@cosmicdrift/kumiko-framework 0.328.0 → 0.329.0

package/src/files/__tests__/files.integration.test.ts

@@ -1,1749 +0,0 @@
-import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
-import { mkdtemp, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import type { Hono } from "hono";
-import type { JwtHelper } from "../../api/jwt";
-import { buildServer } from "../../api/server";
-import { configurePiiSubjectKms, InMemoryKmsAdapter } from "../../crypto";
-import {
-  createEntity,
-  createFileField,
-  createImageField,
-  createRegistry,
-  createTextField,
-  defineFeature,
-  type SessionUser,
-} from "../../engine";
-import { loadAggregate } from "../../event-store";
-import {
-  createTestDb,
-  createTestUser,
-  type TestDb,
-  TestUsers,
-  unsafeCreateEntityTable,
-  unsafePushTables,
-} from "../../stack";
-import {
-  buildMultipartBody,
-  expectErrorIncludes,
-  patchFileInstanceofForBunTest,
-  resetPiiSubjectKmsForTests,
-} from "../../testing";
-import { createFilesFeature } from "../feature";
-import { fileRefsTable } from "../file-ref-table";
-import type { FileRoutesOptions } from "../file-routes";
-import { createInMemoryFileProvider, type InMemoryFileProvider } from "../in-memory-provider";
-import { createLocalProvider } from "../local-provider";
-import type { FileStorageProvider, SignedUrlOptions } from "../types";
-import {
-  parseMaxSize,
-  resolveUploadMimeType,
-  sniffMimeType,
-  validateFile,
-  validateFileContent,
-} from "../types";
-
-// UUID for "this row doesn't exist" assertions. Valid v4 format so PG accepts
-// the query — the row just isn't there. Pre-v1 files-feature tests used
-// `99999` which Postgres now rejects with an invalid-uuid error.
-const NONEXISTENT_UUID = "00000000-0000-4000-8000-999999999999";
-
-// --- Setup ---
-
-let testDb: TestDb;
-let app: Hono;
-let jwt: JwtHelper;
-let storagePath: string;
-
-const adminUser = TestUsers.admin;
-const otherTenantUser = createTestUser({ id: 2, tenantId: "00000000-0000-4000-8000-000000000002" });
-const JWT_SECRET = "files-test-secret-at-least-32-characters!!";
-
-// A tenant feature with a logo field
-const testTenantEntity = createEntity({
-  table: "test_tenants",
-  fields: {
-    name: createTextField({ personal: false, reason: "test_fixture", required: true }),
-    logo: createImageField({ maxSize: "2mb", accept: ["png", "jpg"] }),
-    strictLogo: createImageField({ maxSize: "2mb", accept: ["jpg"] }),
-    importFile: createFileField({ maxSize: "2mb", accept: ["csv"] }),
-  },
-});
-
-const tenantFeature = defineFeature("tenant", (r) => {
-  r.entity("tenant", testTenantEntity);
-});
-
-beforeAll(async () => {
-  // Bun v1.3.x bun:test: Hono's parseBody() returns cross-realm Blob objects
-  // that fail `instanceof File`. Patch File[Symbol.hasInstance] with duck-typing.
-  patchFileInstanceofForBunTest();
-
-  testDb = await createTestDb();
-  storagePath = await mkdtemp(join(tmpdir(), "kumiko-files-test-"));
-
-  // Create tables
-  await unsafePushTables(testDb.db, { fileRefsTable });
-  await unsafeCreateEntityTable(testDb.db, testTenantEntity);
-  // Event-store table: the upload route appends files:event:uploaded in the
-  // same tx as the FileRef insert. Without events, upload would 500.
-
-  const registry = createRegistry([tenantFeature]);
-  const storageProvider = createLocalProvider(storagePath);
-
-  const server = buildServer({
-    registry,
-    context: { db: testDb.db, _fileProviderResolver: () => Promise.resolve(storageProvider) },
-    jwtSecret: JWT_SECRET,
-  });
-  app = server.app;
-  jwt = server.jwt;
-});
-
-afterAll(async () => {
-  await testDb.cleanup();
-  await rm(storagePath, { recursive: true, force: true });
-});
-
-// --- Helpers ---
-
-async function uploadFile(
-  user: SessionUser,
-  fileName: string,
-  content: Uint8Array,
-  mimeType: string,
-  extra?: Record<string, string>,
-): Promise<Response> {
-  const token = await jwt.sign(user);
-  const formData = new FormData();
-  formData.append("file", new File([Buffer.from(content)], fileName, { type: mimeType }));
-  if (extra) {
-    for (const [k, v] of Object.entries(extra)) {
-      formData.append(k, v);
-    }
-  }
-  const { body, contentType } = await buildMultipartBody(formData);
-  return app.request("/api/files", {
-    method: "POST",
-    headers: { Authorization: `Bearer ${token}`, "Content-Type": contentType },
-    body,
-  });
-}
-
-async function getFile(user: SessionUser, fileId: string): Promise<Response> {
-  const token = await jwt.sign(user);
-  return app.request(`/api/files/${fileId}`, {
-    method: "GET",
-    headers: { Authorization: `Bearer ${token}` },
-  });
-}
-
-async function getFileMeta(user: SessionUser, fileId: string): Promise<Response> {
-  const token = await jwt.sign(user);
-  return app.request(`/api/files/${fileId}/meta`, {
-    method: "GET",
-    headers: { Authorization: `Bearer ${token}` },
-  });
-}
-
-async function deleteFile(user: SessionUser, fileId: string): Promise<Response> {
-  const token = await jwt.sign(user);
-  return app.request(`/api/files/${fileId}`, {
-    method: "DELETE",
-    headers: { Authorization: `Bearer ${token}` },
-  });
-}
-
-// --- Unit tests for validation helpers ---
-
-describe("file validation", () => {
-  test("parseMaxSize converts units correctly", () => {
-    expect(parseMaxSize("1kb")).toBe(1024);
-    expect(parseMaxSize("2mb")).toBe(2 * 1024 * 1024);
-    expect(parseMaxSize("1gb")).toBe(1024 * 1024 * 1024);
-  });
-
-  test("parseMaxSize rejects invalid format", () => {
-    expect(() => parseMaxSize("abc")).toThrow();
-    expect(() => parseMaxSize("10")).toThrow();
-  });
-
-  test("validateFile rejects oversized files", () => {
-    const error = validateFile(
-      { fileName: "big.pdf", mimeType: "application/pdf", size: 3 * 1024 * 1024 },
-      { maxSize: "2mb" },
-    );
-    expectErrorIncludes(error, "file_too_large");
-  });
-
-  test("validateFile rejects wrong extension", () => {
-    const error = validateFile(
-      { fileName: "doc.exe", mimeType: "application/exe", size: 100 },
-      { accept: ["pdf", "jpg"] },
-    );
-    expectErrorIncludes(error, "invalid_file_type");
-  });
-
-  test("validateFile accepts valid file", () => {
-    const error = validateFile(
-      { fileName: "photo.jpg", mimeType: "image/jpeg", size: 500_000 },
-      { maxSize: "2mb", accept: ["jpg", "png"] },
-    );
-    expect(error).toBeNull();
-  });
-
-  test("validateFile rejects MIME mismatch (extension says jpg, client claims PDF)", () => {
-    const error = validateFile(
-      { fileName: "sneaky.jpg", mimeType: "application/pdf", size: 500 },
-      { accept: ["jpg", "png"] },
-    );
-    expectErrorIncludes(error, "mime_mismatch");
-  });
-
-  test("validateFile accepts jpeg mimeType variants for jpg extension", () => {
-    expect(
-      validateFile({ fileName: "a.jpg", mimeType: "image/jpeg", size: 100 }, { accept: ["jpg"] }),
-    ).toBeNull();
-    expect(
-      validateFile({ fileName: "a.jpg", mimeType: "image/jpg", size: 100 }, { accept: ["jpg"] }),
-    ).toBeNull();
-  });
-
-  test("sniffMimeType recognizes gif, webp and pdf signatures", () => {
-    expect(sniffMimeType(new TextEncoder().encode(`GIF89a${"x".repeat(20)}`))).toBe("image/gif");
-    const webp = new Uint8Array([
-      ...new TextEncoder().encode("RIFF"),
-      0,
-      0,
-      0,
-      0,
-      ...new TextEncoder().encode("WEBP"),
-      ...Array(20).fill(0),
-    ]);
-    expect(sniffMimeType(webp)).toBe("image/webp");
-    expect(sniffMimeType(new TextEncoder().encode(`%PDF-1.4${"x".repeat(20)}`))).toBe(
-      "application/pdf",
-    );
-  });
-
-  test("sniffMimeType returns null for unrecognized or too-short byte sequences", () => {
-    expect(sniffMimeType(new Uint8Array([0x00, 0x01, 0x02]))).toBeNull();
-    expect(sniffMimeType(new TextEncoder().encode("hello world"))).toBeNull();
-  });
-
-  // --- doc/docx magic-byte content verification ---
-
-  const docBytes = new Uint8Array([
-    0xd0,
-    0xcf,
-    0x11,
-    0xe0,
-    0xa1,
-    0xb1,
-    0x1a,
-    0xe1,
-    ...Array(20).fill(0),
-  ]);
-  const docxBytes = new Uint8Array([0x50, 0x4b, 0x03, 0x04, ...Array(20).fill(0)]);
-
-  test("validateFile accepts a .doc/.docx upload on extension/mimeType alone", () => {
-    expect(
-      validateFile(
-        { fileName: "report.doc", mimeType: "application/msword", size: docBytes.length },
-        { accept: ["doc", "docx"] },
-      ),
-    ).toBeNull();
-    expect(
-      validateFile(
-        {
-          fileName: "report.docx",
-          mimeType: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-          size: docxBytes.length,
-        },
-        { accept: ["doc", "docx"] },
-      ),
-    ).toBeNull();
-  });
-
-  test("validateFileContent accepts .doc/.docx bytes matching their declared extension", () => {
-    expect(validateFileContent("report.doc", docBytes)).toEqual({ kind: "ok" });
-    expect(validateFileContent("report.docx", docxBytes)).toEqual({ kind: "ok" });
-  });
-
-  test("validateFileContent rejects .doc/.docx whose content doesn't match the extension", () => {
-    const fakeDoc = validateFileContent(
-      "fake.doc",
-      new TextEncoder().encode("not actually a Word document, just text"),
-    );
-    expect(fakeDoc.kind).toBe("rejected");
-    expectErrorIncludes(fakeDoc.kind === "rejected" ? fakeDoc.error : null, "content_mismatch");
-
-    const fakeDocx = validateFileContent(
-      "fake.docx",
-      new TextEncoder().encode("not actually a docx, just text"),
-    );
-    expect(fakeDocx.kind).toBe("rejected");
-    expectErrorIncludes(fakeDocx.kind === "rejected" ? fakeDocx.error : null, "content_mismatch");
-  });
-
-  test("validateFileContent now content-verifies every signature-bearing extension (e.g. pdf), not just doc/docx", () => {
-    const mismatch = validateFileContent(
-      "fake.pdf",
-      new TextEncoder().encode("not a PDF at all, just text"),
-    );
-    expect(mismatch.kind).toBe("rejected");
-    expectErrorIncludes(mismatch.kind === "rejected" ? mismatch.error : null, "content_mismatch");
-  });
-
-  test("validateFileContent leaves extensions without a magic-byte signature unchecked (csv/txt/svg/md/json/unknown)", () => {
-    const text = new TextEncoder().encode("just plain text, not any binary format");
-    expect(validateFileContent("data.csv", text)).toEqual({ kind: "ok" });
-    expect(validateFileContent("notes.txt", text)).toEqual({ kind: "ok" });
-    expect(validateFileContent("readme.md", text)).toEqual({ kind: "ok" });
-    expect(validateFileContent("data.json", text)).toEqual({ kind: "ok" });
-    expect(validateFileContent("logo.svg", text)).toEqual({ kind: "ok" });
-    expect(validateFileContent("file.unknownext", text)).toEqual({ kind: "ok" });
-  });
-
-  test("validateFileContent treats a prototype-property extension as unknown instead of crashing", () => {
-    expect(validateFileContent("evil.constructor", docBytes)).toEqual({ kind: "ok" });
-    expect(validateFileContent("evil.__proto__", docBytes)).toEqual({ kind: "ok" });
-    expect(validateFileContent("evil.toString", docBytes)).toEqual({ kind: "ok" });
-  });
-
-  const pngBytesForNormalization = new Uint8Array([
-    0x89,
-    0x50,
-    0x4e,
-    0x47,
-    0x0d,
-    0x0a,
-    0x1a,
-    0x0a,
-    ...Array(20).fill(0),
-  ]);
-
-  test("validateFileContent normalizes PNG bytes uploaded as .jpg when png is in accept", () => {
-    expect(validateFileContent("photo.jpg", pngBytesForNormalization, ["jpg", "png"])).toEqual({
-      kind: "normalized",
-      extension: "png",
-      mimeType: "image/png",
-    });
-  });
-
-  test("validateFileContent still rejects PNG bytes uploaded as .jpg when png is not in accept", () => {
-    const result = validateFileContent("photo.jpg", pngBytesForNormalization, ["jpg"]);
-    expect(result.kind).toBe("rejected");
-  });
-
-  test("validateFileContent rejects a format not covered by accept at all, even with accept present", () => {
-    const result = validateFileContent("photo.jpg", new TextEncoder().encode("%PDF-1.4 minimal"), [
-      "jpg",
-      "png",
-    ]);
-    expect(result.kind).toBe("rejected");
-  });
-
-  test("validateFileContent without an accept list normalizes too — no accept means no restriction to widen", () => {
-    expect(validateFileContent("photo.jpg", pngBytesForNormalization)).toEqual({
-      kind: "normalized",
-      extension: "png",
-      mimeType: "image/png",
-    });
-  });
-
-  test("validateFileContent with an empty accept list normalizes the same as no accept at all", () => {
-    expect(validateFileContent("photo.jpg", pngBytesForNormalization, [])).toEqual({
-      kind: "normalized",
-      extension: "png",
-      mimeType: "image/png",
-    });
-  });
-
-  test("validateFile with accept: ['constructor'] and a matching filename never throws", () => {
-    let result: string | null = null;
-    expect(() => {
-      result = validateFile(
-        { fileName: "x.constructor", mimeType: "application/octet-stream", size: 10 },
-        { accept: ["constructor"] },
-      );
-    }).not.toThrow();
-    expect(result === null || typeof result === "string").toBe(true);
-  });
-
-  test("sniffMimeType recognizes doc (OLE) and docx (ZIP) signatures", () => {
-    expect(sniffMimeType(docBytes)).toBe("application/msword");
-    expect(sniffMimeType(docxBytes)).toBe(
-      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-    );
-  });
-
-  // --- .csv declared as application/vnd.ms-excel (Windows browsers) ---
-
-  test("validateFile accepts .csv declared as application/vnd.ms-excel when csv is in accept", () => {
-    expect(
-      validateFile(
-        { fileName: "data.csv", mimeType: "application/vnd.ms-excel", size: 100 },
-        { accept: ["csv"] },
-      ),
-    ).toBeNull();
-  });
-
-  test("validateFile does not extend the vnd.ms-excel alias to extensions other than csv", () => {
-    const error = validateFile(
-      { fileName: "photo.jpg", mimeType: "application/vnd.ms-excel", size: 100 },
-      { accept: ["jpg"] },
-    );
-    expectErrorIncludes(error, "mime_mismatch");
-  });
-
-  test("validateFile rejects a prototype-property mimeType instead of treating it as an alias match", () => {
-    const error = validateFile(
-      { fileName: "photo.jpg", mimeType: "constructor", size: 100 },
-      { accept: ["jpg"] },
-    );
-    expectErrorIncludes(error, "mime_mismatch");
-  });
-
-  describe("resolveUploadMimeType", () => {
-    const textCsvBytes = new TextEncoder().encode("name,age\nAda,36\n");
-
-    test("rewrites .csv + application/vnd.ms-excel to text/csv when bytes are text", () => {
-      expect(resolveUploadMimeType("data.csv", "application/vnd.ms-excel", textCsvBytes)).toEqual({
-        kind: "ok",
-        mimeType: "text/csv",
-      });
-    });
-
-    test("rewrites regardless of charset suffix or case", () => {
-      expect(
-        resolveUploadMimeType("data.csv", "Application/VND.MS-EXCEL; charset=utf-8", textCsvBytes),
-      ).toEqual({ kind: "ok", mimeType: "text/csv" });
-    });
-
-    test("rejects .csv + application/vnd.ms-excel when bytes are a real OLE binary", () => {
-      const result = resolveUploadMimeType("data.csv", "application/vnd.ms-excel", docBytes);
-      expect(result.kind).toBe("rejected");
-      if (result.kind === "rejected") {
-        expectErrorIncludes(result.error, "content_mismatch");
-      }
-    });
-
-    test("rejects .csv + application/vnd.ms-excel when bytes are a ZIP container (.xlsx)", () => {
-      const result = resolveUploadMimeType("data.csv", "application/vnd.ms-excel", docxBytes);
-      expect(result.kind).toBe("rejected");
-      if (result.kind === "rejected") {
-        expectErrorIncludes(result.error, "content_mismatch");
-      }
-    });
-
-    test("leaves .csv + text/plain unchanged", () => {
-      expect(resolveUploadMimeType("data.csv", "text/plain", textCsvBytes)).toEqual({
-        kind: "ok",
-        mimeType: "text/plain",
-      });
-    });
-
-    test("leaves .xls + application/vnd.ms-excel unchanged (alias is csv-only)", () => {
-      expect(resolveUploadMimeType("data.xls", "application/vnd.ms-excel", docBytes)).toEqual({
-        kind: "ok",
-        mimeType: "application/vnd.ms-excel",
-      });
-    });
-
-    test("a prototype-property extension or mimeType never resolves as an alias", () => {
-      expect(resolveUploadMimeType("x.constructor", "name", textCsvBytes)).toEqual({
-        kind: "ok",
-        mimeType: "name",
-      });
-      expect(resolveUploadMimeType("data.csv", "constructor", textCsvBytes)).toEqual({
-        kind: "ok",
-        mimeType: "constructor",
-      });
-    });
-  });
-});
-
-// --- Integration: Upload → Download → Delete via real HTTP API ---
-
-describe("file upload flow via API", () => {
-  let uploadedFileId: string;
-
-  // Create a small PNG-like test file
-  const testPngContent = new Uint8Array([
-    0x89,
-    0x50,
-    0x4e,
-    0x47,
-    0x0d,
-    0x0a,
-    0x1a,
-    0x0a, // PNG header
-    ...Array(100).fill(0),
-  ]);
-
-  test("upload a logo image", async () => {
-    const res = await uploadFile(adminUser, "logo.png", testPngContent, "image/png", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "logo",
-    });
-
-    expect(res.status).toBe(201);
-    const body = await res.json();
-    expect(body.id).toBeDefined();
-    expect(body.fileName).toBe("logo.png");
-    expect(body.mimeType).toBe("image/png");
-    expect(body.size).toBe(testPngContent.length);
-    expect(body.storageKey).toContain("1/tenant/1/logo/");
-
-    uploadedFileId = body.id;
-  });
-
-  test("download the uploaded file", async () => {
-    const res = await getFile(adminUser, uploadedFileId);
-    expect(res.status).toBe(200);
-    expect(res.headers.get("Content-Type")).toBe("image/png");
-    expect(res.headers.get("Content-Disposition")).toContain("logo.png");
-
-    const downloaded = new Uint8Array(await res.arrayBuffer());
-    expect(downloaded.length).toBe(testPngContent.length);
-    expect(downloaded[0]).toBe(0x89); // PNG magic byte
-  });
-
-  test("upload emits fileRef.created to the entity stream", async () => {
-    // fileRef is a standard ES entity — the upload goes through the entity
-    // executor, so the stream carries exactly one `fileRef.created` at v1.
-    const events = await loadAggregate(testDb.db, uploadedFileId, adminUser.tenantId);
-
-    expect(events).toHaveLength(1);
-    const event = events[0];
-    expect(event?.type).toBe("fileRef.created");
-    expect(event?.version).toBe(1);
-
-    type CreatedPayload = {
-      fileName: string;
-      mimeType: string;
-      size: number;
-      entityType: string;
-      fieldName: string;
-      storageKey: string;
-      data?: unknown;
-      binary?: unknown;
-    };
-    // The entity executor strips `id` from the event payload (it's the
-    // aggregateId / stream id, which we loaded by above) and threads
-    // insertedById through metadata — neither appears in payload.
-    const payload = event!.payload as CreatedPayload;
-    expect(payload.fileName).toBe("logo.png");
-    expect(payload.mimeType).toBe("image/png");
-    expect(payload.size).toBe(testPngContent.length);
-    expect(payload.entityType).toBe("tenant");
-    expect(payload.fieldName).toBe("logo");
-    // The binary never hits the event — payload carries a pointer only.
-    expect(payload.data).toBeUndefined();
-    expect(payload.binary).toBeUndefined();
-    expect(typeof payload.storageKey).toBe("string");
-  });
-
-  test("get file metadata", async () => {
-    const res = await getFileMeta(adminUser, uploadedFileId);
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.fileName).toBe("logo.png");
-    expect(body.entityType).toBe("tenant");
-    // entity_id is text post-migration — the upload route passes whatever
-    // string the client sent (here "1") straight through.
-    expect(body.entityId).toBe("1");
-    expect(body.fieldName).toBe("logo");
-  });
-
-  test("other tenant cannot access the file", async () => {
-    const res = await getFile(otherTenantUser, uploadedFileId);
-    expect(res.status).toBe(404);
-  });
-
-  test("delete the file", async () => {
-    const res = await deleteFile(adminUser, uploadedFileId);
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.ok).toBe(true);
-
-    // File is gone
-    const getRes = await getFile(adminUser, uploadedFileId);
-    expect(getRes.status).toBe(404);
-  });
-});
-
-// --- Serving hardens Content-Type against a spoofed/mismatched declared MIME ---
-
-describe("download Content-Type is sniffed from bytes, not trusted from the declared MIME", () => {
-  const testPngContent = new Uint8Array([
-    0x89,
-    0x50,
-    0x4e,
-    0x47,
-    0x0d,
-    0x0a,
-    0x1a,
-    0x0a,
-    ...Array(50).fill(0),
-  ]);
-  const testJpegContent = new Uint8Array([0xff, 0xd8, 0xff, 0xe0, ...Array(50).fill(0)]);
-
-  test("real PNG bytes declared as text/html are served as octet-stream, never text/html", async () => {
-    // Bun's own Request#formData() derives File#type from the *filename*
-    // extension, not from the multipart part's declared Content-Type header
-    // — so the fileName here (.html) is what actually lands as the stored
-    // mimeType; the mismatch this test needs is against the real PNG bytes.
-    const uploadRes = await uploadFile(adminUser, "sneaky.html", testPngContent, "text/html");
-    // Upload itself is not rejected — mismatch enforcement stays at the
-    // serving side, existing uploads with an off mimeType keep working.
-    expect(uploadRes.status).toBe(201);
-    const { id } = await uploadRes.json();
-
-    const res = await getFile(adminUser, id);
-    expect(res.status).toBe(200);
-    expect(res.headers.get("Content-Type")).toBe("application/octet-stream");
-    expect(res.headers.get("Content-Disposition")).toContain("attachment");
-  });
-
-  test("actual HTML bytes are never served as text/html or image/svg+xml", async () => {
-    const htmlBytes = new TextEncoder().encode(
-      "<html><body><script>alert(document.domain)</script></body></html>",
-    );
-    const uploadRes = await uploadFile(adminUser, "evil.html", htmlBytes, "text/html");
-    expect(uploadRes.status).toBe(201);
-    const { id } = await uploadRes.json();
-
-    const res = await getFile(adminUser, id);
-    expect(res.status).toBe(200);
-    expect(res.headers.get("Content-Type")).not.toBe("text/html");
-    expect(res.headers.get("Content-Type")).not.toBe("image/svg+xml");
-    expect(res.headers.get("Content-Type")).toBe("application/octet-stream");
-    expect(res.headers.get("Content-Disposition")).toContain("attachment");
-  });
-
-  test("an SVG upload — bytes and declared MIME both image/svg+xml — is still downgraded to octet-stream, never served inline", async () => {
-    const svgBytes = new TextEncoder().encode(
-      '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>',
-    );
-    const uploadRes = await uploadFile(adminUser, "logo.svg", svgBytes, "image/svg+xml");
-    expect(uploadRes.status).toBe(201);
-    const { id } = await uploadRes.json();
-
-    const res = await getFile(adminUser, id);
-    expect(res.status).toBe(200);
-    expect(res.headers.get("Content-Type")).not.toBe("image/svg+xml");
-    expect(res.headers.get("Content-Type")).toBe("application/octet-stream");
-  });
-
-  test("regression: a real allowed image type with a correctly declared MIME still serves with the matching sniffed Content-Type", async () => {
-    const uploadRes = await uploadFile(adminUser, "photo.jpg", testJpegContent, "image/jpeg");
-    expect(uploadRes.status).toBe(201);
-    const { id } = await uploadRes.json();
-
-    const res = await getFile(adminUser, id);
-    expect(res.status).toBe(200);
-    expect(res.headers.get("Content-Type")).toBe("image/jpeg");
-  });
-});
-
-// --- doc/docx upload via API: content-verified independent of `accept` ---
-
-describe("doc/docx upload is content-verified against magic bytes", () => {
-  const docBytes = new Uint8Array([
-    0xd0,
-    0xcf,
-    0x11,
-    0xe0,
-    0xa1,
-    0xb1,
-    0x1a,
-    0xe1,
-    ...Array(20).fill(0),
-  ]);
-  const docxBytes = new Uint8Array([0x50, 0x4b, 0x03, 0x04, ...Array(20).fill(0)]);
-
-  test("a real .doc upload succeeds", async () => {
-    const res = await uploadFile(adminUser, "report.doc", docBytes, "application/msword");
-    expect(res.status).toBe(201);
-  });
-
-  test("a real .docx upload succeeds", async () => {
-    const res = await uploadFile(
-      adminUser,
-      "report.docx",
-      docxBytes,
-      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-    );
-    expect(res.status).toBe(201);
-  });
-
-  test("a .doc upload whose bytes don't match the declared mimeType is rejected with content_mismatch, even unattached (no `accept` list)", async () => {
-    const fakeDocBytes = new TextEncoder().encode("plain text pretending to be a Word document");
-    const res = await uploadFile(adminUser, "fake.doc", fakeDocBytes, "application/msword");
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.error).toContain("content_mismatch");
-  });
-});
-
-// --- Content-verification is keyed on the filename extension, not the ---
-// --- declared/runtime mimeType (Option A, kumiko-framework#3287)       ---
-
-describe("content_mismatch is enforced by filename extension for every signature-bearing type", () => {
-  const jpegBytes = new Uint8Array([0xff, 0xd8, 0xff, 0xe0, ...Array(20).fill(0)]);
-  const pngBytes = new Uint8Array([
-    0x89,
-    0x50,
-    0x4e,
-    0x47,
-    0x0d,
-    0x0a,
-    0x1a,
-    0x0a,
-    ...Array(20).fill(0),
-  ]);
-  const pdfBytes = new TextEncoder().encode("%PDF-1.4 minimal");
-  const docBytes = new Uint8Array([
-    0xd0,
-    0xcf,
-    0x11,
-    0xe0,
-    0xa1,
-    0xb1,
-    0x1a,
-    0xe1,
-    ...Array(20).fill(0),
-  ]);
-  const docxBytes = new Uint8Array([0x50, 0x4b, 0x03, 0x04, ...Array(20).fill(0)]);
-
-  test("PDF bytes uploaded as x.jpg against an accept: [png, jpg] field are rejected with content_mismatch", async () => {
-    const res = await uploadFile(adminUser, "x.jpg", pdfBytes, "image/jpeg", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "logo",
-    });
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.error).toContain("content_mismatch");
-  });
-
-  test("PNG bytes uploaded as x.jpg are normalized and stored as image/png when png is in the field's accept", async () => {
-    const res = await uploadFile(adminUser, "x.jpg", pngBytes, "image/jpeg", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "logo",
-    });
-    expect(res.status).toBe(201);
-    const body = await res.json();
-    expect(body.fileName).toBe("x.jpg");
-    expect(body.mimeType).toBe("image/png");
-    expect(body.storageKey).toMatch(/\.png$/);
-  });
-
-  test("PNG bytes normalized on upload are served back with the matching image/png Content-Type", async () => {
-    const uploadRes = await uploadFile(adminUser, "x.jpg", pngBytes, "image/jpeg", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "logo",
-    });
-    expect(uploadRes.status).toBe(201);
-    const { id } = await uploadRes.json();
-
-    const res = await getFile(adminUser, id);
-    expect(res.status).toBe(200);
-    expect(res.headers.get("Content-Type")).toBe("image/png");
-  });
-
-  test("PNG bytes uploaded as x.jpg against a field whose accept doesn't include png are still rejected with content_mismatch", async () => {
-    const res = await uploadFile(adminUser, "x.jpg", pngBytes, "image/jpeg", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "strictLogo",
-    });
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.error).toContain("content_mismatch");
-  });
-
-  test("real signature bytes with a matching extension upload successfully", async () => {
-    for (const [fileName, bytes, mimeType] of [
-      ["real.jpg", jpegBytes, "image/jpeg"],
-      ["real.png", pngBytes, "image/png"],
-      ["real.pdf", pdfBytes, "application/pdf"],
-      ["real.doc", docBytes, "application/msword"],
-      [
-        "real.docx",
-        docxBytes,
-        "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-      ],
-    ] as const) {
-      const res = await uploadFile(adminUser, fileName, bytes, mimeType);
-      expect(res.status).toBe(201);
-    }
-  });
-
-  test(".csv and .txt plain text upload successfully (no magic-byte signature to check)", async () => {
-    const text = new TextEncoder().encode("name,age\nAda,36\n");
-    const csvRes = await uploadFile(adminUser, "data.csv", text, "text/csv");
-    expect(csvRes.status).toBe(201);
-    const txtRes = await uploadFile(adminUser, "notes.txt", text, "text/plain");
-    expect(txtRes.status).toBe(201);
-  });
-
-  test("an unattached upload with a prototype-property extension is handled as unknown, not a 500", async () => {
-    const constructorRes = await uploadFile(adminUser, "evil.constructor", pngBytes, "image/png");
-    expect(constructorRes.status).toBe(201);
-    const protoRes = await uploadFile(adminUser, "evil.__proto__", pngBytes, "image/png");
-    expect(protoRes.status).toBe(201);
-  });
-
-  test("an unattached upload (no entityType/fieldName, so no accept restriction) also normalizes mislabeled bytes", async () => {
-    const res = await uploadFile(adminUser, "vin.jpg", pngBytes, "image/jpeg");
-    expect(res.status).toBe(201);
-    const body = await res.json();
-    expect(body.fileName).toBe("vin.jpg");
-    expect(body.mimeType).toBe("image/png");
-    expect(body.storageKey).toMatch(/\.png$/);
-  });
-
-  test("a too-short .png upload (fewer bytes than the PNG signature) is rejected with content_mismatch", async () => {
-    // A zero-byte file part is dropped by Bun's multipart parser before it
-    // ever reaches the route handler as `file`, so this uses one byte
-    // instead — still far short of the 8-byte PNG signature.
-    const res = await uploadFile(adminUser, "empty.png", new Uint8Array([0x00]), "image/png");
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.error).toContain("content_mismatch");
-  });
-});
-
-// Bun's formData() derives File#type from the filename, so .csv never
-// arrives as vnd.ms-excel here; the csv alias is covered by the unit tests above.
-describe("vnd.ms-excel via HTTP (.xls)", () => {
-  const docBytes = new Uint8Array([
-    0xd0,
-    0xcf,
-    0x11,
-    0xe0,
-    0xa1,
-    0xb1,
-    0x1a,
-    0xe1,
-    ...Array(20).fill(0),
-  ]);
-
-  test("unattached .xls declared as application/vnd.ms-excel keeps its declared mimeType unchanged", async () => {
-    const res = await uploadFile(adminUser, "legacy.xls", docBytes, "application/vnd.ms-excel");
-    expect(res.status).toBe(201);
-    const body = await res.json();
-    expect(body.mimeType).toBe("application/vnd.ms-excel");
-  });
-
-  test("attached .xls upload is rejected by the importFile field's csv-only accept list", async () => {
-    const res = await uploadFile(adminUser, "legacy.xls", docBytes, "application/vnd.ms-excel", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "importFile",
-    });
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.error).toContain("invalid_file_type");
-  });
-});
-
-// --- Cross-user access within a tenant (attached file owner-scope) ---
-
-describe("attached file owner-scope", () => {
-  const testPng = new Uint8Array([
-    0x89,
-    0x50,
-    0x4e,
-    0x47,
-    0x0d,
-    0x0a,
-    0x1a,
-    0x0a,
-    ...Array(50).fill(0),
-  ]);
-  // Same tenant as adminUser (tenantId 1), different id and no privileged role.
-  const memberUser: SessionUser = {
-    id: "11111111-0000-4000-8000-000000000042",
-    tenantId: "00000000-0000-4000-8000-000000000001",
-    roles: ["User"],
-  };
-
-  test("non-uploader, non-admin in same tenant cannot download an entity-attached file", async () => {
-    const uploadRes = await uploadFile(memberUser, "mine.png", testPng, "image/png", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "logo",
-    });
-    expect(uploadRes.status).toBe(201);
-    const { id } = await uploadRes.json();
-
-    // A different non-privileged user in the SAME tenant — the old code leaked
-    // here (tenant check alone passed). New code rejects with 404.
-    const otherMember: SessionUser = {
-      id: "11111111-0000-4000-8000-000000000043",
-      tenantId: "00000000-0000-4000-8000-000000000001",
-      roles: ["User"],
-    };
-    const res = await getFile(otherMember, id);
-    expect(res.status).toBe(404);
-  });
-
-  test("uploader can download their own entity-attached file", async () => {
-    const uploadRes = await uploadFile(memberUser, "mine2.png", testPng, "image/png", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "logo",
-    });
-    const { id } = await uploadRes.json();
-
-    const res = await getFile(memberUser, id);
-    expect(res.status).toBe(200);
-  });
-
-  test("Admin in same tenant can download any attached file", async () => {
-    const uploadRes = await uploadFile(memberUser, "mine3.png", testPng, "image/png", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "logo",
-    });
-    const { id } = await uploadRes.json();
-
-    const res = await getFile(adminUser, id); // Admin role
-    expect(res.status).toBe(200);
-  });
-});
-
-// --- Custom access guard + privilegedRoles ---
-
-describe("custom file access guard", () => {
-  const testPng = new Uint8Array([
-    0x89,
-    0x50,
-    0x4e,
-    0x47,
-    0x0d,
-    0x0a,
-    0x1a,
-    0x0a,
-    ...Array(30).fill(0),
-  ]);
-
-  // Spin up an isolated DB + storage dir for a single-test server. Runs the
-  // body inside try/finally so the DB and tmpdir are cleaned up even if
-  // assertions fail.
-  async function withIsolatedFileServer(
-    options: Omit<FileRoutesOptions, "db" | "resolveProvider"> & {
-      // Overrides the default local-filesystem provider. Needed for tests
-      // that exercise optional provider methods (e.g. getSignedUrl) which
-      // the local provider deliberately doesn't implement.
-      readonly storageProvider?: FileStorageProvider;
-    },
-    body: (args: {
-      app: Hono;
-      jwt: JwtHelper;
-      upload: (user: SessionUser, name: string) => Promise<Response>;
-      request: (user: SessionUser, fileId: string, init?: RequestInit) => Promise<Response>;
-    }) => Promise<void>,
-  ): Promise<void> {
-    const { storageProvider: providerOverride, ...routeOptions } = options;
-    const isolatedDb = await createTestDb();
-    await unsafePushTables(isolatedDb.db, { fileRefsTable });
-    await unsafeCreateEntityTable(isolatedDb.db, testTenantEntity);
-    const storagePath = await mkdtemp(join(tmpdir(), "kumiko-files-custom-"));
-    const provider = providerOverride ?? createLocalProvider(storagePath);
-    // Route policy (accessGuard/privilegedRoles/maxUploadSize) now rides on the
-    // files feature; the provider is injected as the per-tenant resolver.
-    const isolatedRegistry = createRegistry([tenantFeature, createFilesFeature(routeOptions)]);
-    const isolatedServer = buildServer({
-      registry: isolatedRegistry,
-      context: { db: isolatedDb.db, _fileProviderResolver: () => Promise.resolve(provider) },
-      jwtSecret: JWT_SECRET,
-    });
-
-    try {
-      const upload = async (user: SessionUser, name: string) => {
-        const token = await isolatedServer.jwt.sign(user);
-        const fd = new FormData();
-        fd.append("file", new File([Buffer.from(testPng)], name, { type: "image/png" }));
-        fd.append("entityType", "tenant");
-        fd.append("entityId", "1");
-        fd.append("fieldName", "logo");
-        const { body: multipartBody, contentType } = await buildMultipartBody(fd);
-        return isolatedServer.app.request("/api/files", {
-          method: "POST",
-          headers: { Authorization: `Bearer ${token}`, "Content-Type": contentType },
-          body: multipartBody,
-        });
-      };
-      const request = async (user: SessionUser, fileId: string, init: RequestInit = {}) => {
-        const token = await isolatedServer.jwt.sign(user);
-        return isolatedServer.app.request(`/api/files/${fileId}`, {
-          ...init,
-          headers: {
-            ...((init.headers as Record<string, string> | undefined) ?? {}),
-            Authorization: `Bearer ${token}`,
-          },
-        });
-      };
-      await body({
-        app: isolatedServer.app,
-        jwt: isolatedServer.jwt,
-        upload,
-        request,
-      });
-    } finally {
-      await isolatedDb.cleanup();
-      await rm(storagePath, { recursive: true, force: true });
-    }
-  }
-
-  test("privilegedRoles override: app-defined role (e.g. Supervisor) replaces the default Admin+SystemAdmin", async () => {
-    await withIsolatedFileServer(
-      { privilegedRoles: ["Supervisor"] },
-      async ({ upload, request }) => {
-        const uploader: SessionUser = {
-          id: "11111111-0000-4000-8000-000000000010",
-          tenantId: "00000000-0000-4000-8000-000000000001",
-          roles: ["User"],
-        };
-        const supervisor: SessionUser = {
-          id: "11111111-0000-4000-8000-000000000020",
-          tenantId: "00000000-0000-4000-8000-000000000001",
-          roles: ["Supervisor"],
-        };
-        const adminCaller: SessionUser = {
-          id: "11111111-0000-4000-8000-000000000030",
-          tenantId: "00000000-0000-4000-8000-000000000001",
-          roles: ["Admin"],
-        };
-
-        const uploaded = await upload(uploader, "custom-role.png");
-        const { id } = await uploaded.json();
-
-        // Supervisor (the new privileged role) can read.
-        expect((await request(supervisor, id)).status).toBe(200);
-        // Admin is NO longer privileged under this config.
-        expect((await request(adminCaller, id)).status).toBe(404);
-      },
-    );
-  });
-
-  test("custom accessGuard receives read/delete operation and can distinguish", async () => {
-    const guardCalls: Array<{ operation: string; userId: string }> = [];
-    await withIsolatedFileServer(
-      {
-        // Everyone in the tenant can read; only the uploader can delete.
-        accessGuard: ({ fileRef, user, operation }) => {
-          guardCalls.push({ operation, userId: user.id });
-          if (operation === "read") return "allow";
-          return fileRef.insertedById === user.id ? "allow" : "deny";
-        },
-      },
-      async ({ upload, request }) => {
-        const uploader: SessionUser = {
-          id: "11111111-0000-4000-8000-000000000040",
-          tenantId: "00000000-0000-4000-8000-000000000001",
-          roles: ["User"],
-        };
-        const other: SessionUser = {
-          id: "11111111-0000-4000-8000-000000000041",
-          tenantId: "00000000-0000-4000-8000-000000000001",
-          roles: ["User"],
-        };
-
-        const { id } = await (await upload(uploader, "guard.png")).json();
-
-        // Other user can read (guard allowed).
-        expect((await request(other, id)).status).toBe(200);
-        // Other user cannot delete — guard denied.
-        expect((await request(other, id, { method: "DELETE" })).status).toBe(404);
-        // Uploader can delete.
-        expect((await request(uploader, id, { method: "DELETE" })).status).toBe(200);
-
-        expect(guardCalls.map((c) => c.operation)).toEqual(["read", "delete", "delete"]);
-      },
-    );
-  });
-});
-
-// --- Tenant isolation ---
-
-describe("tenant isolation", () => {
-  test("tenant 2 uploads a file, tenant 1 cannot see it", async () => {
-    const content = new TextEncoder().encode("%PDF-1.4 tenant2-secret-file");
-    const uploadRes = await uploadFile(otherTenantUser, "secret.pdf", content, "application/pdf");
-    expect(uploadRes.status).toBe(201);
-    const { id } = await uploadRes.json();
-
-    // Tenant 1 cannot access
-    const getRes = await getFile(adminUser, id);
-    expect(getRes.status).toBe(404);
-
-    // Tenant 2 can access
-    const getRes2 = await getFile(otherTenantUser, id);
-    expect(getRes2.status).toBe(200);
-  });
-});
-
-// --- Error handling ---
-
-describe("error handling", () => {
-  test("upload without file returns 400", async () => {
-    const token = await jwt.sign(adminUser);
-    const formData = new FormData();
-    formData.append("notafile", "just text");
-
-    const { body: multipartBody, contentType } = await buildMultipartBody(formData);
-    const res = await app.request("/api/files", {
-      method: "POST",
-      headers: { Authorization: `Bearer ${token}`, "Content-Type": contentType },
-      body: multipartBody,
-    });
-
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    // /files route uses its own lightweight error shape (plain string).
-    expect(body.error).toContain("missing_file");
-  });
-
-  test("download non-existent file returns 404", async () => {
-    const res = await getFile(adminUser, NONEXISTENT_UUID);
-    expect(res.status).toBe(404);
-  });
-
-  test("delete non-existent file returns 404", async () => {
-    const res = await deleteFile(adminUser, NONEXISTENT_UUID);
-    expect(res.status).toBe(404);
-  });
-
-  // #1950: a malformed (non-UUID) id used to reach `selectMany` unchecked —
-  // Postgres rejects it with 22P02, which the pooled Bun.SQL connection
-  // treated as poisoned (see the NONEXISTENT_UUID comment above, added as a
-  // workaround before this guard existed). 404, same as a real-but-absent
-  // id, not the raw DB error.
-  test("download with a malformed (non-UUID) id returns 404, not a DB error", async () => {
-    const res = await getFile(adminUser, "not-a-uuid");
-    expect(res.status).toBe(404);
-  });
-
-  test("a malformed id doesn't poison the pooled connection for the next request", async () => {
-    await getFile(adminUser, "not-a-uuid");
-    const res = await getFile(adminUser, NONEXISTENT_UUID);
-    expect(res.status).toBe(404);
-  });
-
-  test("upload wrong file type for entity field is rejected", async () => {
-    const pdfContent = new TextEncoder().encode("fake-pdf-content");
-    const res = await uploadFile(adminUser, "document.pdf", pdfContent, "application/pdf", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "logo", // logo only accepts png, jpg
-    });
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.error).toContain("invalid_file_type");
-  });
-
-  test("upload with path-traversal entityType is rejected before it reaches storage", async () => {
-    const pngContent = new Uint8Array([0x89, 0x50, 0x4e, 0x47]);
-    const res = await uploadFile(adminUser, "logo.png", pngContent, "image/png", {
-      entityType: "../../tenantB",
-      entityId: "1",
-      fieldName: "logo",
-    });
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.error).toContain("invalid_entityType");
-  });
-
-  test("upload with path-traversal fieldName is rejected before it reaches storage", async () => {
-    const pngContent = new Uint8Array([0x89, 0x50, 0x4e, 0x47]);
-    const res = await uploadFile(adminUser, "logo.png", pngContent, "image/png", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "../../escape",
-    });
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.error).toContain("invalid_fieldName");
-  });
-
-  // #3005: fileRefDeleteHook's GDPR-forget decision resolves entityType/
-  // fieldName against the registry — an attachment nobody can resolve must
-  // be rejected at upload, not silently accepted and left to the forget
-  // hook's conservative fallback.
-  test("upload with an entityType not registered in the registry is rejected", async () => {
-    const pngContent = new Uint8Array([0x89, 0x50, 0x4e, 0x47]);
-    const res = await uploadFile(adminUser, "logo.png", pngContent, "image/png", {
-      entityType: "no-such-entity",
-      entityId: "1",
-      fieldName: "logo",
-    });
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.error).toContain("unresolvable_field");
-  });
-
-  test("upload with a fieldName not declared on the resolved entity is rejected", async () => {
-    const pngContent = new Uint8Array([0x89, 0x50, 0x4e, 0x47]);
-    const res = await uploadFile(adminUser, "logo.png", pngContent, "image/png", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "no-such-field",
-    });
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.error).toContain("unresolvable_field");
-  });
-
-  test("upload with only entityType set (no fieldName) is rejected, not silently treated as unattached", async () => {
-    const pngContent = new Uint8Array([0x89, 0x50, 0x4e, 0x47]);
-    const res = await uploadFile(adminUser, "logo.png", pngContent, "image/png", {
-      entityType: "tenant",
-      entityId: "1",
-    });
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.error).toContain("unresolvable_field");
-  });
-
-  test("upload without auth returns 401", async () => {
-    const formData = new FormData();
-    formData.append("file", new File([new Uint8Array(10)], "test.png", { type: "image/png" }));
-
-    const { body: multipartBody, contentType } = await buildMultipartBody(formData);
-    const res = await app.request("/api/files", {
-      method: "POST",
-      headers: { "Content-Type": contentType },
-      body: multipartBody,
-    });
-    expect(res.status).toBe(401);
-  });
-});
-
-// --- Content-Disposition hardening (Phase 2.3 follow-up) ---
-
-describe("Content-Disposition header hardening", () => {
-  const smallPng = new Uint8Array([
-    0x89,
-    0x50,
-    0x4e,
-    0x47,
-    0x0d,
-    0x0a,
-    0x1a,
-    0x0a,
-    ...Array(20).fill(0),
-  ]);
-
-  // Helper: upload a file WITHOUT entity attachment so validateFile skips
-  // the extension/mime whitelist. That's what lets us test with arbitrary
-  // filenames that wouldn't pass the attached-upload validator.
-  async function uploadUnattached(fileName: string): Promise<string> {
-    const token = await jwt.sign(adminUser);
-    const fd = new FormData();
-    fd.append("file", new File([Buffer.from(smallPng)], fileName, { type: "image/png" }));
-    const { body: multipartBody, contentType } = await buildMultipartBody(fd);
-    const res = await app.request("/api/files", {
-      method: "POST",
-      headers: { Authorization: `Bearer ${token}`, "Content-Type": contentType },
-      body: multipartBody,
-    });
-    expect(res.status).toBe(201);
-    const body = await res.json();
-    return body.id;
-  }
-
-  test("malicious filename cannot inject a second header parameter", async () => {
-    // Name with a quote would break `filename="..."` quoting and inject
-    // `filename*=utf-8''evil.exe` if we interpolated the raw name.
-    const evil = `normal.png"; filename*=utf-8''evil.exe`;
-    const id = await uploadUnattached(evil);
-
-    const res = await getFile(adminUser, id);
-    expect(res.status).toBe(200);
-    const header = res.headers.get("Content-Disposition") ?? "";
-
-    // Header has the RFC-6266 shape: attachment; filename="..."; filename*=UTF-8''...
-    // Critically: exactly two parameters after `attachment`, i.e. no third
-    // parameter injected. split by ";" yields ["attachment", filename=, filename*=]
-    expect(header.split(";")).toHaveLength(3);
-    expect(header.startsWith('attachment; filename="')).toBe(true);
-
-    // The ASCII fallback inside `filename="..."` MUST NOT contain a quote
-    // character — that would close the string early and let the tail
-    // become a new parameter. This is the core fix.
-    const fallbackMatch = header.match(/filename="([^"]*)"/);
-    expect(fallbackMatch).not.toBeNull();
-    expect(fallbackMatch?.[1]).not.toContain('"');
-    expect(fallbackMatch?.[1]).not.toContain(";");
-
-    // filename* uses UTF-8 percent-encoding for non-ASCII characters.
-    // Bun's multipart parser already strips quotes/semicolons from File.name
-    // (the raw Content-Disposition filename parameter is parsed by the runtime).
-    // The safe fallback + encodeRFC5987 chain provides defense-in-depth.
-    expect(header).toContain("filename*=UTF-8''");
-  });
-
-  test("unicode filename is percent-encoded in filename*", async () => {
-    const unicode = "測試.png"; // Chinese characters
-    const id = await uploadUnattached(unicode);
-
-    const res = await getFile(adminUser, id);
-    const header = res.headers.get("Content-Disposition") ?? "";
-
-    // ASCII fallback collapses non-ASCII to underscore.
-    expect(header).toMatch(/^attachment; filename="[A-Za-z0-9._\-()]+";/);
-    // Modern filename* carries the UTF-8 bytes percent-encoded.
-    expect(header).toContain("filename*=UTF-8''");
-    // 測 = 0xE6 0xB8 0xAC in UTF-8 — at least one of those bytes must
-    // appear percent-encoded. Check E6 (lead byte of 測).
-    expect(header.toUpperCase()).toContain("%E6");
-  });
-
-  test("empty fallback (all chars stripped) falls back to 'download'", async () => {
-    // Name made entirely of characters outside the safe set — fallback
-    // would be empty; the builder substitutes a sane default instead.
-    const allStripped = "@@@###$$$.png"; // dots survive but the rest is stripped
-    const id = await uploadUnattached(allStripped);
-
-    const res = await getFile(adminUser, id);
-    const header = res.headers.get("Content-Disposition") ?? "";
-
-    // The dots + .png survive, so fallback is "____.png" rather than
-    // the "download" default — prove the fallback is non-empty and safe.
-    const fallbackMatch = header.match(/filename="([^"]+)"/);
-    expect(fallbackMatch).not.toBeNull();
-    expect(fallbackMatch?.[1]).not.toBe("");
-    expect(fallbackMatch?.[1]).toMatch(/^[A-Za-z0-9._\-()]+$/);
-  });
-});
-
-// --- Download-URL endpoint (Phase 2.3) ---
-
-describe("download-url endpoint", () => {
-  const testPng = new Uint8Array([
-    0x89,
-    0x50,
-    0x4e,
-    0x47,
-    0x0d,
-    0x0a,
-    0x1a,
-    0x0a,
-    ...Array(40).fill(0),
-  ]);
-
-  // Mirrors the helper from the custom-guard block — same DB/storage
-  // lifecycle, but accepts a provider override so we can inject an in-memory
-  // provider that implements getSignedUrl.
-  async function withIsolatedServer(
-    storageProvider: FileStorageProvider,
-    body: (args: {
-      jwt: JwtHelper;
-      upload: (user: SessionUser) => Promise<Response>;
-      getDownloadUrl: (user: SessionUser, fileId: string) => Promise<Response>;
-    }) => Promise<void>,
-  ): Promise<void> {
-    const isolatedDb = await createTestDb();
-    await unsafePushTables(isolatedDb.db, { fileRefsTable });
-    await unsafeCreateEntityTable(isolatedDb.db, testTenantEntity);
-    const isolatedRegistry = createRegistry([tenantFeature]);
-    const isolatedServer = buildServer({
-      registry: isolatedRegistry,
-      context: { db: isolatedDb.db, _fileProviderResolver: () => Promise.resolve(storageProvider) },
-      jwtSecret: JWT_SECRET,
-    });
-
-    try {
-      const upload = async (user: SessionUser) => {
-        const token = await isolatedServer.jwt.sign(user);
-        const fd = new FormData();
-        fd.append("file", new File([Buffer.from(testPng)], "photo.png", { type: "image/png" }));
-        fd.append("entityType", "tenant");
-        fd.append("entityId", "1");
-        fd.append("fieldName", "logo");
-        const { body: multipartBody, contentType } = await buildMultipartBody(fd);
-        return isolatedServer.app.request("/api/files", {
-          method: "POST",
-          headers: { Authorization: `Bearer ${token}`, "Content-Type": contentType },
-          body: multipartBody,
-        });
-      };
-      const getDownloadUrl = async (user: SessionUser, fileId: string) => {
-        const token = await isolatedServer.jwt.sign(user);
-        return isolatedServer.app.request(`/api/files/${fileId}/download-url`, {
-          method: "GET",
-          headers: { Authorization: `Bearer ${token}` },
-        });
-      };
-      await body({ jwt: isolatedServer.jwt, upload, getDownloadUrl });
-    } finally {
-      await isolatedDb.cleanup();
-    }
-  }
-
-  test("returns signed URL + expiresAt for authorized caller", async () => {
-    await withIsolatedServer(createInMemoryFileProvider(), async ({ upload, getDownloadUrl }) => {
-      const before = Date.now();
-      const { id } = await (await upload(adminUser)).json();
-
-      const res = await getDownloadUrl(adminUser, id);
-      expect(res.status).toBe(200);
-      const body = await res.json();
-      // The in-memory provider returns a memory:// URL with key + expiry —
-      // that's enough to prove the route wired the provider through.
-      expect(body.url).toMatch(/^memory:\/\//);
-      expect(body.url).toContain(`${adminUser.tenantId}/tenant/1/logo/`);
-      expect(body.url).toContain("expires=900");
-      // expiresAt is ~15 min in the future (ISO-8601).
-      const expiresAtMs = Date.parse(body.expiresAt);
-      expect(expiresAtMs).toBeGreaterThan(before + 14 * 60 * 1000);
-      expect(expiresAtMs).toBeLessThan(before + 16 * 60 * 1000);
-    });
-  });
-
-  test("returns 404 for nonexistent file", async () => {
-    await withIsolatedServer(createInMemoryFileProvider(), async ({ getDownloadUrl }) => {
-      const res = await getDownloadUrl(adminUser, NONEXISTENT_UUID);
-      expect(res.status).toBe(404);
-    });
-  });
-
-  test("returns 404 for other tenant (tenant isolation)", async () => {
-    await withIsolatedServer(createInMemoryFileProvider(), async ({ upload, getDownloadUrl }) => {
-      const { id } = await (await upload(adminUser)).json();
-      const res = await getDownloadUrl(otherTenantUser, id);
-      expect(res.status).toBe(404);
-    });
-  });
-
-  test("returns 404 when access guard denies (non-uploader, non-privileged)", async () => {
-    const memberUploader: SessionUser = {
-      id: "11111111-0000-4000-8000-000000000050",
-      tenantId: "00000000-0000-4000-8000-000000000001",
-      roles: ["User"],
-    };
-    const memberOther: SessionUser = {
-      id: "11111111-0000-4000-8000-000000000051",
-      tenantId: "00000000-0000-4000-8000-000000000001",
-      roles: ["User"],
-    };
-    await withIsolatedServer(createInMemoryFileProvider(), async ({ upload, getDownloadUrl }) => {
-      const { id } = await (await upload(memberUploader)).json();
-      // Different non-privileged user in the SAME tenant — guard denies.
-      const res = await getDownloadUrl(memberOther, id);
-      expect(res.status).toBe(404);
-    });
-  });
-
-  test("returns 501 when provider has no getSignedUrl (local filesystem)", async () => {
-    // The main test server uses createLocalProvider which deliberately does
-    // not implement getSignedUrl. Upload a fresh file, then request its
-    // download URL — the route must detect the missing method and 501.
-    const uploadRes = await uploadFile(adminUser, "no-signed.png", testPng, "image/png", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "logo",
-    });
-    const { id } = await uploadRes.json();
-
-    const token = await jwt.sign(adminUser);
-    const res = await app.request(`/api/files/${id}/download-url`, {
-      method: "GET",
-      headers: { Authorization: `Bearer ${token}` },
-    });
-    expect(res.status).toBe(501);
-    const body = await res.json();
-    expect(body.error).toContain("signed_urls_not_supported");
-  });
-});
-
-// --- fw#2423: GET /:id/meta with field-level PII encryption active ---
-
-describe("meta route with field-encrypted fileName", () => {
-  const testPng = new Uint8Array([
-    0x89,
-    0x50,
-    0x4e,
-    0x47,
-    0x0d,
-    0x0a,
-    0x1a,
-    0x0a,
-    ...Array(20).fill(0),
-  ]);
-
-  afterEach(() => {
-    // configurePiiSubjectKms is process-global — every test in this block
-    // must leave it clean for the rest of the suite.
-    resetPiiSubjectKmsForTests();
-  });
-
-  test("returns the decrypted fileName instead of 500 pii_ciphertext_leak", async () => {
-    configurePiiSubjectKms(new InMemoryKmsAdapter());
-
-    const uploadRes = await uploadFile(
-      adminUser,
-      "Krankheitsattest-Mai.png",
-      testPng,
-      "image/png",
-      { entityType: "tenant", entityId: "1", fieldName: "logo" },
-    );
-    expect(uploadRes.status).toBe(201);
-    const { id } = await uploadRes.json();
-
-    const metaRes = await getFileMeta(adminUser, id);
-    expect(metaRes.status).toBe(200);
-    const body = await metaRes.json();
-    expect(body.fileName).toBe("Krankheitsattest-Mai.png");
-    expect(body.mimeType).toBe("image/png");
-    expect(body.size).toBe(testPng.length);
-    expect(body.entityType).toBe("tenant");
-    expect(body.fieldName).toBe("logo");
-  });
-
-  test("other tenant still gets 404 (tenant isolation survives the executor swap)", async () => {
-    configurePiiSubjectKms(new InMemoryKmsAdapter());
-
-    const uploadRes = await uploadFile(adminUser, "cross-tenant.png", testPng, "image/png", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "logo",
-    });
-    const { id } = await uploadRes.json();
-
-    const res = await getFileMeta(otherTenantUser, id);
-    expect(res.status).toBe(404);
-  });
-
-  test("malformed (non-UUID) id still 404s instead of hitting the raw UUID column", async () => {
-    configurePiiSubjectKms(new InMemoryKmsAdapter());
-
-    const res = await getFileMeta(adminUser, "not-a-uuid");
-    expect(res.status).toBe(404);
-  });
-
-  test("soft-deleted file's meta still 404s (executor.detail() doesn't filter isDeleted)", async () => {
-    configurePiiSubjectKms(new InMemoryKmsAdapter());
-
-    const uploadRes = await uploadFile(adminUser, "trashed.png", testPng, "image/png", {
-      entityType: "tenant",
-      entityId: "1",
-      fieldName: "logo",
-    });
-    const { id } = await uploadRes.json();
-    expect((await deleteFile(adminUser, id)).status).toBe(200);
-
-    const res = await getFileMeta(adminUser, id);
-    expect(res.status).toBe(404);
-  });
-});
-
-// --- fw#2442: byte-serving + signed-URL routes with field-encrypted fileName ---
-
-describe("byte-serving routes with field-encrypted fileName", () => {
-  const testPng = new Uint8Array([
-    0x89,
-    0x50,
-    0x4e,
-    0x47,
-    0x0d,
-    0x0a,
-    0x1a,
-    0x0a,
-    ...Array(20).fill(0),
-  ]);
-
-  afterEach(() => {
-    resetPiiSubjectKmsForTests();
-  });
-
-  test("GET /files/:id serves the decrypted fileName in Content-Disposition, not the ciphertext", async () => {
-    configurePiiSubjectKms(new InMemoryKmsAdapter());
-
-    const uploadRes = await uploadFile(
-      adminUser,
-      "Krankheitsattest-Mai.png",
-      testPng,
-      "image/png",
-      { entityType: "tenant", entityId: "1", fieldName: "logo" },
-    );
-    expect(uploadRes.status).toBe(201);
-    const { id } = await uploadRes.json();
-
-    const res = await getFile(adminUser, id);
-    expect(res.status).toBe(200);
-    const header = res.headers.get("Content-Disposition") ?? "";
-    expect(header).toContain('filename="Krankheitsattest-Mai.png"');
-    expect(header).not.toContain("kumiko-pii");
-  });
-
-  test("GET /files/:id/download-url hints the decrypted fileName, never the ciphertext", async () => {
-    configurePiiSubjectKms(new InMemoryKmsAdapter());
-
-    let capturedDisposition: string | undefined;
-    const capturingProvider = {
-      ...createInMemoryFileProvider(),
-      async getSignedUrl(key: string, expiresInSeconds: number, options?: SignedUrlOptions) {
-        capturedDisposition = options?.contentDisposition;
-        return `memory://${key}?expires=${expiresInSeconds}`;
-      },
-    };
-
-    const isolatedDb = await createTestDb();
-    await unsafePushTables(isolatedDb.db, { fileRefsTable });
-    await unsafeCreateEntityTable(isolatedDb.db, testTenantEntity);
-    const isolatedRegistry = createRegistry([tenantFeature]);
-    const isolatedServer = buildServer({
-      registry: isolatedRegistry,
-      context: {
-        db: isolatedDb.db,
-        _fileProviderResolver: () => Promise.resolve(capturingProvider),
-      },
-      jwtSecret: JWT_SECRET,
-    });
-
-    try {
-      const fd = new FormData();
-      fd.append(
-        "file",
-        new File([Buffer.from(testPng)], "Krankheitsattest-Mai.png", { type: "image/png" }),
-      );
-      fd.append("entityType", "tenant");
-      fd.append("entityId", "1");
-      fd.append("fieldName", "logo");
-      const { body: multipartBody, contentType } = await buildMultipartBody(fd);
-      const token = await isolatedServer.jwt.sign(adminUser);
-      const uploadRes = await isolatedServer.app.request("/api/files", {
-        method: "POST",
-        headers: { Authorization: `Bearer ${token}`, "Content-Type": contentType },
-        body: multipartBody,
-      });
-      expect(uploadRes.status).toBe(201);
-      const { id } = await uploadRes.json();
-
-      const res = await isolatedServer.app.request(`/api/files/${id}/download-url`, {
-        method: "GET",
-        headers: { Authorization: `Bearer ${token}` },
-      });
-      expect(res.status).toBe(200);
-      expect(capturedDisposition).toContain('filename="Krankheitsattest-Mai.png"');
-      expect(capturedDisposition ?? "").not.toContain("kumiko-pii");
-    } finally {
-      await isolatedDb.cleanup();
-    }
-  });
-});
-
-describe("upload body-size limit", () => {
-  // Small on purpose: the pre-parseBody body limit is maxUploadSize + a
-  // fixed multipart margin regardless of scale, so a tiny maxUploadSize
-  // keeps the over-limit payloads (and this suite) fast.
-  const SMALL_MAX_UPLOAD_SIZE = "1kb";
-  const OVER_LIMIT_FILE_BYTES = 200 * 1024;
-
-  async function withSizeLimitedServer(
-    body: (args: { app: Hono; jwt: JwtHelper; provider: InMemoryFileProvider }) => Promise<void>,
-  ): Promise<void> {
-    const isolatedDb = await createTestDb();
-    await unsafePushTables(isolatedDb.db, { fileRefsTable });
-    const provider = createInMemoryFileProvider();
-    const isolatedRegistry = createRegistry([
-      createFilesFeature({ maxUploadSize: SMALL_MAX_UPLOAD_SIZE }),
-    ]);
-    const isolatedServer = buildServer({
-      registry: isolatedRegistry,
-      context: { db: isolatedDb.db, _fileProviderResolver: () => Promise.resolve(provider) },
-      jwtSecret: JWT_SECRET,
-    });
-    try {
-      await body({ app: isolatedServer.app, jwt: isolatedServer.jwt, provider });
-    } finally {
-      await isolatedDb.cleanup();
-    }
-  }
-
-  async function buildUnattachedMultipartBody(
-    fileSizeBytes: number,
-  ): Promise<{ body: Uint8Array; contentType: string }> {
-    const fd = new FormData();
-    const content = new Uint8Array(fileSizeBytes);
-    content.set([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]); // PNG magic bytes
-    fd.append("file", new File([Buffer.from(content)], "big.png", { type: "image/png" }));
-    const { body, contentType } = await buildMultipartBody(fd);
-    return { body: body as Uint8Array, contentType };
-  }
-
-  test("Content-Length above the limit is rejected without writing to storage", async () => {
-    await withSizeLimitedServer(async ({ app, jwt, provider }) => {
-      const token = await jwt.sign(adminUser);
-      const { body, contentType } = await buildUnattachedMultipartBody(OVER_LIMIT_FILE_BYTES);
-      const res = await app.request("/api/files", {
-        method: "POST",
-        headers: { Authorization: `Bearer ${token}`, "Content-Type": contentType },
-        body: body as unknown as BodyInit,
-      });
-      expect(res.status).toBe(413);
-      const json = (await res.json()) as { error: string };
-      expectErrorIncludes(json.error, "request_too_large");
-      expect(provider.keys()).toEqual([]);
-    });
-  });
-
-  test("a chunked body without Content-Length above the limit is rejected while streaming", async () => {
-    await withSizeLimitedServer(async ({ app, jwt, provider }) => {
-      const token = await jwt.sign(adminUser);
-      const { body, contentType } = await buildUnattachedMultipartBody(OVER_LIMIT_FILE_BYTES);
-      // Feeding the buffer through a ReadableStream (instead of handing it to
-      // fetch directly) means no Content-Length can be inferred — this drives
-      // bodyLimit's streaming/counting branch instead of its Content-Length
-      // shortcut.
-      const stream = new ReadableStream<Uint8Array>({
-        start(controller) {
-          const chunkSize = 8 * 1024;
-          for (let offset = 0; offset < body.length; offset += chunkSize) {
-            controller.enqueue(body.subarray(offset, offset + chunkSize));
-          }
-          controller.close();
-        },
-      });
-      const req = new Request("http://localhost/api/files", {
-        method: "POST",
-        headers: { Authorization: `Bearer ${token}`, "Content-Type": contentType },
-        body: stream,
-        duplex: "half",
-      } as RequestInit);
-      // A stream body has no known length — confirms this exercises
-      // bodyLimit's streaming/counting branch, not its Content-Length shortcut.
-      expect(req.headers.get("content-length")).toBeNull();
-      const res = await app.request(req);
-      expect(res.status).toBe(413);
-      const json = (await res.json()) as { error: string };
-      expectErrorIncludes(json.error, "request_too_large");
-      expect(provider.keys()).toEqual([]);
-    });
-  });
-
-  test("an upload within the limit still succeeds", async () => {
-    await withSizeLimitedServer(async ({ app, jwt, provider }) => {
-      const token = await jwt.sign(adminUser);
-      const { body, contentType } = await buildUnattachedMultipartBody(128);
-      const res = await app.request("/api/files", {
-        method: "POST",
-        headers: { Authorization: `Bearer ${token}`, "Content-Type": contentType },
-        body: body as unknown as BodyInit,
-      });
-      expect(res.status).toBe(201);
-      expect(provider.keys().length).toBe(1);
-    });
-  });
-});