@indigoai-us/hq-cloud 6.18.44-alpha.8 → 6.18.44

package/dist/context.test.js

@@ -1,646 +0,0 @@
-/**
- * Unit tests for context.ts — entity context resolution (VLT-5 US-001).
- *
- * Uses a mock fetch to simulate vault-service API responses.
- */
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import { resolveEntityContext, refreshEntityContext, clearContextCache, isExpiringSoon, setEntityFetchSleepForTest, } from "./context.js";
-const mockConfig = {
-    apiUrl: "https://vault-api.test",
-    authToken: "test-jwt-token",
-    region: "us-east-1",
-};
-const mockEntity = {
-    uid: "cmp_01ABCDEF",
-    slug: "acme",
-    bucketName: "hq-vault-acme-123",
-    status: "active",
-};
-const mockVendResponse = {
-    credentials: {
-        accessKeyId: "ASIA_TEST_KEY",
-        secretAccessKey: "test-secret",
-        sessionToken: "test-session-token",
-        expiration: new Date(Date.now() + 15 * 60 * 1000).toISOString(),
-    },
-    expiresAt: new Date(Date.now() + 15 * 60 * 1000).toISOString(),
-};
-function setupFetchMock(overrides) {
-    const fetchMock = vi.fn();
-    fetchMock.mockImplementation(async (url) => {
-        const urlStr = String(url);
-        // New per-user-namespace slug resolver (hq-pro PR 67). Maps slug
-        // lookups to `{available: false, conflictingCompanyUid}` so the
-        // caller follows up with `/entity/{uid}`, which lands in the
-        // `/entity/cmp_` branch below — that's where `entityBody` and
-        // `entityStatus` overrides apply. The check-slug branch only
-        // honors `entityStatus` (so tests can simulate a 404/500 on the
-        // namespace lookup itself); its response shape stays fixed.
-        if (urlStr.includes("/entity/check-slug/me")) {
-            return {
-                ok: (overrides?.entityStatus ?? 200) < 400,
-                status: overrides?.entityStatus ?? 200,
-                json: async () => ({
-                    available: false,
-                    conflictingCompanyUid: mockEntity.uid,
-                }),
-                text: async () => JSON.stringify({
-                    available: false,
-                    conflictingCompanyUid: mockEntity.uid,
-                }),
-            };
-        }
-        // Kept for any tests that still mock the legacy global endpoint
-        // directly (none should, post-PR 67 — but harmless if invoked).
-        if (urlStr.includes("/entity/by-slug/")) {
-            return {
-                ok: (overrides?.entityStatus ?? 200) < 400,
-                status: overrides?.entityStatus ?? 200,
-                json: async () => overrides?.entityBody ?? { entity: mockEntity },
-                text: async () => JSON.stringify(overrides?.entityBody ?? { entity: mockEntity }),
-            };
-        }
-        if (urlStr.includes("/entity/cmp_")) {
-            return {
-                ok: (overrides?.entityStatus ?? 200) < 400,
-                status: overrides?.entityStatus ?? 200,
-                json: async () => overrides?.entityBody ?? { entity: mockEntity },
-                text: async () => JSON.stringify(overrides?.entityBody ?? { entity: mockEntity }),
-            };
-        }
-        if (urlStr.includes("/sts/vend")) {
-            return {
-                ok: (overrides?.vendStatus ?? 200) < 400,
-                status: overrides?.vendStatus ?? 200,
-                json: async () => overrides?.vendBody ?? mockVendResponse,
-                text: async () => JSON.stringify(overrides?.vendBody ?? mockVendResponse),
-            };
-        }
-        return { ok: false, status: 404, text: async () => "Not found" };
-    });
-    vi.stubGlobal("fetch", fetchMock);
-    return fetchMock;
-}
-describe("resolveEntityContext", () => {
-    beforeEach(() => {
-        clearContextCache();
-        vi.restoreAllMocks();
-    });
-    it("resolves context by slug", async () => {
-        const fetchMock = setupFetchMock();
-        const ctx = await resolveEntityContext("acme", mockConfig);
-        expect(ctx.uid).toBe("cmp_01ABCDEF");
-        expect(ctx.bucketName).toBe("hq-vault-acme-123");
-        expect(ctx.credentials?.accessKeyId).toBe("ASIA_TEST_KEY");
-        expect(ctx.region).toBe("us-east-1");
-        // Verify entity lookup used the new per-user-namespace endpoint
-        // (PR 67) + a follow-up `/entity/{uid}` materialization + STS.
-        expect(fetchMock).toHaveBeenCalledTimes(3);
-        expect(String(fetchMock.mock.calls[0][0])).toContain("/entity/check-slug/me?type=company&slug=acme");
-        expect(String(fetchMock.mock.calls[1][0])).toContain(`/entity/${mockEntity.uid}`);
-        expect(String(fetchMock.mock.calls[2][0])).toContain("/sts/vend");
-    });
-    it("DEV-2450/2454: rejects a legacy successful vend that silently dropped write scope", async () => {
-        setupFetchMock({
-            vendBody: {
-                ...mockVendResponse,
-                credentials: {
-                    ...mockVendResponse.credentials,
-                    policyTruncated: true,
-                    droppedWriteGrantPrefixes: [
-                        "data/intelligence/deployment-tests/*",
-                        "data/intelligence/founder-signals/*",
-                    ],
-                    retainedGrantPrefixes: ["knowledge/*"],
-                },
-            },
-        });
-        await expect(resolveEntityContext("acme", mockConfig)).rejects.toMatchObject({
-            name: "VaultCredentialScopeError",
-            code: "POLICY_WRITE_SCOPE_TRUNCATED",
-            droppedWriteGrantPrefixes: [
-                "data/intelligence/deployment-tests/*",
-                "data/intelligence/founder-signals/*",
-            ],
-        });
-    });
-    it("resolves context by UID directly", async () => {
-        const fetchMock = setupFetchMock();
-        const ctx = await resolveEntityContext("cmp_01ABCDEF", mockConfig);
-        expect(ctx.uid).toBe("cmp_01ABCDEF");
-        // Verify entity lookup used direct UID endpoint
-        expect(String(fetchMock.mock.calls[0][0])).toContain("/entity/cmp_01ABCDEF");
-    });
-    it("returns cached context when credentials are fresh", async () => {
-        const fetchMock = setupFetchMock();
-        const ctx1 = await resolveEntityContext("acme", mockConfig);
-        const ctx2 = await resolveEntityContext("acme", mockConfig);
-        expect(ctx1).toBe(ctx2); // Same reference
-        // 3 fetches per resolve under the new model: check-slug + entity.get + sts/vend.
-        // 1 resolve here (second call hits cache, no new fetches).
-        expect(fetchMock).toHaveBeenCalledTimes(3);
-    });
-    it("auto-refreshes when credentials expire soon", async () => {
-        const almostExpired = new Date(Date.now() + 60 * 1000).toISOString(); // 1 min left
-        const fetchMock = setupFetchMock({
-            vendBody: {
-                credentials: mockVendResponse.credentials,
-                expiresAt: almostExpired,
-            },
-        });
-        const ctx1 = await resolveEntityContext("acme", mockConfig);
-        // Second call should refresh because <2 min remaining
-        const ctx2 = await resolveEntityContext("acme", mockConfig);
-        expect(ctx2).not.toBe(ctx1);
-        // 2 resolves × 3 fetches each = 6 under the new model.
-        expect(fetchMock).toHaveBeenCalledTimes(6);
-    });
-    it("throws when entity has no bucket", async () => {
-        setupFetchMock({
-            entityBody: { entity: { ...mockEntity, bucketName: undefined } },
-        });
-        await expect(resolveEntityContext("acme", mockConfig)).rejects.toThrow(/no bucket provisioned/);
-    });
-    it("throws on entity lookup failure", async () => {
-        setupFetchMock({ entityStatus: 404 });
-        // The namespace lookup fails first under the new model — error
-        // message now reflects "Failed to check slug" before the
-        // entity.get(uid) step is reached.
-        await expect(resolveEntityContext("nonexistent", mockConfig)).rejects.toThrow(/Failed to check slug/);
-    });
-    it("throws on STS vend failure", async () => {
-        setupFetchMock({ vendStatus: 403 });
-        await expect(resolveEntityContext("acme", mockConfig)).rejects.toThrow(/STS.*vend.*failed/);
-    });
-});
-describe("routing by UID prefix and vend-self dispatch", () => {
-    beforeEach(() => {
-        clearContextCache();
-        vi.restoreAllMocks();
-    });
-    it("prs_* UID: entity resolved via /entity/{uid} and credentials via /sts/vend-self", async () => {
-        const prsEntity = {
-            uid: "prs_01PERSON",
-            slug: "test-person",
-            bucketName: "hq-vault-prs-01person",
-            status: "active",
-        };
-        const calls = [];
-        vi.stubGlobal("fetch", vi.fn().mockImplementation(async (url) => {
-            const u = String(url);
-            calls.push(u);
-            if (u.includes("/entity/prs_")) {
-                return { ok: true, status: 200, json: async () => ({ entity: prsEntity }), text: async () => "" };
-            }
-            if (u.includes("/sts/vend-self")) {
-                return { ok: true, status: 200, json: async () => mockVendResponse, text: async () => "" };
-            }
-            return { ok: false, status: 404, text: async () => "Not found" };
-        }));
-        await resolveEntityContext("prs_01PERSON", mockConfig);
-        expect(calls.some((u) => u.includes("/entity/prs_01PERSON"))).toBe(true);
-        const vendCalls = calls.filter((u) => u.includes("/sts/vend"));
-        expect(vendCalls).toHaveLength(1);
-        expect(vendCalls[0]).toContain("/sts/vend-self");
-    });
-    it("foo_bar slug: entity resolved via /entity/check-slug/me + /entity/<uid> and credentials via /sts/vend", async () => {
-        const calls = [];
-        vi.stubGlobal("fetch", vi.fn().mockImplementation(async (url) => {
-            const u = String(url);
-            calls.push(u);
-            if (u.includes("/entity/check-slug/me")) {
-                return {
-                    ok: true,
-                    status: 200,
-                    json: async () => ({ available: false, conflictingCompanyUid: mockEntity.uid }),
-                    text: async () => "",
-                };
-            }
-            if (u.includes(`/entity/${mockEntity.uid}`)) {
-                return { ok: true, status: 200, json: async () => ({ entity: mockEntity }), text: async () => "" };
-            }
-            if (u.includes("/sts/vend")) {
-                return { ok: true, status: 200, json: async () => mockVendResponse, text: async () => "" };
-            }
-            return { ok: false, status: 404, text: async () => "Not found" };
-        }));
-        await resolveEntityContext("foo_bar", mockConfig);
-        expect(calls.some((u) => u.includes("/entity/check-slug/me?type=company&slug=foo_bar"))).toBe(true);
-        const vendCalls = calls.filter((u) => u.includes("/sts/vend"));
-        expect(vendCalls).toHaveLength(1);
-        expect(vendCalls[0]).not.toContain("/sts/vend-self");
-        expect(vendCalls[0]).toContain("/sts/vend");
-    });
-    it("team_alpha slug: entity resolved via /entity/check-slug/me + /entity/<uid> and credentials via /sts/vend", async () => {
-        const calls = [];
-        vi.stubGlobal("fetch", vi.fn().mockImplementation(async (url) => {
-            const u = String(url);
-            calls.push(u);
-            if (u.includes("/entity/check-slug/me")) {
-                return {
-                    ok: true,
-                    status: 200,
-                    json: async () => ({ available: false, conflictingCompanyUid: mockEntity.uid }),
-                    text: async () => "",
-                };
-            }
-            if (u.includes(`/entity/${mockEntity.uid}`)) {
-                return { ok: true, status: 200, json: async () => ({ entity: mockEntity }), text: async () => "" };
-            }
-            if (u.includes("/sts/vend")) {
-                return { ok: true, status: 200, json: async () => mockVendResponse, text: async () => "" };
-            }
-            return { ok: false, status: 404, text: async () => "Not found" };
-        }));
-        await resolveEntityContext("team_alpha", mockConfig);
-        expect(calls.some((u) => u.includes("/entity/check-slug/me?type=company&slug=team_alpha"))).toBe(true);
-        const vendCalls = calls.filter((u) => u.includes("/sts/vend"));
-        expect(vendCalls).toHaveLength(1);
-        expect(vendCalls[0]).not.toContain("/sts/vend-self");
-    });
-    it("cmp_* UID: entity resolved via /entity/{uid} and credentials via /sts/vend", async () => {
-        const calls = [];
-        vi.stubGlobal("fetch", vi.fn().mockImplementation(async (url) => {
-            const u = String(url);
-            calls.push(u);
-            if (u.includes("/entity/cmp_")) {
-                return { ok: true, status: 200, json: async () => ({ entity: mockEntity }), text: async () => "" };
-            }
-            if (u.includes("/sts/vend")) {
-                return { ok: true, status: 200, json: async () => mockVendResponse, text: async () => "" };
-            }
-            return { ok: false, status: 404, text: async () => "Not found" };
-        }));
-        await resolveEntityContext("cmp_01ABCDEF", mockConfig);
-        expect(calls.some((u) => u.includes("/entity/cmp_01ABCDEF"))).toBe(true);
-        const vendCalls = calls.filter((u) => u.includes("/sts/vend"));
-        expect(vendCalls).toHaveLength(1);
-        expect(vendCalls[0]).not.toContain("/sts/vend-self");
-        expect(vendCalls[0]).toContain("/sts/vend");
-    });
-});
-// ---------------------------------------------------------------------------
-// HQ-59 company vend-skip (presign transport)
-//
-// When the run uses the presigned-URL transport for company vaults
-// (`companyVaultUsesPresign`), resolveEntityContext must NOT call the company
-// `/sts/vend` route — the presign transport needs no STS creds, and the mere
-// presence of a cmp_ vend call is the pre-6.11.6 signal the hq-pro min-version
-// gate denies on. Personal vaults must still vend self.
-// ---------------------------------------------------------------------------
-describe("HQ-59 company vend-skip (companyVaultUsesPresign)", () => {
-    const presignConfig = {
-        ...mockConfig,
-        companyVaultUsesPresign: true,
-    };
-    beforeEach(() => {
-        clearContextCache();
-        vi.restoreAllMocks();
-    });
-    it("cmp_* UID: SKIPS /sts/vend, returns no credentials + a far-future expiry", async () => {
-        const calls = [];
-        vi.stubGlobal("fetch", vi.fn().mockImplementation(async (url) => {
-            const u = String(url);
-            calls.push(u);
-            if (u.includes("/entity/cmp_")) {
-                return { ok: true, status: 200, json: async () => ({ entity: mockEntity }), text: async () => "" };
-            }
-            // If a vend ever fires, surface it as a hard failure so the test fails
-            // LOUDLY rather than silently allowing the route the gate watches.
-            if (u.includes("/sts/vend")) {
-                return { ok: true, status: 200, json: async () => mockVendResponse, text: async () => "" };
-            }
-            return { ok: false, status: 404, text: async () => "Not found" };
-        }));
-        const ctx = await resolveEntityContext("cmp_01ABCDEF", presignConfig);
-        // The load-bearing assertion: NO company vend route was hit.
-        expect(calls.some((u) => u.includes("/sts/vend"))).toBe(false);
-        expect(calls.some((u) => u.includes("/entity/cmp_01ABCDEF"))).toBe(true);
-        // Credential-less context with a sentinel far-future expiry → never re-vends.
-        expect(ctx.credentials).toBeUndefined();
-        expect(ctx.bucketName).toBe(mockEntity.bucketName);
-        expect(isExpiringSoon(ctx.expiresAt)).toBe(false);
-    });
-    it("company slug: SKIPS /sts/vend after the namespace + entity lookup", async () => {
-        const calls = [];
-        vi.stubGlobal("fetch", vi.fn().mockImplementation(async (url) => {
-            const u = String(url);
-            calls.push(u);
-            if (u.includes("/entity/check-slug/me")) {
-                return {
-                    ok: true,
-                    status: 200,
-                    json: async () => ({ available: false, conflictingCompanyUid: mockEntity.uid }),
-                    text: async () => "",
-                };
-            }
-            if (u.includes(`/entity/${mockEntity.uid}`)) {
-                return { ok: true, status: 200, json: async () => ({ entity: mockEntity }), text: async () => "" };
-            }
-            if (u.includes("/sts/vend")) {
-                return { ok: true, status: 200, json: async () => mockVendResponse, text: async () => "" };
-            }
-            return { ok: false, status: 404, text: async () => "Not found" };
-        }));
-        const ctx = await resolveEntityContext("acme", presignConfig);
-        expect(calls.some((u) => u.includes("/sts/vend"))).toBe(false);
-        expect(ctx.credentials).toBeUndefined();
-    });
-    it("prs_* UID: STILL vends self even with the company flag set", async () => {
-        const prsEntity = {
-            uid: "prs_01PERSON",
-            slug: "test-person",
-            bucketName: "hq-vault-prs-01person",
-            status: "active",
-        };
-        const calls = [];
-        vi.stubGlobal("fetch", vi.fn().mockImplementation(async (url) => {
-            const u = String(url);
-            calls.push(u);
-            if (u.includes("/entity/prs_")) {
-                return { ok: true, status: 200, json: async () => ({ entity: prsEntity }), text: async () => "" };
-            }
-            if (u.includes("/sts/vend-self")) {
-                return { ok: true, status: 200, json: async () => mockVendResponse, text: async () => "" };
-            }
-            return { ok: false, status: 404, text: async () => "Not found" };
-        }));
-        const ctx = await resolveEntityContext("prs_01PERSON", presignConfig);
-        const vendCalls = calls.filter((u) => u.includes("/sts/vend"));
-        expect(vendCalls).toHaveLength(1);
-        expect(vendCalls[0]).toContain("/sts/vend-self");
-        expect(ctx.credentials?.accessKeyId).toBe(mockVendResponse.credentials.accessKeyId);
-    });
-    it("flag OFF (default): cmp_* still vends — no behavior change without the flag", async () => {
-        const calls = [];
-        vi.stubGlobal("fetch", vi.fn().mockImplementation(async (url) => {
-            const u = String(url);
-            calls.push(u);
-            if (u.includes("/entity/cmp_")) {
-                return { ok: true, status: 200, json: async () => ({ entity: mockEntity }), text: async () => "" };
-            }
-            if (u.includes("/sts/vend")) {
-                return { ok: true, status: 200, json: async () => mockVendResponse, text: async () => "" };
-            }
-            return { ok: false, status: 404, text: async () => "Not found" };
-        }));
-        const ctx = await resolveEntityContext("cmp_01ABCDEF", mockConfig);
-        const vendCalls = calls.filter((u) => u.includes("/sts/vend"));
-        expect(vendCalls).toHaveLength(1);
-        expect(vendCalls[0]).toContain("/sts/vend");
-        expect(ctx.credentials?.accessKeyId).toBe(mockVendResponse.credentials.accessKeyId);
-    });
-});
-describe("refreshEntityContext", () => {
-    beforeEach(() => {
-        clearContextCache();
-        vi.restoreAllMocks();
-    });
-    it("evicts cache and fetches fresh credentials", async () => {
-        const fetchMock = setupFetchMock();
-        const ctx1 = await resolveEntityContext("acme", mockConfig);
-        const ctx2 = await refreshEntityContext("acme", mockConfig);
-        expect(ctx2).not.toBe(ctx1);
-        // 2 resolves × 3 fetches each = 6 under the new model
-        // (check-slug + entity.get + sts/vend each).
-        expect(fetchMock).toHaveBeenCalledTimes(6);
-    });
-});
-describe("isExpiringSoon", () => {
-    it("returns false when well within TTL", () => {
-        const future = new Date(Date.now() + 10 * 60 * 1000).toISOString();
-        expect(isExpiringSoon(future)).toBe(false);
-    });
-    it("returns true when within 2 minutes", () => {
-        const soon = new Date(Date.now() + 90 * 1000).toISOString();
-        expect(isExpiringSoon(soon)).toBe(true);
-    });
-    it("returns true when already expired", () => {
-        const past = new Date(Date.now() - 1000).toISOString();
-        expect(isExpiringSoon(past)).toBe(true);
-    });
-});
-// ---------------------------------------------------------------------------
-// Refreshable authToken getter
-//
-// Regression for the personal-sync 401: a long-running `hq-sync-runner` run
-// captures vaultConfig.authToken as a string at startup, then `refreshEntityContext`
-// fires ~13 min into the personal-company sync (STS expiry) and uses that
-// stale string against API Gateway's JWT authorizer → 401. The getter form
-// lets every fetchEntity / postVend call resolve the latest token from disk.
-// ---------------------------------------------------------------------------
-describe("authToken getter is invoked per-request (regression: personal-sync 401)", () => {
-    beforeEach(() => {
-        clearContextCache();
-        vi.restoreAllMocks();
-    });
-    it("calls the getter on entity fetch AND on vend (every request)", async () => {
-        setupFetchMock();
-        const getter = vi.fn(async () => "fresh-token");
-        await resolveEntityContext("cmp_01ABCDEF", {
-            apiUrl: "https://vault-api.test",
-            authToken: getter,
-        });
-        // Two upstream requests: fetchEntity (UID looks like a UID) + postVend.
-        expect(getter).toHaveBeenCalledTimes(2);
-    });
-    it("picks up a rotated token between resolveEntityContext and refreshEntityContext", async () => {
-        const fetchMock = setupFetchMock();
-        let current = "stale-token";
-        const cfg = {
-            apiUrl: "https://vault-api.test",
-            authToken: async () => current,
-        };
-        await resolveEntityContext("cmp_01ABCDEF", cfg);
-        // fetchEntity + vend during initial resolution — both used "stale-token"
-        const initialAuth = fetchMock.mock.calls.map(([, init]) => init.headers.Authorization);
-        expect(initialAuth.every((a) => a === "Bearer stale-token")).toBe(true);
-        // Simulate the on-disk token rotating mid-flight.
-        current = "fresh-token";
-        await refreshEntityContext("cmp_01ABCDEF", cfg);
-        // The post-refresh calls must use the new token. Without the per-request
-        // getter, refreshEntityContext would still send "Bearer stale-token" and
-        // 401 against the gateway.
-        const allCalls = fetchMock.mock.calls;
-        const postRefreshCalls = allCalls.slice(initialAuth.length);
-        expect(postRefreshCalls.length).toBeGreaterThan(0);
-        for (const [, init] of postRefreshCalls) {
-            expect(init.headers.Authorization).toBe("Bearer fresh-token");
-        }
-    });
-    it("static-string authToken still works (back-compat)", async () => {
-        const fetchMock = setupFetchMock();
-        await resolveEntityContext("cmp_01ABCDEF", {
-            apiUrl: "https://vault-api.test",
-            authToken: "static-token",
-        });
-        const calls = fetchMock.mock.calls;
-        expect(calls.length).toBeGreaterThan(0);
-        for (const [, init] of calls) {
-            expect(init.headers.Authorization).toBe("Bearer static-token");
-        }
-    });
-});
-// ---------------------------------------------------------------------------
-// Transient HTTP on GET /entity/{uid} (2026-09-18 Odin 429)
-//
-// A vault throttle used to throw on the first 429, the company fanout counted
-// that as a deterministic error, and the box went `degraded partial`. Retry
-// the lookup; leave 4xx other than 429 as immediate hard failures.
-// ---------------------------------------------------------------------------
-function entityJsonResponse(status, body, headers) {
-    return new Response(JSON.stringify(body), {
-        status,
-        headers: { "content-type": "application/json", ...headers },
-    });
-}
-function stubEntityThenVend(entityImpl) {
-    const fetchMock = vi.fn(async (url) => {
-        const urlStr = String(url);
-        if (urlStr.includes("/entity/cmp_"))
-            return entityImpl();
-        if (urlStr.includes("/sts/vend")) {
-            return entityJsonResponse(200, mockVendResponse);
-        }
-        return new Response("Not found", { status: 404 });
-    });
-    vi.stubGlobal("fetch", fetchMock);
-    return fetchMock;
-}
-describe("entity fetch retries transient HTTP (429/502/503/504)", () => {
-    const sleeps = [];
-    beforeEach(() => {
-        clearContextCache();
-        vi.restoreAllMocks();
-        sleeps.length = 0;
-        setEntityFetchSleepForTest(async (ms) => {
-            sleeps.push(ms);
-        });
-    });
-    afterEach(() => {
-        setEntityFetchSleepForTest(undefined);
-    });
-    it("a 429 then success on retry yields a resolved company context", async () => {
-        let entityCalls = 0;
-        stubEntityThenVend(() => {
-            entityCalls += 1;
-            if (entityCalls === 1) {
-                return entityJsonResponse(429, { message: "Too Many Requests" }, { "Retry-After": "1" });
-            }
-            return entityJsonResponse(200, { entity: mockEntity });
-        });
-        const ctx = await resolveEntityContext("cmp_01ABCDEF", mockConfig);
-        expect(ctx.uid).toBe(mockEntity.uid);
-        expect(ctx.bucketName).toBe(mockEntity.bucketName);
-        expect(entityCalls).toBe(2);
-        expect(sleeps).toEqual([1000]);
-    });
-    it("429 on every attempt throws the last failure after 4 tries (message preserved)", async () => {
-        let entityCalls = 0;
-        stubEntityThenVend(() => {
-            entityCalls += 1;
-            return entityJsonResponse(429, { message: "Too Many Requests" });
-        });
-        await expect(resolveEntityContext("cmp_01ABCDEF", mockConfig)).rejects.toThrow('Failed to fetch entity cmp_01ABCDEF: 429 {"message":"Too Many Requests"}');
-        expect(entityCalls).toBe(4);
-        expect(sleeps).toEqual([500, 1000, 2000]);
-    });
-    it("a 403 is still a hard failure on the first attempt with no retry", async () => {
-        let entityCalls = 0;
-        stubEntityThenVend(() => {
-            entityCalls += 1;
-            return entityJsonResponse(403, { message: "Forbidden" });
-        });
-        await expect(resolveEntityContext("cmp_01ABCDEF", mockConfig)).rejects.toThrow('Failed to fetch entity cmp_01ABCDEF: 403 {"message":"Forbidden"}');
-        expect(entityCalls).toBe(1);
-        expect(sleeps).toEqual([]);
-    });
-});
-// ---------------------------------------------------------------------------
-// Transient HTTP on POST /sts/vend-self (2026-09-18 Ecom Analyst 429)
-//
-// A vault throttle on STS vend used to throw on the first 429, the personal
-// sync pass counted that as a company error, and the maintenance ritual
-// failed. Retry the vend in place; leave credential-scope 4xx as immediate
-// hard failures. Exhausted retries keep the original `STS … failed:` text.
-// ---------------------------------------------------------------------------
-const mockPersonEntity = {
-    uid: "prs_01PERSON",
-    slug: "test-person",
-    bucketName: "hq-vault-prs-01person",
-    status: "active",
-};
-function stubEntityThenVendSelf(vendImpl) {
-    const fetchMock = vi.fn(async (url) => {
-        const urlStr = String(url);
-        if (urlStr.includes("/entity/prs_")) {
-            return entityJsonResponse(200, { entity: mockPersonEntity });
-        }
-        if (urlStr.includes("/sts/vend-self")) {
-            return vendImpl();
-        }
-        return new Response("Not found", { status: 404 });
-    });
-    vi.stubGlobal("fetch", fetchMock);
-    return fetchMock;
-}
-describe("STS vend retries transient HTTP (429/502/503/504)", () => {
-    const sleeps = [];
-    beforeEach(() => {
-        clearContextCache();
-        vi.restoreAllMocks();
-        sleeps.length = 0;
-        setEntityFetchSleepForTest(async (ms) => {
-            sleeps.push(ms);
-        });
-    });
-    afterEach(() => {
-        setEntityFetchSleepForTest(undefined);
-    });
-    it("a 429 then success on retry yields a resolved personal context", async () => {
-        let vendCalls = 0;
-        const fetchMock = stubEntityThenVendSelf(() => {
-            vendCalls += 1;
-            if (vendCalls === 1) {
-                return entityJsonResponse(429, { message: "Too Many Requests" }, { "Retry-After": "1" });
-            }
-            return entityJsonResponse(200, mockVendResponse);
-        });
-        const ctx = await resolveEntityContext("prs_01PERSON", mockConfig);
-        expect(ctx.uid).toBe(mockPersonEntity.uid);
-        expect(ctx.bucketName).toBe(mockPersonEntity.bucketName);
-        expect(ctx.credentials?.accessKeyId).toBe(mockVendResponse.credentials.accessKeyId);
-        expect(vendCalls).toBe(2);
-        expect(fetchMock.mock.calls.filter(([url]) => String(url).includes("/sts/vend-self"))).toHaveLength(2);
-        expect(sleeps).toEqual([1000]);
-    });
-    it("429 on every attempt throws the original STS error after 4 tries (message preserved)", async () => {
-        let vendCalls = 0;
-        stubEntityThenVendSelf(() => {
-            vendCalls += 1;
-            return entityJsonResponse(429, { message: "Too Many Requests" });
-        });
-        await expect(resolveEntityContext("prs_01PERSON", mockConfig)).rejects.toThrow('STS /sts/vend-self failed: 429 {"message":"Too Many Requests"}');
-        expect(vendCalls).toBe(4);
-        expect(sleeps).toEqual([500, 1000, 2000]);
-    });
-    it("a 403 with a credential-scope body is a hard failure on the first attempt with no retry", async () => {
-        let vendCalls = 0;
-        stubEntityThenVendSelf(() => {
-            vendCalls += 1;
-            return entityJsonResponse(403, {
-                code: "POLICY_WRITE_SCOPE_TRUNCATED",
-                droppedWriteGrantPrefixes: ["knowledge/*"],
-                retainedGrantPrefixes: [],
-            });
-        });
-        await expect(resolveEntityContext("prs_01PERSON", mockConfig)).rejects.toMatchObject({
-            name: "VaultCredentialScopeError",
-            code: "POLICY_WRITE_SCOPE_TRUNCATED",
-            droppedWriteGrantPrefixes: ["knowledge/*"],
-        });
-        expect(vendCalls).toBe(1);
-        expect(sleeps).toEqual([]);
-    });
-});
-//# sourceMappingURL=context.test.js.map