@cosmicdrift/kumiko-framework 0.163.3 → 0.165.0

package/src/engine/feature-ast/__tests__/render-roundtrip.test.ts

@@ -258,6 +258,7 @@ describe("render → parse roundtrip — mixed patterns (header data + opaque bo
 // from the parsed FeaturePattern shape alone.
 const RAW_REF_FEATURE = `
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { chatCompleteHandler } from "./handlers";
 
 const eventEntity = {
   fields: { name: { type: "text", required: true } },
@@ -284,6 +285,7 @@ defineFeature("refs", (r) => {
   r.entity("event", eventEntity);
   r.entity("task", { fields: buildFields() });
   r.writeHandler(makeHandler());
+  r.streamHandler(chatCompleteHandler);
   r.screen(eventListScreen);
 });
 `;
@@ -297,6 +299,7 @@ describe("render → parse roundtrip — unresolved references (raw-ref sentinel
       { kind: "entity", entityName: "event", definition: { __raw: "eventEntity" } },
       { kind: "entity", entityName: "task", definition: { fields: { __raw: "buildFields()" } } },
       { kind: "writeHandler", handlerName: undefined },
+      { kind: "streamHandler", handlerName: undefined },
       { kind: "screen", definition: { __raw: "eventListScreen" } },
     ]);
   });
@@ -310,6 +313,7 @@ describe("render → parse roundtrip — unresolved references (raw-ref sentinel
     expect(rendered).toContain("eventEntity");
     expect(rendered).toContain("buildFields()");
     expect(rendered).toContain("r.writeHandler(makeHandler())");
+    expect(rendered).toContain("r.streamHandler(chatCompleteHandler)");
     expect(rendered).toContain("r.screen(eventListScreen);");
     // Would only appear if buildFields()'s return value got inlined.
     expect(rendered).not.toContain("title:");

package/src/engine/feature-ast/extractors/handlers.ts

@@ -204,21 +204,24 @@ export function extractWriteHandler(
   });
 }
 
-export function extractQueryHandler(
-  call: CallExpression,
-  sourceFile: SourceFile,
-): ExtractOutput<QueryHandlerPattern> {
-  const parsed = parseHandlerCall(call, sourceFile, "queryHandler");
-  if (parsed.kind === "error") return parsed;
-  return ok({
-    kind: "queryHandler",
+function readHandlerFields(parsed: Extract<ExtractOutput<ParsedHandlerCall>, { kind: "pattern" }>) {
+  return {
     source: parsed.pattern.source,
     handlerName: parsed.pattern.handlerName,
     schemaSource: parsed.pattern.schemaSource,
     handlerBody: parsed.pattern.handlerBody,
     ...(parsed.pattern.access !== undefined && { access: parsed.pattern.access }),
     ...(parsed.pattern.rateLimit !== undefined && { rateLimit: parsed.pattern.rateLimit }),
-  });
+  };
+}
+
+export function extractQueryHandler(
+  call: CallExpression,
+  sourceFile: SourceFile,
+): ExtractOutput<QueryHandlerPattern> {
+  const parsed = parseHandlerCall(call, sourceFile, "queryHandler");
+  if (parsed.kind === "error") return parsed;
+  return ok({ kind: "queryHandler", ...readHandlerFields(parsed) });
 }
 
 export function extractStreamHandler(
@@ -227,13 +230,5 @@ export function extractStreamHandler(
 ): ExtractOutput<StreamHandlerPattern> {
   const parsed = parseHandlerCall(call, sourceFile, "streamHandler");
   if (parsed.kind === "error") return parsed;
-  return ok({
-    kind: "streamHandler",
-    source: parsed.pattern.source,
-    handlerName: parsed.pattern.handlerName,
-    schemaSource: parsed.pattern.schemaSource,
-    handlerBody: parsed.pattern.handlerBody,
-    ...(parsed.pattern.access !== undefined && { access: parsed.pattern.access }),
-    ...(parsed.pattern.rateLimit !== undefined && { rateLimit: parsed.pattern.rateLimit }),
-  });
+  return ok({ kind: "streamHandler", ...readHandlerFields(parsed) });
 }

package/src/engine/registry-validate.ts

@@ -564,7 +564,11 @@ export function validateEntityHookTargets(
 }
 
 export function validateJobTriggers(state: RegistryState): void {
-  // Validate: job event triggers must reference existing handlers.
+  // Validate: job event triggers must reference an existing write/query
+  // handler OR an existing r.defineEvent registration. The latter is
+  // delivered async via the job-trigger event-consumer (server.ts), not
+  // the synchronous write-handler dispatch path — see
+  // createJobTriggerEventConsumer in pipeline/system-hooks.ts.
   // Multi-Trigger-Form: jeden Eintrag im Array gegen allHandlers prüfen,
   // auch wenn nur einer fehlt fail-fast.
   const allHandlers = allHandlerQns(state);
@@ -575,8 +579,9 @@ export function validateJobTriggers(state: RegistryState): void {
     for (const t of triggers) {
       const rawName = resolveName(t);
       if (allHandlers.has(rawName)) continue;
+      if (state.eventMap.has(rawName)) continue;
       throw new Error(
-        `Job "${jobName}" triggers on "${rawName}" but no handler with that name exists`,
+        `Job "${jobName}" triggers on "${rawName}" but no handler or event with that name exists`,
       );
     }
   }

package/src/engine/types/index.ts

@@ -1,7 +1,5 @@
 // Barrel: re-exports all types from @cosmicdrift/kumiko-types, plus the
 // runtime helpers below that stay framework-side.
-// Duplicate types (OnDeleteStrategy, ConfigScope, ConcurrencyMode, LifecycleHookType)
-// are defined ONLY in constants.ts — re-exported here for backwards compatibility.
 
 export type {
   ConfigAccessor,

package/src/event-store/__tests__/event-store.integration.test.ts

@@ -6,6 +6,7 @@ import { generateId as uuid } from "../../utils";
 import {
   append,
   createEventsTable,
+  IdempotentAppendConflictError,
   loadAggregate,
   loadAggregateAsOf,
   loadAllEventsByType,
@@ -93,6 +94,143 @@ describe("event-store: append + load", () => {
   });
 });
 
+describe("event-store: idempotency-key conflict", () => {
+  test("second append with a reused idempotencyKey (new aggregate+version) throws IdempotentAppendConflictError", async () => {
+    const first = uuid();
+    const second = uuid();
+    const key = uuid();
+
+    await append(testDb.db, {
+      aggregateId: first,
+      aggregateType: "task",
+      tenantId: tenantA,
+      expectedVersion: 0,
+      type: "task.created",
+      payload: { title: "Orig" },
+      metadata: { userId: userA, idempotencyKey: key },
+    });
+
+    // A retried command that re-runs after the Redis idempotency guard
+    // missed its window: different aggregate, fresh expectedVersion=0 — the
+    // aggregate-version unique index has nothing to say about this pair, so
+    // only the idempotency-key index catches the duplicate.
+    await expect(
+      append(testDb.db, {
+        aggregateId: second,
+        aggregateType: "task",
+        tenantId: tenantA,
+        expectedVersion: 0,
+        type: "task.created",
+        payload: { title: "Retry" },
+        metadata: { userId: userA, idempotencyKey: key },
+      }),
+    ).rejects.toThrow(IdempotentAppendConflictError);
+
+    const events = await loadAggregate(testDb.db, second, tenantA);
+    expect(events).toHaveLength(0);
+  });
+
+  test("subsequent-event append (expectedVersion > 0) also enforces the idempotency key", async () => {
+    const aggregateId = uuid();
+    const key = uuid();
+
+    await append(testDb.db, {
+      aggregateId,
+      aggregateType: "task",
+      tenantId: tenantA,
+      expectedVersion: 0,
+      type: "task.created",
+      payload: { title: "Orig" },
+      metadata: { userId: userA },
+    });
+
+    await append(testDb.db, {
+      aggregateId,
+      aggregateType: "task",
+      tenantId: tenantA,
+      expectedVersion: 1,
+      type: "task.updated",
+      payload: { title: "V2" },
+      metadata: { userId: userA, idempotencyKey: key },
+    });
+
+    // Retry of the v2 update: goes through insertSubsequentEventRow's raw
+    // INSERT ... SELECT ... WHERE EXISTS path, not insertFirstEvent — the
+    // idempotency index must catch it there too.
+    await expect(
+      append(testDb.db, {
+        aggregateId,
+        aggregateType: "task",
+        tenantId: tenantA,
+        expectedVersion: 2,
+        type: "task.updated",
+        payload: { title: "V3-retry" },
+        metadata: { userId: userA, idempotencyKey: key },
+      }),
+    ).rejects.toThrow(IdempotentAppendConflictError);
+
+    const events = await loadAggregate(testDb.db, aggregateId, tenantA);
+    expect(events).toHaveLength(2);
+  });
+
+  test("same idempotencyKey on a different tenant does not conflict", async () => {
+    const key = uuid();
+
+    const a = await append(testDb.db, {
+      aggregateId: uuid(),
+      aggregateType: "task",
+      tenantId: tenantA,
+      expectedVersion: 0,
+      type: "task.created",
+      payload: {},
+      metadata: { userId: userA, idempotencyKey: key },
+    });
+    const b = await append(testDb.db, {
+      aggregateId: uuid(),
+      aggregateType: "task",
+      tenantId: tenantB,
+      expectedVersion: 0,
+      type: "task.created",
+      payload: {},
+      metadata: { userId: userA, idempotencyKey: key },
+    });
+
+    expect(a.version).toBe(1);
+    expect(b.version).toBe(1);
+  });
+
+  test("omitting idempotencyKey allows unlimited appends, unchanged from before", async () => {
+    // Same tenant for both, unlike the different-aggregateId version this
+    // replaces — Postgres treats every NULL as distinct even in a plain
+    // unique index, so this does NOT exercise the partial index's `WHERE
+    // ... IS NOT NULL` clause specifically (that's provable only by a
+    // duplicate NON-null key, covered above). What this does pin: a fully-
+    // omitted key and an explicit `idempotencyKey: undefined` both serialize
+    // to a JSON-absent key (JSON.stringify drops undefined) and must behave
+    // identically, rather than one silently colliding on `"idempotencyKey":null`.
+    const omitted = await append(testDb.db, {
+      aggregateId: uuid(),
+      aggregateType: "task",
+      tenantId: tenantA,
+      expectedVersion: 0,
+      type: "task.created",
+      payload: {},
+      metadata: { userId: userA },
+    });
+    const explicitUndefined = await append(testDb.db, {
+      aggregateId: uuid(),
+      aggregateType: "task",
+      tenantId: tenantA,
+      expectedVersion: 0,
+      type: "task.created",
+      payload: {},
+      metadata: { userId: userA, idempotencyKey: undefined },
+    });
+    expect(omitted.version).toBe(1);
+    expect(explicitUndefined.version).toBe(1);
+  });
+});
+
 describe("event-store: optimistic concurrency", () => {
   test("wrong expectedVersion throws VersionConflictError (no write)", async () => {
     const aggregateId = uuid();

package/src/event-store/__tests__/unscoped-stream-primitives.guard.test.ts

@@ -1,14 +1,11 @@
 import { describe, expect, test } from "bun:test";
 import { Glob } from "bun";
 
-// getUnscopedAggregateStreamMaxVersion / getUnscopedAggregateStreamTenant have
-// no tenant filter — a caller can use them to probe whether a foreign tenant's
-// aggregate exists (see event-store.ts SECURITY doc). Restricted to known
-// seed/system-internal callers; extend only for genuine new ones.
-const RESTRICTED_SYMBOLS = [
-  "getUnscopedAggregateStreamMaxVersion",
-  "getUnscopedAggregateStreamTenant",
-];
+// getUnscopedAggregateStreamMaxVersion has no tenant filter — a caller can use
+// it to probe whether a foreign tenant's aggregate exists (see event-store.ts
+// SECURITY doc). Restricted to known seed/system-internal callers; extend
+// only for genuine new ones.
+const RESTRICTED_SYMBOLS = ["getUnscopedAggregateStreamMaxVersion"];
 
 const ALLOWED_FILES = new Set([
   "packages/framework/src/event-store/event-store.ts",

package/src/event-store/event-store.ts

@@ -1,19 +1,18 @@
 import type { EventMetadata, StoredEvent } from "@cosmicdrift/kumiko-types/event-store-types";
 import { encryptEventPayloadPii } from "../crypto/event-pii";
 import type { DbRunner } from "../db";
-import { isUniqueViolation } from "../db/pg-error";
+import { constraintOf, isUniqueViolation } from "../db/pg-error";
 import {
   insertSubsequentEventRow,
   notifyPgChannel,
   selectAggregateMaxVersion,
-  selectAggregateStreamTenant,
   selectEventsHighWaterMark,
   selectStreamMaxVersion,
 } from "../db/queries/event-store";
 import { insertOne, selectMany } from "../db/query";
 import type { TenantId } from "../engine/types";
 import { isStreamArchived } from "./archive";
-import { VersionConflictError } from "./errors";
+import { IdempotentAppendConflictError, VersionConflictError } from "./errors";
 import { eventsTable } from "./events-schema";
 import { toStoredEvent } from "./row-to-stored-event";
 
@@ -91,10 +90,15 @@ export async function append(db: DbRunner, event: EventToAppend): Promise<Stored
     return buildStoredEvent(toStore, newVersion, eventVersion, row);
   } catch (e) {
     if (isUniqueViolation(e)) {
-      // Only constraint left on the events table: events_aggregate_version_uq
-      // on (tenant_id, aggregate_id, version). A unique violation here always
-      // means a concurrent writer in the same tenant won the race to the
-      // next version — retry-able conflict.
+      // Two unique constraints on this table: events_aggregate_version_uq
+      // (tenant_id, aggregate_id, version) — a concurrent writer won the
+      // race to the next version — and events_idempotency_uq (tenant_id,
+      // metadata->>'idempotencyKey') — the caller reused an idempotency key.
+      // constraintOf() tells them apart; unknown/renamed constraint falls
+      // back to VersionConflictError, the pre-existing behaviour.
+      if (constraintOf(e) === "events_idempotency_uq" && event.metadata.idempotencyKey) {
+        throw new IdempotentAppendConflictError(event.tenantId, event.metadata.idempotencyKey);
+      }
       throw new VersionConflictError(event.aggregateId, event.expectedVersion);
     }
     throw e;
@@ -255,21 +259,6 @@ export async function getUnscopedAggregateStreamMaxVersion(
   return selectAggregateMaxVersion(db, aggregateId);
 }
 
-/** Stream tenant of an aggregate (the tenant_id its events live under), with no
- *  membership/tenant filter. SECURITY: existence-oracle, same caveat as
- *  getUnscopedAggregateStreamMaxVersion — seed/system-internal use only. Recovers
- *  the write target for a systemScope aggregate whose stream tenant isn't one of
- *  the subject's memberships. Returns null for unknown streams. */
-export async function getUnscopedAggregateStreamTenant(
-  db: DbRunner,
-  aggregateId: string,
-  aggregateType: string,
-): Promise<TenantId | null> {
-  const tenantId = await selectAggregateStreamTenant(db, aggregateId, aggregateType);
-  // DB-boundary: kumiko_events.tenant_id is a TenantId-shaped uuid column.
-  return tenantId as TenantId | null;
-}
-
 // Global high-water-mark = MAX(events.id). Marten/Wolverine standard for
 // projection/consumer lag math: lag = HWM - cursor. Single-row aggregate over
 // the bigserial PK index — sub-millisecond cost. Returns 0n on an empty log
@@ -307,7 +296,7 @@ export async function loadEventsAfterVersion(
 // prevent.
 export const LOAD_ALL_EVENTS_ROW_LIMIT = 100_000;
 
-/** @deprecated buffers ALL matching events in memory — a memory cliff for large stores. Use `streamAllEventsByType` (yields batchwise) instead. */
+/** Buffers ALL matching events in memory — a memory cliff for large stores. Use `streamAllEventsByType` (yields batchwise) for production reads; this is test-only in practice. */
 export async function loadAllEventsByType(
   db: DbRunner,
   aggregateType: string,

package/src/event-store/events-schema.ts

@@ -12,6 +12,7 @@ import {
   uniqueIndex,
   uuid,
 } from "../db/dialect";
+import { ensureIdempotencyKeyIndex } from "../db/queries/event-store";
 import { unsafePushTables } from "../stack";
 import { createArchivedStreamsTable } from "./archive";
 import { createSnapshotsTable } from "./snapshot";
@@ -22,9 +23,11 @@ import type { EventMetadata } from "./types";
 // INSERT ... SELECT ... WHERE EXISTS isn't ergonomic in the typed builder.
 //
 // HTTP-level retry idempotency is handled by pipeline/idempotency.ts
-// (Redis-backed check + cached-response replay). The event-store itself
-// imposes no idempotency index — a single HTTP request may write N events
-// freely, metadata.requestId is purely a trace marker.
+// (Redis-backed check + cached-response replay); metadata.requestId is
+// purely a trace marker (no uniqueness constraint — one request may write
+// N events). Callers that need a hard per-event guarantee as a second line
+// of defense set metadata.idempotencyKey, enforced by the tenant-scoped
+// partial unique index ensureIdempotencyKeyIndex() creates below.
 
 export const eventsTable = pgTable(
   "kumiko_events",
@@ -77,6 +80,10 @@ export async function createEventsTable(db: DbConnection): Promise<void> {
   if (!(await tableExists(db, "public.kumiko_events"))) {
     await unsafePushTables(db, { kumikoEvents: eventsTable });
   }
+  // Runs unconditionally (both fresh + already-existing table) so installs
+  // that predate the idempotency-key index get healed the same way
+  // ensureSnapshotVersionColumn heals kumiko_snapshots.
+  await ensureIdempotencyKeyIndex(db);
   await createArchivedStreamsTable(db);
   await createSnapshotsTable(db);
 }

package/src/event-store/index.ts

@@ -12,7 +12,7 @@ export {
   isStreamArchived,
   restoreStream,
 } from "./archive";
-export { ArchivedStreamError, VersionConflictError } from "./errors";
+export { ArchivedStreamError, IdempotentAppendConflictError, VersionConflictError } from "./errors";
 export {
   append,
   EVENTS_PUBSUB_CHANNEL,
@@ -21,7 +21,6 @@ export {
   getEventsHighWaterMark,
   getStreamVersion,
   getUnscopedAggregateStreamMaxVersion,
-  getUnscopedAggregateStreamTenant,
   LOAD_ALL_EVENTS_ROW_LIMIT,
   loadAggregate,
   loadAggregateAsOf,

package/src/pipeline/__tests__/dispatcher.test.ts

@@ -2,9 +2,12 @@ import { describe, expect, test } from "bun:test";
 import { z } from "zod";
 import { createEntity, createRegistry, createTextField, defineFeature } from "../../engine";
 import type { TenantId } from "../../engine/types/identifiers";
+import { createSecret } from "../../secrets/types";
 import { createTestUser } from "../../stack";
 import { createDispatcher } from "../dispatcher";
 
+const streamCleanupState = { closed: false };
+
 const echoFeature = defineFeature("echo", (r) => {
   r.entity("item", createEntity({ table: "Items", fields: { name: createTextField() } }));
 
@@ -36,6 +39,29 @@ const echoFeature = defineFeature("echo", (r) => {
     { access: { roles: ["Admin"] } },
   );
 
+  r.streamHandler(
+    "item:tail-leak",
+    z.object({}),
+    async function* () {
+      yield { apiKey: createSecret("leak-me") };
+    },
+    { access: { roles: ["Admin"] } },
+  );
+
+  r.streamHandler(
+    "item:tail-cleanup",
+    z.object({}),
+    async function* () {
+      try {
+        yield { i: 0 };
+        yield { i: 1 };
+      } finally {
+        streamCleanupState.closed = true;
+      }
+    },
+    { access: { roles: ["Admin"] } },
+  );
+
   r.hook("validation", "item:create", (data) => {
     if (data["name"] === "forbidden") return [{ field: "name", error: "forbidden_name" }];
     return null;
@@ -272,6 +298,32 @@ describe("dispatcher.stream", () => {
       collect(dispatcher.stream("nonexistent", {}, createTestUser({ roles: ["Admin"] }))),
     ).rejects.toMatchObject({ code: "not_found", httpStatus: 404 });
   });
+
+  test("a chunk containing a Secret<> value aborts the stream instead of leaking it", async () => {
+    const dispatcher = createTestDispatcher();
+
+    await expect(
+      collect(
+        dispatcher.stream("echo:stream:item:tail-leak", {}, createTestUser({ roles: ["Admin"] })),
+      ),
+    ).rejects.toMatchObject({ message: expect.stringContaining("Secret<> leaked") });
+  });
+
+  test("consumer breaking out of for-await runs the handler generator's finally block", async () => {
+    streamCleanupState.closed = false;
+    const dispatcher = createTestDispatcher();
+    const gen = dispatcher.stream(
+      "echo:stream:item:tail-cleanup",
+      {},
+      createTestUser({ roles: ["Admin"] }),
+    );
+
+    for await (const _chunk of gen) {
+      break;
+    }
+
+    expect(streamCleanupState.closed).toBe(true);
+  });
 });
 
 // --- postQuery hooks on standalone (entity-less) queries ---

package/src/pipeline/__tests__/job-trigger-consumer.integration.test.ts

@@ -0,0 +1,106 @@
+// createJobTriggerEventConsumer — proves r.job's trigger.on can fire on an
+// r.defineEvent QN appended by a multiStreamProjection's unsafeAppendEvent
+// (kumiko-framework#1505). Mirrors document-ingest-foundation's actual
+// request-ingest MSP (upload → fileRef.created → an owned defineEvent),
+// the motivating case for this fix — fileRef.created itself never reaches
+// jobRunner.handleEvent because the upload route appends it via the raw
+// event-store executor, not a write-handler dispatch (see #1505).
+//
+// Not covered here: a job triggered on a write/query-handler QN still
+// firing exactly once (unaffected by the new consumer). The full suite
+// stays green (e.g. the lane-routing sample), but that's not a positive
+// test of the partition guard — no stored event's `type` is ever a
+// handler QN in practice (entity events are "entity.verb"; custom
+// write-handlers like lane-routing's don't append to the store at all),
+// so `getWriteHandler`/`getQueryHandler` in the new consumer's handler is
+// defense-in-depth for an input shape the framework doesn't currently
+// produce, not something exercised end-to-end by any test today.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { z } from "zod";
+import { entityEventName } from "../../db";
+import { defineFeature } from "../../engine";
+import { createInMemoryFileProvider, type InMemoryFileProvider } from "../../files";
+import { setupTestStack, type TestStack, TestUsers } from "../../stack";
+import { waitFor } from "../../testing";
+
+const ITEM_REQUESTED_EVENT_QN = "job-trigger-fixture:event:item-requested";
+const FILE_REF_CREATED = entityEventName("fileRef", "created");
+
+const processedItems: Array<{ readonly fileRefId: string }> = [];
+
+const jobTriggerFixtureFeature = defineFeature("job-trigger-fixture", (r) => {
+  r.defineEvent("item-requested", z.object({ fileRefId: z.string().min(1) }));
+
+  // Mirrors document-ingest-foundation's request-ingest MSP exactly: reacts
+  // to fileRef.created, appends a NEW event via unsafeAppendEvent — no
+  // write-handler behind the appended event itself.
+  r.multiStreamProjection({
+    name: "request-item",
+    apply: {
+      [FILE_REF_CREATED]: async (event, _tx, ctx) => {
+        await ctx.unsafeAppendEvent({
+          aggregateId: event.aggregateId,
+          aggregateType: "job-trigger-fixture-request",
+          type: ITEM_REQUESTED_EVENT_QN,
+          payload: { fileRefId: event.aggregateId },
+        });
+      },
+    },
+  });
+
+  // Under test: only reachable via createJobTriggerEventConsumer, since
+  // ITEM_REQUESTED_EVENT_QN is an r.defineEvent QN, not a handler QN.
+  r.job(
+    "process-item",
+    { trigger: { on: ITEM_REQUESTED_EVENT_QN }, runIn: "worker" },
+    async (payload) => {
+      processedItems.push({ fileRefId: payload["fileRefId"] as string });
+    },
+  );
+});
+
+let stack: TestStack;
+let provider: InMemoryFileProvider;
+
+beforeAll(async () => {
+  provider = createInMemoryFileProvider();
+  stack = await setupTestStack({
+    features: [jobTriggerFixtureFeature],
+    files: { storageProvider: provider },
+    jobs: { consumerLane: "worker" },
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(() => {
+  processedItems.length = 0;
+  provider.clear();
+});
+
+describe("job-trigger event consumer", () => {
+  test("a job triggers on an r.defineEvent QN appended by an MSP's unsafeAppendEvent", async () => {
+    const token = await stack.jwt.sign(TestUsers.admin);
+    const formData = new FormData();
+    formData.append("file", new File([Buffer.from("hello")], "note.txt", { type: "text/plain" }));
+    const res = await stack.app.request("/api/files", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+      body: formData,
+    });
+    expect(res.status).toBe(201);
+
+    await waitFor(async () => {
+      // Drives both the MSP (appends item-requested off fileRef.created)
+      // and the new job-trigger consumer (reacts to it) — may need more
+      // than one pass since the MSP's append happens mid-drain.
+      await stack.eventDispatcher?.runOnce();
+      expect(processedItems).toHaveLength(1);
+    });
+
+    expect(processedItems[0]?.fileRefId).toBeTruthy();
+  });
+});

package/src/pipeline/__tests__/lifecycle-pipeline.test.ts

@@ -707,30 +707,43 @@ describe("runPostSaveBatch / runPostDeleteBatch", () => {
     expect(seen).toEqual([[deletectx]]);
   });
 
-  test("one batch hook throwing doesn't stop the others (Promise.allSettled) — logged, never thrown", async () => {
+  test.each([
+    [
+      "postSaveBatch",
+      (hooks: { name: string; priority: number; fn: () => Promise<void> }[]) =>
+        ({ postSaveBatch: hooks }) satisfies SystemHooks,
+      (pipeline: ReturnType<typeof createLifecycleHooks>) =>
+        pipeline.runPostSaveBatch([savectx], {}),
+    ],
+    [
+      "postDeleteBatch",
+      (hooks: { name: string; priority: number; fn: () => Promise<void> }[]) =>
+        ({ postDeleteBatch: hooks }) satisfies SystemHooks,
+      (pipeline: ReturnType<typeof createLifecycleHooks>) =>
+        pipeline.runPostDeleteBatch([deletectx], {}),
+    ],
+  ])("one %s hook throwing doesn't stop the others (Promise.allSettled) — logged, never thrown", async (_name, buildHooks, run) => {
     const consoleSpy = spyOn(console, "error").mockImplementation(() => {});
     const calls: string[] = [];
-    const systemHooks: SystemHooks = {
-      postSaveBatch: [
-        {
-          name: "failing",
-          priority: 1000,
-          fn: async () => {
-            throw new Error("batch-hook-boom");
-          },
+    const systemHooks = buildHooks([
+      {
+        name: "failing",
+        priority: 1000,
+        fn: async () => {
+          throw new Error("batch-hook-boom");
         },
-        {
-          name: "ok",
-          priority: 1001,
-          fn: async () => {
-            calls.push("ok-ran");
-          },
+      },
+      {
+        name: "ok",
+        priority: 1001,
+        fn: async () => {
+          calls.push("ok-ran");
         },
-      ],
-    };
+      },
+    ]);
     const pipeline = createLifecycleHooks(makeRegistry(), systemHooks);
     // Must not throw.
-    await pipeline.runPostSaveBatch([savectx], {});
+    await run(pipeline);
     expect(calls).toEqual(["ok-ran"]);
     expect(consoleSpy).toHaveBeenCalled();
     consoleSpy.mockRestore();