@indigoai-us/hq-cloud 6.14.7 → 6.14.9

package/dist/manifest-reconcile.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Reconcile successfully pulled cloud companies into the local manifest.
+ *
+ * The personal-vault leg also carries `companies/manifest.yaml`, so this runs
+ * only after the complete fanout has settled. That makes the locally
+ * materialized cloud companies authoritative for their own manifest entries
+ * without discarding entries the personal vault already had.
+ */
+import type { EntityInfo } from "./vault-client.js";
+export interface ManifestReconcileTarget {
+    uid: string;
+    slug: string;
+    personalMode?: boolean;
+}
+export interface ManifestReconcileOptions {
+    hqRoot: string;
+    targets: readonly ManifestReconcileTarget[];
+    completedCompanySlugs: ReadonlySet<string>;
+    getEntity: (uid: string) => Promise<EntityInfo>;
+}
+/**
+ * Atomically merge live, successfully pulled company targets into
+ * `companies/manifest.yaml`. Targets that are personal, incomplete, deleted,
+ * no longer resolvable, or not materialized on disk are intentionally ignored.
+ */
+export declare function reconcileCompanyManifest(options: ManifestReconcileOptions): Promise<void>;
+//# sourceMappingURL=manifest-reconcile.d.ts.map

package/dist/manifest-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-reconcile.d.ts","sourceRoot":"","sources":["../src/manifest-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC5C,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CACjD;AA6DD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,IAAI,CAAC,CAgEf"}

package/dist/manifest-reconcile.js

@@ -0,0 +1,120 @@
+/**
+ * Reconcile successfully pulled cloud companies into the local manifest.
+ *
+ * The personal-vault leg also carries `companies/manifest.yaml`, so this runs
+ * only after the complete fanout has settled. That makes the locally
+ * materialized cloud companies authoritative for their own manifest entries
+ * without discarding entries the personal vault already had.
+ */
+import { randomUUID } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import yaml from "js-yaml";
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isLiveCompany(entity, uid) {
+    return (entity.uid === uid &&
+        entity.type === "company" &&
+        entity.status === "active" &&
+        typeof entity.name === "string" &&
+        entity.name.length > 0 &&
+        typeof entity.bucketName === "string" &&
+        entity.bucketName.length > 0);
+}
+function hasCompanyDirectory(companiesDir, slug) {
+    const resolvedCompaniesDir = path.resolve(companiesDir);
+    const companyDir = path.resolve(resolvedCompaniesDir, slug);
+    if (path.dirname(companyDir) !== resolvedCompaniesDir)
+        return false;
+    try {
+        return fs.statSync(companyDir).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function loadManifest(manifestPath) {
+    try {
+        const raw = fs.readFileSync(manifestPath, "utf8");
+        const parsed = yaml.load(raw);
+        return isRecord(parsed) ? parsed : null;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return {};
+        return null;
+    }
+}
+function writeManifestAtomically(manifestPath, document) {
+    const temporaryPath = path.join(path.dirname(manifestPath), `.manifest-${process.pid}-${randomUUID()}.yaml`);
+    fs.writeFileSync(temporaryPath, yaml.dump(document, { lineWidth: -1 }), "utf8");
+    fs.renameSync(temporaryPath, manifestPath);
+}
+/**
+ * Atomically merge live, successfully pulled company targets into
+ * `companies/manifest.yaml`. Targets that are personal, incomplete, deleted,
+ * no longer resolvable, or not materialized on disk are intentionally ignored.
+ */
+export async function reconcileCompanyManifest(options) {
+    const companiesDir = path.join(options.hqRoot, "companies");
+    const candidates = [];
+    for (const target of options.targets) {
+        if (target.personalMode === true ||
+            !options.completedCompanySlugs.has(target.slug) ||
+            !hasCompanyDirectory(companiesDir, target.slug)) {
+            continue;
+        }
+        try {
+            const entity = await options.getEntity(target.uid);
+            if (isLiveCompany(entity, target.uid)) {
+                candidates.push({ slug: target.slug, entity });
+            }
+        }
+        catch {
+            // The target is not presently a live, resolvable company. Never mint a
+            // manifest entry from stale fanout data.
+        }
+    }
+    if (candidates.length === 0)
+        return;
+    const manifestPath = path.join(companiesDir, "manifest.yaml");
+    const document = loadManifest(manifestPath);
+    if (!document)
+        return;
+    let companies;
+    if (document.companies === undefined) {
+        companies = {};
+        document.companies = companies;
+    }
+    else if (isRecord(document.companies)) {
+        companies = document.companies;
+    }
+    else {
+        // A malformed `companies` key is user state; refusing to replace it is
+        // safer than losing a manifest that cannot be interpreted unambiguously.
+        return;
+    }
+    let changed = false;
+    for (const { slug, entity } of candidates) {
+        const existing = companies[slug];
+        if (existing !== undefined && !isRecord(existing))
+            continue;
+        const entry = existing ?? {};
+        if (entry.name === entity.name &&
+            entry.cloud_uid === entity.uid &&
+            entry.bucket_name === entity.bucketName) {
+            continue;
+        }
+        companies[slug] = {
+            ...entry,
+            name: entity.name,
+            cloud_uid: entity.uid,
+            bucket_name: entity.bucketName,
+        };
+        changed = true;
+    }
+    if (changed)
+        writeManifestAtomically(manifestPath, document);
+}
+//# sourceMappingURL=manifest-reconcile.js.map

package/dist/manifest-reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-reconcile.js","sourceRoot":"","sources":["../src/manifest-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,IAAI,MAAM,SAAS,CAAC;AA6B3B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,MAAkB,EAAE,GAAW;IACpD,OAAO,CACL,MAAM,CAAC,GAAG,KAAK,GAAG;QAClB,MAAM,CAAC,IAAI,KAAK,SAAS;QACzB,MAAM,CAAC,MAAM,KAAK,QAAQ;QAC1B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACtB,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,YAAoB,EAAE,IAAY;IAC7D,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,oBAAoB;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,YAAoB;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA2B,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB,EAAE,QAA0B;IAC/E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAC7B,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAC1B,aAAa,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,OAAO,CAChD,CAAC;IACF,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAChF,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAiC;IAEjC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAgD,EAAE,CAAC;IAEnE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,IACE,MAAM,CAAC,YAAY,KAAK,IAAI;YAC5B,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAC/C,CAAC,mBAAmB,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAC/C,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,yCAAyC;QAC3C,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEpC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,IAAI,SAA0C,CAAC;IAC/C,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,SAAS,GAAG,EAAE,CAAC;QACf,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;IACjC,CAAC;SAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,SAAS,GAAG,QAAQ,CAAC,SAA4C,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,yEAAyE;QACzE,OAAO;IACT,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC5D,MAAM,KAAK,GAAoB,QAAQ,IAAI,EAAE,CAAC;QAC9C,IACE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YAC1B,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,GAAG;YAC9B,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,UAAU,EACvC,CAAC;YACD,SAAS;QACX,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,GAAG;YAChB,GAAG,KAAK;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,WAAW,EAAE,MAAM,CAAC,UAAU;SAC/B,CAAC;QACF,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,OAAO;QAAE,uBAAuB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAC/D,CAAC"}

package/dist/manifest-reconcile.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=manifest-reconcile.test.d.ts.map

package/dist/manifest-reconcile.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-reconcile.test.d.ts","sourceRoot":"","sources":["../src/manifest-reconcile.test.ts"],"names":[],"mappings":""}

package/dist/manifest-reconcile.test.js

@@ -0,0 +1,97 @@
+import { afterEach, describe, expect, it } from "vitest";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import yaml from "js-yaml";
+import { reconcileCompanyManifest } from "./manifest-reconcile.js";
+let hqRoot;
+afterEach(() => {
+    if (hqRoot) {
+        fs.rmSync(hqRoot, { recursive: true, force: true });
+        hqRoot = undefined;
+    }
+});
+describe("reconcileCompanyManifest", () => {
+    it("atomically restores one successful cloud entry after the personal leg without replacing existing manifest state", async () => {
+        hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-manifest-reconcile-"));
+        const companiesDir = path.join(hqRoot, "companies");
+        fs.mkdirSync(path.join(companiesDir, "acme"), { recursive: true });
+        fs.mkdirSync(path.join(companiesDir, "failed"), { recursive: true });
+        fs.mkdirSync(path.join(companiesDir, "deleted"), { recursive: true });
+        // This is the older manifest the personal-vault leg pulled after the
+        // cloud-company legs completed. The final merge must retain this state and
+        // add only the live, successful cloud target.
+        const manifestPath = path.join(companiesDir, "manifest.yaml");
+        fs.writeFileSync(manifestPath, `version: 3\nsettings:\n  keep: true\ncompanies:\n  local-only:\n    name: Local Only\n    repos:\n      - repos/local\n  preserved:\n    name: Keep Me\n    cloud_uid: cmp_preserved\n`);
+        const entities = {
+            cmp_acme: {
+                uid: "cmp_acme",
+                slug: "acme",
+                type: "company",
+                status: "active",
+                name: "Acme Inc",
+                bucketName: "hq-vault-cmp-acme",
+                createdAt: "2026-01-01T00:00:00Z",
+            },
+            cmp_failed: {
+                uid: "cmp_failed",
+                slug: "failed",
+                type: "company",
+                status: "active",
+                name: "Failed Corp",
+                bucketName: "hq-vault-cmp-failed",
+                createdAt: "2026-01-01T00:00:00Z",
+            },
+            cmp_deleted: {
+                uid: "cmp_deleted",
+                slug: "deleted",
+                type: "company",
+                status: "deleted",
+                name: "Deleted Corp",
+                bucketName: "hq-vault-cmp-deleted",
+                createdAt: "2026-01-01T00:00:00Z",
+            },
+        };
+        const options = {
+            hqRoot,
+            targets: [
+                { uid: "cmp_acme", slug: "acme" },
+                { uid: "cmp_failed", slug: "failed" },
+                { uid: "cmp_deleted", slug: "deleted" },
+                { uid: "cmp_missing-directory", slug: "missing-directory" },
+                { uid: "prs_me", slug: "personal", personalMode: true },
+            ],
+            completedCompanySlugs: new Set(["acme", "deleted", "missing-directory", "personal"]),
+            getEntity: async (uid) => {
+                const entity = entities[uid];
+                if (!entity)
+                    throw new Error("entity not found");
+                return entity;
+            },
+        };
+        await reconcileCompanyManifest(options);
+        const firstWrite = fs.readFileSync(manifestPath, "utf8");
+        await reconcileCompanyManifest(options);
+        expect(fs.readFileSync(manifestPath, "utf8")).toBe(firstWrite);
+        expect(yaml.load(firstWrite)).toEqual({
+            version: 3,
+            settings: { keep: true },
+            companies: {
+                "local-only": {
+                    name: "Local Only",
+                    repos: ["repos/local"],
+                },
+                preserved: {
+                    name: "Keep Me",
+                    cloud_uid: "cmp_preserved",
+                },
+                acme: {
+                    name: "Acme Inc",
+                    cloud_uid: "cmp_acme",
+                    bucket_name: "hq-vault-cmp-acme",
+                },
+            },
+        });
+    });
+});
+//# sourceMappingURL=manifest-reconcile.test.js.map

package/dist/manifest-reconcile.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-reconcile.test.js","sourceRoot":"","sources":["../src/manifest-reconcile.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAGnE,IAAI,MAA0B,CAAC;AAE/B,SAAS,CAAC,GAAG,EAAE;IACb,IAAI,MAAM,EAAE,CAAC;QACX,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,iHAAiH,EAAE,KAAK,IAAI,EAAE;QAC/H,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAC1E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACpD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,qEAAqE;QACrE,2EAA2E;QAC3E,8CAA8C;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAC9D,EAAE,CAAC,aAAa,CACd,YAAY,EACZ,wLAAwL,CACzL,CAAC;QAEF,MAAM,QAAQ,GAA+B;YAC3C,QAAQ,EAAE;gBACR,GAAG,EAAE,UAAU;gBACf,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,UAAU;gBAChB,UAAU,EAAE,mBAAmB;gBAC/B,SAAS,EAAE,sBAAsB;aAClC;YACD,UAAU,EAAE;gBACV,GAAG,EAAE,YAAY;gBACjB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,qBAAqB;gBACjC,SAAS,EAAE,sBAAsB;aAClC;YACD,WAAW,EAAE;gBACX,GAAG,EAAE,aAAa;gBAClB,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,sBAAsB;gBAClC,SAAS,EAAE,sBAAsB;aAClC;SACF,CAAC;QACF,MAAM,OAAO,GAAG;YACd,MAAM;YACN,OAAO,EAAE;gBACP,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;gBACjC,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACrC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;gBACvC,EAAE,GAAG,EAAE,uBAAuB,EAAE,IAAI,EAAE,mBAAmB,EAAE;gBAC3D,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE;aACxD;YACD,qBAAqB,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;YACpF,SAAS,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE;gBAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACjD,OAAO,MAAM,CAAC;YAChB,CAAC;SACF,CAAC;QAEF,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAExC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;YACpC,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACxB,SAAS,EAAE;gBACT,YAAY,EAAE;oBACZ,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,CAAC,aAAa,CAAC;iBACvB;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,SAAS;oBACf,SAAS,EAAE,eAAe;iBAC3B;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,UAAU;oBAChB,SAAS,EAAE,UAAU;oBACrB,WAAW,EAAE,mBAAmB;iBACjC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/object-io.d.ts

@@ -13,8 +13,8 @@
  *   - `PresignObjectIO` — the presigned-URL path. The vault-service decides
  *     access as a runtime DDB check (no IAM policy ceiling) and hands back
  *     short-lived presigned GET/PUT/DELETE URLs + (for PUT) the exact headers
- *     to replay. The client never holds AWS credentials — it just `fetch`es
- *     the signed URLs.
+ *     to replay. The client never holds AWS credentials — it requests the
+ *     signed URLs directly.
  *
  * The seam is a per-EntityContext factory resolved INSIDE s3.ts, so every
  * existing call site (`uploadFile(ctx, …)`, `downloadFile(ctx, …)`, …) keeps
@@ -165,6 +165,23 @@ export declare class S3SdkObjectIO implements ObjectIO {
     deleteObject(key: string): Promise<void>;
     headObject(key: string): Promise<HeadObjectResult | null>;
 }
+/**
+ * Response shape shared by every presigned GET consumer. Unlike the runtime
+ * `fetch` response, its body is backed by Node's core HTTP client, so it never
+ * enters the runtime-bundled undici parser path.
+ */
+export interface PresignedGetResponse {
+    status: number;
+    headers: Headers;
+    body?: AsyncIterable<Uint8Array>;
+    destroy(): void;
+}
+/** Transport seam retained for deterministic wire-level regression tests. */
+export interface PresignedGetTransport {
+    get(url: string, headers: Record<string, string> | undefined): Promise<PresignedGetResponse>;
+}
+/** Test-only override; production always uses Node's core HTTP(S) transport. */
+export declare function setPresignedGetTransportForTesting(transport: PresignedGetTransport | null): void;
 /**
  * Opt-in gate for strict fail-closed enforcement of fenced presigned PUTs.
  *

package/dist/object-io.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"object-io.d.ts","sourceRoot":"","sources":["../src/object-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAG3B;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,KAAK,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,EAAE,CAAC,EAAE,SAAS,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,eAAe,EAAE,CAAC;KACzB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;CACJ;AAMD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,WAAW,CAAC,EAAE,GAAG,CAAC;CACnB;AAED,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAChC,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,gFAAgF;IAChF,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjD,eAAe,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC9D,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC1D;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACrC;AAqBD;;;;;GAKG;AACH,qBAAa,aAAc,YAAW,QAAQ;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,GAAG,EAAE,aAAa;IAwBxB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAsB3D,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAa5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAMhD,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAwBhE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAuBhE;AAoKD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,4BAA4B,CAAC;AAYtE;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,EAAE,EAAE,SAAS;gBADb,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,SAAS,EACtB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAQhC;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IAItD,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,eAAe;IAJ/C,QAAQ,CAAC,SAAS,QAAQ;gBAGf,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,GAAG,eAAe;CAKhD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAS;IACxB,SAAS,IAAI,OAAO;IAGpB,IAAI,IAAI,IAAI;CAGb;AAOD;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAgB,YAAW,QAAQ;IAK5C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;gBAG7C,KAAK,EAAE,sBAAsB,EAC7B,UAAU,EAAE,MAAM,EAGlB,OAAO,GAAE,gBAAyC;IAGrE,OAAO,CAAC,QAAQ;IAIhB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIlC,iEAAiE;IACjE,OAAO,CAAC,UAAU;IAWlB,wEAAwE;IACxE,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,gBAAgB;YAMV,aAAa;YA8Bb,oBAAoB;IAYlC;;;;OAIG;YACW,UAAU;IAwBxB,OAAO,CAAC,6BAA6B;IAwB/B,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgD5D,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA2C3D,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAoB5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAMhD,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAiBhE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAkFhE;AAyGD,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,QAAQ,CAAC;AAM/D;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,GAAG,IAAI,CAExE;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,QAAQ,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,sBAAsB,GAC5B,eAAe,CA4BjB"}
+{"version":3,"file":"object-io.d.ts","sourceRoot":"","sources":["../src/object-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAaH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAG3B;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,KAAK,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,EAAE,CAAC,EAAE,SAAS,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,eAAe,EAAE,CAAC;KACzB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;CACJ;AAMD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,WAAW,CAAC,EAAE,GAAG,CAAC;CACnB;AAED,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAChC,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,gFAAgF;IAChF,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjD,eAAe,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC9D,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC1D;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACrC;AAqBD;;;;;GAKG;AACH,qBAAa,aAAc,YAAW,QAAQ;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,GAAG,EAAE,aAAa;IAwBxB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAsB3D,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAa5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAMhD,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAwBhE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAuBhE;AAsBD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACjC,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,GAAG,CACD,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC1C,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AA8GD,gFAAgF;AAChF,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,qBAAqB,GAAG,IAAI,GACtC,IAAI,CAEN;AAgJD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,4BAA4B,CAAC;AAYtE;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,EAAE,EAAE,SAAS;gBADb,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,SAAS,EACtB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAQhC;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IAItD,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,eAAe;IAJ/C,QAAQ,CAAC,SAAS,QAAQ;gBAGf,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,GAAG,eAAe;CAKhD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAS;IACxB,SAAS,IAAI,OAAO;IAGpB,IAAI,IAAI,IAAI;CAGb;AAOD;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAgB,YAAW,QAAQ;IAK5C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;gBAG7C,KAAK,EAAE,sBAAsB,EAC7B,UAAU,EAAE,MAAM,EAGlB,OAAO,GAAE,gBAAyC;IAGrE,OAAO,CAAC,QAAQ;IAIhB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIlC,iEAAiE;IACjE,OAAO,CAAC,UAAU;IAWlB,wEAAwE;IACxE,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,gBAAgB;YAMV,aAAa;YA8Bb,oBAAoB;IAYlC;;;;OAIG;YACW,UAAU;IAwBxB,OAAO,CAAC,6BAA6B;IAwB/B,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgD5D,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA2C3D,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAqB5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAMhD,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAiBhE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAqFhE;AAgJD,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,QAAQ,CAAC;AAM/D;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,GAAG,IAAI,CAExE;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,QAAQ,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,sBAAsB,GAC5B,eAAe,CA4BjB"}

package/dist/object-io.js

@@ -13,8 +13,8 @@
  *   - `PresignObjectIO` — the presigned-URL path. The vault-service decides
  *     access as a runtime DDB check (no IAM policy ceiling) and hands back
  *     short-lived presigned GET/PUT/DELETE URLs + (for PUT) the exact headers
- *     to replay. The client never holds AWS credentials — it just `fetch`es
- *     the signed URLs.
+ *     to replay. The client never holds AWS credentials — it requests the
+ *     signed URLs directly.
  *
  * The seam is a per-EntityContext factory resolved INSIDE s3.ts, so every
  * existing call site (`uploadFile(ctx, …)`, `downloadFile(ctx, …)`, …) keeps
@@ -23,6 +23,8 @@
  * preserving today's behavior for every non-gated caller.
  */
 import { S3Client, PutObjectCommand, GetObjectCommand, ListObjectsV2Command, DeleteObjectCommand, HeadObjectCommand, } from "@aws-sdk/client-s3";
+import * as http from "node:http";
+import * as https from "node:https";
 import { VaultClientError } from "./vault-client.js";
 // ---------------------------------------------------------------------------
 // S3 SDK transport (default)
@@ -167,6 +169,107 @@ function metaFromHeaders(headers) {
     });
     return meta;
 }
+function headersFromNode(headers) {
+    const out = new Headers();
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined)
+            continue;
+        out.set(name, Array.isArray(value) ? value.join(", ") : value);
+    }
+    return out;
+}
+function expectedContentLength(headers) {
+    const value = headers.get("content-length");
+    if (value === null)
+        return undefined;
+    if (!/^\d+$/.test(value)) {
+        throw new Error(`invalid presigned GET content-length: ${value}`);
+    }
+    const length = Number(value);
+    if (!Number.isSafeInteger(length)) {
+        throw new Error(`invalid presigned GET content-length: ${value}`);
+    }
+    return length;
+}
+function contentLengthError(expected, actual) {
+    return new Error(`presigned GET content-length mismatch: expected ${expected} bytes, received ${actual}`);
+}
+async function* checkedNodeBody(message, expected) {
+    let received = 0;
+    let exhausted = false;
+    try {
+        try {
+            for await (const chunk of message) {
+                const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                received += bytes.byteLength;
+                if (expected !== undefined && received > expected) {
+                    throw contentLengthError(expected, received);
+                }
+                yield bytes;
+            }
+        }
+        catch (err) {
+            // A FIN before Node has received the declared bytes normally surfaces as
+            // an "aborted" stream error. Preserve the useful data-integrity cause.
+            if (expected !== undefined && received !== expected) {
+                throw contentLengthError(expected, received);
+            }
+            throw err;
+        }
+        exhausted = true;
+        if (expected !== undefined && received !== expected) {
+            throw contentLengthError(expected, received);
+        }
+    }
+    finally {
+        // Consumers such as HEAD only inspect headers, and a caller can stop after
+        // a prefix. Destroying in both cases releases the socket immediately.
+        if (!exhausted)
+            message.destroy();
+    }
+}
+function nodePresignedGet(url, headers) {
+    const target = new URL(url);
+    return new Promise((resolve, reject) => {
+        const handleResponse = (message) => {
+            const responseHeaders = headersFromNode(message.headers);
+            let expected;
+            try {
+                expected = expectedContentLength(responseHeaders);
+            }
+            catch (err) {
+                message.destroy();
+                reject(err);
+                return;
+            }
+            resolve({
+                status: message.statusCode ?? 0,
+                headers: responseHeaders,
+                body: checkedNodeBody(message, expected),
+                destroy: () => message.destroy(),
+            });
+        };
+        const request = target.protocol === "https:"
+            ? https.request(target, { method: "GET", headers }, handleResponse)
+            : target.protocol === "http:"
+                ? http.request(target, { method: "GET", headers }, handleResponse)
+                : undefined;
+        if (!request) {
+            reject(new Error(`unsupported presigned GET protocol: ${target.protocol}`));
+            return;
+        }
+        request.once("error", reject);
+        request.end();
+    });
+}
+const NODE_PRESIGNED_GET_TRANSPORT = {
+    get: nodePresignedGet,
+};
+let presignedGetTransport = NODE_PRESIGNED_GET_TRANSPORT;
+/** Test-only override; production always uses Node's core HTTP(S) transport. */
+export function setPresignedGetTransportForTesting(transport) {
+    presignedGetTransport = transport ?? NODE_PRESIGNED_GET_TRANSPORT;
+}
 /**
  * Per-key presign denial codes that are EXPECTED and must be reclassified as
  * skip-with-log — throwing the `name: "Forbidden"` shape (see
@@ -572,20 +675,17 @@ export class PresignObjectIO {
     }
     async getObjectStream(key) {
         const row = await this.resolveGetUrlForBody(key);
-        const res = await fetchWithRetry(row.url, { method: "GET" }, `presigned GET ${key}`);
+        const res = await presignedGetWithRetry(row.url, row.headers, `presigned GET ${key}`);
         if (res.status === 404) {
-            await cancelBody(res);
+            res.destroy();
             throw notFoundError(key);
         }
-        if (!res.ok) {
-            const detail = await safeText(res);
+        if (res.status < 200 || res.status >= 300) {
+            const detail = await safePresignedGetText(res);
             throw new Error(`presigned GET failed for ${key}: ${res.status} ${detail}`);
         }
-        if (!res.body) {
-            return { body: (async function* () { })(), metadata: metaFromHeaders(res.headers) };
-        }
         return {
-            body: webReadableToAsyncIterable(res.body),
+            body: res.body ?? (async function* () { })(),
             metadata: metaFromHeaders(res.headers),
         };
     }
@@ -673,9 +773,9 @@ export class PresignObjectIO {
             }
             url = row.url;
         }
-        const res = await fetchWithRetry(url, { method: "GET" }, `presigned HEAD ${key}`);
+        const res = await presignedGetWithRetry(url, undefined, `presigned HEAD ${key}`);
         if (res.status === 404) {
-            await cancelBody(res);
+            res.destroy();
             return null;
         }
         if (res.status === 403) {
@@ -684,12 +784,11 @@ export class PresignObjectIO {
             // denial branch above. The SDK transport throws name:"Forbidden" here;
             // mirror it so both transports agree and no caller mistakes a denial
             // for a missing object.
-            await cancelBody(res);
+            res.destroy();
             throw accessDeniedError(key, "presigned HEAD returned 403");
         }
-        if (!res.ok) {
-            await cancelBody(res);
-            const detail = await safeText(res);
+        if (res.status < 200 || res.status >= 300) {
+            const detail = await safePresignedGetText(res);
             throw new Error(`presigned HEAD failed for ${key}: ${res.status} ${detail}`);
         }
         const result = {
@@ -698,7 +797,7 @@ export class PresignObjectIO {
             size: Number(res.headers.get("content-length") ?? "0"),
             metadata: metaFromHeaders(res.headers),
         };
-        await cancelBody(res);
+        res.destroy();
         return result;
     }
 }
@@ -718,21 +817,6 @@ async function cancelBody(res) {
         // Best-effort — the socket is released either way once GC'd.
     }
 }
-async function* webReadableToAsyncIterable(stream) {
-    const reader = stream.getReader();
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                return;
-            if (value && value.byteLength > 0)
-                yield value;
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-}
 function parseLastModified(value) {
     if (!value)
         return new Date();
@@ -758,6 +842,58 @@ function isTransientStatus(status) {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+/**
+ * Shared presigned-GET path for streaming reads and header-only probes.
+ *
+ * GET deliberately uses Node core HTTP(S), not global fetch: on affected
+ * Node/Windows builds the bundled undici parser can assert after a FIN arrives
+ * while the consumer is backpressured. Keep the retry budget identical to the
+ * PUT/DELETE fetch path below.
+ */
+async function presignedGetWithRetry(url, headers, what) {
+    let lastError;
+    for (let attempt = 0; attempt <= FETCH_MAX_RETRIES; attempt++) {
+        if (attempt > 0) {
+            const backoff = FETCH_BASE_DELAY_MS * 2 ** (attempt - 1);
+            const jitter = Math.floor(Math.random() * FETCH_BASE_DELAY_MS);
+            await sleep(backoff + jitter);
+        }
+        let res;
+        try {
+            res = await presignedGetTransport.get(url, headers);
+        }
+        catch (err) {
+            lastError = err;
+            continue;
+        }
+        if (isTransientStatus(res.status) && attempt < FETCH_MAX_RETRIES) {
+            res.destroy();
+            lastError = new Error(`${what}: transient ${res.status}`);
+            continue;
+        }
+        return res;
+    }
+    throw lastError instanceof Error
+        ? lastError
+        : new Error(`${what}: failed after ${FETCH_MAX_RETRIES} retries`);
+}
+async function safePresignedGetText(res) {
+    try {
+        let text = "";
+        for await (const chunk of res.body ?? []) {
+            text += Buffer.from(chunk).toString("utf-8");
+            if (text.length >= 200)
+                break;
+        }
+        return text.slice(0, 200);
+    }
+    catch {
+        return "";
+    }
+    finally {
+        res.destroy();
+    }
+}
 /**
  * `fetch` with bounded retry on network errors + transient 5xx. The presigned
  * URL is reusable until expiry and the bodies are in-memory Buffers, so a