@cosmicdrift/kumiko-bundled-features 0.220.0 → 0.221.0

package/src/tenant/__tests__/members-screens.boot.test.ts

@@ -74,7 +74,7 @@ describe("tenant members screen + handler access alignment", () => {
     const rowAction = screen.rowActions?.find((a) => a.id === "edit-roles");
     if (rowAction?.kind !== "navigate") throw new Error("expected a navigate row action");
     expect(rowAction.screen).toBe(MEMBER_ROLES_EDIT_SCREEN_ID);
-    expect(rowAction.params).toEqual({ map: { userId: "userId" } });
+    expect(rowAction.params).toEqual({ map: { userId: "userId", roles: "roles" } });
     expect(rowAction.visible).toEqual({ field: "status", eq: "active" });
   });
 
@@ -85,6 +85,11 @@ describe("tenant members screen + handler access alignment", () => {
       throw new Error("expected member-roles-edit screen to be actionForm");
     expect(screen.handler).toBe(TenantHandlers.updateMemberRoles);
     expect(screen.fields["userId"]).toEqual({ type: "text", required: true });
+    const section = screen.layout.sections[0];
+    if (section === undefined || !("fields" in section)) {
+      throw new Error("expected member-roles-edit layout fields section");
+    }
+    expect(section.fields).toEqual([{ field: "userId", readOnly: true }, "roles"]);
     expect(screen.fields["roles"]).toEqual({
       type: "multiSelect",
       options: DEFAULT_INVITE_ROLE_OPTIONS,

package/src/tenant/__tests__/tenant-security.integration.test.ts

@@ -32,12 +32,7 @@ import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { seedUser } from "../../user/seeding";
-import {
-  MEMBER_ROLES_EDIT_SCREEN_ID,
-  MEMBERS_SCREEN_ID,
-  TenantHandlers,
-  TenantQueries,
-} from "../constants";
+import { MEMBERS_SCREEN_ID, TenantHandlers, TenantQueries } from "../constants";
 import { createTenantFeature } from "../feature";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../invitation-table";
 import { tenantMembershipsTable } from "../membership-table";
@@ -649,6 +644,33 @@ describe("updateMemberRoles — TenantAdmin session-scoped path and safety gates
     expect(JSON.parse(rows[0]?.["roles"] as string)).toEqual(["Admin"]);
   });
 
+  test("TenantAdmin omits payload.tenantId — updates roles in own tenant (fallback)", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "tenant-fallback-member@example.com",
+      displayName: "Tenant Fallback Member",
+      passwordHash: await hashPassword("pw-fallback-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+
+    const res = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId: memberUserId, roles: ["Admin"] },
+      tenantAdminA(),
+    );
+    expect(res).toMatchObject({ userId: memberUserId, tenantId: TENANT_A_ID, roles: ["Admin"] });
+
+    const rows = await selectMany(stack.db, tenantMembershipsTable, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+    });
+    expect(JSON.parse(rows[0]?.["roles"] as string)).toEqual(["Admin"]);
+  });
+
   test("TenantAdmin cannot update membership of a user in another tenant", async () => {
     const { id: otherTenantMemberId } = await seedUser(stack.db, {
       email: "other-tenant-member@example.com",
@@ -859,6 +881,78 @@ describe("updateMemberRoles — TenantAdmin session-scoped path and safety gates
     expect(JSON.parse(rows[0]?.["roles"] as string)).toEqual(["Admin"]);
   });
 
+  test("SystemAdmin omits payload.tenantId — uses session tenant (actionForm UI shape)", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "sysadmin-session-tenant@example.com",
+      displayName: "SysAdmin Session Tenant",
+      passwordHash: await hashPassword("pw-sys-sess-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+
+    // Mirrors prod: SystemAdmin with an active tenant opens Edit roles; the
+    // actionForm only posts userId+roles (no tenantId field).
+    const sysAdminInTenant: SessionUser = {
+      id: TestUsers.systemAdmin.id,
+      tenantId: TENANT_A_ID,
+      roles: ["SystemAdmin", "TenantAdmin"],
+    };
+    const res = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId: memberUserId, roles: ["Admin"] },
+      sysAdminInTenant,
+    );
+    expect(res).toMatchObject({ userId: memberUserId, tenantId: TENANT_A_ID, roles: ["Admin"] });
+
+    const rows = await selectMany(stack.db, tenantMembershipsTable, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+    });
+    expect(JSON.parse(rows[0]?.["roles"] as string)).toEqual(["Admin"]);
+  });
+
+  test("SystemAdmin sending an explicit empty payload.tenantId is rejected, not silently falls back", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "no-tenant-target@example.com",
+      displayName: "No Tenant Target",
+      passwordHash: await hashPassword("pw-notenant-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+
+    // `payloadTenantId ?? sessionTenantId` only falls back on null/undefined —
+    // a JWT always carries a valid session tenantId (jwt.verify rejects a
+    // malformed/empty tenantId claim), so the only way to reach the
+    // `!targetTenantId` branch through the real HTTP path is an explicit
+    // empty-string payload.tenantId, which `??` does NOT treat as absent.
+    const sysAdminInTenant: SessionUser = {
+      id: TestUsers.systemAdmin.id,
+      tenantId: TENANT_A_ID,
+      roles: ["SystemAdmin"],
+    };
+    const err = await stack.http.writeErr(
+      TenantHandlers.updateMemberRoles,
+      { userId: memberUserId, tenantId: "", roles: ["Admin"] },
+      sysAdminInTenant,
+    );
+    expectErrorIncludes(err, "validation_error");
+    expectErrorIncludes(err, "tenantId");
+
+    const rows = await selectMany(stack.db, tenantMembershipsTable, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+    });
+    expect(JSON.parse(rows[0]?.["roles"] as string)).toEqual(["User"]);
+  });
+
   test("updateMemberRoles appends audit event and invalidates active sessions for target user", async () => {
     const { id: memberUserId } = await seedUser(stack.db, {
       email: "session-target@example.com",
@@ -904,11 +998,14 @@ describe("updateMemberRoles — TenantAdmin session-scoped path and safety gates
 
     const [s1] = await selectMany(stack.db, userSessionTable, { id: sessionTarget1Id });
     const [s2] = await selectMany(stack.db, userSessionTable, { id: sessionTarget2Id });
-    expect(s1?.revokedAt).not.toBeNull();
-    expect(s2?.revokedAt).not.toBeNull();
+    expect(s1).toBeDefined();
+    expect(s2).toBeDefined();
+    expect(s1!.revokedAt).not.toBeNull();
+    expect(s2!.revokedAt).not.toBeNull();
 
     const [sAdmin] = await selectMany(stack.db, userSessionTable, { id: sessionAdminId });
-    expect(sAdmin?.revokedAt).toBeNull();
+    expect(sAdmin).toBeDefined();
+    expect(sAdmin!.revokedAt).toBeNull();
 
     // Event-store actor is createSystemUser (handler rewrites via system
     // stream), so filter by type + tenant — not the HTTP caller's user id.
@@ -975,34 +1072,3 @@ describe("invite + accept end-to-end integration against real stack", () => {
     expect(membersList.some((m) => m.userId === newUserId)).toBe(true);
   });
 });
-
-describe("members UI screens and actions integration against real stack", () => {
-  test("members screen and member-roles-edit actionForm execute through stack", async () => {
-    const membersScreen = stack.registry.getScreen(`tenant:screen:${MEMBERS_SCREEN_ID}`);
-    expect(membersScreen).toBeDefined();
-    expect(membersScreen?.type).toBe("projectionList");
-
-    const editRolesScreen = stack.registry.getScreen(
-      `tenant:screen:${MEMBER_ROLES_EDIT_SCREEN_ID}`,
-    );
-    expect(editRolesScreen).toBeDefined();
-    expect(editRolesScreen?.type).toBe("actionForm");
-
-    const { id: memberUserId } = await seedUser(stack.db, {
-      email: "ui-member@example.com",
-      displayName: "UI Member",
-    });
-    await seedTenantMembership(stack.db, {
-      userId: memberUserId,
-      tenantId: TENANT_A_ID,
-      roles: ["User"],
-    });
-
-    const res = await stack.http.writeOk(
-      TenantHandlers.updateMemberRoles,
-      { userId: memberUserId, tenantId: TENANT_A_ID, roles: ["Admin"] },
-      tenantAdminA(),
-    );
-    expect(res).toMatchObject({ userId: memberUserId, tenantId: TENANT_A_ID, roles: ["Admin"] });
-  });
-});

package/src/tenant/handlers/members.query.ts

@@ -18,7 +18,11 @@ const KMS_POOL_CONCURRENCY = 4;
 
 export const membersQuery = defineQueryHandler({
   name: "members",
-  schema: z.object({}),
+  schema: z.object({
+    // Optional single-user filter — audit detail (and similar) only need one
+    // member's display name, not the full decrypted roster (fw#2291).
+    userId: z.string().min(1).optional(),
+  }),
   access: { roles: access.admin },
   handler: async (query, ctx) => {
     if (!ctx.systemDb) {
@@ -30,6 +34,7 @@ export const membersQuery = defineQueryHandler({
     const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
     const rows = await selectMany(db, tenantMembershipsTable, {
       tenantId: query.user.tenantId,
+      ...(query.payload.userId !== undefined ? { userId: query.payload.userId } : {}),
     });
 
     const userIds = [...new Set(rows.map((row) => row["userId"]))];

package/src/tenant/handlers/team-list.query.ts

@@ -223,7 +223,9 @@ export const teamListQuery = definePagedQueryHandler({
     // the order of a few thousand members per tenant; past that the fix is
     // a real combined read-projection (a materialized view/table kept in
     // sync by both tenant-membership and tenant-invitation events), not a
-    // cursor bolted onto this merge.
+    // cursor bolted onto this merge. Upgrade path: r.multiStreamProjection({
+    // name, apply }) — see custom-fields/wire-for-entity.ts,
+    // feature-toggles/feature.ts, step-dispatcher/feature.ts.
     const search = query.payload.search?.trim().toLowerCase();
     const merged = [...memberRows, ...invitationRows].filter((row) => {
       if (search === undefined || search === "") return true;

package/src/tenant/handlers/update-member-roles.write.ts

@@ -41,10 +41,20 @@ const REVOKE_ALL_SESSIONS_QN = "sessions:write:user-session:revoke-all-for-user"
 // (dispatcher batch wraps handlers in transaction — xact lock holds through update).
 const LAST_TENANT_ADMIN_LOCK_NAMESPACE = 0x7461646d; // 'tadm'
 
+/** SystemAdmin may pass payload.tenantId (cross-tenant); the members actionForm
+ *  only sends userId+roles, so fall back to the active session tenant. */
+function resolveTargetTenantId(
+  isSystem: boolean,
+  payloadTenantId: string | undefined,
+  sessionTenantId: string | undefined,
+): string | undefined {
+  return isSystem ? (payloadTenantId ?? sessionTenantId) : sessionTenantId;
+}
+
 export const updateMemberRolesWrite = defineWriteHandler({
   name: "updateMemberRoles",
   schema: z.object({
-    userId: z.string(),
+    userId: z.string().min(1),
     tenantId: z.string().optional(),
     roles: z.array(z.string()).min(1),
   }),
@@ -63,7 +73,11 @@ export const updateMemberRolesWrite = defineWriteHandler({
 
     const isSystem =
       event.user.roles.includes("SystemAdmin") || event.user.roles.includes("system");
-    const targetTenantId = isSystem ? event.payload.tenantId : event.user.tenantId;
+    const targetTenantId = resolveTargetTenantId(
+      isSystem,
+      event.payload.tenantId,
+      event.user.tenantId,
+    );
     if (!targetTenantId) {
       return writeFailure(
         new ValidationError({

package/src/tenant/i18n.ts

@@ -22,19 +22,18 @@ export const TENANT_I18N: Readonly<Record<string, LocalizedString>> = {
   },
   "tenant.members.invite.title": { en: "New invitation" },
   "tenant.members.invite.submit": { en: "Send invitation" },
-  "tenant.members.roles.edit.title": { en: "Edit roles" },
   "tenant.members.roles.edit.submit": { en: "Save roles" },
   "tenant:entity:__action-form__:field:email": { en: "Email" },
   "tenant:entity:__action-form__:field:role": { en: "Role" },
   "tenant:entity:__action-form__:field:role:option:User": { en: "User" },
   "tenant:entity:__action-form__:field:role:option:Admin": { en: "Admin" },
-  "tenant:entity:__action-form__:field:role:option:TenantAdmin": { en: "TenantAdmin" },
+  "tenant:entity:__action-form__:field:role:option:TenantAdmin": { en: "Tenant Admin" },
   "tenant:entity:__action-form__:field:role:option:Editor": { en: "Editor" },
   "tenant:entity:__action-form__:field:userId": { en: "User ID" },
   "tenant:entity:__action-form__:field:roles": { en: "Roles" },
   "tenant:entity:__action-form__:field:roles:option:User": { en: "User" },
   "tenant:entity:__action-form__:field:roles:option:Admin": { en: "Admin" },
-  "tenant:entity:__action-form__:field:roles:option:TenantAdmin": { en: "TenantAdmin" },
+  "tenant:entity:__action-form__:field:roles:option:TenantAdmin": { en: "Tenant Admin" },
   "tenant:entity:__action-form__:field:roles:option:Editor": { en: "Editor" },
   "tenant:entity:tenant:field:key": { en: "Key" },
   "tenant:entity:tenant:field:name": { en: "Name" },

package/src/tenant/screens.ts

@@ -113,7 +113,7 @@ export function createMembersScreen(options?: {
         id: "edit-roles",
         label: "tenant.members.actions.editRoles",
         screen: MEMBER_ROLES_EDIT_SCREEN_ID,
-        params: { map: { userId: "userId" } },
+        params: { map: { userId: "userId", roles: "roles" } },
         visible: { field: "status", eq: "active" },
       },
       {
@@ -172,7 +172,8 @@ export const memberRolesEditScreen = {
     roles: { type: "multiSelect", options: DEFAULT_INVITE_ROLE_OPTIONS, required: true },
   },
   layout: {
-    sections: [{ fields: ["userId", "roles"] }],
+    // Prefill userId from rowAction; readOnly so the operator cannot retarget.
+    sections: [{ fields: [{ field: "userId", readOnly: true }, "roles"] }],
   },
   submitLabel: "tenant.members.roles.edit.submit",
   access: { roles: access.admin },

package/src/tenant-settings/__tests__/settings-hub-i18n.test.ts

@@ -7,10 +7,16 @@
 // audience. This test proves the real, declared translations resolve to
 // actual text (not the raw key) AND that the two nav entries read
 // differently — a regression guard, not an existence check.
+//
+// de/es copy lives in the lockstep locale packages (fw#2350); the feature
+// itself is English-only like the rest of bundled-features after 0.208.0.
 
 import { describe, expect, test } from "bun:test";
 import { createConfigFeature } from "@cosmicdrift/kumiko-bundled-features/config";
 import { buildConfigFeatureSchema, createRegistry } from "@cosmicdrift/kumiko-framework/engine";
+import { localeDeBundle } from "@cosmicdrift/kumiko-locale-de";
+import { localeEsBundle } from "@cosmicdrift/kumiko-locale-es";
+import { translationsByLocaleFromKeys } from "@cosmicdrift/kumiko-renderer";
 import { createTenantSettingsFeature } from "../feature";
 
 function translate(
@@ -18,7 +24,29 @@ function translate(
   key: string,
   locale = "en",
 ): string {
-  return translations[key]?.[locale] ?? key;
+  const byLocale = translationsByLocaleFromKeys(
+    translations as Record<string, Readonly<Record<string, string>>>,
+  );
+  return byLocale[locale]?.[key] ?? key;
+}
+
+function settingsHubLabelKeys(): readonly string[] {
+  const registry = createRegistry([createConfigFeature(), createTenantSettingsFeature()]);
+  const schema = buildConfigFeatureSchema(registry);
+  const renderedKeys: string[] = [];
+  for (const screenId of ["tenant-settings-system", "tenant-settings-tenant"]) {
+    const nav = schema.navs.find((n) => n.id === screenId);
+    const screen = schema.screens.find((s) => s.id === screenId);
+    if (nav === undefined || screen === undefined || screen.type !== "configEdit") {
+      throw new Error(`expected configEdit screen ${screenId}`);
+    }
+    const section = screen.layout.sections[0];
+    const sectionTitle = section !== undefined && "title" in section ? section.title : undefined;
+    if (sectionTitle === undefined) throw new Error(`expected section title on ${screenId}`);
+    renderedKeys.push(nav.label, `screen:${screenId}.title`, sectionTitle);
+    renderedKeys.push(...Object.values(screen.fieldLabels ?? {}));
+  }
+  return renderedKeys;
 }
 
 describe("tenant-settings — Settings-Hub nav/section labels", () => {
@@ -36,12 +64,8 @@ describe("tenant-settings — Settings-Hub nav/section labels", () => {
     const systemLabel = translate(translations, systemNav.label);
     const tenantLabel = translate(translations, tenantNav.label);
 
-    // Both labels actually resolve to text — not an echoed raw key.
     expect(systemLabel).not.toBe(systemNav.label);
     expect(tenantLabel).not.toBe(tenantNav.label);
-    // The cross-scope duplicate this test guards against: the two nav
-    // entries read differently instead of repeating the same words under
-    // both "Platform" and "Organization".
     expect(systemLabel).not.toBe(tenantLabel);
 
     const systemScreen = schema.screens.find((s) => s.id === "tenant-settings-system");
@@ -56,41 +80,35 @@ describe("tenant-settings — Settings-Hub nav/section labels", () => {
     expect(translate(translations, sectionTitle)).not.toBe(sectionTitle);
   });
 
-  test("every Settings-Hub label the schema renders resolves in es, distinct from en", () => {
-    const registry = createRegistry([createConfigFeature(), createTenantSettingsFeature()]);
-    const schema = buildConfigFeatureSchema(registry);
-    const translations = registry.getFeature("tenant-settings")?.translations ?? {};
-
-    const renderedKeys: string[] = [];
-    for (const screenId of ["tenant-settings-system", "tenant-settings-tenant"]) {
-      const nav = schema.navs.find((n) => n.id === screenId);
-      const screen = schema.screens.find((s) => s.id === screenId);
-      expect(nav).toBeDefined();
-      expect(screen).toBeDefined();
-      if (nav === undefined || screen === undefined || screen.type !== "configEdit") {
-        throw new Error("unreachable");
-      }
-      const section = screen.layout.sections[0];
-      const sectionTitle = section !== undefined && "title" in section ? section.title : undefined;
-      expect(sectionTitle).toBeDefined();
-      if (sectionTitle === undefined) throw new Error("unreachable");
-
-      renderedKeys.push(nav.label, `screen:${screenId}.title`, sectionTitle);
-      renderedKeys.push(...Object.values(screen.fieldLabels ?? {}));
-    }
-
-    // The Settings-Hub renders exactly these label surfaces per scope: nav
-    // entry, screen title, section heading and one label per masked config
-    // key (currency + locale) — six distinct keys across both scopes.
+  test("every Settings-Hub label resolves in en on the feature and in de/es locale packs", () => {
+    const renderedKeys = settingsHubLabelKeys();
+    // nav + screen title + section + currency/locale field labels — six distinct keys.
     expect(new Set(renderedKeys).size).toBe(6);
 
+    const translations = createTenantSettingsFeature().translations ?? {};
     for (const key of renderedKeys) {
-      expect(translate(translations, key, "es")).not.toBe(key);
-      expect(translate(translations, key, "es")).not.toBe(translate(translations, key, "en"));
+      const en = translations[key]?.["en"];
+      expect(en).toBeString();
+      expect(en).not.toBe(key);
     }
 
-    const systemLabel = translate(translations, "tenant-settings.settings.system", "es");
-    const tenantLabel = translate(translations, "tenant-settings.settings", "es");
-    expect(systemLabel).not.toBe(tenantLabel);
+    for (const [locale, bundle] of [
+      ["de", localeDeBundle],
+      ["es", localeEsBundle],
+    ] as const) {
+      for (const key of renderedKeys) {
+        const label = bundle[key];
+        expect(label, `${locale}:${key}`).toBeString();
+        expect(label).not.toBe(key);
+        expect(label).not.toBe(translations[key]?.["en"]);
+      }
+    }
+
+    expect(localeEsBundle["tenant-settings.settings.system"]).not.toBe(
+      localeEsBundle["tenant-settings.settings"],
+    );
+    expect(localeDeBundle["tenant-settings.settings.system"]).not.toBe(
+      localeDeBundle["tenant-settings.settings"],
+    );
   });
 });

package/src/tenant-settings/feature.ts

@@ -29,45 +29,21 @@ export function createTenantSettingsFeature(
     r.config({ keys: buildTenantSettingsKeys(opts) });
     r.translations({
       keys: {
-        "tenant-settings.currency": {
-          de: "Standard-Währung",
-          en: "Default Currency",
-          es: "Moneda predeterminada",
-        },
-        "tenant-settings.locale": {
-          de: "Standard-Sprache",
-          en: "Default Locale",
-          es: "Idioma predeterminado",
-        },
+        "tenant-settings.currency": { en: "Default Currency" },
+        "tenant-settings.locale": { en: "Default Locale" },
         // Settings-Hub-derived configEdit screen title (buildConfigFeatureSchema) —
         // required by the i18n boot-validator whenever a feature masks config keys.
-        "screen:tenant-settings-system.title": {
-          de: "Tenant-Einstellungen",
-          en: "Tenant Settings",
-          es: "Ajustes de la organización",
-        },
-        "screen:tenant-settings-tenant.title": {
-          de: "Tenant-Einstellungen",
-          en: "Tenant Settings",
-          es: "Ajustes de la organización",
-        },
+        "screen:tenant-settings-system.title": { en: "Tenant Settings" },
+        "screen:tenant-settings-tenant.title": { en: "Tenant Settings" },
         // Settings-Hub nav label + configEdit section heading (same key, both
         // scopes fall back here — see buildConfigFeatureSchema).
-        "tenant-settings.settings": {
-          de: "Tenant-Einstellungen",
-          en: "Tenant Settings",
-          es: "Ajustes de la organización",
-        },
+        "tenant-settings.settings": { en: "Tenant Settings" },
         // Both currency/locale are tenant-home with admin write access, which
         // cascades a SystemAdmin-only "set the platform default" screen up to
         // the system audience — scoped override so its nav entry reads
         // differently from the tenant-home entry instead of repeating the
         // same words under both "Platform" and "Organization".
-        "tenant-settings.settings.system": {
-          de: "Tenant-Einstellungen (Plattform-Standard)",
-          en: "Tenant Settings (Platform Default)",
-          es: "Ajustes de la organización (valor predeterminado de la plataforma)",
-        },
+        "tenant-settings.settings.system": { en: "Tenant Settings (Platform Default)" },
       },
     });
   });

package/src/tier-engine/web/tier-admin-screen.tsx

@@ -60,7 +60,8 @@ export function TierAdminScreen(): ReactNode {
   // shown (UI-level mis-grant guard). tenantId is a pure trigger here (the
   // body doesn't read it) — Biome's "extra dep" autofix would empty the deps
   // and limit the reset to mount.
-  // biome-ignore lint/correctness/useExhaustiveDependencies: tenantId is the intended reset trigger, do not remove. kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+  // biome-ignore lint/correctness/useExhaustiveDependencies: tenantId is the intended reset trigger, do not remove.
   useEffect(() => {
     setTier("");
     setStatus({ kind: "idle" });
@@ -92,7 +93,7 @@ export function TierAdminScreen(): ReactNode {
   const canSubmit = tenantId !== "" && tier !== "" && !submitting;
 
   return (
-    <FormScreenShell testId="tier-admin-screen" className="flex flex-col gap-6">
+    <FormScreenShell testId="tier-admin-screen" maxWidth="4xl" className="flex flex-col gap-6">
       {tenantsQuery.error !== null && (
         <Banner variant="error" testId="tier-admin-load-error">
           {t("tier-admin.error.load")}

package/src/user/__tests__/roles-input-schema.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, test } from "bun:test";
+import { rolesInputSchema } from "../roles-input-schema";
+
+describe("rolesInputSchema", () => {
+  test("accepts string[]", () => {
+    expect(rolesInputSchema.parse(["SystemAdmin"])).toEqual(["SystemAdmin"]);
+  });
+
+  test("accepts JSON-encoded string[]", () => {
+    expect(rolesInputSchema.parse(JSON.stringify(["SystemAdmin"]))).toEqual(["SystemAdmin"]);
+  });
+
+  test("rejects bare role name that would silently clear via parseRoles", () => {
+    expect(() => rolesInputSchema.parse("SystemAdmin")).toThrow();
+  });
+
+  test("accepts empty JSON array", () => {
+    expect(rolesInputSchema.parse("[]")).toEqual([]);
+  });
+});