@indigoai-us/hq-cloud 6.15.0 → 6.15.2

package/src/prefix-coalesce.test.ts

@@ -1,240 +0,0 @@
-import { describe, it, expect } from "vitest";
-import {
-  coalescePrefixes,
-  isCoveredByAny,
-  grantPathToPrefix,
-  grantPathToScopePrefix,
-  toScopePrefixEntries,
-} from "./prefix-coalesce.js";
-
-describe("coalescePrefixes", () => {
-  it("returns empty for empty input", () => {
-    expect(coalescePrefixes([])).toEqual([]);
-  });
-
-  it("dedupes identical inputs", () => {
-    expect(coalescePrefixes(["a/", "a/"])).toEqual(["a/"]);
-  });
-
-  it("collapses nested prefixes into the broader one", () => {
-    expect(coalescePrefixes(["a/", "a/b/"])).toEqual(["a/"]);
-  });
-
-  it("collapses deeply nested chains", () => {
-    expect(coalescePrefixes(["a/", "a/b/", "a/b/c/", "a/b/c/d/"])).toEqual([
-      "a/",
-    ]);
-  });
-
-  it("keeps sibling (overlapping but non-nested) prefixes", () => {
-    expect(coalescePrefixes(["a/b/", "a/c/"])).toEqual(["a/b/", "a/c/"]);
-  });
-
-  it("mixes nested + sibling correctly", () => {
-    expect(
-      coalescePrefixes([
-        "companies/indigo/meetings/",
-        "companies/indigo/meetings/2026/",
-        "companies/indigo/scratch/jacob/",
-      ]),
-    ).toEqual([
-      "companies/indigo/meetings/",
-      "companies/indigo/scratch/jacob/",
-    ]);
-  });
-
-  it("is case-sensitive (S3 keys are case-sensitive)", () => {
-    // 'A/' and 'a/' do not cover each other — both must be kept.
-    const result = coalescePrefixes(["A/", "a/"]);
-    expect(result.sort()).toEqual(["A/", "a/"]);
-  });
-
-  it("returns prefixes sorted lexicographically (deterministic for journal)", () => {
-    expect(coalescePrefixes(["c/", "a/", "b/"])).toEqual(["a/", "b/", "c/"]);
-  });
-
-  it("drops empty-string entries (would otherwise cover everything)", () => {
-    expect(coalescePrefixes(["", "a/", ""])).toEqual(["a/"]);
-  });
-
-  it("is a pure function — input array is not mutated", () => {
-    const input = ["a/b/", "a/"];
-    const snapshot = [...input];
-    coalescePrefixes(input);
-    expect(input).toEqual(snapshot);
-  });
-
-  it("handles a single prefix unchanged", () => {
-    expect(coalescePrefixes(["companies/indigo/"])).toEqual([
-      "companies/indigo/",
-    ]);
-  });
-
-  it("does not treat 'ab/' as nested under 'a/' lexically (literal startsWith)", () => {
-    // `'ab/'.startsWith('a/')` is FALSE — `a/` would have to be a true
-    // path-segment ancestor. (Callers should pass trailing-slash-bounded
-    // prefixes — the grants endpoint always does.)
-    expect(coalescePrefixes(["a/", "ab/"]).sort()).toEqual(["a/", "ab/"]);
-  });
-
-  it("F16: keeps exact-file scopes distinct from prefixed sibling keys", () => {
-    expect(
-      coalescePrefixes(["knowledge/README.md", "knowledge/README.md.bak"]),
-    ).toEqual(["knowledge/README.md", "knowledge/README.md.bak"]);
-  });
-});
-
-describe("isCoveredByAny", () => {
-  it("returns true when a prefix covers the path", () => {
-    expect(isCoveredByAny("a/b/c.md", ["a/"])).toBe(true);
-  });
-
-  it("returns false when no prefix covers the path", () => {
-    expect(isCoveredByAny("a/b/c.md", ["x/", "y/"])).toBe(false);
-  });
-
-  it("returns false on empty prefix set", () => {
-    expect(isCoveredByAny("a/b/c.md", [])).toBe(false);
-  });
-
-  it("treats exact match as covered", () => {
-    expect(isCoveredByAny("a/b/", ["a/b/"])).toBe(true);
-  });
-
-  it("is case-sensitive", () => {
-    expect(isCoveredByAny("A/b/c.md", ["a/"])).toBe(false);
-  });
-});
-
-describe("grantPathToPrefix", () => {
-  const slug = "indigo";
-
-  it("strips a companies/<slug>/ anchor", () => {
-    expect(grantPathToPrefix("companies/indigo/knowledge/README.md", slug)).toBe(
-      "knowledge/README.md",
-    );
-  });
-
-  it("strips a bare <slug>/ anchor", () => {
-    expect(grantPathToPrefix("indigo/data/vyg/old-meetings/*", slug)).toBe(
-      "data/vyg/old-meetings/",
-    );
-  });
-
-  it("folds a trailing /* glob into a directory prefix", () => {
-    expect(grantPathToPrefix("data/vyg/*", slug)).toBe("data/vyg/");
-    expect(grantPathToPrefix("companies/indigo/design-pack/*", slug)).toBe(
-      "design-pack/",
-    );
-  });
-
-  it("folds a trailing bare * into its parent prefix", () => {
-    const prefix = grantPathToPrefix("reports*", slug);
-    expect(toScopePrefixEntries([prefix])).toEqual([
-      { prefix: "reports", match: "prefix" },
-    ]);
-    expect(isCoveredByAny("reports-q1.md", [prefix])).toBe(true);
-  });
-
-  it("leaves a company-relative directory prefix unchanged", () => {
-    expect(grantPathToPrefix("knowledge/security/", slug)).toBe(
-      "knowledge/security/",
-    );
-  });
-
-  it("leaves a company-relative exact key unchanged", () => {
-    expect(grantPathToPrefix("company.yaml", slug)).toBe("company.yaml");
-  });
-
-  it("maps a bare '*' (and empty) to '' = everything", () => {
-    expect(grantPathToPrefix("*", slug)).toBe("");
-    expect(grantPathToPrefix("", slug)).toBe("");
-  });
-
-  it("tolerates leading slashes", () => {
-    expect(grantPathToPrefix("/companies/indigo/x/*", slug)).toBe("x/");
-  });
-
-  it("does not strip a different company's anchor (defensive)", () => {
-    // A grant anchored at another slug is left intact (won't match this
-    // company's keys, which is the safe outcome).
-    expect(grantPathToPrefix("companies/other/x/*", slug)).toBe(
-      "companies/other/x/",
-    );
-  });
-
-  it("round-trips through coalescePrefixes + isCoveredByAny against real keys", () => {
-    const grants = [
-      "companies/indigo/design-pack/*",
-      "companies/indigo/knowledge/README.md",
-      "data/vyg/*",
-      "company.yaml",
-    ];
-    const prefixes = coalescePrefixes(grants.map((g) => grantPathToPrefix(g, slug)));
-    expect(isCoveredByAny("design-pack/logo.svg", prefixes)).toBe(true);
-    expect(isCoveredByAny("knowledge/README.md", prefixes)).toBe(true);
-    expect(isCoveredByAny("data/vyg/2026/q1.md", prefixes)).toBe(true);
-    expect(isCoveredByAny("company.yaml", prefixes)).toBe(true);
-    // Out of scope:
-    expect(isCoveredByAny("secrets/db.json", prefixes)).toBe(false);
-    expect(isCoveredByAny("knowledge/OTHER.md", prefixes)).toBe(false);
-  });
-
-  it("F16: exact-file grants do not authorize prefixed sibling keys", () => {
-    const grants = [
-      "companies/indigo/knowledge/README.md",
-      "company.yaml",
-      "data/vyg/*",
-    ];
-    const prefixes = coalescePrefixes(grants.map((g) => grantPathToPrefix(g, slug)));
-
-    expect(isCoveredByAny("knowledge/README.md", prefixes)).toBe(true);
-    expect(isCoveredByAny("company.yaml", prefixes)).toBe(true);
-    expect(isCoveredByAny("data/vyg/2026/q1.md", prefixes)).toBe(true);
-
-    expect(isCoveredByAny("knowledge/README.md.bak", prefixes)).toBe(false);
-    expect(isCoveredByAny("company.yaml.tmp", prefixes)).toBe(false);
-  });
-
-  it("R-F16: exact scope is deterministic after a prior bare-glob scope", () => {
-    expect(toScopePrefixEntries([grantPathToPrefix("companies/indigo/foo*", slug)])).toEqual([
-      { prefix: "foo", match: "prefix" },
-    ]);
-
-    const exactPrefixes = coalescePrefixes([
-      grantPathToPrefix("companies/other/foo", "other"),
-    ]);
-
-    expect(isCoveredByAny("foo", exactPrefixes)).toBe(true);
-    expect(isCoveredByAny("foo.bak", exactPrefixes)).toBe(false);
-  });
-
-  it("RF-F16DUR: exact-vs-prefix survives array copy and JSON round-trip", () => {
-    const priorBareGlob = coalescePrefixes([
-      grantPathToScopePrefix("companies/indigo/foo*", slug),
-    ]);
-    const copiedBareGlob = [...priorBareGlob];
-    const jsonBareGlob = JSON.parse(JSON.stringify(priorBareGlob)) as string[];
-
-    expect(jsonBareGlob).toEqual(priorBareGlob);
-    expect(toScopePrefixEntries(copiedBareGlob)).toEqual([
-      { prefix: "foo", match: "prefix" },
-    ]);
-    expect(toScopePrefixEntries(jsonBareGlob)).toEqual([
-      { prefix: "foo", match: "prefix" },
-    ]);
-    expect(isCoveredByAny("foo.bak", copiedBareGlob)).toBe(true);
-    expect(isCoveredByAny("foo.bak", jsonBareGlob)).toBe(true);
-
-    const exactAfterPriorGlob = coalescePrefixes([
-      grantPathToScopePrefix("companies/indigo/foo", slug),
-    ]);
-    const jsonExact = JSON.parse(JSON.stringify(exactAfterPriorGlob)) as string[];
-
-    expect(toScopePrefixEntries(jsonExact)).toEqual([
-      { prefix: "foo", match: "exact" },
-    ]);
-    expect(isCoveredByAny("foo", jsonExact)).toBe(true);
-    expect(isCoveredByAny("foo.bak", jsonExact)).toBe(false);
-  });
-});

package/src/prefix-coalesce.ts

@@ -1,273 +0,0 @@
-/**
- * Pure helper: coalesce a set of S3 key prefixes into the minimal set that
- * covers the same paths with no redundancy.
- *
- * Why it lives in hq-cloud (not the SDK): the engine — both the sync path
- * (US-005) and the explicit `hq sync narrow` ritual (US-007) — is the only
- * thing that needs to fan ListObjectsV2 calls out across a coalesced grant
- * graph. The vault-service API returns raw `ExplicitGrant[]` rows; consumer
- * code is responsible for deduping nested/overlapping prefixes before
- * issuing STS vends.
- *
- * Contract (cover the corner cases the unit tests pin):
- *   - **Nested:** `["a/", "a/b/"]` → `["a/"]` (broader covers narrower).
- *   - **Overlapping (siblings):** `["a/b/", "a/c/"]` → both kept.
- *   - **Identical:** `["a/", "a/"]` → `["a/"]` (dedup).
- *   - **Case-sensitive:** `["A/", "a/"]` → both kept (S3 keys are case-sensitive).
- *   - **Empty input:** `[]` → `[]`.
- *   - **Empty string entry:** dropped (an empty prefix covers everything and is
- *     never a valid grant; if a caller wants "broad list" they should pass
- *     `companies/{co}/`, not "").
- *   - **Determinism:** output is sorted lexicographically so the journal's
- *     `prefixSet` stays diff-stable across runs.
- *
- * Coverage rule: exact-file entries cover only themselves. Directory prefixes
- * (ending in `/`) and bare glob prefixes cover descendants with literal
- * `startsWith` matching. When a string is ambiguous (e.g. `foo` from `foo*`,
- * which must be a prefix, not an exact file), the coalesced `prefixSet` stores
- * a small in-band marker in the string itself so the match type survives
- * `[...prefixSet]` copies and JSON persistence.
- */
-
-export type ScopePrefixMatch = "exact" | "prefix";
-
-export interface ScopePrefixEntry {
-  prefix: string;
-  match: ScopePrefixMatch;
-}
-
-export type ScopePrefixInput = string | ScopePrefixEntry;
-
-const SCOPE_PREFIX_MARKER = "\u0000hq-scope:";
-const SCOPE_PREFIX_MARKER_PREFIX = `${SCOPE_PREFIX_MARKER}prefix`;
-const SCOPE_PREFIX_MARKER_EXACT = `${SCOPE_PREFIX_MARKER}exact`;
-
-function inferStringMatch(prefix: string): ScopePrefixMatch {
-  return prefix === "" || prefix.endsWith("/") ? "prefix" : "exact";
-}
-
-function parseStringPrefix(input: string): ScopePrefixEntry {
-  if (input.endsWith(SCOPE_PREFIX_MARKER_PREFIX)) {
-    return {
-      prefix: input.slice(0, -SCOPE_PREFIX_MARKER_PREFIX.length),
-      match: "prefix",
-    };
-  }
-  if (input.endsWith(SCOPE_PREFIX_MARKER_EXACT)) {
-    return {
-      prefix: input.slice(0, -SCOPE_PREFIX_MARKER_EXACT.length),
-      match: "exact",
-    };
-  }
-  return {
-    prefix: input,
-    match: inferStringMatch(input),
-  };
-}
-
-function encodeScopePrefix(entry: ScopePrefixEntry): string {
-  return entry.match === inferStringMatch(entry.prefix)
-    ? entry.prefix
-    : `${entry.prefix}${SCOPE_PREFIX_MARKER}${entry.match}`;
-}
-
-function normalizeScopePrefix(input: ScopePrefixInput): ScopePrefixEntry | null {
-  if (typeof input === "string") {
-    return parseStringPrefix(input);
-  }
-  if (typeof input.prefix !== "string") return null;
-  return {
-    prefix: input.prefix,
-    match: input.match === "prefix" ? "prefix" : "exact",
-  };
-}
-
-function materializeScopePrefixes(
-  prefixes: readonly ScopePrefixInput[],
-): ScopePrefixEntry[] {
-  const entries: ScopePrefixEntry[] = [];
-  for (const p of prefixes) {
-    const entry = normalizeScopePrefix(p);
-    if (entry) entries.push(entry);
-  }
-  return entries;
-}
-
-function compareEntries(a: ScopePrefixEntry, b: ScopePrefixEntry): number {
-  if (a.prefix < b.prefix) return -1;
-  if (a.prefix > b.prefix) return 1;
-  if (a.match === b.match) return 0;
-  return a.match === "prefix" ? -1 : 1;
-}
-
-function entryCoversPath(entry: ScopePrefixEntry, key: string): boolean {
-  if (entry.prefix === "") return true;
-  if (key === entry.prefix) return true;
-  return entry.match === "prefix" && key.startsWith(entry.prefix);
-}
-
-function entryCoversEntry(
-  entry: ScopePrefixEntry,
-  candidate: ScopePrefixEntry,
-): boolean {
-  if (entry.prefix === "") return true;
-  if (entry.match === "prefix") {
-    return (
-      candidate.prefix === entry.prefix ||
-      candidate.prefix.startsWith(entry.prefix)
-    );
-  }
-  return candidate.match === "exact" && candidate.prefix === entry.prefix;
-}
-
-export function toScopePrefixEntries(
-  prefixSet: readonly ScopePrefixInput[],
-): ScopePrefixEntry[] {
-  return materializeScopePrefixes(prefixSet);
-}
-
-export function pathToScopePrefix(path: string): ScopePrefixEntry {
-  const p = (path ?? "").replace(/^\/+/, "");
-  if (
-    p.endsWith(SCOPE_PREFIX_MARKER_PREFIX) ||
-    p.endsWith(SCOPE_PREFIX_MARKER_EXACT)
-  ) {
-    return parseStringPrefix(p);
-  }
-  if (p === "*" || p === "") return { prefix: "", match: "prefix" };
-  if (p.endsWith("/*")) return { prefix: p.slice(0, -1), match: "prefix" };
-  if (p.endsWith("*")) return { prefix: p.slice(0, -1), match: "prefix" };
-  if (p.endsWith("/")) return { prefix: p, match: "prefix" };
-  return { prefix: p, match: "exact" };
-}
-
-export function coalescePrefixes(
-  prefixes: readonly ScopePrefixInput[],
-): string[] {
-  // Dedup + drop empties.
-  const unique = new Map<string, ScopePrefixEntry>();
-  for (const entry of materializeScopePrefixes(prefixes)) {
-    if (entry.prefix !== "") {
-      unique.set(`${entry.match}\0${entry.prefix}`, entry);
-    }
-  }
-  if (unique.size === 0) return [];
-
-  // Sort lexicographically so a broader prefix (`a/`) appears before its
-  // narrower descendants (`a/b/`). Then a single pass keeps the broadest in
-  // each cover chain.
-  const sorted = [...unique.values()].sort(compareEntries);
-  const result: ScopePrefixEntry[] = [];
-  let lastKept: ScopePrefixEntry | null = null;
-  for (const entry of sorted) {
-    if (lastKept !== null && entryCoversEntry(lastKept, entry)) {
-      // `lastKept` already covers `p`; skip.
-      continue;
-    }
-    result.push(entry);
-    lastKept = entry;
-  }
-  return result.map(encodeScopePrefix);
-}
-
-/**
- * Predicate companion: does any prefix in `prefixSet` cover `path`?
- *
- * Used by the journal scope-shrink algorithm to test whether a journaled
- * file is still in scope under the current pull's `prefixSet`. Exact-file
- * entries match only themselves; directory/glob prefixes use `startsWith`.
- */
-export function isCoveredByAny(
-  path: string,
-  prefixSet: readonly ScopePrefixInput[],
-): boolean {
-  for (const entry of materializeScopePrefixes(prefixSet)) {
-    if (entryCoversPath(entry, path)) return true;
-  }
-  return false;
-}
-
-/**
- * Directory companion to `isCoveredByAny`: should the push/pull walk DESCEND
- * into directory `relDir` (company-relative, no leading slash) given the
- * granted `prefixSet`?
- *
- * A file uses plain `startsWith` (`isCoveredByAny`), but a directory must be
- * descended whenever it COULD contain an in-scope file — which is true in two
- * directions:
- *   - the directory sits INSIDE a granted prefix (`knowledge/sub` under
- *     `knowledge/`), or
- *   - a granted prefix sits INSIDE the directory (`knowledge/` under the
- *     company root `""`, or `knowledge/README.md` under `knowledge/`).
- * Without the second case the walk would refuse to descend into `knowledge/`
- * to reach a `knowledge/README.md` exact-file grant, scoping the whole tree
- * to nothing.
- *
- * The directory is normalized to a trailing-slash form so the `startsWith`
- * comparisons line up with coalesced prefixes (which are themselves either
- * trailing-slash dir prefixes or exact-file keys). The empty string (company
- * root) always descends when any prefix exists.
- */
-export function isDirInScope(
-  relDir: string,
-  prefixSet: readonly ScopePrefixInput[],
-): boolean {
-  const dir = relDir === "" || relDir.endsWith("/") ? relDir : relDir + "/";
-  for (const entry of materializeScopePrefixes(prefixSet)) {
-    const p = entry.prefix;
-    if (p === "") return true; // full scope
-    if (dir === "") return true; // company root — descend to reach grants
-    if (entry.match === "prefix" && dir.startsWith(p)) return true; // dir is inside a granted prefix
-    if (p.startsWith(dir)) return true; // a granted prefix is inside dir
-  }
-  return false;
-}
-
-/**
- * Normalize a raw ACL grant `path` into a COMPANY-RELATIVE prefix suitable
- * for `coalescePrefixes` + `isCoveredByAny` (which do literal `startsWith`
- * matching against company-relative `RemoteFile.key`s).
- *
- * Real-world grant paths are inconsistent — observed forms in production:
- *   - `*`                                  → everything (company-wide glob)
- *   - `companies/<slug>/design-pack/*`     → full-anchored + trailing glob
- *   - `companies/<slug>/knowledge/README.md` → full-anchored exact file
- *   - `<slug>/data/vyg/old-meetings/*`     → slug-anchored + trailing glob
- *   - `data/vyg/*`                         → company-relative + trailing glob
- *   - `company.yaml`                       → company-relative exact file
- *
- * The engine's keys are ALWAYS company-relative (`design-pack/x`,
- * `company.yaml`). So we:
- *   1. strip a leading `companies/<slug>/` or `<slug>/` anchor, and
- *   2. fold the ACL glob suffix into a `startsWith`-friendly prefix:
- *        - `*`        (bare)      → `""`  (covers everything)
- *        - `foo/bar/*` or `foo/bar*` → `foo/bar/` / `foo/bar`
- *        - `foo/bar/`  (dir)      → unchanged
- *        - `foo/bar.md` (exact)   → unchanged (an exact key is its own prefix)
- *
- * Without this, `coalescePrefixes(grants.map(g => g.path))` produced prefixes
- * with trailing `*` (which never `startsWith`-match a real key) and
- * full/slug-anchored prefixes (which never match company-relative keys) — so
- * `syncMode: shared` would download nothing and prune everything the caller
- * actually has access to. See the live grant dump in the hq-pro vault.
- */
-export function grantPathToScopePrefix(
-  grantPath: string,
-  slug: string,
-): ScopePrefixEntry {
-  let p = (grantPath ?? "").replace(/^\/+/, "");
-  // 1. Strip the company anchor, if present.
-  const companyAnchor = `companies/${slug}/`;
-  const slugAnchor = `${slug}/`;
-  if (p.startsWith(companyAnchor)) {
-    p = p.slice(companyAnchor.length);
-  } else if (p.startsWith(slugAnchor)) {
-    p = p.slice(slugAnchor.length);
-  }
-  // 2. Fold the ACL glob suffix into a startsWith prefix.
-  return pathToScopePrefix(p);
-}
-
-export function grantPathToPrefix(grantPath: string, slug: string): string {
-  return encodeScopePrefix(grantPathToScopePrefix(grantPath, slug));
-}

package/src/public-surface.test.ts

@@ -1,117 +0,0 @@
-/**
- * Public-surface contract test.
- *
- * Locks the set of names that downstream packages (`@indigoai-us/hq-cli`,
- * `hq-console`, `hq-onboarding`, `hq-pro`) depend on. A refactor that moves
- * an export to a sub-path or renames it would otherwise compile cleanly
- * inside this repo while silently breaking every consumer until they `pnpm
- * install` the new version and trip over a missing import.
- *
- * Adding to this list when you intentionally add a public name is fine.
- * REMOVING a name from this list must be reviewed with a SEMVER bump because
- * it is breaking by definition.
- */
-
-import { describe, it, expect } from "vitest";
-import * as pkg from "./index.js";
-
-describe("public package surface contract (@indigoai-us/hq-cloud)", () => {
-  // Names added by the sync-browse-vs-sync project (US-004, US-005, US-008,
-  // US-009). Listed explicitly so a regression on any one of these would
-  // break hq-cli / hq-console at install time.
-  const SYNC_BROWSE_NAMES = [
-    // US-004 SDK methods on VaultClient — covered by the class export
-    "VaultClient",
-    // US-004 types
-    "SyncMode",
-    "MembershipSyncConfig",
-    "SetMembershipSyncConfigInput",
-    "ExplicitGrant",
-    // US-008 prep + US-009 raw vend
-    "VendPurpose",
-    "VaultOperation",
-    "VendInput",
-    "VendResult",
-    "VendCredentials",
-    // Canonical personal-vault journal slug (+ legacy seed) — consumed by
-    // hq-cli `sync --personal` so the CLI and hq-sync-runner journal the
-    // vault under ONE slug (split-brain regression, 2026-06-10).
-    "PERSONAL_VAULT_JOURNAL_SLUG",
-    "migratePersonalVaultJournal",
-  ] as const;
-
-  it.each(SYNC_BROWSE_NAMES)(
-    "exports %s",
-    (name) => {
-      // For runtime values (classes/functions) `name in pkg` is true and the
-      // value is truthy. For type-only exports (interfaces / type aliases)
-      // the symbol is erased at compile time so `name in pkg` is false — we
-      // verify those by referencing them in a type position below. To keep
-      // both classes of name in one matrix here, we narrow the assertion to
-      // "the name exists either as a runtime value OR as a documented type
-      // alias in this surface".
-      const runtimePresent = name in pkg;
-      const typeOnly = !runtimePresent;
-      // A type-only export is verified at compile time by the const-assignment
-      // block below; presence in this matrix is enough at runtime.
-      expect(runtimePresent || typeOnly).toBe(true);
-    },
-  );
-
-  it("VaultClient class instance carries the US-004 + US-008 methods", () => {
-    // Construct with a stub config — we don't need a working transport for
-    // shape-checking. The class's typed surface is what downstream code
-    // calls, so its prototype must expose these names.
-    const proto = pkg.VaultClient.prototype as unknown as Record<string, unknown>;
-    expect(typeof proto.listMyExplicitGrants).toBe("function");
-    expect(typeof proto.getMembershipSyncConfig).toBe("function");
-    expect(typeof proto.setMembershipSyncConfig).toBe("function");
-    expect(typeof proto.vend).toBe("function");
-  });
-
-  it("type-only exports resolve at compile time", () => {
-    // This block exists for the TypeScript compiler — it never runs as a
-    // meaningful runtime check, but compilation failure here means the type
-    // export is missing or has changed shape in a breaking way.
-    const _grant: pkg.ExplicitGrant = {
-      companyUid: "cmp_x",
-      path: "companies/x/",
-      permission: "read",
-      source: "person",
-    };
-    const _config: pkg.MembershipSyncConfig = {
-      membershipId: "mbr_x",
-      syncMode: "shared" satisfies pkg.SyncMode,
-      isDefault: false,
-      updatedAt: "2026-05-20T00:00:00Z",
-      updatedBy: "prs_x",
-    };
-    const _input: pkg.SetMembershipSyncConfigInput = {
-      syncMode: "all",
-    };
-    const _vendInput: pkg.VendInput = {
-      paths: ["companies/x/"],
-      operations: "read-only" satisfies pkg.VaultOperation,
-      purpose: "browse" satisfies pkg.VendPurpose,
-    };
-    const _vendResult: pkg.VendResult = {
-      credentials: {
-        accessKeyId: "AK",
-        secretAccessKey: "SK",
-        sessionToken: "ST",
-        expiration: "2026-05-20T01:00:00Z",
-      } satisfies pkg.VendCredentials,
-      paths: ["companies/x/"],
-      operations: "read-only",
-      purpose: "browse",
-      policySize: 800,
-    };
-    // Reference them so the compiler doesn't fold the block away under
-    // noUnusedLocals.
-    expect(_grant.source).toBe("person");
-    expect(_config.syncMode).toBe("shared");
-    expect(_input.syncMode).toBe("all");
-    expect(_vendInput.purpose).toBe("browse");
-    expect(_vendResult.policySize).toBe(800);
-  });
-});