@cosmicdrift/kumiko-bundled-features 0.164.0 → 0.165.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.164.0",
+  "version": "0.165.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -57,6 +57,7 @@
     "./mail-transport-inmemory": "./src/mail-transport-inmemory/index.ts",
     "./file-foundation": "./src/file-foundation/index.ts",
     "./file-provider-s3": "./src/file-provider-s3/index.ts",
+    "./document-ingest-foundation": "./src/document-ingest-foundation/index.ts",
     "./file-provider-s3-env": "./src/file-provider-s3-env/index.ts",
     "./file-provider-inmemory": "./src/file-provider-inmemory/index.ts",
     "./files": "./src/files/index.ts",
@@ -117,11 +118,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.164.0",
-    "@cosmicdrift/kumiko-framework": "0.164.0",
-    "@cosmicdrift/kumiko-headless": "0.164.0",
-    "@cosmicdrift/kumiko-renderer": "0.164.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.164.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.165.0",
+    "@cosmicdrift/kumiko-framework": "0.165.0",
+    "@cosmicdrift/kumiko-headless": "0.165.0",
+    "@cosmicdrift/kumiko-renderer": "0.165.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.165.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/admin-shell/__tests__/admin-shell-security.integration.test.ts

@@ -21,7 +21,6 @@ import { createConfigFeature } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
 import { createFeatureTogglesFeature } from "../../feature-toggles/feature";
-import { globalFeatureStateTable } from "../../feature-toggles/global-feature-state-table";
 import { JobQueries } from "../../jobs/constants";
 import { createJobsFeature } from "../../jobs/feature";
 import { jobRunLogsTable, jobRunsTable } from "../../jobs/job-run-table";
@@ -79,10 +78,12 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  // globalFeatureStateTable is auto-provisioned by setupTestStack — no
+  // manual push needed (that used to mask a missing r.storeTable()
+  // registration entirely).
   await unsafePushTables(stack.db, {
     configValuesTable,
     tenantMembershipsTable,
-    globalFeatureStateTable,
     jobRunsTable,
     jobRunLogsTable,
   });

package/src/auth-email-password/__tests__/self-registration-toggle.integration.test.ts

@@ -1,6 +1,6 @@
 // Runtime on/off switch for self-signup (#self-registration-toggle). Pins:
 //   1. Default (no override row) → signup-request works.
-//   2. runtime.apply(off) → signup-request 403 feature_disabled, no mail sent.
+//   2. runtime.apply(off) → signup-request still 200 (silent no-op, anti-enumeration), no mail sent.
 //   3. runtime.apply(on) → works again.
 // Mirrors samples/recipes/feature-toggles' runtime.apply() pattern — flips the
 // in-memory snapshot directly instead of going through the set-handler/HTTP,
@@ -91,11 +91,13 @@ beforeAll(async () => {
 
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
+  // globalFeatureStateTable is auto-provisioned by setupTestStack — no
+  // manual push needed (that used to mask a missing r.storeTable()
+  // registration entirely).
   await unsafePushTables(stack.db, {
     configValuesTable,
     tenantMembershipsTable,
     notificationPreferencesTable,
-    globalFeatureStateTable,
   });
 
   runtime = new GlobalFeatureToggleRuntime(stack.db, stack.registry);
@@ -166,3 +168,102 @@ describe("auth-self-registration toggle", () => {
     });
   });
 });
+
+// Regression for Finding 1 (#1468): the suite above always composes the
+// companion toggle feature alongside feature-toggles. An app that mounts
+// createFeatureTogglesFeature + a real effectiveFeatures resolver but
+// forgets (or never knew to) compose createAuthSelfRegistrationToggleFeature
+// must not go silently signup-dead — ctx.hasFeature() is checked against a
+// feature name the registry never registered.
+describe("auth-self-registration toggle — companion feature NOT composed", () => {
+  const bareEmailTransport = createInMemoryTransport();
+  let bareStack: TestStack;
+  let bareRuntime: GlobalFeatureToggleRuntime;
+
+  beforeAll(async () => {
+    const runtimeHolder = createLateBoundHolder<GlobalFeatureToggleRuntime>("bare-runtime");
+    let effective: () => ReadonlySet<string> = () => new Set();
+
+    bareStack = await setupTestStack({
+      features: [
+        createConfigFeature(),
+        createUserFeature(),
+        createTenantFeature(),
+        createTemplateResolverFeature(),
+        createRendererFoundationFeature(),
+        createDeliveryFeature(),
+        createRendererSimpleFeature(),
+        createChannelEmailFeature({
+          transport: bareEmailTransport,
+          renderer: simpleRenderer,
+          resolveEmail: async () => "unused@test.local",
+        }),
+        createAuthEmailPasswordFeature({
+          signup: { tokenTtlMinutes: 60, appUrl: APP_ACTIVATION_URL },
+        }),
+        // Deliberately NO createAuthSelfRegistrationToggleFeature().
+        createFeatureTogglesFeature({ getRuntime: () => runtimeHolder.get() }),
+      ],
+      effectiveFeatures: () => effective(),
+      extraContext: (deps) => ({
+        ...createDeliveryTestContext(deps),
+        configResolver: createConfigResolver(),
+      }),
+      systemHooks: [],
+      anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
+      authConfig: {
+        membershipQuery: "tenant:query:memberships",
+        loginHandler: AuthHandlers.login,
+        signup: {
+          requestHandler: AuthHandlers.signupRequest,
+          confirmHandler: AuthHandlers.signupConfirm,
+        },
+      },
+    });
+
+    await unsafeCreateEntityTable(bareStack.db, userEntity);
+    await unsafeCreateEntityTable(bareStack.db, tenantEntity);
+    await unsafePushTables(bareStack.db, {
+      configValuesTable,
+      tenantMembershipsTable,
+      notificationPreferencesTable,
+    });
+
+    bareRuntime = new GlobalFeatureToggleRuntime(bareStack.db, bareStack.registry);
+    await bareRuntime.initialize();
+    effective = bareRuntime.effectiveFeatures;
+    runtimeHolder.set(bareRuntime);
+  });
+
+  afterAll(async () => {
+    await bareStack.cleanup();
+  });
+
+  // KNOWN GAP (found while writing this regression pin, not yet decided):
+  // ctx.hasFeature() checks the effective-feature SET, which only ever
+  // contains registered feature names (computeEffectiveFeatures iterates
+  // registry.features). A name nothing ever registered is never a member,
+  // so hasFeature("auth-self-registration") is false here — signup-request
+  // silently no-ops (200, anti-enumeration success shape, but no mail) the
+  // moment an app wires a real effectiveFeatures resolver without also
+  // composing createAuthSelfRegistrationToggleFeature. This pins the
+  // CURRENT (broken) behavior rather than asserting the desired one —
+  // flagged for a follow-up decision, not silently fixed here.
+  test("[KNOWN GAP] signup-request silently drops mail when the companion toggle feature was never composed", async () => {
+    const res = await bareStack.http.raw("POST", "/api/auth/signup-request", {
+      email: "not-toggle-aware@example.com",
+    });
+    expect(res.status).toBe(200);
+    expect(bareEmailTransport.sent).toHaveLength(0);
+  });
+
+  test("[KNOWN GAP] signup-registration-status reports enabled:false with no toggle feature mounted", async () => {
+    const res = await bareStack.http.raw("POST", "/api/query", {
+      type: "auth-email-password:query:signup-registration-status",
+      payload: {},
+    });
+    expect((await res.json()) as { data?: { enabled: boolean } }).toMatchObject({
+      data: { enabled: false },
+    });
+  });
+});

package/src/auth-email-password/web/__tests__/login-screen.test.tsx

@@ -331,7 +331,7 @@ describe("LoginScreen", () => {
     fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
     fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
     await waitFor(() => {
-      expect(screen.getByRole("alert").textContent).toMatch(/MFA|Zwei-Faktor|nicht unterstützt/i);
+      expect(screen.getByRole("alert").textContent).toContain("unterstützt keine Zwei-Faktor");
     });
   });
 

package/src/auth-mfa/__tests__/enable-confirm-preauth.integration.test.ts

@@ -6,7 +6,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -38,7 +38,7 @@ import { base32Decode } from "../base32";
 import { mfaRequiredConfigHandle } from "../config";
 import { AuthMfaHandlers } from "../constants";
 import { createAuthMfaFeature, mfaStatusCheckerFromFeature } from "../feature";
-import { userMfaEntity } from "../schema/user-mfa";
+import { userMfaEntity, userMfaTable } from "../schema/user-mfa";
 import { currentTotpCode } from "../totp";
 
 let stack: TestStack;
@@ -163,7 +163,7 @@ describe("POST /auth/mfa/preauth-confirm", () => {
 
   test("wrong TOTP code → invalid_totp_code, no enrollment persisted", async () => {
     const email = "wrongcode@example.com";
-    const { preauthSetupToken } = await loginBlockedByEnforcement(email);
+    const { preauthSetupToken, userId } = await loginBlockedByEnforcement(email);
     const { setupToken } = await startEnrollment(preauthSetupToken, email);
 
     const res = await stack.http.raw("POST", "/api/auth/mfa/preauth-confirm", {
@@ -176,11 +176,16 @@ describe("POST /auth/mfa/preauth-confirm", () => {
     expect(body.isSuccess).toBe(false);
     expect(body.error.details.reason).toBe("invalid_totp_code");
     expect(body.token).toBeUndefined();
+    // "no enrollment persisted" is the actual claim in the test name — the
+    // reason string alone doesn't prove it. Scoped to this test's own user:
+    // the table isn't truncated between tests in this file.
+    const rows = await selectMany(stack.db, userMfaTable, { userId });
+    expect(rows).toHaveLength(0);
   });
 
   test("replaying the same setupToken after a successful confirm → invalid_setup_token (burned), not a second enrollment", async () => {
     const email = "race@example.com";
-    const { preauthSetupToken } = await loginBlockedByEnforcement(email);
+    const { preauthSetupToken, userId } = await loginBlockedByEnforcement(email);
     const { setupToken, secret } = await startEnrollment(preauthSetupToken, email);
     const code = currentTotpCode(secret);
 
@@ -200,6 +205,9 @@ describe("POST /auth/mfa/preauth-confirm", () => {
     expect(second.status).not.toBe(200);
     const secondBody = await second.json();
     expect(secondBody.error.details.reason).toBe("invalid_setup_token");
+    // "not a second enrollment" — pin the row count, not just the error reason.
+    const rows = await selectMany(stack.db, userMfaTable, { userId });
+    expect(rows).toHaveLength(1);
   });
 
   test("a session-issued setupToken (no tenantId) is rejected, not silently accepted", async () => {

package/src/auth-mfa/__tests__/enable-start-preauth.integration.test.ts

@@ -163,9 +163,32 @@ describe("POST /auth/mfa/preauth-enable-start", () => {
       accountLabel: "unenrolled@example.com",
     });
 
-    expect(res.status).not.toBe(200);
+    expect(res.status).toBe(422);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(false);
+    expect(body.error.details.reason).toBe("invalid_challenge_token");
+    expect(body.setupToken).toBeUndefined();
+  });
+
+  test("structurally-valid preauthSetupToken signed with the WRONG secret (setup instead of challenge) is rejected", async () => {
+    // EnableStartPreauthOptions warns explicitly about this secret mix-up —
+    // signing with SETUP_TOKEN_SECRET instead of the CHALLENGE_TOKEN_SECRET
+    // that preauth-enable-start actually verifies against must fail exactly
+    // like a garbage token, not silently pass signature verification.
+    const { token: wrongSecretToken } = signMfaPreauthSetupToken(
+      { userId: "11111111-1111-4111-8111-111111111111", tenantId: TENANT_ID },
+      10,
+      SETUP_TOKEN_SECRET,
+    );
+    const res = await stack.http.raw("POST", "/api/auth/mfa/preauth-enable-start", {
+      preauthSetupToken: wrongSecretToken,
+      accountLabel: "unenrolled@example.com",
+    });
+
+    expect(res.status).toBe(422);
     const body = await res.json();
     expect(body.isSuccess).toBe(false);
+    expect(body.error.details.reason).toBe("invalid_challenge_token");
     expect(body.setupToken).toBeUndefined();
   });
 

package/src/auth-mfa/__tests__/mfa-preauth-setup-token.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { Temporal } from "temporal-polyfill";
+import { signMfaChallengeToken, verifyMfaChallengeToken } from "../mfa-challenge-token";
 import { signMfaPreauthSetupToken, verifyMfaPreauthSetupToken } from "../mfa-preauth-setup-token";
 
 const SECRET = "test-mfa-preauth-setup-secret-at-least-32-bytes!!";
@@ -34,6 +35,31 @@ describe("mfa-preauth-setup-token", () => {
     });
   });
 
+  test("a genuine mfa-challenge token cannot be replayed as a preauth-setup token, and vice versa", () => {
+    // Both bodies share the identical JSON shape ({userId, tenantId,
+    // expiresAtMs}), so this only fails if the domain-separated signing
+    // string (`mfa-challenge:` vs `mfa-preauth-setup:`) actually differs.
+    const { token: challengeToken } = signMfaChallengeToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+    );
+    expect(verifyMfaPreauthSetupToken(challengeToken, SECRET)).toEqual({
+      ok: false,
+      reason: "bad_signature",
+    });
+
+    const { token: setupToken } = signMfaPreauthSetupToken(
+      { userId: USER_ID, tenantId: TENANT_ID },
+      10,
+      SECRET,
+    );
+    expect(verifyMfaChallengeToken(setupToken, SECRET)).toEqual({
+      ok: false,
+      reason: "bad_signature",
+    });
+  });
+
   test("tampered signature → bad_signature", () => {
     const { token } = signMfaPreauthSetupToken(
       { userId: USER_ID, tenantId: TENANT_ID },

package/src/auth-mfa/web/__tests__/mfa-setup-preauth-screen.test.tsx

@@ -199,4 +199,78 @@ describe("MfaSetupPreauthScreen", () => {
     );
     expect(screen.queryByRole("button", { name: "Zurück zum Login" })).toBeNull();
   });
+
+  test("confirm schlägt mit invalid_totp_code fehl → übersetztes Banner, onSuccess NICHT gefeuert, Formular weiter bedienbar", async () => {
+    const onSuccess = mock(() => {});
+    globalThis.fetch = mock(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes("preauth-enable-start")) return jsonResponse(startBody);
+      if (url.includes("preauth-confirm")) {
+        return jsonResponse({ isSuccess: false, error: "invalid_totp_code" });
+      }
+      return jsonResponse({ isSuccess: false, error: "unexpected_url" }, 500);
+    }) as unknown as typeof fetch;
+
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen
+          preauthSetupToken="preauth-1"
+          accountLabel="user@example.com"
+          onSuccess={onSuccess}
+        />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "000000" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung abschließen" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Ungültiger Code. Bitte erneut versuchen.")).toBeTruthy();
+    });
+    expect(onSuccess).not.toHaveBeenCalled();
+    // Form stays usable — QR/recovery section is still there, a retry is possible.
+    expect(screen.getByText("ABCD1234")).toBeTruthy();
+    const confirm = screen.getByRole("button", {
+      name: "Einrichtung abschließen",
+    }) as HTMLButtonElement;
+    expect(confirm.disabled).toBe(false);
+  });
+
+  test("confirm schlägt mit invalid_setup_token fehl → übersetztes Banner (Neustart-Pfad)", async () => {
+    globalThis.fetch = mock(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes("preauth-enable-start")) return jsonResponse(startBody);
+      if (url.includes("preauth-confirm")) {
+        return jsonResponse({ isSuccess: false, error: "invalid_setup_token" });
+      }
+      return jsonResponse({ isSuccess: false, error: "unexpected_url" }, 500);
+    }) as unknown as typeof fetch;
+
+    render(
+      <Wrapper>
+        <MfaSetupPreauthScreen preauthSetupToken="preauth-1" accountLabel="user@example.com" />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "123456" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung abschließen" }));
+
+    await waitFor(() => {
+      expect(
+        screen.getByText("Die Einrichtung ist abgelaufen. Bitte erneut starten."),
+      ).toBeTruthy();
+    });
+  });
 });

package/src/config/__tests__/cascade.integration.test.ts

@@ -528,10 +528,9 @@ describe("config:query:cascade handler", () => {
   });
 });
 
-// getAll / getAllWithSource are bulk readers used by admin UIs — never
-// reached via the cascade query handlers above, so they stay uncovered
-// unless called directly on the resolver.
-describe("getAll / getAllWithSource", () => {
+// getAll is a bulk reader — never reached via the cascade query handlers
+// above, so it stays uncovered unless called directly on the resolver.
+describe("getAll", () => {
   test("getAll picks the most specific row (user > tenant > system)", async () => {
     await stack.http.writeOk(
       ConfigHandlers.set,
@@ -551,18 +550,4 @@ describe("getAll / getAllWithSource", () => {
     // System seed still present for keys without a more-specific row.
     expect(JSON.parse(all.get(SYSTEM_KEY)?.value ?? "null")).toBe("SEED_SYSTEM");
   });
-
-  test("getAllWithSource tags the winning row's source", async () => {
-    const withSource = await resolver.getAllWithSource(tenantAdmin.tenantId, tenantAdmin.id, db);
-
-    const userRow = withSource.get(USER_KEY);
-    expect(userRow?.source).toBe("user-row");
-    expect(JSON.parse(userRow?.value ?? "null")).toBe("USER_BULK");
-
-    const tenantRow = withSource.get(TENANT_KEY);
-    expect(tenantRow?.source).toBe("tenant-row");
-
-    const systemRow = withSource.get(SYSTEM_KEY);
-    expect(systemRow?.source).toBe("system-row");
-  });
 });

package/src/config/resolver.ts

@@ -12,7 +12,6 @@ import type {
   ConfigKeyDefinition,
   ConfigResolver,
   ConfigSecretsReader,
-  ConfigStoredRowWithSource,
   ConfigValueSource,
   ConfigValueWithSource,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -441,12 +440,12 @@ export function createConfigResolver(options: ConfigResolverOptions = {}): Confi
       return { value: undefined, source: "missing" };
     },
 
-    // NOTE: getAll / getAllWithSource read only config_values rows and do NOT
-    // dispatch to the secrets store (unlike get/getCascade/getWithSource). A
-    // backing="secrets" key has no config_values row, so it is simply ABSENT
-    // from the result map — never a stale/undefined value. Callers needing a
-    // secrets-backed value must use get/getCascade; these bulk readers are for
-    // the config_values-backed keys only.
+    // NOTE: getAll reads only config_values rows and does NOT dispatch to the
+    // secrets store (unlike get/getCascade/getWithSource). A backing="secrets"
+    // key has no config_values row, so it is simply ABSENT from the result map
+    // — never a stale/undefined value. Callers needing a secrets-backed value
+    // must use get/getCascade; this bulk reader is for config_values-backed
+    // keys only.
     async getAll(tenantId, userId, db) {
       // Only load rows relevant to this user/tenant (system + tenant + user scope)
       const rows = await selectConfigRowsForScope(db, SYSTEM_TENANT_ID, tenantId, userId);
@@ -467,48 +466,6 @@ export function createConfigResolver(options: ConfigResolverOptions = {}): Confi
       return result;
     },
 
-    async getAllWithSource(tenantId, userId, db) {
-      // Load ALL potentially relevant rows (user + tenant + system)
-      const rows = await selectConfigRowsForScope(db, SYSTEM_TENANT_ID, tenantId, userId);
-
-      const result = new Map<string, ConfigStoredRowWithSource>();
-
-      // Group rows by key so we can determine the winner and its source
-      const groups = new Map<string, ConfigRow[]>();
-      for (const r of rows) {
-        const g = groups.get(r.key) ?? [];
-        g.push(r);
-        groups.set(r.key, g);
-      }
-
-      for (const [key, keyRows] of groups) {
-        const specificityOf = (candidate: ConfigRow) =>
-          (candidate.userId !== null ? 2 : 0) + (candidate.tenantId !== SYSTEM_TENANT_ID ? 1 : 0);
-
-        const first = keyRows[0];
-        if (!first) continue;
-        let winner: ConfigRow = first;
-        for (const r of keyRows) {
-          if (specificityOf(r) > specificityOf(winner)) {
-            winner = r;
-          }
-        }
-
-        let source: ConfigValueSource;
-        if (winner.userId !== null) {
-          source = "user-row";
-        } else if (winner.tenantId !== SYSTEM_TENANT_ID) {
-          source = "tenant-row";
-        } else {
-          source = "system-row";
-        }
-
-        result.set(key, { ...winner, source });
-      }
-
-      return result;
-    },
-
     async getCascade(
       qualifiedKey,
       keyDef,

package/src/document-ingest-foundation/__tests__/feature.integration.test.ts

@@ -0,0 +1,147 @@
+// document-ingest-foundation — fileRef.created MSP integration test.
+//
+// Proves the end-to-end trigger flow: upload → fileRef.created →
+// documentIngest.requested, gated on mime/size (files-post-processing
+// pattern, kumiko-framework#1497).
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createInMemoryFileProvider,
+  type InMemoryFileProvider,
+} from "@cosmicdrift/kumiko-framework/files";
+import { setupTestStack, type TestStack, TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { createConfigFeature } from "../../config";
+import { documentIngestFoundationFeature } from "../feature";
+
+let stack: TestStack;
+let provider: InMemoryFileProvider;
+
+const admin = TestUsers.admin;
+
+const pdfBytes = new TextEncoder().encode("%PDF-1.4 minimal");
+const pngBytes = new Uint8Array([
+  0x89,
+  0x50,
+  0x4e,
+  0x47,
+  0x0d,
+  0x0a,
+  0x1a,
+  0x0a,
+  ...Array(64).fill(0),
+]);
+const textBytes = new TextEncoder().encode("plain text, not a supported mime type");
+
+beforeAll(async () => {
+  provider = createInMemoryFileProvider();
+  stack = await setupTestStack({
+    features: [createConfigFeature(), documentIngestFoundationFeature],
+    files: { storageProvider: provider },
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  provider.clear();
+  stack.events.reset();
+  await asRawClient(stack.db).unsafe(
+    `TRUNCATE kumiko_events, kumiko_event_consumers, file_refs RESTART IDENTITY CASCADE`,
+  );
+  await stack.eventDispatcher?.ensureRegistered();
+});
+
+async function uploadFile(
+  fileName: string,
+  content: Uint8Array,
+  mimeType: string,
+): Promise<{ id: string; storageKey: string }> {
+  const token = await stack.jwt.sign(admin);
+  const formData = new FormData();
+  formData.append("file", new File([Buffer.from(content)], fileName, { type: mimeType }));
+  const res = await stack.app.request("/api/files", {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}` },
+    body: formData,
+  });
+  expect(res.status).toBe(201);
+  const body = (await res.json()) as { id: string; storageKey: string };
+  return body;
+}
+
+async function loadIngestRequestedEvents(): Promise<{ payload: Record<string, unknown> }[]> {
+  const rows = await asRawClient(stack.db).unsafe(
+    `SELECT payload FROM kumiko_events WHERE type = $1`,
+    ["document-ingest-foundation:event:document-ingest-requested"],
+  );
+  return rows as { payload: Record<string, unknown> }[];
+}
+
+describe("fileRef.created → documentIngest.requested", () => {
+  test("PDF upload requests ingest with the fileRef pointer, no binary", async () => {
+    const { id, storageKey } = await uploadFile("invoice.pdf", pdfBytes, "application/pdf");
+
+    await stack.eventDispatcher?.runOnce();
+
+    const rows = await loadIngestRequestedEvents();
+    expect(rows).toHaveLength(1);
+    const payload = rows[0]?.payload;
+    expect(payload?.["fileRefId"]).toBe(id);
+    expect(payload?.["storageKey"]).toBe(storageKey);
+    expect(payload?.["mimeType"]).toBe("application/pdf");
+    expect(payload?.["data"]).toBeUndefined();
+    expect(payload?.["binary"]).toBeUndefined();
+  });
+
+  test("image/png upload also requests ingest (Phase-1 mime allowlist)", async () => {
+    await uploadFile("scan.png", pngBytes, "image/png");
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(await loadIngestRequestedEvents()).toHaveLength(1);
+  });
+
+  test("unsupported mime type is skipped — no ingest requested", async () => {
+    await uploadFile("notes.txt", textBytes, "text/plain");
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(await loadIngestRequestedEvents()).toHaveLength(0);
+  });
+
+  test("oversized file is skipped before the mime check — no ingest requested", async () => {
+    // Real uploads can't exceed file-routes.ts' 10mb unconstrained-upload
+    // default, well below this feature's 25mb domain cap — so an oversized
+    // fileRef.created is inserted directly (bypassing the upload route) to
+    // prove the MSP's own size-check fires independently of it.
+    await asRawClient(stack.db).unsafe(
+      `
+      INSERT INTO kumiko_events
+      (tenant_id, aggregate_type, aggregate_id, version, type, payload, metadata, created_at, created_by)
+      VALUES ($1, $2, $3, $4, $5, $6, $7, now(), $8)
+      `,
+      [
+        admin.tenantId,
+        "fileRef",
+        "00000000-0000-4000-8000-0000000000ff",
+        1,
+        "fileRef.created",
+        JSON.stringify({
+          storageKey: "huge.pdf",
+          fileName: "huge.pdf",
+          mimeType: "application/pdf",
+          size: 26 * 1024 * 1024,
+        }),
+        "{}",
+        admin.id,
+      ],
+    );
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(await loadIngestRequestedEvents()).toHaveLength(0);
+  });
+});