@cosmicdrift/kumiko-framework 0.163.3 → 0.165.0

package/src/pipeline/dispatch-stream.ts

@@ -1,4 +1,3 @@
-import type { DbTx } from "../db/connection";
 import { hasAccess } from "../engine/access";
 import type { SessionUser } from "../engine/types";
 import { AccessDeniedError, NotFoundError, validationErrorFromZod } from "../errors";
@@ -22,11 +21,8 @@ export async function* executeStream(
   type: string,
   payload: unknown,
   user: SessionUser,
-  tx?: DbTx,
 ): AsyncGenerator<unknown> {
-  yield* runStreamInstrumented(ctx, type, user, () =>
-    executeStreamInner(ctx, type, payload, user, tx),
-  );
+  yield* runStreamInstrumented(ctx, type, user, () => executeStreamInner(ctx, type, payload, user));
 }
 
 async function* executeStreamInner(
@@ -34,7 +30,6 @@ async function* executeStreamInner(
   type: string,
   payload: unknown,
   user: SessionUser,
-  tx?: DbTx,
 ): AsyncGenerator<unknown> {
   const { registry } = ctx;
   const handler = registry.getStreamHandler(type);
@@ -58,7 +53,7 @@ async function* executeStreamInner(
     throw validationErrorFromZod(parsed.error);
   }
 
-  const handlerContext = buildHandlerContext(ctx, type, user, tx);
+  const handlerContext = buildHandlerContext(ctx, type, user);
   const chunks = handler.handler({ type, payload: parsed.data, user }, handlerContext);
 
   // Consumer-driven pull (for await) is the backpressure mechanism — the

package/src/pipeline/event-dispatcher-delivery.ts

@@ -194,7 +194,8 @@ export type DeliveryOutcome = {
 
 // Deliver events to the consumer's handler in events.id order. Halt-on-
 // poison: a throw breaks the loop, the cursor stays at the last successful
-// event, and attempts climb. At maxAttempts the caller persists status=
+// event, and attempts climb. At the consumer's effectiveMaxAttempts
+// (errorPolicy.maxAttempts ?? maxAttempts) the caller persists status=
 // "dead" and the consumer is parked until ops intervenes (see
 // restartConsumer / skipPoisonEvent).
 export async function deliverEvents(

package/src/pipeline/system-hooks.ts

@@ -1,7 +1,7 @@
 import type { SseBroker } from "../api/sse-broker";
 import type { DbRow } from "../db/connection";
 import { tenantChannel } from "../engine/constants";
-import type { EntityId, Registry } from "../engine/types";
+import type { EntityId, JobRunnerRef, Registry, SessionUser } from "../engine/types";
 import type { SearchAdapter, SearchDocument } from "../search/types";
 import type { EventConsumer } from "./event-dispatcher";
 
@@ -249,3 +249,52 @@ export function createSseBroadcastEventConsumer(sseBroker: SseBroker): EventCons
     },
   };
 }
+
+// --- Job-Trigger Consumer (async, via event-dispatcher) ---
+//
+// r.job's `trigger.on` historically only fired via the synchronous
+// write-handler dispatch path (dispatch-write.ts's afterCommitHooks calling
+// jobRunner.handleEvent). Events appended any other way — an
+// r.multiStreamProjection's ctx.unsafeAppendEvent, or a raw
+// event-store-executor write (e.g. `files`' fileRef.created) — never
+// reached it, so a job could never trigger on an r.defineEvent-registered
+// event (kumiko-framework#1505).
+//
+// This consumer closes that gap the same way search/SSE do: read every
+// committed event off the shared cursor and re-check job triggers. It is
+// scoped EXACTLY to the gap — the write/query-handler-QN skip below is
+// defense-in-depth: no stored event's `type` is a handler QN today (entity
+// events are "entity.verb"; ctx.appendEvent enforces defineEvent-only
+// ownership), but if that ever changes, this consumer must not re-fire a
+// trigger the synchronous dispatch-write.ts path already handled.
+//
+// Delivery is at-least-once (cursor semantics) where the synchronous path
+// is effectively once — job handlers reached via an r.defineEvent trigger
+// must be idempotent (same expectation r.multiStreamProjection applies
+// already carry).
+export const JOB_TRIGGER_CONSUMER_NAME = "system:consumer:job-trigger";
+
+export function createJobTriggerEventConsumer(
+  jobRunner: JobRunnerRef,
+  registry: Registry,
+): EventConsumer {
+  return {
+    name: JOB_TRIGGER_CONSUMER_NAME,
+    handler: async (event) => {
+      // skip: write/query-handler QN — already dispatched synchronously by
+      // dispatch-write.ts's afterCommitHooks. Re-firing here would
+      // double-enqueue every existing handler-triggered job.
+      if (registry.getWriteHandler(event.type) || registry.getQueryHandler(event.type)) return;
+      // skip: no r.defineEvent registered under this type — nothing this
+      // consumer is responsible for.
+      if (!registry.getEvent(event.type)) return;
+
+      const user: SessionUser = {
+        id: event.metadata.userId,
+        tenantId: event.tenantId,
+        roles: [],
+      };
+      await jobRunner.handleEvent(event.type, event.payload, user);
+    },
+  };
+}

package/src/db/__tests__/encryption.test.ts

@@ -1,39 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { createEncryptionProvider } from "../encryption";
-
-// 32 bytes base64-encoded for AES-256
-const TEST_KEY = Buffer.from("a]bJm#kP9xQ2@wN!vL$hR5yT8eU0iO3f").toString("base64");
-
-describe("EncryptionProvider", () => {
-  test("encrypt + decrypt roundtrip returns original", () => {
-    const provider = createEncryptionProvider(TEST_KEY);
-    const ciphertext = provider.encrypt("hello world");
-    expect(provider.decrypt(ciphertext)).toBe("hello world");
-  });
-
-  test("same plaintext produces different ciphertexts (random IV)", () => {
-    const provider = createEncryptionProvider(TEST_KEY);
-    const a = provider.encrypt("same");
-    const b = provider.encrypt("same");
-    expect(a).not.toBe(b);
-  });
-
-  test("decrypt with different key throws", () => {
-    const key2 = Buffer.from("x]bJm#kP9xQ2@wN!vL$hR5yT8eU0iO3f").toString("base64");
-    const p1 = createEncryptionProvider(TEST_KEY);
-    const p2 = createEncryptionProvider(key2);
-    const ciphertext = p1.encrypt("secret");
-    expect(() => p2.decrypt(ciphertext)).toThrow();
-  });
-
-  test("handles unicode and emoji", () => {
-    const provider = createEncryptionProvider(TEST_KEY);
-    const ciphertext = provider.encrypt("Ünïcödé 🔐");
-    expect(provider.decrypt(ciphertext)).toBe("Ünïcödé 🔐");
-  });
-
-  test("throws on invalid key length", () => {
-    const shortKey = Buffer.from("too-short").toString("base64");
-    expect(() => createEncryptionProvider(shortKey)).toThrow(/32 bytes/);
-  });
-});

package/src/db/encryption.ts

@@ -1,45 +0,0 @@
-import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 12;
-const TAG_LENGTH = 16;
-
-export type EncryptionProvider = {
-  encrypt(plaintext: string): string;
-  decrypt(ciphertext: string): string;
-};
-
-/**
- * @deprecated Legacy single-key format: base64(iv+tag+ct) with NO key id —
- * a key change makes existing ciphertexts permanently undecryptable. Use
- * `createEnvelopeCipher` (@cosmicdrift/kumiko-framework/secrets) for new code;
- * this provider has no consumers left in the framework.
- */
-export function createEncryptionProvider(key: string): EncryptionProvider {
-  // Key must be 32 bytes for AES-256
-  const keyBuffer = Buffer.from(key, "base64");
-  if (keyBuffer.length !== 32) {
-    throw new Error("ENCRYPTION_KEY must be 32 bytes (base64 encoded)");
-  }
-
-  return {
-    encrypt(plaintext: string): string {
-      const iv = randomBytes(IV_LENGTH);
-      const cipher = createCipheriv(ALGORITHM, keyBuffer, iv);
-      const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-      const tag = cipher.getAuthTag();
-      // Format: base64(iv + tag + ciphertext)
-      return Buffer.concat([iv, tag, encrypted]).toString("base64");
-    },
-
-    decrypt(ciphertext: string): string {
-      const data = Buffer.from(ciphertext, "base64");
-      const iv = data.subarray(0, IV_LENGTH);
-      const tag = data.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
-      const encrypted = data.subarray(IV_LENGTH + TAG_LENGTH);
-      const decipher = createDecipheriv(ALGORITHM, keyBuffer, iv);
-      decipher.setAuthTag(tag);
-      return decipher.update(encrypted) + decipher.final("utf8");
-    },
-  };
-}