@indigoai-us/hq-cloud 6.15.16 → 6.15.18

package/dist/cli/rescue-keep-local-ignore.test.js

@@ -0,0 +1,315 @@
+/**
+ * Regression test for `hq rescue` clobbering root-level ignore files.
+ *
+ * The bug: `.gitignore` / `.hqignore` (and friends) are release-shipped, so the
+ * generic USER-EDIT classifier moved a locally-tuned copy into `personal/` as a
+ * `.drift-<ts>-<pid>` archive and let the overlay lay the release copy down. On
+ * a real HQ root that silently dropped the operator's exclusion rules: the git
+ * mirror started walking a 62 GB `workspace/` again (killed at its 120s
+ * timeout, every pass), and the sync engine walked far more than intended until
+ * its 15-minute STS credentials expired mid-run — surfacing as a red
+ * "Sync failed" in the desktop app.
+ *
+ * These files are machine-local tuning, not scaffold: a rescue must never
+ * overwrite an edited one. The fix classifies an edited root ignore file as
+ * KEEP-LOCAL — left untouched on disk and excluded from the overlay — while an
+ * unedited one still tracks the release, and every other user-edited file is
+ * still rescued into `personal/` exactly as before.
+ *
+ * Runs the real (non-dry-run) rescue so the assertions are about bytes on disk,
+ * not just the classifier's log line. The rescue clones its source from GitHub,
+ * so we shim `git clone` to clone a local fixture repo instead.
+ */
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { execFileSync } from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { runRescue } from "./rescue-core.js";
+function has(bin, ...args) {
+    try {
+        execFileSync(bin, args, { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// Needs git (fixture + clone) and rsync (overlay).
+const toolsAvailable = has("git", "--version") && has("rsync", "--version");
+/**
+ * Env for a fixture run. `GH_TOKEN`/`GITHUB_TOKEN` are stripped on purpose: with
+ * one set, the rescue clones `https://x-access-token:<token>@github.com/...`,
+ * which the `https://github.com/*` shim pattern does not rewrite — the test
+ * would then leave its fixture and attempt a real authenticated network clone.
+ */
+function fixtureEnv(shimDir) {
+    const env = {
+        ...process.env,
+        PATH: `${shimDir}:${process.env.PATH ?? ""}`,
+    };
+    delete env.GH_TOKEN;
+    delete env.GITHUB_TOKEN;
+    return env;
+}
+/** Run the rescue in-process, capturing its stdout/stderr. */
+function runRescueCapture(argv, env) {
+    let stdout = "";
+    let stderr = "";
+    const origOut = process.stdout.write.bind(process.stdout);
+    const origErr = process.stderr.write.bind(process.stderr);
+    process.stdout.write = ((chunk) => {
+        stdout += String(chunk);
+        return true;
+    });
+    process.stderr.write = ((chunk) => {
+        stderr += String(chunk);
+        return true;
+    });
+    let status;
+    try {
+        status = runRescue(argv, { env }).status;
+    }
+    finally {
+        process.stdout.write = origOut;
+        process.stderr.write = origErr;
+    }
+    return { status, stdout, stderr };
+}
+describe.skipIf(!toolsAvailable)("rescue keeps locally-edited root ignore files", () => {
+    let workDir;
+    let upstream;
+    let hqRoot;
+    let shimDir;
+    let floorSha;
+    let out = "";
+    const git = (cwd, ...args) => execFileSync("git", args, {
+        cwd,
+        stdio: ["ignore", "pipe", "pipe"],
+        env: {
+            ...process.env,
+            GIT_AUTHOR_NAME: "t",
+            GIT_AUTHOR_EMAIL: "t@t",
+            GIT_COMMITTER_NAME: "t",
+            GIT_COMMITTER_EMAIL: "t@t",
+        },
+    })
+        .toString()
+        .trim();
+    const read = (rel) => fs.readFileSync(path.join(hqRoot, rel), "utf-8");
+    beforeAll(() => {
+        workDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-rescue-ignore-"));
+        // --- upstream: floor commit, then a HEAD that advances every ignore file --
+        upstream = path.join(workDir, "upstream");
+        fs.mkdirSync(path.join(upstream, "core/docs"), { recursive: true });
+        git(workDir, "init", "-b", "main", "upstream");
+        fs.writeFileSync(path.join(upstream, ".gitignore"), "release-git\n");
+        fs.writeFileSync(path.join(upstream, ".hqignore"), "release-hq\n");
+        fs.writeFileSync(path.join(upstream, ".claudeignore"), "release-claude\n");
+        fs.writeFileSync(path.join(upstream, ".hqinclude"), "release-include\n");
+        fs.writeFileSync(path.join(upstream, "core/docs/.gitignore"), "release-nested\n");
+        fs.writeFileSync(path.join(upstream, "core/edited.md"), "base\n");
+        git(upstream, "add", "-A");
+        git(upstream, "commit", "-m", "floor");
+        floorSha = git(upstream, "rev-parse", "HEAD");
+        // HEAD moves all four ignore files on, so "release wins" is observable.
+        fs.writeFileSync(path.join(upstream, ".gitignore"), "release-git\nv2\n");
+        fs.writeFileSync(path.join(upstream, ".hqignore"), "release-hq\nv2\n");
+        fs.writeFileSync(path.join(upstream, ".claudeignore"), "release-claude\nv2\n");
+        fs.writeFileSync(path.join(upstream, ".hqinclude"), "release-include\nv2\n");
+        fs.writeFileSync(path.join(upstream, "core/docs/.gitignore"), "release-nested\nv2\n");
+        git(upstream, "add", "-A");
+        git(upstream, "commit", "-m", "head");
+        // --- the local HQ root being rescued ------------------------------------
+        hqRoot = path.join(workDir, "hq");
+        fs.mkdirSync(path.join(hqRoot, "core/docs"), { recursive: true });
+        // `companies/` + `personal/` make it look like an HQ root (script guard).
+        fs.mkdirSync(path.join(hqRoot, "personal"), { recursive: true });
+        fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
+        // Root ignore files the operator tuned: differ from BOTH floor and HEAD.
+        // These are the regression — they must survive byte-for-byte.
+        fs.writeFileSync(path.join(hqRoot, ".gitignore"), "release-git\n/workspace/\n");
+        fs.writeFileSync(path.join(hqRoot, ".hqignore"), "release-hq\n*.mp4\n");
+        // Untouched root ignore file (matches floor): still tracks the release.
+        fs.writeFileSync(path.join(hqRoot, ".claudeignore"), "release-claude\n");
+        // A NESTED .gitignore is scaffold, not machine-local tuning: still rescued.
+        fs.writeFileSync(path.join(hqRoot, "core/docs/.gitignore"), "release-nested\nMINE\n");
+        // A root ignore file managed through a symlink (dotfiles repo): the
+        // generic top-level-symlink arm used to `skip` it, after which `rsync -a`
+        // replaced the receiver symlink with the release's regular file.
+        fs.writeFileSync(path.join(hqRoot, "personal/my-hqinclude"), "from-dotfiles\n");
+        fs.symlinkSync("personal/my-hqinclude", path.join(hqRoot, ".hqinclude"));
+        // Control: an ordinary user-edited file is still rescued into personal/.
+        fs.writeFileSync(path.join(hqRoot, "core/edited.md"), "MINE\n");
+        // --- git shim: rewrite `git clone <github-url> dest` to the fixture ------
+        const realGit = execFileSync("bash", ["-lc", "command -v git"]).toString().trim() ||
+            "/usr/bin/git";
+        shimDir = path.join(workDir, "shim");
+        fs.mkdirSync(shimDir, { recursive: true });
+        const shim = `#!/usr/bin/env bash
+if [ "$1" = "clone" ]; then
+  args=()
+  for a in "$@"; do
+    case "$a" in
+      https://github.com/*) a=${JSON.stringify(upstream)} ;;
+    esac
+    args+=("$a")
+  done
+  exec ${JSON.stringify(realGit)} "\${args[@]}"
+fi
+exec ${JSON.stringify(realGit)} "$@"
+`;
+        fs.writeFileSync(path.join(shimDir, "git"), shim, { mode: 0o755 });
+        const env = fixtureEnv(shimDir);
+        // --- run the real rescue (non-dry-run) ----------------------------------
+        const r = runRescueCapture([
+            "--hq-root",
+            hqRoot,
+            "--source",
+            "test/repo",
+            "--ref",
+            "main",
+            "--floor-sha",
+            floorSha,
+            "--yes",
+            "--no-backup",
+        ], env);
+        out = `${r.stdout}\n${r.stderr}`;
+        if (r.status !== 0)
+            throw new Error(`rescue failed (${r.status}):\n${out}`);
+    });
+    afterAll(() => {
+        if (workDir)
+            fs.rmSync(workDir, { recursive: true, force: true });
+    });
+    it("ran in history_floor mode against our floor", () => {
+        expect(out).toContain(`Baseline: ${floorSha}`);
+    });
+    it("leaves an edited root .gitignore byte-for-byte intact (the regression)", () => {
+        expect(read(".gitignore")).toBe("release-git\n/workspace/\n");
+    });
+    it("leaves an edited root .hqignore byte-for-byte intact (the regression)", () => {
+        expect(read(".hqignore")).toBe("release-hq\n*.mp4\n");
+    });
+    it("does not archive edited root ignore files into personal/", () => {
+        const litter = fs
+            .readdirSync(path.join(hqRoot, "personal"))
+            .filter((n) => n.startsWith(".gitignore") || n.startsWith(".hqignore"));
+        expect(litter, `unexpected personal/ archive: ${litter.join(", ")}`).toEqual([]);
+    });
+    it("reports edited root ignore files as keep-local, not rescue", () => {
+        expect(out).toContain("kept local: .gitignore");
+        expect(out).toContain("kept local: .hqignore");
+        expect(out).not.toMatch(/rescued: \.gitignore/);
+        expect(out).not.toMatch(/rescued: \.hqignore/);
+        expect(out).toMatch(/user-edit\s+\(kept local\):\s+3 files/);
+        expect(out).toMatch(/kept-local: 3/);
+    });
+    it("preserves a root ignore file managed as a symlink", () => {
+        const p = path.join(hqRoot, ".hqinclude");
+        expect(fs.lstatSync(p).isSymbolicLink(), ".hqinclude is no longer a symlink").toBe(true);
+        expect(fs.readlinkSync(p)).toBe("personal/my-hqinclude");
+        expect(fs.readFileSync(p, "utf-8")).toBe("from-dotfiles\n");
+        expect(out).toContain("kept local: .hqinclude");
+    });
+    it("still ships release updates for an UNEDITED root ignore file", () => {
+        expect(read(".claudeignore")).toBe("release-claude\nv2\n");
+    });
+    it("still rescues a user-edited NESTED .gitignore (carve-out is root-only)", () => {
+        expect(read("core/docs/.gitignore")).toBe("release-nested\nv2\n");
+        expect(fs.readFileSync(path.join(hqRoot, "personal/docs/.gitignore"), "utf-8")).toBe("release-nested\nMINE\n");
+    });
+    it("still rescues an ordinary user-edited file into personal/", () => {
+        expect(fs.readFileSync(path.join(hqRoot, "personal/edited.md"), "utf-8")).toBe("MINE\n");
+        expect(out).toContain("rescued: core/edited.md  ->  personal/edited.md");
+    });
+});
+/**
+ * KEEP-LOCAL must require *proof* that the operator edited the file, which only
+ * a floor comparison provides. In `head_compare` mode — first-ever run, a
+ * missing or unreachable last-sync stamp, `--no-history-check` — "differs from
+ * HEAD" is all we know, and an untouched ignore file from an older release
+ * looks identical to an edited one. Keeping it there would pin a stale file
+ * locally forever instead of letting it track the release, so this mode falls
+ * back to the pre-existing rescue behaviour.
+ */
+describe.skipIf(!toolsAvailable)("rescue keep-local requires a floor-proven edit", () => {
+    let workDir;
+    let hqRoot;
+    let out = "";
+    const git = (cwd, ...args) => execFileSync("git", args, {
+        cwd,
+        stdio: ["ignore", "pipe", "pipe"],
+        env: {
+            ...process.env,
+            GIT_AUTHOR_NAME: "t",
+            GIT_AUTHOR_EMAIL: "t@t",
+            GIT_COMMITTER_NAME: "t",
+            GIT_COMMITTER_EMAIL: "t@t",
+        },
+    })
+        .toString()
+        .trim();
+    beforeAll(() => {
+        workDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-rescue-nofloor-"));
+        const upstream = path.join(workDir, "upstream");
+        fs.mkdirSync(upstream, { recursive: true });
+        git(workDir, "init", "-b", "main", "upstream");
+        fs.writeFileSync(path.join(upstream, ".gitignore"), "release-git\nv2\n");
+        git(upstream, "add", "-A");
+        git(upstream, "commit", "-m", "head");
+        hqRoot = path.join(workDir, "hq");
+        fs.mkdirSync(path.join(hqRoot, "personal"), { recursive: true });
+        fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
+        // Stale-but-untouched: an older release's copy, indistinguishable from an
+        // edit without a floor to compare against.
+        fs.writeFileSync(path.join(hqRoot, ".gitignore"), "release-git\n");
+        const realGit = execFileSync("bash", ["-lc", "command -v git"]).toString().trim() ||
+            "/usr/bin/git";
+        const shimDir = path.join(workDir, "shim");
+        fs.mkdirSync(shimDir, { recursive: true });
+        fs.writeFileSync(path.join(shimDir, "git"), `#!/usr/bin/env bash
+if [ "$1" = "clone" ]; then
+  args=()
+  for a in "$@"; do
+    case "$a" in
+      https://github.com/*) a=${JSON.stringify(upstream)} ;;
+    esac
+    args+=("$a")
+  done
+  exec ${JSON.stringify(realGit)} "\${args[@]}"
+fi
+exec ${JSON.stringify(realGit)} "$@"
+`, { mode: 0o755 });
+        // No --floor-sha: the rescue falls back to head_compare.
+        const r = runRescueCapture([
+            "--hq-root",
+            hqRoot,
+            "--source",
+            "test/repo",
+            "--ref",
+            "main",
+            "--no-history-check",
+            "--yes",
+            "--no-backup",
+        ], fixtureEnv(shimDir));
+        out = `${r.stdout}\n${r.stderr}`;
+        if (r.status !== 0)
+            throw new Error(`rescue failed (${r.status}):\n${out}`);
+    });
+    afterAll(() => {
+        if (workDir)
+            fs.rmSync(workDir, { recursive: true, force: true });
+    });
+    it("ran in head_compare mode (no usable floor)", () => {
+        expect(out).toContain("Baseline: HEAD compare");
+    });
+    it("does not keep-local without floor-proven evidence of an edit", () => {
+        expect(out).not.toContain("kept local: .gitignore");
+        expect(out).toMatch(/user-edit\s+\(kept local\):\s+0 files/);
+    });
+    it("lets the release update a stale root .gitignore in this mode", () => {
+        expect(fs.readFileSync(path.join(hqRoot, ".gitignore"), "utf-8")).toBe("release-git\nv2\n");
+    });
+});
+//# sourceMappingURL=rescue-keep-local-ignore.test.js.map

package/dist/cli/rescue-keep-local-ignore.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rescue-keep-local-ignore.test.js","sourceRoot":"","sources":["../../src/cli/rescue-keep-local-ignore.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,SAAS,GAAG,CAAC,GAAW,EAAE,GAAG,IAAc;IACzC,IAAI,CAAC;QACH,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAE5E;;;;;GAKG;AACH,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,GAAG,GAAsB;QAC7B,GAAG,OAAO,CAAC,GAAG;QACd,IAAI,EAAE,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE;KAC7C,CAAC;IACF,OAAO,GAAG,CAAC,QAAQ,CAAC;IACpB,OAAO,GAAG,CAAC,YAAY,CAAC;IACxB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8DAA8D;AAC9D,SAAS,gBAAgB,CAAC,IAAc,EAAE,GAAsB;IAC9D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE;QACzC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC,CAAgC,CAAC;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE;QACzC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC,CAAgC,CAAC;IAClC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAC9B,+CAA+C,EAC/C,GAAG,EAAE;IACH,IAAI,OAAe,CAAC;IACpB,IAAI,QAAgB,CAAC;IACrB,IAAI,MAAc,CAAC;IACnB,IAAI,OAAe,CAAC;IACpB,IAAI,QAAgB,CAAC;IACrB,IAAI,GAAG,GAAG,EAAE,CAAC;IAEb,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAG,IAAc,EAAE,EAAE,CAC7C,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QACxB,GAAG;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,eAAe,EAAE,GAAG;YACpB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,GAAG;YACvB,mBAAmB,EAAE,KAAK;SAC3B;KACF,CAAC;SACC,QAAQ,EAAE;SACV,IAAI,EAAE,CAAC;IAEZ,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAC3B,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAEnD,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAEtE,6EAA6E;QAC7E,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC/C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC;QACrE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC;QACnE,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EACpC,kBAAkB,CACnB,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACzE,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAC3C,kBAAkB,CACnB,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,QAAQ,CAAC,CAAC;QAClE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3B,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACvC,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAE9C,wEAAwE;QACxE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACzE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvE,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EACpC,sBAAsB,CACvB,CAAC;QACF,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EACjC,uBAAuB,CACxB,CAAC;QACF,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAC3C,sBAAsB,CACvB,CAAC;QACF,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3B,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAEtC,2EAA2E;QAC3E,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,0EAA0E;QAC1E,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAElE,yEAAyE;QACzE,8DAA8D;QAC9D,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAC/B,4BAA4B,CAC7B,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,qBAAqB,CAAC,CAAC;QACxE,wEAAwE;QACxE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACzE,4EAA4E;QAC5E,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,EACzC,wBAAwB,CACzB,CAAC;QACF,oEAAoE;QACpE,0EAA0E;QAC1E,iEAAiE;QACjE,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAC1C,iBAAiB,CAClB,CAAC;QACF,EAAE,CAAC,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QACzE,yEAAyE;QACzE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,QAAQ,CAAC,CAAC;QAEhE,4EAA4E;QAC5E,MAAM,OAAO,GACX,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;YACjE,cAAc,CAAC;QACjB,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG;;;;;gCAKa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;;;;SAI/C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;;OAEzB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;CAC7B,CAAC;QACI,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAEhC,2EAA2E;QAC3E,MAAM,CAAC,GAAG,gBAAgB,CACxB;YACE,WAAW;YACX,MAAM;YACN,UAAU;YACV,WAAW;YACX,OAAO;YACP,MAAM;YACN,aAAa;YACb,QAAQ;YACR,OAAO;YACP,aAAa;SACd,EACD,GAAG,CACJ,CAAC;QACF,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE;QACZ,IAAI,OAAO;YAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,MAAM,GAAG,EAAE;aACd,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1E,MAAM,CACJ,MAAM,EACN,iCAAiC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrD,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC1C,MAAM,CACJ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,EAChC,mCAAmC,CACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAClE,MAAM,CACJ,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,0BAA0B,CAAC,EAAE,OAAO,CAAC,CACxE,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CACJ,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC,CAClE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjB,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,QAAQ,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAC9B,gDAAgD,EAChD,GAAG,EAAE;IACH,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IACnB,IAAI,GAAG,GAAG,EAAE,CAAC;IAEb,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAG,IAAc,EAAE,EAAE,CAC7C,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QACxB,GAAG;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,eAAe,EAAE,GAAG;YACpB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,GAAG;YACvB,mBAAmB,EAAE,KAAK;SAC3B;KACF,CAAC;SACC,QAAQ,EAAE;SACV,IAAI,EAAE,CAAC;IAEZ,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAEvE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAChD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC/C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACzE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3B,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAEtC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,0EAA0E;QAC1E,2CAA2C;QAC3C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC;QAEnE,MAAM,OAAO,GACX,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;YACjE,cAAc,CAAC;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EACzB;;;;;gCAKwB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;;;;SAI/C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;;OAEzB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;CAC7B,EACO,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QAEF,yDAAyD;QACzD,MAAM,CAAC,GAAG,gBAAgB,CACxB;YACE,WAAW;YACX,MAAM;YACN,UAAU;YACV,WAAW;YACX,OAAO;YACP,MAAM;YACN,oBAAoB;YACpB,OAAO;YACP,aAAa;SACd,EACD,UAAU,CAAC,OAAO,CAAC,CACpB,CAAC;QACF,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE;QACZ,IAAI,OAAO;YAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACpE,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}

package/dist/object-io.d.ts

@@ -152,10 +152,25 @@ export interface ObjectIO {
  * (caching/refresh is the caller's concern, at the EntityContext level — see
  * the original buildClient note in s3.ts).
  */
+/**
+ * Re-resolve one entity's context, returning credentials valid *now*. Backed by
+ * `resolveEntityContext`, which serves from cache and re-vends only inside its
+ * refresh window.
+ */
+export type ContextRefresh = () => Promise<EntityContext>;
+/** Build a {@link ContextRefresh} for a given entity uid. */
+export type ContextRefresherFactory = (uid: string) => ContextRefresh;
 export declare class S3SdkObjectIO implements ObjectIO {
     private readonly client;
     private readonly bucket;
-    constructor(ctx: EntityContext);
+    /**
+     * @param refresh Re-resolve this context's credentials. When supplied, the
+     *   SDK is handed a credential *provider* rather than a frozen object, so a
+     *   pass that outlives its 15-minute STS session renews instead of failing
+     *   with `ExpiredToken`. Omit it only where the instance is known to be
+     *   short-lived; the default factory always supplies one.
+     */
+    constructor(ctx: EntityContext, refresh?: ContextRefresh);
     putObject(input: PutObjectInput): Promise<{
         etag: string;
     }>;
@@ -300,6 +315,14 @@ export declare class PresignObjectIO implements ObjectIO {
     private mintHeadGetUrl;
 }
 export type ObjectIOFactory = (ctx: EntityContext) => ObjectIO;
+/**
+ * The S3-SDK transport, wired so every instance can renew its own STS session.
+ *
+ * Use this rather than the bare default wherever the caller can supply a
+ * refresher: the bare default builds instances that expire with the 15-minute
+ * session that created them.
+ */
+export declare function stsObjectIOFactory(refresherFor: ContextRefresherFactory): ObjectIOFactory;
 /**
  * Install the transport factory for the current process. Passing `null`
  * resets to the default S3 SDK transport. Called once by `runRunner` after it
@@ -314,5 +337,5 @@ export declare function resolveObjectIO(ctx: EntityContext): ObjectIO;
  * transport, reusing the one already-authenticated VaultClient and deriving
  * the per-company authority from `ctx.uid`.
  */
-export declare function presignObjectIOFactory(vault: PresignTransportClient): ObjectIOFactory;
+export declare function presignObjectIOFactory(vault: PresignTransportClient, refresherFor?: ContextRefresherFactory): ObjectIOFactory;
 //# sourceMappingURL=object-io.d.ts.map

package/dist/object-io.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"object-io.d.ts","sourceRoot":"","sources":["../src/object-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAcH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAG3B;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,KAAK,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,EAAE,CAAC,EAAE,SAAS,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,eAAe,EAAE,CAAC;KACzB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;CACJ;AAMD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,WAAW,CAAC,EAAE,GAAG,CAAC;CACnB;AAED,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAChC,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,gFAAgF;IAChF,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjD,eAAe,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC9D,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC1D;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACrC;AAqBD;;;;;GAKG;AACH,qBAAa,aAAc,YAAW,QAAQ;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,GAAG,EAAE,aAAa;IAwBxB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAsB3D,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAa5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAMhD,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAwBhE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAuBhE;AAsBD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACjC,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,GAAG,CACD,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC1C,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAiHD,gFAAgF;AAChF,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,qBAAqB,GAAG,IAAI,GACtC,IAAI,CAEN;AAgJD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,4BAA4B,CAAC;AAYtE;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,EAAE,EAAE,SAAS;gBADb,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,SAAS,EACtB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAQhC;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IAItD,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,eAAe;IAJ/C,QAAQ,CAAC,SAAS,QAAQ;gBAGf,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,GAAG,eAAe;CAKhD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAS;IACxB,SAAS,IAAI,OAAO;IAGpB,IAAI,IAAI,IAAI;CAGb;AAOD;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAgB,YAAW,QAAQ;IAK5C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;gBAG7C,KAAK,EAAE,sBAAsB,EAC7B,UAAU,EAAE,MAAM,EAGlB,OAAO,GAAE,gBAAyC;IAGrE,OAAO,CAAC,QAAQ;IAIhB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIlC,iEAAiE;IACjE,OAAO,CAAC,UAAU;IAWlB,wEAAwE;IACxE,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,gBAAgB;YAMV,aAAa;YA8Bb,oBAAoB;IAYlC,yEAAyE;IACzE,OAAO,CAAC,kBAAkB;IAK1B;;;;OAIG;YACW,UAAU;IAwBxB,OAAO,CAAC,6BAA6B;IAwB/B,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgD5D,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA2CjE;;;;;;;;;;;;;OAaG;IACG,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA8F5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAMhD,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAiBhE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAyG/D;;;OAGG;YACW,cAAc;CAgC7B;AAgLD,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,QAAQ,CAAC;AAM/D;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,GAAG,IAAI,CAExE;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,QAAQ,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,sBAAsB,GAC5B,eAAe,CA4BjB"}
+{"version":3,"file":"object-io.d.ts","sourceRoot":"","sources":["../src/object-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAcH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAG3B;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,KAAK,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,EAAE,CAAC,EAAE,SAAS,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,eAAe,EAAE,CAAC;KACzB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;CACJ;AAMD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,WAAW,CAAC,EAAE,GAAG,CAAC;CACnB;AAED,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAChC,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,gFAAgF;IAChF,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjD,eAAe,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC9D,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC1D;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACrC;AAqBD;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;AAE1D,6DAA6D;AAC7D,MAAM,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,CAAC;AAEtE,qBAAa,aAAc,YAAW,QAAQ;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC;;;;;;OAMG;gBACS,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,cAAc;IA0DlD,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAsB3D,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAa5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAMhD,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAwBhE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAuBhE;AAsBD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACjC,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,GAAG,CACD,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC1C,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAkHD,gFAAgF;AAChF,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,qBAAqB,GAAG,IAAI,GACtC,IAAI,CAEN;AA4ID;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,4BAA4B,CAAC;AAYtE;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,EAAE,EAAE,SAAS;gBADb,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,SAAS,EACtB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAQhC;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IAItD,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,eAAe;IAJ/C,QAAQ,CAAC,SAAS,QAAQ;gBAGf,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,GAAG,eAAe;CAKhD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAS;IACxB,SAAS,IAAI,OAAO;IAGpB,IAAI,IAAI,IAAI;CAGb;AAOD;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAgB,YAAW,QAAQ;IAK5C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;gBAG7C,KAAK,EAAE,sBAAsB,EAC7B,UAAU,EAAE,MAAM,EAGlB,OAAO,GAAE,gBAAyC;IAGrE,OAAO,CAAC,QAAQ;IAIhB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIlC,iEAAiE;IACjE,OAAO,CAAC,UAAU;IAWlB,wEAAwE;IACxE,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,gBAAgB;YAMV,aAAa;YA8Bb,oBAAoB;IAYlC,yEAAyE;IACzE,OAAO,CAAC,kBAAkB;IAK1B;;;;OAIG;YACW,UAAU;IAwBxB,OAAO,CAAC,6BAA6B;IAwB/B,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD5D,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA2CjE;;;;;;;;;;;;;OAaG;IACG,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAwF5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAMhD,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAiBhE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAoG/D;;;OAGG;YACW,cAAc;CAgC7B;AAkLD,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,QAAQ,CAAC;AAI/D;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,uBAAuB,GACpC,eAAe,CAEjB;AAID;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,GAAG,IAAI,CAExE;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,QAAQ,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,sBAAsB,EAC7B,YAAY,CAAC,EAAE,uBAAuB,GACrC,eAAe,CA8BjB"}

package/dist/object-io.js

@@ -42,16 +42,17 @@ async function drainToBuffer(body) {
     }
     return Buffer.concat(chunks);
 }
-/**
- * Direct-to-S3 transport over STS-vended credentials. A fresh client per
- * instance so the latest credentials from the EntityContext are always used
- * (caching/refresh is the caller's concern, at the EntityContext level — see
- * the original buildClient note in s3.ts).
- */
 export class S3SdkObjectIO {
     client;
     bucket;
-    constructor(ctx) {
+    /**
+     * @param refresh Re-resolve this context's credentials. When supplied, the
+     *   SDK is handed a credential *provider* rather than a frozen object, so a
+     *   pass that outlives its 15-minute STS session renews instead of failing
+     *   with `ExpiredToken`. Omit it only where the instance is known to be
+     *   short-lived; the default factory always supplies one.
+     */
+    constructor(ctx, refresh) {
         this.bucket = ctx.bucketName;
         if (!ctx.credentials) {
             // A credential-less context only exists on the presign path (HQ-59
@@ -63,13 +64,45 @@ export class S3SdkObjectIO {
                 `context for ${ctx.uid}; company presign contexts must use ` +
                 `PresignObjectIO. This is a transport-routing bug.`);
         }
+        // A frozen credential object is the whole bug: STS sessions last 15
+        // minutes (context.ts DEFAULT_SESSION_DURATION_SECONDS = 900), and an
+        // instance living longer than that signs with a dead token until S3
+        // answers `ExpiredToken http=400`. Hand the SDK a provider instead — it
+        // caches on the `expiration` we return and calls back once it passes, so
+        // renewal costs nothing until it is actually needed.
+        //
+        // `resolveEntityContext` is already the right thing to call back into: it
+        // serves from cache and re-vends only inside its 2-minute refresh window,
+        // so this does not add a vend per request.
+        const initial = ctx.credentials;
         this.client = new S3Client({
             region: ctx.region,
-            credentials: {
-                accessKeyId: ctx.credentials.accessKeyId,
-                secretAccessKey: ctx.credentials.secretAccessKey,
-                sessionToken: ctx.credentials.sessionToken,
-            },
+            credentials: refresh
+                ? async () => {
+                    const next = await refresh();
+                    if (!next.credentials) {
+                        // The refresher resolved a presign-only context. Signing with
+                        // `undefined` would 403 with an opaque AWS error much later, so
+                        // surface the routing bug here instead.
+                        throw new Error(`S3SdkObjectIO refreshed ${ctx.uid} into a context with no STS ` +
+                            `credentials; company presign contexts must use PresignObjectIO. ` +
+                            `This is a transport-routing bug.`);
+                    }
+                    return {
+                        accessKeyId: next.credentials.accessKeyId,
+                        secretAccessKey: next.credentials.secretAccessKey,
+                        sessionToken: next.credentials.sessionToken,
+                        // Without this the SDK treats the credentials as eternal and
+                        // never calls back — the frozen-credential bug in another shape.
+                        expiration: new Date(next.expiresAt),
+                    };
+                }
+                : {
+                    accessKeyId: initial.accessKeyId,
+                    secretAccessKey: initial.secretAccessKey,
+                    sessionToken: initial.sessionToken,
+                    expiration: new Date(ctx.expiresAt),
+                },
         });
     }
     async putObject(input) {
@@ -344,7 +377,9 @@ function notFoundError(key) {
  * disable every push-side conflict guard and clobber newer remote objects.
  */
 function accessDeniedError(key, detail) {
-    return Object.assign(new Error(`Access denied for ${key}: ${detail}`), { name: "Forbidden" });
+    return Object.assign(new Error(`Access denied for ${key}: ${detail}`), {
+        name: "Forbidden",
+    });
 }
 /**
  * An error shaped like the AWS SDK's 412 (`name: "PreconditionFailed"`) so
@@ -354,7 +389,9 @@ function accessDeniedError(key, detail) {
  * (If-None-Match) — surface as a conflict, never overwrite.
  */
 function preconditionFailedError(key, detail) {
-    return Object.assign(new Error(`Precondition failed for ${key}: ${detail}`), { name: "PreconditionFailed" });
+    return Object.assign(new Error(`Precondition failed for ${key}: ${detail}`), {
+        name: "PreconditionFailed",
+    });
 }
 /**
  * If-Match compares quoted entity-tags. Journal baselines store etags
@@ -723,8 +760,7 @@ export class PresignObjectIO {
                 // presignedGetWithRetry already burned same-URL connection retries.
                 // One outer pass with a freshly minted URL recovers poisoned sockets
                 // that keep failing on the same signed endpoint.
-                if (isRetryablePresignedGetError(err) &&
-                    attempt < FETCH_MAX_RETRIES) {
+                if (isRetryablePresignedGetError(err) && attempt < FETCH_MAX_RETRIES) {
                     lastError = err;
                     forceFreshUrl = true;
                     continue;
@@ -837,8 +873,7 @@ export class PresignObjectIO {
                 res = await presignedGetWithRetry(url, undefined, `presigned HEAD ${key}`);
             }
             catch (err) {
-                if (isRetryablePresignedGetError(err) &&
-                    attempt < FETCH_MAX_RETRIES) {
+                if (isRetryablePresignedGetError(err) && attempt < FETCH_MAX_RETRIES) {
                     lastError = err;
                     forceFreshUrl = true;
                     continue;
@@ -1082,6 +1117,16 @@ async function fetchWithRetry(url, init, what) {
         : new Error(`${what}: failed after ${FETCH_MAX_RETRIES} retries`);
 }
 const DEFAULT_FACTORY = (ctx) => new S3SdkObjectIO(ctx);
+/**
+ * The S3-SDK transport, wired so every instance can renew its own STS session.
+ *
+ * Use this rather than the bare default wherever the caller can supply a
+ * refresher: the bare default builds instances that expire with the 15-minute
+ * session that created them.
+ */
+export function stsObjectIOFactory(refresherFor) {
+    return (ctx) => new S3SdkObjectIO(ctx, refresherFor(ctx.uid));
+}
 let activeFactory = DEFAULT_FACTORY;
 /**
  * Install the transport factory for the current process. Passing `null`
@@ -1101,7 +1146,7 @@ export function resolveObjectIO(ctx) {
  * transport, reusing the one already-authenticated VaultClient and deriving
  * the per-company authority from `ctx.uid`.
  */
-export function presignObjectIOFactory(vault) {
+export function presignObjectIOFactory(vault, refresherFor) {
     // Memoize one PresignObjectIO per company for the run, so a prime() and the
     // transfer loop that drains its URL cache share the SAME instance. (Safe to
     // memoize: PresignObjectIO holds only the vault client — whose token is a
@@ -1120,7 +1165,9 @@ export function presignObjectIOFactory(vault) {
         // presign — keep them on the S3 SDK (STS) transport. Presign is for company
         // vaults (cmp_*), which is where the unbounded-grants problem lives.
         if (!ctx.uid.startsWith("cmp_")) {
-            return new S3SdkObjectIO(ctx);
+            // Personal vaults are the remaining STS holder, and a personal pass over
+            // a large HQ root is exactly the one that outlives a 15-minute session.
+            return new S3SdkObjectIO(ctx, refresherFor?.(ctx.uid));
         }
         let io = byCompany.get(ctx.uid);
         if (!io) {