@cosmicdrift/kumiko-framework 0.173.1 → 0.174.1

package/src/engine/ownership.ts

@@ -158,6 +158,12 @@ export function userCanReadFieldRow(
   for (const role of user.roles) {
     const rule = accessMap[role];
     if (!rule) continue;
+    // where-rules are entity-level SQL predicates (buildOwnershipClause);
+    // matchesRule can't evaluate them in-memory and throws. Field-level
+    // access is boot-validator-rejected for where-rules, but this function
+    // is also reachable from hand-rolled entity-level reads.
+    // skip: where-rules are SQL-layer only — fail closed instead of throwing.
+    if (rule !== "all" && rule.kind === "where") continue;
     if (matchesRule(rule, user, row)) return true;
   }
   return false;
@@ -180,6 +186,8 @@ export function userCanWriteFieldRow(
     const rule = accessMap[role];
     if (!rule) continue;
     if (rule === "all") return true;
+    // skip: where-rules are SQL-layer only — fail closed instead of throwing.
+    if (rule.kind === "where") continue;
     if (matchesRule(rule, user, oldRow) && matchesRule(rule, user, newRow)) return true;
   }
   return false;
@@ -272,6 +280,17 @@ export function shiftParams(fragment: SqlFragment, shift: number): SqlFragment {
 // SQL names via the kumiko:schema:Columns symbol. Unknown column on a from-rule
 // is a boot-time misconfiguration; at request time we treat it as empty
 // (safe default) rather than passing silently.
+//
+// Caller obligations (fw#1700) — this function returns ONLY the ownership
+// fragment, not the full row-access contract. A raw-SQL caller (not going
+// through `ctx.db`, which already applies all three) must additionally:
+//   1. Pass `paramStart` as `params.length + 1` for its own already-bound
+//      params, or `$N` placeholders in the returned fragment silently splice
+//      into the wrong query params.
+//   2. Apply tenant + soft-delete scoping itself (event-store-executor-read.ts
+//      does this outside `buildOwnershipClause`) — this function does not.
+//   3. Treat `kind: "empty"` (see `OwnershipClause`) as a hard DENY, and
+//      `kind: "pass"` as an explicit bypass — not as "no additional filter".
 export function buildOwnershipClause(
   user: SessionUser,
   accessMap: OwnershipMap | undefined,

package/src/engine/schema-builder.ts

@@ -55,7 +55,17 @@ function embeddedSubFieldToZod(subField: EmbeddedSubFieldDef): z.ZodTypeAny {
   }
 }
 
-export function fieldToZod(field: FieldDefinition, currencies: readonly string[]): z.ZodTypeAny {
+export function fieldToZod(
+  field: FieldDefinition,
+  currencies: readonly string[],
+  opts: { readonly applyDefaults?: boolean } = {},
+): z.ZodTypeAny {
+  // Insert callers want `.default(...)` applied so an omitted field falls
+  // back to it; buildUpdateSchema passes applyDefaults: false so an omitted
+  // field on update stays omitted (a `{ title }` patch must not clobber
+  // other columns with their defaults) while a field's own default value is
+  // still known here for "" → default mapping (select case below).
+  const applyDefaults = opts.applyDefaults ?? true;
   switch (field.type) {
     case "text": {
       let schema = z.string();
@@ -63,7 +73,7 @@ export function fieldToZod(field: FieldDefinition, currencies: readonly string[]
       if (field.format === "email") schema = schema.email();
       if (field.format === "url") schema = schema.url();
       if (field.required) schema = schema.min(1);
-      return field.default !== undefined ? schema.default(field.default) : schema;
+      return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
     }
     case "longText": {
       // longText hat keine `format`-Variante (per type-design). Nur
@@ -71,24 +81,32 @@ export function fieldToZod(field: FieldDefinition, currencies: readonly string[]
       let schema = z.string();
       if (field.maxLength) schema = schema.max(field.maxLength);
       if (field.required) schema = schema.min(1);
-      return field.default !== undefined ? schema.default(field.default) : schema;
+      return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
     }
     case "boolean": {
       const schema = z.boolean();
-      return field.default !== undefined ? schema.default(field.default) : schema;
+      return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
     }
     case "select": {
       const [first, ...rest] = field.options;
       if (!first) return z.string();
       const enumSchema = z.enum([first, ...rest]);
-      if (field.default !== undefined)
+      if (field.default !== undefined) {
         // Untouched <select> sends "" too; with a default that maps to the
         // default (same semantics as undefined) instead of the invalid-value
-        // rejection from #1702. A field with a default is never "unset".
-        return z.preprocess(
-          (value) => (value === "" ? field.default : value),
-          enumSchema.default(field.default),
+        // rejection from #1702. A field with a default is never "unset" —
+        // true on both insert AND update, so this branch (and its "" → default
+        // mapping) fires regardless of applyDefaults; only the `.default(...)`
+        // schema-level fallback for OMITTED input is update-gated below.
+        // `null` maps the same way: the no-default branch below normalizes
+        // an untouched select to null, and a client that reuses that value
+        // against a since-defaulted field must not get rejected either.
+        const mapped = z.preprocess(
+          (value) => (value === "" || value === null ? field.default : value),
+          enumSchema,
         );
+        return applyDefaults ? mapped.default(field.default) : mapped;
+      }
       if (field.required) return enumSchema;
       // Optional select without a default: an untouched HTML <select> submits
       // "" for its placeholder option. Treat that as "unset" (null) instead of
@@ -105,14 +123,19 @@ export function fieldToZod(field: FieldDefinition, currencies: readonly string[]
       // in buildInsertSchema kümmert sich um „darf fehlen".
       let schema = z.array(z.enum([first, ...rest]));
       if (field.required) schema = schema.min(1);
-      return field.default !== undefined ? schema.default([...field.default]) : schema;
+      return field.default !== undefined && applyDefaults
+        ? schema.default([...field.default])
+        : schema;
     }
     case "number": {
       let schema = z.number();
-      if (field.integer) schema = schema.int();
+      // `integer: true` maps to a Postgres int4 column (entity-table-meta.ts)
+      // — bound it here so an out-of-range write fails loud (400) at the
+      // schema boundary instead of dying in Postgres (22003 → 500).
+      if (field.integer) schema = schema.int().min(-2147483648).max(2147483647);
       if (field.min !== undefined) schema = schema.min(field.min);
       if (field.max !== undefined) schema = schema.max(field.max);
-      return field.default !== undefined ? schema.default(field.default) : schema;
+      return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
     }
     case "decimal": {
       // Stored as numeric(precision, scale), surfaced as JS number. Bound the
@@ -126,7 +149,7 @@ export function fieldToZod(field: FieldDefinition, currencies: readonly string[]
         .refine((n) => isRepresentableAtScale(n, field.scale), {
           message: `at most ${field.scale} decimal places`,
         });
-      return field.default !== undefined ? schema.default(field.default) : schema;
+      return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
     }
     case "bigInt": {
       // JS-`number`-Round-trip via mode:"number"; sicher bis 2^53.
@@ -134,7 +157,7 @@ export function fieldToZod(field: FieldDefinition, currencies: readonly string[]
       // Float reinwirft (z.B. parseFloat-Bug), beim Insert sofort
       // failed statt silent-Truncation zu kassieren.
       const schema = z.number().int().safe();
-      return field.default !== undefined ? schema.default(field.default) : schema;
+      return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
     }
     case "money": {
       const [first, ...rest] = currencies;
@@ -242,14 +265,15 @@ export function buildUpdateSchema(
   const shape: Record<string, z.ZodTypeAny> = {};
 
   for (const [name, field] of Object.entries(entity.fields)) {
-    // Update schemas never apply defaults — a user that sends only
-    // `{ title }` means "only change title"; zod defaults would silently
-    // inject default values for every omitted field and clobber existing
-    // data via the event-store-executor's `changes` payload.
-    // Cast widens the discriminated union so destructure works for variants
-    // without a `default` field; remainder is structurally a FieldDefinition.
-    const { default: _default, ...stripped } = field as FieldDefinition & { default?: unknown }; // @cast-boundary schema-walk
-    shape[name] = fieldToZod(stripped as FieldDefinition, currencies).optional(); // @cast-boundary schema-walk
+    // Update schemas never apply defaults for OMITTED fields — a user that
+    // sends only `{ title }` means "only change title"; zod defaults would
+    // silently inject default values for every omitted field and clobber
+    // existing data via the event-store-executor's `changes` payload.
+    // The field is passed through un-stripped (unlike before fw#1703) so
+    // fieldToZod still knows the default for its "" → default mapping
+    // (e.g. select) — applyDefaults: false only suppresses the schema-level
+    // `.default(...)` fallback for a genuinely omitted key.
+    shape[name] = fieldToZod(field, currencies, { applyDefaults: false }).optional();
   }
 
   return z.object(shape);

package/src/entrypoint/index.ts

@@ -142,11 +142,8 @@ export type WorkerEntrypoint = {
   readonly eventDispatcher: EventDispatcher;
   readonly jobRunner: JobRunner;
   readonly observability: ObservabilityProvider;
-  // Same dispatcher the API process exposes — a worker builds the identical
-  // server, only without routes. App-wired components that run in the worker
-  // and must persist their result need it: JobContext has no write/query
-  // (handlers.ts JobContext), so writing goes through dispatchSystemWrite,
-  // the pattern inbound-mail-foundation/watch-supervisor.ts established.
+  // Same dispatcher the API process exposes. Background components in the
+  // worker persist through the write-path — JobContext has no write/query.
   readonly dispatcher: Dispatcher;
   readonly mode: "worker";
   // Starts event-dispatcher poll + BullMQ worker. SIGTERM triggers

package/src/jobs/__tests__/scheduler-id.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { schedulerIdForJobName } from "../job-runner";
+import { bootJobIdForJobName, schedulerIdForJobName } from "../job-runner";
 
 describe("schedulerIdForJobName", () => {
   test("strips dots and colons so BullMQ job ids stay under the 5-segment legacy heuristic", () => {
@@ -16,3 +16,15 @@ describe("schedulerIdForJobName", () => {
     expect(schedulerIdForJobName("app.job.tick")).toBe("scheduler-app-job-tick");
   });
 });
+
+describe("bootJobIdForJobName", () => {
+  test("strips colons, same hazard as schedulerIdForJobName (fw#1604)", () => {
+    const id = bootJobIdForJobName("publicstatus:job:uptime-probe");
+    expect(id).toBe("boot-publicstatus-job-uptime-probe");
+    expect(id.includes(":")).toBe(false);
+  });
+
+  test("still collapses dotted QNs", () => {
+    expect(bootJobIdForJobName("app.job.tick")).toBe("boot-app-job-tick");
+  });
+});

package/src/jobs/job-runner.ts

@@ -45,6 +45,12 @@ export function schedulerIdForJobName(jobName: string): string {
   return `scheduler-${jobName.replace(/[.:]/g, "-")}`;
 }
 
+// Same colon-in-BullMQ-id hazard as schedulerIdForJobName (fw#1603/#1604) —
+// a QN like "publicstatus:job:uptime-probe" must not leave ":" in the id.
+export function bootJobIdForJobName(jobName: string): string {
+  return `boot-${jobName.replace(/[.:]/g, "-")}`;
+}
+
 // ponytail: migration shim, remove after fw#1603 deploy is everywhere.
 function legacySchedulerIdForJobName(jobName: string): string {
   return `scheduler-${jobName.replace(/\./g, "-")}`;
@@ -518,7 +524,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
         if (laneForJob(jobDef) !== consumerLane) continue;
         if (jobDef.runOnBoot) {
           const bootName = jobDef.perTenant ? `_perTenant:${name}` : name;
-          await consumerQueue.add(bootName, {}, { jobId: `boot-${name.replace(/\./g, "-")}` });
+          await consumerQueue.add(bootName, {}, { jobId: bootJobIdForJobName(name) });
         }
       }
 

package/src/pipeline/dispatch-shared.ts

@@ -60,7 +60,7 @@ import {
   observabilityContext,
 } from "../observability";
 import { buildBucketKey } from "../rate-limit";
-import { createTzContext } from "../time";
+import { createTzContext, isValidIanaTimeZone } from "../time";
 import { appendDomainEventCore } from "./append-event-core";
 import { resolveAuthClaims as runAuthClaimsResolver } from "./auth-claims-resolver";
 import { executeQuery } from "./dispatch-query";
@@ -523,10 +523,18 @@ export async function buildHandlerContext(
   // tenant (createTzContext's own default). An app-injected GeoTzProvider
   // (context.geoTzProvider) feeds ctx.tz.fromCoordinates / fromAddress.
   const tenantTz = config !== undefined ? await config("tenant:config:timezone") : undefined;
+  // Guarded against garbage: an unvalidated string here (free-form config
+  // key, legacy JWT claim predating validation) blows up every ctx.tz call
+  // for the whole tenant with a RangeError. Fall back to UTC/tenant instead
+  // of trusting the raw value.
+  const safeTenantTz =
+    typeof tenantTz === "string" && isValidIanaTimeZone(tenantTz) ? tenantTz : "UTC";
+  const safeUserTz =
+    user.timezone !== undefined && isValidIanaTimeZone(user.timezone) ? user.timezone : undefined;
   const tz = createTzContext({
     ...(context.geoTzProvider !== undefined ? { geoTz: context.geoTzProvider } : {}),
-    tenant: typeof tenantTz === "string" ? tenantTz : "UTC",
-    ...(user.timezone !== undefined && { user: user.timezone }),
+    tenant: safeTenantTz,
+    ...(safeUserTz !== undefined && { user: safeUserTz }),
   });
 
   return {

package/src/pipeline/dispatch-stream.ts

@@ -59,12 +59,9 @@ async function* executeStreamInner(
   const invalidated = new Promise<void>((resolve) => {
     resolveInvalidated = resolve;
   });
-  const unsubscribeAccessInvalidation = ctx.sseBroker?.subscribeAccessInvalidation?.(
-    user.id,
-    () => {
-      resolveInvalidated?.();
-    },
-  );
+  const unsubscribeAccessInvalidation = ctx.sseBroker?.subscribeAccessInvalidation(user.id, () => {
+    resolveInvalidated?.();
+  });
 
   let iterator: AsyncIterator<unknown> | undefined;
   // When access is revoked mid-pull, `iterator.next()` is still in flight.

package/src/pipeline/system-hooks.ts

@@ -94,7 +94,7 @@ export function createSearchEventConsumer(
 // #1610 — subject-annotated searchable fields are ciphertext in the event
 // payload; decrypt into the derived index only. No KMS → omit ciphertext
 // values rather than indexing blobs.
-async function decryptSearchableSubjectFields(
+export async function decryptSearchableSubjectFields(
   entityName: string,
   state: Record<string, unknown>,
   registry: Registry,
@@ -111,12 +111,25 @@ async function decryptSearchableSubjectFields(
     }
     return out;
   }
-  return decryptPiiFieldValues(state, fields, kms, {
-    requestId: "system:consumer:search",
-  });
+  try {
+    return await decryptPiiFieldValues(state, fields, kms, {
+      requestId: "system:consumer:search",
+    });
+  } catch (err) {
+    console.warn(
+      `[kumiko:search] decryptSearchableSubjectFields failed for "${entityName}" — ` +
+        `dropping ciphertext fields for this document instead of wedging the consumer.`,
+      err,
+    );
+    const out = { ...state };
+    for (const name of fields) {
+      if (isPiiCiphertext(out[name])) delete out[name];
+    }
+    return out;
+  }
 }
 
-function hasErasedSearchableSubjectField(
+export function hasErasedSearchableSubjectField(
   entityName: string,
   state: Record<string, unknown>,
   registry: Registry,
@@ -416,7 +429,7 @@ export function createAccessInvalidationEventConsumer(sseBroker: SseBroker): Eve
         // poison would otherwise permanently stop access-invalidation for
         // every user behind one bad row).
         if (typeof userId !== "string" || userId.length === 0) return;
-        sseBroker.publishAccessInvalidation?.(userId);
+        sseBroker.publishAccessInvalidation(userId);
       }
 
       if (
@@ -427,7 +440,7 @@ export function createAccessInvalidationEventConsumer(sseBroker: SseBroker): Eve
         // skip: previous snapshot missing/malformed userId — same fail-open
         // reasoning as above.
         if (userId === undefined) return;
-        sseBroker.publishAccessInvalidation?.(userId);
+        sseBroker.publishAccessInvalidation(userId);
       }
     },
   };

package/src/schema-cli.ts

@@ -289,11 +289,13 @@ export async function runSchemaCli(
             }
             if (mismatches.some((m) => m.kind === "unexpected-table")) {
               out.err(
-                "    Fix (unexpected-table): register the raw/hand-written table via `table()` " +
-                  "(or `defineUnmanagedTable()`) from `@cosmicdrift/kumiko-framework/db`, then " +
-                  "`r.storeTable(meta, { reason: ... })` inside a feature — this adds it to " +
-                  "ENTITY_METAS and the snapshot without going through r.entity(). See the " +
-                  "bundled `jobs` feature's job-run-log store table for the pattern.",
+                "    Fix (unexpected-table): build a meta via `defineUnmanagedTable()` " +
+                  "from `@cosmicdrift/kumiko-framework/db`, then `r.storeTable(meta, { reason: ... })` " +
+                  "inside a feature — this adds it to ENTITY_METAS immediately; the .snapshot.json " +
+                  "only picks it up on the NEXT `kumiko-schema generate` run, which you still need " +
+                  "to run and commit. `table()` returns a query handle, not a storeTable()-compatible " +
+                  "meta — don't pass its result to storeTable(). See the bundled `jobs` feature's " +
+                  "job-run-log store table for the pattern.",
               );
             }
             if (mismatches.some((m) => m.kind !== "unexpected-table")) {

package/src/search/__tests__/reindex-entity.integration.test.ts

@@ -5,6 +5,11 @@
 // nothing.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import {
   asRawClient,
   buildEntityTable,
@@ -20,6 +25,7 @@ import {
   TestUsers,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
 
 const widgetEntity = createEntity({
   table: "read_reindex_widgets",
@@ -35,16 +41,38 @@ const widgetFeature = defineFeature("reindex-test", (r) => {
   r.entity("widget", widgetEntity);
 });
 
+// fw#1611: pii + searchable — the read-table column holds ciphertext, a
+// naive backfill would index blobs (or resurrect a crypto-shredded row).
+const contactEntity = createEntity({
+  table: "read_reindex_contacts",
+  fields: {
+    label: createTextField({ required: true, maxLength: 100, pii: true, searchable: true }),
+  },
+});
+const contactTable = buildEntityTable("contact", contactEntity);
+const contactFeature = defineFeature("reindex-pii-test", (r) => {
+  r.entity("contact", contactEntity);
+});
+
 let stack: TestStack;
+let kms: InMemoryKmsAdapter;
 const admin = TestUsers.admin;
 
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [widgetFeature] });
+  stack = await setupTestStack({ features: [widgetFeature, contactFeature] });
   await unsafeCreateEntityTable(stack.db, widgetEntity);
+  await unsafeCreateEntityTable(stack.db, contactEntity, "contact");
   await createEventsTable(stack.db);
+  // Shared across both pii tests below (not per-test) — reindexEntity scans
+  // the whole tenant table regardless of which test created which row, so a
+  // fresh KMS instance per test would make earlier rows' subject keys
+  // unresolvable (KeyNotFoundError) instead of exercising the erased path.
+  kms = new InMemoryKmsAdapter();
+  configurePiiSubjectKms(kms);
 });
 
 afterAll(async () => {
+  resetPiiSubjectKmsForTests();
   await stack.cleanup();
 });
 
@@ -141,4 +169,72 @@ describe("reindexEntity", () => {
       );
     }
   });
+
+  // fw#1611: reindexEntity read the read-table row (ciphertext for pii+
+  // searchable fields) straight into the search document, skipping the
+  // decrypt step createSearchEventConsumer applies on the live path.
+  test("decrypts pii+searchable fields before indexing — backfill is findable by plaintext, not ciphertext", async () => {
+    const plain = "UniqueReindexPiiLabel1611";
+    const executor = createEventStoreExecutor(contactTable, contactEntity, {
+      entityName: "contact",
+    });
+    const created = await executor.create(
+      { label: plain },
+      admin,
+      createTenantDb(stack.db, admin.tenantId, "system"),
+    );
+    if (!created.isSuccess) throw new Error("seed failed");
+
+    // No dispatcher run — row exists only on the read-table, ciphertext.
+    const row = (
+      await asRawClient(stack.db).unsafe(
+        `SELECT label FROM "read_reindex_contacts" WHERE id = $1`,
+        [created.data.id],
+      )
+    )[0] as { label: string };
+    expect(isPiiCiphertext(row.label)).toBe(true);
+
+    const result = await reindexEntity(
+      stack.db,
+      stack.registry,
+      stack.search,
+      "contact",
+      admin.tenantId,
+    );
+    expect(result.indexedRows).toBe(1);
+    expect(result.failures).toHaveLength(0);
+
+    const hits = await stack.search.search(admin.tenantId, plain, { filterType: "contact" });
+    expect(hits.some((h) => String(h.entityId) === String(created.data.id))).toBe(true);
+  });
+
+  test("skips a row whose subject key was already erased — reindex must not resurrect a crypto-shredded row", async () => {
+    const plain = "ErasedReindexPiiLabel1611";
+    const executor = createEventStoreExecutor(contactTable, contactEntity, {
+      entityName: "contact",
+    });
+    const created = await executor.create(
+      { label: plain },
+      admin,
+      createTenantDb(stack.db, admin.tenantId, "system"),
+    );
+    if (!created.isSuccess) throw new Error("seed failed");
+
+    // pii: true → subject key is the entity id itself.
+    await kms.eraseKey({ kind: "user", userId: String(created.data.id) });
+
+    const result = await reindexEntity(
+      stack.db,
+      stack.registry,
+      stack.search,
+      "contact",
+      admin.tenantId,
+    );
+    // Shares the tenant/table with the preceding test, so other rows may
+    // also index here — what matters is that THIS erased row didn't.
+    expect(result.failures).toHaveLength(0);
+
+    const hits = await stack.search.search(admin.tenantId, plain, { filterType: "contact" });
+    expect(hits.some((h) => String(h.entityId) === String(created.data.id))).toBe(false);
+  });
 });

package/src/search/purge-subject.ts

@@ -8,6 +8,7 @@
 //   2. Ciphertext LIKE prefix (same as nullBlindIndexesForSubject) for rows
 //      that still carry the subject key in encrypted columns.
 
+import { quoteIdent, subjectCiphertextLikePattern } from "../crypto/ciphertext-pattern";
 import type { SubjectId } from "../crypto/kms-adapter";
 import { collectSearchableSubjectFields } from "../crypto/subject-resolver";
 import type { DbRunner } from "../db/connection";
@@ -19,14 +20,6 @@ import type { EntityId, TenantId } from "../engine/types/identifiers";
 import { toSnakeCase } from "../utils/case";
 import type { SearchAdapter } from "./types";
 
-function quoteIdent(name: string): string {
-  return `"${name.replace(/"/g, '""')}"`;
-}
-
-function escapeLikePattern(value: string): string {
-  return value.replace(/[\\%_]/g, (m) => `\\${m}`);
-}
-
 /** Build OR predicates for rows owned by `subject` (id / ownerField / tenant_id). */
 function ownershipPredicates(
   entity: EntityDefinition,
@@ -76,7 +69,7 @@ export async function purgeSearchDocumentsForSubject(
   /** When set, also match rows by ownership — needed after anonymize rewrites ciphertext. */
   subject?: SubjectId,
 ): Promise<void> {
-  const likePattern = `kumiko-pii:v%:${escapeLikePattern(subjectKey)}:%`;
+  const likePattern = subjectCiphertextLikePattern(subjectKey);
   const byTenant = new Map<string, { entityType: string; entityId: EntityId }[]>();
   const seen = new Set<string>();
 

package/src/search/reindex-entity.ts

@@ -9,7 +9,11 @@ import type { DbRunner } from "../db/connection";
 import { resolveTableName } from "../db/entity-table-meta";
 import { executeRawQuery } from "../db/queries/raw-sql";
 import type { Registry, TenantId } from "../engine/types";
-import { buildSearchDocument } from "../pipeline/system-hooks";
+import {
+  buildSearchDocument,
+  decryptSearchableSubjectFields,
+  hasErasedSearchableSubjectField,
+} from "../pipeline/system-hooks";
 import { toSnakeCase } from "../utils/case";
 import type { SearchAdapter, SearchDocument } from "./types";
 
@@ -135,7 +139,16 @@ export async function reindexEntity(
       result.scannedRows++;
       const entityId = String(row["id"]);
       try {
-        const state = rowToState(row, fieldNames);
+        const rawState = rowToState(row, fieldNames);
+        // `pii + searchable` fields hold ciphertext on the read-table row —
+        // decrypt the same way the live write-path consumer does. An
+        // erased subject key doesn't throw, it swaps the value for
+        // PII_ERASED_SENTINEL (see decryptSearchableSubjectFields) — check
+        // for that AFTER decrypting, mirroring the softDelete filter above:
+        // resurrecting a crypto-shredded row here would undo
+        // purgeSearchDocumentsForSubject and make it findable again.
+        const state = await decryptSearchableSubjectFields(entityName, rawState, registry);
+        if (hasErasedSearchableSubjectField(entityName, state, registry)) continue;
         const doc = await buildSearchDocument(entityName, entityId, state, registry);
         if (doc) docs.push({ entityId, doc });
       } catch (e) {

package/src/secrets/derive-purpose-secret.ts

@@ -1,21 +1,11 @@
 import { hkdfSync } from "node:crypto";
 
-// One master secret, many purposes: HKDF turns `JWT_SECRET` into an
-// independent secret per trust boundary, so a token-signing key for MFA setup
-// cannot be used to forge a deletion token — and neither can be walked back to
-// the master. Rotating the master rotates every purpose with it.
-//
-// The alternative is an env var per purpose. That is not more secure (same
-// blast radius if the deploy is compromised), it is just more operations, and
-// in practice one of them ends up unset in some environment.
-//
-// The purpose string is a domain separator and part of the contract: change it
-// and every previously issued token for that purpose stops verifying. Version
-// them ("mfa-setup-token-v1") so a single purpose can be rotated deliberately
-// without touching the master or the other purposes.
-//
-// Lived copy-pasted in four apps before fw#1623 (money-horse, kumiko-studio,
-// publicstatus, plus a stale worktree) — identical bodies, drifting comments.
+// HKDF turns one master secret into an independent secret per purpose, so
+// a token-signing key for MFA setup can't forge a deletion token and
+// neither can be walked back to the master. `purpose` is a domain
+// separator, not a label — changing it invalidates every previously
+// issued token for that purpose; version it ("mfa-setup-token-v1") to
+// rotate one purpose deliberately.
 export function derivePurposeSecret(masterSecret: string, purpose: string): string {
   if (!masterSecret) {
     throw new Error("derivePurposeSecret: masterSecret must not be empty.");

package/src/testing/__tests__/e2e-generator.test.ts

@@ -259,4 +259,11 @@ describe("generateZodFixture", () => {
     expect(() => generateZodFixture(z.object({}))).toThrow(/not supported yet/);
     expect(() => generateZodFixture(z.array(z.string()))).toThrow(/not supported yet/);
   });
+
+  test("pipe (select-with-default, same shape schema-builder's z.preprocess produces) unwraps to the underlying type's fixture (fw#1712)", () => {
+    const enumSchema = z.enum(["a", "b"]);
+    const pipe = z.preprocess((value) => (value === "" ? "a" : value), enumSchema);
+    expect(pipe._def.type).toBe("pipe");
+    expect(generateZodFixture(pipe)).toBe("a");
+  });
 });

package/src/testing/__tests__/wait-for.test.ts

@@ -9,11 +9,11 @@ describe("waitFor", () => {
       () => {
         calls++;
       },
-      { delays: [200, 200, 200] },
+      { delays: [2000] },
     );
     expect(calls).toBe(1);
     // try-first: must not burn the first delay when the condition already holds
-    expect(Date.now() - started).toBeLessThan(100);
+    expect(Date.now() - started).toBeLessThan(500);
   });
 
   test("retries on failure and succeeds once fn passes", async () => {

package/src/testing/e2e-generator.ts

@@ -355,6 +355,7 @@ type ZodInternals = {
   readonly format?: string;
   readonly innerType?: z.ZodTypeAny;
   readonly entries?: Record<string, string>;
+  readonly out?: z.ZodTypeAny;
 };
 
 function readZodInternals(schema: z.ZodTypeAny): ZodInternals | undefined {
@@ -384,6 +385,10 @@ export function generateZodFixture(schema: z.ZodTypeAny): unknown {
     }
     case "date":
       return new Date("2026-01-01T00:00:00Z");
+    case "pipe": {
+      if (!def?.out) throw new Error("zod pipe without out");
+      return generateZodFixture(def.out);
+    }
     default:
       throw new Error(`generateZodFixture: not supported yet: ${typeName ?? "<unknown>"}`);
   }