@indigoai-us/hq-cloud 6.11.5 → 6.11.6

package/dist/sources/get.js

@@ -2,9 +2,8 @@
  * getSource — fetch a single source document (and optionally its `.raw.json`
  * sibling) from an entity bucket and return parsed frontmatter + body.
  */
-import { GetObjectCommand } from "@aws-sdk/client-s3";
 import { assertSourceChannel, sourcePathSegment } from "../schemas/source-channels.js";
-import { getS3Client, streamToString } from "./internals.js";
+import { readObjectText, tryReadObjectText } from "./internals.js";
 import { parseMarkdown } from "./parse.js";
 export class SourceNotFoundError extends Error {
     key;
@@ -18,24 +17,21 @@ function isNoSuchKey(err) {
     if (!err || typeof err !== "object")
         return false;
     const name = err.name;
-    // AWS SDK v3 throws either a `NoSuchKey` exception or a `NotFound` head error.
-    return name === "NoSuchKey" || name === "NoSuchKeyException";
+    // The transport normalizes a missing object to a `NoSuchKey`-named error on
+    // both the S3 and presigned paths (a presign 404 → NoSuchKey). `NotFound` is
+    // kept for defense in depth (S3 HEAD-style errors).
+    return (name === "NoSuchKey" || name === "NoSuchKeyException" || name === "NotFound");
 }
 export async function getSource(opts) {
-    // Validate channel BEFORE any S3 call (acceptance criterion).
+    // Validate channel BEFORE any read (acceptance criterion).
     assertSourceChannel(opts.channel);
-    const client = getS3Client(opts.entity);
     // sources-pipeline writes "meeting" channel to sources/meetings/...; other
     // channels pass through. See schemas/source-channels.ts:sourcePathSegment.
     const segment = sourcePathSegment(opts.channel);
     const key = `sources/${segment}/${opts.sourceId}.md`;
     let body;
     try {
-        const response = await client.send(new GetObjectCommand({
-            Bucket: opts.entity.bucketName,
-            Key: key,
-        }));
-        body = await streamToString(response.Body);
+        body = await readObjectText(opts, key);
     }
     catch (err) {
         if (isNoSuchKey(err)) {
@@ -50,20 +46,12 @@ export async function getSource(opts) {
         body: parsed.body,
     };
     if (opts.includeRaw) {
+        // Raw sibling is optional; tryReadObjectText returns null when absent.
         const rawKey = `sources/${segment}/${opts.sourceId}.raw.json`;
-        try {
-            const rawResponse = await client.send(new GetObjectCommand({
-                Bucket: opts.entity.bucketName,
-                Key: rawKey,
-            }));
-            const rawText = await streamToString(rawResponse.Body);
+        const rawText = await tryReadObjectText(opts, rawKey);
+        if (rawText !== null) {
             document.raw = JSON.parse(rawText);
         }
-        catch (err) {
-            if (!isNoSuchKey(err))
-                throw err;
-            // Raw sibling is optional; leave undefined when absent.
-        }
     }
     return document;
 }

package/dist/sources/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../../src/sources/get.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAChB;IAA5B,YAA4B,GAAW;QACrC,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;QADR,QAAG,GAAH,GAAG,CAAQ;QAErC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;IAC9C,+EAA+E;IAC/E,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,oBAAoB,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,8DAA8D;IAC9D,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,WAAW,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;IAErD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAC9B,GAAG,EAAE,GAAG;SACT,CAAC,CACH,CAAC;QACF,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEnC,MAAM,QAAQ,GAAmB;QAC/B,GAAG;QACH,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;IAEF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,WAAW,OAAO,IAAI,IAAI,CAAC,QAAQ,WAAW,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CACnC,IAAI,gBAAgB,CAAC;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAC9B,GAAG,EAAE,MAAM;aACZ,CAAC,CACH,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACvD,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACjC,wDAAwD;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../src/sources/get.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAChB;IAA5B,YAA4B,GAAW;QACrC,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;QADR,QAAG,GAAH,GAAG,CAAQ;QAErC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;IAC9C,4EAA4E;IAC5E,6EAA6E;IAC7E,oDAAoD;IACpD,OAAO,CACL,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,2DAA2D;IAC3D,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAElC,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,WAAW,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;IAErD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEnC,MAAM,QAAQ,GAAmB;QAC/B,GAAG;QACH,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;IAEF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,uEAAuE;QACvE,MAAM,MAAM,GAAG,WAAW,OAAO,IAAI,IAAI,CAAC,QAAQ,WAAW,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/sources/get.test.js

@@ -1,7 +1,7 @@
 /**
  * Unit tests for sources/get.ts.
  */
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { GetObjectCommand } from "@aws-sdk/client-s3";
 import { getSource, SourceNotFoundError } from "./get.js";
 import { _setSourcesS3Factory, _resetSourcesS3Factory, } from "./internals.js";
@@ -129,4 +129,88 @@ describe("getSource", () => {
         expect(doc.body).toBe("Just a body, no frontmatter.");
     });
 });
+// ---------------------------------------------------------------------------
+// Presigned transport (vault client + company vault) — HQ-59
+// ---------------------------------------------------------------------------
+/**
+ * A presign-capable vault stub + a `fetch` mock keyed by the presigned URL.
+ * presign() mints a URL that encodes the key; fetch() returns the object's
+ * bytes (404 when absent, so a missing key surfaces as SourceNotFoundError —
+ * matching the S3 NoSuchKey path).
+ */
+function makePresignVault(objects) {
+    vi.stubGlobal("fetch", vi.fn(async (url) => {
+        const key = new URL(url).searchParams.get("key") ?? "";
+        const content = objects[key];
+        if (content === undefined)
+            return new Response(null, { status: 404 });
+        return new Response(Buffer.from(content, "utf-8"), { status: 200 });
+    }));
+    return {
+        presign: async (input) => ({
+            results: input.keys.map((k) => ({
+                key: k.key,
+                op: k.op ?? input.op ?? "get",
+                url: `https://signed.example/?key=${encodeURIComponent(k.key)}`,
+            })),
+            expiresAt: "2099-01-01T00:00:00.000Z",
+        }),
+        listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
+    };
+}
+describe("getSource — presigned transport (vault + cmp_)", () => {
+    afterEach(() => vi.unstubAllGlobals());
+    it("reads via presign and never touches S3", async () => {
+        // S3 factory throws if used — proves the read went through presign.
+        _setSourcesS3Factory(() => ({
+            send: async () => {
+                throw new Error("S3 must not be used on the presign path");
+            },
+        }));
+        const vault = makePresignVault({ "sources/meetings/abc.md": MEETING_MD });
+        const doc = await getSource({
+            entity: ENTITY,
+            channel: "meeting",
+            sourceId: "abc",
+            vault,
+        });
+        expect(doc.frontmatter).toEqual({
+            source_id: "abc",
+            source_type: "meeting",
+            title: "Q1 Planning",
+        });
+        expect(doc.body).toContain("Body text line 1.");
+    });
+    it("maps a presign 404 to SourceNotFoundError", async () => {
+        const vault = makePresignVault({});
+        await expect(getSource({ entity: ENTITY, channel: "meeting", sourceId: "missing", vault })).rejects.toBeInstanceOf(SourceNotFoundError);
+    });
+    it("includeRaw via presign reads the .raw.json sibling", async () => {
+        const vault = makePresignVault({
+            "sources/meetings/abc.md": MEETING_MD,
+            "sources/meetings/abc.raw.json": JSON.stringify(RAW_PAYLOAD),
+        });
+        const doc = await getSource({
+            entity: ENTITY,
+            channel: "meeting",
+            sourceId: "abc",
+            includeRaw: true,
+            vault,
+        });
+        expect(doc.raw).toEqual(RAW_PAYLOAD);
+    });
+    it("personal vault (prs_) ignores the vault client and stays on direct S3", async () => {
+        // S3 stub serves the doc; the presign fetch would 404 if (wrongly) used.
+        installStub({ "sources/meetings/abc.md": MEETING_MD });
+        const vault = makePresignVault({});
+        const personal = { ...ENTITY, uid: "prs_me" };
+        const doc = await getSource({
+            entity: personal,
+            channel: "meeting",
+            sourceId: "abc",
+            vault,
+        });
+        expect(doc.body).toContain("Body text line 1.");
+    });
+});
 //# sourceMappingURL=get.test.js.map

package/dist/sources/get.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.test.js","sourceRoot":"","sources":["../../src/sources/get.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAiB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,MAAM,GAAkB;IAC5B,GAAG,EAAE,cAAc;IACnB,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,eAAe;IAC3B,MAAM,EAAE,WAAW;IACnB,WAAW,EAAE;QACX,WAAW,EAAE,UAAU;QACvB,eAAe,EAAE,QAAQ;QACzB,YAAY,EAAE,SAAS;KACxB;IACD,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;CACzD,CAAC;AAEF,MAAM,UAAU,GAAG;;;;;;;;CAQlB,CAAC;AAEF,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;AAE1C,SAAS,WAAW,CAAC,OAA+B;IAClD,KAAK,UAAU,IAAI,CAAC,OAAgB;QAClC,IAAI,OAAO,YAAY,gBAAgB,EAAE,CAAC;YACxC,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,KAAwB,CAAC;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;gBAC1C,GAAgC,CAAC,IAAI,GAAG,WAAW,CAAC;gBACrD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,MAAM;gBACpB,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAA0B,CAAA,CAAC,CAAC;AAChE,CAAC;AAED,UAAU,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC;AAC3C,SAAS,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC;AAE1C,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,WAAW,CAAC,EAAE,yBAAyB,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;YAC9B,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,SAAS;YACtB,KAAK,EAAE,aAAa;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,WAAW,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,MAAM,CACV,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CACvE,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAE9C,MAAM,MAAM,CACV,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CACvE,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,WAAW,CAAC;YACV,yBAAyB,EAAE,UAAU;YACrC,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;SAC7D,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,WAAW,CAAC,EAAE,yBAAyB,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1B,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,CAAC;YACZ,CAAC;SACsB,CAAA,CAAC,CAAC;QAE3B,MAAM,MAAM,CACV,SAAS,CAAC;YACR,MAAM,EAAE,MAAM;YACd,iDAAiD;YACjD,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,KAAK;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,WAAW,CAAC,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAE7E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"get.test.js","sourceRoot":"","sources":["../../src/sources/get.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAiB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,MAAM,GAAkB;IAC5B,GAAG,EAAE,cAAc;IACnB,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,eAAe;IAC3B,MAAM,EAAE,WAAW;IACnB,WAAW,EAAE;QACX,WAAW,EAAE,UAAU;QACvB,eAAe,EAAE,QAAQ;QACzB,YAAY,EAAE,SAAS;KACxB;IACD,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;CACzD,CAAC;AAEF,MAAM,UAAU,GAAG;;;;;;;;CAQlB,CAAC;AAEF,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;AAE1C,SAAS,WAAW,CAAC,OAA+B;IAClD,KAAK,UAAU,IAAI,CAAC,OAAgB;QAClC,IAAI,OAAO,YAAY,gBAAgB,EAAE,CAAC;YACxC,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,KAAwB,CAAC;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;gBAC1C,GAAgC,CAAC,IAAI,GAAG,WAAW,CAAC;gBACrD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,MAAM;gBACpB,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAA0B,CAAA,CAAC,CAAC;AAChE,CAAC;AAED,UAAU,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC;AAC3C,SAAS,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC;AAE1C,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,WAAW,CAAC,EAAE,yBAAyB,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;YAC9B,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,SAAS;YACtB,KAAK,EAAE,aAAa;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,WAAW,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,MAAM,CACV,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CACvE,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAE9C,MAAM,MAAM,CACV,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CACvE,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,WAAW,CAAC;YACV,yBAAyB,EAAE,UAAU;YACrC,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;SAC7D,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,WAAW,CAAC,EAAE,yBAAyB,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1B,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,CAAC;YACZ,CAAC;SACsB,CAAA,CAAC,CAAC;QAE3B,MAAM,MAAM,CACV,SAAS,CAAC;YACR,MAAM,EAAE,MAAM;YACd,iDAAiD;YACjD,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,KAAK;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,WAAW,CAAC,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAE7E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,OAA+B;IACvD,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC1B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CACH,CAAC;IACF,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACzB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9B,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK;gBAC7B,GAAG,EAAE,+BAA+B,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;aAChE,CAAC,CAAC;YACH,SAAS,EAAE,0BAA0B;SACtC,CAAC;QACF,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEvC,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,oEAAoE;QACpE,oBAAoB,CAClB,GAAG,EAAE,CACH,CAAC;YACC,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;SACF,CAAwB,CAC5B,CAAC;QACF,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,yBAAyB,EAAE,UAAU,EAAE,CAAC,CAAC;QAE1E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK;YACf,KAAK;SACN,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;YAC9B,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,SAAS;YACtB,KAAK,EAAE,aAAa;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,MAAM,CACV,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAC9E,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC7B,yBAAyB,EAAE,UAAU;YACrC,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;YAChB,KAAK;SACN,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,yEAAyE;QACzE,WAAW,CAAC,EAAE,yBAAyB,EAAE,UAAU,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAkB,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QAE7D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK;YACf,KAAK;SACN,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/sources/internals.d.ts

@@ -1,16 +1,63 @@
 /**
  * Internal helpers shared between sources/list.ts and sources/get.ts.
  *
- * The S3 client factory hook exists so tests can inject an in-memory stub
- * without standing up vi.mock for @aws-sdk/client-s3. Production code never
- * calls the setter.
+ * Two transports back the read surface:
+ *   - presigned-URL (HQ-59): when a vault client is supplied AND the entity is a
+ *     company vault (cmp_*), reads go through the vault `list`/`presign`
+ *     endpoints — the client never talks to S3 directly. This is the path every
+ *     company read should take going forward.
+ *   - direct S3 (legacy / personal): no vault client, or a personal vault
+ *     (prs_*, whose membership-less creds 403 the membership-gated presign
+ *     endpoints). Goes through `getS3Client`, whose factory hook lets tests
+ *     inject an in-memory stub without vi.mock.
  */
 import { S3Client } from "@aws-sdk/client-s3";
 import type { EntityContext } from "../types.js";
+import { type PresignTransportClient } from "../object-io.js";
 export declare function getS3Client(ctx: EntityContext): S3Client;
 /** Test hook: replace the S3 client factory. */
 export declare function _setSourcesS3Factory(f: (ctx: EntityContext) => S3Client): void;
 /** Test hook: restore the default S3 client factory. */
 export declare function _resetSourcesS3Factory(): void;
 export declare function streamToString(body: unknown): Promise<string>;
+/** Common shape of every reader's options: an entity + an optional vault client. */
+export interface ReaderTransportOpts {
+    entity: EntityContext;
+    /**
+     * Presign-capable vault client. When supplied and the entity is a company
+     * vault (cmp_*), reads use the presigned-URL transport instead of direct S3.
+     */
+    vault?: PresignTransportClient;
+}
+/** Lightweight listed object (transport-agnostic). */
+export interface ListedKey {
+    key: string;
+    size: number;
+    lastModified: Date;
+}
+/** True when this read should use the presigned-URL transport. */
+export declare function usePresign(opts: ReaderTransportOpts): boolean;
+/**
+ * Read an object's UTF-8 text. Throws a `NoSuchKey`-named error when the object
+ * is absent (both transports), so callers' existing not-found checks work
+ * unchanged.
+ */
+export declare function readObjectText(opts: ReaderTransportOpts, key: string): Promise<string>;
+/** Like {@link readObjectText} but returns null when the object is absent. */
+export declare function tryReadObjectText(opts: ReaderTransportOpts, key: string): Promise<string | null>;
+/**
+ * List one page of objects under `prefix`.
+ *
+ * Under the presigned transport the vault `list` endpoint is ACL-filtered and
+ * controls page size server-side, so `limit` is advisory — paginate via the
+ * returned `nextToken` (the opaque vault cursor) until it is undefined. Under
+ * direct S3, `limit` maps to `MaxKeys`.
+ */
+export declare function listObjects(opts: ReaderTransportOpts, prefix: string, page: {
+    limit?: number;
+    continuationToken?: string;
+}): Promise<{
+    contents: ListedKey[];
+    nextToken?: string;
+}>;
 //# sourceMappingURL=internals.d.ts.map

package/dist/sources/internals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internals.d.ts","sourceRoot":"","sources":["../../src/sources/internals.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAejD,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,QAAQ,CAExD;AAED,gDAAgD;AAChD,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,QAAQ,GAAG,IAAI,CAE9E;AAED,wDAAwD;AACxD,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAOnE"}
+{"version":3,"file":"internals.d.ts","sourceRoot":"","sources":["../../src/sources/internals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,QAAQ,EAGT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AA0B/E,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,QAAQ,CAExD;AAED,gDAAgD;AAChD,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,QAAQ,GAAG,IAAI,CAE9E;AAED,wDAAwD;AACxD,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAOnE;AAMD,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED,sDAAsD;AACtD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,IAAI,CAAC;CACpB;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAE7D;AAeD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,mBAAmB,EACzB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,8EAA8E;AAC9E,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,mBAAmB,EACzB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOxB;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC;IAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAsCxD"}

package/dist/sources/internals.js

@@ -1,12 +1,28 @@
 /**
  * Internal helpers shared between sources/list.ts and sources/get.ts.
  *
- * The S3 client factory hook exists so tests can inject an in-memory stub
- * without standing up vi.mock for @aws-sdk/client-s3. Production code never
- * calls the setter.
+ * Two transports back the read surface:
+ *   - presigned-URL (HQ-59): when a vault client is supplied AND the entity is a
+ *     company vault (cmp_*), reads go through the vault `list`/`presign`
+ *     endpoints — the client never talks to S3 directly. This is the path every
+ *     company read should take going forward.
+ *   - direct S3 (legacy / personal): no vault client, or a personal vault
+ *     (prs_*, whose membership-less creds 403 the membership-gated presign
+ *     endpoints). Goes through `getS3Client`, whose factory hook lets tests
+ *     inject an in-memory stub without vi.mock.
  */
-import { S3Client } from "@aws-sdk/client-s3";
+import { S3Client, GetObjectCommand, ListObjectsV2Command, } from "@aws-sdk/client-s3";
+import { PresignObjectIO } from "../object-io.js";
 function defaultFactory(ctx) {
+    if (!ctx.credentials) {
+        // The direct-S3 read path needs STS creds. A credential-less context only
+        // exists on the presign path (HQ-59 company vend-skip), which reads via the
+        // vault list/presign endpoints, not this S3 client — so arriving here with
+        // no creds is a routing bug. Fail loudly rather than 403 opaquely later.
+        throw new Error(`Sources S3 read for ${ctx.uid} requires STS credentials but got a ` +
+            `presign-only context; company presign reads must go through the ` +
+            `vault transport, not getS3Client.`);
+    }
     return new S3Client({
         region: ctx.region,
         credentials: {
@@ -36,4 +52,97 @@ export async function streamToString(body) {
     }
     return Buffer.concat(chunks).toString("utf-8");
 }
+/** True when this read should use the presigned-URL transport. */
+export function usePresign(opts) {
+    return opts.vault != null && opts.entity.uid.startsWith("cmp_");
+}
+/** A not-found error normalized to the S3 `NoSuchKey` shape callers test for. */
+function noSuchKeyError(key) {
+    return Object.assign(new Error(`No such key: ${key}`), { name: "NoSuchKey" });
+}
+function isNotFound(err) {
+    if (!err || typeof err !== "object")
+        return false;
+    const name = err.name;
+    return (name === "NoSuchKey" || name === "NoSuchKeyException" || name === "NotFound");
+}
+/**
+ * Read an object's UTF-8 text. Throws a `NoSuchKey`-named error when the object
+ * is absent (both transports), so callers' existing not-found checks work
+ * unchanged.
+ */
+export async function readObjectText(opts, key) {
+    if (usePresign(opts)) {
+        const io = new PresignObjectIO(opts.vault, opts.entity.uid);
+        try {
+            const { body } = await io.getObject(key);
+            return body.toString("utf-8");
+        }
+        catch (err) {
+            if (isNotFound(err))
+                throw noSuchKeyError(key);
+            throw err;
+        }
+    }
+    const client = getS3Client(opts.entity);
+    const res = await client.send(new GetObjectCommand({ Bucket: opts.entity.bucketName, Key: key }));
+    return streamToString(res.Body);
+}
+/** Like {@link readObjectText} but returns null when the object is absent. */
+export async function tryReadObjectText(opts, key) {
+    try {
+        return await readObjectText(opts, key);
+    }
+    catch (err) {
+        if (isNotFound(err))
+            return null;
+        throw err;
+    }
+}
+/**
+ * List one page of objects under `prefix`.
+ *
+ * Under the presigned transport the vault `list` endpoint is ACL-filtered and
+ * controls page size server-side, so `limit` is advisory — paginate via the
+ * returned `nextToken` (the opaque vault cursor) until it is undefined. Under
+ * direct S3, `limit` maps to `MaxKeys`.
+ */
+export async function listObjects(opts, prefix, page) {
+    if (usePresign(opts)) {
+        const io = new PresignObjectIO(opts.vault, opts.entity.uid);
+        const res = await io.listObjects({
+            prefix,
+            continuationToken: page.continuationToken,
+        });
+        return {
+            contents: res.objects.map((o) => ({
+                key: o.key,
+                size: o.size,
+                lastModified: o.lastModified,
+            })),
+            nextToken: res.nextContinuationToken,
+        };
+    }
+    const client = getS3Client(opts.entity);
+    const res = await client.send(new ListObjectsV2Command({
+        Bucket: opts.entity.bucketName,
+        Prefix: prefix,
+        MaxKeys: page.limit,
+        ContinuationToken: page.continuationToken,
+    }));
+    const contents = [];
+    for (const obj of res.Contents ?? []) {
+        if (!obj.Key)
+            continue;
+        contents.push({
+            key: obj.Key,
+            size: obj.Size ?? 0,
+            lastModified: obj.LastModified ?? new Date(0),
+        });
+    }
+    return {
+        contents,
+        nextToken: res.IsTruncated ? res.NextContinuationToken : undefined,
+    };
+}
 //# sourceMappingURL=internals.js.map

package/dist/sources/internals.js.map

@@ -1 +1 @@
-{"version":3,"file":"internals.js","sourceRoot":"","sources":["../../src/sources/internals.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,SAAS,cAAc,CAAC,GAAkB;IACxC,OAAO,IAAI,QAAQ,CAAC;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE;YACX,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW;YACxC,eAAe,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe;YAChD,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,YAAY;SAC3C;KACF,CAAC,CAAC;AACL,CAAC;AAED,IAAI,OAAO,GAAqC,cAAc,CAAC;AAE/D,MAAM,UAAU,WAAW,CAAC,GAAkB;IAC5C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,oBAAoB,CAAC,CAAmC;IACtE,OAAO,GAAG,CAAC,CAAC;AACd,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,sBAAsB;IACpC,OAAO,GAAG,cAAc,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAa;IAChD,MAAM,MAAM,GAAG,IAAiC,CAAC;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"internals.js","sourceRoot":"","sources":["../../src/sources/internals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,eAAe,EAA+B,MAAM,iBAAiB,CAAC;AAE/E,SAAS,cAAc,CAAC,GAAkB;IACxC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,CAAC,GAAG,sCAAsC;YAClE,kEAAkE;YAClE,mCAAmC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE;YACX,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW;YACxC,eAAe,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe;YAChD,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,YAAY;SAC3C;KACF,CAAC,CAAC;AACL,CAAC;AAED,IAAI,OAAO,GAAqC,cAAc,CAAC;AAE/D,MAAM,UAAU,WAAW,CAAC,GAAkB;IAC5C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,oBAAoB,CAAC,CAAmC;IACtE,OAAO,GAAG,CAAC,CAAC;AACd,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,sBAAsB;IACpC,OAAO,GAAG,cAAc,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAa;IAChD,MAAM,MAAM,GAAG,IAAiC,CAAC;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAuBD,kEAAkE;AAClE,MAAM,UAAU,UAAU,CAAC,IAAyB;IAClD,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;IAC9C,OAAO,CACL,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAyB,EACzB,GAAW;IAEX,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CACnE,CAAC;IACF,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAyB,EACzB,GAAW;IAEX,IAAI,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAyB,EACzB,MAAc,EACd,IAAoD;IAEpD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC;YAC/B,MAAM;YACN,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChC,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,YAAY,EAAE,CAAC,CAAC,YAAY;aAC7B,CAAC,CAAC;YACH,SAAS,EAAE,GAAG,CAAC,qBAAqB;SACrC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,IAAI,oBAAoB,CAAC;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,IAAI,CAAC,KAAK;QACnB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CACH,CAAC;IACF,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG;YAAE,SAAS;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;YACnB,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;KACnE,CAAC;AACJ,CAAC"}

package/dist/sources/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/sources/list.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAsBpB,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuDtF"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/sources/list.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAsBpB,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA8CtF"}

package/dist/sources/list.js

@@ -5,9 +5,8 @@
  * The `.raw.json` siblings written by the sources-pipeline are skipped from
  * the summary (callers fetch them via getSource({ includeRaw: true })).
  */
-import { GetObjectCommand, ListObjectsV2Command, } from "@aws-sdk/client-s3";
 import { assertSourceChannel, sourcePathSegment } from "../schemas/source-channels.js";
-import { getS3Client, streamToString } from "./internals.js";
+import { listObjects, readObjectText } from "./internals.js";
 import { parseFrontmatter } from "./parse.js";
 /**
  * Strip the `sources/{channel}/` prefix and `.md` / `.raw.json` suffix from a key.
@@ -27,39 +26,33 @@ function deriveSourceId(key, prefix) {
     return null;
 }
 export async function listSources(opts) {
-    // Validate channel BEFORE any S3 call (acceptance criterion).
+    // Validate channel BEFORE any read (acceptance criterion).
     assertSourceChannel(opts.channel);
-    const client = getS3Client(opts.entity);
     // Use the canonical path segment from the schema; channel "meeting" maps
     // to the plural "meetings/" prefix the sources-pipeline writes to.
     const prefix = `sources/${sourcePathSegment(opts.channel)}/`;
-    const response = await client.send(new ListObjectsV2Command({
-        Bucket: opts.entity.bucketName,
-        Prefix: prefix,
-        MaxKeys: opts.limit,
-        ContinuationToken: opts.continuationToken,
-    }));
+    // Presign transport ACL-filters server-side and controls page size, so
+    // `limit` is advisory there; under direct S3 it maps to MaxKeys. Paginate via
+    // the returned nextToken regardless of transport.
+    const page = await listObjects(opts, prefix, {
+        limit: opts.limit,
+        continuationToken: opts.continuationToken,
+    });
     const entries = [];
-    for (const obj of response.Contents ?? []) {
-        if (!obj.Key)
-            continue;
-        const derived = deriveSourceId(obj.Key, prefix);
+    for (const obj of page.contents) {
+        const derived = deriveSourceId(obj.key, prefix);
         if (!derived || derived.isRawSibling)
             continue;
         const summary = {
             sourceId: derived.sourceId,
             channel: opts.channel,
-            key: obj.Key,
-            lastModified: obj.LastModified ?? new Date(0),
-            size: obj.Size ?? 0,
+            key: obj.key,
+            lastModified: obj.lastModified,
+            size: obj.size,
         };
         if (opts.includeFrontmatter) {
             try {
-                const get = await client.send(new GetObjectCommand({
-                    Bucket: opts.entity.bucketName,
-                    Key: obj.Key,
-                }));
-                const text = await streamToString(get.Body);
+                const text = await readObjectText(opts, obj.key);
                 const fm = parseFrontmatter(text);
                 if (fm)
                     summary.frontmatter = fm;
@@ -72,7 +65,7 @@ export async function listSources(opts) {
     }
     return {
         entries,
-        nextToken: response.IsTruncated ? response.NextContinuationToken : undefined,
+        nextToken: page.nextToken,
     };
 }
 //# sourceMappingURL=list.js.map

package/dist/sources/list.js.map

@@ -1 +1 @@
-{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/sources/list.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAO9C;;;;GAIG;AACH,SAAS,cAAc,CACrB,GAAW,EACX,MAAc;IAEd,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,8DAA8D;IAC9D,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,MAAM,GAAG,WAAW,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAE7D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,oBAAoB,CAAC;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,IAAI,CAAC,KAAK;QACnB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CACH,CAAC;IAEF,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,GAAG;YAAE,SAAS;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY;YAAE,SAAS;QAE/C,MAAM,OAAO,GAAkB;YAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC;YAC7C,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;SACpB,CAAC;QAEF,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,IAAI,gBAAgB,CAAC;oBACnB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;oBAC9B,GAAG,EAAE,GAAG,CAAC,GAAG;iBACb,CAAC,CACH,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC5C,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,EAAE;oBAAE,OAAO,CAAC,WAAW,GAAG,EAAE,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,OAAO;QACL,OAAO;QACP,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;KAC7E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/sources/list.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAO9C;;;;GAIG;AACH,SAAS,cAAc,CACrB,GAAW,EACX,MAAc;IAEd,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,2DAA2D;IAC3D,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAElC,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,MAAM,GAAG,WAAW,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAE7D,uEAAuE;IACvE,8EAA8E;IAC9E,kDAAkD;IAClD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE;QAC3C,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY;YAAE,SAAS;QAE/C,MAAM,OAAO,GAAkB;YAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;QAEF,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;gBACjD,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,EAAE;oBAAE,OAAO,CAAC,WAAW,GAAG,EAAE,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,OAAO;QACL,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC"}

package/dist/sources/list.test.js

@@ -4,7 +4,7 @@
  * Uses an in-memory S3Client stub installed via the internal `_setSourcesS3Factory`
  * hook so we don't have to stand up vi.mock for @aws-sdk/client-s3.
  */
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { GetObjectCommand, ListObjectsV2Command, } from "@aws-sdk/client-s3";
 import { listSources } from "./list.js";
 import { _setSourcesS3Factory, _resetSourcesS3Factory, } from "./internals.js";
@@ -195,4 +195,104 @@ describe("listSources", () => {
         expect(observed.commands).toHaveLength(0);
     });
 });
+/**
+ * Vault stub for the list path: `listFiles` returns the configured ACL-filtered
+ * page (the server is the ACL boundary — only readable keys come back) + an
+ * opaque cursor; `presign`+fetch serve per-entry frontmatter GETs.
+ */
+function makePresignVault(page, contents = {}) {
+    const listCalls = [];
+    vi.stubGlobal("fetch", vi.fn(async (url) => {
+        const key = new URL(url).searchParams.get("key") ?? "";
+        const c = contents[key];
+        if (c === undefined)
+            return new Response(null, { status: 404 });
+        return new Response(Buffer.from(c, "utf-8"), { status: 200 });
+    }));
+    const vault = {
+        presign: async (input) => ({
+            results: input.keys.map((k) => ({
+                key: k.key,
+                op: k.op ?? input.op ?? "get",
+                url: `https://signed.example/?key=${encodeURIComponent(k.key)}`,
+            })),
+            expiresAt: "2099-01-01T00:00:00.000Z",
+        }),
+        listFiles: async (_company, prefix, cursor) => {
+            listCalls.push({ prefix, cursor });
+            return {
+                objects: page.objects,
+                cursor: page.cursor,
+                truncated: page.cursor != null,
+            };
+        },
+    };
+    return { vault, listCalls };
+}
+function listed(key) {
+    return {
+        key,
+        size: 10,
+        lastModified: "2026-02-01T00:00:00.000Z",
+        etag: "etag",
+        permission: "read",
+    };
+}
+describe("listSources — presigned transport (vault + cmp_)", () => {
+    afterEach(() => vi.unstubAllGlobals());
+    it("lists via the ACL-filtered vault endpoint and never touches S3", async () => {
+        _setSourcesS3Factory(() => ({
+            send: async () => {
+                throw new Error("S3 must not be used on the presign path");
+            },
+        }));
+        const { vault, listCalls } = makePresignVault({
+            objects: [listed("sources/meetings/a.md"), listed("sources/meetings/a.raw.json")],
+            cursor: null,
+        });
+        const res = await listSources({ entity: ENTITY, channel: "meeting", vault });
+        // .raw.json sibling is skipped; only the .md entry surfaces.
+        expect(res.entries.map((e) => e.sourceId)).toEqual(["a"]);
+        expect(res.entries[0].key).toBe("sources/meetings/a.md");
+        expect(res.nextToken).toBeUndefined();
+        // listFiles was called with the channel prefix (ACL filtering is server-side).
+        expect(listCalls[0].prefix).toBe("sources/meetings/");
+    });
+    it("surfaces the opaque vault cursor as nextToken (advisory limit)", async () => {
+        const { vault } = makePresignVault({
+            objects: [listed("sources/meetings/a.md")],
+            cursor: "OPAQUE_CURSOR",
+        });
+        const res = await listSources({
+            entity: ENTITY,
+            channel: "meeting",
+            limit: 1,
+            vault,
+        });
+        expect(res.nextToken).toBe("OPAQUE_CURSOR");
+    });
+    it("includeFrontmatter parses each entry via a presigned GET", async () => {
+        const { vault } = makePresignVault({ objects: [listed("sources/meetings/a.md")], cursor: null }, { "sources/meetings/a.md": MEETING_MD });
+        const res = await listSources({
+            entity: ENTITY,
+            channel: "meeting",
+            includeFrontmatter: true,
+            vault,
+        });
+        expect(res.entries[0].frontmatter).toMatchObject({ title: "Hello" });
+    });
+    it("forwards the continuationToken as the vault cursor", async () => {
+        const { vault, listCalls } = makePresignVault({
+            objects: [],
+            cursor: null,
+        });
+        await listSources({
+            entity: ENTITY,
+            channel: "meeting",
+            continuationToken: "RESUME_HERE",
+            vault,
+        });
+        expect(listCalls[0].cursor).toBe("RESUME_HERE");
+    });
+});
 //# sourceMappingURL=list.test.js.map