@cosmicdrift/kumiko-framework 0.326.0 → 0.327.0

package/src/event-store/transfer.ts

@@ -8,6 +8,7 @@
 // commits it together with the root row's ownership write — see
 // move-entity-graph.ts's file header for why that matters).
 
+import { AGGREGATE_TRANSFERRED_EVENT_TYPE } from "../crypto/system-event-pii";
 import type { DbRunner } from "../db";
 import {
   deleteSnapshotsForAggregates,
@@ -15,12 +16,11 @@ import {
   transferEventRows,
 } from "../db/queries/event-store-transfer";
 import type { TenantId } from "../engine/types";
-import { SYSTEM_EVENT_PREFIX } from "../pipeline/append-event-core";
 import { generateId } from "../utils/ids";
 import { append } from "./event-store";
 
 export const AGGREGATE_TRANSFER_STREAM_TYPE = "aggregate-transfer";
-export const AGGREGATE_TRANSFERRED_EVENT_TYPE = `${SYSTEM_EVENT_PREFIX}aggregate.transferred`;
+export { AGGREGATE_TRANSFERRED_EVENT_TYPE };
 
 export type TransferAggregateStreamsArgs = {
   readonly sourceTenantId: TenantId;

package/src/jobs/__tests__/jobs.integration.test.ts

@@ -1530,3 +1530,34 @@ describe("boot gates", () => {
     expect(() => createRegistry([validStringForm])).not.toThrow();
   });
 });
+
+describe("runner lifecycle: immediate stop (fw#1805)", () => {
+  test("stop() right after construction leaves no unhandled rejection", async () => {
+    const unhandled: unknown[] = [];
+    const onUnhandled = (reason: unknown) => {
+      unhandled.push(reason);
+    };
+    process.on("unhandledRejection", onUnhandled);
+    try {
+      // @timeout-exception: #1805 the 0-4ms delay is the variable under test (stop during connect), nothing to poll for
+      for (let i = 0; i < 20; i++) {
+        const runner = createJobRunner({
+          registry: createRegistry([testFeature]),
+          context: {},
+          redisUrl,
+          consumerLane: "worker",
+          queueNamePrefix: `kumiko-test-stop-${Date.now()}-${i}-${Math.random().toString(36).slice(2, 8)}`,
+        });
+        // Deterministic 0-4ms delays hit the window where the Queue
+        // connection is still 'initializing'.
+        await sleep(i % 5);
+        await runner.stop();
+      }
+      // Rejections surface on a later tick.
+      await sleep(200);
+    } finally {
+      process.off("unhandledRejection", onUnhandled);
+    }
+    expect(unhandled).toEqual([]);
+  });
+});

package/src/jobs/job-runner.ts

@@ -1181,6 +1181,24 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
         await worker.close();
         worker = null;
       }
+      // BullMQ close() while a Queue's connection is still 'initializing'
+      // rejects the in-flight INFO with "Connection is closed." on an emitter
+      // without listeners -> unhandled rejection (fw#1805). Wait for readiness
+      // first; a failed/timed-out wait must not block the close itself.
+      const readinessTimeout = timeoutReject(
+        bootRedisTimeoutMs,
+        `job-runner: Queue not ready within ${bootRedisTimeoutMs}ms during stop()`,
+      );
+      try {
+        await Promise.race([
+          Promise.all([queues.api.waitUntilReady(), queues.worker.waitUntilReady()]),
+          readinessTimeout.promise,
+        ]);
+      } catch {
+        // close() below still has to run
+      } finally {
+        readinessTimeout.cancel();
+      }
       await Promise.all([queues.api.close(), queues.worker.close()]);
       if (lockRedis) {
         // quit() drains in-flight commands; disconnect() would cancel them

package/src/pipeline/append-event-core.ts

@@ -1,4 +1,5 @@
 import { requestContext } from "../api/request-context";
+import { SYSTEM_EVENT_PREFIX } from "../crypto/system-event-pii";
 import type { DbRunner } from "../db/connection";
 import { qnScope, toKebab } from "../engine/qualified-name";
 import type { AppendEventArgs, Registry, TenantId } from "../engine/types";
@@ -32,14 +33,6 @@ export type AppendDomainEventCoreDeps = {
   readonly callerFeature?: string;
 };
 
-// System-event prefix: events under this namespace bypass the registry +
-// ownership checks. Reserved for framework-internal coordination (step-
-// engine deferred dispatch, lifecycle signals). The matching MSP filters
-// on the literal type-string. Apps cannot write into "kumiko:system:*"
-// directly — only framework step implementations call unsafeAppendEvent
-// with these types.
-export const SYSTEM_EVENT_PREFIX = "kumiko:system:";
-
 export async function appendDomainEventCore(
   deps: AppendDomainEventCoreDeps,
   args: AppendEventArgs,

package/src/pipeline/irreversible-operation-gate.ts

@@ -15,10 +15,11 @@ export function isIrreversibleEntityVerb(
 
 // The gate reads the directly dispatched entry handler; a write dispatched inside a deferred
 // context (afterCommit hook, job, consumer) gets its own entryHandler and is gated too. Direct
-// executor/KMS calls without one stay ungated in exactly two cases: deleting derived data
+// executor/KMS calls without one stay ungated in exactly three cases: deleting derived data
 // rebuildable from a reversible source (document-ingest-foundation's forget-extract-with-file-ref
-// consumer, re-created on fileRef.restored), and pipelines started by a risk "high" handler or a
-// cron scan (forget cleanup, retention, tenant destroy). A deferred context can't return the
+// consumer, re-created on fileRef.restored), pipelines started by a risk "high" handler or a
+// cron scan (forget cleanup, retention, tenant destroy), and the step-dispatcher erasing the
+// per-dispatch record key once the outcome is recorded. A deferred context can't return the
 // reason to the agent synchronously, so the gate sits at the primitives.
 function assertEntryHandlerHighRisk(args: {
   reason: FrameworkReason;