@indigoai-us/hq-cloud 6.15.0 → 6.15.2

package/src/sync/feature-flags.test.ts

@@ -1,378 +0,0 @@
-/**
- * US-008 — client push transport unit tests.
- *
- * The PRD names this file as the home for US-008's coverage; it spans the
- * four required assertions across the three US-008 modules:
- *
- *   1. flag gating          — feature-flags.ts (env list, legacy global,
- *                              static provider, malformed-entry tolerance)
- *   2. POST                 — push-transport.ts HttpPushTransport posts an
- *                              encoded PushEvent to `<apiUrl>/sync/push` with
- *                              a Bearer token (mocked fetch — no real server)
- *   3. emit                 — watcher.ts PushEventEmitter builds a valid
- *                              PushEvent (sha256 hash, monotonic seq, tenant)
- *                              per debounced change and hands it to the
- *                              transport; dormant when the flag is OFF
- *   4. transport failure    — a publish rejection (or hash error) is caught,
- *                              surfaced via onError, and never crashes / never
- *                              propagates (cadence poll is the safety net)
- *
- * The live `/sync/push` endpoint is NOT deployed yet — every POST is asserted
- * against a mocked fetch / mocked transport.
- */
-
-import { createHash } from "node:crypto";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-import {
-  EVENT_SYNC_LOCAL_DISABLE_ENV_VAR,
-  isEventSyncLocallyDisabled,
-} from "./feature-flags.js";
-import {
-  HttpPushTransport,
-  NoopPushTransport,
-  type FetchLike,
-  type PushTransport,
-} from "./push-transport.js";
-import { decodePushEvent, type PushEvent } from "./push-event.js";
-import { PushEventEmitter } from "../watcher.js";
-import type { TreeChangeBatch } from "../watcher.js";
-
-// ─── Helpers ─────────────────────────────────────────────────────────────────
-
-function fakePushEvent(overrides: Partial<PushEvent> = {}): PushEvent {
-  return {
-    relativePath: "personal/notes/a.md",
-    kind: "upsert",
-    contentHash: `sha256:${"a".repeat(64)}`,
-    mtime: "2026-05-21T12:00:00.000Z",
-    originDeviceId: "device-1",
-    originTenantId: "indigo",
-    sequenceNumber: 0,
-    eventTimestamp: "2026-05-21T12:00:01.000Z",
-    ...overrides,
-  };
-}
-
-/** A fetch double that records calls and returns a configurable response. */
-function makeFetch(
-  res: { ok: boolean; status: number; body?: string } = {
-    ok: true,
-    status: 200,
-  },
-): { fetch: FetchLike; calls: Array<{ url: string; init: unknown }> } {
-  const calls: Array<{ url: string; init: unknown }> = [];
-  const fetch: FetchLike = async (url, init) => {
-    calls.push({ url, init });
-    return {
-      ok: res.ok,
-      status: res.status,
-      text: async () => res.body ?? "",
-    };
-  };
-  return { fetch, calls };
-}
-
-// ─── 1. Local disable (feature-flags.ts) ─────────────────────────────────────
-
-const serverGranted = { isEnabled: () => true };
-const serverDenied = { isEnabled: () => false };
-
-describe("Event sync local control", () => {
-  it("exports only the local disable control", () => {
-    expect(EVENT_SYNC_LOCAL_DISABLE_ENV_VAR).toBe("HQ_SYNC_EVENT_SYNC");
-  });
-
-  it.each(["0", "false", "no", "off", " OFF "])(
-    "recognizes %j as a local disable",
-    (value) => expect(isEventSyncLocallyDisabled(value)).toBe(true),
-  );
-
-  it.each([undefined, "", "1", "true", "yes", "on", "indigo,acme"])(
-    "%j does not grant authority",
-    (value) => expect(isEventSyncLocallyDisabled(value)).toBe(false),
-  );
-});
-
-// ─── 2. POST (HttpPushTransport) ──────────────────────────────────────────────
-
-describe("HttpPushTransport — POST /sync/push", () => {
-  it("POSTs an encoded PushEvent to <apiUrl>/sync/push with a Bearer token", async () => {
-    const { fetch, calls } = makeFetch({ ok: true, status: 200 });
-    const transport = new HttpPushTransport({
-      apiUrl: "https://vault-api.example.com/",
-      authToken: "tok-123",
-      fetchImpl: fetch,
-    });
-    await transport.start();
-    expect(transport.connected).toBe(true);
-
-    const event = fakePushEvent();
-    await transport.publish(event);
-
-    expect(calls).toHaveLength(1);
-    const call = calls[0];
-    // Trailing slash on apiUrl is normalized; default path is /sync/push.
-    expect(call.url).toBe("https://vault-api.example.com/sync/push");
-    const init = call.init as {
-      method: string;
-      headers: Record<string, string>;
-      body: string;
-    };
-    expect(init.method).toBe("POST");
-    expect(init.headers.Authorization).toBe("Bearer tok-123");
-    expect(init.headers["Content-Type"]).toBe("application/json");
-    // Body is a valid encoded PushEvent that round-trips.
-    expect(decodePushEvent(init.body)).toEqual(event);
-  });
-
-  it("POSTs a delete tombstone without contentHash or mtime", async () => {
-    const { fetch, calls } = makeFetch({ ok: true, status: 200 });
-    const transport = new HttpPushTransport({
-      apiUrl: "https://vault-api.example.com/",
-      authToken: "tok-123",
-      fetchImpl: fetch,
-    });
-    const event = fakePushEvent({
-      kind: "delete",
-      contentHash: undefined,
-      mtime: undefined,
-    });
-
-    await transport.publish(event);
-
-    expect(calls).toHaveLength(1);
-    const body = (calls[0].init as { body: string }).body;
-    expect(JSON.parse(body)).toEqual({
-      relativePath: "personal/notes/a.md",
-      kind: "delete",
-      originDeviceId: "device-1",
-      originTenantId: "indigo",
-      sequenceNumber: 0,
-      eventTimestamp: "2026-05-21T12:00:01.000Z",
-    });
-    expect(decodePushEvent(body)).toEqual(JSON.parse(body));
-  });
-
-  it("resolves the auth token per-request via an async getter (self-heals across refresh)", async () => {
-    const { fetch, calls } = makeFetch();
-    let n = 0;
-    const transport = new HttpPushTransport({
-      apiUrl: "https://api.example.com",
-      authToken: () => `tok-${n++}`,
-      fetchImpl: fetch,
-    });
-    await transport.publish(fakePushEvent());
-    await transport.publish(fakePushEvent());
-    expect((calls[0].init as any).headers.Authorization).toBe("Bearer tok-0");
-    expect((calls[1].init as any).headers.Authorization).toBe("Bearer tok-1");
-  });
-
-  it("honors a custom pushPath + extra headers", async () => {
-    const { fetch, calls } = makeFetch();
-    const transport = new HttpPushTransport({
-      apiUrl: "https://api.example.com",
-      pushPath: "v1/sync/push",
-      authToken: "t",
-      headers: { "x-hq-client-name": "hq-sync-runner" },
-      fetchImpl: fetch,
-    });
-    await transport.publish(fakePushEvent());
-    expect(calls[0].url).toBe("https://api.example.com/v1/sync/push");
-    expect((calls[0].init as any).headers["x-hq-client-name"]).toBe(
-      "hq-sync-runner",
-    );
-  });
-
-  it("rejects when apiUrl is missing", () => {
-    expect(
-      () => new HttpPushTransport({ apiUrl: "", authToken: "t" }),
-    ).toThrow(/apiUrl is required/);
-  });
-
-  it("rejects (does not swallow) on a non-2xx response", async () => {
-    const { fetch } = makeFetch({ ok: false, status: 403, body: "forbidden" });
-    const transport = new HttpPushTransport({
-      apiUrl: "https://api.example.com",
-      authToken: "t",
-      fetchImpl: fetch,
-    });
-    await expect(transport.publish(fakePushEvent())).rejects.toThrow(/403/);
-  });
-
-  it("rejects on a malformed event before hitting the network", async () => {
-    const { fetch, calls } = makeFetch();
-    const transport = new HttpPushTransport({
-      apiUrl: "https://api.example.com",
-      authToken: "t",
-      fetchImpl: fetch,
-    });
-    await expect(
-      transport.publish(fakePushEvent({ contentHash: "not-a-hash" })),
-    ).rejects.toBeTruthy();
-    expect(calls).toHaveLength(0);
-  });
-});
-
-// ─── 3 + 4. Emit + gating + failure handling (PushEventEmitter) ───────────────
-
-describe("PushEventEmitter — emit, gating, failure handling", () => {
-  let dir: string;
-  let filePath: string;
-  const REL = "a.md";
-
-  beforeEach(() => {
-    dir = mkdtempSync(path.join(tmpdir(), "us008-"));
-    filePath = path.join(dir, REL);
-    writeFileSync(filePath, "hello world");
-  });
-
-  afterEach(() => {
-    rmSync(dir, { recursive: true, force: true });
-  });
-
-  function batchFor(...rels: string[]): TreeChangeBatch {
-    const paths = new Map<string, string>();
-    for (const rel of rels) paths.set(path.join(dir, rel), rel);
-    return { paths };
-  }
-
-  it("emits a valid PushEvent (sha256 hash, tenant) per changed path and ships it", async () => {
-    const transport = new NoopPushTransport();
-    const published: PushEvent[] = [];
-    const spyTransport: PushTransport = {
-      start: () => transport.start(),
-      dispose: () => transport.dispose(),
-      get connected() {
-        return transport.connected;
-      },
-      publish: async (e) => {
-        published.push(e);
-      },
-    };
-    const emitter = new PushEventEmitter({
-      originTenantId: "indigo",
-      originDeviceId: "dev-1",
-      transport: spyTransport,
-      flagProvider: serverGranted,
-      now: () => new Date("2026-05-21T00:00:00.000Z"),
-    });
-
-    await emitter.emitForBatch(batchFor(REL));
-
-    expect(published).toHaveLength(1);
-    const e = published[0];
-    expect(e.relativePath).toBe(REL);
-    expect(e.kind).toBe("upsert");
-    expect(e.originTenantId).toBe("indigo");
-    expect(e.originDeviceId).toBe("dev-1");
-    const expectedHex = createHash("sha256").update("hello world").digest("hex");
-    expect(e.contentHash).toBe(`sha256:${expectedHex}`);
-    // Round-trips through the wire contract.
-    expect(() => decodePushEvent(e)).not.toThrow();
-  });
-
-  it("assigns monotonic per-device sequence numbers across emits", async () => {
-    const published: PushEvent[] = [];
-    const emitter = new PushEventEmitter({
-      originTenantId: "indigo",
-      originDeviceId: "dev-1",
-      transport: { start: async () => {}, dispose: async () => {}, connected: true, publish: async (e) => { published.push(e); } },
-      flagProvider: serverGranted,
-    });
-    writeFileSync(path.join(dir, "b.md"), "second");
-    await emitter.emitForBatch(batchFor(REL));
-    await emitter.emitForBatch(batchFor("b.md"));
-    expect(published.map((e) => e.sequenceNumber)).toEqual([0, 1]);
-  });
-
-  it("is DORMANT when the flag is OFF: ships nothing, attach is a no-op", async () => {
-    const publish = vi.fn(async () => {});
-    const emitter = new PushEventEmitter({
-      originTenantId: "indigo",
-      originDeviceId: "dev-1",
-      transport: { start: async () => {}, dispose: async () => {}, connected: false, publish },
-      flagProvider: serverDenied, // indigo NOT enabled
-    });
-    expect(emitter.enabled).toBe(false);
-    await emitter.emitForBatch(batchFor(REL));
-    expect(publish).not.toHaveBeenCalled();
-    // attach returns a callable no-op when dormant.
-    const fakeWatcher = { onChange: vi.fn() } as any;
-    const off = emitter.attach(fakeWatcher);
-    expect(fakeWatcher.onChange).not.toHaveBeenCalled();
-    expect(() => off()).not.toThrow();
-  });
-
-  it("transport publish failure is caught + surfaced, never throws (cadence safety net)", async () => {
-    const onError = vi.fn();
-    const emitter = new PushEventEmitter({
-      originTenantId: "indigo",
-      originDeviceId: "dev-1",
-      transport: {
-        start: async () => {},
-        dispose: async () => {},
-        connected: true,
-        publish: async () => {
-          throw new Error("network down");
-        },
-      },
-      flagProvider: serverGranted,
-      onError,
-    });
-    // Must not reject — the daemon stays alive.
-    await expect(emitter.emitForBatch(batchFor(REL))).resolves.toBeUndefined();
-    expect(onError).toHaveBeenCalledTimes(1);
-    expect(onError.mock.calls[0][0]).toBeInstanceOf(Error);
-    expect(onError.mock.calls[0][1]).toMatchObject({ relativePath: REL });
-  });
-
-  it("a missing file emits a delete tombstone, and other paths still ship", async () => {
-    const published: PushEvent[] = [];
-    const onError = vi.fn();
-    const emitter = new PushEventEmitter({
-      originTenantId: "indigo",
-      originDeviceId: "dev-1",
-      transport: { start: async () => {}, dispose: async () => {}, connected: true, publish: async (e) => { published.push(e); } },
-      flagProvider: serverGranted,
-      onError,
-    });
-    // REL exists; "ghost.md" does not.
-    await emitter.emitForBatch(batchFor(REL, "ghost.md"));
-    expect(published.map((e) => e.relativePath).sort()).toEqual([
-      REL,
-      "ghost.md",
-    ].sort());
-    const tombstone = published.find((e) => e.relativePath === "ghost.md");
-    expect(tombstone).toMatchObject({ kind: "delete" });
-    expect(tombstone).not.toHaveProperty("contentHash");
-    expect(tombstone).not.toHaveProperty("mtime");
-    expect(onError).not.toHaveBeenCalled();
-  });
-
-  it("end-to-end: emit → HttpPushTransport POST with a valid schema (mocked fetch)", async () => {
-    const { fetch, calls } = makeFetch({ ok: true, status: 200 });
-    const transport = new HttpPushTransport({
-      apiUrl: "https://api.example.com",
-      authToken: "tok",
-      fetchImpl: fetch,
-    });
-    const emitter = new PushEventEmitter({
-      originTenantId: "indigo",
-      originDeviceId: "dev-1",
-      transport,
-      flagProvider: serverGranted,
-    });
-    await transport.start();
-    await emitter.emitForBatch(batchFor(REL));
-
-    expect(calls).toHaveLength(1);
-    expect(calls[0].url).toBe("https://api.example.com/sync/push");
-    const posted = decodePushEvent((calls[0].init as any).body);
-    expect(posted.relativePath).toBe(REL);
-    expect(posted.originTenantId).toBe("indigo");
-  });
-});

package/src/sync/feature-flags.ts

@@ -1,62 +0,0 @@
-/**
- * Local control for the dormant event-sync wiring.
- *
- * U15 removes client-side positive selectors. Environment values, tenant IDs,
- * and cached identity cannot grant authority; the authenticated server
- * inventory is the sole positive authority. This module preserves only the
- * operator's local off-switch.
- */
-
-/** A local-only kill switch. Any other value is deliberately non-authorizing. */
-export const EVENT_SYNC_LOCAL_DISABLE_ENV_VAR = "HQ_SYNC_EVENT_SYNC";
-
-/**
- * Compatibility seam consumed by the existing emitter. Production event-sync
- * supplies it only after authenticated server inventory has granted access.
- */
-export interface EventDrivenPushFlagProvider {
-  isEnabled(scopeId: string): boolean;
-}
-
-/** Deprecated inert compatibility shape; no environment is ever read. */
-export type FlagProviderWarnFn = (
-  message: string,
-  context: Record<string, unknown>,
-) => void;
-
-/** Deprecated inert compatibility shape; no environment is ever read. */
-export interface EnvTenantListFlagProviderOptions {
-  env?: Record<string, string | undefined>;
-  warn?: FlagProviderWarnFn;
-}
-
-/**
- * Compatibility fixture for older direct emitter tests. It represents a
- * previously authenticated server inventory result; the supplied legacy value
- * is deliberately ignored, so it cannot select a tenant or grant by email.
- */
-export class StaticFlagProvider implements EventDrivenPushFlagProvider {
-  constructor(_authenticatedLegacyInventory: unknown) {}
-
-  isEnabled(_scopeId: string): boolean {
-    return true;
-  }
-}
-
-/**
- * Returns true only for an explicit local disable value. Values such as
- * `true`, `1`, a tenant list, or an unrecognized string never enable sync.
- */
-export function isEventSyncLocallyDisabled(
-  value: string | undefined,
-): boolean {
-  switch ((value ?? "").trim().toLowerCase()) {
-    case "0":
-    case "false":
-    case "no":
-    case "off":
-      return true;
-    default:
-      return false;
-  }
-}

package/src/sync/index.ts

@@ -1,76 +0,0 @@
-/**
- * @indigoai-us/hq-cloud — event-driven sync (`src/sync`) barrel.
- *
- * Surfaces the PushEvent wire contract + the PushTransport shipping seam
- * ported from hq-pro PR #112 (project event-driven-sync-menubar US-007).
- */
-
-export {
-  CONTENT_HASH_PATTERN,
-  ISO8601_DATETIME_PATTERN,
-  PushEventSchema,
-  PushEventDecodeError,
-  encodePushEvent,
-  decodePushEvent,
-} from "./push-event.js";
-export type {
-  PushEvent,
-  PushEventInput,
-  PushEventDecodeIssue,
-} from "./push-event.js";
-
-export { NoopPushTransport, HttpPushTransport } from "./push-transport.js";
-export type {
-  PushTransport,
-  HttpPushTransportOptions,
-  AuthTokenSource,
-  FetchLike,
-} from "./push-transport.js";
-
-export {
-  EVENT_SYNC_LOCAL_DISABLE_ENV_VAR,
-  isEventSyncLocallyDisabled,
-  StaticFlagProvider,
-} from "./feature-flags.js";
-export type {
-  EventDrivenPushFlagProvider,
-  FlagProviderWarnFn,
-  EnvTenantListFlagProviderOptions,
-} from "./feature-flags.js";
-
-export {
-  NoopPushReceiver,
-  SqsPushReceiver,
-  InMemoryFanout,
-  InMemoryPushReceiver,
-  createPushReceiver,
-  DEFAULT_RECEIVER_DISPOSE_DRAIN_MS,
-  DEFAULT_WAIT_TIME_SECONDS,
-  DEFAULT_MAX_MESSAGES,
-} from "./push-receiver.js";
-export type {
-  PushReceiver,
-  PushReceiverContext,
-  SyncEngineFn,
-  PublishMetricFn,
-  ReceiverLogger,
-  SqsClientLike,
-  SqsMessageLike,
-  SqsPushReceiverOptions,
-  InMemoryPushReceiverOptions,
-  CreatePushReceiverOptions,
-} from "./push-receiver.js";
-
-export {
-  SYNC_METRIC_NAMESPACE,
-  SYNC_LATENCY_METRIC_NAME,
-  _setSyncCloudWatchClient,
-  publishSyncLatencyMetric,
-} from "./metrics.js";
-export type {
-  SyncLatencyMetric,
-  PublishSyncLatencyMetricOptions,
-} from "./metrics.js";
-
-export { createLogger } from "./logger.js";
-export type { CreateLoggerOptions, Logger } from "./logger.js";

package/src/sync/lease-client.test.ts

@@ -1,128 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-
-import { RealtimeLeaseClient, RealtimePassAuthorizer } from "./lease-client.js";
-import { RealtimeRolloutClient, type RealtimeCapabilityVector } from "./realtime-rollout.js";
-
-const capability: RealtimeCapabilityVector = {
-  hqCloud: "6.14.49",
-  hqDesktop: "none",
-  protocol: 2,
-  journal: 3,
-  durableApply: 1,
-};
-
-function jsonResponse(body: unknown, status = 200) {
-  return { ok: status >= 200 && status < 300, status, text: async () => JSON.stringify(body) };
-}
-
-describe("RealtimeLeaseClient", () => {
-  it("uses the pass bearer and rejects a lease longer than sixty seconds", async () => {
-    let received: { method?: string; headers?: Record<string, string> } | undefined;
-    const fetchImpl = async (_url: string, init?: { method?: string; headers?: Record<string, string> }) => {
-      received = init;
-      return jsonResponse({
-        lease: "lease_1",
-        issuedAt: "2026-08-12T00:00:00.000Z",
-        expiresAt: "2026-08-12T00:01:01.000Z",
-        authorizationEpoch: "epoch_1",
-      });
-    };
-    const client = new RealtimeLeaseClient({ apiUrl: "https://api.example", fetchImpl, now: () => Date.parse("2026-08-12T00:00:00.000Z") });
-
-    await expect(client.issue({ bearer: "token-a", deviceId: "machine_a", capabilityVector: capability, scopeHandle: "handle_1", scopeRevision: "rev_1" })).rejects.toThrow("invalid lease lifetime");
-    expect(received).toMatchObject({
-      method: "POST",
-      headers: expect.objectContaining({ Authorization: "Bearer token-a", "X-HQ-Sync-Contract": "2" }),
-    });
-  });
-
-  it("rejects a lease issued too far into the future", async () => {
-    const fetchImpl = async () => jsonResponse({
-      lease: "lease_1",
-      issuedAt: "2026-08-12T00:00:06.000Z",
-      expiresAt: "2026-08-12T00:01:00.000Z",
-      authorizationEpoch: "epoch_1",
-    });
-    const client = new RealtimeLeaseClient({ apiUrl: "https://api.example", fetchImpl, now: () => Date.parse("2026-08-12T00:00:00.000Z") });
-    await expect(client.issue({ bearer: "token-a", deviceId: "machine_a", capabilityVector: capability, scopeHandle: "handle_1", scopeRevision: "rev_1" })).rejects.toThrow("invalid lease lifetime");
-  });
-
-  it("resolves one bearer and freshly leases every selected scope before I/O", async () => {
-    const now = Date.parse("2026-08-12T00:00:00.000Z");
-    const requests: Array<{ headers?: Record<string, string> }> = [];
-    const fetchImpl = async (url: string, init?: { headers?: Record<string, string> }) => {
-      requests.push({ headers: init?.headers });
-      if (url.endsWith("/scopes")) {
-        return jsonResponse({ scopes: [
-          { scopeUid: "prs_1", scopeHandle: "handle_1", scopeRevision: "rev_1", state: "v2-ready", cursor: "cursor_1" },
-          { scopeUid: "cmp_1", scopeHandle: "handle_2", scopeRevision: "rev_2", state: "v2-ready", cursor: "cursor_2" },
-        ] });
-      }
-      return jsonResponse({
-        lease: "lease_issued",
-        issuedAt: "2026-08-12T00:00:00.000Z",
-        expiresAt: "2026-08-12T00:01:00.000Z",
-        authorizationEpoch: "epoch_1",
-      }, 201);
-    };
-    const token = vi.fn(async () => "token-a");
-    const inventory = new RealtimeRolloutClient({ apiUrl: "https://api.example", fetchImpl, now: () => now });
-    const leases = new RealtimeLeaseClient({ apiUrl: "https://api.example", fetchImpl, now: () => now });
-    const authorizer = new RealtimePassAuthorizer(token, inventory, leases);
-    const operation = vi.fn(async () => "done");
-
-    await expect(authorizer.runBeforeIo({
-      deviceId: "machine_a",
-      capabilityVector: capability,
-      configurationFingerprint: "config-a",
-      scopeFingerprint: "prs_1,cmp_1",
-      scopeUids: ["prs_1", "cmp_1"],
-    }, operation)).resolves.toBe("done");
-
-    expect(token).toHaveBeenCalledTimes(1);
-    expect(requests).toHaveLength(3);
-    for (const call of requests) expect(call.headers?.Authorization).toBe("Bearer token-a");
-    expect(operation).toHaveBeenCalledTimes(1);
-  });
-
-  it("does not invoke I/O when inventory loses a requested scope", async () => {
-    const fetchImpl = vi.fn(async () => jsonResponse({ scopes: [
-      { scopeUid: "prs_1", scopeHandle: "handle_1", scopeRevision: "rev_1", state: "paused", reasonCode: "maintenance" },
-    ] }));
-    const inventory = new RealtimeRolloutClient({ apiUrl: "https://api.example", fetchImpl });
-    const leases = new RealtimeLeaseClient({ apiUrl: "https://api.example", fetchImpl });
-    const authorizer = new RealtimePassAuthorizer("token-a", inventory, leases);
-    const operation = vi.fn(async () => undefined);
-
-    await expect(authorizer.runBeforeIo({
-      deviceId: "machine_a", capabilityVector: capability, configurationFingerprint: "config-a", scopeFingerprint: "prs_1", scopeUids: ["prs_1"],
-    }, operation)).rejects.toThrow("does not authorize every requested scope");
-    expect(operation).not.toHaveBeenCalled();
-  });
-
-  it("does not invoke I/O when parallel lease issues disagree on epoch", async () => {
-    let leaseCalls = 0;
-    const fetchImpl = async (url: string) => {
-      if (url.endsWith("/scopes")) return jsonResponse({ scopes: [
-        { scopeUid: "prs_1", scopeHandle: "handle_1", scopeRevision: "rev_1", state: "v2-ready", cursor: "cursor_1" },
-        { scopeUid: "cmp_1", scopeHandle: "handle_2", scopeRevision: "rev_2", state: "v2-ready", cursor: "cursor_2" },
-      ] });
-      leaseCalls += 1;
-      return jsonResponse({
-        lease: `lease_${leaseCalls}`,
-        issuedAt: "2026-08-12T00:00:00.000Z",
-        expiresAt: "2026-08-12T00:00:30.000Z",
-        authorizationEpoch: `epoch_${leaseCalls}`,
-      }, 201);
-    };
-    const now = () => Date.parse("2026-08-12T00:00:00.000Z");
-    const inventory = new RealtimeRolloutClient({ apiUrl: "https://api.example", fetchImpl, now });
-    const leases = new RealtimeLeaseClient({ apiUrl: "https://api.example", fetchImpl, now });
-    const authorizer = new RealtimePassAuthorizer("token-a", inventory, leases);
-    const operation = vi.fn(async () => undefined);
-    await expect(authorizer.runBeforeIo({
-      deviceId: "machine_a", capabilityVector: capability, configurationFingerprint: "config-a", scopeFingerprint: "all", scopeUids: ["prs_1", "cmp_1"],
-    }, operation)).rejects.toThrow("leases disagree on authorization epoch");
-    expect(operation).not.toHaveBeenCalled();
-  });
-});