@cosmicdrift/kumiko-framework 0.311.0 → 0.313.0

package/src/files/__tests__/files.integration.test.ts

@@ -35,7 +35,7 @@ import type { FileRoutesOptions } from "../file-routes";
 import { createInMemoryFileProvider } from "../in-memory-provider";
 import { createLocalProvider } from "../local-provider";
 import type { FileStorageProvider, SignedUrlOptions } from "../types";
-import { parseMaxSize, sniffMimeType, validateFile } from "../types";
+import { parseMaxSize, sniffMimeType, validateFile, validateFileContent } from "../types";
 
 // UUID for "this row doesn't exist" assertions. Valid v4 format so PG accepts
 // the query — the row just isn't there. Pre-v1 files-feature tests used
@@ -222,6 +222,80 @@ describe("file validation", () => {
     expect(sniffMimeType(new Uint8Array([0x00, 0x01, 0x02]))).toBeNull();
     expect(sniffMimeType(new TextEncoder().encode("hello world"))).toBeNull();
   });
+
+  // --- doc/docx magic-byte content verification ---
+
+  const docBytes = new Uint8Array([
+    0xd0,
+    0xcf,
+    0x11,
+    0xe0,
+    0xa1,
+    0xb1,
+    0x1a,
+    0xe1,
+    ...Array(20).fill(0),
+  ]);
+  const docxBytes = new Uint8Array([0x50, 0x4b, 0x03, 0x04, ...Array(20).fill(0)]);
+
+  test("validateFile accepts a .doc/.docx upload on extension/mimeType alone", () => {
+    expect(
+      validateFile(
+        { fileName: "report.doc", mimeType: "application/msword", size: docBytes.length },
+        { accept: ["doc", "docx"] },
+      ),
+    ).toBeNull();
+    expect(
+      validateFile(
+        {
+          fileName: "report.docx",
+          mimeType: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+          size: docxBytes.length,
+        },
+        { accept: ["doc", "docx"] },
+      ),
+    ).toBeNull();
+  });
+
+  test("validateFileContent accepts .doc/.docx bytes matching their declared mimeType", () => {
+    expect(validateFileContent("application/msword", docBytes)).toBeNull();
+    expect(
+      validateFileContent(
+        "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+        docxBytes,
+      ),
+    ).toBeNull();
+  });
+
+  test("validateFileContent rejects .doc/.docx whose content doesn't match the declared mimeType", () => {
+    const fakeDoc = validateFileContent(
+      "application/msword",
+      new TextEncoder().encode("not actually a Word document, just text"),
+    );
+    expectErrorIncludes(fakeDoc, "content_mismatch");
+
+    const fakeDocx = validateFileContent(
+      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+      new TextEncoder().encode("not actually a docx, just text"),
+    );
+    expectErrorIncludes(fakeDocx, "content_mismatch");
+  });
+
+  test("validateFileContent does not content-verify pre-existing types (e.g. pdf) even when content mismatches", () => {
+    expect(
+      validateFileContent(
+        "application/pdf",
+        new TextEncoder().encode("not a PDF at all, just text"),
+      ),
+    ).toBeNull();
+  });
+
+  test("sniffMimeType recognizes doc (OLE) and docx (ZIP) signatures", () => {
+    expect(sniffMimeType(docBytes)).toBe("application/msword");
+    expect(sniffMimeType(docxBytes)).toBe(
+      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    );
+  });
 });
 
 // --- Integration: Upload → Download → Delete via real HTTP API ---
@@ -409,6 +483,46 @@ describe("download Content-Type is sniffed from bytes, not trusted from the decl
   });
 });
 
+// --- doc/docx upload via API: content-verified independent of `accept` ---
+
+describe("doc/docx upload is content-verified against magic bytes", () => {
+  const docBytes = new Uint8Array([
+    0xd0,
+    0xcf,
+    0x11,
+    0xe0,
+    0xa1,
+    0xb1,
+    0x1a,
+    0xe1,
+    ...Array(20).fill(0),
+  ]);
+  const docxBytes = new Uint8Array([0x50, 0x4b, 0x03, 0x04, ...Array(20).fill(0)]);
+
+  test("a real .doc upload succeeds", async () => {
+    const res = await uploadFile(adminUser, "report.doc", docBytes, "application/msword");
+    expect(res.status).toBe(201);
+  });
+
+  test("a real .docx upload succeeds", async () => {
+    const res = await uploadFile(
+      adminUser,
+      "report.docx",
+      docxBytes,
+      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    );
+    expect(res.status).toBe(201);
+  });
+
+  test("a .doc upload whose bytes don't match the declared mimeType is rejected with content_mismatch, even unattached (no `accept` list)", async () => {
+    const fakeDocBytes = new TextEncoder().encode("plain text pretending to be a Word document");
+    const res = await uploadFile(adminUser, "fake.doc", fakeDocBytes, "application/msword");
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toContain("content_mismatch");
+  });
+});
+
 // --- Cross-user access within a tenant (attached file owner-scope) ---
 
 describe("attached file owner-scope", () => {

package/src/files/__tests__/storage-tracking.test.ts

@@ -0,0 +1,46 @@
+// fileRefStorageDelta — the single source of truth the tenant-storage-usage
+// MSP's apply handlers and transferTenantStorageUsage's replay both use to
+// turn one fileRef event into a signed (bytes, files) delta.
+
+import { describe, expect, test } from "bun:test";
+import { entityEventName } from "../../db";
+import { fileRefStorageDelta } from "../storage-tracking";
+
+const CREATED = entityEventName("fileRef", "created");
+const DELETED = entityEventName("fileRef", "deleted");
+const RESTORED = entityEventName("fileRef", "restored");
+
+describe("fileRefStorageDelta", () => {
+  test("created: positive delta from payload.size", () => {
+    expect(fileRefStorageDelta({ type: CREATED, payload: { size: 42 } })).toEqual({
+      bytes: 42,
+      files: 1,
+    });
+  });
+
+  test("created: missing/non-numeric size reads as 0 bytes, still counts a file", () => {
+    expect(fileRefStorageDelta({ type: CREATED, payload: {} })).toEqual({ bytes: 0, files: 1 });
+  });
+
+  test("deleted: negative delta from payload.previous.size", () => {
+    expect(fileRefStorageDelta({ type: DELETED, payload: { previous: { size: 42 } } })).toEqual({
+      bytes: -42,
+      files: -1,
+    });
+  });
+
+  test("deleted: missing previous reads as 0 bytes, still counts -1 file", () => {
+    expect(fileRefStorageDelta({ type: DELETED, payload: {} })).toEqual({ bytes: 0, files: -1 });
+  });
+
+  test("restored: positive delta from payload.previous.size, symmetric to delete", () => {
+    expect(fileRefStorageDelta({ type: RESTORED, payload: { previous: { size: 42 } } })).toEqual({
+      bytes: 42,
+      files: 1,
+    });
+  });
+
+  test("an unrelated event type returns null", () => {
+    expect(fileRefStorageDelta({ type: "fileRef.renamed", payload: { size: 42 } })).toBeNull();
+  });
+});

package/src/files/file-routes.ts

@@ -27,7 +27,12 @@ import { createFileContext } from "./file-handle";
 import { fileRefEntity } from "./file-ref-entity";
 import { fileRefsTable } from "./file-ref-table";
 import type { FileProviderResolver } from "./provider-resolver";
-import { buildStorageKey, resolveServedContentType, validateFile } from "./types";
+import {
+  buildStorageKey,
+  resolveServedContentType,
+  validateFile,
+  validateFileContent,
+} from "./types";
 
 // Decision returned by a FileAccessGuard — distinct from boolean so callers
 // can't accidentally negate or default it.
@@ -228,13 +233,19 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
       generateId(),
     );
 
+    const data = new Uint8Array(await file.arrayBuffer());
+
+    const contentValidationError = validateFileContent(file.type, data);
+    if (contentValidationError) {
+      return c.json({ error: contentValidationError }, 400);
+    }
+
     // Write binary FIRST (outside the tx — network/disk I/O doesn't belong
     // inside a PG connection's tx window). On DB-tx rollback below the bytes
     // are orphaned in the provider; cleanup-jobs sweep those later. Losing a
     // row on append-failure is acceptable; corrupting a committed row with a
     // missing binary is not.
     const storageProvider = await options.resolveProvider(user.tenantId);
-    const data = new Uint8Array(await file.arrayBuffer());
     await storageProvider.write(storageKey, data, file.type);
 
     // Create via the standard entity executor: emits fileRef.created +

package/src/files/index.ts

@@ -26,7 +26,12 @@ export {
   isFileProviderPlugin,
   makeFileProviderResolver,
 } from "./provider-resolver";
-export { filesStorageTrackingFeature, tenantStorageUsageTable } from "./storage-tracking";
+export {
+  fileRefStorageDelta,
+  filesStorageTrackingFeature,
+  tenantStorageUsageTable,
+  transferTenantStorageUsage,
+} from "./storage-tracking";
 export type {
   FileMetadata,
   FileStorageProvider,
@@ -37,10 +42,12 @@ export type {
 export {
   assertSafeStorageKey,
   buildStorageKey,
+  normalizeMimeType,
   parseMaxSize,
   tenantExportPrefix,
   tenantStoragePrefixes,
   validateFile,
+  validateFileContent,
 } from "./types";
 export type { ZipEntry } from "./zip-stream";
 export { createZipStream } from "./zip-stream";

package/src/files/storage-tracking.ts

@@ -11,18 +11,28 @@
 // consumer-cursor row. Apps that want it pass filesStorageTrackingFeature
 // into createApp / setupTestStack alongside their domain features.
 
-import { entityEventName } from "../db";
+import { type DbRunner, entityEventName, executeRawQueryRead } from "../db";
 import { bigint, instant, integer, table as pgTable, sql, uuid } from "../db/dialect";
 import { incrementCounter } from "../db/query";
-import { defineFeature } from "../engine";
+import { defineFeature, qn, type Registry, toKebab } from "../engine";
+import {
+  type PendingGapEntry,
+  SHARED_INSTANCE_SENTINEL,
+  selectConsumerCursorForUpdate,
+} from "../pipeline";
+import { parseJsonOrThrow } from "../utils";
+
+const FILE_REF_AGGREGATE_TYPE = "fileRef";
+const STORAGE_TRACKING_FEATURE_NAME = "files-storage-tracking";
+const TENANT_STORAGE_USAGE_MSP_NAME = "tenant-storage-usage";
 
 // fileRef is a standard ES entity, so usage tracking subscribes to its
 // auto-verb events. `fileRef.created` payload carries the entity fields
 // (incl. size); `fileRef.deleted` / `fileRef.restored` carry `{ previous }`
 // (the pre-event row), so the byte count to apply lives at previous.size.
-const FILE_REF_CREATED = entityEventName("fileRef", "created");
-const FILE_REF_DELETED = entityEventName("fileRef", "deleted");
-const FILE_REF_RESTORED = entityEventName("fileRef", "restored");
+const FILE_REF_CREATED = entityEventName(FILE_REF_AGGREGATE_TYPE, "created");
+const FILE_REF_DELETED = entityEventName(FILE_REF_AGGREGATE_TYPE, "deleted");
+const FILE_REF_RESTORED = entityEventName(FILE_REF_AGGREGATE_TYPE, "restored");
 
 function readNumber(value: unknown): number {
   return typeof value === "number" ? value : 0;
@@ -36,6 +46,28 @@ function sizeFromPrevious(payload: Record<string, unknown>): number {
   return 0;
 }
 
+// Single source of truth for "how much does this fileRef event move the
+// tenant's storage counters" — shared by the MSP's own apply handlers and by
+// transferTenantStorageUsage's replay of already-applied events during a
+// tenant handover.
+export function fileRefStorageDelta(event: {
+  readonly type: string;
+  readonly payload: Record<string, unknown>;
+}): { readonly bytes: number; readonly files: number } | null {
+  switch (event.type) {
+    case FILE_REF_CREATED:
+      return { bytes: readNumber(event.payload["size"]), files: 1 };
+    case FILE_REF_DELETED:
+      // `0 - x`, not `-x`: a zero-byte previous size must stay `0`, not `-0`
+      // (toEqual/JSON round-trips treat -0 as distinct from 0).
+      return { bytes: 0 - sizeFromPrevious(event.payload), files: -1 };
+    case FILE_REF_RESTORED:
+      return { bytes: sizeFromPrevious(event.payload), files: 1 };
+    default:
+      return null;
+  }
+}
+
 // bigint in `mode: "number"` returns a JS number (safe up to 2^53 ≈ 9e15
 // bytes ≈ 8 petabytes per tenant — large enough for any practical storage
 // quota). Default "bigint" mode would hand back a bigint value, which
@@ -48,13 +80,15 @@ export const tenantStorageUsageTable = pgTable("read_tenant_storage_usage", {
   lastUpdatedAt: instant("last_updated_at").default(sql`now()`).notNull(),
 });
 
-export const filesStorageTrackingFeature = defineFeature("files-storage-tracking", (r) => {
+export const filesStorageTrackingFeature = defineFeature(STORAGE_TRACKING_FEATURE_NAME, (r) => {
   r.multiStreamProjection({
-    name: "tenant-storage-usage",
+    name: TENANT_STORAGE_USAGE_MSP_NAME,
     table: tenantStorageUsageTable,
     apply: {
       [FILE_REF_CREATED]: async (event, tx) => {
-        const size = readNumber(event.payload["size"]);
+        const delta = fileRefStorageDelta(event);
+        // skip: not a tracked fileRef storage change
+        if (!delta) return;
 
         // UPSERT: INSERT on first upload per tenant, otherwise atomic increment.
         // The SQL increment guarantees correctness under concurrent dispatcher
@@ -63,13 +97,15 @@ export const filesStorageTrackingFeature = defineFeature("files-storage-tracking
         await incrementCounter(
           tx,
           tenantStorageUsageTable,
-          { tenantId: event.tenantId, totalBytes: size, fileCount: 1 },
-          { totalBytes: size, fileCount: 1 },
+          { tenantId: event.tenantId, totalBytes: delta.bytes, fileCount: delta.files },
+          { totalBytes: delta.bytes, fileCount: delta.files },
           { set: { lastUpdatedAt: sql`now()` } },
         );
       },
       [FILE_REF_DELETED]: async (event, tx) => {
-        const size = sizeFromPrevious(event.payload);
+        const delta = fileRefStorageDelta(event);
+        // skip: not a tracked fileRef storage change
+        if (!delta) return;
         // Decrement on delete. INSERT values are 0/0 so a delete that somehow
         // precedes any upload can't create negative usage; the on-conflict
         // path applies the real negative delta. Async (dispatcher) —
@@ -78,7 +114,7 @@ export const filesStorageTrackingFeature = defineFeature("files-storage-tracking
           tx,
           tenantStorageUsageTable,
           { tenantId: event.tenantId, totalBytes: 0, fileCount: 0 },
-          { totalBytes: -size, fileCount: -1 },
+          { totalBytes: delta.bytes, fileCount: delta.files },
           { set: { lastUpdatedAt: sql`now()` } },
         );
       },
@@ -86,15 +122,124 @@ export const filesStorageTrackingFeature = defineFeature("files-storage-tracking
         // Restore re-increments by the soft-deleted row's size — symmetric
         // to delete. Without this handler totalBytes/fileCount drift low
         // after every delete→restore round-trip.
-        const size = sizeFromPrevious(event.payload);
+        const delta = fileRefStorageDelta(event);
+        // skip: not a tracked fileRef storage change
+        if (!delta) return;
         await incrementCounter(
           tx,
           tenantStorageUsageTable,
-          { tenantId: event.tenantId, totalBytes: size, fileCount: 1 },
-          { totalBytes: size, fileCount: 1 },
+          { tenantId: event.tenantId, totalBytes: delta.bytes, fileCount: delta.files },
+          { totalBytes: delta.bytes, fileCount: delta.files },
           { set: { lastUpdatedAt: sql`now()` } },
         );
       },
     },
   });
 });
+
+// Qualified name of the tenant-storage-usage MSP consumer row in
+// kumiko_event_consumers — the same qualification registry-ingest.ts applies
+// to every multiStreamProjection (qualify(featureName, "projection", name)).
+const TENANT_STORAGE_USAGE_MSP_QN = qn(
+  toKebab(STORAGE_TRACKING_FEATURE_NAME),
+  "projection",
+  toKebab(TENANT_STORAGE_USAGE_MSP_NAME),
+);
+
+const TRACKED_FILE_REF_EVENT_TYPES = [FILE_REF_CREATED, FILE_REF_DELETED, FILE_REF_RESTORED];
+
+function isWithinPendingGap(eventId: bigint, gaps: readonly PendingGapEntry[]): boolean {
+  return gaps.some((gap) => eventId >= BigInt(gap.from) && eventId <= BigInt(gap.to));
+}
+
+// Moves the already-applied share of the tenant-storage-usage counters from
+// source to destination tenant when a tenant-handover claim moves fileRef
+// rows. Must run BEFORE moveEventHistory rewrites the events' tenant_id —
+// the query below finds "already applied" events by sourceTenantId, and once
+// the rewrite runs there is no way to tell an already-applied event from a
+// not-yet-applied one by tenant_id alone.
+//
+// Events with id above the cursor (or inside a pending gap) are NOT summed
+// here: the dispatcher hasn't applied them yet, they will carry the
+// destination tenant_id once moveEventHistory runs, and the dispatcher will
+// apply them against the destination counter on its own next pass.
+export async function transferTenantStorageUsage(args: {
+  readonly db: DbRunner;
+  readonly registry: Registry;
+  readonly fileRefIds: readonly string[];
+  readonly sourceTenantId: string;
+  readonly destinationTenantId: string;
+}): Promise<void> {
+  const { db, registry, fileRefIds, sourceTenantId, destinationTenantId } = args;
+  // skip: no fileRefs moved, nothing to transfer
+  if (fileRefIds.length === 0) return;
+  // skip: storage tracking is not mounted in this app
+  if (!registry.getAllMultiStreamProjections().has(TENANT_STORAGE_USAGE_MSP_QN)) return;
+
+  // Locks the same consumer row the dispatcher's own FOR UPDATE SKIP LOCKED
+  // pass takes before applying a batch — serializing against it here means no
+  // fileRef event for these ids can be applied between reading the cursor
+  // below and the tenant move that follows in the caller.
+  const cursor = await selectConsumerCursorForUpdate(
+    db,
+    TENANT_STORAGE_USAGE_MSP_QN,
+    SHARED_INSTANCE_SENTINEL,
+  );
+  // skip: no consumer row means the MSP never applied anything yet
+  if (!cursor) return;
+
+  const rows = await executeRawQueryRead<{ id: string; type: string; payload: string }>(
+    db,
+    `SELECT "id"::text AS id, "type", "payload"::text AS payload FROM kumiko_events
+     WHERE "tenant_id" = $1 AND "aggregate_type" = $2 AND "aggregate_id" = ANY($3)
+       AND "type" = ANY($4) AND "id" <= $5`,
+    [
+      sourceTenantId,
+      FILE_REF_AGGREGATE_TYPE,
+      fileRefIds,
+      TRACKED_FILE_REF_EVENT_TYPES,
+      cursor.lastProcessedEventId,
+    ],
+  );
+
+  let bytes = 0;
+  let files = 0;
+  for (const row of rows) {
+    if (isWithinPendingGap(BigInt(row.id), cursor.pendingGaps)) continue;
+    const delta = fileRefStorageDelta({
+      type: row.type,
+      payload: parseJsonOrThrow<Record<string, unknown>>(
+        row.payload,
+        "transferTenantStorageUsage: kumiko_events.payload",
+      ),
+    });
+    if (!delta) continue;
+    bytes += delta.bytes;
+    files += delta.files;
+  }
+  // skip: the moved fileRefs carry no applied storage share
+  if (bytes === 0 && files === 0) return;
+
+  // Source: insert-values stay 0/0 (same guard as the DELETED handler above)
+  // — the row this subtracts from is expected to already exist (the MSP
+  // already applied the create against it), and if it somehow doesn't, this
+  // must not conjure a negative balance out of thin air.
+  await incrementCounter(
+    db,
+    tenantStorageUsageTable,
+    { tenantId: sourceTenantId, totalBytes: 0, fileCount: 0 },
+    { totalBytes: -bytes, fileCount: -files },
+    { set: { lastUpdatedAt: sql`now()` } },
+  );
+  // Destination: insert-values ARE the transferred amount (same as CREATED/
+  // RESTORED above) — a tenant claiming its first-ever fileRef must start
+  // its counter row at the transferred total, not at 0 with an increment
+  // that only fires once a row already exists.
+  await incrementCounter(
+    db,
+    tenantStorageUsageTable,
+    { tenantId: destinationTenantId, totalBytes: bytes, fileCount: files },
+    { totalBytes: bytes, fileCount: files },
+    { set: { lastUpdatedAt: sql`now()` } },
+  );
+}

package/src/files/types.ts

@@ -50,6 +50,8 @@ const EXTENSION_MIME_WHITELIST: Record<string, readonly string[]> = {
   csv: ["text/csv", "application/csv", "text/plain"],
   json: ["application/json", "text/json"],
   md: ["text/markdown", "text/plain"],
+  doc: ["application/msword"],
+  docx: ["application/vnd.openxmlformats-officedocument.wordprocessingml.document"],
 } satisfies Record<string, readonly string[]>;
 
 // Magic-byte signatures for the subset of EXTENSION_MIME_WHITELIST that has
@@ -78,6 +80,19 @@ const MAGIC_BYTE_SIGNATURES: ReadonlyArray<{
     matches: (bytes) => startsWithAscii(bytes, "RIFF") && startsWithAscii(bytes, "WEBP", 8),
   },
   { mimeType: "application/pdf", matches: (bytes) => startsWithAscii(bytes, "%PDF-") },
+  // Full 8-byte OLE Compound File signature (legacy .doc/.xls/.ppt share it —
+  // sniffing can't tell them apart by bytes alone, only content-verification
+  // below narrows to msword specifically).
+  {
+    mimeType: "application/msword",
+    matches: (bytes) => startsWithBytes(bytes, [0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1]),
+  },
+  // ZIP local-file-header signature — .docx/.xlsx/.pptx/plain .zip all share
+  // it; same caveat as OLE above.
+  {
+    mimeType: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    matches: (bytes) => startsWithBytes(bytes, [0x50, 0x4b, 0x03, 0x04]),
+  },
 ];
 
 function startsWithBytes(bytes: Uint8Array, signature: readonly number[]): boolean {
@@ -100,6 +115,12 @@ export function sniffMimeType(bytes: Uint8Array): string | null {
   return null;
 }
 
+// Strips a `; charset=…`-style suffix and trims/lowercases — the one
+// normalization every mimeType comparison needs before comparing values.
+export function normalizeMimeType(mimeType: string): string {
+  return mimeType.toLowerCase().split(";")[0]?.trim() ?? "";
+}
+
 // image/jpg is not a registered IANA type but EXTENSION_MIME_WHITELIST above
 // accepts it as a jpg alias — sniffMimeType only ever returns the canonical
 // image/jpeg, so without this a legitimately-declared "image/jpg" upload
@@ -119,11 +140,19 @@ const DECLARED_MIME_ALIASES: Readonly<Record<string, string>> = {
 export function resolveServedContentType(bytes: Uint8Array, declaredMimeType: string): string {
   const sniffed = sniffMimeType(bytes);
   if (!sniffed) return "application/octet-stream";
-  const normalizedDeclared = declaredMimeType.toLowerCase().split(";")[0]?.trim() ?? "";
+  const normalizedDeclared = normalizeMimeType(declaredMimeType);
   const declared = DECLARED_MIME_ALIASES[normalizedDeclared] ?? normalizedDeclared;
   return sniffed === declared ? sniffed : "application/octet-stream";
 }
 
+// Signature-checked against the declared mimeType regardless of
+// `options.accept`. Deliberately narrow: most of the whitelist has no magic
+// bytes at all and would reject honestly-mislabeled uploads if checked.
+const CONTENT_VERIFIED_MIME_TYPES = new Set([
+  "application/msword",
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+]);
+
 export function validateFile(
   metadata: FileMetadata,
   options: FileValidationOptions,
@@ -146,7 +175,7 @@ export function validateFile(
     // and having the mimeType reflect that.
     const allowedMimes = EXTENSION_MIME_WHITELIST[ext];
     if (allowedMimes && metadata.mimeType) {
-      const normalized = metadata.mimeType.toLowerCase().split(";")[0]?.trim() ?? "";
+      const normalized = normalizeMimeType(metadata.mimeType);
       if (!allowedMimes.includes(normalized)) {
         return `mime_mismatch: extension ".${ext}" does not match mimeType "${metadata.mimeType}"`;
       }
@@ -156,6 +185,19 @@ export function validateFile(
   return null;
 }
 
+// Separate from validateFile: metadata is known before the upload body is
+// fully read, content-verification only after — callers reject early on
+// metadata without buffering bytes they'll then have to reject anyway.
+export function validateFileContent(mimeType: string, content: Uint8Array): string | null {
+  const normalizedDeclared = normalizeMimeType(mimeType);
+  if (!CONTENT_VERIFIED_MIME_TYPES.has(normalizedDeclared)) return null;
+  const signature = MAGIC_BYTE_SIGNATURES.find((s) => s.mimeType === normalizedDeclared);
+  if (signature && !signature.matches(content)) {
+    return `content_mismatch: bytes do not match declared mimeType "${mimeType}"`;
+  }
+  return null;
+}
+
 export function assertSafeStorageKey(key: string): void {
   if (key.split("/").some((segment) => segment === "." || segment === "..")) {
     throw new Error(`storage key contains a path-traversal segment: "${key}"`);

package/src/jobs/job-runner.ts

@@ -13,6 +13,7 @@ import {
   type JobContext,
   type JobDefinition,
   type JobRunIn,
+  type JobTriggerEvent,
   type MemberReader,
   type Registry,
   type SessionUser,
@@ -42,6 +43,22 @@ import {
 } from "../pipeline/write-origin";
 import { bridgeStub } from "../testing/handler-context";
 
+// Shape-checked after the BullMQ/Redis JSON round-trip. Unlike `_writeOrigin`
+// (a security-relevant escape hatch that must fail the run closed), a
+// malformed `_triggerEvent` only costs an idempotency-key convenience — the
+// run proceeds without it rather than failing over what would be a framework
+// bug, not untrusted input.
+function isJobTriggerEvent(value: unknown): value is JobTriggerEvent {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value as Record<string, unknown>;
+  if (typeof candidate["id"] !== "string") return false;
+  const headers = candidate["headers"];
+  if (typeof headers !== "object" || headers === null) return false;
+  return Object.values(headers as Record<string, unknown>).every(
+    (v) => typeof v === "string" || typeof v === "number" || typeof v === "boolean",
+  );
+}
+
 // A payload's own `_writeOrigin` is never trusted; only the ambient gated origin is stamped.
 function stampGatedWriteOrigin(data: Record<string, unknown>): void {
   delete data["_writeOrigin"];
@@ -216,6 +233,7 @@ export type JobRunner = {
     eventName: string,
     payload: Record<string, unknown>,
     user?: SessionUser,
+    triggerEvent?: JobTriggerEvent,
   ): Promise<void>;
   // Wires JobContext.write/writeAs/queryAs to the real dispatcher — called
   // once at boot, after the dispatcher exists (job-runner construction happens
@@ -367,6 +385,17 @@ function buildRetryBullOpts(jobDef: JobDefinition): Pick<JobsOptions, "attempts"
   return opts;
 }
 
+// Equality filter on top-level payload fields for a job's trigger.where —
+// lets N jobs share one broad event QN, partitioned by a payload
+// discriminant instead of needing N distinct event types.
+function payloadMatchesTriggerFilter(
+  where: Readonly<Record<string, string | number | boolean>> | undefined,
+  payload: Record<string, unknown>,
+): boolean {
+  if (!where) return true;
+  return Object.entries(where).every(([key, value]) => payload[key] === value);
+}
+
 // BullMQ sweeps queue-wide: any job finishing with keepJobs set can evict
 // OTHER jobs in the same completed/failed zset (moveToFinished lua,
 // removeJobsByMaxAge/removeJobsByMaxCount), not just the finishing job, and
@@ -748,6 +777,12 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
     // don't dig through the raw payload themselves.
     const triggerName = rawData["_triggerName"] as string | undefined; // @cast-boundary dynamic-key
 
+    // Same carry-through for `_triggerEvent` — handleEvent injects it when
+    // the job-trigger event consumer supplied the stored event that fired
+    // this run (see createJobTriggerEventConsumer).
+    const rawTriggerEvent = rawData["_triggerEvent"];
+    const triggerEvent = isJobTriggerEvent(rawTriggerEvent) ? rawTriggerEvent : undefined;
+
     // Absent = legacy or ungated root; present but invalid fails the run closed.
     const rawWriteOrigin = rawData["_writeOrigin"]; // @cast-boundary dynamic-key
     let jobOrigin: WriteOrigin | undefined;
@@ -855,6 +890,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
       triggeredBy: triggeredById !== null ? { id: triggeredById, tenantId } : null,
       log: createJobLogger(logs),
       ...(triggerName !== undefined && { triggerName }),
+      ...(triggerEvent !== undefined && { triggerEvent }),
       write: (qn: string, payload: unknown) => {
         if (!dispatchWriteRef) {
           throw new Error(
@@ -1247,6 +1283,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
       eventName: string,
       payload: Record<string, unknown>,
       user?: SessionUser,
+      triggerEvent?: JobTriggerEvent,
     ): Promise<void> {
       const traceCtx = captureTraceContext(tracer);
       // Same correlation propagation as dispatch(): events triggered from
@@ -1263,6 +1300,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
           ? triggerOn.includes(eventName)
           : triggerOn === eventName;
         if (!matches) continue;
+        if (!payloadMatchesTriggerFilter(jobDef.trigger.where, payload)) continue;
         const data: Record<string, unknown> = { ...payload };
         if (user) {
           data["_tenantId"] = user.tenantId;
@@ -1273,6 +1311,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
         // setzen wir es auch — kostet nichts und vereinfacht Handler-Code
         // (kein "ist es Multi?"-Branch nötig).
         data["_triggerName"] = eventName;
+        if (triggerEvent) data["_triggerEvent"] = triggerEvent;
         if (traceCtx) data[TRACE_CONTEXT_KEY] = traceCtx;
         if (reqCtx?.correlationId) data["_correlationId"] = reqCtx.correlationId;
         // Same maxPerTenant guard as dispatch — events that fan into many