feature, "delete-system-field")).toEqual(["SystemAdmin"]);
   });
 
-  test("fieldDefinitionWriteRoles feeds into the list-default (a definer can load what they defined)", () => {
+  test("fieldDefinitionWriteRoles feeds into list roles without keeping default TenantAdmin", () => {
     const feature = createCustomFieldsFeature({ fieldDefinitionWriteRoles: ["Admin", "Editor"] });
     const roles = listAccess(feature);
-    expect(roles).toContain("Admin");
-    expect(roles).toContain("Editor");
-    expect(roles).toContain("TenantAdmin");
+    expect(roles).toEqual(["Admin", "Editor"]);
   });
 
   test("fieldDefinitionWriteRoles and valueWriteRoles are independent — setting one leaves the other's default", () => {
@@ -219,23 +217,23 @@ describe("createCustomFieldsFeature access-options", () => {
 });
 
 describe("resolveFieldDefinitionListRoles", () => {
-  test("nichts gesetzt → reiner Default", () => {
+  test("nothing set → default only", () => {
     expect(resolveFieldDefinitionListRoles({})).toEqual(["TenantAdmin"]);
   });
 
-  test("valueWriteRoles gesetzt, list ungesetzt → Union mit Default, dedupliziert", () => {
+  test("valueWriteRoles set, list unset → union with default, deduped", () => {
     expect(resolveFieldDefinitionListRoles({ valueWriteRoles: ["Admin", "Editor"] })).toEqual([
       "Admin",
       "Editor",
       "TenantAdmin",
     ]);
-    // TenantAdmin schon in valueWriteRoles → keine Dublette.
+    // TenantAdmin already in valueWriteRoles → no duplicate.
     expect(resolveFieldDefinitionListRoles({ valueWriteRoles: ["TenantAdmin", "Editor"] })).toEqual(
       ["TenantAdmin", "Editor"],
     );
   });
 
-  test("explizite list-Rollen gewinnen immer (auch über valueWriteRoles)", () => {
+  test("explicit list roles always win (even over valueWriteRoles)", () => {
     expect(
       resolveFieldDefinitionListRoles({
         valueWriteRoles: ["Admin"],
@@ -244,18 +242,18 @@ describe("resolveFieldDefinitionListRoles", () => {
     ).toEqual(["Viewer"]);
   });
 
-  test("fieldDefinitionWriteRoles gesetzt, list ungesetzt → Union mit Default, dedupliziert", () => {
+  test("fieldDefinitionWriteRoles set, list unset → write roles only (no default TenantAdmin)", () => {
     expect(
       resolveFieldDefinitionListRoles({ fieldDefinitionWriteRoles: ["Admin", "Editor"] }),
-    ).toEqual(["Admin", "Editor", "TenantAdmin"]);
+    ).toEqual(["Admin", "Editor"]);
   });
 
-  test("valueWriteRoles UND fieldDefinitionWriteRoles gesetzt → Union aus beiden plus Default", () => {
+  test("valueWriteRoles AND fieldDefinitionWriteRoles → union of both, no default", () => {
     expect(
       resolveFieldDefinitionListRoles({
         valueWriteRoles: ["Member"],
         fieldDefinitionWriteRoles: ["Admin"],
       }),
-    ).toEqual(["Member", "Admin", "TenantAdmin"]);
+    ).toEqual(["Member", "Admin"]);
   });
 });

package/src/custom-fields/constants.ts

@@ -23,9 +23,10 @@ export const CustomFieldsQueries = {
   fieldDefinitionList: "custom-fields:query:field-definition:list",
 } as const;
 
-// Name unter dem die web-component im ExtensionSectionsProvider
-// registriert wird — Apps referenzieren ihn im Screen-Schema via
-// `component: { react: { __component: CUSTOM_FIELDS_FORM_EXTENSION_NAME } }`.
+// Name the web component registers under in ExtensionSectionsProvider —
+// apps reference it in the screen schema via:
+// { kind: "extension", title, contributesToFormSubmit: true,
+//   component: { react: { __component: CUSTOM_FIELDS_FORM_EXTENSION_NAME } } }
 export const CUSTOM_FIELDS_FORM_EXTENSION_NAME = "CustomFieldsFormSection";
 
 // Entity-CRUD auto-events for the `field-definition` entity. registry.ts emits

package/src/custom-fields/feature.ts

@@ -206,7 +206,7 @@ export type CustomFieldsFeatureOptions = {
    *  before #2296. Apps with their own role vocabulary (e.g. ["Admin","Editor"])
    *  MUST set this, else field-definition management is access_denied for every
    *  app-user without a "TenantAdmin" role. Only covers the tenant-scope triad —
-   *  define-/delete-system-field stay hard-wired to ["TenantAdmin"], since
+   *  define-/delete-system-field stay hard-wired to ["SystemAdmin"], since
    *  system-scope is a separate trust boundary that must not become reachable
    *  through a tenant role vocabulary. Also feeds into
    *  resolveFieldDefinitionListRoles (below) so a definer without an explicit
@@ -225,13 +225,12 @@ export function resolveFieldDefinitionListRoles(
   if (opts.valueWriteRoles === undefined && opts.fieldDefinitionWriteRoles === undefined) {
     return DEFAULT_FIELD_DEFINITION_LIST_ROLES;
   }
-  return [
-    ...new Set([
-      ...(opts.valueWriteRoles ?? []),
-      ...(opts.fieldDefinitionWriteRoles ?? []),
-      ...DEFAULT_FIELD_DEFINITION_LIST_ROLES,
-    ]),
-  ];
+  // Write-roles override replaces the default role vocab — don't keep unioning
+  // TenantAdmin onto list when the app opted into its own write roles.
+  if (opts.fieldDefinitionWriteRoles !== undefined) {
+    return [...new Set([...(opts.valueWriteRoles ?? []), ...opts.fieldDefinitionWriteRoles])];
+  }
+  return [...new Set([...(opts.valueWriteRoles ?? []), ...DEFAULT_FIELD_DEFINITION_LIST_ROLES])];
 }
 
 // Backwards-compat-wrapper. Bestehende Caller (z.B. integration-tests,

package/src/delivery/__tests__/delivery-log-query.integration.test.ts

@@ -17,6 +17,7 @@ import { deliveryAttemptsTable, notificationPreferencesTable } from "../tables";
 
 type LogRow = {
   readonly id: string;
+  readonly tenantId?: string;
   readonly type: string;
   readonly channel: string;
   readonly recipient: string | null;
@@ -25,7 +26,9 @@ type LogRow = {
 
 let stack: TestStack;
 const tenantId = testTenantId(701);
+const otherTenantId = testTenantId(702);
 const admin = createTestUser({ id: 701, roles: ["TenantAdmin"], tenantId });
+const systemAdmin = createTestUser({ id: 709, roles: ["SystemAdmin"], tenantId });
 
 beforeAll(async () => {
   stack = await setupTestStack({ features: [createDeliveryFeature()] });
@@ -55,6 +58,14 @@ beforeAll(async () => {
       recipientAddress: null,
       status: "queued",
     },
+    {
+      id: crypto.randomUUID(),
+      tenantId: otherTenantId,
+      notificationType: "logtest:other",
+      channel: "email",
+      recipientAddress: "other@example.com",
+      status: "sent",
+    },
   ]);
 });
 
@@ -115,6 +126,23 @@ describe("delivery:query:log — sort", () => {
     );
     expect(withInvalidSort.rows.map((r) => r.id)).toEqual(withNoSort.rows.map((r) => r.id));
   });
+
+  test("sort=tenantId is whitelisted and reverses for SystemAdmin cross-tenant", async () => {
+    const asc = await stack.http.queryOk<{ rows: readonly LogRow[] }>(
+      DeliveryQueries.log,
+      { sort: "tenantId", sortDirection: "asc" },
+      systemAdmin,
+    );
+    const desc = await stack.http.queryOk<{ rows: readonly LogRow[] }>(
+      DeliveryQueries.log,
+      { sort: "tenantId", sortDirection: "desc" },
+      systemAdmin,
+    );
+    const ascTenants = [...new Set(asc.rows.map((r) => r.tenantId))];
+    const descTenants = [...new Set(desc.rows.map((r) => r.tenantId))];
+    expect(new Set(ascTenants)).toEqual(new Set([tenantId, otherTenantId]));
+    expect(descTenants).toEqual([...ascTenants].reverse());
+  });
 });
 
 describe("delivery:query:log — field mapping", () => {

package/src/delivery/__tests__/delivery-security.integration.test.ts

@@ -169,7 +169,7 @@ describe("delivery log SystemAdmin cross-tenant scope", () => {
         status: string;
         error: string | null;
       }[];
-    }>(DeliveryQueries.log, {}, systemAdmin);
+    }>(DeliveryQueries.log, { limit: 100 }, systemAdmin);
 
     const byId = new Map(res.rows.map((r) => [r.id, r]));
     expect(byId.get(systemConfirmationId)?.tenantId).toBe(SYSTEM_TENANT_ID);
@@ -189,6 +189,97 @@ describe("delivery log SystemAdmin cross-tenant scope", () => {
     );
   });
 
+  test("SystemAdmin cursor-paginates the unfiltered cross-tenant result set, seeing every row exactly once", async () => {
+    const pagingTenant = testTenantId(53);
+    const seededRows = Array.from({ length: 7 }, (_, i) => ({
+      id: crypto.randomUUID(),
+      tenantId: i % 2 === 0 ? SYSTEM_TENANT_ID : pagingTenant,
+      // unique per row so we can sort on it — the default sort (createdAt)
+      // ties across rows inserted in the same insertMany statement, and the
+      // cursor WHERE only excludes strictly-equal sort values (see
+      // log.query.ts), so equal timestamps would silently drop rows.
+      notificationType: `paging-test:${i}`,
+      channel: "email",
+      recipientAddress: null,
+      status: "sent",
+    }));
+    await insertMany(stack.db, deliveryAttemptsTable, seededRows);
+
+    const systemAdmin = createTestUser({
+      id: 52,
+      roles: ["SystemAdmin"],
+      tenantId: pagingTenant,
+    });
+
+    const seenCounts = new Map<string, number>();
+    let cursor: string | undefined;
+    let pageCount = 0;
+    do {
+      const page = await stack.http.queryOk<{
+        rows: readonly { id: string }[];
+        nextCursor: string | null;
+      }>(
+        DeliveryQueries.log,
+        { limit: 3, sort: "type", sortDirection: "asc", cursor },
+        systemAdmin,
+      );
+      for (const row of page.rows) {
+        seenCounts.set(row.id, (seenCounts.get(row.id) ?? 0) + 1);
+      }
+      cursor = page.nextCursor ?? undefined;
+      pageCount += 1;
+      expect(pageCount).toBeLessThan(50);
+    } while (cursor);
+
+    expect(pageCount).toBeGreaterThan(1);
+    for (const row of seededRows) {
+      expect(seenCounts.get(row.id)).toBe(1);
+    }
+    expect([...seenCounts.values()].every((count) => count === 1)).toBe(true);
+  });
+
+  test("SystemAdmin with no demo-tenant session (session tenantId is SYSTEM_TENANT_ID itself) still sees cross-tenant rows", async () => {
+    const otherTenant = testTenantId(54);
+    const systemScopedId = crypto.randomUUID();
+    const otherTenantRowId = crypto.randomUUID();
+
+    await insertMany(stack.db, deliveryAttemptsTable, [
+      {
+        id: systemScopedId,
+        tenantId: SYSTEM_TENANT_ID,
+        notificationType: "no-session-tenant-test:system",
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+      {
+        id: otherTenantRowId,
+        tenantId: otherTenant,
+        notificationType: "no-session-tenant-test:other",
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+    ]);
+
+    // Mirrors a platform-level caller (e.g. an API key) that has no demo
+    // tenant on its session at all, as opposed to the other SystemAdmin
+    // tests above which browse from a demo tenant panel.
+    const systemAdmin = createTestUser({
+      id: 53,
+      roles: ["SystemAdmin"],
+      tenantId: SYSTEM_TENANT_ID,
+    });
+
+    const res = await stack.http.queryOk<{
+      rows: readonly { id: string; tenantId: string }[];
+    }>(DeliveryQueries.log, { limit: 100 }, systemAdmin);
+
+    const byId = new Map(res.rows.map((r) => [r.id, r]));
+    expect(byId.get(systemScopedId)?.tenantId).toBe(SYSTEM_TENANT_ID);
+    expect(byId.get(otherTenantRowId)?.tenantId).toBe(otherTenant);
+  });
+
   test("TenantAdmin cannot read SYSTEM_TENANT_ID or foreign-tenant delivery attempts", async () => {
     const demoTenant = testTenantId(61);
     const otherTenant = testTenantId(62);

package/src/delivery/db/queries/preferences.ts

@@ -1,4 +1,4 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 
@@ -15,7 +15,8 @@ export async function selectNotificationPreferences(
   notificationType: string,
   channelName: string,
 ): Promise<readonly NotificationPreferenceRow[]> {
-  return asRawClient(db).unsafe<NotificationPreferenceRow>(
+  return unsafeReadRetrying<NotificationPreferenceRow>(
+    db,
     `SELECT notification_type AS "notificationType", channel, enabled
      FROM read_notification_preferences
      WHERE tenant_id = $1

package/src/delivery/handlers/log.query.ts

@@ -34,6 +34,7 @@ type DeliveryLogRow = {
 // application code, so there is no column to ORDER BY in SQL for it.
 const DELIVERY_LOG_SORT_COLUMNS = {
   createdAt: "createdAt",
+  tenantId: "tenantId",
   type: "notificationType",
   channel: "channel",
   status: "status",

package/src/feature-toggles/__tests__/feature-toggles.integration.test.ts

@@ -568,7 +568,7 @@ describe("feature-toggles queries + audit automation", () => {
   test("registered query reports metadata + override + effective for every feature", async () => {
     runtime.apply("widget", false);
     const data = await stack.http.queryOk<{
-      items: Array<{
+      rows: Array<{
         name: string;
         toggleable: boolean;
         default: boolean | null;
@@ -577,7 +577,7 @@ describe("feature-toggles queries + audit automation", () => {
         effective: boolean | null;
       }>;
     }>("feature-toggles:query:registered", {}, admin);
-    const byName = new Map(data.items.map((i) => [i.name, i]));
+    const byName = new Map(data.rows.map((i) => [i.name, i]));
 
     expect(byName.get("widget")).toMatchObject({
       toggleable: true,

package/src/feature-toggles/__tests__/toggle-admin.boot.test.ts

@@ -11,11 +11,19 @@ describe("feature-toggles screen + handler access alignment", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
-  test("toggle-admin screen is SystemAdmin-gated", () => {
+  test("toggle-admin screen is projectionList and SystemAdmin-gated", () => {
     const toggles = createFeatureTogglesFeature();
     const screen = toggles.screens[TOGGLE_ADMIN_SCREEN_ID];
-    expect(screen?.type).toBe("custom");
-    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+    expect(screen?.type).toBe("projectionList");
+    if (screen?.type !== "projectionList") throw new Error("expected projectionList");
+    expect(screen.query).toBe(FeatureToggleQueries.registered);
+    const toggleAction = screen.rowActions?.find((a) => a.id === "toggle");
+    if (toggleAction?.kind !== "writeHandler") throw new Error("expected a writeHandler rowAction");
+    expect(toggleAction.handler).toBe(FeatureToggleHandlers.set);
+    expect(toggleAction.payload).toEqual({
+      map: { featureName: "name", enabled: "nextEnabled" },
+    });
+    if ("access" in screen && screen.access && "roles" in screen.access) {
       expect(screen.access.roles).toEqual(["SystemAdmin"]);
     }
   });

package/src/feature-toggles/__tests__/toggle-admin.security.integration.test.ts

@@ -36,6 +36,7 @@ describe("feature-toggles access matrix", () => {
     ]);
     const feature = createFeatureTogglesFeature();
     const screen = feature.screens[TOGGLE_ADMIN_SCREEN_ID];
+    expect(screen?.type).toBe("projectionList");
     if (screen && "access" in screen && screen.access && "roles" in screen.access) {
       expect(screen.access.roles).toEqual(["SystemAdmin"]);
     }
@@ -49,12 +50,12 @@ describe("feature-toggles HTTP access", () => {
       { items?: readonly unknown[] } | { rows?: readonly unknown[] }
     >(FeatureToggleQueries.list, {}, admin);
     expect(typeof list).toBe("object");
-    const registered = await stack.http.queryOk<{ items: readonly unknown[] }>(
+    const registered = await stack.http.queryOk<{ rows: readonly unknown[] }>(
       FeatureToggleQueries.registered,
       {},
       admin,
     );
-    expect(Array.isArray(registered.items)).toBe(true);
+    expect(Array.isArray(registered.rows)).toBe(true);
   });
 
   test("TenantAdmin gets 403 on list, registered, and set", async () => {

package/src/feature-toggles/feature.ts

@@ -1,5 +1,10 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { FEATURE_TOGGLE_SET_EVENT_NAME, TOGGLE_ADMIN_SCREEN_ID } from "./constants";
+import {
+  FEATURE_TOGGLE_SET_EVENT_NAME,
+  FeatureToggleHandlers,
+  FeatureToggleQueries,
+  TOGGLE_ADMIN_SCREEN_ID,
+} from "./constants";
 import { featureToggleSetSchema } from "./events";
 import { globalFeatureStateTableMeta } from "./global-feature-state-table";
 import { listQuery } from "./handlers/list.query";
@@ -67,11 +72,26 @@ export function createFeatureTogglesFeature(
       registered: r.queryHandler(registeredQuery),
     };
 
-    // kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312
     r.screen({
       id: TOGGLE_ADMIN_SCREEN_ID,
-      type: "custom",
-      renderer: { react: { __component: "ToggleAdminScreen" } },
+      type: "projectionList",
+      query: FeatureToggleQueries.registered,
+      columns: [
+        { field: "name", label: "feature-toggles.admin.col.feature" },
+        { field: "defaultLabel", label: "feature-toggles.admin.col.default" },
+        { field: "overrideLabel", label: "feature-toggles.admin.col.override" },
+        { field: "effectiveLabel", label: "feature-toggles.admin.col.effective" },
+      ],
+      rowActions: [
+        {
+          kind: "writeHandler",
+          id: "toggle",
+          label: "feature-toggles.admin.toggle",
+          handler: FeatureToggleHandlers.set,
+          payload: { map: { featureName: "name", enabled: "nextEnabled" } },
+          visible: { field: "toggleable", eq: true },
+        },
+      ],
       access: { roles: ["SystemAdmin"] },
     });
     r.nav({

package/src/feature-toggles/handlers/registered.query.ts

@@ -12,6 +12,12 @@ import { globalFeatureStateTable } from "../global-feature-state-table";
 // Design: registry introspection (toggleable/default/requires) + a single
 // DB read of overrides. No per-feature DB calls. Scales to however many
 // features an app registers — currently tens, never thousands.
+
+function formatFlag(value: boolean | null): string {
+  if (value === null) return "inherit";
+  return value ? "on" : "off";
+}
+
 export const registeredQuery = defineQueryHandler({
   name: "registered",
   schema: z.object({}),
@@ -38,38 +44,43 @@ export const registeredQuery = defineQueryHandler({
     // dokumentiert in DispatcherOptions.effectiveFeatures.
     const effective = ctx.effectiveFeatures?.(SYSTEM_TENANT_ID);
 
-    const items: Array<{
+    const rows: Array<{
+      id: string;
       name: string;
       toggleable: boolean;
       default: boolean | null;
       override: boolean | null;
       requires: readonly string[];
       effective: boolean | null;
+      defaultLabel: string;
+      overrideLabel: string;
+      effectiveLabel: string;
+      nextEnabled: boolean;
     }> = [];
+
     for (const feature of ctx.registry.features.values()) {
       const toggleable = feature.toggleableDefault !== undefined;
       const override = overrides.get(feature.name);
-      items.push({
+      const defaultValue = feature.toggleableDefault ?? null;
+      const effectiveValue = effective ? effective.has(feature.name) : null;
+      const effectiveBool = effectiveValue ?? defaultValue ?? false;
+
+      rows.push({
+        id: feature.name,
         name: feature.name,
         toggleable,
-        // `default` is null when non-toggleable; the UI must render
-        // non-toggleable features as "always on" without an enable/disable
-        // control (flipping them would be rejected by the set-handler).
-        default: feature.toggleableDefault ?? null,
-        // `override` is null when no explicit row exists. That's distinct
-        // from "override says on" or "override says off" so the UI can show
-        // an "inherits default" indicator.
+        // Raw booleans for API consumers; label fields for projectionList columns.
+        default: defaultValue,
         override: override ?? null,
         requires: feature.requires,
-        // Effective = what the dispatcher-gate actually uses right now,
-        // after cascade. When the feature-toggles runtime isn't wired
-        // (dev setup without the feature loaded), we surface null so the
-        // UI knows the runtime isn't available rather than defaulting
-        // to "everything on".
-        effective: effective ? effective.has(feature.name) : null,
+        effective: effectiveValue,
+        defaultLabel: formatFlag(defaultValue),
+        overrideLabel: formatFlag(override ?? null),
+        effectiveLabel: formatFlag(effectiveValue),
+        nextEnabled: !effectiveBool,
       });
     }
 
-    return { items };
+    return { rows, nextCursor: null };
   },
 });

package/src/feature-toggles/i18n.ts

@@ -3,4 +3,9 @@ type LocalizedString = { readonly en: string };
 export const FEATURE_TOGGLES_I18N: Readonly<Record<string, LocalizedString>> = {
   "screen:toggle-admin.title": { en: "Feature toggles" },
   "feature-toggles:nav.toggleAdmin": { en: "Feature toggles" },
+  "feature-toggles.admin.col.feature": { en: "Feature" },
+  "feature-toggles.admin.col.default": { en: "Default" },
+  "feature-toggles.admin.col.override": { en: "Override" },
+  "feature-toggles.admin.col.effective": { en: "Effective" },
+  "feature-toggles.admin.toggle": { en: "Toggle" },
 };

package/src/feature-toggles/web/client-plugin.tsx

@@ -1,9 +1,8 @@
 // @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
-import { FEATURE_TOGGLES_FEATURE, TOGGLE_ADMIN_SCREEN_ID } from "../constants";
+import { FEATURE_TOGGLES_FEATURE } from "../constants";
 import { defaultTranslations } from "./i18n";
-import { ToggleAdminScreen } from "./toggle-admin-screen";
 
 export type FeatureTogglesClientOptions = {
   readonly translations?: TranslationsByLocale;
@@ -15,8 +14,5 @@ export function featureTogglesClient(
   return {
     name: FEATURE_TOGGLES_FEATURE,
     translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
-    components: {
-      [TOGGLE_ADMIN_SCREEN_ID]: ToggleAdminScreen,
-    },
   };
 }

package/src/feature-toggles/web/index.ts

@@ -3,4 +3,3 @@ export {
   type FeatureTogglesClientOptions,
   featureTogglesClient,
 } from "./client-plugin";
-export { ToggleAdminScreen } from "./toggle-admin-screen";

package/src/file-derivatives/__tests__/public-variant-query-validation.integration.test.ts

@@ -8,7 +8,7 @@
 // fetchOne(), throwing a Postgres 22P02 (malformed uuid literal) that
 // poisons the pooled Bun.SQL connection, an unauth DoS primitive.
 
-import { describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createFilesFeature,
@@ -21,8 +21,10 @@ import { createFileDerivativesFeature } from "../feature";
 import { PUBLIC_VARIANT_QN } from "../handlers/public-variant.query";
 
 describe("file-derivatives :: publicVariant query fileRefId validation", () => {
-  test("non-UUID fileRefId via /api/query → 400 validation_error, never reaches the DB", async () => {
-    const stack: TestStack = await setupTestStack({
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    stack = await setupTestStack({
       features: [
         createConfigFeature(),
         fileFoundationFeature,
@@ -32,44 +34,31 @@ describe("file-derivatives :: publicVariant query fileRefId validation", () => {
       anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
       files: { storageProvider: createInMemoryFileProvider() },
     });
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
 
-    try {
-      const res = await stack.http.raw("POST", "/api/query", {
-        type: PUBLIC_VARIANT_QN,
-        payload: { fileRefId: "not-a-uuid; DROP TABLE file_refs;--", variant: "thumb" },
-      });
+  test("non-UUID fileRefId via /api/query → 400 validation_error, never reaches the DB", async () => {
+    const res = await stack.http.raw("POST", "/api/query", {
+      type: PUBLIC_VARIANT_QN,
+      payload: { fileRefId: "not-a-uuid; DROP TABLE file_refs;--", variant: "thumb" },
+    });
 
-      expect(res.status).toBe(400);
-      const body = (await res.json()) as { error?: { code?: string } };
-      expect(body.error?.code).toBe("validation_error");
-    } finally {
-      await stack.cleanup();
-    }
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error?: { code?: string } };
+    expect(body.error?.code).toBe("validation_error");
   });
 
   test("well-formed but unknown UUID fileRefId via /api/query → 200 with null (schema passes, DB lookup just finds nothing)", async () => {
-    const stack: TestStack = await setupTestStack({
-      features: [
-        createConfigFeature(),
-        fileFoundationFeature,
-        createFilesFeature(),
-        createFileDerivativesFeature({ resolveApexTenant: () => SYSTEM_TENANT_ID }),
-      ],
-      anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
-      files: { storageProvider: createInMemoryFileProvider() },
+    const res = await stack.http.raw("POST", "/api/query", {
+      type: PUBLIC_VARIANT_QN,
+      payload: { fileRefId: "00000000-0000-4000-8000-000000000000", variant: "thumb" },
     });
 
-    try {
-      const res = await stack.http.raw("POST", "/api/query", {
-        type: PUBLIC_VARIANT_QN,
-        payload: { fileRefId: "00000000-0000-4000-8000-000000000000", variant: "thumb" },
-      });
-
-      expect(res.status).toBe(200);
-      const body = (await res.json()) as { data: unknown };
-      expect(body.data).toBeNull();
-    } finally {
-      await stack.cleanup();
-    }
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { data: unknown };
+    expect(body.data).toBeNull();
   });
 });

package/src/file-derivatives/__tests__/public-variant-route.integration.test.ts

@@ -279,8 +279,8 @@ describe("GET /media/:fileRefId/:variant (anonymous, default-deny)", () => {
   test("a preset name the field doesn't declare in its variants → 404", async () => {
     const fileId = await uploadFile(userA, { entityType: "widget", entityId: PUBLIC_WIDGET_ID });
 
-    // widgetEntity's "img" field declares only thumb/full — "card" and
-    // "hero" aren't in its variants map.
+    // widgetEntity's "img" field declares thumb/full/plan/heroWide/raw —
+    // "card" and "hero" aren't in its variants map.
     const res = await stack.app.request(`http://${HOST_A}/media/${fileId}/card`);
 
     expect(res.status).toBe(404);