@indigoai-us/hq-cloud 6.15.0 → 6.15.2

package/src/object-io.ts

@@ -1,1306 +0,0 @@
-/**
- * ObjectIO — transport seam for vault object byte/metadata movement.
- *
- * s3.ts holds the *semantics* of sync (symlink-record encoding, mode/mtime
- * stamping, created-at preservation, directory-marker filtering). Those never
- * change. What CAN change is the *wire transport* underneath them:
- *
- *   - `S3SdkObjectIO` — the historical path. STS-vended credentials + the AWS
- *     S3 SDK talking directly to the per-company bucket. No policy-size
- *     ceiling concern for the BYTES, but the STS session policy that grants
- *     access has the 2048-char IAM limit that motivated the presigned model.
- *
- *   - `PresignObjectIO` — the presigned-URL path. The vault-service decides
- *     access as a runtime DDB check (no IAM policy ceiling) and hands back
- *     short-lived presigned GET/PUT/DELETE URLs + (for PUT) the exact headers
- *     to replay. The client never holds AWS credentials — it requests the
- *     signed URLs directly.
- *
- * The seam is a per-EntityContext factory resolved INSIDE s3.ts, so every
- * existing call site (`uploadFile(ctx, …)`, `downloadFile(ctx, …)`, …) keeps
- * its signature. `runRunner` selects the transport once per session via
- * {@link setObjectIOFactory}; absent any selection the default is the S3 SDK,
- * preserving today's behavior for every non-gated caller.
- */
-
-import {
-  S3Client,
-  PutObjectCommand,
-  GetObjectCommand,
-  ListObjectsV2Command,
-  DeleteObjectCommand,
-  HeadObjectCommand,
-} from "@aws-sdk/client-s3";
-import * as http from "node:http";
-import * as https from "node:https";
-import type { IncomingMessage } from "node:http";
-import type { EntityContext } from "./types.js";
-import type {
-  PresignOp,
-  PresignKeyInput,
-  PresignResultRow,
-  VaultListedObject,
-} from "./vault-client.js";
-import { VaultClientError } from "./vault-client.js";
-
-/**
- * The slice of {@link VaultClient} the presigned transport needs. Narrowed to
- * just `presign` + `listFiles` so the factory accepts any caller that exposes
- * those two (the real VaultClient, or a stub in tests) without depending on
- * the full 20-method surface.
- */
-export interface PresignTransportClient {
-  presign(input: {
-    companyUid: string;
-    op?: PresignOp;
-    expiresIn?: number;
-    keys: PresignKeyInput[];
-  }): Promise<{ results: PresignResultRow[]; expiresAt: string }>;
-  listFiles(
-    companyUid: string,
-    prefix?: string,
-    cursor?: string,
-  ): Promise<{
-    objects: VaultListedObject[];
-    cursor: string | null;
-    truncated: boolean;
-  }>;
-}
-
-// ---------------------------------------------------------------------------
-// Wire-primitive shapes
-// ---------------------------------------------------------------------------
-
-/**
- * Conditional-write fence for a PUT (S3 conditional writes, GA 2024-11).
- *
- * `ifMatch` — only land the PUT if the remote object's ETag still equals
- * this value (the journal baseline / last-observed HEAD). `ifNoneMatch: "*"`
- * — only land the PUT if NO object exists at the key (creation fence).
- * Either mismatch makes S3 reject with 412 PreconditionFailed, which the
- * push path surfaces as a conflict instead of a silent overwrite.
- *
- * This is the storage-level backstop for the entire stale-clobber class:
- * a HEAD-then-PUT race, a transport bug that misreads remote state, or an
- * outdated client mid-pass can no longer regress a newer remote object —
- * S3 itself refuses. (The 2026-06-10..12 vault regression storm was this
- * class: stale machine copies blind-PUT over newer objects.)
- */
-export interface PutPrecondition {
-  /** Land only if the current remote ETag equals this (quotes optional). */
-  ifMatch?: string;
-  /** Land only if no object exists at the key. */
-  ifNoneMatch?: "*";
-}
-
-export interface PutObjectInput extends PutPrecondition {
-  key: string;
-  body: Buffer;
-  contentType: string;
-  /** S3 user metadata (x-amz-meta-*). Lowercased keys by convention. */
-  metadata?: Record<string, string>;
-}
-
-export interface GetObjectResult {
-  body: Buffer;
-  /** S3 user metadata (keys lowercased by S3). */
-  metadata?: Record<string, string>;
-}
-
-export interface GetObjectStreamResult {
-  body: AsyncIterable<Uint8Array>;
-  /** S3 user metadata (keys lowercased by S3). */
-  metadata?: Record<string, string>;
-}
-
-export interface ListObjectsInput {
-  prefix?: string;
-  continuationToken?: string;
-}
-
-export interface ListedRemoteObject {
-  key: string;
-  size: number;
-  lastModified: Date;
-  etag: string;
-}
-
-export interface ListObjectsResult {
-  objects: ListedRemoteObject[];
-  /** Opaque cursor for the next page; undefined when the listing is exhausted. */
-  nextContinuationToken?: string;
-}
-
-export interface HeadObjectResult {
-  lastModified: Date;
-  etag: string;
-  size: number;
-  metadata?: Record<string, string>;
-}
-
-/**
- * The minimal byte/metadata transport s3.ts needs. Deliberately narrow — no
- * symlink, mode, or created-at concepts leak in here; those live one layer up
- * in s3.ts and compose on top of these five primitives.
- */
-export interface ObjectIO {
-  putObject(input: PutObjectInput): Promise<{ etag: string }>;
-  getObject(key: string): Promise<GetObjectResult>;
-  getObjectStream?(key: string): Promise<GetObjectStreamResult>;
-  listObjects(input: ListObjectsInput): Promise<ListObjectsResult>;
-  deleteObject(key: string): Promise<void>;
-  /**
-   * Null ONLY when the key definitively does not exist (404). Access denial
-   * (403 / per-key presign denial) THROWS a `name: "Forbidden"` error — it is
-   * unknown state, never "absent". Conflating the two disables push-side
-   * conflict guards and clobbers newer remote objects.
-   */
-  headObject(key: string): Promise<HeadObjectResult | null>;
-  /**
-   * Optional batch pre-mint. Warms an internal URL cache for `keys` under `op`
-   * so subsequent per-key get/head (and, when primed, put/delete) calls reuse a
-   * pre-signed URL instead of issuing one presign request each. This is what
-   * turns an N-file sync from N presign calls into ceil(N/chunk) — the
-   * difference between staying under and blowing past the 100-req/hr limit on a
-   * bulk pull. The S3 SDK transport has no presign step and omits this (the
-   * per-call cost there is the SDK request itself, not a separate presign).
-   * Best-effort: a failed chunk or per-key denial simply leaves those keys
-   * uncached, and the per-key call falls back to a single presign.
-   */
-  prime?(op: PresignOp, keys: PresignKeyInput[]): Promise<void>;
-  /**
-   * True if a live primed PUT URL exists for `key`. Lets uploadFile/uploadSymlink
-   * skip recomputing metadata + the created-at HEAD when a `prime("put", …)`
-   * pre-pass already signed the metadata into the cached URL (the upload just
-   * sends the body, replaying the cached headers). Absent (undefined) on the S3
-   * SDK transport → callers take their normal compute-metadata path.
-   */
-  hasPrimedPut?(key: string): boolean;
-}
-
-// ---------------------------------------------------------------------------
-// S3 SDK transport (default)
-// ---------------------------------------------------------------------------
-
-function stripQuotes(etag: string | undefined): string {
-  return etag ? etag.replace(/^"|"$/g, "") : "";
-}
-
-async function drainToBuffer(
-  body: AsyncIterable<Uint8Array> | undefined,
-): Promise<Buffer> {
-  if (!body) return Buffer.alloc(0);
-  const chunks: Buffer[] = [];
-  for await (const chunk of body) {
-    chunks.push(Buffer.from(chunk));
-  }
-  return Buffer.concat(chunks);
-}
-
-/**
- * Direct-to-S3 transport over STS-vended credentials. A fresh client per
- * instance so the latest credentials from the EntityContext are always used
- * (caching/refresh is the caller's concern, at the EntityContext level — see
- * the original buildClient note in s3.ts).
- */
-export class S3SdkObjectIO implements ObjectIO {
-  private readonly client: S3Client;
-  private readonly bucket: string;
-
-  constructor(ctx: EntityContext) {
-    this.bucket = ctx.bucketName;
-    if (!ctx.credentials) {
-      // A credential-less context only exists on the presign path (HQ-59
-      // company vaults skip the STS vend). Such a context must route through
-      // PresignObjectIO, never here — reaching the direct-S3 transport with no
-      // creds is a routing bug, so fail loudly instead of building a broken
-      // S3 client that would later 403 with an opaque AWS error.
-      throw new Error(
-        `S3SdkObjectIO requires STS credentials but got a presign-only ` +
-          `context for ${ctx.uid}; company presign contexts must use ` +
-          `PresignObjectIO. This is a transport-routing bug.`,
-      );
-    }
-    this.client = new S3Client({
-      region: ctx.region,
-      credentials: {
-        accessKeyId: ctx.credentials.accessKeyId,
-        secretAccessKey: ctx.credentials.secretAccessKey,
-        sessionToken: ctx.credentials.sessionToken,
-      },
-    });
-  }
-
-  async putObject(input: PutObjectInput): Promise<{ etag: string }> {
-    const res = await this.client.send(
-      new PutObjectCommand({
-        Bucket: this.bucket,
-        Key: input.key,
-        Body: input.body,
-        ContentType: input.contentType,
-        ...(input.metadata && Object.keys(input.metadata).length > 0
-          ? { Metadata: input.metadata }
-          : {}),
-        // Conditional-write fence. If-Match wants the quoted entity-tag form;
-        // callers hand us journal/HEAD etags that may be stripped — re-quote
-        // so both shapes fence identically. A mismatch surfaces as the SDK's
-        // name:"PreconditionFailed" (HTTP 412), which the push path maps to
-        // its conflict flow.
-        ...(input.ifMatch ? { IfMatch: quoteEtag(input.ifMatch) } : {}),
-        ...(input.ifNoneMatch ? { IfNoneMatch: input.ifNoneMatch } : {}),
-      }),
-    );
-    return { etag: res.ETag || "" };
-  }
-
-  async getObjectStream(key: string): Promise<GetObjectStreamResult> {
-    const res = await this.client.send(
-      new GetObjectCommand({ Bucket: this.bucket, Key: key }),
-    );
-    if (!res.Body) {
-      throw new Error(`Empty response for ${key}`);
-    }
-    return {
-      body: res.Body as AsyncIterable<Uint8Array>,
-      metadata: res.Metadata,
-    };
-  }
-
-  async getObject(key: string): Promise<GetObjectResult> {
-    const res = await this.getObjectStream(key);
-    const body = await drainToBuffer(res.body);
-    return { body, metadata: res.metadata };
-  }
-
-  async listObjects(input: ListObjectsInput): Promise<ListObjectsResult> {
-    const res = await this.client.send(
-      new ListObjectsV2Command({
-        Bucket: this.bucket,
-        Prefix: input.prefix,
-        ContinuationToken: input.continuationToken,
-      }),
-    );
-    const objects: ListedRemoteObject[] = [];
-    for (const obj of res.Contents || []) {
-      if (!obj.Key) continue;
-      objects.push({
-        key: obj.Key,
-        size: obj.Size ?? 0,
-        lastModified: obj.LastModified || new Date(),
-        etag: obj.ETag || "",
-      });
-    }
-    return {
-      objects,
-      nextContinuationToken: res.NextContinuationToken,
-    };
-  }
-
-  async deleteObject(key: string): Promise<void> {
-    await this.client.send(
-      new DeleteObjectCommand({ Bucket: this.bucket, Key: key }),
-    );
-  }
-
-  async headObject(key: string): Promise<HeadObjectResult | null> {
-    try {
-      const res = await this.client.send(
-        new HeadObjectCommand({ Bucket: this.bucket, Key: key }),
-      );
-      return {
-        lastModified: res.LastModified || new Date(),
-        etag: res.ETag || "",
-        size: res.ContentLength || 0,
-        metadata: res.Metadata,
-      };
-    } catch (err: unknown) {
-      if (
-        err &&
-        typeof err === "object" &&
-        "name" in err &&
-        (err as { name?: string }).name === "NotFound"
-      ) {
-        return null;
-      }
-      throw err;
-    }
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Presigned-URL transport
-// ---------------------------------------------------------------------------
-
-/**
- * Pull every `x-amz-meta-*` response header into a plain metadata record with
- * the prefix stripped. S3 surfaces user metadata this way on GET/HEAD; fetch
- * lowercases header names, matching how the SDK lowercases `Metadata` keys, so
- * the read path in s3.ts is identical across both transports.
- */
-function metaFromHeaders(headers: Headers): Record<string, string> {
-  const meta: Record<string, string> = {};
-  headers.forEach((value, name) => {
-    if (name.startsWith("x-amz-meta-")) {
-      meta[name.slice("x-amz-meta-".length)] = value;
-    }
-  });
-  return meta;
-}
-
-/**
- * Response shape shared by every presigned GET consumer. Unlike the runtime
- * `fetch` response, its body is backed by Node's core HTTP client, so it never
- * enters the runtime-bundled undici parser path.
- */
-export interface PresignedGetResponse {
-  status: number;
-  headers: Headers;
-  body?: AsyncIterable<Uint8Array>;
-  destroy(): void;
-}
-
-/** Transport seam retained for deterministic wire-level regression tests. */
-export interface PresignedGetTransport {
-  get(
-    url: string,
-    headers: Record<string, string> | undefined,
-  ): Promise<PresignedGetResponse>;
-}
-
-function headersFromNode(
-  headers: IncomingMessage["headers"],
-): Headers {
-  const out = new Headers();
-  for (const [name, value] of Object.entries(headers)) {
-    if (value === undefined) continue;
-    out.set(name, Array.isArray(value) ? value.join(", ") : value);
-  }
-  return out;
-}
-
-function expectedContentLength(headers: Headers): number | undefined {
-  const value = headers.get("content-length");
-  if (value === null) return undefined;
-  if (!/^\d+$/.test(value)) {
-    throw new Error(`invalid presigned GET content-length: ${value}`);
-  }
-  const length = Number(value);
-  if (!Number.isSafeInteger(length)) {
-    throw new Error(`invalid presigned GET content-length: ${value}`);
-  }
-  return length;
-}
-
-function contentLengthError(expected: number, actual: number): Error {
-  return new Error(
-    `presigned GET content-length mismatch: expected ${expected} bytes, received ${actual}`,
-  );
-}
-
-async function* checkedNodeBody(
-  message: IncomingMessage,
-  expected: number | undefined,
-): AsyncIterable<Uint8Array> {
-  let received = 0;
-  let exhausted = false;
-  try {
-    try {
-      for await (const chunk of message) {
-        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        received += bytes.byteLength;
-        if (expected !== undefined && received > expected) {
-          throw contentLengthError(expected, received);
-        }
-        yield bytes;
-      }
-    } catch (err) {
-      // A FIN before Node has received the declared bytes normally surfaces as
-      // an "aborted" stream error. Preserve the useful data-integrity cause.
-      if (expected !== undefined && received !== expected) {
-        throw contentLengthError(expected, received);
-      }
-      throw err;
-    }
-    exhausted = true;
-    if (expected !== undefined && received !== expected) {
-      throw contentLengthError(expected, received);
-    }
-  } finally {
-    // Consumers such as HEAD only inspect headers, and a caller can stop after
-    // a prefix. Destroying in both cases releases the socket immediately.
-    if (!exhausted) message.destroy();
-  }
-}
-
-function nodePresignedGet(
-  url: string,
-  headers: Record<string, string> | undefined,
-): Promise<PresignedGetResponse> {
-  const target = new URL(url);
-  return new Promise((resolve, reject) => {
-    const handleResponse = (message: IncomingMessage): void => {
-      const responseHeaders = headersFromNode(message.headers);
-      let expected: number | undefined;
-      try {
-        expected = expectedContentLength(responseHeaders);
-      } catch (err) {
-        message.destroy();
-        reject(err);
-        return;
-      }
-      resolve({
-        status: message.statusCode ?? 0,
-        headers: responseHeaders,
-        body: checkedNodeBody(message, expected),
-        destroy: () => message.destroy(),
-      });
-    };
-    const request = target.protocol === "https:"
-      ? https.request(target, { method: "GET", headers }, handleResponse)
-      : target.protocol === "http:"
-        ? http.request(target, { method: "GET", headers }, handleResponse)
-        : undefined;
-    if (!request) {
-      reject(new Error(`unsupported presigned GET protocol: ${target.protocol}`));
-      return;
-    }
-    request.once("error", reject);
-    request.end();
-  });
-}
-
-const NODE_PRESIGNED_GET_TRANSPORT: PresignedGetTransport = {
-  get: nodePresignedGet,
-};
-
-let presignedGetTransport: PresignedGetTransport = NODE_PRESIGNED_GET_TRANSPORT;
-
-/** Test-only override; production always uses Node's core HTTP(S) transport. */
-export function setPresignedGetTransportForTesting(
-  transport: PresignedGetTransport | null,
-): void {
-  presignedGetTransport = transport ?? NODE_PRESIGNED_GET_TRANSPORT;
-}
-
-/**
- * Per-key presign denial codes that are EXPECTED and must be reclassified as
- * skip-with-log — throwing the `name: "Forbidden"` shape (see
- * {@link accessDeniedError}) so `isAccessDenied` in sync.ts / share.ts routes
- * them into the silent per-key scope-excluded skip, never a FATAL sync error.
- *
- * Two families qualify:
- *   1. Any `*_FORBIDDEN` code — an authorization/ACL denial. Covers
- *      FILES_PRESIGN_FORBIDDEN (no write on a shared prefix), FILES_RAW_FORBIDDEN,
- *      and — the structural sessions-ACL rejection this US-006 phase relies on —
- *      FILES_PRESIGN_SESSIONS_FORBIDDEN (a spoofed/foreign `sessions/{uid}/`
- *      prefix the server refuses to presign).
- *   2. FILES_PRESIGN_TRANSCRIPT_CONSENT_REQUIRED — the US-005 transcript-consent
- *      denial. It ends `_REQUIRED`, not `_FORBIDDEN`, so the suffix test alone
- *      would MISS it and let it fall through to the fatal generic Error below,
- *      re-introducing exactly the recurring partial-failure that poisons every
- *      subsequent sync run (US-006 AC5).
- */
-const SKIP_WITH_LOG_DENIAL_CODES: ReadonlySet<string> = new Set([
-  "FILES_PRESIGN_TRANSCRIPT_CONSENT_REQUIRED",
-]);
-
-function isSkipWithLogDenialCode(code: unknown): code is string {
-  return (
-    typeof code === "string" &&
-    (code.endsWith("_FORBIDDEN") || SKIP_WITH_LOG_DENIAL_CODES.has(code))
-  );
-}
-
-function firstRowOrThrow(
-  results: PresignResultRow[],
-  key: string,
-  op: string,
-): PresignResultRow {
-  const row = results[0];
-  if (!row) {
-    throw new Error(`presign ${op} returned no row for ${key}`);
-  }
-  if (row.error || !row.url) {
-    // An expected per-key denial (see {@link isSkipWithLogDenialCode}) must
-    // throw the SAME `name: "Forbidden"` shape the GET/HEAD path uses so it
-    // routes through the `isAccessDenied` skip in sync.ts / share.ts. Without
-    // this, a denied presign fell to the generic Error below — `isAccessDenied`
-    // returned false — and the per-file ACL skip the GET path handles gracefully
-    // became a FATAL sync error: the crash-loop + Sentry flood behind the
-    // widespread "presign put denied" incident (members pushing net-new keys to
-    // a company-wide-read prefix under private-by-default), and — for the
-    // sessions/consent codes — a recurring partial-failure that poisoned every
-    // subsequent sync run (US-006 AC5). The denial is expected; only the fatal
-    // handling of it was the bug. Log a one-line skip so the reason is visible
-    // without the run failing.
-    if (isSkipWithLogDenialCode(row.code)) {
-      // Shared presign layer: this fires for sync legs AND for non-sync callers
-      // (hq files get, signals/sources internals) where the denial surfaces as a
-      // user-facing error, not a continued sync. State only what THIS layer did
-      // (denied → skipped this row) and let the caller own any "sync continues"
-      // / error framing — don't assert an outcome the caller may not take.
-      console.warn(
-        `presign ${op} denied for '${key}' (${row.code}) — skipped`,
-      );
-      throw accessDeniedError(
-        key,
-        `no ${op} access to '${key}' (server ${op} denied: ${row.code})`,
-      );
-    }
-    throw new Error(
-      `presign ${op} denied for ${key}: ${row.error ?? "no url"}${
-        row.code ? ` (${row.code})` : ""
-      }`,
-    );
-  }
-  return row;
-}
-
-/**
- * An error shaped like the AWS SDK's NoSuchKey/NotFound so existing catch
- * sites in s3.ts (which test `err.name === "NotFound"`) treat a presigned
- * 404 the same as an SDK 404.
- */
-function notFoundError(key: string): Error {
-  return Object.assign(new Error(`Not found: ${key}`), { name: "NotFound" });
-}
-
-/**
- * An error shaped like the AWS SDK's HeadObject 403 (`name: "Forbidden"`) so
- * presigned-transport denials route through the SAME catch sites as SDK ones
- * (share.ts / sync.ts `isAccessDenied`: name === "AccessDenied" | "Forbidden").
- * Critically this is NOT `null`: "can't read the key" must never be conflated
- * with "the key does not exist" — that conflation let a transient 403 episode
- * disable every push-side conflict guard and clobber newer remote objects.
- */
-function accessDeniedError(key: string, detail: string): Error {
-  return Object.assign(
-    new Error(`Access denied for ${key}: ${detail}`),
-    { name: "Forbidden" },
-  );
-}
-
-/**
- * An error shaped like the AWS SDK's 412 (`name: "PreconditionFailed"`) so
- * presigned-transport conditional-write rejections route through the same
- * catch sites as SDK ones. A 412 means the fence WORKED: the remote moved
- * past the caller's baseline (If-Match) or the key already exists
- * (If-None-Match) — surface as a conflict, never overwrite.
- */
-function preconditionFailedError(key: string, detail: string): Error {
-  return Object.assign(
-    new Error(`Precondition failed for ${key}: ${detail}`),
-    { name: "PreconditionFailed" },
-  );
-}
-
-/**
- * If-Match compares quoted entity-tags. Journal baselines store etags
- * stripped (normalizeEtag) while SDK HEADs return them quoted — accept both
- * and emit the canonical quoted form.
- */
-function quoteEtag(etag: string): string {
-  return etag.startsWith('"') ? etag : `"${etag}"`;
-}
-
-/**
- * Max keys per presign request when priming — the server's hard batch cap
- * (hq-pro files-presign MAX_BATCH_KEYS = 1000). One presign call costs ONE
- * audit row toward the 100/hr limit regardless of how many keys it carries, so
- * filling the batch is strictly better: a 5.5k-file pull is 6 presign calls at
- * 1000/chunk vs 55 at 100. (The sibling list page size is fixed at 1000 by
- * AWS's ListObjectsV2 MaxKeys cap — that one we can't raise.)
- */
-const PRIME_CHUNK = 1000;
-/**
- * Lifetime requested for primed URLs. Generous (30 min) so a whole sync batch
- * completes within one prime, but well inside the presign Lambda role's
- * credential lifetime (a presigned URL cannot outlive the creds that signed
- * it). A batch that somehow outruns this falls back to per-key single presign.
- */
-const PRIME_EXPIRES_IN_SECONDS = 1800;
-/** Concurrent prime chunks in flight (each is one presign HTTP call). */
-const PRIME_CONCURRENCY = 4;
-/** Treat a cached URL within this window of expiry as a miss (re-presign). */
-const CACHE_SAFETY_MS = 60_000;
-
-/**
- * Opt-in gate for strict fail-closed enforcement of fenced presigned PUTs.
- *
- * Defaults OFF until the hq-pro files-presign server signs and echoes
- * If-Match/If-None-Match. While disabled, the presigned transport preserves
- * today's behavior: replay whatever signed headers the server returned.
- */
-export const PRESIGN_FENCE_STRICT_ENV_VAR = "HQ_PRESIGN_FENCE_STRICT";
-
-function isPresignFenceStrictEnabled(): boolean {
-  return process.env[PRESIGN_FENCE_STRICT_ENV_VAR] === "true";
-}
-
-interface CacheEntry {
-  url: string;
-  headers?: Record<string, string>;
-  expiresAtMs: number;
-}
-
-/**
- * Thrown when a presign mint is skipped because the per-user 100/hr vault rate
- * budget is exhausted. Distinct name so callers can tell "deferred, retry next
- * sync" apart from a real transfer failure. The key was NOT synced.
- */
-export class RateLimitedError extends Error {
-  constructor(
-    readonly key: string,
-    readonly op: PresignOp,
-    options?: { cause?: unknown },
-  ) {
-    super(`rate limited (100/hr) — ${op} ${key} deferred to next sync`);
-    this.name = "RateLimited";
-    if (options?.cause !== undefined) {
-      (this as { cause?: unknown }).cause = options.cause;
-    }
-  }
-}
-
-/**
- * A fenced presigned PUT is only safe if the presign service signed and echoed
- * the requested conditional header for replay. Missing/mismatched condition
- * headers mean an older server or a stale primed URL would write
- * unconditionally, so fail closed and let the caller retry later.
- */
-export class PresignPreconditionMissingError extends Error {
-  readonly retryable = true;
-
-  constructor(
-    readonly key: string,
-    readonly header: "if-match" | "if-none-match",
-  ) {
-    super(`presigned PUT for ${key} missing required ${header} precondition`);
-    this.name = "PresignPreconditionMissing";
-  }
-}
-
-/**
- * One-way circuit breaker shared across a run's per-company transports. The
- * first 429 (vault rate budget exhausted) trips it; thereafter every UNCACHED
- * presign fails fast with {@link RateLimitedError} instead of hitting the wire.
- *
- * Without this, an exhausted budget spirals: prime chunks 429 → keys uncached
- * → per-file presign → each 429s (after VaultClient's own 3 retries +
- * backoff) → an 86-minute storm of ~10k doomed calls (observed live). Tripping
- * once and short-circuiting turns that into a clean fast finish: primed URLs
- * still work, un-primed keys are deferred, and the run reports them so the next
- * sync (after the rolling hour recovers) picks them up.
- */
-export class RateLimitBreaker {
-  private tripped = false;
-  isTripped(): boolean {
-    return this.tripped;
-  }
-  trip(): void {
-    this.tripped = true;
-  }
-}
-
-/** A VaultClient 429 (rate budget exhausted) after its own retries. */
-function isRateLimit(err: unknown): boolean {
-  return err instanceof VaultClientError && err.statusCode === 429;
-}
-
-/**
- * Transport that moves bytes over short-lived presigned URLs minted by the
- * vault-service. Holds no AWS credentials. `companyUid` is the EntityContext's
- * `uid` — the server resolves the per-company bucket from it, so cross-company
- * reach is structurally impossible (same authority model as the list/presign
- * handlers).
- *
- * URL cache: {@link prime} batch-mints URLs into `urlCache` (keyed by op+key)
- * so the per-file get/head calls during a sync reuse them instead of issuing a
- * presign request each. A single instance is shared across all s3.ts calls for
- * one company within a run (see {@link presignObjectIOFactory} memoization), so
- * a prime before the transfer loop warms the cache the loop then drains.
- */
-export class PresignObjectIO implements ObjectIO {
-  private readonly urlCache = new Map<string, CacheEntry>();
-  private readonly headReuseCache = new Map<string, CacheEntry>();
-
-  constructor(
-    private readonly vault: PresignTransportClient,
-    private readonly companyUid: string,
-    // Shared across a run's per-company instances by the factory; a directly
-    // constructed instance gets its own (fine for tests / one-offs).
-    private readonly breaker: RateLimitBreaker = new RateLimitBreaker(),
-  ) {}
-
-  private cacheKey(op: PresignOp, key: string): string {
-    return `${op}\u0000${key}`;
-  }
-
-  hasPrimedPut(key: string): boolean {
-    return this.peekCached("put", key) !== undefined;
-  }
-
-  /** A live (non-expiring) cached URL for op+key, or undefined. */
-  private peekCached(op: PresignOp, key: string): CacheEntry | undefined {
-    const cacheKey = this.cacheKey(op, key);
-    const hit = this.urlCache.get(cacheKey);
-    if (!hit) return undefined;
-    if (Date.now() >= hit.expiresAtMs - CACHE_SAFETY_MS) {
-      this.urlCache.delete(cacheKey);
-      return undefined;
-    }
-    return hit;
-  }
-
-  /** Return and evict a live cached URL so primed batches are bounded. */
-  private consumeCached(op: PresignOp, key: string): CacheEntry | undefined {
-    const hit = this.peekCached(op, key);
-    if (hit) this.urlCache.delete(this.cacheKey(op, key));
-    return hit;
-  }
-
-  private peekHeadReuse(key: string): CacheEntry | undefined {
-    const hit = this.headReuseCache.get(key);
-    if (!hit) return undefined;
-    if (Date.now() >= hit.expiresAtMs - CACHE_SAFETY_MS) {
-      this.headReuseCache.delete(key);
-      return undefined;
-    }
-    return hit;
-  }
-
-  private consumeHeadReuse(key: string): CacheEntry | undefined {
-    const hit = this.peekHeadReuse(key);
-    if (hit) this.headReuseCache.delete(key);
-    return hit;
-  }
-
-  private async presignSingle(
-    op: PresignOp,
-    key: string,
-    extra?: {
-      contentType?: string;
-      metadata?: Record<string, string>;
-      /** Conditional-write fence for PUT presigns — see PutPrecondition. */
-      ifMatch?: string;
-      ifNoneMatch?: "*";
-    },
-  ): Promise<{ url: string; headers?: Record<string, string> }> {
-    if (this.breaker.isTripped()) throw new RateLimitedError(key, op);
-    let results;
-    try {
-      ({ results } = await this.vault.presign({
-        companyUid: this.companyUid,
-        op,
-        keys: [{ key, op, ...extra }],
-      }));
-    } catch (err) {
-      if (isRateLimit(err)) {
-        this.breaker.trip();
-        throw new RateLimitedError(key, op, { cause: err });
-      }
-      throw err;
-    }
-    const row = firstRowOrThrow(results, key, op);
-    return { url: row.url!, headers: row.headers };
-  }
-
-  private async resolveGetUrlForBody(
-    key: string,
-  ): Promise<{ url: string; headers?: Record<string, string> }> {
-    const hit = this.consumeCached("get", key);
-    if (hit) {
-      this.headReuseCache.set(key, hit);
-      return { url: hit.url, headers: hit.headers };
-    }
-    this.headReuseCache.delete(key);
-    return this.presignSingle("get", key);
-  }
-
-  /**
-   * Resolve a presigned URL (+ replay headers) for op+key: cache hit if primed,
-   * else a single presign. Throws on per-key denial (matches the SDK path's
-   * access error). `extra` carries PUT contentType/metadata on the miss path.
-   */
-  private async resolveUrl(
-    op: PresignOp,
-    key: string,
-    extra?: {
-      contentType?: string;
-      metadata?: Record<string, string>;
-      /** Conditional-write fence for PUT presigns — see PutPrecondition. */
-      ifMatch?: string;
-      ifNoneMatch?: "*";
-    },
-  ): Promise<{ url: string; headers?: Record<string, string> }> {
-    const hasPutFence =
-      op === "put" &&
-      (extra?.ifMatch !== undefined || extra?.ifNoneMatch !== undefined);
-    if (hasPutFence) {
-      this.urlCache.delete(this.cacheKey("put", key));
-    }
-    const hit = hasPutFence ? undefined : this.consumeCached(op, key);
-    if (hit) return { url: hit.url, headers: hit.headers };
-    // Primed URLs still serve once the breaker trips (no wire needed); only an
-    // uncached key on an exhausted budget fails fast.
-    return this.presignSingle(op, key, extra);
-  }
-
-  private requireSignedPutPreconditions(
-    key: string,
-    input: PutPrecondition,
-    headers: Record<string, string> | undefined,
-  ): void {
-    const lowerHeaders = new Map<string, string>();
-    for (const [name, value] of Object.entries(headers ?? {})) {
-      lowerHeaders.set(name.toLowerCase(), value);
-    }
-
-    if (input.ifMatch) {
-      const signed = lowerHeaders.get("if-match");
-      if (signed !== quoteEtag(input.ifMatch)) {
-        throw new PresignPreconditionMissingError(key, "if-match");
-      }
-    }
-    if (input.ifNoneMatch) {
-      const signed = lowerHeaders.get("if-none-match");
-      if (signed !== input.ifNoneMatch) {
-        throw new PresignPreconditionMissingError(key, "if-none-match");
-      }
-    }
-  }
-
-  async prime(op: PresignOp, keys: PresignKeyInput[]): Promise<void> {
-    if (keys.length === 0) return;
-    const chunks: PresignKeyInput[][] = [];
-    for (let i = 0; i < keys.length; i += PRIME_CHUNK) {
-      chunks.push(keys.slice(i, i + PRIME_CHUNK));
-    }
-    let next = 0;
-    const worker = async (): Promise<void> => {
-      while (next < chunks.length) {
-        // Budget already exhausted — stop priming; remaining keys defer.
-        if (this.breaker.isTripped()) return;
-        const chunk = chunks[next++];
-        let resp;
-        try {
-          resp = await this.vault.presign({
-            companyUid: this.companyUid,
-            op,
-            expiresIn: PRIME_EXPIRES_IN_SECONDS,
-            keys: chunk.map((k) => ({ ...k, op })),
-          });
-        } catch (err) {
-          if (isRateLimit(err)) {
-            // Budget exhausted mid-prime: trip the breaker and stop. Priming
-            // on means every remaining chunk + per-file fallback would 429 —
-            // the spiral. Tripping makes the transfer loop fail fast instead.
-            this.breaker.trip();
-            return;
-          }
-          // A non-429 chunk failure just means those keys aren't cached — the
-          // per-key call will single-presign. Never let priming fail the sync.
-          continue;
-        }
-        const now = Date.now();
-        for (const row of resp.results) {
-          if (row.error || !row.url) continue;
-          this.urlCache.set(this.cacheKey(op, row.key), {
-            url: row.url,
-            headers: row.headers,
-            expiresAtMs: now + (row.expiresIn ?? PRIME_EXPIRES_IN_SECONDS) * 1000,
-          });
-        }
-      }
-    };
-    await Promise.all(
-      Array.from({ length: Math.min(PRIME_CONCURRENCY, chunks.length) }, worker),
-    );
-  }
-
-  async putObject(input: PutObjectInput): Promise<{ etag: string }> {
-    // Conditional-write fields (ifMatch/ifNoneMatch) are forwarded on the
-    // presign request so the server can sign If-Match/If-None-Match into the
-    // URL and echo them via `headers` for replay. Do not inject a missing
-    // condition client-side: an unsigned conditional header breaks the SigV4
-    // signature. Strict validation of echoed headers remains feature-gated
-    // until the hq-pro files-presign server signs these conditions.
-    const row = await this.resolveUrl("put", input.key, {
-      contentType: input.contentType,
-      ...(input.metadata && Object.keys(input.metadata).length > 0
-        ? { metadata: input.metadata }
-        : {}),
-      ...(input.ifMatch ? { ifMatch: stripQuotes(input.ifMatch) } : {}),
-      ...(input.ifNoneMatch ? { ifNoneMatch: input.ifNoneMatch } : {}),
-    });
-    if (isPresignFenceStrictEnabled()) {
-      this.requireSignedPutPreconditions(input.key, input, row.headers);
-    }
-    // The server signs Content-Type, SSE-KMS, and every x-amz-meta-* into the
-    // signature and returns them in `headers`; they MUST be replayed verbatim
-    // or SigV4 rejects the PUT.
-    const res = await fetchWithRetry(
-      row.url,
-      { method: "PUT", body: input.body, headers: row.headers ?? {} },
-      `presigned PUT ${input.key}`,
-    );
-    if (res.status === 412) {
-      // The signed conditional header fenced this write off: the remote
-      // moved past our baseline (If-Match) or the key already exists
-      // (If-None-Match). Same shape as the SDK's PreconditionFailed so the
-      // push path routes both transports through one conflict handler.
-      const detail = await safeText(res);
-      throw preconditionFailedError(input.key, detail);
-    }
-    if (!res.ok) {
-      const detail = await safeText(res);
-      throw new Error(
-        `presigned PUT failed for ${input.key}: ${res.status} ${detail}`,
-      );
-    }
-    return { etag: stripQuotes(res.headers.get("etag") ?? undefined) };
-  }
-
-  async getObjectStream(key: string): Promise<GetObjectStreamResult> {
-    const row = await this.resolveGetUrlForBody(key);
-    const res = await presignedGetWithRetry(
-      row.url,
-      row.headers,
-      `presigned GET ${key}`,
-    );
-    if (res.status === 404) {
-      res.destroy();
-      throw notFoundError(key);
-    }
-    if (res.status < 200 || res.status >= 300) {
-      const detail = await safePresignedGetText(res);
-      throw new Error(`presigned GET failed for ${key}: ${res.status} ${detail}`);
-    }
-    return {
-      body: res.body ?? (async function* () {})(),
-      metadata: metaFromHeaders(res.headers),
-    };
-  }
-
-  async getObject(key: string): Promise<GetObjectResult> {
-    const res = await this.getObjectStream(key);
-    const body = await drainToBuffer(res.body);
-    return { body, metadata: res.metadata };
-  }
-
-  async listObjects(input: ListObjectsInput): Promise<ListObjectsResult> {
-    const { objects, cursor } = await this.vault.listFiles(
-      this.companyUid,
-      input.prefix,
-      input.continuationToken,
-    );
-    return {
-      objects: objects.map((o) => ({
-        key: o.key,
-        size: o.size,
-        lastModified: o.lastModified ? new Date(o.lastModified) : new Date(),
-        etag: o.etag ?? "",
-      })),
-      nextContinuationToken: cursor ?? undefined,
-    };
-  }
-
-  async deleteObject(key: string): Promise<void> {
-    const row = await this.resolveUrl("delete", key);
-    const res = await fetchWithRetry(row.url, { method: "DELETE" }, `presigned DELETE ${key}`);
-    // S3 DELETE is idempotent — a 204 (deleted) and a 404 (already gone) are
-    // both success for the sync engine's purposes.
-    if (!res.ok && res.status !== 404) {
-      const detail = await safeText(res);
-      throw new Error(
-        `presigned DELETE failed for ${key}: ${res.status} ${detail}`,
-      );
-    }
-  }
-
-  async headObject(key: string): Promise<HeadObjectResult | null> {
-    // The presign endpoint has no HEAD op (get/put/delete only). A presigned
-    // GET signs the GET method, so we issue a real GET and read only the
-    // response headers, cancelling the body stream before it downloads — the
-    // headers (etag, content-length, last-modified, x-amz-meta-*) are all we
-    // need and arrive before the body. Cheap for the created-at-preservation
-    // and conflict-detection call sites that use headObject. Reuses the GET
-    // cache: a prime("get", …) before a pull warms these HEADs for free.
-    let url: string;
-    const hit = this.consumeHeadReuse(key) ?? this.consumeCached("get", key);
-    if (hit) {
-      url = hit.url;
-    } else {
-      if (this.breaker.isTripped()) throw new RateLimitedError(key, "get");
-      let results;
-      try {
-        ({ results } = await this.vault.presign({
-          companyUid: this.companyUid,
-          op: "get",
-          keys: [{ key, op: "get" }],
-        }));
-      } catch (err) {
-        if (isRateLimit(err)) {
-          this.breaker.trip();
-          throw new RateLimitedError(key, "get", { cause: err });
-        }
-        throw err;
-      }
-      const row = results[0];
-      if (row?.code === "FILES_PRESIGN_NOT_FOUND") {
-        // The presign lambda HEAD'd S3 and confirmed the object does NOT
-        // exist — an unambiguous absence, distinct from the read DENIAL
-        // handled below. Report absent (null) so the push creates the new
-        // object. Without this, a brand-new file's first upload is blocked
-        // forever: its presigned GET 403s (S3 masks absence when the URL
-        // lacks `s3:ListBucket`) and routes through the access-denied skip
-        // path. The server's explicit NOT_FOUND is the ONLY safe absence
-        // signal — a 403 stays "unknown", never "missing" (see below).
-        return null;
-      }
-      if (!row || row.error || !row.url) {
-        // A per-key denial means the caller can't READ the key — it says
-        // nothing about whether the object EXISTS. Pre-fix this returned
-        // null ("absent"), which made push call sites skip every conflict
-        // guard (`if (remoteMeta)`) and issue an UNCONDITIONAL PUT — a
-        // transient denial episode mid-pass silently clobbered newer remote
-        // bytes with this machine's stale copy (the 2026-06-10..12 vault
-        // regression storm). Throw the same access-denied shape the SDK
-        // transport raises so callers route through their existing
-        // isAccessDenied skip/defer paths instead of "object missing".
-        throw accessDeniedError(key, row?.error ?? "presign denied");
-      }
-      url = row.url;
-    }
-    const res = await presignedGetWithRetry(
-      url,
-      undefined,
-      `presigned HEAD ${key}`,
-    );
-    if (res.status === 404) {
-      res.destroy();
-      return null;
-    }
-    if (res.status === 403) {
-      // 403 on the signed GET (expired URL, expired signing creds, KMS or
-      // bucket-policy denial) is UNKNOWN state, not absence — see the presign
-      // denial branch above. The SDK transport throws name:"Forbidden" here;
-      // mirror it so both transports agree and no caller mistakes a denial
-      // for a missing object.
-      res.destroy();
-      throw accessDeniedError(key, "presigned HEAD returned 403");
-    }
-    if (res.status < 200 || res.status >= 300) {
-      const detail = await safePresignedGetText(res);
-      throw new Error(`presigned HEAD failed for ${key}: ${res.status} ${detail}`);
-    }
-    const result: HeadObjectResult = {
-      lastModified: parseLastModified(res.headers.get("last-modified")),
-      etag: stripQuotes(res.headers.get("etag") ?? undefined),
-      size: Number(res.headers.get("content-length") ?? "0"),
-      metadata: metaFromHeaders(res.headers),
-    };
-    res.destroy();
-    return result;
-  }
-}
-
-async function safeText(res: Response): Promise<string> {
-  try {
-    return (await res.text()).slice(0, 200);
-  } catch {
-    return "";
-  }
-}
-
-async function cancelBody(res: Response): Promise<void> {
-  try {
-    await res.body?.cancel();
-  } catch {
-    // Best-effort — the socket is released either way once GC'd.
-  }
-}
-
-function parseLastModified(value: string | null): Date {
-  if (!value) return new Date();
-  const d = new Date(value);
-  return Number.isNaN(d.getTime()) ? new Date() : d;
-}
-
-// ---------------------------------------------------------------------------
-// Transient-failure retry for the presigned-URL fetches
-// ---------------------------------------------------------------------------
-//
-// The AWS S3 SDK retries transient errors (5xx, throttling, dropped sockets)
-// automatically with backoff. Moving the byte transfer to `fetch` over a
-// presigned URL dropped that resilience — and at sync scale (thousands of
-// objects per pull) transient S3 5xx (notably 503 SlowDown) are routine, so
-// without retry a large sync sporadically loses files. This restores
-// SDK-parity: retry network errors and transient 5xx with exponential backoff
-// + jitter; 4xx (404/403) are definitive and pass straight through.
-
-const FETCH_MAX_RETRIES = 3;
-const FETCH_BASE_DELAY_MS = 400;
-
-function isTransientStatus(status: number): boolean {
-  return status === 500 || status === 502 || status === 503 || status === 504;
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-/**
- * Shared presigned-GET path for streaming reads and header-only probes.
- *
- * GET deliberately uses Node core HTTP(S), not global fetch: on affected
- * Node/Windows builds the bundled undici parser can assert after a FIN arrives
- * while the consumer is backpressured. Keep the retry budget identical to the
- * PUT/DELETE fetch path below.
- */
-async function presignedGetWithRetry(
-  url: string,
-  headers: Record<string, string> | undefined,
-  what: string,
-): Promise<PresignedGetResponse> {
-  let lastError: unknown;
-  for (let attempt = 0; attempt <= FETCH_MAX_RETRIES; attempt++) {
-    if (attempt > 0) {
-      const backoff = FETCH_BASE_DELAY_MS * 2 ** (attempt - 1);
-      const jitter = Math.floor(Math.random() * FETCH_BASE_DELAY_MS);
-      await sleep(backoff + jitter);
-    }
-    let res: PresignedGetResponse;
-    try {
-      res = await presignedGetTransport.get(url, headers);
-    } catch (err) {
-      lastError = err;
-      continue;
-    }
-    if (isTransientStatus(res.status) && attempt < FETCH_MAX_RETRIES) {
-      res.destroy();
-      lastError = new Error(`${what}: transient ${res.status}`);
-      continue;
-    }
-    return res;
-  }
-  throw lastError instanceof Error
-    ? lastError
-    : new Error(`${what}: failed after ${FETCH_MAX_RETRIES} retries`);
-}
-
-async function safePresignedGetText(res: PresignedGetResponse): Promise<string> {
-  try {
-    let text = "";
-    for await (const chunk of res.body ?? []) {
-      text += Buffer.from(chunk).toString("utf-8");
-      if (text.length >= 200) break;
-    }
-    return text.slice(0, 200);
-  } catch {
-    return "";
-  } finally {
-    res.destroy();
-  }
-}
-
-/**
- * `fetch` with bounded retry on network errors + transient 5xx. The presigned
- * URL is reusable until expiry and the bodies are in-memory Buffers, so a
- * retry simply re-issues the same request. Jitter avoids a thundering-herd
- * re-retry when the whole transfer pool hits a 503 SlowDown at once. After
- * exhausting retries on a 5xx it returns the final (failing) Response so the
- * caller's normal status handling reports it; network errors throw.
- */
-async function fetchWithRetry(
-  url: string,
-  init: RequestInit,
-  what: string,
-): Promise<Response> {
-  let lastError: unknown;
-  for (let attempt = 0; attempt <= FETCH_MAX_RETRIES; attempt++) {
-    if (attempt > 0) {
-      const backoff = FETCH_BASE_DELAY_MS * 2 ** (attempt - 1);
-      const jitter = Math.floor(Math.random() * FETCH_BASE_DELAY_MS);
-      await sleep(backoff + jitter);
-    }
-    let res: Response;
-    try {
-      res = await fetch(url, init);
-    } catch (err) {
-      lastError = err; // socket reset / DNS / TLS — retry
-      continue;
-    }
-    if (isTransientStatus(res.status) && attempt < FETCH_MAX_RETRIES) {
-      await cancelBody(res); // free the socket before backoff
-      lastError = new Error(`${what}: transient ${res.status}`);
-      continue;
-    }
-    return res; // success, a non-transient status, or the last 5xx attempt
-  }
-  throw lastError instanceof Error
-    ? lastError
-    : new Error(`${what}: failed after ${FETCH_MAX_RETRIES} retries`);
-}
-
-// ---------------------------------------------------------------------------
-// Factory registry — selected once per session by runRunner
-// ---------------------------------------------------------------------------
-
-export type ObjectIOFactory = (ctx: EntityContext) => ObjectIO;
-
-const DEFAULT_FACTORY: ObjectIOFactory = (ctx) => new S3SdkObjectIO(ctx);
-
-let activeFactory: ObjectIOFactory = DEFAULT_FACTORY;
-
-/**
- * Install the transport factory for the current process. Passing `null`
- * resets to the default S3 SDK transport. Called once by `runRunner` after it
- * resolves the caller's identity + feature-flag gate; every subsequent s3.ts
- * call resolves its transport through this.
- */
-export function setObjectIOFactory(factory: ObjectIOFactory | null): void {
-  activeFactory = factory ?? DEFAULT_FACTORY;
-}
-
-/** Resolve the transport for an EntityContext using the active factory. */
-export function resolveObjectIO(ctx: EntityContext): ObjectIO {
-  return activeFactory(ctx);
-}
-
-/**
- * Build a factory that routes every EntityContext through the presigned-URL
- * transport, reusing the one already-authenticated VaultClient and deriving
- * the per-company authority from `ctx.uid`.
- */
-export function presignObjectIOFactory(
-  vault: PresignTransportClient,
-): ObjectIOFactory {
-  // Memoize one PresignObjectIO per company for the run, so a prime() and the
-  // transfer loop that drains its URL cache share the SAME instance. (Safe to
-  // memoize: PresignObjectIO holds only the vault client — whose token is a
-  // live getter — and the stable companyUid; it captures no rotating
-  // credentials, unlike S3SdkObjectIO, which is why the default factory is
-  // intentionally NOT memoized.)
-  // One breaker per run, shared across companies: the 100/hr budget is
-  // per-user, so a 429 in one company means the whole run should stop minting.
-  const breaker = new RateLimitBreaker();
-  const byCompany = new Map<string, PresignObjectIO>();
-  return (ctx) => {
-    // Personal vaults are a PERSON entity (prs_*) accessed via the membership-
-    // less vend-self model; the list/presign endpoints are membership-gated and
-    // 403 ("no active membership in company prs_…") for them. Personal vaults
-    // also have no ACL-scale problem (single owner), so they don't need
-    // presign — keep them on the S3 SDK (STS) transport. Presign is for company
-    // vaults (cmp_*), which is where the unbounded-grants problem lives.
-    if (!ctx.uid.startsWith("cmp_")) {
-      return new S3SdkObjectIO(ctx);
-    }
-    let io = byCompany.get(ctx.uid);
-    if (!io) {
-      io = new PresignObjectIO(vault, ctx.uid, breaker);
-      byCompany.set(ctx.uid, io);
-    }
-    return io;
-  };
-}