@cosmicdrift/kumiko-framework 0.173.1 → 0.174.1

package/src/db/entity-table-meta.ts

@@ -247,7 +247,7 @@ export function deriveEntityTableMeta(
   const tableName = resolveTableName(entityName, entity, options?.featureName);
   const source = options?.source ?? "managed";
   if (source === "unmanaged") {
-    assertUnmanagedTableName(tableName, "deriveEntityTableMeta");
+    assertUnmanagedTableName(tableName, "deriveEntityTableMeta/buildEntityTableMeta");
   }
   const idType = entity.idType ?? "uuid";
 
@@ -424,6 +424,11 @@ function columnsByNameMeta(meta: EntityTableMeta): Map<string, ColumnMeta> {
 /**
  * Hand-built EntityTableMeta for direct-write stores (no entity base columns).
  * Prefer a `store_*` table name; `read_` is reserved for managed projections (#1220).
+ *
+ * Escape hatch, not a shortcut: no audit trail, no automatic tenant_id index,
+ * no softDelete — the app author owns tenant-scoping and retention for this
+ * table. Justify WHY in the call site; reviewers should scrutinize every new
+ * unmanaged table.
  */
 export function defineUnmanagedTable(input: UnmanagedTableInput): EntityTableMeta {
   assertUnmanagedTableName(input.tableName, "defineUnmanagedTable");

package/src/db/event-store-executor-write.ts

@@ -69,7 +69,12 @@ async function runPreSave(
 ): Promise<{ readonly data: DbRow } | { readonly failure: ReturnType<typeof writeFailure> }> {
   if (!preSave) return { data: changes as DbRow };
   try {
-    return { data: (await preSave(changes, previous, isNew)) as DbRow };
+    const hookResult = await preSave(changes, previous, isNew);
+    // A hook that echoes `id`/`version` back (e.g. `{ ...changes, id: x }`)
+    // must not leak them into the persisted row — aggregateId already comes
+    // from generateId()/the loaded row, not from hook output (fw#1685).
+    const { id: _hookId, version: _hookVersion, ...safe } = hookResult as Record<string, unknown>;
+    return { data: safe as DbRow };
   } catch (e) {
     return {
       failure: writeFailure(
@@ -133,7 +138,20 @@ export function createWriteVerbs(
       // Field-level write-ownership on create — mirror of entity-level but
       // per declared field. Role-level was already checked by the
       // dispatcher; here we enforce ownership-rules against the new row.
-      const fieldDeniedCreate = checkWriteFieldOwnership(entity, data, user);
+      //
+      // Which fields get checked is scoped to the pre-hook payload (fw#1685)
+      // — a hook-derived field the user never submitted must not be
+      // field-ownership-checked against the user. The rule for a checked
+      // field is still evaluated against the full post-hook row (`data`) —
+      // an ownership rule can reference a column only a hook populates
+      // (kumiko-framework#1672).
+      const fieldDeniedCreate = checkWriteFieldOwnership(
+        entity,
+        applyDefaults(payloadWithoutId),
+        user,
+        undefined,
+        data,
+      );
       if (fieldDeniedCreate) {
         return writeFailure(
           new UnprocessableError("ownership_denied", {
@@ -301,7 +319,24 @@ export function createWriteVerbs(
       // `previous`, we can run the ownership rules per field against both
       // sides and reject individual fields the user isn't entitled to
       // touch on this specific row.
-      const fieldDeniedUpdate = checkWriteFieldOwnership(entity, changes, user, previous);
+      //
+      // Which fields get checked is scoped to `payload.changes` (the user's
+      // actual submission), NOT `changes` (post-preSave-hook data, fw#1685)
+      // — a hook-derived field the user never submitted (e.g. a system hook
+      // setting `assignedTo`) has no business being field-ownership-checked
+      // against the *user*, and doing so rejects writes the user is fully
+      // entitled to make. The dispatcher's role-gate (checkWriteFieldAccess)
+      // already runs on this same pre-hook payload for consistency. The rule
+      // for a checked field is still evaluated against the full post-hook
+      // row (`changes` merged onto `previous`) — an ownership rule can
+      // reference a column only a hook populates (kumiko-framework#1672).
+      const fieldDeniedUpdate = checkWriteFieldOwnership(
+        entity,
+        payload.changes,
+        user,
+        previous,
+        changes,
+      );
       if (fieldDeniedUpdate) {
         return writeFailure(
           new UnprocessableError("ownership_denied", {

package/src/db/migrate-runner.ts

@@ -160,6 +160,11 @@ export function splitSqlStatements(sqlText: string): readonly string[] {
       current += ch;
       continue;
     }
+    if (ch === "$" && /^\$([A-Za-z_]\w*)?\$/.test(sqlText.slice(i))) {
+      throw new Error(
+        "splitSqlStatements: unsupported dollar-quoted body — migration SQL is malformed, refusing to split",
+      );
+    }
     if (ch === ";") {
       statements.push(current);
       current = "";

package/src/engine/__tests__/boot-validator-pii-retention.test.ts

@@ -626,6 +626,25 @@ describe("validateBoot — retention", () => {
     expect(matchingWarn).toBeUndefined();
   });
 
+  test("blockDelete with only a subjectRef-only field and no anonymize warns (#1645)", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "lease",
+        createEntity({
+          fields: {
+            authorId: createTextField({ subjectRef: true }),
+          },
+          retention: { keepFor: "10y", strategy: "blockDelete" },
+        }),
+      );
+    });
+    validateBoot([feature]);
+    const matchingWarn = warnSpy.mock.calls.find((args: unknown[]) =>
+      String(args[0]).includes('strategy="blockDelete" but no field has an anonymize-function'),
+    );
+    expect(matchingWarn).toBeDefined();
+  });
+
   test('retention.keepFor with invalid format "30days" warns', () => {
     const feature = defineFeature("test", (r) => {
       r.entity(

package/src/engine/__tests__/boot-validator.test.ts

@@ -600,7 +600,7 @@ describe("boot-validator", () => {
           });
         }),
       ];
-      validateBoot(features);
+      validateBootRaw(withBootValidatorFixture(features), { warnOnUniqueAccessRoles: true });
       // Not toHaveBeenCalledTimes(1): this file's tests share the process-global
       // console.warn and run with the default concurrency (bunfig.toml) — other
       // concurrently-running tests' own "role used by one handler" warnings can
@@ -615,6 +615,27 @@ describe("boot-validator", () => {
     }
   });
 
+  test("does NOT warn on unique access roles by default — opt-in only (#1711)", () => {
+    const warnSpy = spyOn(console, "warn");
+    try {
+      const features = [
+        defineFeature("b", (r) => {
+          r.queryHandler("list", z.object({}), async () => [], {
+            access: { roles: ["OnlyThereRole"] },
+          });
+        }),
+      ];
+      validateBoot(features);
+      expect(
+        warnSpy.mock.calls.some((call) =>
+          (call[0] as string | undefined)?.includes("OnlyThereRole"),
+        ),
+      ).toBe(false);
+    } finally {
+      warnSpy.mockRestore();
+    }
+  });
+
   test("throws when a stream handler has no access rule", () => {
     const features = [
       defineFeature("a", (r) => {
@@ -2886,6 +2907,35 @@ describe("boot-validator — config key backing × scope", () => {
     );
   });
 
+  test("navigate with params targeting a cross-entity entityList screen → no throw (list screens read URL search params for filter-prefill, fw#1708)", () => {
+    const feature = defineFeature("housing", (r) => {
+      r.entity("unit", createEntity({ fields: { id: createTextField() } }));
+      r.entity("contract", createEntity({ fields: { unitId: createTextField() } }));
+      r.screen({
+        id: "unit-list",
+        type: "entityList",
+        entity: "unit",
+        columns: ["id"],
+        rowActions: [
+          {
+            kind: "navigate",
+            id: "view-contracts",
+            label: "actions.viewContracts",
+            screen: "contract-list",
+            params: { map: { "housing:contract-list.f.unitId": "id" } },
+          },
+        ],
+      });
+      r.screen({
+        id: "contract-list",
+        type: "entityList",
+        entity: "contract",
+        columns: ["unitId"],
+      });
+    });
+    expect(() => validateBoot([feature])).not.toThrow();
+  });
+
   test("navigate with params targeting a custom screen → no throw (author owns the component, may read searchParams itself)", () => {
     const feature = defineFeature("shop", (r) => {
       r.entity("product", createEntity({ fields: { name: createTextField() } }));

package/src/engine/__tests__/ownership.test.ts

@@ -195,6 +195,29 @@ describe("userCanReadFieldRow() — multi-role OR", () => {
     // row with mismatched teamId — TeamMember would fail, Admin passes
     expect(userCanReadFieldRow(user, accessMap, { teamId: "ops" })).toBe(true);
   });
+
+  // fw#1700: matchesRule() throws on a where-rule (SQL-layer only, can't
+  // evaluate in-memory). Field-level access is boot-validator-rejected for
+  // where-rules, but this function is also reachable from hand-rolled
+  // entity-level reads — a role backed by a where-rule must fail closed
+  // (deny, no throw) instead of crashing the caller with an uncaught 500.
+  test("role backed by a where-rule → fails closed (deny), does not throw", () => {
+    const whereMap: OwnershipMap = {
+      Support: { kind: "where", where: () => ({ sqlText: "1=1", params: [] }) },
+    };
+    const user = mkUser({ roles: ["Support"] });
+    expect(() => userCanReadFieldRow(user, whereMap, { teamId: "ops" })).not.toThrow();
+    expect(userCanReadFieldRow(user, whereMap, { teamId: "ops" })).toBe(false);
+  });
+
+  test("where-rule role does not block a later 'all' role in the same access map", () => {
+    const mixedMap: OwnershipMap = {
+      Support: { kind: "where", where: () => ({ sqlText: "1=1", params: [] }) },
+      Admin: "all",
+    };
+    const user = mkUser({ roles: ["Support", "Admin"] });
+    expect(userCanReadFieldRow(user, mixedMap, { teamId: "ops" })).toBe(true);
+  });
 });
 
 // --- userCanWriteFieldRow() — STRADDLE PREVENTION ---

package/src/engine/__tests__/schema-builder.test.ts

@@ -131,6 +131,18 @@ describe("buildInsertSchema", () => {
       valid: { age: 5 },
       invalid: { age: 11 },
     },
+    {
+      name: "integer field rejects a value outside Postgres int4 range (must 400, not crash the DB write)",
+      fields: { attempt: createNumberField({ integer: true }) },
+      valid: { attempt: 2147483647 },
+      invalid: { attempt: 2147483648 },
+    },
+    {
+      name: "integer field with explicit max narrower than int4 still enforces the explicit bound",
+      fields: { displayOrder: createNumberField({ integer: true, max: 100 }) },
+      valid: { displayOrder: 100 },
+      invalid: { displayOrder: 101 },
+    },
     {
       name: "date field",
       fields: { born: createDateField() },
@@ -438,6 +450,26 @@ describe("buildInsertSchema", () => {
     }
   });
 
+  // Review-fix (kumiko-framework#1712): an optional select WITHOUT a default
+  // normalizes an untouched <select> to null (see the "unset (null)" test
+  // above). A client that reuses that null against a since-defaulted field
+  // must fall back to the default too, not get rejected as an invalid enum
+  // value the way a bare `null` previously was.
+  test("optional select with default accepts null and falls back to the default", () => {
+    const entity = createEntity({
+      table: "Test",
+      fields: {
+        locale: createSelectField({ options: ["de", "en", "fr"] as const, default: "de" }),
+      },
+    });
+    const schema = buildInsertSchema(entity);
+    const result = schema.safeParse({ locale: null });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data["locale"]).toBe("de");
+    }
+  });
+
   test("optional select with default still validates a real value", () => {
     const entity = createEntity({
       table: "Test",
@@ -537,11 +569,13 @@ describe("buildUpdateSchema", () => {
     }
   });
 
-  // Update schemas strip defaults deliberately (buildUpdateSchema never
-  // applies them — omitting a field must leave it untouched). So "" maps
-  // to the same explicit clear-to-null as the no-default case; only the
-  // insert path falls back to the default (#1702).
-  test("optional select with default on update: empty string is a clear-to-null, not the default", () => {
+  // fw#1703: buildUpdateSchema never applies defaults for an OMITTED field —
+  // omitting a field must leave it untouched. But an explicit `""` from an
+  // untouched <select> is a submission, not an omission, and "a field with a
+  // default is never unset" (same invariant the insert path documents at
+  // #1702) — so "" must map to the field's default on update too, not clobber
+  // an existing value to null.
+  test("optional select with default on update: empty string falls back to the default", () => {
     const entity = createEntity({
       table: "Test",
       fields: {
@@ -553,7 +587,43 @@ describe("buildUpdateSchema", () => {
     const result = schema.safeParse({ locale: "" });
     expect(result.success).toBe(true);
     if (result.success) {
-      expect(result.data["locale"]).toBeNull();
+      expect(result.data["locale"]).toBe("de");
+    }
+  });
+
+  test("optional select with default on update: omitting the field leaves it untouched", () => {
+    const entity = createEntity({
+      table: "Test",
+      fields: {
+        locale: createSelectField({ options: ["de", "en"] as const, default: "de" }),
+      },
+    });
+
+    const schema = buildUpdateSchema(entity);
+    const result = schema.safeParse({});
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(Object.hasOwn(result.data, "locale")).toBe(false);
+    }
+  });
+
+  test("required select with default on update: empty string falls back to the default instead of a required-error", () => {
+    const entity = createEntity({
+      table: "Test",
+      fields: {
+        locale: createSelectField({
+          options: ["de", "en"] as const,
+          default: "de",
+          required: true,
+        }),
+      },
+    });
+
+    const schema = buildUpdateSchema(entity);
+    const result = schema.safeParse({ locale: "" });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data["locale"]).toBe("de");
     }
   });
 });

package/src/engine/boot-validator/access-roles.ts

@@ -1,32 +1,74 @@
+import { normalizeAccessEntry } from "../ownership";
 import type { FeatureDefinition } from "../types";
 
 const BUILTIN_ROLES = new Set(["all", "system"]);
 
+function addRole(roleHandlers: Map<string, Set<string>>, role: string, identifier: string): void {
+  let handlers = roleHandlers.get(role);
+  if (!handlers) {
+    handlers = new Set();
+    roleHandlers.set(role, handlers);
+  }
+  handlers.add(identifier);
+}
+
+function addHandlerRoles(roleHandlers: Map<string, Set<string>>, f: FeatureDefinition): void {
+  const handlerGroups = [
+    { type: "write", defs: f.writeHandlers },
+    { type: "query", defs: f.queryHandlers },
+    { type: "stream", defs: f.streamHandlers },
+  ] as const;
+
+  for (const { type, defs } of handlerGroups) {
+    for (const [handlerName, def] of Object.entries(defs)) {
+      if (!def.access || !("roles" in def.access)) continue;
+      const identifier = `${f.name}:${type}:${handlerName}`;
+      for (const role of def.access.roles) {
+        addRole(roleHandlers, role, identifier);
+      }
+    }
+  }
+}
+
+function addConfigKeyRoles(roleHandlers: Map<string, Set<string>>, f: FeatureDefinition): void {
+  for (const [key, keyDef] of Object.entries(f.configKeys ?? {})) {
+    const identifier = `${f.name}:config:${key}`;
+    for (const role of [...keyDef.access.read, ...keyDef.access.write]) {
+      addRole(roleHandlers, role, identifier);
+    }
+  }
+}
+
+function addEntityFieldRoles(roleHandlers: Map<string, Set<string>>, f: FeatureDefinition): void {
+  for (const [entityName, entity] of Object.entries(f.entities ?? {})) {
+    for (const [fieldName, field] of Object.entries(entity.fields)) {
+      const identifier = `${f.name}:entity:${entityName}.${fieldName}`;
+      const readRoles = Object.keys(normalizeAccessEntry(field.access?.read) ?? {});
+      const writeRoles = Object.keys(normalizeAccessEntry(field.access?.write) ?? {});
+      for (const role of [...readRoles, ...writeRoles]) {
+        addRole(roleHandlers, role, identifier);
+      }
+    }
+  }
+}
+
+// A single "exactly one handler" heuristic over-counts by construction:
+// legitimate fine-grained roles (a role scoped to one admin endpoint on
+// purpose) are the normal case, not a typo — and until every access
+// surface is scanned, a role can look unique here while it's really used
+// elsewhere (configKeys / entity+field access), a false positive in the
+// other direction. Both is why this stays opt-in (#1711) rather than a
+// default-on prod warning.
 export function warnOnUniqueAccessRoles(features: readonly FeatureDefinition[]): void {
-  // role → set of distinct handler identifiers using it
+  // role → set of distinct identifiers using it, across every access
+  // surface — write/query/stream handlers, config-key access, and
+  // entity/field-level access rules.
   const roleHandlers = new Map<string, Set<string>>();
 
   for (const f of features) {
-    const handlerGroups = [
-      { type: "write", defs: f.writeHandlers },
-      { type: "query", defs: f.queryHandlers },
-      { type: "stream", defs: f.streamHandlers },
-    ] as const;
-
-    for (const { type, defs } of handlerGroups) {
-      for (const [handlerName, def] of Object.entries(defs)) {
-        if (!def.access || !("roles" in def.access)) continue;
-        const identifier = `${f.name}:${type}:${handlerName}`;
-        for (const role of def.access.roles) {
-          let handlers = roleHandlers.get(role);
-          if (!handlers) {
-            handlers = new Set();
-            roleHandlers.set(role, handlers);
-          }
-          handlers.add(identifier);
-        }
-      }
-    }
+    addHandlerRoles(roleHandlers, f);
+    addConfigKeyRoles(roleHandlers, f);
+    addEntityFieldRoles(roleHandlers, f);
   }
 
   for (const [role, handlers] of roleHandlers) {

package/src/engine/boot-validator/entity-handler.ts

@@ -61,9 +61,12 @@ export const PII_USER_OWNED_NAME_HINTS: ReadonlySet<string> = new Set([
 export const PII_USER_REFERENCE_NAME_HINTS: ReadonlySet<string> = new Set([
   "authorid",
   "assigneeid",
+  "assigneeuserid",
   "ownerid",
+  "createdby",
   "createdbyid",
   "createdbyuserid",
+  "updatedby",
   "updatedbyid",
   "updatedbyuserid",
   "invitedby",
@@ -72,6 +75,7 @@ export const PII_USER_REFERENCE_NAME_HINTS: ReadonlySet<string> = new Set([
   "uploadedby",
   "assignedto",
   "reportedby",
+  "memberid",
 ]);
 
 // --- Extension preSave wiring validation ---

package/src/engine/boot-validator/index.ts

@@ -61,11 +61,24 @@ export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns";
 // dieselbe Extraktionslogik.
 export { collectWriteHandlerQns } from "./nav";
 
+export type ValidateBootOptions = {
+  /** Warn when an access role is used by exactly one handler/config-key/
+   *  field across the whole boot scan — often a typo, but also the normal
+   *  shape of a legitimate fine-grained role (one role scoped to one admin
+   *  endpoint on purpose). Opt-in (default false, #1711): a default-on
+   *  prod warning that nobody can silence per-role isn't worth the noise
+   *  it generates on every boot. */
+  readonly warnOnUniqueAccessRoles?: boolean;
+};
+
 /**
  * Validates all feature configurations at boot time.
  * Throws on the first error found — fail fast.
  */
-export function validateBoot(features: readonly FeatureDefinition[]): void {
+export function validateBoot(
+  features: readonly FeatureDefinition[],
+  options?: ValidateBootOptions,
+): void {
   const featureMap = new Map<string, FeatureDefinition>();
   for (const f of features) {
     featureMap.set(f.name, f);
@@ -213,5 +226,7 @@ export function validateBoot(features: readonly FeatureDefinition[]): void {
 
   validateConfigReads(features, allConfigKeys);
   warnOnToggleableDependencies(features, featureMap);
-  warnOnUniqueAccessRoles(features);
+  if (options?.warnOnUniqueAccessRoles === true) {
+    warnOnUniqueAccessRoles(features);
+  }
 }

package/src/engine/boot-validator/pii-retention.ts

@@ -21,6 +21,13 @@ const FRAMEWORK_TIMESTAMP_FIELDS: ReadonlySet<string> = new Set([
 // werden statt erst beim ersten Cleanup-Run.
 const KEEP_FOR_PATTERN = /^\d+[hdwmy]$/;
 
+// A field carries a subject binding — pii/userOwned/tenantOwned mark
+// annotated content, subjectRef marks a bare FK into `user` with no
+// annotated content of its own but the same Art.17 obligations (#1645).
+function hasSubjectAnnotation(annot: PiiAnnotations): boolean {
+  return Boolean(annot.pii || annot.userOwned || annot.tenantOwned || annot.subjectRef);
+}
+
 // --- PII / Subject-Key Annotations + Retention validation ---
 //
 // Drei Klassen von Checks:
@@ -133,11 +140,12 @@ export function validatePiiAndRetention(feature: FeatureDefinition): void {
         );
       }
 
-      // Sortierung liest die Projection-Spalte — die bleibt Ciphertext, also
-      // sortable + Subject-Annotation bleibt Boot-Fail. searchable ist seit
-      // #1610 erlaubt: der Search-Consumer decryptet in den abgeleiteten
-      // Index und forget purgt die Docs (siehe createSearchEventConsumer).
-      // sensitive + searchable bleibt verboten (nobody-may-read-back).
+      // Sorting reads the projection column — that stays ciphertext, so
+      // sortable + subject annotation stays a boot-fail. searchable has
+      // been allowed since #1610: the search consumer decrypts into the
+      // derived index and forget purges those docs (see
+      // createSearchEventConsumer). sensitive + searchable stays forbidden
+      // (nobody-may-read-back).
       {
         const flags = field as {
           readonly searchable?: boolean;
@@ -215,7 +223,7 @@ export function validatePiiAndRetention(feature: FeatureDefinition): void {
         } else if (PII_USER_REFERENCE_NAME_HINTS.has(lower) && !annot.subjectRef) {
           // biome-ignore lint/suspicious/noConsole: boot-time dev hint, no logger available yet
           console.warn(
-            `[kumiko:boot] [Feature ${feature.name}] Field "${fieldName}" on entity "${entityName}" has a user-reference-typical name but no { subjectRef: true } annotation — a foreign key into \`user\` carries Art.17 obligations even with no annotated content on the entity. Mark it { subjectRef: true }, or { userOwned: { ownerField: "${fieldName}" } } on the field it owns. If business data, set { allowPlaintext: "..." } to silence.`,
+            `[kumiko:boot] [Feature ${feature.name}] Field "${fieldName}" on entity "${entityName}" has a user-reference-typical name but no { subjectRef: true } annotation — a foreign key into \`user\` carries Art.17 obligations even with no annotated content on the entity. Mark it { subjectRef: true } AND register r.useExtension(EXT_USER_DATA, "${entityName}", …) — without the hook the V3 boot guard throws. Or { userOwned: { ownerField: "${fieldName}" } } on the field it owns. If business data, set { allowPlaintext: "..." } to silence.`,
           );
         }
       }
@@ -245,10 +253,9 @@ export function validatePiiAndRetention(feature: FeatureDefinition): void {
       if (retention.strategy === "blockDelete") {
         // blockDelete on an entity with no subject field is the correct
         // "never auto-delete" choice; User-Forget never reaches those rows (#1622).
-        const hasSubjectField = Object.values(fieldsByName).some((f) => {
-          const a = f as PiiAnnotations; // @cast-boundary schema-walk
-          return Boolean(a.pii || a.userOwned || a.tenantOwned);
-        });
+        const hasSubjectField = Object.values(fieldsByName).some(
+          (f) => hasSubjectAnnotation(f as PiiAnnotations), // @cast-boundary schema-walk
+        );
         const hasAnonymize = Object.values(fieldsByName).some((f) => {
           const a = f as PiiAnnotations; // @cast-boundary schema-walk
           return Boolean(a.anonymize);

package/src/engine/boot-validator/screens.ts

@@ -36,8 +36,16 @@ function validateRowActionNavigateParams(
 ): void {
   // skip: not a navigate-with-params action — nothing to validate here.
   if (action.kind !== "navigate" || action.params === undefined) return;
-  // skip: unresolvable/custom target already reported (or exempt) elsewhere.
-  if (target === undefined || target.screen.type === "custom") return;
+  // entityList/projectionList targets also read URL search params (Tier
+  // 2.7c filter-prefill, see use-list-url-state.ts: `<screenId>.q/.sort/
+  // .dir/.page/.f.<field>`), not just actionForm/entityEdit-create.
+  const exemptTargetType =
+    target === undefined ||
+    target.screen.type === "custom" ||
+    target.screen.type === "entityList" ||
+    target.screen.type === "projectionList";
+  // skip: unresolvable/custom/list target already reported (or exempt) elsewhere.
+  if (exemptTargetType) return;
 
   const isEntityEditUpdate =
     target.screen.type === "entityEdit" &&

package/src/engine/boot-validator.ts

@@ -1,5 +1,6 @@
 export {
   collectWriteHandlerQns,
+  type ValidateBootOptions,
   validateAppCustomScreenWriteQns,
   validateBoot,
 } from "./boot-validator/index";

package/src/engine/create-app.ts

@@ -1,4 +1,4 @@
-import { validateBoot } from "./boot-validator";
+import { type ValidateBootOptions, validateBoot } from "./boot-validator";
 import { createRegistry } from "./registry";
 import type { FeatureDefinition, Registry } from "./types";
 import { DEFAULT_CURRENCIES } from "./types";
@@ -8,6 +8,8 @@ export type AppConfig = {
   features: readonly FeatureDefinition[];
   softDelete?: boolean; // Global default for all entities (default: true)
   currencies?: readonly string[]; // Extends DEFAULT_CURRENCIES
+  /** Opt-in boot-validator warnings — see ValidateBootOptions. */
+  validateBootOptions?: ValidateBootOptions;
 };
 
 export type App = {
@@ -98,7 +100,7 @@ export function createApp(config: AppConfig): App {
   }
 
   // Run boot-time validation before creating registry
-  validateBoot(config.features);
+  validateBoot(config.features, config.validateBootOptions);
 
   return {
     registry: createRegistry(config.features),

package/src/engine/field-access.ts

@@ -98,15 +98,29 @@ export function checkWriteFieldRoles(
 // row. For creates, pass oldRow = undefined; the check degenerates to a
 // newRow-only evaluation.
 //
+// `submittedChanges` and `rowContext` are deliberately separate (fw#1685):
+// - `submittedChanges` drives WHICH fields get checked — only what the user
+//   actually wrote in the request. A preSave-hook-derived field the user
+//   never touched (e.g. a system hook setting `assignedTo`) must not be
+//   field-ownership-checked against the user at all.
+// - `rowContext` drives what a checked field's rule is evaluated AGAINST —
+//   this needs the full post-hook row, because an ownership rule can
+//   reference a DIFFERENT column that only a hook populates (kumiko-
+//   framework#1672: a hook derives `authorId`, a user-submitted `secretNote`
+//   field's rule is `from("user:id", "authorId")` — the check needs the
+//   hook-derived `authorId` in scope even though the user only wrote
+//   `secretNote`). Defaults to `submittedChanges` when omitted.
+//
 // Returns the denied field name for the caller to wrap into an
 // `ownership_denied` error with scope: "field", or null if all fields pass.
 export function checkWriteFieldOwnership(
   entity: EntityDefinition,
-  changes: Readonly<Record<string, unknown>>,
+  submittedChanges: Readonly<Record<string, unknown>>,
   user: SessionUser,
   oldRow?: Readonly<Record<string, unknown>>,
+  rowContext: Readonly<Record<string, unknown>> = submittedChanges,
 ): string | null {
-  for (const key of Object.keys(changes)) {
+  for (const key of Object.keys(submittedChanges)) {
     const field = entity.fields[key];
     if (!field) continue;
 
@@ -120,7 +134,7 @@ export function checkWriteFieldOwnership(
     const hasOwnershipRule = Object.values(accessMap).some((r) => r !== "all");
     if (!hasOwnershipRule) continue;
 
-    const newRow: Record<string, unknown> = { ...(oldRow ?? {}), ...changes };
+    const newRow: Record<string, unknown> = { ...(oldRow ?? {}), ...rowContext };
     const effectiveOld = oldRow ?? newRow; // create: compare against newRow
 
     if (!userCanWriteFieldRow(user, accessMap, effectiveOld, newRow)) {

package/src/engine/index.ts

@@ -205,6 +205,8 @@ export type { OwnershipClause, OwnershipMap, OwnershipRef, OwnershipRule } from
 export {
   buildOwnershipClause,
   from,
+  normalizeAccessEntry,
+  userCanCreateFieldRow,
   userCanReadFieldRow,
   userCanWriteFieldRow,
 } from "./ownership";