@cosmicdrift/kumiko-framework 0.220.1 → 0.222.0

package/src/event-store/index.ts

@@ -21,6 +21,7 @@ export {
   getEventsHighWaterMark,
   getStreamVersion,
   getUnscopedAggregateStreamMaxVersion,
+  getUnscopedStreamMaxVersionForSeed,
   LOAD_ALL_EVENTS_ROW_LIMIT,
   loadAggregate,
   loadAggregateAsOf,

package/src/files/__tests__/files.integration.test.ts

@@ -1,10 +1,11 @@
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { Hono } from "hono";
 import type { JwtHelper } from "../../api/jwt";
 import { buildServer } from "../../api/server";
+import { configurePiiSubjectKms, InMemoryKmsAdapter } from "../../crypto";
 import {
   createEntity,
   createImageField,
@@ -26,13 +27,14 @@ import {
   buildMultipartBody,
   expectErrorIncludes,
   patchFileInstanceofForBunTest,
+  resetPiiSubjectKmsForTests,
 } from "../../testing";
 import { createFilesFeature } from "../feature";
 import { fileRefsTable } from "../file-ref-table";
 import type { FileRoutesOptions } from "../file-routes";
 import { createInMemoryFileProvider } from "../in-memory-provider";
 import { createLocalProvider } from "../local-provider";
-import type { FileStorageProvider } from "../types";
+import type { FileStorageProvider, SignedUrlOptions } from "../types";
 import { parseMaxSize, sniffMimeType, validateFile } from "../types";
 
 // UUID for "this row doesn't exist" assertions. Valid v4 format so PG accepts
@@ -980,3 +982,180 @@ describe("download-url endpoint", () => {
     expect(body.error).toContain("signed_urls_not_supported");
   });
 });
+
+// --- fw#2423: GET /:id/meta with field-level PII encryption active ---
+
+describe("meta route with field-encrypted fileName", () => {
+  const testPng = new Uint8Array([
+    0x89,
+    0x50,
+    0x4e,
+    0x47,
+    0x0d,
+    0x0a,
+    0x1a,
+    0x0a,
+    ...Array(20).fill(0),
+  ]);
+
+  afterEach(() => {
+    // configurePiiSubjectKms is process-global — every test in this block
+    // must leave it clean for the rest of the suite.
+    resetPiiSubjectKmsForTests();
+  });
+
+  test("returns the decrypted fileName instead of 500 pii_ciphertext_leak", async () => {
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+
+    const uploadRes = await uploadFile(
+      adminUser,
+      "Krankheitsattest-Mai.png",
+      testPng,
+      "image/png",
+      { entityType: "tenant", entityId: "1", fieldName: "logo" },
+    );
+    expect(uploadRes.status).toBe(201);
+    const { id } = await uploadRes.json();
+
+    const metaRes = await getFileMeta(adminUser, id);
+    expect(metaRes.status).toBe(200);
+    const body = await metaRes.json();
+    expect(body.fileName).toBe("Krankheitsattest-Mai.png");
+    expect(body.mimeType).toBe("image/png");
+    expect(body.size).toBe(testPng.length);
+    expect(body.entityType).toBe("tenant");
+    expect(body.fieldName).toBe("logo");
+  });
+
+  test("other tenant still gets 404 (tenant isolation survives the executor swap)", async () => {
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+
+    const uploadRes = await uploadFile(adminUser, "cross-tenant.png", testPng, "image/png", {
+      entityType: "tenant",
+      entityId: "1",
+      fieldName: "logo",
+    });
+    const { id } = await uploadRes.json();
+
+    const res = await getFileMeta(otherTenantUser, id);
+    expect(res.status).toBe(404);
+  });
+
+  test("malformed (non-UUID) id still 404s instead of hitting the raw UUID column", async () => {
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+
+    const res = await getFileMeta(adminUser, "not-a-uuid");
+    expect(res.status).toBe(404);
+  });
+
+  test("soft-deleted file's meta still 404s (executor.detail() doesn't filter isDeleted)", async () => {
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+
+    const uploadRes = await uploadFile(adminUser, "trashed.png", testPng, "image/png", {
+      entityType: "tenant",
+      entityId: "1",
+      fieldName: "logo",
+    });
+    const { id } = await uploadRes.json();
+    expect((await deleteFile(adminUser, id)).status).toBe(200);
+
+    const res = await getFileMeta(adminUser, id);
+    expect(res.status).toBe(404);
+  });
+});
+
+// --- fw#2442: byte-serving + signed-URL routes with field-encrypted fileName ---
+
+describe("byte-serving routes with field-encrypted fileName", () => {
+  const testPng = new Uint8Array([
+    0x89,
+    0x50,
+    0x4e,
+    0x47,
+    0x0d,
+    0x0a,
+    0x1a,
+    0x0a,
+    ...Array(20).fill(0),
+  ]);
+
+  afterEach(() => {
+    resetPiiSubjectKmsForTests();
+  });
+
+  test("GET /files/:id serves the decrypted fileName in Content-Disposition, not the ciphertext", async () => {
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+
+    const uploadRes = await uploadFile(
+      adminUser,
+      "Krankheitsattest-Mai.png",
+      testPng,
+      "image/png",
+      { entityType: "tenant", entityId: "1", fieldName: "logo" },
+    );
+    expect(uploadRes.status).toBe(201);
+    const { id } = await uploadRes.json();
+
+    const res = await getFile(adminUser, id);
+    expect(res.status).toBe(200);
+    const header = res.headers.get("Content-Disposition") ?? "";
+    expect(header).toContain('filename="Krankheitsattest-Mai.png"');
+    expect(header).not.toContain("kumiko-pii");
+  });
+
+  test("GET /files/:id/download-url hints the decrypted fileName, never the ciphertext", async () => {
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+
+    let capturedDisposition: string | undefined;
+    const capturingProvider = {
+      ...createInMemoryFileProvider(),
+      async getSignedUrl(key: string, expiresInSeconds: number, options?: SignedUrlOptions) {
+        capturedDisposition = options?.contentDisposition;
+        return `memory://${key}?expires=${expiresInSeconds}`;
+      },
+    };
+
+    const isolatedDb = await createTestDb();
+    await unsafePushTables(isolatedDb.db, { fileRefsTable });
+    await unsafeCreateEntityTable(isolatedDb.db, testTenantEntity);
+    const isolatedRegistry = createRegistry([tenantFeature]);
+    const isolatedServer = buildServer({
+      registry: isolatedRegistry,
+      context: {
+        db: isolatedDb.db,
+        _fileProviderResolver: () => Promise.resolve(capturingProvider),
+      },
+      jwtSecret: JWT_SECRET,
+    });
+
+    try {
+      const fd = new FormData();
+      fd.append(
+        "file",
+        new File([Buffer.from(testPng)], "Krankheitsattest-Mai.png", { type: "image/png" }),
+      );
+      fd.append("entityType", "tenant");
+      fd.append("entityId", "1");
+      fd.append("fieldName", "logo");
+      const { body: multipartBody, contentType } = await buildMultipartBody(fd);
+      const token = await isolatedServer.jwt.sign(adminUser);
+      const uploadRes = await isolatedServer.app.request("/api/files", {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}`, "Content-Type": contentType },
+        body: multipartBody,
+      });
+      expect(uploadRes.status).toBe(201);
+      const { id } = await uploadRes.json();
+
+      const res = await isolatedServer.app.request(`/api/files/${id}/download-url`, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${token}` },
+      });
+      expect(res.status).toBe(200);
+      expect(capturedDisposition).toContain('filename="Krankheitsattest-Mai.png"');
+      expect(capturedDisposition ?? "").not.toContain("kumiko-pii");
+    } finally {
+      await isolatedDb.cleanup();
+    }
+  });
+});

package/src/files/__tests__/local-provider.contract.test.ts

@@ -0,0 +1,14 @@
+import { afterAll } from "bun:test";
+import { rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describeFileProviderContract } from "../../testing/file-provider-contract";
+import { createLocalProvider } from "../local-provider";
+
+const basePath = join(tmpdir(), `kumiko-local-provider-contract-${Date.now()}`);
+
+describeFileProviderContract("LocalFileProvider", () => createLocalProvider(basePath));
+
+afterAll(async () => {
+  await rm(basePath, { recursive: true, force: true });
+});

package/src/files/__tests__/storage-tracking.integration.test.ts

@@ -9,6 +9,7 @@
 //      Drizzle's mode:"number", so arithmetic in assertions Just Works).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { Temporal } from "temporal-polyfill";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { asRawClient, selectMany } from "../../db/query";
 import { createTenantDb } from "../../db/tenant-db";
@@ -180,6 +181,7 @@ describe("tenant-storage-usage MSP", () => {
     const [first] = await selectMany(stack.db, tenantStorageUsageTable, {
       tenantId: admin.tenantId,
     });
+    expect(first?.["lastUpdatedAt"]).toBeInstanceOf(Temporal.Instant);
 
     // Postgres NOW() resolution is microseconds; a second upload a beat
     // later must produce a strictly later timestamp (or at least not an
@@ -192,6 +194,7 @@ describe("tenant-storage-usage MSP", () => {
     const [second] = await selectMany(stack.db, tenantStorageUsageTable, {
       tenantId: admin.tenantId,
     });
+    expect(second?.["lastUpdatedAt"]).toBeInstanceOf(Temporal.Instant);
     if (!first?.["lastUpdatedAt"] || !second?.["lastUpdatedAt"]) throw new Error("missing rows");
     expect(
       Temporal.Instant.compare(second["lastUpdatedAt"], first["lastUpdatedAt"]),

package/src/files/file-routes.ts

@@ -1,6 +1,14 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { Hono } from "hono";
 import { getUser } from "../api/auth-middleware";
+import { requestContext } from "../api/request-context";
+import {
+  collectPiiSubjectFields,
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+  isPiiCiphertext,
+  type KmsContext,
+} from "../crypto";
 import type { DbConnection } from "../db/connection";
 import { createEventStoreExecutor } from "../db/event-store-executor";
 import { createTenantDb } from "../db/tenant-db";
@@ -35,6 +43,7 @@ export type FileRef = {
   entityId: string | null;
   fieldName: string | null;
   insertedById: string | null;
+  isDeleted: boolean;
 };
 
 // fileRef is a standard ES entity: upload/delete go through the entity
@@ -102,8 +111,33 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
   const executor = createEventStoreExecutor(fileRefsTable, fileRefEntity, {
     entityName: "fileRef",
   });
+  const piiSubjectFields = collectPiiSubjectFields(fileRefEntity);
   const api = new Hono();
 
+  function kmsContextFor(): KmsContext {
+    return { requestId: requestContext.get()?.requestId ?? "file-routes" };
+  }
+
+  // loadFileForTenant is a raw selectMany — unlike executor.detail() (used by
+  // /meta), it never decrypts. Decrypting via detail() here would add its
+  // getStreamVersion/entity-cache overhead to these binary-serving hot
+  // paths, so this calls the same PII cipher directly on the already-
+  // fetched row: one KMS key fetch instead of detail()'s full read path.
+  async function resolveFileName(fileRef: FileRef): Promise<string> {
+    if (!isPiiCiphertext(fileRef.fileName)) return fileRef.fileName;
+    const kms = configuredPiiSubjectKms();
+    if (!kms) {
+      return "download";
+    }
+    const decrypted = await decryptPiiFieldValues(
+      { fileName: fileRef.fileName },
+      piiSubjectFields,
+      kms,
+      kmsContextFor(),
+    );
+    return typeof decrypted["fileName"] === "string" ? decrypted["fileName"] : "download";
+  }
+
   // POST /files — multipart upload.
   api.post("/files", async (c) => {
     const user = getUser(c);
@@ -244,7 +278,7 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
     return new Response(Buffer.from(data), {
       headers: {
         "Content-Type": contentType,
-        "Content-Disposition": buildContentDispositionHeader(fileRef.fileName),
+        "Content-Disposition": buildContentDispositionHeader(await resolveFileName(fileRef)),
         "Content-Length": String(fileRef.size),
         "X-Content-Type-Options": "nosniff",
       },
@@ -381,19 +415,32 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
       // with the original filename instead of the UUID-based storage key.
       // Sanitised via buildContentDispositionHeader — the same attacker-
       // controlled fileName reaches the provider's presigned response.
-      contentDisposition: buildContentDispositionHeader(fileRef.fileName),
+      contentDisposition: buildContentDispositionHeader(await resolveFileName(fileRef)),
     });
     const expiresAt = new Date(Date.now() + expiresInSeconds * 1000).toISOString();
     return c.json({ url, expiresAt });
   });
 
-  // GET /files/:id/meta — metadata without the bytes. Guarded exactly like
-  // download (meta leaks fileName/mimeType/size).
+  // GET /files/:id/meta — metadata without the bytes. Unlike the byte-serving
+  // routes above, this returns fileName as JSON — and fileName is
+  // `personal: "self"` (fw#2423), so it must go through the entity executor's
+  // detail() to decrypt instead of loadFileForTenant's raw, still-encrypted read.
   api.get("/files/:id/meta", async (c) => {
     const user = getUser(c);
     const id = c.req.param("id");
-    const fileRef = await loadFileForTenant(id, user.tenantId);
-    if (!fileRef) return c.json({ error: "not_found" }, 404);
+    // Same 22P02-avoidance as loadFileForTenant — detail() doesn't validate
+    // id shape before it hits the UUID column.
+    if (!isUuid(id)) return c.json({ error: "not_found" }, 404);
+    const row = await executor.detail({ id }, user, createTenantDb(db, user.tenantId));
+    if (!row) return c.json({ error: "not_found" }, 404);
+    const fileRef = row as FileRef; // @cast-boundary db-row (decrypted via executor.detail)
+    // detail()'s "pass"-ownership read widens to tenantId IN (self, SYSTEM)
+    // and doesn't filter isDeleted (list() does, detail() doesn't) — both
+    // narrower in loadFileForTenant's selectMany. Restore that here so meta
+    // doesn't leak reference-tenant or soft-deleted rows.
+    if (fileRef.tenantId !== user.tenantId || fileRef.isDeleted) {
+      return c.json({ error: "not_found" }, 404);
+    }
 
     const decision = await guard({ fileRef, user, operation: "read" });
     if (decision === "deny") return c.json({ error: "not_found" }, 404);

package/src/files/in-memory-provider.ts

@@ -86,6 +86,10 @@ export function createInMemoryFileProvider(): InMemoryFileProvider {
       return store.has(key);
     },
 
+    async list(prefix) {
+      return Array.from(store.keys()).filter((key) => key.startsWith(prefix));
+    },
+
     // Deterministic fake URL — encodes the key + expiry so tests can assert
     // the route wired through without running a real presigner. Shape
     // (memory://<key>?expires=<seconds>) intentionally differs from any real

package/src/files/local-provider.ts

@@ -1,5 +1,5 @@
 import { createReadStream, createWriteStream } from "node:fs";
-import { mkdir, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { mkdir, readdir, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { assertSafeStorageKey, type FileStorageProvider } from "./types";
@@ -107,5 +107,26 @@ export function createLocalProvider(basePath: string): FileStorageProvider {
         return false;
       }
     },
+
+    async list(prefix: string): Promise<readonly string[]> {
+      // recursive:true returns POSIX- or OS-sep-joined relative paths for
+      // both files and directories; normalize to "/" (storage keys are
+      // always "/"-joined, matching S3) before the prefix match, then stat
+      // only the (few) matches to drop directory entries.
+      let entries: string[];
+      try {
+        entries = await readdir(resolvedBase, { recursive: true });
+      } catch (err) {
+        if ((err as NodeJS.ErrnoException).code === "ENOENT") return [];
+        throw err;
+      }
+      const results: string[] = [];
+      for (const entry of entries) {
+        const key = entry.split(sep).join("/");
+        if (!key.startsWith(prefix)) continue;
+        if ((await stat(join(resolvedBase, entry))).isFile()) results.push(key);
+      }
+      return results;
+    },
   };
 }

package/src/i18n/__tests__/mail-registry.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, test } from "bun:test";
-import { hasMailTranslations, mailT, registerMailTranslations } from "../mail-registry";
+import {
+  hasMailTranslations,
+  mailT,
+  registerMailTranslations,
+  resolveMailLocale,
+} from "../mail-registry";
 
 describe("mail-registry", () => {
   registerMailTranslations("en", { "test.hi": "Hello {name}" });
@@ -21,3 +26,10 @@ test("hasMailTranslations is true only for registered locales", () => {
   expect(hasMailTranslations("de")).toBe(true);
   expect(hasMailTranslations("de-AT")).toBe(true);
 });
+
+test("resolveMailLocale prefers exact, then root, then en", () => {
+  registerMailTranslations("de", { "test.hi": "Hallo" });
+  expect(resolveMailLocale("de")).toBe("de");
+  expect(resolveMailLocale("de-AT")).toBe("de");
+  expect(resolveMailLocale("fr-CA")).toBe("en");
+});

package/src/i18n/__tests__/request-locale.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, test } from "bun:test";
+import { canonicalizeLocaleTag, resolveHeaderLocale } from "../request-locale";
+
+describe("canonicalizeLocaleTag", () => {
+  test("lowercases the primary subtag", () => {
+    expect(canonicalizeLocaleTag("DE")).toBe("de");
+    expect(canonicalizeLocaleTag("DE-at")).toBe("de-at");
+  });
+});
+
+describe("resolveHeaderLocale", () => {
+  test("canonicalizes X-Locale", () => {
+    expect(resolveHeaderLocale({ headerLocale: "DE" })).toBe("de");
+  });
+
+  test("canonicalizes Accept-Language pick", () => {
+    expect(resolveHeaderLocale({ acceptLanguage: "DE-at,en;q=0.8" })).toBe("de-at");
+  });
+});

package/src/i18n/index.ts

@@ -1,7 +1,13 @@
 import type { Registry, TranslationKeys } from "../engine/types";
 
-export { hasMailTranslations, mailT, registerMailTranslations } from "./mail-registry";
 export {
+  hasMailTranslations,
+  mailT,
+  registerMailTranslations,
+  resolveMailLocale,
+} from "./mail-registry";
+export {
+  canonicalizeLocaleTag,
   DEFAULT_LOCALE,
   isValidLocaleTag,
   pickAcceptLanguage,

package/src/i18n/mail-registry.ts

@@ -24,3 +24,13 @@ export function mailT(
   if (params === undefined) return raw;
   return raw.replace(/\{(\w+)\}/g, (_, name: string) => params[name] ?? `{${name}}`);
 }
+
+/** Locale key mailT would actually use (exact → root → en). Use for appUrl
+ *  path negotiation so the link language matches the rendered mail body. */
+export function resolveMailLocale(locale: string): string {
+  const root = locale.split("-")[0] ?? locale;
+  if (tables.has(locale)) return locale;
+  if (tables.has(root)) return root;
+  if (tables.has("en")) return "en";
+  return "en";
+}

package/src/i18n/request-locale.ts

@@ -18,6 +18,14 @@ export function isValidLocaleTag(value: string): boolean {
   return value.length <= MAX_LOCALE_TAG_LENGTH && LOCALE_TAG_RE.test(value);
 }
 
+/** BCP-47 is case-insensitive; canonicalize the primary subtag to lowercase
+ *  so registry lookups (`mailT`, `hasMailTranslations`) hit registered keys. */
+export function canonicalizeLocaleTag(tag: string): string {
+  const dash = tag.indexOf("-");
+  if (dash === -1) return tag.toLowerCase();
+  return `${tag.slice(0, dash).toLowerCase()}${tag.slice(dash)}`;
+}
+
 type AcceptLanguageCandidate = { readonly tag: string; readonly q: number; readonly index: number };
 
 /**
@@ -57,7 +65,8 @@ export function resolveHeaderLocale(options: {
   readonly acceptLanguage?: string;
 }): string | undefined {
   if (options.headerLocale !== undefined && isValidLocaleTag(options.headerLocale)) {
-    return options.headerLocale;
+    return canonicalizeLocaleTag(options.headerLocale);
   }
-  return pickAcceptLanguage(options.acceptLanguage);
+  const picked = pickAcceptLanguage(options.acceptLanguage);
+  return picked !== undefined ? canonicalizeLocaleTag(picked) : undefined;
 }

package/src/i18n/required-surface-keys.ts

@@ -328,7 +328,9 @@ export function buildEffectiveTranslationKeys(features: readonly FeatureDefiniti
   for (const feature of features) {
     for (const key of Object.keys(feature.translations ?? {})) {
       out.add(`${feature.name}:${key}`);
-      if (key.includes(":")) out.add(key);
+      // Blank form too — Settings-Hub group namespaces (`group: "tenant-settings"`)
+      // require `${group}.settings` which is not `${feature}:${key}` (fw#2314).
+      out.add(key);
     }
   }
   return out;

package/src/jobs/job-runner.ts

@@ -206,10 +206,20 @@ function parseRedisOpts(url: string): { host: string; port: number; db?: number
 // would otherwise hang start() forever with no health endpoint to notice.
 const BOOT_REDIS_TIMEOUT_MS = 10_000;
 
-function timeoutReject(ms: number, message: string): Promise<never> {
-  return new Promise((_, reject) => {
-    setTimeout(() => reject(new Error(message)), ms);
+function timeoutReject(
+  ms: number,
+  message: string,
+): { promise: Promise<never>; cancel: () => void } {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const promise = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => reject(new Error(message)), ms);
   });
+  return {
+    promise,
+    cancel: () => {
+      if (timer !== undefined) clearTimeout(timer);
+    },
+  };
 }
 
 export function createJobRunner(options: JobRunnerOptions): JobRunner {
@@ -592,13 +602,15 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
       // upsertJobScheduler()/add() below when the lane has a cron/boot job.
       // Racing a timeout against it keeps an unreachable Redis from hanging
       // start() forever — there's no worker health endpoint to notice.
-      await Promise.race([
-        worker.waitUntilReady(),
-        timeoutReject(
-          bootRedisTimeoutMs,
-          `job-runner: Redis not reachable within ${bootRedisTimeoutMs}ms (lane=${consumerLane})`,
-        ),
-      ]);
+      const bootTimeout = timeoutReject(
+        bootRedisTimeoutMs,
+        `job-runner: Redis not reachable within ${bootRedisTimeoutMs}ms (lane=${consumerLane})`,
+      );
+      try {
+        await Promise.race([worker.waitUntilReady(), bootTimeout.promise]);
+      } finally {
+        bootTimeout.cancel();
+      }
 
       // Only schedule cron + boot for jobs that belong to this lane. Jobs
       // assigned to the other lane get their cron/boot wiring from the

package/src/lifecycle/signal-handlers.ts

@@ -47,6 +47,8 @@ export function attachSignalHandlers(
         .then(() => exitFn(0))
         .catch(() => exitFn(1));
     };
+    // bun-types vs @types/node: signal overload on process.on/off is not
+    // selectable via bind() under the merged types — EventEmitter seam is intentional.
     (process as NodeJS.EventEmitter).on(sig, handler);
     listeners.set(sig, handler);
   }

package/src/pipeline/__tests__/distributed-lock.integration.test.ts

@@ -90,6 +90,18 @@ describe("distributed lock", () => {
     expect(await lock.acquire("test-lock-7")).not.toBeNull();
   });
 
+  test("renew with ttlSeconds 0 does not drop the lock", async () => {
+    const lock = createDistributedLock(testRedis.redis);
+    const token = await lock.acquire("test-lock-ttl0", { ttlSeconds: 5 });
+    if (!token) throw new Error("expected token");
+    const renewed = await lock.renew("test-lock-ttl0", token, 0);
+    expect(renewed).toBe(false);
+    // Original lock still held — a peer acquire must fail.
+    const peer = await lock.acquire("test-lock-ttl0", { ttlSeconds: 5 });
+    expect(peer).toBeNull();
+    await lock.release("test-lock-ttl0", token);
+  });
+
   test("renew on an expired/absent key fails", async () => {
     const lock = createDistributedLock(testRedis.redis);
     const renewed = await lock.renew("test-lock-8-never-acquired", "some-token", 5);