@cosmicdrift/kumiko-framework 0.187.0 → 0.189.0

package/src/engine/boot-validator/screens.ts

@@ -5,16 +5,18 @@
 // same-folder require cycle.
 
 import { rowMetaFieldNames } from "../../db/table-builder";
-import { qualifyEntityName } from "../qualified-name";
+import { isValidQn, qualifyEntityName } from "../qualified-name";
 import { getAllowedFilterOps, isFieldFilterable } from "../screen-filter-ops";
 import { isExtensionEditSection, normalizeEditField, normalizeListColumn } from "../screen-helpers";
-import type { FeatureDefinition } from "../types";
+import type { EntityDefinition, FeatureDefinition } from "../types";
 import type {
   DashboardCustomPanel,
   DashboardFilterDefinition,
   DashboardPanelDefinition,
   DashboardScreenDefinition,
   DashboardStatGroupPanel,
+  EditFieldSpec,
+  EditLayout,
   FieldCondition,
   RowAction,
   RowFieldExtractor,
@@ -22,6 +24,48 @@ import type {
   ToolbarAction,
 } from "../types/screen";
 
+// Mirrors FIELD_TYPES_WITHOUT_WIDGET in packages/renderer/src/app/form-schema.ts.
+// Can't import it directly — renderer depends on framework, not the reverse.
+// Keep both lists in sync when a field type gains or loses an auto-wired widget.
+const NO_WIDGET_FIELD_TYPES = new Set(["jsonb", "embedded", "files", "images"]);
+
+// A field type in NO_WIDGET_FIELD_TYPES renders read-only on the auto-wired
+// entityEdit path (#1925) — a required field the user can never fill would
+// block every save. Only the statically-resolvable case is caught here: a
+// literal `required: true` (screen-spec override or entity-level default).
+// A dynamic FieldCondition depends on runtime form values and can't be
+// evaluated at boot; buildFormSchema() silently skips presence-checking it.
+function validateNoWidgetRequiredField(
+  featureName: string,
+  screenId: string,
+  entityDef: EntityDefinition,
+  fieldSpec: Exclude<EditFieldSpec, string>,
+): void {
+  const fieldDef = entityDef.fields[fieldSpec.field];
+  // skip: field doesn't exist or its type already has a widget — nothing to validate.
+  if (fieldDef === undefined || !NO_WIDGET_FIELD_TYPES.has(fieldDef.type)) return;
+  // Embedded LIST fields (`multiple: true`) get their own EmbeddedListField
+  // grid widget (#1838) — only plain (non-list) embedded has no widget.
+  const isEmbeddedList =
+    fieldDef.type === "embedded" &&
+    (fieldDef as unknown as { multiple?: boolean }).multiple === true;
+  // skip: list variant has a widget — not the no-widget case this guard targets.
+  if (isEmbeddedList) return;
+  // skip: already read-only by spec — no fillable widget needed regardless of type.
+  if (fieldSpec.readOnly === true) return;
+  const entityRequired = "required" in fieldDef && fieldDef.required === true;
+  const isStaticallyRequired =
+    fieldSpec.required === undefined ? entityRequired : fieldSpec.required === true;
+  // skip: not required — a read-only widget-less field is fine to leave empty.
+  if (!isStaticallyRequired) return;
+  throw new Error(
+    `[Feature ${featureName}] Screen "${screenId}" (entityEdit) field "${fieldSpec.field}" is ` +
+      `type "${fieldDef.type}", which renders read-only on the auto-wired entityEdit path — a ` +
+      `required field the user could never fill would block every save. Set required: false, ` +
+      `move the field to a custom-component section, or drop the required constraint.`,
+  );
+}
+
 // Tier 2.7e navigate rowAction → target-screen params validity. Shared by
 // entityList and projectionList (framework#1708) — projectionList has no
 // `screen.entity`, so there's no same-entity row["id"] auto-fill case: any
@@ -71,6 +115,58 @@ function validateRowActionNavigateParams(
   }
 }
 
+// Wizard layouts (mode: "wizard") render one section per step — a single
+// step (or a step without a title, which would leave the progress
+// indicator blank) defeats the point, so both fail at boot rather than
+// as a broken step UI. Missing/blank titles are checked identically for
+// both section kinds — EditExtensionSection.title is required by type,
+// but that doesn't stop author code that circumvented the check from
+// passing an empty string.
+function validateWizardLayout(
+  featureName: string,
+  screenId: string,
+  screenType: "entityEdit" | "actionForm",
+  layout: EditLayout,
+  featureMap: ReadonlyMap<string, FeatureDefinition>,
+): void {
+  // "form-draft" is hardcoded because the framework layer must not depend on
+  // @cosmicdrift/kumiko-bundled-features — same precedence as the
+  // "user-data-rights" check in gdpr-storage.ts.
+  if (layout.draft === true) {
+    if (layout.mode !== "wizard") {
+      throw new Error(
+        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) sets draft: true but ` +
+          `mode is not "wizard" — draft persistence only applies to wizard layouts. Remove ` +
+          `draft: true or set mode: "wizard".`,
+      );
+    }
+    if (!featureMap.has("form-draft")) {
+      throw new Error(
+        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) sets draft: true but the ` +
+          `bundled feature "form-draft" is not mounted — every resume would silently lose its ` +
+          `values. Add formDraftFeature() from @cosmicdrift/kumiko-bundled-features to the app's ` +
+          `feature list.`,
+      );
+    }
+  }
+  // skip: mode omitted/"single" — no wizard constraints apply.
+  if (layout.mode !== "wizard") return;
+  if (layout.sections.length < 2) {
+    throw new Error(
+      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) has mode: "wizard" but only ` +
+        `${layout.sections.length} section(s) — a wizard needs at least 2 sections (one per step).`,
+    );
+  }
+  layout.sections.forEach((section, index) => {
+    if (section.title === undefined || section.title.trim().length === 0) {
+      throw new Error(
+        `[Feature ${featureName}] Screen "${screenId}" (${screenType}) has mode: "wizard" but ` +
+          `sections[${index}] has no title — every wizard step needs a title.`,
+      );
+    }
+  });
+}
+
 // --- Screen validation ---
 //
 // For every r.screen() declaration check what's locally knowable at boot:
@@ -171,6 +267,15 @@ export function validateScreenShortIdCollisions(
   }
 }
 
+// redirect/cancelTarget accept either a same-feature short id (unchanged
+// behavior, qualified against the owning feature) or a fully-qualified
+// cross-feature screen QN (`<feature>:screen:<id>`) given verbatim — a
+// short id can never itself be a valid QN (QN_SEGMENT forbids colons), so
+// the two forms don't collide.
+function resolveScreenTargetQn(featureName: string, target: string): string {
+  return isValidQn(target) ? target : qualifyEntityName(featureName, "screen", target);
+}
+
 export function validateScreens(
   feature: FeatureDefinition,
   featureMap: ReadonlyMap<string, FeatureDefinition>,
@@ -186,8 +291,9 @@ export function validateScreens(
   // der Runtime-Router (create-app) löst eine bare screenId app-weit über ALLE
   // Features auf (eine deklarative Liste im owning-Feature der Entity navigiert
   // so zu den Custom-Editoren der Consumer-App). Der Validator spiegelt das:
-  // same-feature ODER irgendein Feature. (redirect/cancelTarget bleiben bewusst
-  // same-feature: deren Router baut die URL direkt aus der kurzen id.)
+  // same-feature ODER irgendein Feature. redirect/cancelTarget akzeptieren
+  // zusätzlich eine voll-qualifizierte Cross-Feature-QN (resolveScreenTargetQn,
+  // #1946) — kurze IDs bleiben same-feature wie zuvor.
   const navTargetShortIds = screenShortIdsFrom(allScreenQns);
   for (const [screenId, screen] of Object.entries(feature.screens)) {
     if (screen.type === "custom") {
@@ -441,32 +547,31 @@ export function validateScreens(
           }
         }
       }
+      validateWizardLayout(feature.name, screenId, "actionForm", screen.layout, featureMap);
       if (screen.redirect !== undefined) {
-        // redirect ist die kurze Screen-ID (z.B. "item-list"); der
-        // nav-Router resolved sie beim Mount gegen die Schema-Map.
-        // Cross-Feature-Redirect ist nicht supported — der nav-Router
-        // baut die URL aus screenId direkt, eine voll-QN würde als
-        // `/shop:screen:foo/` landen und nirgendwo greifen.
-        const candidateQn = qualifyEntityName(feature.name, "screen", screen.redirect);
+        // redirect ist entweder die kurze Screen-ID (same-feature, z.B.
+        // "item-list") oder eine voll-qualifizierte Cross-Feature-QN
+        // (`<feature>:screen:<id>`) — der Renderer strippt letztere beim
+        // Navigieren auf die kurze ID (lastSegment), die der nav-Router
+        // app-weit auflöst (#1946).
+        const candidateQn = resolveScreenTargetQn(feature.name, screen.redirect);
         if (!allScreenQns.has(candidateQn)) {
           throw new Error(
             `[Feature ${feature.name}] Screen "${screenId}" (actionForm) redirect "${screen.redirect}" ` +
-              `does not resolve to a registered screen in this feature. Known screens: ${
-                [...Object.keys(feature.screens)].sort().join(", ") || "(none)"
-              }.`,
+              `does not resolve to a registered screen (checked "${candidateQn}"). Known screens ` +
+              `in this feature: ${[...Object.keys(feature.screens)].sort().join(", ") || "(none)"}.`,
           );
         }
       }
       if (typeof screen.cancelTarget === "string") {
         // Gleiche Regel wie redirect — `false` (kein Cancel-Button)
         // braucht keine Validierung.
-        const candidateQn = qualifyEntityName(feature.name, "screen", screen.cancelTarget);
+        const candidateQn = resolveScreenTargetQn(feature.name, screen.cancelTarget);
         if (!allScreenQns.has(candidateQn)) {
           throw new Error(
             `[Feature ${feature.name}] Screen "${screenId}" (actionForm) cancelTarget "${screen.cancelTarget}" ` +
-              `does not resolve to a registered screen in this feature. Known screens: ${
-                [...Object.keys(feature.screens)].sort().join(", ") || "(none)"
-              }.`,
+              `does not resolve to a registered screen (checked "${candidateQn}"). Known screens ` +
+              `in this feature: ${[...Object.keys(feature.screens)].sort().join(", ") || "(none)"}.`,
           );
         }
       }
@@ -770,6 +875,20 @@ export function validateScreens(
               ),
             );
           }
+          validateNoWidgetRequiredField(feature.name, screenId, entityDef, normalized);
+        }
+      }
+      validateWizardLayout(feature.name, screenId, "entityEdit", screen.layout, featureMap);
+      if (screen.redirect !== undefined) {
+        // Same rule as actionForm's redirect: short screen-ID (same-feature)
+        // or a fully-qualified cross-feature QN (#1946).
+        const candidateQn = resolveScreenTargetQn(feature.name, screen.redirect);
+        if (!allScreenQns.has(candidateQn)) {
+          throw new Error(
+            `[Feature ${feature.name}] Screen "${screenId}" (entityEdit) redirect "${screen.redirect}" ` +
+              `does not resolve to a registered screen (checked "${candidateQn}"). Known screens ` +
+              `in this feature: ${[...Object.keys(feature.screens)].sort().join(", ") || "(none)"}.`,
+          );
         }
       }
     }

package/src/errors/__tests__/classes.test.ts

@@ -106,6 +106,45 @@ describe("ValidationError", () => {
     expect(err.cause).toBe(result.error);
   });
 
+  test("custom issue with params.i18nKey overrides the mechanical errors.validation.custom key", () => {
+    const schema = z.object({ name: z.string() }).superRefine((values, ctx) => {
+      if (values.name === "") {
+        ctx.addIssue({
+          code: "custom",
+          path: ["name"],
+          message: '"name" is required.',
+          params: { i18nKey: "kumiko.validation.required" },
+        });
+      }
+    });
+    const result = schema.safeParse({ name: "" });
+    if (result.success) throw new Error("zod did not reject");
+
+    const err = validationErrorFromZod(result.error);
+    const fields = (err.details as { fields: Array<Record<string, unknown>> }).fields;
+    expect(fields[0]).toMatchObject({
+      code: "custom",
+      i18nKey: "kumiko.validation.required",
+    });
+  });
+
+  test("custom issue without params.i18nKey still falls back to errors.validation.custom", () => {
+    const schema = z.object({ name: z.string() }).superRefine((values, ctx) => {
+      if (values.name === "bad") {
+        ctx.addIssue({ code: "custom", path: ["name"], message: "not allowed" });
+      }
+    });
+    const result = schema.safeParse({ name: "bad" });
+    if (result.success) throw new Error("zod did not reject");
+
+    const err = validationErrorFromZod(result.error);
+    const fields = (err.details as { fields: Array<Record<string, unknown>> }).fields;
+    expect(fields[0]).toMatchObject({
+      code: "custom",
+      i18nKey: "errors.validation.custom",
+    });
+  });
+
   test('root-level zod issue maps to path "(root)"', () => {
     const schema = z.string();
     const result = schema.safeParse(123);

package/src/errors/zod-bridge.ts

@@ -30,13 +30,30 @@ export function validationErrorFromZod(error: ZodError): ValidationError {
     return {
       path: issue.path.map(String).join(".") || "(root)",
       code: issue.code,
-      i18nKey: `errors.validation.${issue.code}`,
+      i18nKey: resolveI18nKey(issue),
       ...(params && { params }),
     };
   });
   return new ValidationError({ fields }, { cause: error });
 }
 
+// Every zod code maps mechanically to `errors.validation.<code>` — except
+// `code: "custom"`, which is zod's one-size-fits-all bucket for every
+// `superRefine`/`refine` check in the codebase (e.g. schema-builder.ts's
+// totalsMatch check). Left mechanical, ALL of them would collapse onto the
+// same `errors.validation.custom` ("Invalid value.") key. A `superRefine`
+// that needs its own key sets `params.i18nKey` on the issue; this is the one
+// place that honors it. Keep in sync with the client-side mirror
+// (packages/headless/src/form/zod-bridge.ts) — a superRefine can run on
+// either side.
+function resolveI18nKey(issue: ZodIssue): string {
+  if (issue.code === "custom") {
+    const override = issue.params?.["i18nKey"];
+    if (typeof override === "string") return override;
+  }
+  return `errors.validation.${issue.code}`;
+}
+
 function extractIssueParams(issue: ZodIssue): Readonly<Record<string, unknown>> | undefined {
   // ZodIssue is a discriminated union with variant-specific params (minimum,
   // maximum, expected, …); reading them generically requires widening since

package/src/event-store/__tests__/perf.integration.test.ts

@@ -3,16 +3,26 @@
 // the raw-SQL spike used as proof before the ES pivot.
 //
 // Targets (from docs/plans/architecture/event-sourcing-spike-1.md):
-//   - Write-Latency  p99 < 30ms  (append a single event)
-//   - Read-Latency   p99 < 25ms  (loadAggregate for a single aggregate)
-//   - Update-Latency p99 < 30ms  (append with predecessor-check WHERE EXISTS)
+//   - Write-Latency  p95 < 30ms  (append a single event)
+//   - Read-Latency   p95 < 25ms  (loadAggregate for a single aggregate)
+//   - Update-Latency p95 < 30ms  (append with predecessor-check WHERE EXISTS)
 //   - Snapshot-Load < 50ms       (1000-event aggregate, snapshot @ 900)
 //
 // Workload is sequential against local Docker Postgres — no network
 // latency, single-node PG. Production deploys are slower; these numbers
-// are the ceiling. Red test = framework regression, no slack tolerated.
+// are the ceiling.
 //
-// Isolated from bulk integration via `bun run test:integration:perf`.
+// Isolated from bulk integration via `bun run test:integration:perf`. Used
+// to run inside the `integration` CI job, right after the ~213-test bulk
+// suite, and flaked up to 3.4x under that (30-102ms vs the 25-30ms budgets
+// above, #1940). Moved to its own `event-store-perf` CI job
+// (test:integration:perf:eventstore) — but re-measuring against a fresh
+// container per run (mirroring that job) showed the real cause wasn't job
+// contention: p50 sits at 1-3ms in every run, and single-sample p99 spikes
+// to 47-73ms even fully isolated on an idle machine, from cold-Postgres
+// connection/cache warm-up. Gate switched from p99 (the single worst-of-200
+// sample) to p95 (drops the top 10), which absorbs that cold-start outlier
+// while still catching a real order-of-magnitude regression.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
@@ -60,7 +70,7 @@ async function measure<T>(op: () => Promise<T>): Promise<number> {
 }
 
 describe("event-store performance — Gate A", () => {
-  test("write-latency p99 < 30ms over 200 sequential appends", async () => {
+  test("write-latency p95 < 30ms over 200 sequential appends", async () => {
     const samples: number[] = [];
 
     // Warm-up — Connection-Pool + Drizzle-Prepare-Overhead
@@ -95,13 +105,16 @@ describe("event-store performance — Gate A", () => {
 
     samples.sort((a, b) => a - b);
     const p50 = percentile(samples, 0.5);
+    const p95 = percentile(samples, 0.95);
     const p99 = percentile(samples, 0.99);
-    console.log(`  Write-latency: p50=${p50.toFixed(2)}ms, p99=${p99.toFixed(2)}ms (n=200)`);
+    console.log(
+      `  Write-latency: p50=${p50.toFixed(2)}ms, p95=${p95.toFixed(2)}ms, p99=${p99.toFixed(2)}ms (n=200)`,
+    );
 
-    expect(p99).toBeLessThan(30);
+    expect(p95).toBeLessThan(30);
   });
 
-  test("read-latency p99 < 25ms for loadAggregate detail reads", async () => {
+  test("read-latency p95 < 25ms for loadAggregate detail reads", async () => {
     // Seed 200 single-event aggregates
     const ids: string[] = [];
     for (let i = 0; i < 200; i++) {
@@ -130,18 +143,18 @@ describe("event-store performance — Gate A", () => {
 
     samples.sort((a, b) => a - b);
     const p50 = percentile(samples, 0.5);
+    const p95 = percentile(samples, 0.95);
     const p99 = percentile(samples, 0.99);
     console.log(
-      `  Read-latency:  p50=${p50.toFixed(2)}ms, p99=${p99.toFixed(2)}ms (n=${ids.length})`,
+      `  Read-latency:  p50=${p50.toFixed(2)}ms, p95=${p95.toFixed(2)}ms, p99=${p99.toFixed(2)}ms (n=${ids.length})`,
     );
 
-    // 25ms statt der 10ms aus dem Spike-Doc: der shared cdgs-runner failt
-    // lastabhängig (real gemessen 13.7ms p99) — als CI-Gate zählt die
-    // Größenordnung, nicht der Idle-Bestwert. Tracking: #325.
-    expect(p99).toBeLessThan(25);
+    // 25ms budget kept from the original spike doc's 10ms — an
+    // order-of-magnitude gate, not an idle-best-case one. Tracking: #325.
+    expect(p95).toBeLessThan(25);
   });
 
-  test("update-latency p99 < 30ms — exercises predecessor-check WHERE EXISTS path", async () => {
+  test("update-latency p95 < 30ms — exercises predecessor-check WHERE EXISTS path", async () => {
     // Single aggregate, repeated updates — the INSERT … SELECT … WHERE EXISTS
     // path is heavier than a simple create and adds an index lookup.
     const aggregateId = uuid();
@@ -191,10 +204,13 @@ describe("event-store performance — Gate A", () => {
 
     samples.sort((a, b) => a - b);
     const p50 = percentile(samples, 0.5);
+    const p95 = percentile(samples, 0.95);
     const p99 = percentile(samples, 0.99);
-    console.log(`  Update-latency: p50=${p50.toFixed(2)}ms, p99=${p99.toFixed(2)}ms (n=200)`);
+    console.log(
+      `  Update-latency: p50=${p50.toFixed(2)}ms, p95=${p95.toFixed(2)}ms, p99=${p99.toFixed(2)}ms (n=200)`,
+    );
 
-    expect(p99).toBeLessThan(30);
+    expect(p95).toBeLessThan(30);
   });
 
   test("snapshot-load < 50ms for 1000-event aggregate (Gate A)", async () => {

package/src/event-store/__tests__/upcaster-dead-letter.integration.test.ts

@@ -139,7 +139,7 @@ describe("upcaster error-policy: quarantine", () => {
     expect(result).toHaveLength(1);
     expect(result[0]?.id).toBe("10");
     expect(result[0]?.eventVersion).toBe(2);
-    expect((result[0]?.payload as { migrated?: boolean }).migrated).toBe(true);
+    expect((result[0]!.payload as { migrated?: boolean }).migrated).toBe(true);
 
     const dl = await listDeadLetters(testDb.db);
     expect(dl).toHaveLength(1);

package/src/pipeline/__tests__/lifecycle-pipeline.test.ts

@@ -729,33 +729,36 @@ describe("runPostSaveBatch / runPostDeleteBatch", () => {
       (pipeline: ReturnType<typeof createLifecycleHooks>) =>
         pipeline.runPostDeleteBatch([deletectx], {}),
     ],
-  ])("one %s hook throwing doesn't stop the others (Promise.allSettled) — logged, never thrown", async (_name, buildHooks, run) => {
-    const consoleSpy = spyOn(console, "error").mockImplementation(() => {});
-    try {
-      const calls: string[] = [];
-      const systemHooks = buildHooks([
-        {
-          name: "failing",
-          priority: 1000,
-          fn: async () => {
-            throw new Error("batch-hook-boom");
+  ])(
+    "one %s hook throwing doesn't stop the others (Promise.allSettled) — logged, never thrown",
+    async (_name, buildHooks, run) => {
+      const consoleSpy = spyOn(console, "error").mockImplementation(() => {});
+      try {
+        const calls: string[] = [];
+        const systemHooks = buildHooks([
+          {
+            name: "failing",
+            priority: 1000,
+            fn: async () => {
+              throw new Error("batch-hook-boom");
+            },
           },
-        },
-        {
-          name: "ok",
-          priority: 1001,
-          fn: async () => {
-            calls.push("ok-ran");
+          {
+            name: "ok",
+            priority: 1001,
+            fn: async () => {
+              calls.push("ok-ran");
+            },
           },
-        },
-      ]);
-      const pipeline = createLifecycleHooks(makeRegistry(), systemHooks);
-      // Must not throw.
-      await run(pipeline);
-      expect(calls).toEqual(["ok-ran"]);
-      expect(consoleSpy).toHaveBeenCalled();
-    } finally {
-      consoleSpy.mockRestore();
-    }
-  });
+        ]);
+        const pipeline = createLifecycleHooks(makeRegistry(), systemHooks);
+        // Must not throw.
+        await run(pipeline);
+        expect(calls).toEqual(["ok-ran"]);
+        expect(consoleSpy).toHaveBeenCalled();
+      } finally {
+        consoleSpy.mockRestore();
+      }
+    },
+  );
 });

package/src/pipeline/__tests__/redis-pipeline.integration.test.ts

@@ -297,7 +297,7 @@ describe("entity cache", () => {
 
     const single = await cache.get("00000000-0000-4000-8000-000000000001", "event", 42);
     expect(single?.["insertedAt"]).toBeInstanceOf(Date);
-    expect((single?.["insertedAt"] as Date).getTime()).toBe(insertedAt.getTime());
+    expect((single!["insertedAt"] as Date).getTime()).toBe(insertedAt.getTime());
     // Non-ISO strings must not be coerced
     expect(typeof single?.["title"]).toBe("string");
     expect(single?.["note"]).toBe("not a date: 2026-04");

package/src/time/__tests__/iana.test.ts

@@ -4,26 +4,19 @@ import { isValidIanaTimeZone } from "../iana";
 describe("isValidIanaTimeZone", () => {
   // Die 5 Zonen der geplanten CI-TZ-Matrix (timezones.md) müssen alle gültig
   // sein — sonst kann die Matrix sie nicht setzen.
-  test.each([
-    "UTC",
-    "Europe/Berlin",
-    "America/Los_Angeles",
-    "Asia/Tokyo",
-    "Pacific/Apia",
-  ])("akzeptiert kanonische Zone %s", (zone) => {
-    expect(isValidIanaTimeZone(zone)).toBe(true);
-  });
+  test.each(["UTC", "Europe/Berlin", "America/Los_Angeles", "Asia/Tokyo", "Pacific/Apia"])(
+    "akzeptiert kanonische Zone %s",
+    (zone) => {
+      expect(isValidIanaTimeZone(zone)).toBe(true);
+    },
+  );
 
-  test.each([
-    "",
-    "Mars/Phobos",
-    "europe/berlin",
-    "Europe/Berlin ",
-    "GMT+2",
-    "not-a-zone",
-  ])("lehnt ungültigen / nicht-kanonischen String %p ab", (value) => {
-    expect(isValidIanaTimeZone(value)).toBe(false);
-  });
+  test.each(["", "Mars/Phobos", "europe/berlin", "Europe/Berlin ", "GMT+2", "not-a-zone"])(
+    "lehnt ungültigen / nicht-kanonischen String %p ab",
+    (value) => {
+      expect(isValidIanaTimeZone(value)).toBe(false);
+    },
+  );
 
   // Intl.supportedValuesOf("timeZone") listet nur kanonische Namen — gültige
   // IANA-Aliase fehlen darin, obwohl Intl.DateTimeFormat/Temporal/ctx.tz.parse

package/src/utils/__tests__/safe-json-temporal.test.ts

@@ -12,3 +12,17 @@ describe("stringifyJson — Temporal.Instant without ambient Temporal", () => {
     });
   });
 });
+
+describe("stringifyJson — Temporal.PlainDate (kumiko-framework#1924)", () => {
+  test("serializes to yyyy-mm-dd via PlainDate's own toJSON(), no special-casing needed", () => {
+    const day = PolyfillTemporal.PlainDate.from("2026-03-15");
+    expect(stringifyJson({ publishedAt: day })).toBe('{"publishedAt":"2026-03-15"}');
+  });
+
+  test("serializes polyfill PlainDate when globalThis.Temporal is missing", async () => {
+    const day = PolyfillTemporal.PlainDate.from("2026-03-15");
+    await withoutAmbientTemporal(() => {
+      expect(stringifyJson({ publishedAt: day })).toBe('{"publishedAt":"2026-03-15"}');
+    });
+  });
+});