@indigoai-us/hq-cli 5.75.0 → 5.77.0

package/test/helpers/vault-service-mock.ts

@@ -1,17 +1,32 @@
 /**
- * vault-service-mock.ts — fetch stub for vault-service HTTP endpoints.
+ * vault-service-mock.ts — vault-service test double.
  *
- * Intercepts globalThis.fetch and handles the subset of vault-service routes
- * needed by entity-resolver and STS tests. Returns the original fetch restore
- * function so callers can clean up in afterEach/finally.
+ * Two collaborating pieces:
+ *   1. A `globalThis.fetch` stub for the vault-service JSON API (membership,
+ *      entity lookup, STS vend, files list/presign).
+ *   2. A real ephemeral localhost HTTP server that serves the presigned-object
+ *      GETs. As of hq-cloud >=6.14.x, `PresignObjectIO` fetches presigned URLs
+ *      through Node's core HTTP client (`nodePresignedGet`), NOT
+ *      `globalThis.fetch`, to bypass the runtime-bundled undici parser — so a
+ *      fetch stub alone never intercepts them and the request escapes to real
+ *      DNS (`ENOTFOUND`). A real (loopback) server is transport-agnostic: it
+ *      works for both the fetch and node-http code paths, and future ones.
  *
- * Handled endpoints (URL path suffixes):
+ * `mockVaultService` is async (it awaits the server's `listen`) and returns a
+ * restore function for `afterEach` that both un-installs the fetch stub and
+ * closes the server.
+ *
+ * Handled JSON endpoints (URL path suffixes):
  *   GET  .../membership/me                  returns { memberships: [...] }
  *   GET  .../entity/by-slug/{type}/{slug}   returns { entity: {...} }
  *   GET  .../entity/{uid}                   returns { entity: {...} }   (direct UID lookup)
- *   POST .../sts/vend                       returns { credentials, expiresAt }    (canonical company STS endpoint)
+ *   GET  .../v1/files/list                  returns { objects, cursor, truncated }
+ *   POST .../v1/files/presign               returns { results, expiresAt } (URLs point at the local server)
+ *   POST .../sts/vend                       returns { credentials, expiresAt }
  */
 
+import http from "node:http";
+import type { AddressInfo } from "node:net";
 import type { Membership, EntityInfo } from "@indigoai-us/hq-cloud";
 
 export interface MockEntity {
@@ -56,8 +71,6 @@ export interface MockVaultOptions {
   files?: MockVaultFile[];
 }
 
-/** Host for mock presigned URLs minted by POST /v1/files/presign. */
-const PRESIGN_URL_HOST = "https://presigned.test";
 const DEFAULT_FILE_DATE = new Date("2026-01-01T00:00:00Z");
 
 const DEFAULT_STS: MockStsCredentials = {
@@ -67,14 +80,56 @@ const DEFAULT_STS: MockStsCredentials = {
 };
 
 /**
- * Installs a fetch stub for vault-service endpoints.
+ * Start a loopback HTTP server that serves presigned-object GETs from the
+ * in-memory `files`. Each minted presign URL is `${origin}/obj?key=<key>`;
+ * the handler resolves the file (200 + body) or 404s (→ NoSuchKey in the
+ * reader). Returns the server + its `http://127.0.0.1:<port>` origin.
+ */
+async function startPresignedFileServer(
+  files: MockVaultFile[],
+): Promise<{ server: http.Server; origin: string }> {
+  const server = http.createServer((req, res) => {
+    const requestUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+    const key = requestUrl.searchParams.get("key") ?? "";
+    const file = files.find((f) => f.key === key);
+    if (!file) {
+      res.statusCode = 404;
+      res.setHeader("content-length", "0");
+      res.end();
+      return;
+    }
+    const body = Buffer.from(file.content, "utf-8");
+    res.writeHead(200, {
+      "content-type": "text/markdown",
+      "content-length": String(body.byteLength),
+      "last-modified": (file.lastModified ?? DEFAULT_FILE_DATE).toUTCString(),
+      etag: '"mock-etag"',
+    });
+    res.end(body);
+  });
+  await new Promise<void>((resolve) => {
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  // Don't keep the event loop (or vitest) alive on this listener.
+  server.unref();
+  const { port } = server.address() as AddressInfo;
+  return { server, origin: `http://127.0.0.1:${port}` };
+}
+
+/**
+ * Installs the vault-service test double (fetch stub + presigned-file server).
  *
- * @returns A restore function — call it in afterEach to un-install the stub.
+ * @returns A restore function — call it in afterEach to un-install the stub and
+ *   close the server.
  */
-export function mockVaultService(opts: MockVaultOptions): () => void {
+export async function mockVaultService(
+  opts: MockVaultOptions,
+): Promise<() => void> {
   const { entities, stsCredentials = DEFAULT_STS, files = [] } = opts;
   const originalFetch = globalThis.fetch as typeof fetch | undefined;
 
+  const { server, origin: presignOrigin } = await startPresignedFileServer(files);
+
   globalThis.fetch = async (
     input: RequestInfo | URL,
     init?: RequestInit,
@@ -89,9 +144,10 @@ export function mockVaultService(opts: MockVaultOptions): () => void {
       (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
 
     // ── Presigned-URL transport (HQ-59 company reads) ──────────────────────
-    // A GET against a URL minted by POST /v1/files/presign below. Serve the
-    // file body (or 404) so PresignObjectIO.getObject resolves like real S3.
-    if (url.startsWith(`${PRESIGN_URL_HOST}/`)) {
+    // Production fetches presigned URLs over node http (served by the loopback
+    // server above), but keep a fetch branch too so any fetch-based transport
+    // resolves identically without escaping to the network.
+    if (url.startsWith(`${presignOrigin}/`)) {
       const key = new URL(url).searchParams.get("key") ?? "";
       const file = files.find((f) => f.key === key);
       if (!file) return new Response("", { status: 404 });
@@ -122,8 +178,9 @@ export function mockVaultService(opts: MockVaultOptions): () => void {
     }
 
     // POST /v1/files/presign  (VaultClient.presign) — mint a per-key URL that
-    // the GET handler above resolves. Unknown keys still get a URL → that GET
-    // 404s, which the reader normalizes to NoSuchKey (the not-found path).
+    // the loopback server (and the GET branch above) resolves. Unknown keys
+    // still get a URL → that GET 404s, which the reader normalizes to
+    // NoSuchKey (the not-found path).
     if (method === "POST" && /\/v1\/files\/presign$/.test(url)) {
       const body = init?.body ? JSON.parse(init.body.toString()) : {};
       const keys = (body.keys ?? []) as Array<{ key: string; op?: string }>;
@@ -134,7 +191,7 @@ export function mockVaultService(opts: MockVaultOptions): () => void {
       const results = keys.map((k) => ({
         key: k.key,
         op: k.op ?? "get",
-        url: `${PRESIGN_URL_HOST}/obj?key=${encodeURIComponent(k.key)}`,
+        url: `${presignOrigin}/obj?key=${encodeURIComponent(k.key)}`,
       }));
       return json({
         results,
@@ -225,6 +282,8 @@ export function mockVaultService(opts: MockVaultOptions): () => void {
     } else {
       delete (globalThis as Record<string, unknown>).fetch;
     }
+    server.closeAllConnections?.();
+    server.close();
   };
 }
 

package/test/sources-signals/smoke.test.ts

@@ -176,7 +176,7 @@ describe("mockVaultService — membership endpoint", () => {
   });
 
   it("GET /membership/me returns memberships for all configured entities", async () => {
-    restore = mockVaultService({
+    restore = await mockVaultService({
       entities: [
         { uid: "cmp_indigo_001", slug: "indigo", bucketName: "hq-indigo-bucket" },
         { uid: "prs_personal_001", slug: "personal", bucketName: "hq-personal-bucket" },
@@ -194,7 +194,7 @@ describe("mockVaultService — membership endpoint", () => {
   });
 
   it("POST /sts/vend returns credentials", async () => {
-    restore = mockVaultService({
+    restore = await mockVaultService({
       entities: [{ uid: "cmp_indigo_001", slug: "indigo", bucketName: "hq-indigo-bucket" }],
     });