@cosmicdrift/kumiko-framework 0.193.0 → 0.194.0

package/src/engine/__tests__/schema-builder.test.ts

@@ -724,10 +724,51 @@ describe("totalsMatch (fw#1839)", () => {
     expect(schema.safeParse({ total: { amount: 30, currency: "EUR" } }).success).toBe(true);
   });
 
+  // kumiko-framework#1972: a round total (30 EUR = 3000 minor) still passes
+  // even if the major/minor conversion is silently skipped, because 30 and
+  // 3000 both "look" plausible under either interpretation. A crooked
+  // amount catches that a round-number fixture wouldn't.
+  test("accepts a crooked total (1234.56 EUR) whose minor-unit line sum matches exactly", () => {
+    const schema = buildInsertSchema(invoiceEntity());
+    const result = schema.safeParse({
+      total: { amount: 1234.56, currency: "EUR" },
+      lines: [{ amount: 100000 }, { amount: 23456 }],
+    });
+    expect(result.success).toBe(true);
+  });
+
+  // The exact shape of the reported solon incident: a genuinely wrong total
+  // (100.00 EUR entered as if it were already minor units, i.e. 1.00 EUR)
+  // must still be rejected — proves the refinement doesn't silently pass a
+  // mismatch through by accident.
+  test("rejects a total that was itself entered/scaled wrong (100x too small)", () => {
+    const schema = buildInsertSchema(invoiceEntity());
+    const result = schema.safeParse({
+      total: { amount: 1, currency: "EUR" }, // should have been 100
+      lines: [{ amount: 10000 }], // 100.00 EUR
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues.some((issue) => issue.path.join(".") === "lines")).toBe(true);
+    }
+  });
+
   test("update payload omitting the sibling total is not checked (nothing to compare against)", () => {
     const schema = buildUpdateSchema(invoiceEntity());
     expect(schema.safeParse({ lines: [{ amount: 1000 }, { amount: 1500 }] }).success).toBe(true);
   });
+
+  test("rejects a sibling total tagged with a currency other than the entity's default, even when the raw minor-unit amounts match", () => {
+    const schema = buildInsertSchema(invoiceEntity());
+    const result = schema.safeParse({
+      total: { amount: 30, currency: "USD" },
+      lines: [{ amount: 1000 }, { amount: 2000 }],
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues.some((issue) => issue.path.join(".") === "total")).toBe(true);
+    }
+  });
 });
 
 // --- kumiko-framework#1837: derived-cell server-side recomputation — the
@@ -959,6 +1000,58 @@ describe("embedded-list derived cell recomputation (kumiko-framework#1837)", ()
       expect(row?.["amount"]).toBe(3);
     }
   });
+
+  test("a sum of scale-3 sources on a scale-2 decimal target is rounded, not rejected as over-scale", () => {
+    const entity = createEntity({
+      table: "Orders",
+      fields: {
+        lines: createEmbeddedListField(
+          {
+            a: { type: "decimal", scale: 3, required: true },
+            b: { type: "decimal", scale: 3, required: true },
+            c: { type: "decimal", scale: 3, required: true },
+            total: { type: "decimal", scale: 2, required: false },
+          },
+          { derived: { total: { op: "sum", from: ["a", "b", "c"] } } },
+        ),
+      },
+    });
+    const schema = buildInsertSchema(entity);
+    // Each source is in-scale for its own scale-3 field, but the sum
+    // (0.333) has 3 decimal digits — over-scale for the scale-2 target
+    // without the rounding this PR added.
+    const result = schema.safeParse({ lines: [{ a: 0.111, b: 0.111, c: 0.111 }] });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      const row = (result.data["lines"] as readonly Record<string, unknown>[])[0];
+      expect(row?.["total"]).toBe(0.33);
+    }
+  });
+
+  test("a subtract landing on a money target rounds to whole minor units", () => {
+    const entity = createEntity({
+      table: "Orders",
+      fields: {
+        lines: createEmbeddedListField(
+          {
+            gross: { type: "decimal", scale: 2, required: true },
+            refund: { type: "decimal", scale: 2, required: true },
+            total: { type: "money", required: false },
+          },
+          { derived: { total: { op: "subtract", from: ["gross", "refund"] } } },
+        ),
+      },
+    });
+    const schema = buildInsertSchema(entity);
+    // 2400.58 - 93 = 2307.58 minor units — not representable by money's
+    // integer constraint without rounding.
+    const result = schema.safeParse({ lines: [{ gross: 2400.58, refund: 93 }] });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      const row = (result.data["lines"] as readonly Record<string, unknown>[])[0];
+      expect(row?.["total"]).toBe(2308);
+    }
+  });
 });
 
 // --- Update schema (all partial) ---

package/src/engine/boot-validator/entity-handler.ts

@@ -1,4 +1,4 @@
-import type { VariantSpec } from "@cosmicdrift/kumiko-types/derivatives-types";
+import type { BlurRegion, VariantSpec } from "@cosmicdrift/kumiko-types/derivatives-types";
 import { VARIANT_NAME_PATTERN } from "../../derivatives/variant-key";
 import { parseRefTarget } from "../parse-ref-target";
 import type { EmbeddedFieldDef, EntityDefinition, FeatureDefinition } from "../types";
@@ -557,6 +557,15 @@ function validateEmbeddedListBounds(
       `Embedded-list field "${fieldName}" on entity "${entityName}" has minItems ${field.minItems} greater than maxItems ${field.maxItems}.`,
     );
   }
+  // required:true means "at least one row" (schema-builder.ts falls back to
+  // minItems:1 for that); an explicit minItems:0 would silently win over
+  // that and let a required list submit empty — reject the contradiction
+  // instead of picking one side of it for the caller.
+  if (field.required === true && field.minItems === 0) {
+    throw new Error(
+      `Embedded-list field "${fieldName}" on entity "${entityName}" sets required:true and minItems:0 — these contradict each other. Drop minItems (defaults to 1) or set required:false.`,
+    );
+  }
 }
 
 function validateEmbeddedDerivedCells(
@@ -693,6 +702,31 @@ function isPositiveInt(value: number): boolean {
   return Number.isInteger(value) && value > 0;
 }
 
+// Renderers cap dimensions in practice (sharp refuses output above 0x1000000
+// pixels); 8192 per edge is generously above any real thumbnail/preview use
+// and keeps a boot-declared spec from becoming a memory-exhaustion vector.
+const MAX_VARIANT_EDGE_PX = 8192;
+// sharp's blur() accepts a sigma of 0.3..1000; anything above that throws at
+// render time, months after boot, on the first request for that variant.
+const MAX_BLUR_SIGMA = 1000;
+
+function isValidBlurRegion(region: BlurRegion): boolean {
+  const { x, y, width, height } = region;
+  return (
+    Number.isFinite(x) &&
+    Number.isFinite(y) &&
+    Number.isFinite(width) &&
+    Number.isFinite(height) &&
+    x >= 0 &&
+    y >= 0 &&
+    width >= 0 &&
+    height >= 0 &&
+    x + width <= 1 &&
+    y + height <= 1
+  );
+}
+
+// kumiko-lint-ignore complexity-budget blur/size bounds added for boot-time DoS guard
 function assertValidVariantSpec(name: string, spec: VariantSpec, where: string): void {
   if (!VARIANT_NAME_PATTERN.test(name)) {
     throw new Error(
@@ -704,15 +738,23 @@ function assertValidVariantSpec(name: string, spec: VariantSpec, where: string):
   }
   if (
     spec.size !== undefined &&
-    !(isPositiveInt(spec.size.width) && isPositiveInt(spec.size.height))
+    !(
+      isPositiveInt(spec.size.width) &&
+      isPositiveInt(spec.size.height) &&
+      spec.size.width <= MAX_VARIANT_EDGE_PX &&
+      spec.size.height <= MAX_VARIANT_EDGE_PX
+    )
   ) {
     throw new Error(
-      `Image variant "${name}" ${where} has a non-positive-integer "size" (${spec.size.width}x${spec.size.height}).`,
+      `Image variant "${name}" ${where} has an invalid "size" (${spec.size.width}x${spec.size.height}) — must be a positive integer up to ${MAX_VARIANT_EDGE_PX}px per edge.`,
     );
   }
-  if (spec.maxEdge !== undefined && !isPositiveInt(spec.maxEdge)) {
+  if (
+    spec.maxEdge !== undefined &&
+    !(isPositiveInt(spec.maxEdge) && spec.maxEdge <= MAX_VARIANT_EDGE_PX)
+  ) {
     throw new Error(
-      `Image variant "${name}" ${where} has a non-positive-integer "maxEdge" (${spec.maxEdge}).`,
+      `Image variant "${name}" ${where} has an invalid "maxEdge" (${spec.maxEdge}) — must be a positive integer up to ${MAX_VARIANT_EDGE_PX}px.`,
     );
   }
   if (spec.quality !== undefined && !(isPositiveInt(spec.quality) && spec.quality <= 100)) {
@@ -720,6 +762,23 @@ function assertValidVariantSpec(name: string, spec: VariantSpec, where: string):
       `Image variant "${name}" ${where} has "quality" ${spec.quality} — must be an integer in 1..100.`,
     );
   }
+  if (
+    spec.blur !== undefined &&
+    !(Number.isFinite(spec.blur) && spec.blur > 0 && spec.blur <= MAX_BLUR_SIGMA)
+  ) {
+    throw new Error(
+      `Image variant "${name}" ${where} has "blur" ${spec.blur} — must be a finite number in (0, ${MAX_BLUR_SIGMA}].`,
+    );
+  }
+  if (spec.blurRegions !== undefined) {
+    for (const region of spec.blurRegions) {
+      if (!isValidBlurRegion(region)) {
+        throw new Error(
+          `Image variant "${name}" ${where} has an invalid "blurRegions" entry ${JSON.stringify(region)} — x/y/width/height must be within 0..1 and x+width/y+height must not exceed 1.`,
+        );
+      }
+    }
+  }
 }
 
 // A bad spec is only visible when someone finally requests that variant —

package/src/engine/boot-validator/screens.ts

@@ -8,7 +8,7 @@ import { rowMetaFieldNames } from "../../db/table-builder";
 import { isValidQn, qualifyEntityName } from "../qualified-name";
 import { getAllowedFilterOps, isFieldFilterable } from "../screen-filter-ops";
 import { isExtensionEditSection, normalizeEditField, normalizeListColumn } from "../screen-helpers";
-import type { EntityDefinition, FeatureDefinition } from "../types";
+import type { EntityDefinition, FeatureDefinition, FieldDefinition } from "../types";
 import type {
   DashboardCustomPanel,
   DashboardFilterDefinition,
@@ -27,7 +27,12 @@ import type {
 // Mirrors FIELD_TYPES_WITHOUT_WIDGET in packages/renderer/src/app/form-schema.ts.
 // Can't import it directly — renderer depends on framework, not the reverse.
 // Keep both lists in sync when a field type gains or loses an auto-wired widget.
-const NO_WIDGET_FIELD_TYPES = new Set(["jsonb", "embedded", "files", "images"]);
+const NO_WIDGET_FIELD_TYPES: ReadonlySet<FieldDefinition["type"]> = new Set([
+  "jsonb",
+  "embedded",
+  "files",
+  "images",
+]);
 
 // A field type in NO_WIDGET_FIELD_TYPES renders read-only on the auto-wired
 // entityEdit path (#1925) — a required field the user can never fill would
@@ -46,9 +51,7 @@ function validateNoWidgetRequiredField(
   if (fieldDef === undefined || !NO_WIDGET_FIELD_TYPES.has(fieldDef.type)) return;
   // Embedded LIST fields (`multiple: true`) get their own EmbeddedListField
   // grid widget (#1838) — only plain (non-list) embedded has no widget.
-  const isEmbeddedList =
-    fieldDef.type === "embedded" &&
-    (fieldDef as unknown as { multiple?: boolean }).multiple === true;
+  const isEmbeddedList = fieldDef.type === "embedded" && fieldDef.multiple === true;
   // skip: list variant has a widget — not the no-widget case this guard targets.
   if (isEmbeddedList) return;
   // skip: already read-only by spec — no fillable widget needed regardless of type.
@@ -115,13 +118,9 @@ function validateRowActionNavigateParams(
   }
 }
 
-// Wizard layouts (mode: "wizard") render one section per step — a single
-// step (or a step without a title, which would leave the progress
-// indicator blank) defeats the point, so both fail at boot rather than
-// as a broken step UI. Missing/blank titles are checked identically for
-// both section kinds — EditExtensionSection.title is required by type,
-// but that doesn't stop author code that circumvented the check from
-// passing an empty string.
+// Wizard layouts (mode: "wizard") need >= 2 titled sections — a single or
+// untitled step would leave the progress indicator blank, so both fail at
+// boot rather than as a broken step UI.
 function validateWizardLayout(
   featureName: string,
   screenId: string,
@@ -276,6 +275,25 @@ function resolveScreenTargetQn(featureName: string, target: string): string {
   return isValidQn(target) ? target : qualifyEntityName(featureName, "screen", target);
 }
 
+function validateScreenNavTarget(
+  featureName: string,
+  screenId: string,
+  screenKind: string,
+  fieldName: string,
+  value: string,
+  allScreenQns: ReadonlySet<string>,
+  screens: FeatureDefinition["screens"],
+): void {
+  const candidateQn = resolveScreenTargetQn(featureName, value);
+  if (!allScreenQns.has(candidateQn)) {
+    throw new Error(
+      `[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${fieldName} "${value}" ` +
+        `does not resolve to a registered screen (checked "${candidateQn}"). Known screens ` +
+        `in this feature: ${[...Object.keys(screens)].sort().join(", ") || "(none)"}.`,
+    );
+  }
+}
+
 export function validateScreens(
   feature: FeatureDefinition,
   featureMap: ReadonlyMap<string, FeatureDefinition>,
@@ -554,26 +572,28 @@ export function validateScreens(
         // (`<feature>:screen:<id>`) — der Renderer strippt letztere beim
         // Navigieren auf die kurze ID (lastSegment), die der nav-Router
         // app-weit auflöst (#1946).
-        const candidateQn = resolveScreenTargetQn(feature.name, screen.redirect);
-        if (!allScreenQns.has(candidateQn)) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (actionForm) redirect "${screen.redirect}" ` +
-              `does not resolve to a registered screen (checked "${candidateQn}"). Known screens ` +
-              `in this feature: ${[...Object.keys(feature.screens)].sort().join(", ") || "(none)"}.`,
-          );
-        }
+        validateScreenNavTarget(
+          feature.name,
+          screenId,
+          "actionForm",
+          "redirect",
+          screen.redirect,
+          allScreenQns,
+          feature.screens,
+        );
       }
       if (typeof screen.cancelTarget === "string") {
         // Gleiche Regel wie redirect — `false` (kein Cancel-Button)
         // braucht keine Validierung.
-        const candidateQn = resolveScreenTargetQn(feature.name, screen.cancelTarget);
-        if (!allScreenQns.has(candidateQn)) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (actionForm) cancelTarget "${screen.cancelTarget}" ` +
-              `does not resolve to a registered screen (checked "${candidateQn}"). Known screens ` +
-              `in this feature: ${[...Object.keys(feature.screens)].sort().join(", ") || "(none)"}.`,
-          );
-        }
+        validateScreenNavTarget(
+          feature.name,
+          screenId,
+          "actionForm",
+          "cancelTarget",
+          screen.cancelTarget,
+          allScreenQns,
+          feature.screens,
+        );
       }
       continue;
     }
@@ -882,14 +902,15 @@ export function validateScreens(
       if (screen.redirect !== undefined) {
         // Same rule as actionForm's redirect: short screen-ID (same-feature)
         // or a fully-qualified cross-feature QN (#1946).
-        const candidateQn = resolveScreenTargetQn(feature.name, screen.redirect);
-        if (!allScreenQns.has(candidateQn)) {
-          throw new Error(
-            `[Feature ${feature.name}] Screen "${screenId}" (entityEdit) redirect "${screen.redirect}" ` +
-              `does not resolve to a registered screen (checked "${candidateQn}"). Known screens ` +
-              `in this feature: ${[...Object.keys(feature.screens)].sort().join(", ") || "(none)"}.`,
-          );
-        }
+        validateScreenNavTarget(
+          feature.name,
+          screenId,
+          "entityEdit",
+          "redirect",
+          screen.redirect,
+          allScreenQns,
+          feature.screens,
+        );
       }
     }
   }

package/src/engine/embedded-derived.ts

@@ -35,7 +35,14 @@ export type DerivedCellRoundingTarget = {
  *  stays unit-agnostic for those). */
 export function roundDerivedCellValue(value: number, target: DerivedCellRoundingTarget): number {
   if (target.type === "money") return roundHalfAwayFromZero(value, 0);
-  if (target.type === "decimal") return roundHalfAwayFromZero(value, target.scale ?? 0);
+  // `scale` is required on the real decimal EmbeddedSubFieldDef (fields.ts:
+  // "no silent default that could truncate") — DerivedCellRoundingTarget
+  // only widens it to optional for the money/decimal split above. If it's
+  // ever missing anyway, pass the value through unrounded rather than
+  // guessing 0 decimals and truncating a value the caller never asked to round.
+  if (target.type === "decimal") {
+    return target.scale === undefined ? value : roundHalfAwayFromZero(value, target.scale);
+  }
   return value;
 }
 
@@ -45,6 +52,7 @@ function roundHalfAwayFromZero(value: number, decimals: number): number {
   // === 100.49999999999999) before rounding, so a value that's
   // mathematically exactly at the half-step doesn't fall to the wrong side.
   // ponytail: toPrecision(15) can shift by ±1 minor unit for values near Number.MAX_SAFE_INTEGER (2^53); fine for realistic money amounts.
+  // ponytail: also snaps values within ~1e-16 of a half-step up (e.g. roundHalfAwayFromZero(0.49999999999999994, 0) === 1) — deliberate, the float-noise case is far more common than a genuine near-half input.
   const scaled = Number((Math.abs(value) * factor).toPrecision(15));
   return (Math.sign(value) * Math.round(scaled)) / factor;
 }

package/src/engine/schema-builder.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { toMinorUnits } from "../db/money";
+import { moneyPayloadToMinorUnits } from "../db/money";
 import { isValidIanaTimeZone } from "../time";
 import { assertUnreachable } from "../utils";
 import { withDerivedCells } from "./embedded-derived";
@@ -295,14 +295,14 @@ export function fieldToZod(
 // Runs via the same z.object().safeParse() call on both the client
 // (form-controller's runValidate) and the server (write handler) — one
 // mechanism, no separate client/server validation path to keep in sync.
-// ponytail: compares raw minor-unit amounts only, not currencies — a row
-// sum in the entity's default currency against a sibling amount tagged with
-// a different currency string still passes. Add a currency-equality check
-// here if multi-currency siblings become a real case.
+// Row cells have no currency of their own (they're minor units in the
+// entity's default currency); a sibling tagged with a different currency
+// fails the check even if the raw minor-unit amounts happen to match.
 //
 // Known limitation: compares against rounded `derived` cells, i.e.
 // "sum-of-rounded" not "round-of-sum" (kumiko-framework#1866). Follow-up
 // for a computed, read-only sibling total: kumiko-framework#1873.
+// kumiko-lint-ignore complexity-budget currency-equality check on sibling money payloads
 function applyTotalsMatchRefinements(
   entity: EntityDefinition,
   schema: z.ZodObject<Record<string, z.ZodTypeAny>>,
@@ -313,30 +313,40 @@ function applyTotalsMatchRefinements(
     const totalsMatch = field.totalsMatch;
     result = result.superRefine((values, ctx) => {
       for (const [subFieldName, siblingFieldName] of Object.entries(totalsMatch)) {
-        const rows = values[fieldName] as ReadonlyArray<Record<string, unknown>> | undefined;
+        const rawRows = values[fieldName];
         const siblingRaw = values[siblingFieldName];
         // Not sent -> not checkable, not an error (partial update payloads).
-        if (rows === undefined || siblingRaw === undefined) continue;
-        const siblingAmount =
-          typeof siblingRaw === "object" &&
-          siblingRaw !== null &&
-          "amount" in siblingRaw &&
-          typeof (siblingRaw as { amount: unknown }).amount === "number"
-            ? (siblingRaw as { amount: number }).amount
-            : typeof siblingRaw === "number"
-              ? siblingRaw
+        if (rawRows === undefined || siblingRaw === undefined) continue;
+        // Not an array -> a different refinement already rejects the shape;
+        // this check isn't the right place to report it.
+        if (!Array.isArray(rawRows)) continue;
+        const siblingMinor = moneyPayloadToMinorUnits(siblingRaw);
+        if (siblingMinor === undefined) continue;
+        const siblingCurrency =
+          typeof siblingRaw === "object" && siblingRaw !== null && "currency" in siblingRaw
+            ? (siblingRaw as { currency: unknown }).currency
+            : undefined;
+        const entityCurrency = entity.defaultCurrency ?? DEFAULT_CURRENCIES[0];
+        if (typeof siblingCurrency === "string" && siblingCurrency !== entityCurrency) {
+          ctx.addIssue({
+            code: "custom",
+            path: [siblingFieldName],
+            message: `"${siblingFieldName}" currency (${siblingCurrency}) does not match the entity's default currency (${entityCurrency}) that "${fieldName}" rows are summed in`,
+          });
+          continue;
+        }
+        const sumMinor = rawRows.reduce((total: number, row: unknown) => {
+          const value =
+            typeof row === "object" && row !== null
+              ? (row as Record<string, unknown>)[subFieldName]
               : undefined;
-        if (siblingAmount === undefined) continue;
-        const sumMinor = rows.reduce(
-          (total, row) =>
-            total + (typeof row[subFieldName] === "number" ? (row[subFieldName] as number) : 0),
-          0,
-        );
-        if (sumMinor !== toMinorUnits(siblingAmount)) {
+          return total + (typeof value === "number" ? value : 0);
+        }, 0);
+        if (sumMinor !== siblingMinor) {
           ctx.addIssue({
             code: "custom",
             path: [fieldName],
-            message: `Sum of "${subFieldName}" across "${fieldName}" (${sumMinor}) does not match "${siblingFieldName}" (${toMinorUnits(siblingAmount)})`,
+            message: `Sum of "${subFieldName}" across "${fieldName}" (${sumMinor}) does not match "${siblingFieldName}" (${siblingMinor})`,
           });
         }
       }

package/src/entrypoint/__tests__/split-deploy.integration.test.ts

@@ -66,8 +66,13 @@ const workerWriteFeature = defineFeature("workerWrite", (r) => {
 // The job-runner is built BEFORE the server, so it used to capture the raw
 // caller context — without the per-tenant file-provider resolver buildServer
 // wires onto it. An event-triggered job reaching for ctx.files then died in
-// the worker while the identical code worked on the request path.
-const jobSawFileResolver: string[] = [];
+// the worker while the identical code worked on the request path. Recording
+// `typeof ctx.files?.ref` (not the private `_fileProviderResolver` wire
+// field) pins the observable symptom: a usable ctx.files handle. `ref()`
+// itself stays lazy (file-handle.ts) — it never calls the resolver, which
+// this feature's provider intentionally throws in, so the assertion below
+// doesn't need a working provider to be meaningful.
+const jobSawFilesRef: string[] = [];
 
 const fileJobFeature = defineFeature("fileJob", (r) => {
   const requested = r.defineEvent("bytes-requested", z.object({ storageKey: z.string() }), {
@@ -84,7 +89,7 @@ const fileJobFeature = defineFeature("fileJob", (r) => {
     "read-bytes",
     { trigger: { on: requested.name }, runIn: "worker" },
     async (_payload, ctx) => {
-      jobSawFileResolver.push(typeof ctx._fileProviderResolver);
+      jobSawFilesRef.push(typeof ctx.files?.ref);
     },
   );
   // Worker mode refuses to boot without a consumer to drain.
@@ -176,7 +181,7 @@ describe("entrypoint factories", () => {
       queueNamePrefix: uniquePrefix("split-filejob"),
     });
 
-    jobSawFileResolver.length = 0;
+    jobSawFilesRef.length = 0;
     await worker.start();
     try {
       await worker.jobRunner.handleEvent(
@@ -184,8 +189,8 @@ describe("entrypoint factories", () => {
         { storageKey: "some/key.pdf" },
         TestUsers.admin,
       );
-      await waitForCondition(() => jobSawFileResolver.length > 0);
-      expect(jobSawFileResolver[0]).toBe("function");
+      await waitForCondition(() => jobSawFilesRef.length > 0);
+      expect(jobSawFilesRef[0]).toBe("function");
     } finally {
       await worker.stop();
     }
@@ -234,6 +239,32 @@ describe("entrypoint factories", () => {
     }
   });
 
+  test("All-in-one job-context also carries ctx.files, same fixture as the worker", async () => {
+    const registry = createRegistry([fileJobFeature]);
+    const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
+    const entry = createAllInOneEntrypoint({
+      registry,
+      context: { db: testDb.db, redis: testRedis.redis },
+      jwtSecret: JWT,
+      redisUrl,
+      queueNamePrefix: uniquePrefix("all-filejob"),
+    });
+
+    jobSawFilesRef.length = 0;
+    await entry.start();
+    try {
+      await entry.jobRunner.handleEvent(
+        "file-job:event:bytes-requested",
+        { storageKey: "some/key.pdf" },
+        TestUsers.admin,
+      );
+      await waitForCondition(() => jobSawFilesRef.length > 0);
+      expect(jobSawFilesRef[0]).toBe("function");
+    } finally {
+      await entry.stop();
+    }
+  });
+
   test("All-in-one entrypoint has both HTTP surface and background workers", async () => {
     const registry = createRegistry([splitFeature]);
     const redisUrl = process.env["REDIS_URL"] ?? "redis://localhost:16379";

package/src/errors/zod-bridge.ts

@@ -37,15 +37,10 @@ export function validationErrorFromZod(error: ZodError): ValidationError {
   return new ValidationError({ fields }, { cause: error });
 }
 
-// Every zod code maps mechanically to `errors.validation.<code>` — except
-// `code: "custom"`, which is zod's one-size-fits-all bucket for every
-// `superRefine`/`refine` check in the codebase (e.g. schema-builder.ts's
-// totalsMatch check). Left mechanical, ALL of them would collapse onto the
-// same `errors.validation.custom` ("Invalid value.") key. A `superRefine`
-// that needs its own key sets `params.i18nKey` on the issue; this is the one
-// place that honors it. Keep in sync with the client-side mirror
-// (packages/headless/src/form/zod-bridge.ts) — a superRefine can run on
-// either side.
+// `code: "custom"` is zod's catch-all for every superRefine/refine check;
+// left mechanical it'd collapse onto one generic key, so a superRefine can
+// set `params.i18nKey` to override it. Keep in sync with the client mirror
+// (packages/headless/src/form/zod-bridge.ts).
 function resolveI18nKey(issue: ZodIssue): string {
   if (issue.code === "custom") {
     const override = issue.params?.["i18nKey"];

package/src/event-store/__tests__/perf.integration.test.ts

@@ -12,17 +12,8 @@
 // latency, single-node PG. Production deploys are slower; these numbers
 // are the ceiling.
 //
-// Isolated from bulk integration via `bun run test:integration:perf`. Used
-// to run inside the `integration` CI job, right after the ~213-test bulk
-// suite, and flaked up to 3.4x under that (30-102ms vs the 25-30ms budgets
-// above, #1940). Moved to its own `event-store-perf` CI job
-// (test:integration:perf:eventstore) — but re-measuring against a fresh
-// container per run (mirroring that job) showed the real cause wasn't job
-// contention: p50 sits at 1-3ms in every run, and single-sample p99 spikes
-// to 47-73ms even fully isolated on an idle machine, from cold-Postgres
-// connection/cache warm-up. Gate switched from p99 (the single worst-of-200
-// sample) to p95 (drops the top 10), which absorbs that cold-start outlier
-// while still catching a real order-of-magnitude regression.
+// Runs isolated in the `event-store-perf` CI job (test:integration:perf:eventstore,
+// #1940) — see that job's comment in ci.yml for why the gate is p95 not p99.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";

package/src/files/file-routes.ts

@@ -4,7 +4,7 @@ import { getUser } from "../api/auth-middleware";
 import type { DbConnection } from "../db/connection";
 import { createEventStoreExecutor } from "../db/event-store-executor";
 import { createTenantDb } from "../db/tenant-db";
-import { createDerivativesContext, resolveFieldVariant } from "../derivatives";
+import { createDerivativesContext, resolveFieldVariant, resolveRenderer } from "../derivatives";
 import { isFileField, type Registry, type SessionUser, type TenantId } from "../engine/types";
 import { generateId } from "../utils";
 import { buildContentDispositionHeader } from "./content-disposition";
@@ -68,7 +68,7 @@ const DEFAULT_PRIVILEGED_ROLES = ["Admin", "SystemAdmin"] as const;
 
 // 15 minutes — long enough for a download to start, short enough that a
 // leaked URL (e.g. from a browser history screenshot) isn't a long-lived
-// credential. Matches the security-checklist in core-files.md.
+// credential (see "Signed-URL default expiry" in core-files.md).
 const SIGNED_URL_DEFAULT_EXPIRY_SECONDS = 15 * 60;
 
 // Default guard: on attached files, allow the uploader or a privileged role.
@@ -252,15 +252,23 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
     if (decision === "deny") return c.json({ error: "not_found" }, 404);
 
     // An unknown name and a denied file answer alike, so the route never
-    // confirms what exists. A missing renderer is NOT folded in here — that
-    // throws out of variant() as a 500, because a mount gap is a config
-    // error, not a missing variant.
+    // confirms what exists.
     const registry = options.registry;
     const spec = registry
       ? resolveFieldVariant(registry, fileRef.entityType, fileRef.fieldName, name)
       : undefined;
     if (!registry || !spec) return c.json({ error: "not_found" }, 404);
 
+    // The file's mimeType comes from the upload (`file.type`) — validateFile
+    // only checks it against the field's `accept` when the field declares
+    // one, so a field without `accept` lets a client upload anything and
+    // then request /variant/*. Without this check, derivatives.variant()
+    // throws for an unsupported source mimeType — an uncaught 500 whose
+    // message lists every registered renderer's extension name.
+    if (!resolveRenderer(registry, fileRef.mimeType)) {
+      return c.json({ error: "unsupported_media_type" }, 415);
+    }
+
     // Built per request: createFileContext caches the resolved provider, so
     // one shared across requests would serve tenant A's store to tenant B.
     const files = createFileContext(() => options.resolveProvider(user.tenantId));
@@ -274,8 +282,14 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
     const data = await files.ref(result.storageKey).read();
     // No Content-Length/Content-Disposition: fileRef.size is the ORIGINAL's
     // size, and a variant is rendered for display, not for download.
+    // storageKey embeds specHash(spec), so the URL is content-stable until
+    // the spec changes — safe to cache. "private" because the response sits
+    // behind the tenant + guard gate above, not a shared CDN-cacheable asset.
     return new Response(Buffer.from(data), {
-      headers: { "Content-Type": result.mimeType },
+      headers: {
+        "Content-Type": result.mimeType,
+        "Cache-Control": "private, max-age=31536000, immutable",
+      },
     });
   });