@indigoai-us/hq-cloud 6.14.7 → 6.14.8

package/src/cli/sync.test.ts

@@ -2566,6 +2566,68 @@ describe("sync", () => {
     expect(journal.files["knowledge/readme.md"].remoteEtag).toBe("def456");
   });
 
+  it("checkpoints completed downloads so a failed bulk pass resumes only its tail", async () => {
+    process.env.HQ_SYNC_TRANSFER_CONCURRENCY = "1";
+    const remoteFiles = Array.from({ length: 9 }, (_, index) => ({
+      key: `bulk/file-${index}.md`,
+      size: 10,
+      lastModified: new Date(),
+      etag: `"bulk-${index}"`,
+    }));
+    const defaultDownload = vi.mocked(s3Module.downloadFile).getMockImplementation();
+    if (!defaultDownload) throw new Error("missing default download mock");
+
+    try {
+      vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce(remoteFiles);
+      vi.mocked(s3Module.downloadFile).mockImplementation(
+        async (ctx, key, localPath) => {
+          if (key === "bulk/file-8.md") {
+            // This models the next transfer crashing the process. The first
+            // eight entries must already be durable before the final writer.
+            const checkpoint = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+            expect(Object.keys(checkpoint.files)).toHaveLength(8);
+            throw new Error("simulated crash after checkpoint");
+          }
+          return defaultDownload(ctx, key, localPath);
+        },
+      );
+
+      const first = await sync({
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        skipReindex: true,
+        onEvent: () => undefined,
+      });
+      expect(first.filesDownloaded).toBe(8);
+
+      const checkpoint = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+      expect(Object.keys(checkpoint.files)).toHaveLength(8);
+
+      vi.mocked(s3Module.downloadFile).mockImplementation(defaultDownload);
+      vi.mocked(s3Module.downloadFile).mockClear();
+      vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce(remoteFiles);
+
+      await sync({
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        skipReindex: true,
+        onEvent: () => undefined,
+      });
+
+      expect(vi.mocked(s3Module.downloadFile)).toHaveBeenCalledTimes(1);
+      expect(vi.mocked(s3Module.downloadFile)).toHaveBeenCalledWith(
+        expect.anything(),
+        "bulk/file-8.md",
+        expect.any(String),
+      );
+    } finally {
+      vi.mocked(s3Module.downloadFile).mockImplementation(defaultDownload);
+      delete process.env.HQ_SYNC_TRANSFER_CONCURRENCY;
+    }
+  });
+
   // ── Stage-1 plan event ─────────────────────────────────────────────────
 
   it("emits a plan event before any progress events", async () => {

package/src/cli/sync.ts

@@ -602,6 +602,8 @@ interface PullRunContext {
    */
   currentExcludeSet: string[];
   fileTombstones: ReadonlyMap<string, CompanyTombstone>;
+  /** Successful downloads since the last durable journal checkpoint. */
+  downloadsSinceJournalCheckpoint: number;
 }
 
 interface PullCounters {
@@ -647,6 +649,8 @@ export function resolveAutoPruneCap(): number {
 
 /** Max time to wait on the best-effort new-files notification POST. */
 const NOTIFY_FILE_ADDED_TIMEOUT_MS = 5000;
+/** Bound crash recovery to at most this many completed pull downloads. */
+const DOWNLOAD_JOURNAL_CHECKPOINT_BATCH_SIZE = 8;
 
 /**
  * Server cap on files per `/v1/notify/file-added` report. The endpoint rejects
@@ -915,6 +919,7 @@ async function buildPullContext(options: SyncOptions): Promise<PullRunContext> {
     currentPrefixSet,
     currentExcludeSet,
     fileTombstones,
+    downloadsSinceJournalCheckpoint: 0,
   };
 }
 
@@ -1534,6 +1539,19 @@ async function downloadOne(
         message: err instanceof Error ? err.message : String(err),
       });
     }
+    return;
+  }
+
+  run.downloadsSinceJournalCheckpoint++;
+  if (
+    run.downloadsSinceJournalCheckpoint >=
+    DOWNLOAD_JOURNAL_CHECKPOINT_BATCH_SIZE
+  ) {
+    // writeJournal is already fsync + rename atomic. Persist completed work
+    // before scheduling more objects so an abrupt process exit only replays a
+    // small tail, not an entire bulk download.
+    writeJournal(run.journalSlug, run.journal);
+    run.downloadsSinceJournalCheckpoint = 0;
   }
 }
 

package/src/object-io.test.ts

@@ -9,12 +9,17 @@
  */
 
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import * as http from "node:http";
+import { once } from "node:events";
+import { spawn } from "node:child_process";
 import {
   PresignObjectIO,
   S3SdkObjectIO,
   setObjectIOFactory,
+  setPresignedGetTransportForTesting,
   resolveObjectIO,
   presignObjectIOFactory,
+  type PresignedGetTransport,
   type PresignTransportClient,
 } from "./object-io.js";
 import type { EntityContext } from "./types.js";
@@ -23,6 +28,55 @@ import { isAccessDenied } from "./sync-core.js";
 
 const COMPANY = "cmp_test";
 
+function fetchBackedPresignedGetTransport(): PresignedGetTransport {
+  return {
+    async get(url, headers) {
+      const response = await fetch(url, { method: "GET", headers });
+      const body = response.body;
+      return {
+        status: response.status,
+        headers: response.headers,
+        body: body
+          ? (async function* (): AsyncIterable<Uint8Array> {
+              const reader = body.getReader();
+              let exhausted = false;
+              try {
+                while (true) {
+                  const { done, value } = await reader.read();
+                  if (done) {
+                    exhausted = true;
+                    return;
+                  }
+                  if (value.byteLength > 0) yield value;
+                }
+              } finally {
+                if (!exhausted) {
+                  try {
+                    await reader.cancel();
+                  } catch {
+                    // The response may already have been cancelled by destroy.
+                  }
+                }
+                reader.releaseLock();
+              }
+            })()
+          : undefined,
+        destroy: () => {
+          void body?.cancel().catch(() => undefined);
+        },
+      };
+    },
+  };
+}
+
+beforeEach(() => {
+  setPresignedGetTransportForTesting(fetchBackedPresignedGetTransport());
+});
+
+afterEach(() => {
+  setPresignedGetTransportForTesting(null);
+});
+
 function ctx(): EntityContext {
   return {
     uid: COMPANY,
@@ -506,6 +560,27 @@ describe("PresignObjectIO.getObject", () => {
     });
   });
 
+  it("drains the injected transport body instead of returning empty content", async () => {
+    const { vault, setPresign } = makeVault();
+    setPresign([{ key: "shared/a.md", op: "get", url: "https://s3/get" }]);
+    const transportGet = vi.fn(async () => ({
+      status: 200,
+      headers: new Headers({ "x-amz-meta-source": "transport" }),
+      body: (async function* (): AsyncIterable<Uint8Array> {
+        yield Buffer.from("transport-bytes");
+      })(),
+      destroy: () => undefined,
+    }));
+    setPresignedGetTransportForTesting({ get: transportGet });
+
+    const io = new PresignObjectIO(vault, COMPANY);
+    const res = await io.getObject("shared/a.md");
+
+    expect(res.body.toString("utf-8")).toBe("transport-bytes");
+    expect(res.metadata).toEqual({ source: "transport" });
+    expect(transportGet).toHaveBeenCalledWith("https://s3/get", undefined);
+  });
+
   it("throws a NotFound-named error on 404 (so s3.ts catch sites match)", async () => {
     const { vault, setPresign } = makeVault();
     setPresign([{ key: "gone", op: "get", url: "https://s3/get" }]);
@@ -1044,3 +1119,103 @@ describe("presignObjectIOFactory — personal vaults route to S3 SDK", () => {
     expect(personal).toBeInstanceOf(S3SdkObjectIO);
   });
 });
+
+describe("PresignObjectIO — core HTTP presigned GET", () => {
+  function streamingVault(baseUrl: string): PresignTransportClient {
+    return {
+      presign: async (input) => ({
+        results: input.keys.map((key) => ({
+          key: key.key,
+          op: "get" as const,
+          url: `${baseUrl}/${key.key}`,
+        })),
+        expiresAt: "2099-01-01T00:00:00.000Z",
+      }),
+      listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
+    };
+  }
+
+  it("destroys an early-exit response and rejects a FIN-short body", async () => {
+    setPresignedGetTransportForTesting(null);
+    let responseClosed: Promise<unknown> | undefined;
+    const server = http.createServer((req, res) => {
+      if (req.url === "/short") {
+        res.writeHead(200, { "content-length": "10" });
+        res.end("short");
+        return;
+      }
+
+      res.writeHead(200, { "content-length": "131072" });
+      res.write(Buffer.alloc(65_536, 1));
+      responseClosed = once(res, "close");
+      const finish = setTimeout(() => res.end(Buffer.alloc(65_536, 2)), 1_000);
+      res.once("close", () => clearTimeout(finish));
+    });
+    server.listen(0, "127.0.0.1");
+    await once(server, "listening");
+    const address = server.address();
+    if (!address || typeof address === "string") {
+      throw new Error("test server did not bind a TCP port");
+    }
+
+    try {
+      const io = new PresignObjectIO(
+        streamingVault(`http://127.0.0.1:${address.port}`),
+        COMPANY,
+      );
+      const streamed = await io.getObjectStream("large");
+      const iterator = streamed.body[Symbol.asyncIterator]();
+      expect((await iterator.next()).value).toBeInstanceOf(Uint8Array);
+      await iterator.return?.();
+      if (!responseClosed) throw new Error("response did not start streaming");
+      await expect(responseClosed).resolves.toBeDefined();
+
+      await expect(io.getObject("short")).rejects.toThrow(
+        /content-length mismatch/,
+      );
+    } finally {
+      server.close();
+      await once(server, "close");
+    }
+  });
+
+  it.runIf(
+    process.platform === "win32" && /^(22|24)\./.test(process.versions.node),
+  )("keeps a child FIN safe after the consumer has applied backpressure", async () => {
+    setPresignedGetTransportForTesting(null);
+    const child = spawn(process.execPath, [
+      "-e",
+      [
+        "const http = require('node:http');",
+        "const body = Buffer.alloc(524288, 7);",
+        "const server = http.createServer((_req, res) => {",
+        "  res.writeHead(200, { 'content-length': String(body.length) });",
+        "  for (let offset = 0; offset < body.length; offset += 16384) res.write(body.subarray(offset, offset + 16384));",
+        "  res.end();",
+        "});",
+        "server.listen(0, '127.0.0.1', () => process.stdout.write(String(server.address().port) + '\\n'));",
+        "process.on('SIGTERM', () => server.close(() => process.exit(0)));",
+      ].join("\n"),
+    ], { stdio: ["ignore", "pipe", "inherit"] });
+
+    const port = await new Promise<number>((resolve, reject) => {
+      child.once("error", reject);
+      child.stdout?.once("data", (data: Buffer) => resolve(Number(data.toString())));
+      child.once("exit", (code) => reject(new Error(`child server exited (${code})`)));
+    });
+
+    try {
+      const io = new PresignObjectIO(
+        streamingVault(`http://127.0.0.1:${port}`),
+        COMPANY,
+      );
+      const streamed = await io.getObjectStream("bulk");
+      await new Promise((resolve) => setTimeout(resolve, 40));
+      let bytes = 0;
+      for await (const chunk of streamed.body) bytes += chunk.byteLength;
+      expect(bytes).toBe(524_288);
+    } finally {
+      child.kill("SIGTERM");
+    }
+  });
+});

package/src/object-io.ts

@@ -13,8 +13,8 @@
  *   - `PresignObjectIO` — the presigned-URL path. The vault-service decides
  *     access as a runtime DDB check (no IAM policy ceiling) and hands back
  *     short-lived presigned GET/PUT/DELETE URLs + (for PUT) the exact headers
- *     to replay. The client never holds AWS credentials — it just `fetch`es
- *     the signed URLs.
+ *     to replay. The client never holds AWS credentials — it requests the
+ *     signed URLs directly.
  *
  * The seam is a per-EntityContext factory resolved INSIDE s3.ts, so every
  * existing call site (`uploadFile(ctx, …)`, `downloadFile(ctx, …)`, …) keeps
@@ -31,6 +31,9 @@ import {
   DeleteObjectCommand,
   HeadObjectCommand,
 } from "@aws-sdk/client-s3";
+import * as http from "node:http";
+import * as https from "node:https";
+import type { IncomingMessage } from "node:http";
 import type { EntityContext } from "./types.js";
 import type {
   PresignOp,
@@ -344,6 +347,141 @@ function metaFromHeaders(headers: Headers): Record<string, string> {
   return meta;
 }
 
+/**
+ * Response shape shared by every presigned GET consumer. Unlike the runtime
+ * `fetch` response, its body is backed by Node's core HTTP client, so it never
+ * enters the runtime-bundled undici parser path.
+ */
+export interface PresignedGetResponse {
+  status: number;
+  headers: Headers;
+  body?: AsyncIterable<Uint8Array>;
+  destroy(): void;
+}
+
+/** Transport seam retained for deterministic wire-level regression tests. */
+export interface PresignedGetTransport {
+  get(
+    url: string,
+    headers: Record<string, string> | undefined,
+  ): Promise<PresignedGetResponse>;
+}
+
+function headersFromNode(
+  headers: IncomingMessage["headers"],
+): Headers {
+  const out = new Headers();
+  for (const [name, value] of Object.entries(headers)) {
+    if (value === undefined) continue;
+    out.set(name, Array.isArray(value) ? value.join(", ") : value);
+  }
+  return out;
+}
+
+function expectedContentLength(headers: Headers): number | undefined {
+  const value = headers.get("content-length");
+  if (value === null) return undefined;
+  if (!/^\d+$/.test(value)) {
+    throw new Error(`invalid presigned GET content-length: ${value}`);
+  }
+  const length = Number(value);
+  if (!Number.isSafeInteger(length)) {
+    throw new Error(`invalid presigned GET content-length: ${value}`);
+  }
+  return length;
+}
+
+function contentLengthError(expected: number, actual: number): Error {
+  return new Error(
+    `presigned GET content-length mismatch: expected ${expected} bytes, received ${actual}`,
+  );
+}
+
+async function* checkedNodeBody(
+  message: IncomingMessage,
+  expected: number | undefined,
+): AsyncIterable<Uint8Array> {
+  let received = 0;
+  let exhausted = false;
+  try {
+    try {
+      for await (const chunk of message) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        received += bytes.byteLength;
+        if (expected !== undefined && received > expected) {
+          throw contentLengthError(expected, received);
+        }
+        yield bytes;
+      }
+    } catch (err) {
+      // A FIN before Node has received the declared bytes normally surfaces as
+      // an "aborted" stream error. Preserve the useful data-integrity cause.
+      if (expected !== undefined && received !== expected) {
+        throw contentLengthError(expected, received);
+      }
+      throw err;
+    }
+    exhausted = true;
+    if (expected !== undefined && received !== expected) {
+      throw contentLengthError(expected, received);
+    }
+  } finally {
+    // Consumers such as HEAD only inspect headers, and a caller can stop after
+    // a prefix. Destroying in both cases releases the socket immediately.
+    if (!exhausted) message.destroy();
+  }
+}
+
+function nodePresignedGet(
+  url: string,
+  headers: Record<string, string> | undefined,
+): Promise<PresignedGetResponse> {
+  const target = new URL(url);
+  return new Promise((resolve, reject) => {
+    const handleResponse = (message: IncomingMessage): void => {
+      const responseHeaders = headersFromNode(message.headers);
+      let expected: number | undefined;
+      try {
+        expected = expectedContentLength(responseHeaders);
+      } catch (err) {
+        message.destroy();
+        reject(err);
+        return;
+      }
+      resolve({
+        status: message.statusCode ?? 0,
+        headers: responseHeaders,
+        body: checkedNodeBody(message, expected),
+        destroy: () => message.destroy(),
+      });
+    };
+    const request = target.protocol === "https:"
+      ? https.request(target, { method: "GET", headers }, handleResponse)
+      : target.protocol === "http:"
+        ? http.request(target, { method: "GET", headers }, handleResponse)
+        : undefined;
+    if (!request) {
+      reject(new Error(`unsupported presigned GET protocol: ${target.protocol}`));
+      return;
+    }
+    request.once("error", reject);
+    request.end();
+  });
+}
+
+const NODE_PRESIGNED_GET_TRANSPORT: PresignedGetTransport = {
+  get: nodePresignedGet,
+};
+
+let presignedGetTransport: PresignedGetTransport = NODE_PRESIGNED_GET_TRANSPORT;
+
+/** Test-only override; production always uses Node's core HTTP(S) transport. */
+export function setPresignedGetTransportForTesting(
+  transport: PresignedGetTransport | null,
+): void {
+  presignedGetTransport = transport ?? NODE_PRESIGNED_GET_TRANSPORT;
+}
+
 /**
  * Per-key presign denial codes that are EXPECTED and must be reclassified as
  * skip-with-log — throwing the `name: "Forbidden"` shape (see
@@ -825,20 +963,21 @@ export class PresignObjectIO implements ObjectIO {
 
   async getObjectStream(key: string): Promise<GetObjectStreamResult> {
     const row = await this.resolveGetUrlForBody(key);
-    const res = await fetchWithRetry(row.url, { method: "GET" }, `presigned GET ${key}`);
+    const res = await presignedGetWithRetry(
+      row.url,
+      row.headers,
+      `presigned GET ${key}`,
+    );
     if (res.status === 404) {
-      await cancelBody(res);
+      res.destroy();
       throw notFoundError(key);
     }
-    if (!res.ok) {
-      const detail = await safeText(res);
+    if (res.status < 200 || res.status >= 300) {
+      const detail = await safePresignedGetText(res);
       throw new Error(`presigned GET failed for ${key}: ${res.status} ${detail}`);
     }
-    if (!res.body) {
-      return { body: (async function* () {})(), metadata: metaFromHeaders(res.headers) };
-    }
     return {
-      body: webReadableToAsyncIterable(res.body),
+      body: res.body ?? (async function* () {})(),
       metadata: metaFromHeaders(res.headers),
     };
   }
@@ -933,9 +1072,13 @@ export class PresignObjectIO implements ObjectIO {
       }
       url = row.url;
     }
-    const res = await fetchWithRetry(url, { method: "GET" }, `presigned HEAD ${key}`);
+    const res = await presignedGetWithRetry(
+      url,
+      undefined,
+      `presigned HEAD ${key}`,
+    );
     if (res.status === 404) {
-      await cancelBody(res);
+      res.destroy();
       return null;
     }
     if (res.status === 403) {
@@ -944,12 +1087,11 @@ export class PresignObjectIO implements ObjectIO {
       // denial branch above. The SDK transport throws name:"Forbidden" here;
       // mirror it so both transports agree and no caller mistakes a denial
       // for a missing object.
-      await cancelBody(res);
+      res.destroy();
       throw accessDeniedError(key, "presigned HEAD returned 403");
     }
-    if (!res.ok) {
-      await cancelBody(res);
-      const detail = await safeText(res);
+    if (res.status < 200 || res.status >= 300) {
+      const detail = await safePresignedGetText(res);
       throw new Error(`presigned HEAD failed for ${key}: ${res.status} ${detail}`);
     }
     const result: HeadObjectResult = {
@@ -958,7 +1100,7 @@ export class PresignObjectIO implements ObjectIO {
       size: Number(res.headers.get("content-length") ?? "0"),
       metadata: metaFromHeaders(res.headers),
     };
-    await cancelBody(res);
+    res.destroy();
     return result;
   }
 }
@@ -979,21 +1121,6 @@ async function cancelBody(res: Response): Promise<void> {
   }
 }
 
-async function* webReadableToAsyncIterable(
-  stream: ReadableStream<Uint8Array>,
-): AsyncIterable<Uint8Array> {
-  const reader = stream.getReader();
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) return;
-      if (value && value.byteLength > 0) yield value;
-    }
-  } finally {
-    reader.releaseLock();
-  }
-}
-
 function parseLastModified(value: string | null): Date {
   if (!value) return new Date();
   const d = new Date(value);
@@ -1023,6 +1150,60 @@ function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+/**
+ * Shared presigned-GET path for streaming reads and header-only probes.
+ *
+ * GET deliberately uses Node core HTTP(S), not global fetch: on affected
+ * Node/Windows builds the bundled undici parser can assert after a FIN arrives
+ * while the consumer is backpressured. Keep the retry budget identical to the
+ * PUT/DELETE fetch path below.
+ */
+async function presignedGetWithRetry(
+  url: string,
+  headers: Record<string, string> | undefined,
+  what: string,
+): Promise<PresignedGetResponse> {
+  let lastError: unknown;
+  for (let attempt = 0; attempt <= FETCH_MAX_RETRIES; attempt++) {
+    if (attempt > 0) {
+      const backoff = FETCH_BASE_DELAY_MS * 2 ** (attempt - 1);
+      const jitter = Math.floor(Math.random() * FETCH_BASE_DELAY_MS);
+      await sleep(backoff + jitter);
+    }
+    let res: PresignedGetResponse;
+    try {
+      res = await presignedGetTransport.get(url, headers);
+    } catch (err) {
+      lastError = err;
+      continue;
+    }
+    if (isTransientStatus(res.status) && attempt < FETCH_MAX_RETRIES) {
+      res.destroy();
+      lastError = new Error(`${what}: transient ${res.status}`);
+      continue;
+    }
+    return res;
+  }
+  throw lastError instanceof Error
+    ? lastError
+    : new Error(`${what}: failed after ${FETCH_MAX_RETRIES} retries`);
+}
+
+async function safePresignedGetText(res: PresignedGetResponse): Promise<string> {
+  try {
+    let text = "";
+    for await (const chunk of res.body ?? []) {
+      text += Buffer.from(chunk).toString("utf-8");
+      if (text.length >= 200) break;
+    }
+    return text.slice(0, 200);
+  } catch {
+    return "";
+  } finally {
+    res.destroy();
+  }
+}
+
 /**
  * `fetch` with bounded retry on network errors + transient 5xx. The presigned
  * URL is reusable until expiry and the bodies are in-memory Buffers, so a

package/src/signals/get.test.ts

@@ -3,13 +3,18 @@
  */
 
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { Readable } from "node:stream";
 import { GetObjectCommand, type S3Client } from "@aws-sdk/client-s3";
 import { getSignal, SignalNotFoundError } from "./get.js";
 import {
   _setSignalsS3Factory,
   _resetSignalsS3Factory,
 } from "./internals.js";
-import type { PresignTransportClient } from "../object-io.js";
+import {
+  setPresignedGetTransportForTesting,
+  type PresignedGetTransport,
+  type PresignTransportClient,
+} from "../object-io.js";
 import type { EntityContext } from "../types.js";
 import { InvalidSignalTypeError } from "../schemas/signal-types.js";
 
@@ -208,6 +213,21 @@ Body.
 // Presigned transport (vault client + company vault) — HQ-59
 // ---------------------------------------------------------------------------
 
+function fetchBackedPresignedGetTransport(): PresignedGetTransport {
+  return {
+    async get(url, headers) {
+      const response = await fetch(url, { method: "GET", headers });
+      const body = response.body ? Readable.fromWeb(response.body) : undefined;
+      return {
+        status: response.status,
+        headers: response.headers,
+        body,
+        destroy: () => body?.destroy(),
+      };
+    },
+  };
+}
+
 function makePresignVault(objects: Record<string, string>): PresignTransportClient {
   vi.stubGlobal(
     "fetch",
@@ -218,6 +238,7 @@ function makePresignVault(objects: Record<string, string>): PresignTransportClie
       return new Response(Buffer.from(content, "utf-8"), { status: 200 });
     }),
   );
+  setPresignedGetTransportForTesting(fetchBackedPresignedGetTransport());
   return {
     presign: async (input) => ({
       results: input.keys.map((k) => ({
@@ -232,7 +253,10 @@ function makePresignVault(objects: Record<string, string>): PresignTransportClie
 }
 
 describe("getSignal — presigned transport (vault + cmp_)", () => {
-  afterEach(() => vi.unstubAllGlobals());
+  afterEach(() => {
+    setPresignedGetTransportForTesting(null);
+    vi.unstubAllGlobals();
+  });
 
   it("reads via presign (no S3) and surfaces typed cross-refs", async () => {
     _setSignalsS3Factory(