@cosmicdrift/kumiko-framework 0.328.0 → 0.329.0

package/src/engine/where-rule-lint.ts

@@ -1,196 +0,0 @@
-// Static lint for `WhereRule` SQL fragments (fw#2639).
-//
-// A `where`-rule hands the framework raw SQL. If the author writes an
-// unqualified column name inside a correlated subquery, Postgres binds it
-// to the innermost table instead of the outer one — the intended predicate
-// silently collapses into a tautology (`t.x = t.x`) and the rule grants
-// every row instead of none. This module is a text-level lint (no SQL
-// parser) that catches the two shapes that always mean "this rule is
-// broken": a bare column reference inside a subquery that shadows an outer
-// column, and a literal self-comparison.
-
-import { KUMIKO_COLUMNS_SYMBOL } from "@cosmicdrift/kumiko-types/schema-table-types";
-import { toSnakeCase } from "../db/table-builder";
-
-const IDENT_SRC = `"(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*`;
-const QUALIFIED_SRC = `(?:${IDENT_SRC})(?:\\.(?:${IDENT_SRC}))?`;
-
-const TOKEN_RE = new RegExp(IDENT_SRC, "g");
-const SELF_COMPARISON_RE = new RegExp(
-  `(${QUALIFIED_SRC})\\s*(?<![!<>=])=(?!=)\\s*(${QUALIFIED_SRC})`,
-  "g",
-);
-const QUALIFIED_PARSE_RE = new RegExp(`^(${IDENT_SRC})(?:\\.(${IDENT_SRC}))?$`);
-
-// Resolve the SQL column names a table exposes, so the lint can tell a
-// real column reference apart from a table alias / function name / SQL
-// keyword. Returns an empty set when nothing is derivable (fail-open on
-// the lint itself would be worse than skipping it).
-export function tableColumnSqlNames(table: unknown): ReadonlySet<string> {
-  if (table === null || typeof table !== "object") return new Set();
-
-  const cols = (table as Record<symbol, unknown>)[KUMIKO_COLUMNS_SYMBOL];
-  if (cols && typeof cols === "object") {
-    const names = new Set<string>();
-    for (const col of Object.values(cols as Record<string, unknown>)) {
-      if (col && typeof col === "object") {
-        const nameVal = (col as Record<string, unknown>)["name"];
-        if (typeof nameVal === "string") names.add(nameVal.toLowerCase());
-      }
-    }
-    return names;
-  }
-
-  // Plain-object fallback (tests): no Drizzle column-symbol map, so every
-  // object-valued key is treated as a field and mapped to its SQL name the
-  // same way columnSqlName() in ownership.ts does for hand-rolled tables.
-  const names = new Set<string>();
-  for (const [key, value] of Object.entries(table as Record<string, unknown>)) {
-    if (value && typeof value === "object") {
-      names.add(toSnakeCase(key).toLowerCase());
-    }
-  }
-  return names;
-}
-
-function skipLineComment(sql: string, i: number): number {
-  let j = i;
-  while (j < sql.length && sql[j] !== "\n") j++;
-  return j;
-}
-
-function skipBlockComment(sql: string, i: number): number {
-  let j = i + 2;
-  while (j < sql.length && !(sql[j] === "*" && sql[j + 1] === "/")) j++;
-  return j + 2;
-}
-
-function skipQuotedLiteral(sql: string, i: number): number {
-  let j = i + 1;
-  while (j < sql.length) {
-    if (sql[j] === "'" && sql[j + 1] === "'") {
-      j += 2;
-      continue;
-    }
-    if (sql[j] === "'") {
-      j++;
-      break;
-    }
-    j++;
-  }
-  return j;
-}
-
-function stripCommentsAndStrings(sqlText: string): string {
-  let result = "";
-  let i = 0;
-  const len = sqlText.length;
-  while (i < len) {
-    const ch = sqlText[i];
-    if (ch === "-" && sqlText[i + 1] === "-") {
-      i = skipLineComment(sqlText, i);
-      result += " ";
-      continue;
-    }
-    if (ch === "/" && sqlText[i + 1] === "*") {
-      i = skipBlockComment(sqlText, i);
-      result += " ";
-      continue;
-    }
-    if (ch === "'") {
-      i = skipQuotedLiteral(sqlText, i);
-      result += " ";
-      continue;
-    }
-    result += ch;
-    i++;
-  }
-  return result;
-}
-
-function normalizeIdent(raw: string): string {
-  if (raw.length >= 2 && raw.startsWith('"') && raw.endsWith('"')) {
-    return raw.slice(1, -1).replace(/""/g, '"').toLowerCase();
-  }
-  return raw.toLowerCase();
-}
-
-function normalizeQualifiedRef(raw: string): string {
-  const parsed = QUALIFIED_PARSE_RE.exec(raw);
-  if (!parsed) return normalizeIdent(raw);
-  const first = normalizeIdent(parsed[1] ?? "");
-  const second = parsed[2];
-  return second === undefined ? first : `${first}.${normalizeIdent(second)}`;
-}
-
-// Rule 1: `X = Y` where X and Y are textually the same (optionally
-// once-qualified) identifier is always a tautology, subquery or not.
-function findSelfComparison(cleaned: string): string | null {
-  SELF_COMPARISON_RE.lastIndex = 0;
-  let match: RegExpExecArray | null = SELF_COMPARISON_RE.exec(cleaned);
-  while (match !== null) {
-    const left = match[1] ?? "";
-    const right = match[2] ?? "";
-    if (normalizeQualifiedRef(left) === normalizeQualifiedRef(right)) {
-      return left.trim();
-    }
-    match = SELF_COMPARISON_RE.exec(cleaned);
-  }
-  return null;
-}
-
-// Rule 2: inside a subquery, a bare identifier that happens to name a
-// column on the OUTER table is the fail-open shape — Postgres resolves it
-// against the innermost table first. A qualifier (`t.x`) or a table/alias
-// name immediately followed by `.` is not a column reference and is
-// ignored.
-function findUnqualifiedColumnReference(
-  cleaned: string,
-  columnSqlNames: ReadonlySet<string>,
-): string | null {
-  TOKEN_RE.lastIndex = 0;
-  let match: RegExpExecArray | null = TOKEN_RE.exec(cleaned);
-  while (match !== null) {
-    const start = match.index;
-    const end = start + match[0].length;
-    const precededByDot = start > 0 && cleaned[start - 1] === ".";
-    const followedByDot = cleaned[end] === ".";
-    if (!precededByDot && !followedByDot) {
-      const normalized = normalizeIdent(match[0]);
-      if (columnSqlNames.has(normalized)) return normalized;
-    }
-    match = TOKEN_RE.exec(cleaned);
-  }
-  return null;
-}
-
-// Throws (fail-closed) instead of shipping a where-rule that would silently
-// fail-open at request time. Called both as a runtime backstop
-// (ownership.ts#ruleToFragment) and as a boot-time probe
-// (boot-validator/ownership.ts).
-export function assertQualifiedWhereFragment(
-  sqlText: string,
-  columnSqlNames: ReadonlySet<string>,
-  scope: string,
-): void {
-  const cleaned = stripCommentsAndStrings(sqlText);
-
-  const selfComparison = findSelfComparison(cleaned);
-  if (selfComparison !== null) {
-    throw new Error(
-      `[Kumiko Ownership] ${scope}: where-rule SQL compares "${selfComparison}" with itself — this is a tautology that matches every row. Remove the redundant comparison or compare against a real bound value / a different, properly qualified column.`,
-    );
-  }
-
-  // skip: without a subquery there is no inner table to shadow — a bare
-  // column reference cannot bind against anything but the outer table, so
-  // the fail-open shape this lint targets is impossible here.
-  if (!/\bSELECT\b/i.test(cleaned)) return;
-
-  const unqualified = findUnqualifiedColumnReference(cleaned, columnSqlNames);
-  if (unqualified !== null) {
-    throw new Error(
-      `[Kumiko Ownership] ${scope}: where-rule SQL references column "${unqualified}" unqualified inside a subquery. Postgres binds an unqualified name to the innermost table first, which silently turns the ownership predicate into a tautology (fail-open). Qualify it with the outer table, e.g. \`\${ctx.tableName}.${unqualified}\`.`,
-    );
-  }
-}

package/src/engine/write-handler-qn-extract.ts

@@ -1,47 +0,0 @@
-import { toKebab } from "./qualified-name";
-
-/**
- * Regex for a valid write-handler QN shape.
- * 3 segments (feature:write:handler) or 4+ (feature:write:entity:verb).
- */
-export const WRITE_HANDLER_QN_FORMAT_RE =
-  /^[a-zA-Z][a-zA-Z0-9-]*:write:[a-zA-Z][a-zA-Z0-9-]*(:[a-zA-Z][a-zA-Z0-9-]*)*$/;
-
-// Matches `dispatcher.write("qn", ...)` and `<expr>.write("qn", ...)` —
-// same surface the CI guard scans. Dynamic QNs (variables, templates) are
-// intentionally skipped (known limitation, documented in #403).
-const DISPATCHER_WRITE_LITERAL_RE = /\.write\s*\(\s*["']([^"']+)["']/g;
-
-/** Extract string-literal write-handler QNs from TS/TSX source text. */
-export function extractDispatcherWriteQnsFromSource(source: string): readonly string[] {
-  const out = new Set<string>();
-  for (const match of source.matchAll(DISPATCHER_WRITE_LITERAL_RE)) {
-    const qn = match[1];
-    if (qn) out.add(qn);
-  }
-  return [...out];
-}
-
-export type WriteHandlerQnValidation =
-  | { readonly ok: true }
-  | { readonly ok: false; readonly reason: string };
-
-/** Validate a single QN against optional known set (kebab-normalized). */
-export function validateDispatcherWriteQn(
-  qn: string,
-  knownQns: ReadonlySet<string>,
-): WriteHandlerQnValidation {
-  if (!WRITE_HANDLER_QN_FORMAT_RE.test(qn)) {
-    return {
-      ok: false,
-      reason: `invalid QN format: "${qn}" — expected "<feature>:write:<handler>"`,
-    };
-  }
-  if (knownQns.size > 0 && !knownQns.has(toKebab(qn))) {
-    return {
-      ok: false,
-      reason: `unknown write handler: "${qn}" — not registered via r.writeHandler(...)`,
-    };
-  }
-  return { ok: true };
-}

package/src/entrypoint/__tests__/entrypoint-attach-dispatcher.integration.test.ts

@@ -1,140 +0,0 @@
-// Regression test for framework#2044 — attachDispatcher() wiring.
-//
-// #2043 added JobContext.write/queryAs plus JobRunner.attachDispatcher(), but
-// left the entrypoint factories unwired: nothing ever called
-// attachDispatcher() on the JobRunners they build, so ctx.write inside a job
-// always hit the throwing stub in production too. This test proves the
-// wiring closes that gap (a job's ctx.write actually commits when run
-// through a real entrypoint) and that the gap is real (the same job, run
-// against a bare createJobRunner() with no attachDispatcher() call, still
-// throws the #2043 stub).
-
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import * as z from "zod";
-import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
-import { asRawClient } from "../../db/query";
-import { createRegistry, defineFeature } from "../../engine";
-import { createArchivedStreamsTable } from "../../event-store";
-import { createJobRunner } from "../../jobs/job-runner";
-import { createEventConsumerStateTable } from "../../pipeline";
-import { createTestRedis, type TestRedis } from "../../stack";
-import { waitFor } from "../../testing";
-import { createWorkerEntrypoint } from "../index";
-
-const writeProbeResults: Array<{ isSuccess: boolean }> = [];
-const writeProbeFailures: string[] = [];
-
-const writeProbeFeature = defineFeature("writeProbe", (r) => {
-  const noted = r.defineEvent("noted", z.object({ note: z.string() }), {
-    piiFields: "none",
-    version: 1,
-  });
-  r.writeHandler(
-    "note",
-    z.object({ note: z.string() }),
-    async (event, ctx) => {
-      await ctx.unsafeAppendEvent({
-        aggregateId: crypto.randomUUID(),
-        aggregateType: "write-probe-note",
-        type: noted.name,
-        payload: { note: event.payload.note },
-      });
-      return { isSuccess: true as const, data: { note: event.payload.note } };
-    },
-    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
-  );
-  r.job("write-via-job", { trigger: { manual: true }, retries: 0 }, async (payload, ctx) => {
-    try {
-      const result = await ctx.write("write-probe:write:note", {
-        note: payload["note"] as string,
-      });
-      writeProbeResults.push({ isSuccess: result.isSuccess });
-    } catch (error) {
-      writeProbeFailures.push(error instanceof Error ? error.message : String(error));
-      throw error;
-    }
-  });
-});
-
-const JWT = "attach-dispatcher-test-secret-must-be-32-chars!";
-
-let testDb: BunTestDb;
-let testRedis: TestRedis;
-
-beforeAll(async () => {
-  [testDb, testRedis] = await Promise.all([createTestDb(), createTestRedis()]);
-  await createArchivedStreamsTable(testDb.db);
-  await createEventConsumerStateTable(testDb.db);
-});
-
-afterAll(async () => {
-  await Promise.all([testDb.cleanup(), testRedis.cleanup()]);
-});
-
-function uniquePrefix(label: string): string {
-  return `${label}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-}
-
-describe("createWorkerEntrypoint auto-wires attachDispatcher() (framework#2044)", () => {
-  test("ctx.write inside a job commits end-to-end through a real entrypoint", async () => {
-    writeProbeResults.length = 0;
-    const registry = createRegistry([writeProbeFeature]);
-    const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
-    const worker = createWorkerEntrypoint({
-      registry,
-      context: { db: testDb.db, redis: testRedis.redis },
-      jwtSecret: JWT,
-      redisUrl,
-      queueNamePrefix: uniquePrefix("attach-dispatcher"),
-    });
-
-    await worker.start();
-    try {
-      await worker.jobRunner.dispatch("write-probe:job:write-via-job", {
-        note: "written from the job",
-      });
-
-      await waitFor(() => {
-        expect(writeProbeResults.length).toBe(1);
-        expect(writeProbeResults[0]?.isSuccess).toBe(true);
-      });
-
-      const rows = await asRawClient(testDb.db).unsafe(
-        `SELECT payload FROM kumiko_events WHERE type = 'write-probe:event:noted'`,
-      );
-      expect(rows).toHaveLength(1);
-      expect((rows[0] as { payload: { note: string } }).payload.note).toBe("written from the job");
-    } finally {
-      await worker.stop();
-    }
-  });
-});
-
-describe("createJobRunner without attachDispatcher() still hits the #2043 stub", () => {
-  test("ctx.write throws — proves the entrypoint's attachDispatcher() call is the thing that makes writes work", async () => {
-    writeProbeFailures.length = 0;
-    const registry = createRegistry([writeProbeFeature]);
-    const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
-    const runner = createJobRunner({
-      registry,
-      context: { db: testDb.db, redis: testRedis.redis },
-      redisUrl,
-      consumerLane: "worker",
-      queueNamePrefix: uniquePrefix("attach-dispatcher-bare"),
-    });
-
-    await runner.start();
-    try {
-      await runner.dispatch("write-probe:job:write-via-job", { note: "should never land" });
-
-      await waitFor(() => {
-        expect(writeProbeFailures.length).toBe(1);
-      });
-      expect(writeProbeFailures[0]).toContain(
-        "JobContext.write called before dispatcher attached — call attachDispatcher() first",
-      );
-    } finally {
-      await runner.stop();
-    }
-  });
-});

package/src/entrypoint/__tests__/entrypoint-job-wiring.integration.test.ts

@@ -1,292 +0,0 @@
-// Regression test for Welle 2.6.b — the `mergeDispatcherOptions` plumbing.
-//
-// The command-dispatcher (packages/framework/src/pipeline/dispatcher.ts:997)
-// fires `jobRunner.handleEvent` as an afterCommit-hook. Without a jobRunner
-// reference IN the dispatcher's options, event-triggered jobs silently drop
-// on every write. Welle 2.5 built the jobRunner in the entrypoint factory
-// but never wired it in — welle 2.6.b closes that via mergeDispatcherOptions.
-//
-// `job-event-trigger.integration.ts` only covers the path when the CALLER
-// hand-wires `dispatcherOptions: { jobRunner }`. This test pins the
-// auto-wiring path that a real app boot uses (`createAllInOneEntrypoint`) —
-// so a future refactor that drops the merge fails here instead of silently
-// regressing to the Welle-2.5 state.
-
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import * as z from "zod";
-import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
-import { createRegistry, defineFeature } from "../../engine";
-import { createArchivedStreamsTable } from "../../event-store";
-import { createNoopProvider, createPrometheusMeter } from "../../observability";
-import { createEventConsumerStateTable } from "../../pipeline";
-import { createTestRedis, type TestRedis, TestUsers } from "../../stack";
-import { sleep, waitFor } from "../../testing";
-import { createAllInOneEntrypoint } from "../index";
-
-const jobRuns: Array<{ name: string; payload: Record<string, unknown> }> = [];
-
-const wiringFeature = defineFeature("wiring", (r) => {
-  r.writeHandler(
-    "order:create",
-    z.object({ sku: z.string() }),
-    async (event) => ({
-      isSuccess: true as const,
-      data: { id: 1, sku: event.payload.sku },
-    }),
-    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
-  );
-  r.job(
-    "record-order",
-    { trigger: { on: "wiring:write:order:create" }, runIn: "worker" },
-    async (payload) => {
-      jobRuns.push({ name: "wiring:job:record-order", payload });
-    },
-  );
-});
-
-// Mixed-lane feature: one worker-lane + one api-lane job triggered on the
-// same event. The all-in-one process spins up both BullMQ workers (one per
-// queue) and both must execute. Proves the two-runner construction in
-// createAllInOneEntrypoint actually consumes both lanes — not just that
-// enqueue routing works.
-const mixedLaneFeature = defineFeature("mixed", (r) => {
-  r.writeHandler(
-    "ping",
-    z.object({ msg: z.string() }),
-    async (event) => ({
-      isSuccess: true as const,
-      data: { id: 1, msg: event.payload.msg },
-    }),
-    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
-  );
-  r.job(
-    "handle-on-worker",
-    { trigger: { on: "mixed:write:ping" }, runIn: "worker" },
-    async (payload) => {
-      jobRuns.push({ name: "mixed:job:handle-on-worker", payload });
-    },
-  );
-  r.job("handle-on-api", { trigger: { on: "mixed:write:ping" }, runIn: "api" }, async (payload) => {
-    jobRuns.push({ name: "mixed:job:handle-on-api", payload });
-  });
-});
-
-const JWT = "entrypoint-wiring-test-secret-must-be-32-chars!";
-const adminUser = TestUsers.admin;
-
-let testDb: BunTestDb;
-let testRedis: TestRedis;
-
-beforeAll(async () => {
-  [testDb, testRedis] = await Promise.all([createTestDb(), createTestRedis()]);
-  await createArchivedStreamsTable(testDb.db);
-  await createEventConsumerStateTable(testDb.db);
-});
-
-afterAll(async () => {
-  await Promise.all([testDb.cleanup(), testRedis.cleanup()]);
-});
-
-describe("createAllInOneEntrypoint auto-wires jobRunner into command-dispatcher", () => {
-  test("event-triggered job runs end-to-end (HTTP write → afterCommit → BullMQ → handler)", async () => {
-    jobRuns.length = 0;
-    const registry = createRegistry([wiringFeature]);
-    const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
-    const entry = createAllInOneEntrypoint({
-      registry,
-      context: { db: testDb.db, redis: testRedis.redis },
-      jwtSecret: JWT,
-      redisUrl,
-      queueNamePrefix: `wiring-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
-    });
-    await entry.start();
-    try {
-      const token = await entry.jwt.sign(adminUser);
-      const res = await entry.app.request("/api/write", {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${token}`,
-        },
-        body: JSON.stringify({
-          type: "wiring:write:order:create",
-          payload: { sku: "W-1" },
-        }),
-      });
-      const result = (await res.json()) as { isSuccess: boolean };
-      expect(result.isSuccess).toBe(true);
-
-      // If mergeDispatcherOptions ever stops wiring the jobRunner, the
-      // afterCommit-hook at dispatcher.ts:997 becomes a no-op, the job
-      // is never enqueued, and waitFor times out. That's the regression
-      // this test is here to catch.
-      await waitFor(() => {
-        const run = jobRuns.find((e) => e.name === "wiring:job:record-order");
-        expect(run).toBeDefined();
-        expect(run?.payload["sku"]).toBe("W-1");
-      });
-    } finally {
-      await entry.stop();
-    }
-  });
-
-  test("all-in-one runs BOTH lane workers — api-lane + worker-lane jobs fire on the same event", async () => {
-    jobRuns.length = 0;
-    const registry = createRegistry([mixedLaneFeature]);
-    const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
-    const entry = createAllInOneEntrypoint({
-      registry,
-      context: { db: testDb.db, redis: testRedis.redis },
-      jwtSecret: JWT,
-      redisUrl,
-      queueNamePrefix: `wiring-mixed-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
-    });
-    await entry.start();
-    try {
-      const token = await entry.jwt.sign(adminUser);
-      const res = await entry.app.request("/api/write", {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${token}`,
-        },
-        body: JSON.stringify({ type: "mixed:write:ping", payload: { msg: "hi" } }),
-      });
-      const result = (await res.json()) as { isSuccess: boolean };
-      expect(result.isSuccess).toBe(true);
-
-      // Both jobs must fire: worker-lane runner picks kumiko-jobs-<prefix>-worker,
-      // api-lane runner picks kumiko-jobs-<prefix>-api. If either BullMQ
-      // worker failed to start (bug in the two-runner build in createAllInOne
-      // Entrypoint), waitFor times out on the missing entry.
-      await waitFor(() => {
-        const workerRun = jobRuns.find((e) => e.name === "mixed:job:handle-on-worker");
-        const apiRun = jobRuns.find((e) => e.name === "mixed:job:handle-on-api");
-        expect(workerRun).toBeDefined();
-        expect(apiRun).toBeDefined();
-        expect(workerRun?.payload["msg"]).toBe("hi");
-        expect(apiRun?.payload["msg"]).toBe("hi");
-      });
-    } finally {
-      await entry.stop();
-    }
-  });
-});
-
-// Regression test for #1046 — createJobRunner is built from the caller's
-// RAW context, BEFORE buildServer ever merges observability.tracer/meter
-// into a context object of its own. Without threading the resolved
-// provider into the job-runner's context too, `context.meter` stayed
-// undefined, the queue-depth poller's `if (context.meter)` guard skipped
-// silently, and `/metrics` showed the kumiko_job_queue_depth HELP/TYPE
-// header but never a single data line — forever, with no error anywhere.
-describe("createAllInOneEntrypoint — kumiko_job_queue_depth sees the SAME meter as buildServer (#1046)", () => {
-  test("passing an explicit observability provider makes the queue-depth poller emit real data for BOTH lanes", async () => {
-    const registry = createRegistry([wiringFeature]);
-    const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
-    const meter = createPrometheusMeter();
-    const observability = { ...createNoopProvider(), meter };
-    const entry = createAllInOneEntrypoint({
-      registry,
-      context: { db: testDb.db, redis: testRedis.redis },
-      jwtSecret: JWT,
-      redisUrl,
-      queueNamePrefix: `wiring-qd-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
-      observability,
-    });
-    await entry.start();
-    try {
-      // If the job-runner never saw this meter (the #1046 bug), the poller's
-      // `if (context.meter)` guard skips entirely and no slots ever appear —
-      // this assertion is the one that would have caught it.
-      const snapshot = meter.snapshot().get("kumiko_job_queue_depth");
-      expect(snapshot).toBeDefined();
-      const workerWaiting = snapshot?.slots.find(
-        (s) => s.labels?.["lane"] === "worker" && s.labels?.["state"] === "waiting",
-      );
-      const apiWaiting = snapshot?.slots.find(
-        (s) => s.labels?.["lane"] === "api" && s.labels?.["state"] === "waiting",
-      );
-      expect(workerWaiting).toBeDefined();
-      expect(apiWaiting).toBeDefined();
-      // Same instance, not a coincidentally-equal one — proves buildServer's
-      // internal registerStandardMetrics() and the job-runner's poller wrote
-      // into the identical meter, not two disconnected Noop instances.
-      expect(entry.observability.meter).toBe(meter);
-      // BullMQ's fresh Worker connections are still settling right after
-      // start() returns — stopping immediately races their own connection
-      // teardown and throws an unrelated "Connection is closed" from
-      // ioredis (same artifact documented in job-queue-depth.integration.
-      // test.ts). Production runners live far longer than this.
-      await sleep(50);
-    } finally {
-      await entry.stop();
-    }
-  });
-});
-
-// Regression test for #1253 — effectiveFeatures was wired into
-// dispatcherOptions (command-dispatcher's feature-gate) but never merged
-// into the job-runner's context. A job handler reading
-// `context.effectiveFeatures?.(tenantId)` always saw undefined in prod.
-const featuresSeenByJob: Array<ReadonlySet<string> | undefined> = [];
-
-const featureGateJobFeature = defineFeature("featuregate", (r) => {
-  r.writeHandler(
-    "ping",
-    z.object({ msg: z.string() }),
-    async (event) => ({
-      isSuccess: true as const,
-      data: { id: 1, msg: event.payload.msg },
-    }),
-    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
-  );
-  r.job(
-    "record-features",
-    { trigger: { on: "featuregate:write:ping" }, runIn: "worker" },
-    async (_payload, context) => {
-      featuresSeenByJob.push(context.effectiveFeatures?.(adminUser.tenantId));
-    },
-  );
-});
-
-describe("createAllInOneEntrypoint — job context sees dispatcherOptions.effectiveFeatures (#1253)", () => {
-  test("job handler reads the same effectiveFeatures resolver as the command-dispatcher's feature-gate", async () => {
-    featuresSeenByJob.length = 0;
-    const registry = createRegistry([featureGateJobFeature]);
-    const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
-    const entry = createAllInOneEntrypoint({
-      registry,
-      context: { db: testDb.db, redis: testRedis.redis },
-      jwtSecret: JWT,
-      redisUrl,
-      queueNamePrefix: `wiring-features-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
-      dispatcherOptions: {
-        effectiveFeatures: () => new Set(["featuregate", "some-feature"]),
-      },
-    });
-    await entry.start();
-    try {
-      const token = await entry.jwt.sign(adminUser);
-      const res = await entry.app.request("/api/write", {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${token}`,
-        },
-        body: JSON.stringify({ type: "featuregate:write:ping", payload: { msg: "hi" } }),
-      });
-      const result = (await res.json()) as { isSuccess: boolean };
-      expect(result.isSuccess).toBe(true);
-
-      // Without the fix, context.effectiveFeatures is undefined and this
-      // stays empty forever — waitFor times out on the missing entry.
-      await waitFor(() => {
-        expect(featuresSeenByJob.length).toBeGreaterThan(0);
-        expect(featuresSeenByJob[0]?.has("some-feature")).toBe(true);
-      });
-    } finally {
-      await entry.stop();
-    }
-  });
-});