@cosmicdrift/kumiko-framework 0.173.1 → 0.174.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.173.1",
+  "version": "0.174.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -182,7 +182,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.173.1",
+    "@cosmicdrift/kumiko-types": "0.174.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.12.27",
@@ -198,7 +198,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.173.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.174.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/__tests__/request-id-middleware.test.ts

@@ -121,3 +121,76 @@ describe("requestIdMiddleware — ip + userAgent capture (603/2)", () => {
     expect(captured).toBeUndefined();
   });
 });
+
+describe("requestIdMiddleware — client-supplied id sanitization (input-validation)", () => {
+  test("oversized X-Request-ID is rejected, a fresh id is generated instead", async () => {
+    let captured: string | undefined;
+
+    const app = new Hono();
+    app.use("/probe", requestIdMiddleware());
+    app.get("/probe", (c) => {
+      captured = requestContext.get()?.requestId;
+      return c.text("ok");
+    });
+
+    const junk = "x".repeat(5000);
+    const res = await app.request(
+      new Request("http://test.local/probe", {
+        method: "GET",
+        headers: { "X-Request-ID": junk },
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(captured).toBeDefined();
+    expect(captured).not.toBe(junk);
+    expect(captured?.length).toBeLessThan(128);
+  });
+
+  test("disallowed-character X-Correlation-ID falls back to the (sanitized) requestId", async () => {
+    let captured: { requestId: string | undefined; correlationId: string | undefined } = {
+      requestId: undefined,
+      correlationId: undefined,
+    };
+
+    const app = new Hono();
+    app.use("/probe", requestIdMiddleware());
+    app.get("/probe", (c) => {
+      const ctx = requestContext.get();
+      captured = { requestId: ctx?.requestId, correlationId: ctx?.correlationId };
+      return c.text("ok");
+    });
+
+    const res = await app.request(
+      new Request("http://test.local/probe", {
+        method: "GET",
+        headers: { "X-Request-ID": "req-1", "X-Correlation-ID": "corr injected; drop table" },
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(captured.requestId).toBe("req-1");
+    expect(captured.correlationId).toBe("req-1");
+  });
+
+  test("a well-formed client id is preserved", async () => {
+    let captured: string | undefined;
+
+    const app = new Hono();
+    app.use("/probe", requestIdMiddleware());
+    app.get("/probe", (c) => {
+      captured = requestContext.get()?.requestId;
+      return c.text("ok");
+    });
+
+    const res = await app.request(
+      new Request("http://test.local/probe", {
+        method: "GET",
+        headers: { "X-Request-ID": "trace-abc123.def" },
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(captured).toBe("trace-abc123.def");
+  });
+});

package/src/api/request-id-middleware.ts

@@ -4,6 +4,16 @@ import { requestContext } from "./request-context";
 const REQUEST_ID_HEADER = "X-Request-ID";
 const CORRELATION_ID_HEADER = "X-Correlation-ID";
 
+// requestId/correlationId flow unvalidated into append-only event-store
+// metadata (e.g. sessions:revoke-all-for-user) — cap shape at the trust
+// boundary so a client can't smuggle an oversized/control-char payload into
+// permanent, replayed, DSGVO-exported storage via a client-set header.
+const SAFE_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+
+function sanitizeClientId(value: string | undefined): string | undefined {
+  return value !== undefined && SAFE_ID_RE.test(value) ? value : undefined;
+}
+
 /**
  * Assigns a requestId + correlationId to every request and wraps execution
  * in AsyncLocalStorage. Runs BEFORE auth — both ids are available even for
@@ -15,8 +25,9 @@ const CORRELATION_ID_HEADER = "X-Correlation-ID";
  */
 export function requestIdMiddleware() {
   return async (c: Context, next: Next) => {
-    const requestId = c.req.header(REQUEST_ID_HEADER) ?? requestContext.generateId();
-    const correlationId = c.req.header(CORRELATION_ID_HEADER) ?? requestId;
+    const requestId =
+      sanitizeClientId(c.req.header(REQUEST_ID_HEADER)) ?? requestContext.generateId();
+    const correlationId = sanitizeClientId(c.req.header(CORRELATION_ID_HEADER)) ?? requestId;
     c.header(REQUEST_ID_HEADER, requestId);
     c.header(CORRELATION_ID_HEADER, correlationId);
     c.set("requestId", requestId);

package/src/api/sse-broker.ts

@@ -19,9 +19,13 @@ export type SseBroker = {
   getClientCount(channel: string): number;
   getTotalClientCount(): number;
   // Separate from addClient so it doesn't count towards getClientCount.
-  // Optional: additive for external/test SseBroker impls (call sites use?.).
-  subscribeAccessInvalidation?(userId: string, onInvalidate: () => void): () => void;
-  publishAccessInvalidation?(userId: string): void;
+  // Required (fw#1601): an app-injected SseBroker (e.g. a Redis-backed
+  // multi-replica broker) that skips these silently turns the mid-stream
+  // access-teardown security control (#1561) into a no-op — a revoked
+  // session keeps receiving live SSE data with no error or log. A no-op
+  // stub is one line for a broker that genuinely doesn't need it.
+  subscribeAccessInvalidation(userId: string, onInvalidate: () => void): () => void;
+  publishAccessInvalidation(userId: string): void;
 };
 
 export function createSseBroker(): SseBroker {

package/src/crypto/__tests__/kms-wiring.test.ts

@@ -83,6 +83,12 @@ describe("buildPgKmsOptions", () => {
       /PLATFORM_KEK_PREVIOUS_VERSION must be set/,
     );
   });
+
+  test("rejects PLATFORM_KEK_PREVIOUS_VERSION without PLATFORM_KEK_PREVIOUS — half-set rotation must not silently drop the version", () => {
+    expect(() => buildPgKmsOptions({ ...rotationEnv, PLATFORM_KEK_PREVIOUS_VERSION: "1" })).toThrow(
+      /PLATFORM_KEK_PREVIOUS must be set/,
+    );
+  });
 });
 
 describe("resolveKmsWiring", () => {

package/src/crypto/kms-wiring.ts

@@ -83,6 +83,11 @@ export function buildPgKmsOptions(env: PgKmsRotationEnv): PgKmsAdapterOptions {
     ? parseKekVersion(env.PLATFORM_KEK_VERSION, "PLATFORM_KEK_VERSION")
     : 1;
   if (!env.PLATFORM_KEK_PREVIOUS) {
+    if (env.PLATFORM_KEK_PREVIOUS_VERSION) {
+      throw new Error(
+        "PLATFORM_KEK_PREVIOUS must be set when PLATFORM_KEK_PREVIOUS_VERSION is set.",
+      );
+    }
     return {
       databaseUrl: env.SUBJECT_KEYS_DATABASE_URL,
       platformKek: env.PLATFORM_KEK,

package/src/db/__tests__/eagerload.integration.test.ts

@@ -9,7 +9,7 @@ import {
   InMemoryKmsAdapter,
   isPiiCiphertext,
 } from "../../crypto";
-import { createEntity, createTextField } from "../../engine";
+import { createEntity, createTextField, from } from "../../engine";
 import type { EntityDefinition } from "../../engine/types";
 import { setupTestStack, type TestStack, testTenantId, unsafeCreateEntityTable } from "../../stack";
 import { createTestEnvelopeCipher, resetPiiSubjectKmsForTests, seedRows } from "../../testing";
@@ -58,13 +58,44 @@ const leadEntity = createEntity({
   fields: {
     title: createTextField({ required: true }),
     contact: { type: "reference", entity: "contact" },
+    ownedContact: { type: "reference", entity: "ownedContact" },
+    unrestrictedContact: { type: "reference", entity: "unrestrictedContact" },
   },
 });
 const contactTable = buildEntityTable("contact", contactEntity);
 
+// fw#1671: ownership-scoped ref entity — eagerload has no SessionUser to
+// evaluate access.read against, so PII/encrypted fields must be stripped
+// entirely rather than decrypted (fail closed, not a same-tenant PII leak).
+const ownedContactEntity = createEntity({
+  table: "el_owned_contacts",
+  fields: {
+    name: createTextField({ required: true }),
+    email: createTextField({ required: true, tenantOwned: true }),
+    iban: createTextField({ required: true, encrypted: true }),
+  },
+  access: { read: { admin: from("user:id", "ownerId") } },
+});
+const ownedContactTable = buildEntityTable("ownedContact", ownedContactEntity);
+
+// access.read present but every role is "all" (unrestricted) — must NOT
+// trigger the strip path, or #1667's decrypt would silently regress for
+// every entity that merely declares an access.read map without narrowing it.
+const unrestrictedContactEntity = createEntity({
+  table: "el_unrestricted_contacts",
+  fields: {
+    name: createTextField({ required: true }),
+    email: createTextField({ required: true, tenantOwned: true }),
+  },
+  access: { read: { admin: "all", member: "all" } },
+});
+const unrestrictedContactTable = buildEntityTable("unrestrictedContact", unrestrictedContactEntity);
+
 const resolve = (name: string): EntityDefinition | undefined => {
   if (name === "author") return authorEntity;
   if (name === "contact") return contactEntity;
+  if (name === "ownedContact") return ownedContactEntity;
+  if (name === "unrestrictedContact") return unrestrictedContactEntity;
   return undefined;
 };
 
@@ -83,6 +114,9 @@ const many = (r: EagerloadedRow | undefined, f: string) =>
   r?._refs?.[f] as ReadonlyArray<Record<string, unknown>> | undefined;
 
 const CX = "44444444-4444-4444-8444-444444444444";
+const OWNED = "66666666-6666-4666-8666-666666666666";
+const UNRESTRICTED = "88888888-8888-4888-8888-888888888888";
+const BROKEN = "77777777-7777-4777-8777-777777777777";
 const TEST_KEY = Buffer.from("a]bJm#kP9xQ2@wN!vL$hR5yT8eU0iO3f").toString("base64");
 const cipher = createTestEnvelopeCipher(TEST_KEY);
 const kms = new InMemoryKmsAdapter();
@@ -94,6 +128,8 @@ beforeAll(async () => {
   stack = await setupTestStack({ features: [] });
   await unsafeCreateEntityTable(stack.db, authorEntity);
   await unsafeCreateEntityTable(stack.db, contactEntity);
+  await unsafeCreateEntityTable(stack.db, ownedContactEntity);
+  await unsafeCreateEntityTable(stack.db, unrestrictedContactEntity);
   dbA = createTenantDb(stack.db, tenantA, "tenant");
 
   await seedRows(stack.db, authorTable, [
@@ -120,6 +156,44 @@ beforeAll(async () => {
     cipher,
   );
   await seedRows(stack.db, contactTable, [encrypted]);
+
+  const plainOwned = {
+    id: OWNED,
+    tenantId: tenantA,
+    name: "Owned Grace",
+    email: "owned-grace@acme.test",
+    iban: "DE99999",
+  };
+  const ownedPiiEncrypted = await encryptPiiFieldValues(
+    plainOwned,
+    ownedContactEntity,
+    ["email"],
+    kms,
+    { requestId: "test" },
+  );
+  const ownedEncrypted = await encryptEntityFieldValues(
+    ownedPiiEncrypted,
+    collectEncryptedFieldNames(ownedContactEntity),
+    cipher,
+  );
+  await seedRows(stack.db, ownedContactTable, [ownedEncrypted]);
+
+  // Legacy/backfilled row: iban never went through encryptEntityFieldValues,
+  // so decryptEntityFieldValues throws on it (fw#1671 error-propagation) —
+  // a single row like this must not 500 the whole eagerload lookup.
+  await seedRows(stack.db, contactTable, [
+    {
+      id: BROKEN,
+      tenantId: tenantA,
+      name: "Broken",
+      email: "broken@acme.test",
+      iban: "not-an-envelope",
+    },
+  ]);
+
+  await seedRows(stack.db, unrestrictedContactTable, [
+    { id: UNRESTRICTED, tenantId: tenantA, name: "Unrestricted", email: "unrestricted@acme.test" },
+  ]);
 });
 
 afterAll(async () => {
@@ -237,4 +311,48 @@ describe("enrichWithReferences", () => {
     expect(contact?.["iban"]).toBe("DE12345");
     expect(isPiiCiphertext(contact?.["email"])).toBe(false);
   });
+
+  test('fw#1671: access.read map where every rule is "all" (unrestricted) does NOT trigger the strip path', async () => {
+    const [row] = (await enrichWithReferences(
+      [{ id: "l1", unrestrictedContact: UNRESTRICTED }],
+      leadEntity,
+      resolve,
+      dbA,
+    )) as EagerloadedRow[];
+    const unrestricted = single(row, "unrestrictedContact");
+
+    expect(unrestricted).toBeDefined();
+    expect(unrestricted?.["name"]).toBe("Unrestricted");
+    expect(unrestricted?.["email"]).toBe("unrestricted@acme.test");
+  });
+
+  test("fw#1671: ownership-scoped ref entity — PII/encrypted fields are stripped, not decrypted or leaked as ciphertext", async () => {
+    const [row] = (await enrichWithReferences(
+      [{ id: "l1", ownedContact: OWNED }],
+      leadEntity,
+      resolve,
+      dbA,
+    )) as EagerloadedRow[];
+    const owned = single(row, "ownedContact");
+
+    expect(owned).toBeDefined();
+    expect(owned?.["name"]).toBe("Owned Grace");
+    expect(owned?.["email"]).toBeUndefined();
+    expect(owned?.["iban"]).toBeUndefined();
+  });
+
+  test("fw#1671: a row with a broken envelope is dropped, a sibling row's good ref still resolves in the same batch", async () => {
+    const [goodRow, brokenRow] = (await enrichWithReferences(
+      [
+        { id: "l1", contact: CX },
+        { id: "l2", contact: BROKEN },
+      ],
+      leadEntity,
+      resolve,
+      dbA,
+    )) as EagerloadedRow[];
+
+    expect(single(goodRow, "contact")?.["email"]).toBe("grace@acme.test");
+    expect(single(brokenRow, "contact")).toBeUndefined();
+  });
 });

package/src/db/__tests__/event-store-executor-write-verbs.integration.test.ts

@@ -245,6 +245,33 @@ describe("event-store-executor write-verbs — field-level ownership_denied", ()
     if (result.isSuccess) return;
     expect((result.error.details as { reason?: string }).reason).toBe("ownership_denied");
   });
+
+  // fw#1685: a preSave hook that derives a field the user never submitted
+  // must not have that field field-ownership-checked against the user —
+  // only what the user actually wrote in `payload.changes` is checked.
+  test("create: preSave-derived `note` (not submitted by the user) does not trigger ownership_denied", async () => {
+    const result = await crud.create({ authorId: TestUsers.driver.id }, nonAdmin, tdb, {
+      preSave: async (changes) => ({ ...changes, note: "hook-derived" }),
+    });
+    expect(result.isSuccess).toBe(true);
+  });
+
+  test("update: preSave-derived `note` (not submitted by the user) does not trigger ownership_denied", async () => {
+    const created = await crud.create(
+      { authorId: TestUsers.driver.id, note: "original" },
+      admin,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const result = await crud.update(
+      { id: created.data.id, version: 1, changes: {} },
+      nonAdmin,
+      tdb,
+      { preSave: async (changes) => ({ ...changes, note: "hook-derived" }) },
+    );
+    expect(result.isSuccess).toBe(true);
+  });
 });
 
 // =============================================================================

package/src/db/eagerload.ts

@@ -95,25 +95,80 @@ export function collectReferenceFields(entity: EntityDefinition): readonly Refer
 // event-store-executor-context's decryptForRead ordering: PII is the outer
 // layer, peel it before the envelope-encrypted fields, or the envelope
 // cipher chokes on a still-PII-wrapped string.
+//
+// Ownership guard (fw#1671): the ref lookup below is tenant-scoped only, not
+// ownership-scoped — this function has no SessionUser to evaluate
+// refEntity.access.read against. If the ref entity declares row-level
+// ownership at all, decrypting here would hand a same-tenant User A the
+// plaintext PII of a User B row they merely reference (e.g. a freely-settable
+// reference UUID), even though refEntity.access.read says "own" — the caller
+// never gets to run that ownership check. Fail closed: strip PII/encrypted
+// fields entirely instead of decrypting (or leaking ciphertext) when that
+// guarantee can't be evaluated here.
+function hasOwnershipScopedRead(refEntity: EntityDefinition): boolean {
+  const readMap = refEntity.access?.read;
+  if (readMap === undefined) return false;
+  // "all" means that role sees every row unrestricted — a map where every
+  // rule is "all" carries no ownership restriction at all, so stripping
+  // here would just silently drop PII/encrypted fields #1667 wants
+  // decrypted, for no security benefit.
+  return Object.values(readMap).some((rule) => rule !== "all");
+}
+
 async function decryptReferencedRow(
   row: Record<string, unknown>,
   refEntity: EntityDefinition,
 ): Promise<Record<string, unknown>> {
-  let out = row;
   const piiFields = collectPiiSubjectFields(refEntity);
+  const encryptedFields = collectEncryptedFieldNames(refEntity);
+  if (hasOwnershipScopedRead(refEntity)) {
+    if (piiFields.length === 0 && encryptedFields.size === 0) return row;
+    const out = { ...row };
+    for (const field of piiFields) delete out[field];
+    for (const field of encryptedFields) delete out[field];
+    return out;
+  }
+
+  let out = row;
   const kms = configuredPiiSubjectKms();
   if (piiFields.length > 0 && kms) {
     out = await decryptPiiFieldValues(out, piiFields, kms, {
       requestId: requestContext.get()?.requestId ?? "eagerload",
     });
   }
-  const encryptedFields = collectEncryptedFieldNames(refEntity);
   if (encryptedFields.size > 0) {
     out = await decryptEntityFieldValues(out, encryptedFields, resolveEntityFieldEncryption());
   }
   return out;
 }
 
+// Per-row, not Promise.all: a single legacy/backfilled row without a valid
+// envelope (decryptEntityFieldValues throws hard on malformed ciphertext)
+// must not 500 the whole list request — the main rows the caller asked for
+// are unrelated to this one broken reference. Drop just that row from the
+// map; the renderer falls back to the raw UUID.
+async function buildRefLookupMap(
+  rawRefRows: ReadonlyArray<Record<string, unknown>>,
+  refEntity: EntityDefinition,
+  refEntityName: string,
+): Promise<Map<string, Record<string, unknown>>> {
+  const map = new Map<string, Record<string, unknown>>();
+  for (const r of rawRefRows) {
+    let decrypted: Record<string, unknown>;
+    try {
+      decrypted = await decryptReferencedRow(r, refEntity);
+    } catch (e) {
+      console.warn(
+        `[eagerload] failed to decrypt referenced row entity=${refEntityName} id=${String(r["id"])}: ${e instanceof Error ? e.message : String(e)}`,
+      );
+      continue;
+    }
+    const id = decrypted["id"];
+    if (typeof id === "string") map.set(id, decrypted);
+  }
+  return map;
+}
+
 /** Eagerload für eine Liste von Rows. Mutiert nicht — gibt eine
  *  flache Kopie der Rows mit hinzugefügtem `_refs`-Property zurück. */
 export async function enrichWithReferences(
@@ -159,12 +214,7 @@ export async function enrichWithReferences(
       const rawRefRows = (await selectMany(db, refTable, { id: idArray })) as Array<
         Record<string, unknown>
       >;
-      const refRows = await Promise.all(rawRefRows.map((r) => decryptReferencedRow(r, refEntity)));
-      const map = new Map<string, Record<string, unknown>>();
-      for (const r of refRows) {
-        const id = r["id"];
-        if (typeof id === "string") map.set(id, r);
-      }
+      const map = await buildRefLookupMap(rawRefRows, refEntity, rf.refEntityName);
       return { fieldName: rf.fieldName, multiple: rf.multiple, map };
     }),
   );

package/src/db/event-store-executor-write.ts

@@ -133,7 +133,20 @@ export function createWriteVerbs(
       // Field-level write-ownership on create — mirror of entity-level but
       // per declared field. Role-level was already checked by the
       // dispatcher; here we enforce ownership-rules against the new row.
-      const fieldDeniedCreate = checkWriteFieldOwnership(entity, data, user);
+      //
+      // Which fields get checked is scoped to the pre-hook payload (fw#1685)
+      // — a hook-derived field the user never submitted must not be
+      // field-ownership-checked against the user. The rule for a checked
+      // field is still evaluated against the full post-hook row (`data`) —
+      // an ownership rule can reference a column only a hook populates
+      // (kumiko-framework#1672).
+      const fieldDeniedCreate = checkWriteFieldOwnership(
+        entity,
+        applyDefaults(payloadWithoutId),
+        user,
+        undefined,
+        data,
+      );
       if (fieldDeniedCreate) {
         return writeFailure(
           new UnprocessableError("ownership_denied", {
@@ -301,7 +314,24 @@ export function createWriteVerbs(
       // `previous`, we can run the ownership rules per field against both
       // sides and reject individual fields the user isn't entitled to
       // touch on this specific row.
-      const fieldDeniedUpdate = checkWriteFieldOwnership(entity, changes, user, previous);
+      //
+      // Which fields get checked is scoped to `payload.changes` (the user's
+      // actual submission), NOT `changes` (post-preSave-hook data, fw#1685)
+      // — a hook-derived field the user never submitted (e.g. a system hook
+      // setting `assignedTo`) has no business being field-ownership-checked
+      // against the *user*, and doing so rejects writes the user is fully
+      // entitled to make. The dispatcher's role-gate (checkWriteFieldAccess)
+      // already runs on this same pre-hook payload for consistency. The rule
+      // for a checked field is still evaluated against the full post-hook
+      // row (`changes` merged onto `previous`) — an ownership rule can
+      // reference a column only a hook populates (kumiko-framework#1672).
+      const fieldDeniedUpdate = checkWriteFieldOwnership(
+        entity,
+        payload.changes,
+        user,
+        previous,
+        changes,
+      );
       if (fieldDeniedUpdate) {
         return writeFailure(
           new UnprocessableError("ownership_denied", {

package/src/engine/__tests__/schema-builder.test.ts

@@ -131,6 +131,18 @@ describe("buildInsertSchema", () => {
       valid: { age: 5 },
       invalid: { age: 11 },
     },
+    {
+      name: "integer field rejects a value outside Postgres int4 range (must 400, not crash the DB write)",
+      fields: { attempt: createNumberField({ integer: true }) },
+      valid: { attempt: 2147483647 },
+      invalid: { attempt: 2147483648 },
+    },
+    {
+      name: "integer field with explicit max narrower than int4 still enforces the explicit bound",
+      fields: { displayOrder: createNumberField({ integer: true, max: 100 }) },
+      valid: { displayOrder: 100 },
+      invalid: { displayOrder: 101 },
+    },
     {
       name: "date field",
       fields: { born: createDateField() },

package/src/engine/field-access.ts

@@ -98,15 +98,29 @@ export function checkWriteFieldRoles(
 // row. For creates, pass oldRow = undefined; the check degenerates to a
 // newRow-only evaluation.
 //
+// `submittedChanges` and `rowContext` are deliberately separate (fw#1685):
+// - `submittedChanges` drives WHICH fields get checked — only what the user
+//   actually wrote in the request. A preSave-hook-derived field the user
+//   never touched (e.g. a system hook setting `assignedTo`) must not be
+//   field-ownership-checked against the user at all.
+// - `rowContext` drives what a checked field's rule is evaluated AGAINST —
+//   this needs the full post-hook row, because an ownership rule can
+//   reference a DIFFERENT column that only a hook populates (kumiko-
+//   framework#1672: a hook derives `authorId`, a user-submitted `secretNote`
+//   field's rule is `from("user:id", "authorId")` — the check needs the
+//   hook-derived `authorId` in scope even though the user only wrote
+//   `secretNote`). Defaults to `submittedChanges` when omitted.
+//
 // Returns the denied field name for the caller to wrap into an
 // `ownership_denied` error with scope: "field", or null if all fields pass.
 export function checkWriteFieldOwnership(
   entity: EntityDefinition,
-  changes: Readonly<Record<string, unknown>>,
+  submittedChanges: Readonly<Record<string, unknown>>,
   user: SessionUser,
   oldRow?: Readonly<Record<string, unknown>>,
+  rowContext: Readonly<Record<string, unknown>> = submittedChanges,
 ): string | null {
-  for (const key of Object.keys(changes)) {
+  for (const key of Object.keys(submittedChanges)) {
     const field = entity.fields[key];
     if (!field) continue;
 
@@ -120,7 +134,7 @@ export function checkWriteFieldOwnership(
     const hasOwnershipRule = Object.values(accessMap).some((r) => r !== "all");
     if (!hasOwnershipRule) continue;
 
-    const newRow: Record<string, unknown> = { ...(oldRow ?? {}), ...changes };
+    const newRow: Record<string, unknown> = { ...(oldRow ?? {}), ...rowContext };
     const effectiveOld = oldRow ?? newRow; // create: compare against newRow
 
     if (!userCanWriteFieldRow(user, accessMap, effectiveOld, newRow)) {

package/src/engine/schema-builder.ts

@@ -109,7 +109,10 @@ export function fieldToZod(field: FieldDefinition, currencies: readonly string[]
     }
     case "number": {
       let schema = z.number();
-      if (field.integer) schema = schema.int();
+      // `integer: true` maps to a Postgres int4 column (entity-table-meta.ts)
+      // — bound it here so an out-of-range write fails loud (400) at the
+      // schema boundary instead of dying in Postgres (22003 → 500).
+      if (field.integer) schema = schema.int().min(-2147483648).max(2147483647);
       if (field.min !== undefined) schema = schema.min(field.min);
       if (field.max !== undefined) schema = schema.max(field.max);
       return field.default !== undefined ? schema.default(field.default) : schema;

package/src/pipeline/dispatch-shared.ts

@@ -60,7 +60,7 @@ import {
   observabilityContext,
 } from "../observability";
 import { buildBucketKey } from "../rate-limit";
-import { createTzContext } from "../time";
+import { createTzContext, isValidIanaTimeZone } from "../time";
 import { appendDomainEventCore } from "./append-event-core";
 import { resolveAuthClaims as runAuthClaimsResolver } from "./auth-claims-resolver";
 import { executeQuery } from "./dispatch-query";
@@ -523,10 +523,18 @@ export async function buildHandlerContext(
   // tenant (createTzContext's own default). An app-injected GeoTzProvider
   // (context.geoTzProvider) feeds ctx.tz.fromCoordinates / fromAddress.
   const tenantTz = config !== undefined ? await config("tenant:config:timezone") : undefined;
+  // Guarded against garbage: an unvalidated string here (free-form config
+  // key, legacy JWT claim predating validation) blows up every ctx.tz call
+  // for the whole tenant with a RangeError. Fall back to UTC/tenant instead
+  // of trusting the raw value.
+  const safeTenantTz =
+    typeof tenantTz === "string" && isValidIanaTimeZone(tenantTz) ? tenantTz : "UTC";
+  const safeUserTz =
+    user.timezone !== undefined && isValidIanaTimeZone(user.timezone) ? user.timezone : undefined;
   const tz = createTzContext({
     ...(context.geoTzProvider !== undefined ? { geoTz: context.geoTzProvider } : {}),
-    tenant: typeof tenantTz === "string" ? tenantTz : "UTC",
-    ...(user.timezone !== undefined && { user: user.timezone }),
+    tenant: safeTenantTz,
+    ...(safeUserTz !== undefined && { user: safeUserTz }),
   });
 
   return {

package/src/pipeline/dispatch-stream.ts

@@ -59,12 +59,9 @@ async function* executeStreamInner(
   const invalidated = new Promise<void>((resolve) => {
     resolveInvalidated = resolve;
   });
-  const unsubscribeAccessInvalidation = ctx.sseBroker?.subscribeAccessInvalidation?.(
-    user.id,
-    () => {
-      resolveInvalidated?.();
-    },
-  );
+  const unsubscribeAccessInvalidation = ctx.sseBroker?.subscribeAccessInvalidation(user.id, () => {
+    resolveInvalidated?.();
+  });
 
   let iterator: AsyncIterator<unknown> | undefined;
   // When access is revoked mid-pull, `iterator.next()` is still in flight.

package/src/pipeline/system-hooks.ts

@@ -94,7 +94,7 @@ export function createSearchEventConsumer(
 // #1610 — subject-annotated searchable fields are ciphertext in the event
 // payload; decrypt into the derived index only. No KMS → omit ciphertext
 // values rather than indexing blobs.
-async function decryptSearchableSubjectFields(
+export async function decryptSearchableSubjectFields(
   entityName: string,
   state: Record<string, unknown>,
   registry: Registry,
@@ -116,7 +116,7 @@ async function decryptSearchableSubjectFields(
   });
 }
 
-function hasErasedSearchableSubjectField(
+export function hasErasedSearchableSubjectField(
   entityName: string,
   state: Record<string, unknown>,
   registry: Registry,
@@ -416,7 +416,7 @@ export function createAccessInvalidationEventConsumer(sseBroker: SseBroker): Eve
         // poison would otherwise permanently stop access-invalidation for
         // every user behind one bad row).
         if (typeof userId !== "string" || userId.length === 0) return;
-        sseBroker.publishAccessInvalidation?.(userId);
+        sseBroker.publishAccessInvalidation(userId);
       }
 
       if (
@@ -427,7 +427,7 @@ export function createAccessInvalidationEventConsumer(sseBroker: SseBroker): Eve
         // skip: previous snapshot missing/malformed userId — same fail-open
         // reasoning as above.
         if (userId === undefined) return;
-        sseBroker.publishAccessInvalidation?.(userId);
+        sseBroker.publishAccessInvalidation(userId);
       }
     },
   };

package/src/search/__tests__/reindex-entity.integration.test.ts

@@ -5,6 +5,11 @@
 // nothing.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import {
   asRawClient,
   buildEntityTable,
@@ -20,6 +25,7 @@ import {
   TestUsers,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
 
 const widgetEntity = createEntity({
   table: "read_reindex_widgets",
@@ -35,16 +41,38 @@ const widgetFeature = defineFeature("reindex-test", (r) => {
   r.entity("widget", widgetEntity);
 });
 
+// fw#1611: pii + searchable — the read-table column holds ciphertext, a
+// naive backfill would index blobs (or resurrect a crypto-shredded row).
+const contactEntity = createEntity({
+  table: "read_reindex_contacts",
+  fields: {
+    label: createTextField({ required: true, maxLength: 100, pii: true, searchable: true }),
+  },
+});
+const contactTable = buildEntityTable("contact", contactEntity);
+const contactFeature = defineFeature("reindex-pii-test", (r) => {
+  r.entity("contact", contactEntity);
+});
+
 let stack: TestStack;
+let kms: InMemoryKmsAdapter;
 const admin = TestUsers.admin;
 
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [widgetFeature] });
+  stack = await setupTestStack({ features: [widgetFeature, contactFeature] });
   await unsafeCreateEntityTable(stack.db, widgetEntity);
+  await unsafeCreateEntityTable(stack.db, contactEntity, "contact");
   await createEventsTable(stack.db);
+  // Shared across both pii tests below (not per-test) — reindexEntity scans
+  // the whole tenant table regardless of which test created which row, so a
+  // fresh KMS instance per test would make earlier rows' subject keys
+  // unresolvable (KeyNotFoundError) instead of exercising the erased path.
+  kms = new InMemoryKmsAdapter();
+  configurePiiSubjectKms(kms);
 });
 
 afterAll(async () => {
+  resetPiiSubjectKmsForTests();
   await stack.cleanup();
 });
 
@@ -141,4 +169,72 @@ describe("reindexEntity", () => {
       );
     }
   });
+
+  // fw#1611: reindexEntity read the read-table row (ciphertext for pii+
+  // searchable fields) straight into the search document, skipping the
+  // decrypt step createSearchEventConsumer applies on the live path.
+  test("decrypts pii+searchable fields before indexing — backfill is findable by plaintext, not ciphertext", async () => {
+    const plain = "UniqueReindexPiiLabel1611";
+    const executor = createEventStoreExecutor(contactTable, contactEntity, {
+      entityName: "contact",
+    });
+    const created = await executor.create(
+      { label: plain },
+      admin,
+      createTenantDb(stack.db, admin.tenantId, "system"),
+    );
+    if (!created.isSuccess) throw new Error("seed failed");
+
+    // No dispatcher run — row exists only on the read-table, ciphertext.
+    const row = (
+      await asRawClient(stack.db).unsafe(
+        `SELECT label FROM "read_reindex_contacts" WHERE id = $1`,
+        [created.data.id],
+      )
+    )[0] as { label: string };
+    expect(isPiiCiphertext(row.label)).toBe(true);
+
+    const result = await reindexEntity(
+      stack.db,
+      stack.registry,
+      stack.search,
+      "contact",
+      admin.tenantId,
+    );
+    expect(result.indexedRows).toBe(1);
+    expect(result.failures).toHaveLength(0);
+
+    const hits = await stack.search.search(admin.tenantId, plain, { filterType: "contact" });
+    expect(hits.some((h) => String(h.entityId) === String(created.data.id))).toBe(true);
+  });
+
+  test("skips a row whose subject key was already erased — reindex must not resurrect a crypto-shredded row", async () => {
+    const plain = "ErasedReindexPiiLabel1611";
+    const executor = createEventStoreExecutor(contactTable, contactEntity, {
+      entityName: "contact",
+    });
+    const created = await executor.create(
+      { label: plain },
+      admin,
+      createTenantDb(stack.db, admin.tenantId, "system"),
+    );
+    if (!created.isSuccess) throw new Error("seed failed");
+
+    // pii: true → subject key is the entity id itself.
+    await kms.eraseKey({ kind: "user", userId: String(created.data.id) });
+
+    const result = await reindexEntity(
+      stack.db,
+      stack.registry,
+      stack.search,
+      "contact",
+      admin.tenantId,
+    );
+    // Shares the tenant/table with the preceding test, so other rows may
+    // also index here — what matters is that THIS erased row didn't.
+    expect(result.failures).toHaveLength(0);
+
+    const hits = await stack.search.search(admin.tenantId, plain, { filterType: "contact" });
+    expect(hits.some((h) => String(h.entityId) === String(created.data.id))).toBe(false);
+  });
 });

package/src/search/reindex-entity.ts

@@ -9,7 +9,11 @@ import type { DbRunner } from "../db/connection";
 import { resolveTableName } from "../db/entity-table-meta";
 import { executeRawQuery } from "../db/queries/raw-sql";
 import type { Registry, TenantId } from "../engine/types";
-import { buildSearchDocument } from "../pipeline/system-hooks";
+import {
+  buildSearchDocument,
+  decryptSearchableSubjectFields,
+  hasErasedSearchableSubjectField,
+} from "../pipeline/system-hooks";
 import { toSnakeCase } from "../utils/case";
 import type { SearchAdapter, SearchDocument } from "./types";
 
@@ -135,7 +139,16 @@ export async function reindexEntity(
       result.scannedRows++;
       const entityId = String(row["id"]);
       try {
-        const state = rowToState(row, fieldNames);
+        const rawState = rowToState(row, fieldNames);
+        // `pii + searchable` fields hold ciphertext on the read-table row —
+        // decrypt the same way the live write-path consumer does. An
+        // erased subject key doesn't throw, it swaps the value for
+        // PII_ERASED_SENTINEL (see decryptSearchableSubjectFields) — check
+        // for that AFTER decrypting, mirroring the softDelete filter above:
+        // resurrecting a crypto-shredded row here would undo
+        // purgeSearchDocumentsForSubject and make it findable again.
+        const state = await decryptSearchableSubjectFields(entityName, rawState, registry);
+        if (hasErasedSearchableSubjectField(entityName, state, registry)) continue;
         const doc = await buildSearchDocument(entityName, entityId, state, registry);
         if (doc) docs.push({ entityId, doc });
       } catch (e) {