@cosmicdrift/kumiko-framework 0.220.1 → 0.222.0

package/src/db/queries/seed-context.ts

@@ -1,5 +1,5 @@
 import type { AnyDb } from "../query";
-import { asRawClient } from "../query";
+import { unsafeReadRetrying } from "../query";
 
 export type SeedUserRow = {
   readonly id: string;
@@ -21,7 +21,8 @@ export type SeedTenantDbRow = {
 };
 
 export async function selectUserByEmail(db: AnyDb, email: string): Promise<SeedUserRow | null> {
-  const rows = (await asRawClient(db).unsafe(
+  const rows = (await unsafeReadRetrying(
+    db,
     `SELECT id::text AS id, email, tenant_id::text AS tenant_id
      FROM read_users
      WHERE email = $1
@@ -37,7 +38,8 @@ export async function selectMembershipsOfUser(
   db: AnyDb,
   userId: string,
 ): Promise<readonly SeedMembershipDbRow[]> {
-  return (await asRawClient(db).unsafe(
+  return (await unsafeReadRetrying(
+    db,
     `SELECT m.user_id::text AS user_id,
             m.tenant_id::text AS tenant_id,
             e.tenant_id::text AS stream_tenant_id,
@@ -50,9 +52,11 @@ export async function selectMembershipsOfUser(
 }
 
 export async function selectAllTenants(db: AnyDb): Promise<readonly SeedTenantDbRow[]> {
-  return (await asRawClient(db).unsafe(
+  return (await unsafeReadRetrying(
+    db,
     `SELECT id::text AS id, name, key AS tenant_key
      FROM read_tenants
      ORDER BY inserted_at`,
+    [],
   )) as readonly SeedTenantDbRow[];
 }

package/src/db/table-builder.ts

@@ -583,10 +583,17 @@ export function buildEntityTable<E extends EntityDefinition>(
               .map((c) => tHandle[c])
               .filter((col): col is ColumnHandle => col !== undefined);
             if (bidxCols.length === bidxFieldNames.length) {
-              const whereText = bidxFieldNames
+              const notNullParts = bidxFieldNames
                 .filter((c, i) => c !== def.columns[i])
-                .map((c) => `"${toSnakeCase(c)}" IS NOT NULL`)
-                .join(" AND ");
+                .map((c) => `"${toSnakeCase(c)}" IS NOT NULL`);
+              // Soft-deleted rows keep their bidx hash — without this, a
+              // restored row can't reuse a value a soft-deleted sibling still
+              // holds (framework#2464).
+              const whereText = (
+                entity.softDelete === true
+                  ? [...notNullParts, `"is_deleted" = false`]
+                  : notNullParts
+              ).join(" AND ");
               const partialWhere: SqlExpression = {
                 kind: "sql-expr",
                 text: whereText,

package/src/derivatives/__tests__/variant-key.test.ts

@@ -1,5 +1,13 @@
 import { describe, expect, test } from "bun:test";
-import { specHash, variantSuffix } from "../variant-key";
+import { deriveKey } from "../../files/file-handle";
+import { buildStorageKey } from "../../files/types";
+import {
+  derivativeListPrefix,
+  isDerivativeKeyOf,
+  parseDerivativeKey,
+  specHash,
+  variantSuffix,
+} from "../variant-key";
 
 describe("specHash — key stability", () => {
   test("key order doesn't matter", () => {
@@ -59,3 +67,117 @@ describe("variantSuffix", () => {
     expect(() => variantSuffix("Hero", {})).not.toThrow();
   });
 });
+
+// These pin the grammar `isDerivativeKeyOf`/`derivativeListPrefix` use to
+// recognize forget/tenant-destroy erasure targets — real deriveKey() output,
+// not a hand-rolled key shape, so a drift in deriveKey's own splitting logic
+// would show up here too.
+describe("derivativeListPrefix + isDerivativeKeyOf — real deriveKey() output", () => {
+  const original = "tenant/photo.jpg";
+  const suffix = variantSuffix("thumb", { maxEdge: 512 });
+  const derived = deriveKey(original, suffix);
+
+  test("deriveKey's own output matches isDerivativeKeyOf for its original", () => {
+    expect(isDerivativeKeyOf(original, derived)).toBe(true);
+  });
+
+  test("derivativeListPrefix is a prefix of every derivative deriveKey() produces", () => {
+    expect(derived.startsWith(derivativeListPrefix(original))).toBe(true);
+  });
+
+  test("the original key is not its own derivative", () => {
+    expect(isDerivativeKeyOf(original, original)).toBe(false);
+  });
+
+  test("a same-directory sibling original with a DIFFERENT extension is not a derivative", () => {
+    // Same base ("tenant/photo"), so it shares derivativeListPrefix — the
+    // extension anchor is what must reject it, or a forget/tenant-destroy
+    // prefix-delete would sweep up a different file (possibly another
+    // user's) alongside the intended derivatives.
+    expect(isDerivativeKeyOf(original, "tenant/photo.png")).toBe(false);
+    expect(isDerivativeKeyOf(original, "tenant/photo.other-1234567890abcdef.png")).toBe(false);
+  });
+
+  test("an unrelated key under the same directory is not a derivative", () => {
+    expect(isDerivativeKeyOf(original, "tenant/other-file.jpg")).toBe(false);
+  });
+
+  test("a key with the right prefix/ext but no valid <name>-<hash> middle is not a derivative", () => {
+    expect(isDerivativeKeyOf(original, "tenant/photo.old.jpg")).toBe(false);
+    expect(isDerivativeKeyOf(original, "tenant/photo.jpg")).toBe(false);
+  });
+
+  test("extension-less original: derivatives have no trailing extension either", () => {
+    const noExtOriginal = "tenant/document";
+    const noExtSuffix = variantSuffix("preview", { maxEdge: 256 });
+    const noExtDerived = deriveKey(noExtOriginal, noExtSuffix);
+    expect(isDerivativeKeyOf(noExtOriginal, noExtDerived)).toBe(true);
+    expect(derivativeListPrefix(noExtOriginal)).toBe("tenant/document.");
+  });
+
+  test("multiple variants of the same original all match", () => {
+    const cardSuffix = variantSuffix("card", { maxEdge: 1024 });
+    const cardDerived = deriveKey(original, cardSuffix);
+    expect(isDerivativeKeyOf(original, cardDerived)).toBe(true);
+    expect(isDerivativeKeyOf(original, derived)).toBe(true);
+  });
+});
+
+// parseDerivativeKey powers the orphaned-derivative backfill/GC sweep
+// (#2474), which has no audit trail of past forgets to work from — it can
+// only trust the deterministic key grammar itself. Real buildStorageKey() +
+// deriveKey() output, not a hand-rolled key shape.
+describe("parseDerivativeKey — reverse of deriveKey", () => {
+  const original = buildStorageKey(
+    "tenant-1" as never,
+    "fileRef",
+    "42",
+    "attachment",
+    "photo.jpg",
+    "uid123",
+  );
+  const suffix = variantSuffix("thumb", { maxEdge: 512 });
+  const derived = deriveKey(original, suffix);
+
+  test("reconstructs the exact original a real derivative was built from", () => {
+    expect(parseDerivativeKey(derived)).toEqual({ originalKey: original });
+  });
+
+  test("a plain original (no derivative suffix) is not derivative-shaped", () => {
+    expect(parseDerivativeKey(original)).toBeNull();
+  });
+
+  test("a key with no dot at all is not derivative-shaped", () => {
+    expect(parseDerivativeKey("tenant-1/fileRef/42/attachment/uid123")).toBeNull();
+  });
+
+  test("a multi-dot ORIGINAL filename still round-trips", () => {
+    const multiDotOriginal = buildStorageKey(
+      "tenant-1" as never,
+      "fileRef",
+      "42",
+      "attachment",
+      "my.file.name.jpg",
+      "uid456",
+    );
+    const multiDotDerived = deriveKey(multiDotOriginal, suffix);
+    expect(parseDerivativeKey(multiDotDerived)).toEqual({ originalKey: multiDotOriginal });
+  });
+
+  // Blind spot the reverse-parse must guard against on its own (no DB
+  // cross-check happens inside parseDerivativeKey itself): a lookalike key
+  // that was never written by buildStorageKey — e.g. a GDPR export bundle —
+  // can still have a last segment shaped like "<name>-<16hex>.<ext>" if its
+  // filename happens to contain a hyphen+16-hex-char run. Anchoring the
+  // reconstructed original to buildStorageKey's own 5-segment/single-dot
+  // shape rejects it even though the suffix pattern alone would match.
+  test("a non-buildStorageKey lookalike with a derivative-shaped suffix is rejected", () => {
+    const lookalike = "tenant-1/gdpr-export-bundle.snapshot-0123456789abcdef.zip";
+    expect(parseDerivativeKey(lookalike)).toBeNull();
+  });
+
+  test("a suffix that doesn't match <name>-<16hex> is rejected", () => {
+    const notAHash = deriveKey(original, "thumb-notahexvalue");
+    expect(parseDerivativeKey(notAHash)).toBeNull();
+  });
+});

package/src/derivatives/__tests__/variant-route.integration.test.ts

@@ -103,6 +103,9 @@ describe("GET /api/files/:id/variant/:name", () => {
     expect(res.headers.get("Content-Type")).toBe("image/webp");
     expect(res.headers.get("Cache-Control")).toBe("private, max-age=31536000, immutable");
     expect(new Uint8Array(await res.arrayBuffer())).toEqual(VARIANT_BYTES);
+    // fw#2442 — variant responses never derive from fileRef.fileName, so
+    // there is no Content-Disposition here for a field-encrypted name to leak into.
+    expect(res.headers.get("Content-Disposition")).toBeNull();
   });
 
   // setupTestStack doesn't wrap with the app-wide security-headers default, so a pass proves the route sets its own.

package/src/derivatives/derivatives-context.ts

@@ -155,6 +155,10 @@ export function createDerivativesContext(deps: DerivativesContextDeps): Derivati
       assertSafeStorageKey(target.key);
       const mimeType = outputMimeType(spec, row.mimeType);
 
+      // ponytail: exists→render→write is a TOCTOU window under concurrent
+      // requests for the same variant (duplicate render + write). Ceiling:
+      // non-atomic providers can briefly expose a half-written object as a
+      // cache hit. Upgrade: write to a temp key then atomic rename/copy.
       if (await target.exists()) {
         return {
           storageKey: target.key,

package/src/derivatives/index.ts

@@ -1,4 +1,12 @@
 export type { DerivativesContextDeps } from "./derivatives-context";
 export { createDerivativesContext, resolveRenderer } from "./derivatives-context";
 export { resolveFieldVariant } from "./field-variants";
-export { canonicalJson, specHash, VARIANT_NAME_PATTERN, variantSuffix } from "./variant-key";
+export {
+  canonicalJson,
+  derivativeListPrefix,
+  isDerivativeKeyOf,
+  parseDerivativeKey,
+  specHash,
+  VARIANT_NAME_PATTERN,
+  variantSuffix,
+} from "./variant-key";

package/src/derivatives/variant-key.ts

@@ -38,3 +38,71 @@ export function variantSuffix(name: string, spec: VariantSpec): string {
   }
   return `${name}-${specHash(spec)}`;
 }
+
+// A full derivative-suffix segment is `<name>-<16 hex chars>` — mirrors
+// VARIANT_NAME_PATTERN (name grammar) + specHash's fixed 16-char slice.
+// Keep in sync with both if either changes.
+const DERIVATIVE_SUFFIX_PATTERN = /^[a-z0-9][a-z0-9-]{0,31}-[0-9a-f]{16}$/i;
+
+// Mirrors deriveKey's own split so callers get the exact same base/ext this
+// key's derivatives were built from.
+function splitKey(key: string): { readonly base: string; readonly ext: string } {
+  const lastSlash = key.lastIndexOf("/");
+  const lastSegment = lastSlash === -1 ? key : key.slice(lastSlash + 1);
+  const lastDot = lastSegment.lastIndexOf(".");
+  if (lastDot === -1) return { base: key, ext: "" };
+  const base = key.slice(0, key.length - lastSegment.length + lastDot);
+  return { base, ext: lastSegment.slice(lastDot) };
+}
+
+// List-prefix that covers every derivative deriveKey() can produce for
+// `originalKey` — pass to FileStorageProvider.list() to enumerate candidates,
+// then filter with isDerivativeKeyOf before deleting any of them.
+export function derivativeListPrefix(originalKey: string): string {
+  return `${splitKey(originalKey).base}.`;
+}
+
+// True when `candidateKey` is a derivative deriveKey() could have produced
+// for `originalKey` — anchored to originalKey's own basename AND extension.
+// Without the extension anchor, a same-directory sibling original with a
+// different extension (a different file, possibly another user's) would
+// match on prefix alone and get swept into a forget/tenant-destroy delete.
+export function isDerivativeKeyOf(originalKey: string, candidateKey: string): boolean {
+  const { base, ext } = splitKey(originalKey);
+  const prefix = `${base}.`;
+  if (!candidateKey.startsWith(prefix) || !candidateKey.endsWith(ext)) return false;
+  const middle = candidateKey.slice(prefix.length, candidateKey.length - ext.length);
+  return DERIVATIVE_SUFFIX_PATTERN.test(middle);
+}
+
+// buildStorageKey (files/types.ts) always produces exactly 5 "/"-segments
+// ending in "<uniqueId>.<ext>" — a single dot, non-empty on both sides.
+// Anchoring parseDerivativeKey's reconstructed candidate to this shape
+// rejects lookalikes that were never written by buildStorageKey (a GDPR
+// export bundle, a local-provider `*.tmp` write-in-progress file) even when
+// their last segment happens to contain a "name-16hex"-shaped middle token.
+const BUILT_STORAGE_KEY_LAST_SEGMENT_PATTERN = /^[^./]+\.[^./]+$/;
+
+function looksLikeBuiltStorageKey(key: string): boolean {
+  const segments = key.split("/");
+  if (segments.length !== 5) return false;
+  return BUILT_STORAGE_KEY_LAST_SEGMENT_PATTERN.test(segments[4] ?? "");
+}
+
+// Reverse of deriveKey: given a key found on a full storage listing, guesses
+// the original key it would be a derivative of. Used by the orphaned-
+// derivative backfill/GC sweep, which has no audit trail of past forgets to
+// work from — only the deterministic key grammar itself. Returns null for
+// anything that isn't derivative-shaped (including a plain original, which
+// splits with no second dot) or whose reconstructed original doesn't match
+// buildStorageKey's own shape.
+export function parseDerivativeKey(candidateKey: string): { readonly originalKey: string } | null {
+  const { base: withSuffix, ext } = splitKey(candidateKey);
+  const { base: outerBase, ext: suffixExt } = splitKey(withSuffix);
+  if (suffixExt === "") return null;
+  const suffixCandidate = suffixExt.slice(1);
+  if (!DERIVATIVE_SUFFIX_PATTERN.test(suffixCandidate)) return null;
+  const originalKey = `${outerBase}${ext}`;
+  if (!looksLikeBuiltStorageKey(originalKey)) return null;
+  return { originalKey };
+}

package/src/engine/__tests__/boot-validator-pii-retention.test.ts

@@ -700,7 +700,7 @@ describe("validateBoot — retention", () => {
     expect(matchingWarn).toBeUndefined();
   });
 
-  test("blockDelete with only a subjectRef-only field and no anonymize stays silent (#1645, narrowed by #2336)", () => {
+  test("blockDelete with only a subjectRef-only field warns about EXT_USER_DATA delete hook (#2338)", () => {
     const feature = defineFeature("test", (r) => {
       r.entity(
         "lease",
@@ -715,36 +715,42 @@ describe("validateBoot — retention", () => {
       );
     });
     validateBoot([feature]);
-    const matchingWarn = warnSpy.mock.calls.find((args: unknown[]) =>
+    const anonymizeWarn = warnSpy.mock.calls.find((args: unknown[]) =>
       String(args[0]).includes('strategy="blockDelete" but no field has an anonymize-function'),
     );
-    expect(matchingWarn).toBeUndefined();
+    expect(anonymizeWarn).toBeUndefined();
+    const extWarn = warnSpy.mock.calls.find((args: unknown[]) =>
+      String(args[0]).includes("EXT_USER_DATA delete hook for Art.17"),
+    );
+    expect(extWarn).toBeDefined();
   });
 
-  test("blockDelete with a subjectRef field plus an anonymizable subject field and no anonymize still warns (#2336)", () => {
-    const feature = defineFeature("test", (r) => {
-      r.entity(
-        "lease",
-        createEntity({
-          fields: {
-            authorId: createTextField({
-              personal: "ref",
-            }),
-            customerName: createTextField({
-              personal: "self",
-              find: "none",
-            }),
-          },
-          retention: { keepFor: "10y", strategy: "blockDelete" },
-        }),
+  test.each([
+    ["self", { personal: "self" as const, find: "none" as const }],
+    ["userOwned", { personal: { of: "authorId" } as const, find: "none" as const }],
+    ["tenantOwned", { personal: "tenant" as const, find: "none" as const }],
+  ])(
+    "blockDelete warns when subjectRef coexists with anonymizable %s field (#2336)",
+    (_label, personal) => {
+      const feature = defineFeature("test", (r) => {
+        r.entity(
+          "lease",
+          createEntity({
+            fields: {
+              authorId: createTextField({ personal: "ref" }),
+              subjectField: createTextField(personal),
+            },
+            retention: { keepFor: "10y", strategy: "blockDelete" },
+          }),
+        );
+      });
+      validateBoot([feature]);
+      const matchingWarn = warnSpy.mock.calls.find((args: unknown[]) =>
+        String(args[0]).includes('strategy="blockDelete" but no field has an anonymize-function'),
       );
-    });
-    validateBoot([feature]);
-    const matchingWarn = warnSpy.mock.calls.find((args: unknown[]) =>
-      String(args[0]).includes('strategy="blockDelete" but no field has an anonymize-function'),
-    );
-    expect(matchingWarn).toBeDefined();
-  });
+      expect(matchingWarn).toBeDefined();
+    },
+  );
 
   test('retention.keepFor with invalid format "30days" warns', () => {
     const feature = defineFeature("test", (r) => {

package/src/engine/__tests__/boot-validator.test.ts

@@ -2264,6 +2264,8 @@ describe("boot-validator", () => {
         readonly fields: readonly string[];
       }>;
       readonly configKeys?: Readonly<Record<string, string>>;
+      readonly mode?: "single" | "wizard";
+      readonly draft?: boolean;
     };
 
     function makeFeature(override: ConfigEditOverride = {}) {
@@ -2291,7 +2293,11 @@ describe("boot-validator", () => {
           scope: "tenant",
           configKeys,
           fields: fields as never,
-          layout: { sections: sections as never },
+          layout: {
+            sections: sections as never,
+            ...(override.mode !== undefined ? { mode: override.mode } : {}),
+            ...(override.draft !== undefined ? { draft: override.draft } : {}),
+          },
         });
       });
     }
@@ -2383,6 +2389,26 @@ describe("boot-validator", () => {
       const section = { kind: "extension", title: "Custom", component: { react: "Panel" } };
       expect(() => validateBoot([makeFeature({ sections: [section] as never })])).not.toThrow();
     });
+    test("mode: wizard mit nur 1 Section → Throw", () => {
+      expect(() =>
+        validateBoot([
+          makeFeature({
+            mode: "wizard",
+            sections: [{ title: "Basics", fields: ["siteName"] }],
+          }),
+        ]),
+      ).toThrow(/\(configEdit\).*mode: "wizard" but only 1 section\(s\)/);
+    });
+
+    test("draft: true ohne gemountetes form-draft-Feature → Throw", () => {
+      const sections = [
+        { title: "Step 1", fields: ["siteName"] },
+        { title: "Step 2", fields: ["maxUploadMb"] },
+      ];
+      expect(() => validateBoot([makeFeature({ mode: "wizard", sections, draft: true })])).toThrow(
+        /"form-draft" is not mounted/,
+      );
+    });
   });
 
   // --- entityEdit extension section ---
@@ -3245,7 +3271,7 @@ describe("boot-validator", () => {
               label: "actions.view",
               screen: "product-detail",
               entity: "product",
-            },
+            } as never,
           ],
         });
         r.screen({
@@ -3268,7 +3294,7 @@ describe("boot-validator", () => {
           type: "entityList",
           entity: "product",
           columns: ["name"],
-          rowActions: [{ kind: "navigate", id: "view", label: "actions.view" }],
+          rowActions: [{ kind: "navigate", id: "view", label: "actions.view" } as never],
         });
       });
       expect(() => validateBoot([feature])).toThrow(

package/src/engine/__tests__/role-assignment.test.ts

@@ -1,35 +1,39 @@
 import { describe, expect, test } from "bun:test";
 import { findForbiddenRoleAssignment } from "../role-assignment";
 
+// Mirror DEFAULT_INVITE_ROLE_OPTIONS — framework must not import bundled-features
+// (tsc pulls source into framework's rootDir and fails the package build).
+const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin", "TenantAdmin"] as const;
+
 describe("role assignment guard", () => {
   test("rejects roles above the actor's highest role", () => {
-    expect(findForbiddenRoleAssignment(["Admin"], ["User", "TenantAdmin"])).toBe("TenantAdmin");
-    expect(findForbiddenRoleAssignment(["TenantAdmin"], ["SystemAdmin"])).toBe("SystemAdmin");
+    expect(findForbiddenRoleAssignment(["Admin"], ["User", "TenantAdmin"], [])).toBe("TenantAdmin");
+    expect(findForbiddenRoleAssignment(["TenantAdmin"], ["SystemAdmin"], [])).toBe("SystemAdmin");
   });
 
   test("allows equal or lower roles, including self-updates", () => {
-    expect(findForbiddenRoleAssignment(["Admin"], ["User", "Admin"])).toBeUndefined();
-    expect(findForbiddenRoleAssignment(["Admin"], ["Editor"])).toBeUndefined();
-    expect(findForbiddenRoleAssignment(["Editor"], ["User", "Editor"])).toBeUndefined();
-    expect(findForbiddenRoleAssignment(["TenantAdmin"], ["User", "Admin"])).toBeUndefined();
-    expect(findForbiddenRoleAssignment(["Admin"], ["Admin"])).toBeUndefined();
-    expect(findForbiddenRoleAssignment(["SystemAdmin"], ["SystemAdmin"])).toBeUndefined();
-    expect(findForbiddenRoleAssignment(["system"], ["SystemAdmin"])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["Admin"], ["User", "Admin"], [])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["Admin"], ["Editor"], [])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["Editor"], ["User", "Editor"], [])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["TenantAdmin"], ["User", "Admin"], [])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["Admin"], ["Admin"], [])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["SystemAdmin"], ["SystemAdmin"], [])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["system"], ["SystemAdmin"], [])).toBeUndefined();
   });
 
   test("rejects Editor above User, Admin above Editor", () => {
-    expect(findForbiddenRoleAssignment(["User"], ["Editor"])).toBe("Editor");
-    expect(findForbiddenRoleAssignment(["Editor"], ["Admin"])).toBe("Admin");
+    expect(findForbiddenRoleAssignment(["User"], ["Editor"], [])).toBe("Editor");
+    expect(findForbiddenRoleAssignment(["Editor"], ["Admin"], [])).toBe("Admin");
   });
 
   test("rejects unknown roles (fail-closed)", () => {
-    expect(findForbiddenRoleAssignment(["User"], ["Custom"])).toBe("Custom");
-    expect(findForbiddenRoleAssignment(["SystemAdmin"], ["Custom"])).toBe("Custom");
+    expect(findForbiddenRoleAssignment(["User"], ["Custom"], [])).toBe("Custom");
+    expect(findForbiddenRoleAssignment(["SystemAdmin"], ["Custom"], [])).toBe("Custom");
   });
 
   test("rejects assignment if actor has no roles or only unknown roles", () => {
-    expect(findForbiddenRoleAssignment([], ["User"])).toBe("User");
-    expect(findForbiddenRoleAssignment(["UnknownRole"], ["User"])).toBe("User");
+    expect(findForbiddenRoleAssignment([], ["User"], [])).toBe("User");
+    expect(findForbiddenRoleAssignment(["UnknownRole"], ["User"], [])).toBe("User");
   });
 
   test("rejects modifying target user with higher existing role", () => {
@@ -41,7 +45,27 @@ describe("role assignment guard", () => {
     // Editor is ranked (invite options); use a true app-defined role here.
     expect(findForbiddenRoleAssignment(["TenantAdmin"], ["User"], ["Billing"])).toBeUndefined();
     expect(findForbiddenRoleAssignment(["Admin"], ["User"], ["Billing", "User"])).toBeUndefined();
-    // Still cannot assign the unranked role on the write path (fail-closed).
-    expect(findForbiddenRoleAssignment(["TenantAdmin"], ["Billing"], ["Billing"])).toBe("Billing");
+    // Cannot introduce a *new* unranked role (fail-closed).
+    expect(findForbiddenRoleAssignment(["TenantAdmin"], ["Billing"], [])).toBe("Billing");
+    // Round-trip: strip then re-assign an unranked role the target already had.
+    expect(findForbiddenRoleAssignment(["TenantAdmin"], ["Billing"], ["Billing"])).toBeUndefined();
+    expect(
+      findForbiddenRoleAssignment(["TenantAdmin"], ["User", "Billing"], ["Billing"]),
+    ).toBeUndefined();
+  });
+
+  test("prototype-polluting role names do not bypass the guard", () => {
+    expect(findForbiddenRoleAssignment(["constructor"], ["SystemAdmin"], [])).toBe("SystemAdmin");
+    expect(findForbiddenRoleAssignment(["SystemAdmin"], ["toString"], [])).toBe("toString");
+  });
+
+  test("empty-string role is forbidden (not truthiness-skipped)", () => {
+    expect(findForbiddenRoleAssignment(["Admin"], [""], [])).toBe("");
+  });
+
+  test("TenantAdmin can assign every default invite role", () => {
+    for (const role of DEFAULT_INVITE_ROLE_OPTIONS) {
+      expect(findForbiddenRoleAssignment(["TenantAdmin"], [role], [])).toBeUndefined();
+    }
   });
 });

package/src/engine/__tests__/schema-builder.test.ts

@@ -719,9 +719,9 @@ describe("totalsMatch (fw#1839)", () => {
     }
   });
 
-  test("update payload omitting the embedded list is not checked (nothing to sum)", () => {
+  test("update payload omitting the embedded list is rejected (totalsMatch pair incomplete)", () => {
     const schema = buildUpdateSchema(invoiceEntity());
-    expect(schema.safeParse({ total: { amount: 30, currency: "EUR" } }).success).toBe(true);
+    expect(schema.safeParse({ total: { amount: 30, currency: "EUR" } }).success).toBe(false);
   });
 
   // kumiko-framework#1972: a round total (30 EUR = 3000 minor) still passes
@@ -753,9 +753,9 @@ describe("totalsMatch (fw#1839)", () => {
     }
   });
 
-  test("update payload omitting the sibling total is not checked (nothing to compare against)", () => {
+  test("update payload omitting the sibling total is rejected (totalsMatch pair incomplete)", () => {
     const schema = buildUpdateSchema(invoiceEntity());
-    expect(schema.safeParse({ lines: [{ amount: 1000 }, { amount: 1500 }] }).success).toBe(true);
+    expect(schema.safeParse({ lines: [{ amount: 1000 }, { amount: 1500 }] }).success).toBe(false);
   });
 
   test("rejects a sibling total tagged with a currency other than the entity's default, even when the raw minor-unit amounts match", () => {
@@ -1019,7 +1019,7 @@ describe("embedded-list derived cell recomputation (kumiko-framework#1837)", ()
     const schema = buildInsertSchema(entity);
     // Each source is in-scale for its own scale-3 field, but the sum
     // (0.333) has 3 decimal digits — over-scale for the scale-2 target
-    // without the rounding this PR added.
+    // without the rounding from #1867 (roundDerivedCellValue).
     const result = schema.safeParse({ lines: [{ a: 0.111, b: 0.111, c: 0.111 }] });
     expect(result.success).toBe(true);
     if (result.success) {
@@ -1043,8 +1043,8 @@ describe("embedded-list derived cell recomputation (kumiko-framework#1837)", ()
       },
     });
     const schema = buildInsertSchema(entity);
-    // 2400.58 - 93 = 2307.58 minor units — not representable by money's
-    // integer constraint without rounding.
+    // 2400.58 - 93 = 2307.58 major units — not representable by money's
+    // integer minor-unit constraint without rounding (#1867).
     const result = schema.safeParse({ lines: [{ gross: 2400.58, refund: 93 }] });
     expect(result.success).toBe(true);
     if (result.success) {