@cosmicdrift/kumiko-framework 0.230.0 → 0.232.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.230.0",
+  "version": "0.232.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,7 +198,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.230.0",
+    "@cosmicdrift/kumiko-types": "0.232.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -214,7 +214,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.230.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.232.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/bun-db/query.ts

@@ -1,6 +1,6 @@
-// Typed Query-API über Bun.sql. KEIN drizzle intern. Identische Signatur
-// zur legacy `db/query-api.ts` — App-code-migration ist Import-Pfad-Wechsel,
-// kein call-site-Refactor.
+// Typed query API over Bun.sql. No drizzle internally. Same signature as the
+// legacy `db/query-api.ts` — app-code migration is just an import-path swap,
+// not a call-site refactor.
 //
 // API:
 //   selectMany<T>(db, table, where?, opts?) → readonly T[]
@@ -13,11 +13,11 @@
 //   deleteManyBatched(db, table, where, { limit }) → { deleted, batches }
 //   transaction<T>(db, fn) → T
 //
-// `table` kann sein:
+// `table` can be either:
 //   - EntityTableMeta (preferred, plain data)
-//   - drizzle pgTable (legacy, hat Symbol-based tableName) — extracted via
-//     drizzle's getTableName + getTableColumns (drizzle weiterhin als type-
-//     reference, NICHT als runtime-API-call)
+//   - drizzle pgTable (legacy, has Symbol-based tableName) — extracted via
+//     drizzle's getTableName + getTableColumns (drizzle kept only as a type
+//     reference, never as a runtime API call)
 
 import { KUMIKO_META_SYMBOL } from "@cosmicdrift/kumiko-types/schema-table-types";
 import type {
@@ -49,7 +49,7 @@ function snakeToCamel(key: string): string {
 import type { DbRunner } from "@cosmicdrift/kumiko-types/db-connection";
 import type { BunDbRunner } from "./connection";
 
-// Drizzle-pgTable-Inspection via raw Symbol-access (kein drizzle-orm import).
+// Drizzle pgTable inspection via raw Symbol access (no drizzle-orm import).
 // table() (dialect) stores the canonical, shadow-proof EntityTableMeta under
 // `Symbol.for("kumiko:schema:Meta")`. The column handles on the table object are
 // enumerable props, so an entity field named `source`/`columns`/`tableName`/…
@@ -79,12 +79,12 @@ export function asEntityTableMeta(table: unknown): EntityTableMeta | undefined {
   return isEntityTableMeta(table) ? table : undefined;
 }
 
-// `db` Input akzeptiert drei Shapes:
-//   1. Bun.SQL connection (BunDbRunner) — neue Welt, native .unsafe + .begin
-//   2. drizzle DbConnection (postgres-js-Wrapper) — legacy compat,
-//      raw postgres-js client liegt unter `db.$client.unsafe / .begin`
-//   3. drizzle tx-handle — client liegt unter `tx.session.client`
-// Shim extrahiert in allen Fällen ein `{unsafe, begin}`-Surface.
+// `db` input accepts three shapes:
+//   1. Bun.SQL connection (BunDbRunner) — new world, native .unsafe + .begin
+//   2. drizzle DbConnection (postgres-js wrapper) — legacy compat,
+//      raw postgres-js client sits under `db.$client.unsafe / .begin`
+//   3. drizzle tx-handle — client sits under `tx.session.client`
+// The shim extracts a `{unsafe, begin}` surface in every case.
 type RawClient = {
   unsafe: <TRow = unknown>(sql: string, params?: readonly unknown[]) => Promise<readonly TRow[]>;
   begin: <T>(fn: (tx: unknown) => Promise<T>) => Promise<T>;
@@ -254,23 +254,24 @@ function isWhereOperator(v: unknown): v is WhereOperator {
   if (keys.length === 0) return false;
   return keys.every((k) => (WHERE_OPERATOR_KEYS as readonly string[]).includes(k));
 }
-// Akzeptiert EITHER. Beide haben einen tableName und field→column-mapping.
+// Accepts EITHER. Both have a tableName and field→column mapping.
 // biome-ignore lint/suspicious/noExplicitAny: legacy drizzle pgTable surface
 type TableLike = EntityTableMeta | any;
 
-// Write-Param: alles was TableLike akzeptiert AUSSER einer gebrandeten
-// EntityTable (managed projection). Ein direkter Write auf eine Entity ist ein
-// Compile-Fehler — der einzige Schreibweg ist der Executor (Event ->
-// rebuild-safe). Unmanaged EntityTableMeta + die am Executor-Seam auf
-// TableColumns<any> eraste Table tragen den Brand nicht -> erlaubt. Test-Seeds
-// gehen über den sanktionierten testing-Seam (seedRow/…), der den Brand strippt.
+// Write param: everything TableLike accepts EXCEPT a branded
+// EntityTable (managed projection). A direct write to an Entity is a
+// compile error — the only write path is the executor (event ->
+// rebuild-safe). Unmanaged EntityTableMeta plus the table erased to
+// TableColumns<any> at the executor seam don't carry the brand -> allowed.
+// Test seeds go through the sanctioned testing seam (seedRow/…), which
+// strips the brand.
 // Method-form writes (ctx.db.insertOne/…) keep an erased param and are covered
 // by the guard-direct-entity-writes AST guard instead (see tenant-db.ts).
 type WritableTable = EntityTableMeta & NotExecutorOnly;
 
 export type TableInfo = {
   readonly name: string;
-  // field-name (camelCase oder snake_case) → snake_case column-name
+  // field name (camelCase or snake_case) → snake_case column name
   readonly columnOf: (field: string) => string;
   // pgType per column-name, for jsonb-cast detection
   readonly pgTypeOf: (column: string) => string | undefined;
@@ -366,8 +367,8 @@ function coerceBigIntFromDriver(value: bigint | string): bigint | number {
 function instantFromDriver(value: unknown): Temporal.Instant | null {
   if (value === null || value === undefined) return null;
   if (isTemporalInstant(value)) return value as Temporal.Instant;
-  // Number-coercion via +date — equivalent to .getTime() ohne Date-API-Methode
-  // (guard-no-date-api). Date → epochMilliseconds, dann zu Temporal.Instant.
+  // Number coercion via +date — equivalent to .getTime() without a Date-API
+  // method (guard-no-date-api). Date → epoch milliseconds, then to Temporal.Instant.
   if (value instanceof Date) return Temporal.Instant.fromEpochMilliseconds(+value);
   if (typeof value === "string") {
     try {
@@ -437,8 +438,8 @@ export function coerceRow<T extends Record<string, unknown>>(row: T, info: Table
   const out: Record<string, unknown> = {};
   let changed = false;
   for (const key of Object.keys(row)) {
-    // Blind-Index-Spalten (#818) sind reine Lookup-Artefakte — der
-    // deterministische HMAC darf nie an Caller/API-Responses leaken.
+    // Blind-index columns (#818) are pure lookup artifacts — the
+    // deterministic HMAC must never leak into caller/API responses.
     if ((key.endsWith("_bidx") || key.endsWith("Bidx")) && info.hasColumn(key)) {
       changed = true;
       continue;
@@ -505,11 +506,11 @@ function coerceRows<T extends Record<string, unknown>>(
   return rows.map((r) => coerceRow(r, info));
 }
 
-// Helper für jsonb-Werte: structured values binden als JS object/array mit
-// ::jsonb cast. JSON.stringify vor dem cast würde JSON-string-scalars erzeugen.
+// Helper for jsonb values: structured values bind as a JS object/array with
+// an ::jsonb cast. JSON.stringify before the cast would produce JSON-string scalars.
 // Plus Temporal.Instant → ISO string coercion for timestamptz columns.
-// SqlExpression (sql`now()`, sql`gen_random_uuid()`) wird als kind:"literal"
-// returned — Caller embedded das inline statt einen $N-placeholder zu setzen.
+// SqlExpression (sql`now()`, sql`gen_random_uuid()`) is returned as
+// kind:"literal" — the caller embeds it inline instead of setting a $N placeholder.
 type PreparedValue =
   | { readonly kind: "param"; readonly sql: string; readonly bound: unknown }
   | { readonly kind: "literal"; readonly literal: string };
@@ -693,12 +694,12 @@ function buildWhereClause(
       if (p.kind === "literal") {
         conditions.push(`${quoteIdent(col)} = ${p.literal}`);
       } else {
-        // Blind-Index-OR-Rewrite (#818): existiert zur Spalte ein bidx-
-        // Pendant (Suffix-Konvention `<col>_bidx`, framework-reserviert)
-        // und ist ein Key konfiguriert, matcht Equality beide Arme —
-        // Klartext-Alt-Rows über den Plaintext-Arm, verschlüsselte Rows
-        // über den HMAC. Der `kumiko-pii:`-Prefix der Ciphertexte macht
-        // einen Zufalls-Match des Plaintext-Arms praktisch unmöglich.
+        // Blind-index OR rewrite (#818): if the column has a bidx
+        // counterpart (suffix convention `<col>_bidx`, framework-reserved)
+        // and a key is configured, equality matches both arms —
+        // plaintext legacy rows via the plaintext arm, encrypted rows
+        // via the HMAC. The `kumiko-pii:` prefix on ciphertexts makes
+        // a random match on the plaintext arm practically impossible.
         const bidxKey = configuredBlindIndexKey();
         const bidxCol = `${col}_bidx`;
         if (

package/src/compliance/__tests__/sub-processors.test.ts

@@ -82,16 +82,6 @@ describe("KUMIKO_SUB_PROCESSORS", () => {
           "sccRequired": false,
           "status": "active",
         },
-        {
-          "appliesTo": [
-            "all-tiers",
-          ],
-          "name": "Heinlein Hosting (Mailbox.org)",
-          "optInOnly": false,
-          "region": "EU (Germany)",
-          "sccRequired": false,
-          "status": "active",
-        },
         {
           "appliesTo": [
             "business",
@@ -101,7 +91,7 @@ describe("KUMIKO_SUB_PROCESSORS", () => {
           "optInOnly": true,
           "region": "US",
           "sccRequired": true,
-          "status": "planned",
+          "status": "active",
         },
         {
           "appliesTo": [
@@ -111,7 +101,17 @@ describe("KUMIKO_SUB_PROCESSORS", () => {
           "optInOnly": false,
           "region": "Global (US-headquartered)",
           "sccRequired": true,
-          "status": "planned",
+          "status": "active",
+        },
+        {
+          "appliesTo": [
+            "all-tiers",
+          ],
+          "name": "ALL-INKL.COM – Neue Medien Münnich",
+          "optInOnly": false,
+          "region": "EU (Germany)",
+          "sccRequired": false,
+          "status": "active",
         },
       ]
     `);

package/src/compliance/sub-processors.ts

@@ -101,15 +101,6 @@ export const KUMIKO_SUB_PROCESSORS: readonly SubProcessor[] = [
     appliesTo: ["standard", "business", "enterprise"],
     status: "active",
   },
-  {
-    name: "Heinlein Hosting (Mailbox.org)",
-    purpose: "Marketing Email Delivery",
-    region: "EU (Germany)",
-    dpa: "https://mailbox.org/de/datenschutzerklaerung",
-    addedAt: "2024-03-01",
-    appliesTo: ["all-tiers"],
-    status: "active",
-  },
   {
     name: "Anthropic PBC",
     purpose: "AI Model Inference (L2 Composition Layer, AI-Foundation)",
@@ -120,7 +111,7 @@ export const KUMIKO_SUB_PROCESSORS: readonly SubProcessor[] = [
     sccRequired: true,
     optInOnly: true,
     hipaaBaaAvailable: true,
-    status: "planned",
+    status: "active",
   },
   {
     name: "Stripe, Inc.",
@@ -130,7 +121,16 @@ export const KUMIKO_SUB_PROCESSORS: readonly SubProcessor[] = [
     addedAt: "2026-06-01",
     appliesTo: ["all-tiers"],
     sccRequired: true,
-    status: "planned",
+    status: "active",
+  },
+  {
+    name: "ALL-INKL.COM – Neue Medien Münnich",
+    purpose: "Mailbox Hosting (support and contact mailboxes)",
+    region: "EU (Germany)",
+    dpa: "https://all-inkl.com/members/avv_muster_print.php",
+    addedAt: "2026-09-02",
+    appliesTo: ["all-tiers"],
+    status: "active",
   },
 ];
 

package/src/db/__tests__/blind-index.integration.test.ts

@@ -45,6 +45,18 @@ const personFeature = defineFeature("bidxtest", (r) => {
 });
 const personTable = buildEntityTable("person", personEntity);
 
+// Lookupable entity whose read table is deliberately never created — used to
+// prove the forget sweep skips missing relations (fw#2550).
+const ghostEntity = createEntity({
+  table: "read_bidx_ghosts_missing",
+  fields: {
+    email: createTextField({ required: true, personal: "self", find: "exact" }),
+  },
+});
+const ghostFeature = defineFeature("bidxghost", (r) => {
+  r.entity("ghost", ghostEntity);
+});
+
 let testDb: TestDb;
 let tdb: TenantDb;
 let kms: InMemoryKmsAdapter;
@@ -247,4 +259,24 @@ describe("blind-index rebuild + forget", () => {
     expect((await rawRow(String(created.data.id)))["email_bidx"]).toBeNull();
     expect(await fetchOne(tdb, personTable, { email: "marc@example.com" })).toBeUndefined();
   });
+
+  test("nullBlindIndexesForSubject skips missing projection tables (fw#2550)", async () => {
+    const created = await crud.create({ email: "marc@example.com" }, adminUser, tdb);
+    if (!created.isSuccess) throw new Error("create failed");
+    expect((await rawRow(String(created.data.id)))["email_bidx"]).not.toBeNull();
+
+    await kms.eraseKey({ kind: "user", userId: String(created.data.id) });
+    // Registry includes a lookupable ghost whose table was never migrated —
+    // pre-fix this UPDATE threw after eraseKey and left bidx linkable.
+    const registry = createRegistry([personFeature, ghostFeature]);
+    await expect(
+      nullBlindIndexesForSubject(
+        testDb.db,
+        registry.features,
+        subjectIdToKey({ kind: "user", userId: String(created.data.id) }),
+      ),
+    ).resolves.toBeUndefined();
+
+    expect((await rawRow(String(created.data.id)))["email_bidx"]).toBeNull();
+  });
 });

package/src/db/blind-index-cleanup.ts

@@ -19,6 +19,7 @@ import { toSnakeCase } from "../utils/case";
 import type { DbRunner } from "./connection";
 import { resolveTableName } from "./entity-table-meta";
 import { executeRawQuery, executeRawQueryRead } from "./queries/raw-sql";
+import { tableExists } from "./schema-inspection";
 
 export async function nullBlindIndexesForSubject(
   db: DbRunner,
@@ -34,6 +35,11 @@ export async function nullBlindIndexesForSubject(
       // one (buildEntityTable with no featureName option), the sweep has to
       // hit the same names.
       const tableName = resolveTableName(entityName, entity, undefined);
+      // Skip entities whose projection was never migrated — same class as
+      // subjectRowExistsInTenant (fw#2348). A throw here runs AFTER eraseKey
+      // in forget-subject and would leave deterministic bidx columns still
+      // linkable (fw#2550).
+      if (!(await tableExists(db, tableName))) continue;
       for (const fieldName of lookupable) {
         const snake = toSnakeCase(fieldName);
         await executeRawQuery(

package/src/db/entity-table-meta.ts

@@ -38,8 +38,8 @@ export type {
   UnmanagedTableInput,
 } from "./entity-table-meta-types";
 
-// Standard base-columns für event-sourced Read-Model-Tabellen. Spiegelt
-// `buildBaseColumns()` aus table-builder.ts (drizzle-Variante).
+// Standard base columns for event-sourced read-model tables. Mirrors
+// `buildBaseColumns()` from table-builder.ts (drizzle variant).
 function fullBaseColumns(idType: "uuid" | "serial", softDelete: boolean): readonly ColumnMeta[] {
   const idCol: ColumnMeta =
     idType === "uuid"
@@ -85,8 +85,8 @@ function fieldDefaultLiteral(field: FieldDefinition): string | undefined {
   return undefined;
 }
 
-// Spiegelt `fieldToColumns()` aus table-builder.ts (Drizzle-Variante).
-// Lock-step: jeder Field-Type produziert dieselben PG-Spalten wie heute.
+// Mirrors `fieldToColumns()` from table-builder.ts (drizzle variant).
+// Lock-step: every field type must produce the same PG columns as today.
 function fieldToColumnMeta(
   name: string,
   field: FieldDefinition,
@@ -105,9 +105,9 @@ function fieldToColumnMeta(
           ...(def !== undefined && { defaultSql: def }),
         },
       ];
-      // lookupable → HMAC-Blind-Index-Pendant. Nullable ist Pflicht:
-      // managedChangeRequiresRecreate würde eine NOT-NULL-Spalte ohne
-      // Default auf Bestandstabellen als DROP+Rebuild diffen.
+      // lookupable → HMAC blind-index counterpart. Nullable is mandatory:
+      // managedChangeRequiresRecreate would diff a NOT-NULL column without
+      // a default on existing tables as DROP+rebuild.
       if (field.type === "text" && field.lookupable === true) {
         cols.push({ name: `${snake}_bidx`, pgType: "text", notNull: false });
       }
@@ -262,13 +262,13 @@ export function deriveEntityTableMeta(
   }
   const idType = entity.idType ?? "uuid";
 
-  // Base-columns first, then user-fields. User-fields with the same
-  // pg-name as a base-column OVERRIDE the base-column (last-wins, gleiches
-  // Verhalten wie drizzle's `{ ...base, ...fields }` Spread im table-
-  // builder). Use-case: user-session hat `tenantId` als field um access-
-  // control aufzudrücken, fileRef hat `insertedAt` als field für sortable/
-  // filterable-marker. Die DB-Spalte bleibt die gleiche, nur Application-
-  // Metadata auf der Field-Seite ändert sich.
+  // Base columns first, then user-fields. User-fields with the same
+  // pg-name as a base-column OVERRIDE the base-column (last-wins, same
+  // behavior as drizzle's `{ ...base, ...fields }` spread in the table
+  // builder). Use case: user-session has `tenantId` as a field to enforce
+  // access control, fileRef has `insertedAt` as a field for sortable/
+  // filterable marking. The DB column stays the same, only the application
+  // metadata on the field side changes.
   const baseCols = fullBaseColumns(idType, entity.softDelete === true);
   const colByName = new Map<string, ColumnMeta>();
   for (const c of baseCols) colByName.set(c.name, c);
@@ -323,15 +323,15 @@ export function deriveEntityTableMeta(
     indexes.push({ name: `${tableName}_${snake}_idx`, columns: [snake] });
   }
 
-  // lookupable-Felder: Index auf der bidx-Spalte — der OR-Rewrite der
-  // Query-Compiler trifft sie bei jedem Equality-Lookup.
+  // lookupable fields: index on the bidx column — the query compiler's
+  // OR rewrite hits it on every equality lookup.
   for (const bidxSnake of bidxSnakeByFieldSnake.values()) {
     indexes.push({ name: `${tableName}_${bidxSnake}_idx`, columns: [bidxSnake] });
   }
 
-  // Explizit deklarierte indexes (EntityIndexDef). `def.where` ist ein
-  // SqlExpression (`sql\`…\`` aus @cosmicdrift/kumiko-framework/db) —
-  // renderbar via `.text`. Unbekannte where-Shapes bleiben needsManualWhere.
+  // Explicitly declared indexes (EntityIndexDef). `def.where` is a
+  // SqlExpression (`sql\`…\`` from @cosmicdrift/kumiko-framework/db) —
+  // renderable via `.text`. Unknown where-shapes stay needsManualWhere.
   for (const def of (entity.indexes ?? []) as readonly EntityIndexDef[]) {
     const cols = def.columns.map(
       (fieldName) => fieldNameToSnake.get(fieldName) ?? toSnakeCase(fieldName),
@@ -346,10 +346,10 @@ export function deriveEntityTableMeta(
       ...(whereSql !== undefined && { whereSql }),
       ...(def.where !== undefined && whereSql === undefined && { needsManualWhere: true }),
     });
-    // Unique-Index über lookupable-Spalten: partielles bidx-Pendant, damit
-    // Uniqueness auch für verschlüsselte Rows greift. Das Original bleibt
-    // für Klartext-Alt-Rows; partial (IS NOT NULL) weil bidx bei erased/
-    // key-losen Rows NULL ist.
+    // Unique index over lookupable columns: partial bidx counterpart, so
+    // uniqueness also holds for encrypted rows. The original stays
+    // for plaintext legacy rows; partial (IS NOT NULL) because bidx is
+    // NULL for erased/key-less rows.
     if (def.unique === true && def.where === undefined) {
       const bidxCols = cols.map((c) => bidxSnakeByFieldSnake.get(c) ?? c);
       if (bidxCols.some((c, i) => c !== cols[i])) {

package/src/engine/__tests__/build-app-schema.test.ts

@@ -49,6 +49,48 @@ describe("buildAppSchema", () => {
     expect(fleet?.entities["vehicle"]).toBeDefined();
   });
 
+  // r.screen({ nav: {...} }) sugar must omit absent optional nav fields
+  // rather than writing them as explicit `undefined` — a plain key-per-
+  // field object literal makes `undefined` a real value in the schema,
+  // which findNonJsonSafePath flags as a boot-time warning even though
+  // JSON.stringify silently drops the key later. r.contentCollection()
+  // already gets this right via a conditional spread; this pins the same
+  // fix for r.screen().
+  test("r.screen({ nav }) sugar omits absent optional nav fields instead of writing them as undefined", () => {
+    const topLevelFeature = defineFeature("privacy", (r) => {
+      r.screen({
+        id: "privacy-center",
+        type: "custom",
+        renderer: { react: { __component: "PrivacyCenterScreen" } },
+        nav: { label: "Privacy" },
+      });
+    });
+    const nestedFeature = defineFeature("billing", (r) => {
+      r.screen({
+        id: "invoices",
+        type: "custom",
+        renderer: { react: { __component: "InvoicesScreen" } },
+        nav: { label: "Invoices", parent: "billing:nav:overview" },
+      });
+    });
+
+    const app = buildAppSchema(createRegistry([topLevelFeature, nestedFeature]));
+
+    const privacyFeature = app.features.find((f) => f.featureName === "privacy");
+    const topLevelNav = privacyFeature?.navs?.[0];
+    if (!topLevelNav) throw new Error("privacy feature's nav entry is missing");
+    expect("parent" in topLevelNav).toBe(false);
+    expect("icon" in topLevelNav).toBe(false);
+    expect("order" in topLevelNav).toBe(false);
+
+    const billingFeature = app.features.find((f) => f.featureName === "billing");
+    const nestedNav = billingFeature?.navs?.[0];
+    if (!nestedNav) throw new Error("billing feature's nav entry is missing");
+    expect(nestedNav.parent).toBe("billing:nav:overview");
+
+    expect(findNonJsonSafePath(app, "schema")).toBeNull();
+  });
+
   // #1059: r.translations({keys}) must flow into FeatureSchema.translations
   // BYTE-IDENTICAL — nav/screen labels resolve these keys verbatim via
   // t(label) client-side, so any re-prefixing (like the registry's internal

package/src/engine/__tests__/define-workflow.test.ts

@@ -4,6 +4,7 @@ import {
   defineWorkflow,
   type WorkflowTrigger,
 } from "../define-workflow";
+import { stepsPipeline } from "../pipeline";
 import type { PipelineDef } from "../types/step";
 
 const pipe = (build: PipelineDef["build"]): PipelineDef => ({ __kind: "pipeline", build });
@@ -17,7 +18,28 @@ describe("defineWorkflow", () => {
     expect(wf.__kind).toBe("workflow");
     expect(wf.name).toBe("onboard");
     expect(wf.trigger).toEqual(eventTrigger);
-    expect(wf.pipelineDef).toBe(steps);
+    // pipelineDef is no longer `steps` by reference — defineWorkflow rebuilds
+    // it to carry the (possibly absent) branded awaits map — but the
+    // closure itself must be the exact same function.
+    expect(wf.pipelineDef.__kind).toBe("pipeline");
+    expect(wf.pipelineDef.build).toBe(steps.build);
+    expect(wf.awaits).toBeUndefined();
+    expect(wf.pipelineDef.awaits).toBeUndefined();
+  });
+
+  test("brands the declared awaits map onto both the definition and the pipelineDef", () => {
+    const wf = defineWorkflow({
+      name: "order-fulfillment",
+      trigger: eventTrigger,
+      awaits: { shipped: "order.shipped", cancelled: "order.cancelled" },
+      steps: stepsPipeline(() => []),
+    });
+
+    expect(wf.awaits).toEqual({ shipped: "order.shipped", cancelled: "order.cancelled" });
+    expect(wf.pipelineDef.awaits).toEqual({
+      shipped: "order.shipped",
+      cancelled: "order.cancelled",
+    });
   });
 });