@indigoai-us/hq-cloud 6.12.5 → 6.13.1

package/dist/cli/share.test.js

@@ -2034,6 +2034,51 @@ describe("share", () => {
         const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
         expect(journal.files["core/policies/old.md"]).toBeUndefined();
     });
+    it("currency-gated: propagates the S3 delete for a local-delete tombstone (pull-leg producer hand-off)", async () => {
+        // The pull-leg producer stamped a persisting `local-delete` tombstone for a
+        // file the user deleted (no respawn). The cross-leg hand-off: on the next
+        // push the S3 object must actually be DELETED and the entry dropped, so the
+        // deletion propagates to the cloud + every other surface.
+        const companyRoot = path.join(tmpDir, "companies", "acme");
+        fs.mkdirSync(companyRoot, { recursive: true });
+        const journalPath = path.join(stateDir, "sync-journal.acme.json");
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "2",
+            lastSync: new Date().toISOString(),
+            files: {
+                "docs/deleted.md": {
+                    hash: "h",
+                    size: 100,
+                    syncedAt: new Date().toISOString(),
+                    direction: "down",
+                    remoteEtag: "abc123",
+                    removedAt: new Date().toISOString(),
+                    removedReason: "local-delete",
+                },
+            },
+            pulls: [],
+        }));
+        // HEAD returns the same etag — this device had the current version, so the
+        // currency-gated delete is safe to propagate.
+        vi.mocked(headRemoteFile).mockResolvedValueOnce({
+            lastModified: new Date(),
+            etag: '"abc123"',
+            size: 100,
+        });
+        const result = await share({
+            paths: [companyRoot],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            skipUnchanged: true,
+            propagateDeletes: true,
+            propagateDeletePolicy: "currency-gated",
+        });
+        expect(result.filesDeleted).toBe(1);
+        expect(deleteRemoteFile).toHaveBeenCalledWith(expect.anything(), "docs/deleted.md");
+        const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+        expect(journal.files["docs/deleted.md"]).toBeUndefined();
+    });
     it("currency-gated: refuses delete + emits stale-etag event when remote moved since last sync", async () => {
         const companyRoot = path.join(tmpDir, "companies", "acme");
         fs.mkdirSync(companyRoot, { recursive: true });
@@ -2087,6 +2132,61 @@ describe("share", () => {
         expect(result.filesRefusedStale).toBe(1);
         expect(result.filesTombstoned).toBe(0);
     });
+    it("currency-gated: refuses delete for a divergent-local entry (journal-honesty — never delete a remote the local never genuinely matched)", async () => {
+        const companyRoot = path.join(tmpDir, "companies", "acme");
+        fs.mkdirSync(companyRoot, { recursive: true });
+        // A keep-conflict recorded the REMOTE etag (so the conflict can't re-fire —
+        // the #137 invariant) but the kept LOCAL content DIVERGED from that remote
+        // (`localDiverges:true`). The local copy was then deleted. The currency HEAD
+        // would MATCH the recorded etag — the trap — yet the etag never reflected a
+        // genuine local==remote sync, so propagating the delete would destroy the
+        // (different) remote version. Must be REFUSED, not propagated.
+        const journalPath = path.join(stateDir, "sync-journal.acme.json");
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "2",
+            lastSync: new Date().toISOString(),
+            files: {
+                "core/policies/kept.md": {
+                    hash: "local-divergent-hash",
+                    size: 100,
+                    syncedAt: new Date().toISOString(),
+                    direction: "down",
+                    remoteEtag: "abc123",
+                    localDiverges: true,
+                },
+            },
+            pulls: [],
+        }));
+        // Deliberately NO HEAD mock: the divergence guard short-circuits BEFORE the
+        // currency HEAD, so `headRemoteFile` is never called for this entry — the
+        // refusal costs no network round-trip (asserted below).
+        const events = [];
+        const result = await share({
+            paths: [companyRoot],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            skipUnchanged: true,
+            propagateDeletes: true,
+            propagateDeletePolicy: "currency-gated",
+            onEvent: (e) => events.push(e),
+        });
+        // No remote DELETE — the recorded etag never reflected a genuine sync.
+        expect(result.filesDeleted).toBe(0);
+        expect(deleteRemoteFile).not.toHaveBeenCalledWith(expect.anything(), "core/policies/kept.md");
+        // Refusal short-circuits before the currency HEAD — no network needed.
+        expect(headRemoteFile).not.toHaveBeenCalled();
+        // Journal entry preserved, not silently dropped.
+        const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+        expect(journal.files["core/policies/kept.md"]).toBeDefined();
+        // Surfaced as a refusal with the divergent-local reason.
+        const refused = events.find((e) => e.type === "delete-refused-stale-etag");
+        expect(refused).toMatchObject({
+            type: "delete-refused-stale-etag",
+            path: "core/policies/kept.md",
+            reason: "divergent-local",
+        });
+    });
     it("currency-gated: tombstones journal entry when remote returns 404 (out-of-band cleanup)", async () => {
         const companyRoot = path.join(tmpDir, "companies", "acme");
         fs.mkdirSync(companyRoot, { recursive: true });