@indigoai-us/hq-cloud 6.18.44-alpha.8 → 6.18.44

package/dist/object-io.test.js

@@ -1,2376 +0,0 @@
-/**
- * Unit tests for the ObjectIO transport seam.
- *
- * Focus is the PresignObjectIO path (the new transport): it talks to a
- * VaultClient-shaped stub for URL minting and a mocked global `fetch` for the
- * byte movement. The S3SdkObjectIO path is already covered transitively by
- * s3.test.ts (which exercises s3.ts through the default factory), plus a couple
- * of factory-selection tests here.
- */
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { createHash } from "node:crypto";
-import * as http from "node:http";
-import { PassThrough } from "node:stream";
-import { once } from "node:events";
-import { spawn } from "node:child_process";
-import { PresignObjectIO, S3SdkObjectIO, setObjectIOFactory, setObjectIOBodyIdleTimeoutMsForTesting, setObjectIORequestTimeoutMsForTesting, setPresignedGetTransportForTesting, setFilesAdmissionTimeoutMsForTesting, resolveObjectIO, presignObjectIOFactory, OBJECT_IO_REQUEST_TIMEOUT_MS, objectIORequestTimeoutMs, ObjectBodyIdleTimeoutError, ObjectLockChecksumRequiredError, } from "./object-io.js";
-import * as objectIoModule from "./object-io.js";
-import { isTransientNetworkError } from "./lib/net-errors.js";
-import { BandwidthGovernor, setBandwidthGovernorForTesting } from "./bandwidth.js";
-import { contentMd5Base64 } from "./lib/s3-content-checksum.js";
-import { vaultErrorFromResponse } from "./vault-client.js";
-import { PLAN_LIMIT_UPGRADE_URL, admissionAllowedBody, admissionUnsupportedBody, canonicalPlanLimitBody, companyPresignRefusalRow, } from "./plan-limit.fixtures.js";
-import { isAccessDenied, isNotFound } from "./sync-core.js";
-const COMPANY = "cmp_test";
-function fetchBackedPresignedGetTransport() {
-    return {
-        async get(url, headers) {
-            const response = await fetch(url, { method: "GET", headers });
-            const body = response.body;
-            return {
-                status: response.status,
-                headers: response.headers,
-                body: body
-                    ? (async function* () {
-                        const reader = body.getReader();
-                        let exhausted = false;
-                        try {
-                            while (true) {
-                                const { done, value } = await reader.read();
-                                if (done) {
-                                    exhausted = true;
-                                    return;
-                                }
-                                if (value.byteLength > 0)
-                                    yield value;
-                            }
-                        }
-                        finally {
-                            if (!exhausted) {
-                                try {
-                                    await reader.cancel();
-                                }
-                                catch {
-                                    // The response may already have been cancelled by destroy.
-                                }
-                            }
-                            reader.releaseLock();
-                        }
-                    })()
-                    : undefined,
-                destroy: () => {
-                    void body?.cancel().catch(() => undefined);
-                },
-            };
-        },
-    };
-}
-beforeEach(() => {
-    setPresignedGetTransportForTesting(fetchBackedPresignedGetTransport());
-});
-afterEach(() => {
-    setPresignedGetTransportForTesting(null);
-});
-describe("realtime ObjectIO payload priority", () => {
-    afterEach(() => {
-        setBandwidthGovernorForTesting(null);
-        vi.unstubAllGlobals();
-    });
-    it("bypasses SDK GET and PUT pacing while retaining ordinary chore pacing", async () => {
-        const governor = new BandwidthGovernor({ maxBytesPerSec: 1 });
-        const acquire = vi.spyOn(governor, "acquire").mockResolvedValue();
-        setBandwidthGovernorForTesting(governor);
-        const body = (async function* () {
-            yield Buffer.from("payload");
-        })();
-        const io = new S3SdkObjectIO(ctx());
-        io.client = {
-            send: async (command) => command.constructor.name === "GetObjectCommand"
-                ? { Body: body, Metadata: {} }
-                : { ETag: '"uploaded"' },
-        };
-        await io.putObject({
-            key: "realtime-put",
-            body: Buffer.from("realtime"),
-            contentType: "text/plain",
-            bypassBandwidthGovernor: true,
-        });
-        const realtimeGet = await io.getObjectStream("realtime-get", {
-            bypassBandwidthGovernor: true,
-        });
-        await realtimeGet.body[Symbol.asyncIterator]().next();
-        expect(acquire).not.toHaveBeenCalled();
-        await io.putObject({
-            key: "chore-put",
-            body: Buffer.from("chore"),
-            contentType: "text/plain",
-        });
-        expect(acquire).toHaveBeenCalledOnce();
-    });
-    it("bypasses presigned GET and PUT pacing for realtime transfers", async () => {
-        const governor = new BandwidthGovernor({ maxBytesPerSec: 1 });
-        const acquire = vi.spyOn(governor, "acquire").mockResolvedValue();
-        setBandwidthGovernorForTesting(governor);
-        const { vault, setPresign } = makeVault();
-        const fetchMock = vi.fn();
-        vi.stubGlobal("fetch", fetchMock);
-        setPresign([
-            { key: "realtime", op: "put", url: "https://s3/realtime-put" },
-            { key: "realtime", op: "get", url: "https://s3/realtime-get" },
-            { key: "chore", op: "put", url: "https://s3/chore-put" },
-        ]);
-        fetchMock.mockResolvedValue(new Response(null, { status: 200, headers: { etag: '"ok"' } }));
-        setPresignedGetTransportForTesting({
-            get: async () => ({
-                status: 200,
-                headers: new Headers(),
-                body: (async function* () { yield Buffer.from("payload"); })(),
-                destroy: () => undefined,
-            }),
-        });
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.putObject({
-            key: "realtime",
-            body: Buffer.from("realtime"),
-            contentType: "text/plain",
-            bypassBandwidthGovernor: true,
-        });
-        const realtimeGet = await io.getObjectStream("realtime", {
-            bypassBandwidthGovernor: true,
-        });
-        await realtimeGet.body[Symbol.asyncIterator]().next();
-        expect(acquire).not.toHaveBeenCalled();
-        await io.putObject({
-            key: "chore",
-            body: Buffer.from("chore"),
-            contentType: "text/plain",
-        });
-        expect(acquire).toHaveBeenCalledOnce();
-    });
-});
-describe("ObjectIO payload-sized request timeout", () => {
-    it("extends large PUT deadlines while keeping the small-object base unchanged", () => {
-        expect(objectIORequestTimeoutMs()).toBe(OBJECT_IO_REQUEST_TIMEOUT_MS);
-        expect(objectIORequestTimeoutMs(8 * 1024 * 1024)).toBe(124_000);
-        expect(objectIORequestTimeoutMs(48_800_000)).toBe(436_000);
-    });
-});
-describe("ObjectIO idle timeout and bandwidth pacing", () => {
-    afterEach(() => {
-        setBandwidthGovernorForTesting(null);
-        setObjectIOBodyIdleTimeoutMsForTesting(undefined);
-    });
-    it("does not count governor wait time as socket idle time", async () => {
-        setObjectIOBodyIdleTimeoutMsForTesting(30);
-        const governor = new BandwidthGovernor({ maxBytesPerSec: 10 }, {
-            sleep: async (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-        });
-        setBandwidthGovernorForTesting(governor);
-        const body = (async function* () {
-            yield Buffer.alloc(1);
-        })();
-        const io = new S3SdkObjectIO(ctx());
-        io.client = {
-            send: async () => ({ Body: body, Metadata: {} }),
-        };
-        const response = await io.getObjectStream("docs/paced.md");
-        const chunks = [];
-        for await (const chunk of response.body)
-            chunks.push(chunk);
-        expect(Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)))).toEqual(Buffer.alloc(1));
-    }, 5_000);
-});
-describe("ObjectIO adaptive bandwidth sampling", () => {
-    afterEach(() => {
-        setBandwidthGovernorForTesting(null);
-        vi.unstubAllGlobals();
-    });
-    for (const transport of ["S3 SDK", "presigned"]) {
-        it(`learns raw upload capacity from an upload-only ${transport} run`, async () => {
-            let now = 0;
-            const governor = new BandwidthGovernor({ percent: 50 }, { now: () => now, sleep: async (ms) => { now += ms; } });
-            setBandwidthGovernorForTesting(governor);
-            if (transport === "S3 SDK") {
-                const io = new S3SdkObjectIO(ctx());
-                io.client = {
-                    send: async () => {
-                        now += 1000;
-                        return { ETag: '"uploaded"' };
-                    },
-                };
-                await io.putObject({
-                    key: "upload-only.bin",
-                    body: Buffer.alloc(1_000_000),
-                    contentType: "application/octet-stream",
-                });
-            }
-            else {
-                const { vault, setPresign } = makeVault();
-                setPresign([{ key: "upload-only.bin", op: "put", url: "https://s3/upload-only" }]);
-                const fetchMock = vi.fn(async () => {
-                    now += 1000;
-                    return new Response(null, { status: 200, headers: { etag: '"uploaded"' } });
-                });
-                vi.stubGlobal("fetch", fetchMock);
-                await new PresignObjectIO(vault, COMPANY).putObject({
-                    key: "upload-only.bin",
-                    body: Buffer.alloc(1_000_000),
-                    contentType: "application/octet-stream",
-                });
-                expect(fetchMock).toHaveBeenCalledOnce();
-            }
-            expect(governor.effectiveRateBps()).toBe(500_000);
-        });
-    }
-    it("samples transport arrivals before buffered GET chunks are pulled", async () => {
-        let now = 1000;
-        const governor = new BandwidthGovernor({ percent: 60 }, { now: () => now, sleep: async (ms) => { now += ms; } });
-        setBandwidthGovernorForTesting(governor);
-        const body = new PassThrough();
-        const io = new S3SdkObjectIO(ctx());
-        io.client = {
-            send: async () => ({ Body: body, Metadata: {} }),
-        };
-        const response = await io.getObjectStream("buffered.bin");
-        body.write(Buffer.alloc(4096));
-        await new Promise((resolve) => setImmediate(resolve));
-        now += 40;
-        body.write(Buffer.alloc(4096));
-        await new Promise((resolve) => setImmediate(resolve));
-        now += 40;
-        body.end(Buffer.alloc(4096));
-        await new Promise((resolve) => setImmediate(resolve));
-        expect(governor.effectiveRateBps()).toBeGreaterThanOrEqual(60_000);
-        expect(governor.effectiveRateBps()).toBeLessThanOrEqual(70_000);
-        let received = 0;
-        for await (const chunk of response.body)
-            received += chunk.byteLength;
-        expect(received).toBe(12_288);
-    });
-});
-describe("ObjectIO chore transfer admission", () => {
-    afterEach(() => {
-        setBandwidthGovernorForTesting(null);
-    });
-    it("waits for a download slot before opening the next SDK GET", async () => {
-        setBandwidthGovernorForTesting(new BandwidthGovernor({ maxConcurrency: 1 }));
-        const opened = [];
-        const io = new S3SdkObjectIO(ctx());
-        io.client = {
-            send: async (command) => {
-                opened.push(command.input.Key);
-                return {
-                    Body: (async function* () { yield Buffer.from(command.input.Key); })(),
-                    Metadata: {},
-                };
-            },
-        };
-        const first = await io.getObjectStream("first.bin");
-        const secondPromise = io.getObjectStream("second.bin");
-        await new Promise((resolve) => setImmediate(resolve));
-        expect(opened).toEqual(["first.bin"]);
-        for await (const _chunk of first.body) { /* drain the first transfer */ }
-        const second = await secondPromise;
-        expect(opened).toEqual(["first.bin", "second.bin"]);
-        for await (const _chunk of second.body) { /* drain the second transfer */ }
-    });
-    it("waits for a download slot before opening the next presigned GET", async () => {
-        setBandwidthGovernorForTesting(new BandwidthGovernor({ maxConcurrency: 1 }));
-        const { vault, setPresign } = makeVault();
-        setPresign([
-            { key: "first.bin", op: "get", url: "https://s3/first" },
-            { key: "second.bin", op: "get", url: "https://s3/second" },
-        ]);
-        const opened = [];
-        setPresignedGetTransportForTesting({
-            get: async (url) => {
-                opened.push(url);
-                return {
-                    status: 200,
-                    headers: new Headers(),
-                    body: (async function* () { yield Buffer.from(url); })(),
-                    destroy: () => undefined,
-                };
-            },
-        });
-        const io = new PresignObjectIO(vault, COMPANY);
-        const first = await io.getObjectStream("first.bin");
-        const secondPromise = io.getObjectStream("second.bin");
-        await new Promise((resolve) => setImmediate(resolve));
-        expect(opened).toEqual(["https://s3/first"]);
-        for await (const _chunk of first.body) { /* drain the first transfer */ }
-        const second = await secondPromise;
-        expect(opened).toHaveLength(2);
-        for await (const _chunk of second.body) { /* drain the second transfer */ }
-    });
-});
-describe("ObjectIO ranged GET validators", () => {
-    afterEach(() => {
-        setObjectIOBodyIdleTimeoutMsForTesting(undefined);
-        setBandwidthGovernorForTesting(null);
-    });
-    it("sends Range and If-Match through the S3 SDK and exposes response identity", async () => {
-        const sent = [];
-        const body = (async function* () {
-            yield Buffer.from("suffix");
-        })();
-        const io = new S3SdkObjectIO(ctx());
-        io.client = {
-            send: async (command) => {
-                sent.push(command.input);
-                return {
-                    Body: body,
-                    Metadata: {},
-                    ETag: '"etag-a"',
-                    VersionId: "version-a",
-                    ContentLength: 6,
-                    ContentRange: "bytes 20-25/26",
-                    $metadata: { httpStatusCode: 206 },
-                };
-            },
-        };
-        const streamed = await io.getObjectStream("resume.bin", {
-            rangeStart: 20,
-            ifMatch: '"etag-a"',
-        });
-        const identity = streamed;
-        expect(sent[0]).toMatchObject({ Range: "bytes=20-", IfMatch: '"etag-a"' });
-        expect(identity).toMatchObject({
-            etag: '"etag-a"',
-            versionId: "version-a",
-            contentLength: 6,
-            contentRange: "bytes 20-25/26",
-            statusCode: 206,
-        });
-    });
-    it("sends Range and If-Match through presigned GET and exposes response identity", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "resume.bin", op: "get", url: "https://s3/resume" }]);
-        const get = vi.fn(async () => ({
-            status: 206,
-            headers: new Headers({
-                etag: '"etag-a"',
-                "x-amz-version-id": "version-a",
-                "content-length": "6",
-                "content-range": "bytes 20-25/26",
-            }),
-            body: (async function* () { yield Buffer.from("suffix"); })(),
-            destroy: vi.fn(),
-        }));
-        setPresignedGetTransportForTesting({ get });
-        const io = new PresignObjectIO(vault, COMPANY);
-        const streamed = await io.getObjectStream("resume.bin", {
-            rangeStart: 20,
-            ifMatch: '"etag-a"',
-        });
-        const identity = streamed;
-        expect(get).toHaveBeenCalledWith("https://s3/resume", expect.objectContaining({ Range: "bytes=20-", "If-Match": '"etag-a"' }));
-        expect(identity).toMatchObject({
-            etag: '"etag-a"',
-            versionId: "version-a",
-            contentLength: 6,
-            contentRange: "bytes 20-25/26",
-            statusCode: 206,
-        });
-    });
-    it("reports a ranged presigned 412 as a precondition failure", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "resume.bin", op: "get", url: "https://s3/resume" }]);
-        const destroy = vi.fn();
-        setPresignedGetTransportForTesting({
-            get: async () => ({
-                status: 412,
-                headers: new Headers(),
-                body: (async function* () { yield Buffer.from("stale etag"); })(),
-                destroy,
-            }),
-        });
-        const io = new PresignObjectIO(vault, COMPANY);
-        await expect(io.getObjectStream("resume.bin", {
-            rangeStart: 20,
-            ifMatch: '"etag-a"',
-        })).rejects.toMatchObject({ name: "PreconditionFailed" });
-        expect(destroy).toHaveBeenCalledOnce();
-    });
-});
-function ctx() {
-    return {
-        uid: COMPANY,
-        slug: "test",
-        bucketName: "bucket-test",
-        region: "us-east-1",
-        credentials: {
-            accessKeyId: "AKIA",
-            secretAccessKey: "secret",
-            sessionToken: "token",
-        },
-        expiresAt: "2099-01-01T00:00:00.000Z",
-    };
-}
-/**
- * Minimal VaultClient stub. Each method returns whatever the per-test config
- * sets; presign records the inputs it was called with so tests can assert the
- * op/metadata/key shape the seam sends.
- */
-function makeVault() {
-    const presignCalls = [];
-    let nextPresign = [];
-    let nextList = { objects: [], cursor: null, truncated: false };
-    const vault = {
-        presign: async (input) => {
-            presignCalls.push({
-                companyUid: input.companyUid,
-                op: input.op,
-                keys: input.keys,
-            });
-            return { results: nextPresign, expiresAt: "2099-01-01T00:00:00.000Z" };
-        },
-        listFiles: async () => nextList,
-    };
-    return {
-        vault,
-        presignCalls,
-        setPresign: (rows) => {
-            nextPresign = rows;
-        },
-        setList: (v) => {
-            nextList = v;
-        },
-    };
-}
-function makeForbiddenPrefixVault(pages) {
-    const calls = [];
-    const forbiddenCharacters = new Set(["?", "#", "\\", "[", "]"]);
-    const vault = {
-        presign: async () => ({ results: [], expiresAt: "2099-01-01T00:00:00.000Z" }),
-        listFiles: async (companyUid, prefix, cursor) => {
-            calls.push({ companyUid, prefix, cursor });
-            if (prefix && [...prefix].some((character) => forbiddenCharacters.has(character))) {
-                throw Object.assign(new Error("Forbidden prefix characters"), {
-                    name: "VaultClientError",
-                    code: "INVALID_PREFIX_FORBIDDEN_CHARS",
-                    statusCode: 400,
-                });
-            }
-            return pages.get(cursor) ?? { objects: [], cursor: null, truncated: false };
-        },
-    };
-    return { vault, calls };
-}
-function vaultObject(key) {
-    return {
-        key,
-        size: 1,
-        lastModified: "2026-01-01T00:00:00.000Z",
-        etag: "etag",
-        permission: "read",
-    };
-}
-function safeVaultListPrefixAncestor(prefix) {
-    const helper = objectIoModule.getSafeVaultListPrefixAncestor;
-    if (!helper)
-        throw new Error("getSafeVaultListPrefixAncestor is not exported");
-    return helper(prefix);
-}
-describe("factory selection", () => {
-    afterEach(() => setObjectIOFactory(null));
-    it("defaults to the S3 SDK transport", () => {
-        const io = resolveObjectIO(ctx());
-        expect(io).toBeInstanceOf(S3SdkObjectIO);
-    });
-    it("setObjectIOFactory(null) resets to the default", () => {
-        const { vault } = makeVault();
-        setObjectIOFactory(presignObjectIOFactory(vault));
-        expect(resolveObjectIO(ctx())).toBeInstanceOf(PresignObjectIO);
-        setObjectIOFactory(null);
-        expect(resolveObjectIO(ctx())).toBeInstanceOf(S3SdkObjectIO);
-    });
-    it("presign factory derives companyUid from ctx.uid", async () => {
-        const { vault, presignCalls, setPresign } = makeVault();
-        setPresign([{ key: "k", op: "get", url: "https://x/get" }]);
-        vi.stubGlobal("fetch", vi.fn(async () => new Response(Buffer.from("body"), { status: 200 })));
-        const io = presignObjectIOFactory(vault)(ctx());
-        await io.getObject("k");
-        expect(presignCalls[0].companyUid).toBe(COMPANY);
-        vi.unstubAllGlobals();
-    });
-});
-describe("S3SdkObjectIO request timeout", () => {
-    afterEach(() => {
-        setObjectIORequestTimeoutMsForTesting(undefined);
-        setObjectIOBodyIdleTimeoutMsForTesting(undefined);
-    });
-    it("aborts a hung ListObjectsV2 within OBJECT_IO_REQUEST_TIMEOUT_MS as transient", async () => {
-        expect(OBJECT_IO_REQUEST_TIMEOUT_MS).toBe(60_000);
-        setObjectIORequestTimeoutMsForTesting(50);
-        const io = new S3SdkObjectIO(ctx());
-        io.client = {
-            send: (_cmd, opts) => new Promise((_resolve, reject) => {
-                const signal = opts?.abortSignal;
-                const fail = () => {
-                    const reason = signal?.reason;
-                    const err = Object.assign(new Error("This operation was aborted"), {
-                        name: reason instanceof Error && typeof reason.name === "string"
-                            ? reason.name
-                            : "AbortError",
-                    });
-                    reject(err);
-                };
-                if (!signal)
-                    return;
-                if (signal.aborted) {
-                    fail();
-                    return;
-                }
-                signal.addEventListener("abort", fail, { once: true });
-            }),
-        };
-        const started = Date.now();
-        let caught;
-        try {
-            await io.listObjects({});
-        }
-        catch (err) {
-            caught = err;
-        }
-        expect(caught).toBeInstanceOf(Error);
-        expect(isTransientNetworkError(caught)).toBe(true);
-        expect(Date.now() - started).toBeLessThan(1_000);
-    }, 5_000);
-    it("cancels a GET body that stops yielding after its headers arrive", async () => {
-        setObjectIOBodyIdleTimeoutMsForTesting(40);
-        let cancelled = false;
-        const body = {
-            [Symbol.asyncIterator]: () => ({
-                next: () => new Promise(() => { }),
-                return: async () => ({ done: true, value: undefined }),
-            }),
-            destroy: () => { cancelled = true; },
-        };
-        const io = new S3SdkObjectIO(ctx());
-        io.client = {
-            send: async () => ({ Body: body, Metadata: {} }),
-        };
-        const response = await io.getObjectStream("docs/stalled.md");
-        const started = Date.now();
-        let caught;
-        try {
-            await response.body[Symbol.asyncIterator]().next();
-        }
-        catch (error) {
-            caught = error;
-        }
-        expect(caught).toBeInstanceOf(ObjectBodyIdleTimeoutError);
-        expect(cancelled).toBe(true);
-        expect(Date.now() - started).toBeLessThan(1_000);
-    }, 5_000);
-    it("cancels a stalled presigned GET body", async () => {
-        setObjectIOBodyIdleTimeoutMsForTesting(40);
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "docs/stalled.md", op: "get", url: "https://example.test/stalled" }]);
-        let destroyed = false;
-        const body = {
-            [Symbol.asyncIterator]: () => ({
-                next: () => new Promise(() => { }),
-                return: async () => ({ done: true, value: undefined }),
-            }),
-        };
-        setPresignedGetTransportForTesting({
-            get: async () => ({
-                status: 200,
-                headers: new Headers(),
-                body,
-                destroy: () => { destroyed = true; },
-            }),
-        });
-        const io = new PresignObjectIO(vault, COMPANY);
-        const response = await io.getObjectStream("docs/stalled.md");
-        let caught;
-        try {
-            await response.body[Symbol.asyncIterator]().next();
-        }
-        catch (error) {
-            caught = error;
-        }
-        expect(caught).toBeInstanceOf(ObjectBodyIdleTimeoutError);
-        expect(destroyed).toBe(true);
-    }, 5_000);
-});
-describe("S3SdkObjectIO.putObject — conditional-write fence", () => {
-    it("maps ifMatch (re-quoted) and ifNoneMatch onto the PutObjectCommand", async () => {
-        const io = new S3SdkObjectIO(ctx());
-        const sent = [];
-        // Swap the private client for a recorder — the fence mapping is pure
-        // input-shaping, no wire needed.
-        io.client = {
-            send: async (cmd) => {
-                sent.push(cmd.input);
-                return { ETag: '"landed"' };
-            },
-        };
-        await io.putObject({ key: "a", body: Buffer.from("x"), contentType: "t", ifMatch: "abc" });
-        expect(sent[0].IfMatch).toBe('"abc"'); // stripped etags re-quoted for If-Match
-        await io.putObject({ key: "a2", body: Buffer.from("x"), contentType: "t", ifMatch: '"quoted"' });
-        expect(sent[1].IfMatch).toBe('"quoted"'); // already-quoted passes through
-        await io.putObject({ key: "b", body: Buffer.from("y"), contentType: "t", ifNoneMatch: "*" });
-        expect(sent[2].IfNoneMatch).toBe("*");
-        await io.putObject({ key: "c", body: Buffer.from("z"), contentType: "t" });
-        expect(sent[3].IfMatch).toBeUndefined(); // unfenced PUT stays unfenced
-        expect(sent[3].IfNoneMatch).toBeUndefined();
-    });
-    it("sets ChecksumAlgorithm SHA256 so Object Lock buckets accept the PUT", async () => {
-        const io = new S3SdkObjectIO(ctx());
-        const sent = [];
-        io.client = {
-            send: async (cmd) => {
-                sent.push(cmd.input);
-                return { ETag: '"ck"' };
-            },
-        };
-        await io.putObject({ key: "a", body: Buffer.from("x"), contentType: "t" });
-        expect(sent[0].ChecksumAlgorithm).toBe("SHA256");
-    });
-});
-describe("PresignObjectIO.putObject", () => {
-    let fetchMock;
-    beforeEach(() => {
-        fetchMock = vi.fn();
-        vi.stubGlobal("fetch", fetchMock);
-    });
-    afterEach(() => vi.unstubAllGlobals());
-    it("sends op:put with metadata and replays the signed headers verbatim", async () => {
-        const { vault, presignCalls, setPresign } = makeVault();
-        setPresign([
-            {
-                key: "shared/a.md",
-                op: "put",
-                url: "https://s3/put-url",
-                headers: {
-                    "content-type": "text/markdown",
-                    "x-amz-server-side-encryption": "aws:kms",
-                    "x-amz-meta-created-by": "me@getindigo.ai",
-                },
-            },
-        ]);
-        fetchMock.mockResolvedValue(new Response(null, { status: 200, headers: { etag: '"abc123"' } }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        const res = await io.putObject({
-            key: "shared/a.md",
-            body: Buffer.from("hello"),
-            contentType: "text/markdown",
-            metadata: { "created-by": "me@getindigo.ai" },
-        });
-        // Presign request carried op + per-key metadata.
-        expect(presignCalls[0].op).toBe("put");
-        expect(presignCalls[0].keys[0]).toMatchObject({
-            key: "shared/a.md",
-            op: "put",
-            contentType: "text/markdown",
-            metadata: { "created-by": "me@getindigo.ai" },
-        });
-        // PUT replays the exact signed headers.
-        const [url, init] = fetchMock.mock.calls[0];
-        expect(url).toBe("https://s3/put-url");
-        expect(init.method).toBe("PUT");
-        expect(init.headers).toEqual({
-            "content-type": "text/markdown",
-            "x-amz-server-side-encryption": "aws:kms",
-            "x-amz-meta-created-by": "me@getindigo.ai",
-            "Content-MD5": "XUFAKrxLKna5cZ2REBfFkg==",
-        });
-        // ETag returned with quotes stripped.
-        expect(res.etag).toBe("abc123");
-    });
-    it("keeps the server upgrade URL on a plan-limit PUT denial", async () => {
-        const { vault, setPresign } = makeVault();
-        const upgradeUrl = "https://billing.example.test/company/acme";
-        setPresign([
-            {
-                key: "shared/paused.md",
-                op: "put",
-                error: "Plan limit reached",
-                code: "PLAN_LIMIT_REACHED",
-                upgradeUrl,
-            },
-        ]);
-        const io = new PresignObjectIO(vault, COMPANY);
-        await expect(io.putObject({
-            key: "shared/paused.md",
-            body: Buffer.from("hello"),
-            contentType: "text/markdown",
-        })).rejects.toMatchObject({
-            statusCode: 402,
-            code: "PLAN_LIMIT_REACHED",
-            upgradeUrl,
-        });
-    });
-    it("throws a typed plan-limit refusal for the server's per-item company presign row", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([companyPresignRefusalRow("docs/paused.md")]);
-        const io = new PresignObjectIO(vault, COMPANY);
-        const err = await io
-            .putObject({
-            key: "docs/paused.md",
-            body: Buffer.from("hello"),
-            contentType: "text/markdown",
-        })
-            .catch((error) => error);
-        expect(err).toBeInstanceOf(VaultClientError);
-        expect(err).toMatchObject({
-            statusCode: 402,
-            path: "docs/paused.md",
-            code: "PLAN_LIMIT_EXCEEDED",
-            upgradeUrl: PLAN_LIMIT_UPGRADE_URL,
-            message: "New files are paused while Acme is over its Starter limits.",
-            planLimit: {
-                code: "PLAN_LIMIT_EXCEEDED",
-                upgradeUrl: PLAN_LIMIT_UPGRADE_URL,
-                message: "New files are paused while Acme is over its Starter limits.",
-            },
-        });
-    });
-    it("sends Content-MD5 (base64 of raw MD5) for a known body when the presign did not sign a checksum", async () => {
-        const body = Buffer.from("hello");
-        expect(contentMd5Base64(body)).toBe("XUFAKrxLKna5cZ2REBfFkg==");
-        const { vault, setPresign } = makeVault();
-        setPresign([
-            {
-                key: "docs/a.md",
-                op: "put",
-                url: "https://s3.example/put?X-Amz-SignedHeaders=content-type%3Bx-amz-meta-created-by",
-                headers: { "content-type": "text/plain" },
-            },
-        ]);
-        fetchMock.mockResolvedValue(new Response(null, { status: 200, headers: { etag: '"md5"' } }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.putObject({ key: "docs/a.md", body, contentType: "text/plain" });
-        const init = fetchMock.mock.calls[0][1];
-        expect(init.headers["Content-MD5"]).toBe("XUFAKrxLKna5cZ2REBfFkg==");
-        expect(init.headers["x-amz-checksum-sha256"]).toBeUndefined();
-    });
-    it("replays a signed x-amz-checksum-sha256 instead of attaching Content-MD5", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([
-            {
-                key: "docs/a.md",
-                op: "put",
-                url: "https://s3.example/put?X-Amz-SignedHeaders=content-type%3Bx-amz-checksum-sha256",
-                headers: {
-                    "content-type": "text/plain",
-                    "x-amz-checksum-sha256": "signed-sha256-value",
-                },
-            },
-        ]);
-        fetchMock.mockResolvedValue(new Response(null, { status: 200, headers: { etag: '"ck"' } }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.putObject({
-            key: "docs/a.md",
-            body: Buffer.from("hello"),
-            contentType: "text/plain",
-        });
-        const init = fetchMock.mock.calls[0][1];
-        expect(init.headers["x-amz-checksum-sha256"]).toBe("signed-sha256-value");
-        expect(init.headers["Content-MD5"]).toBeUndefined();
-    });
-    it("classifies Object Lock InvalidRequest 400 without retrying", async () => {
-        const xml = '<?xml version="1.0" encoding="UTF-8"?><Error><Code>InvalidRequest</Code>' +
-            "<Message>Content-MD5 OR x-amz-checksum- HTTP header is required for Put Object requests with Object Lock parameters</Message></Error>";
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "docs/a.md", op: "put", url: "https://s3/put" }]);
-        fetchMock.mockResolvedValue(new Response(xml, { status: 400 }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        let caught;
-        try {
-            await io.putObject({
-                key: "docs/a.md",
-                body: Buffer.from("hello"),
-                contentType: "text/plain",
-            });
-        }
-        catch (err) {
-            caught = err;
-        }
-        expect(caught).toBeInstanceOf(ObjectLockChecksumRequiredError);
-        expect(caught).toMatchObject({
-            name: "ObjectLockChecksumRequired",
-            statusCode: 400,
-            retryable: false,
-        });
-        expect(caught.message).toMatch(/Object Lock requires a Content-MD5/);
-        expect(fetchMock).toHaveBeenCalledTimes(1);
-        expect(isTransientNetworkError(caught)).toBe(false);
-    });
-    it("throws on a per-key denial (error row)", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([
-            { key: "secret/x", op: "put", error: "forbidden", code: "ACL_DENY" },
-        ]);
-        const io = new PresignObjectIO(vault, COMPANY);
-        await expect(io.putObject({
-            key: "secret/x",
-            body: Buffer.from("z"),
-            contentType: "text/plain",
-        })).rejects.toThrow(/denied for secret\/x.*forbidden.*ACL_DENY/);
-        expect(fetchMock).not.toHaveBeenCalled();
-    });
-    it("a write denial (FILES_PRESIGN_FORBIDDEN) throws the access-denied shape so the push skips it like a denied GET", async () => {
-        const { vault, setPresign } = makeVault();
-        // The server refuses to MINT a PUT URL for a key the caller can't write
-        // (private-by-default: members hold read-only on a shared knowledge prefix).
-        setPresign([
-            {
-                key: "knowledge/clients/acme/brief.md",
-                op: "put",
-                error: "Caller lacks write permission on 'knowledge/clients/acme/brief.md'",
-                code: "FILES_PRESIGN_FORBIDDEN",
-            },
-        ]);
-        const io = new PresignObjectIO(vault, COMPANY);
-        let caught;
-        await io
-            .putObject({
-            key: "knowledge/clients/acme/brief.md",
-            body: Buffer.from("z"),
-            contentType: "text/markdown",
-        })
-            .catch((e) => {
-            caught = e;
-        });
-        // Same shape a denied GET/HEAD already throws (name === "Forbidden"), so the
-        // share.ts push catch routes it through `isAccessDenied` into the silent
-        // per-path skip (scopeExcludedSet) + the "N paths skipped — outside your
-        // granted access" aggregate, instead of a fatal `type:"error"` that exits
-        // the runner non-zero and floods Sentry. This is the PUT/GET symmetry that
-        // fixes the presign-put-denied crash-loop across user machines.
-        expect(caught.name).toBe("Forbidden");
-        expect(isAccessDenied(caught)).toBe(true);
-        // Denied at mint time — the byte-moving PUT is never attempted.
-        expect(fetchMock).not.toHaveBeenCalled();
-    });
-    it("US-006 AC5: a transcript-consent denial (FILES_PRESIGN_TRANSCRIPT_CONSENT_REQUIRED) is skip-with-log, not fatal", async () => {
-        const { vault, setPresign } = makeVault();
-        // The US-005 consent code ends `_REQUIRED`, not `_FORBIDDEN`, so the plain
-        // suffix test alone would MISS it and let it fall through to the fatal
-        // generic Error — the recurring partial-failure this AC5 fix prevents.
-        setPresign([
-            {
-                key: "sessions/prs_1/2026-07-11T10-00-00.json",
-                op: "get",
-                error: "transcript consent required",
-                code: "FILES_PRESIGN_TRANSCRIPT_CONSENT_REQUIRED",
-            },
-        ]);
-        const io = new PresignObjectIO(vault, COMPANY);
-        // Monkeypatch console.warn (vitest's console interception can shadow a spy)
-        // to assert the REAL skip log fires.
-        const warnings = [];
-        const originalWarn = console.warn;
-        console.warn = (...args) => {
-            warnings.push(args.map(String).join(" "));
-        };
-        let caught;
-        try {
-            await io
-                .getObject("sessions/prs_1/2026-07-11T10-00-00.json")
-                .catch((e) => {
-                caught = e;
-            });
-        }
-        finally {
-            console.warn = originalWarn;
-        }
-        // Same shape a denied GET already throws → isAccessDenied → the per-key
-        // scope-excluded skip, NOT a fatal `type:"error"` that poisons the run.
-        expect(caught.name).toBe("Forbidden");
-        expect(isAccessDenied(caught)).toBe(true);
-        // A one-line skip log fires so operators can see WHY the key was skipped.
-        expect(warnings.some((w) => w.includes("FILES_PRESIGN_TRANSCRIPT_CONSENT_REQUIRED"))).toBe(true);
-    });
-    it("US-006 AC5: a sessions structural-ACL denial (FILES_PRESIGN_SESSIONS_FORBIDDEN) is skip-with-log", async () => {
-        const { vault, setPresign } = makeVault();
-        // A spoofed/foreign `sessions/{uid}/` prefix the hq-pro structural gate
-        // refuses to presign. Ends `_FORBIDDEN`, so the suffix test already covers
-        // it — this pins that coverage as a regression contract for US-006.
-        setPresign([
-            {
-                key: "sessions/prs_other/y.json",
-                op: "get",
-                error: "not your session prefix",
-                code: "FILES_PRESIGN_SESSIONS_FORBIDDEN",
-            },
-        ]);
-        const io = new PresignObjectIO(vault, COMPANY);
-        let caught;
-        await io.getObject("sessions/prs_other/y.json").catch((e) => {
-            caught = e;
-        });
-        expect(caught.name).toBe("Forbidden");
-        expect(isAccessDenied(caught)).toBe(true);
-    });
-    it("a non-authorization presign failure stays a generic (fatal) error — not silently skipped", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([
-            { key: "secret/x", op: "put", error: "boom", code: "PRESIGN_INTERNAL" },
-        ]);
-        const io = new PresignObjectIO(vault, COMPANY);
-        let caught;
-        await io
-            .putObject({ key: "secret/x", body: Buffer.from("z"), contentType: "x" })
-            .catch((e) => {
-            caught = e;
-        });
-        // Only `*_FORBIDDEN` authorization denials are reclassified; a real backend
-        // failure must still surface loudly so it is not masked as an expected skip.
-        expect(isAccessDenied(caught)).toBe(false);
-        expect(caught.message).toMatch(/denied for secret\/x.*PRESIGN_INTERNAL/);
-    });
-    it("throws when the PUT itself fails", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "k", op: "put", url: "https://s3/put" }]);
-        fetchMock.mockResolvedValue(new Response("AccessDenied", { status: 403 }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await expect(io.putObject({ key: "k", body: Buffer.from("z"), contentType: "x" })).rejects.toThrow(/presigned PUT failed for k: 403/);
-    });
-    it("F01: fails closed when a fenced PUT presign omits If-Match", async () => {
-        const previous = process.env.HQ_PRESIGN_FENCE_STRICT;
-        process.env.HQ_PRESIGN_FENCE_STRICT = "true";
-        try {
-            const { vault, setPresign } = makeVault();
-            setPresign([
-                {
-                    key: "stale.md",
-                    op: "put",
-                    url: "https://s3/unfenced-put",
-                    headers: { "content-type": "text/markdown" },
-                },
-            ]);
-            fetchMock.mockResolvedValue(new Response(null, { status: 200, headers: { etag: '"v2"' } }));
-            const io = new PresignObjectIO(vault, COMPANY);
-            await expect(io.putObject({
-                key: "stale.md",
-                body: Buffer.from("old bytes"),
-                contentType: "text/markdown",
-                ifMatch: '"v1"',
-            })).rejects.toThrow(/if-match|condition|precondition/i);
-            expect(fetchMock).not.toHaveBeenCalled();
-        }
-        finally {
-            if (previous === undefined) {
-                delete process.env.HQ_PRESIGN_FENCE_STRICT;
-            }
-            else {
-                process.env.HQ_PRESIGN_FENCE_STRICT = previous;
-            }
-        }
-    });
-    it("F01: does not satisfy a fenced PUT with an unfenced primed URL", async () => {
-        const presignCalls = [];
-        const vault = {
-            presign: async (input) => {
-                presignCalls.push(input);
-                const isFenced = input.keys.some((k) => k.ifNoneMatch === "*");
-                return {
-                    results: input.keys.map((k) => ({
-                        key: k.key,
-                        op: k.op ?? input.op ?? "put",
-                        url: isFenced ? "https://s3/fenced-put" : "https://s3/unfenced-put",
-                        headers: isFenced
-                            ? { "content-type": "text/plain", "if-none-match": "*" }
-                            : { "content-type": "text/plain" },
-                        expiresIn: 900,
-                    })),
-                    expiresAt: "2099-01-01T00:00:00.000Z",
-                };
-            },
-            listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-        };
-        fetchMock.mockResolvedValue(new Response(null, { status: 200, headers: { etag: '"created"' } }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.prime("put", [{ key: "new.md", op: "put", contentType: "text/plain" }]);
-        const afterPrime = presignCalls.length;
-        await io.putObject({
-            key: "new.md",
-            body: Buffer.from("new bytes"),
-            contentType: "text/plain",
-            ifNoneMatch: "*",
-        });
-        expect(presignCalls).toHaveLength(afterPrime + 1);
-        expect(presignCalls[afterPrime].keys[0]).toMatchObject({
-            key: "new.md",
-            op: "put",
-            ifNoneMatch: "*",
-        });
-        const [url, init] = fetchMock.mock.calls[0];
-        expect(url).toBe("https://s3/fenced-put");
-        expect(init.headers).toMatchObject({
-            "content-type": "text/plain",
-            "if-none-match": "*",
-        });
-        expect(init.headers["Content-MD5"]).toBe(createHash("md5").update(Buffer.from("new bytes")).digest("base64"));
-    });
-    it("forwards the conditional-write fence on the presign request (ifMatch stripped, ifNoneMatch verbatim)", async () => {
-        // The server signs If-Match/If-None-Match into the URL (hq-pro follow-up)
-        // and echoes the headers for replay; the client's job is to ASK. Servers
-        // that predate the fields ignore them — never broken, just unconditional.
-        const { vault, presignCalls, setPresign } = makeVault();
-        setPresign([{ key: "fenced.md", op: "put", url: "https://s3/put-url" }]);
-        fetchMock.mockResolvedValue(new Response(null, { status: 200, headers: { etag: '"v2"' } }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.putObject({
-            key: "fenced.md",
-            body: Buffer.from("x"),
-            contentType: "text/markdown",
-            ifMatch: '"v1"',
-        });
-        expect(presignCalls[0].keys[0]).toMatchObject({
-            key: "fenced.md",
-            op: "put",
-            ifMatch: "v1", // quotes stripped on the wire; server re-quotes when signing
-        });
-        await io.putObject({
-            key: "fresh.md",
-            body: Buffer.from("y"),
-            contentType: "text/markdown",
-            ifNoneMatch: "*",
-        });
-        expect(presignCalls[1].keys[0]).toMatchObject({
-            key: "fresh.md",
-            op: "put",
-            ifNoneMatch: "*",
-        });
-    });
-    it("maps a 412 PUT response to name:PreconditionFailed (the fence fired — conflict, not failure)", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "raced.md", op: "put", url: "https://s3/put-url" }]);
-        fetchMock.mockResolvedValue(new Response("PreconditionFailed", { status: 412 }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await expect(io.putObject({
-            key: "raced.md",
-            body: Buffer.from("z"),
-            contentType: "text/plain",
-            ifMatch: "old-etag",
-        })).rejects.toMatchObject({ name: "PreconditionFailed" });
-    });
-    it("PUT presign with hq-content-sha256 sends checksumSha256 as base64 of that hex", async () => {
-        const hex = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
-        const { vault, presignCalls, setPresign } = makeVault();
-        setPresign([{ key: "hashed.md", op: "put", url: "https://s3/put" }]);
-        fetchMock.mockResolvedValue(new Response(null, { status: 200, headers: { etag: '"abc"' } }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.putObject({
-            key: "hashed.md",
-            body: Buffer.from(""),
-            contentType: "text/plain",
-            metadata: { "hq-content-sha256": hex },
-        });
-        expect(presignCalls[0].keys[0]).toMatchObject({
-            key: "hashed.md",
-            op: "put",
-            checksumSha256: Buffer.from(hex, "hex").toString("base64"),
-        });
-    });
-    it("PUT presign without hq-content-sha256 omits checksumSha256", async () => {
-        const { vault, presignCalls, setPresign } = makeVault();
-        setPresign([{ key: "plain.md", op: "put", url: "https://s3/put" }]);
-        fetchMock.mockResolvedValue(new Response(null, { status: 200, headers: { etag: '"abc"' } }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.putObject({
-            key: "plain.md",
-            body: Buffer.from("z"),
-            contentType: "text/plain",
-        });
-        expect(presignCalls[0].keys[0]).toMatchObject({
-            key: "plain.md",
-            op: "put",
-        });
-        expect(presignCalls[0].keys[0].checksumSha256).toBeUndefined();
-    });
-    it("replays a server-echoed x-amz-checksum-sha256 header on the PUT unchanged", async () => {
-        const hex = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
-        const checksum = Buffer.from(hex, "hex").toString("base64");
-        const { vault, setPresign } = makeVault();
-        setPresign([
-            {
-                key: "locked.md",
-                op: "put",
-                url: "https://s3/put-locked",
-                headers: {
-                    "content-type": "text/plain",
-                    "x-amz-checksum-sha256": checksum,
-                },
-            },
-        ]);
-        fetchMock.mockResolvedValue(new Response(null, { status: 200, headers: { etag: '"abc"' } }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.putObject({
-            key: "locked.md",
-            body: Buffer.from(""),
-            contentType: "text/plain",
-            metadata: { "hq-content-sha256": hex },
-        });
-        const [, init] = fetchMock.mock.calls[0];
-        expect(init.headers).toEqual({
-            "content-type": "text/plain",
-            "x-amz-checksum-sha256": checksum,
-        });
-    });
-});
-describe("PresignObjectIO.getObject", () => {
-    let fetchMock;
-    beforeEach(() => {
-        fetchMock = vi.fn();
-        vi.stubGlobal("fetch", fetchMock);
-    });
-    afterEach(() => vi.unstubAllGlobals());
-    it("returns body bytes + x-amz-meta-* metadata", async () => {
-        const { vault, presignCalls, setPresign } = makeVault();
-        setPresign([{ key: "shared/a.md", op: "get", url: "https://s3/get" }]);
-        fetchMock.mockResolvedValue(new Response(Buffer.from("file-bytes"), {
-            status: 200,
-            headers: {
-                "x-amz-meta-created-by": "me@getindigo.ai",
-                "x-amz-meta-hq-mode": "640",
-                "content-type": "text/markdown",
-            },
-        }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        const res = await io.getObject("shared/a.md");
-        expect(presignCalls[0].op).toBe("get");
-        expect(res.body.toString("utf-8")).toBe("file-bytes");
-        expect(res.metadata).toEqual({
-            "created-by": "me@getindigo.ai",
-            "hq-mode": "640",
-        });
-    });
-    it("GET presigns never send checksumSha256", async () => {
-        const { vault, presignCalls, setPresign } = makeVault();
-        setPresign([{ key: "shared/a.md", op: "get", url: "https://s3/get" }]);
-        fetchMock.mockResolvedValue(new Response(Buffer.from("file-bytes"), { status: 200 }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.getObject("shared/a.md");
-        expect(presignCalls[0].op).toBe("get");
-        expect(presignCalls[0].keys[0].checksumSha256).toBeUndefined();
-    });
-    it("drains the injected transport body instead of returning empty content", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "shared/a.md", op: "get", url: "https://s3/get" }]);
-        const transportGet = vi.fn(async () => ({
-            status: 200,
-            headers: new Headers({ "x-amz-meta-source": "transport" }),
-            body: (async function* () {
-                yield Buffer.from("transport-bytes");
-            })(),
-            destroy: () => undefined,
-        }));
-        setPresignedGetTransportForTesting({ get: transportGet });
-        const io = new PresignObjectIO(vault, COMPANY);
-        const res = await io.getObject("shared/a.md");
-        expect(res.body.toString("utf-8")).toBe("transport-bytes");
-        expect(res.metadata).toEqual({ source: "transport" });
-        expect(transportGet).toHaveBeenCalledWith("https://s3/get", undefined);
-    });
-    it("throws a NotFound-named error on 404 (so s3.ts catch sites match)", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "gone", op: "get", url: "https://s3/get" }]);
-        fetchMock.mockResolvedValue(new Response("", { status: 404 }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await expect(io.getObject("gone")).rejects.toMatchObject({
-            name: "NotFound",
-        });
-    });
-    it("throws a NotFound-named error on FILES_PRESIGN_NOT_FOUND (absence at mint, no GET issued)", async () => {
-        // Per-key GET presign used to throw a generic "presign get denied …
-        // Object not found (FILES_PRESIGN_NOT_FOUND)" Error. That is NOT
-        // isAccessDenied and was NOT isNotFound, so sync treated it as a hard
-        // per-file error and settled the company `partial`. Absence at mint is
-        // the same shape as a presigned GET 404.
-        const { vault, setPresign } = makeVault();
-        setPresign([
-            {
-                key: "projects/runner/state/mac-google-check-marketer-2.json",
-                op: "get",
-                error: "Object not found: 'projects/runner/state/mac-google-check-marketer-2.json'",
-                code: "FILES_PRESIGN_NOT_FOUND",
-            },
-        ]);
-        const io = new PresignObjectIO(vault, COMPANY);
-        let caught;
-        await io
-            .getObject("projects/runner/state/mac-google-check-marketer-2.json")
-            .catch((e) => {
-            caught = e;
-        });
-        expect(caught.name).toBe("NotFound");
-        expect(isNotFound(caught)).toBe(true);
-        expect(isAccessDenied(caught)).toBe(false);
-        expect(fetchMock).not.toHaveBeenCalled();
-    });
-});
-describe("PresignObjectIO.listObjects", () => {
-    it("maps listFiles rows into the RemoteObject shape (etag, Date, storage class)", async () => {
-        const { vault, setList } = makeVault();
-        setList({
-            objects: [
-                {
-                    key: "shared/a.md",
-                    size: 12,
-                    lastModified: "2026-01-01T00:00:00.000Z",
-                    storageClass: "DEEP_ARCHIVE",
-                    etag: "deadbeef",
-                    permission: "read",
-                },
-                {
-                    key: "shared/b.md",
-                    size: 0,
-                    lastModified: null,
-                    etag: null,
-                    permission: "write",
-                },
-            ],
-            cursor: "next-token",
-            truncated: true,
-        });
-        const io = new PresignObjectIO(vault, COMPANY);
-        const res = await io.listObjects({ prefix: "shared/" });
-        expect(res.nextContinuationToken).toBe("next-token");
-        expect(res.objects[0]).toEqual({
-            key: "shared/a.md",
-            size: 12,
-            lastModified: new Date("2026-01-01T00:00:00.000Z"),
-            etag: "deadbeef",
-            storageClass: "DEEP_ARCHIVE",
-        });
-        // Omitted storageClass from an older hq-pro list server defaults Standard;
-        // null etag → "" ; null lastModified → a Date (not crash).
-        expect(res.objects[1].etag).toBe("");
-        expect(res.objects[1].lastModified).toBeInstanceOf(Date);
-        expect(res.objects[1].storageClass).toBe("STANDARD");
-    });
-    it("exhausted listing yields undefined nextContinuationToken", async () => {
-        const { vault, setList } = makeVault();
-        setList({ objects: [], cursor: null, truncated: false });
-        const io = new PresignObjectIO(vault, COMPANY);
-        const res = await io.listObjects({});
-        expect(res.nextContinuationToken).toBeUndefined();
-    });
-    it("lists the safe parent and filters sibling keys for a forbidden prefix", async () => {
-        const prefix = "a/api/issues/[id]/";
-        const { vault, calls } = makeForbiddenPrefixVault(new Map([
-            [undefined, {
-                    objects: [
-                        vaultObject("a/api/issues/[id]/route.ts"),
-                        vaultObject("a/api/issues/other.js"),
-                    ],
-                    cursor: null,
-                    truncated: false,
-                }],
-        ]));
-        const io = new PresignObjectIO(vault, COMPANY);
-        const res = await io.listObjects({ prefix });
-        expect(calls).toEqual([
-            { companyUid: COMPANY, prefix: "a/api/issues/", cursor: undefined },
-        ]);
-        expect(res.objects.map(({ key }) => key)).toEqual(["a/api/issues/[id]/route.ts"]);
-    });
-    it("preserves ancestor cursors across empty filtered pages", async () => {
-        const prefix = "a/api/issues/[id]/";
-        const { vault, calls } = makeForbiddenPrefixVault(new Map([
-            ["incoming-cursor", {
-                    objects: [vaultObject("a/api/issues/other.js")],
-                    cursor: "page-two-cursor",
-                    truncated: true,
-                }],
-            ["page-two-cursor", {
-                    objects: [
-                        vaultObject("a/api/issues/[id]/route.ts"),
-                        vaultObject("a/api/issues/another.js"),
-                    ],
-                    cursor: null,
-                    truncated: false,
-                }],
-        ]));
-        const io = new PresignObjectIO(vault, COMPANY);
-        const first = await io.listObjects({ prefix, continuationToken: "incoming-cursor" });
-        expect(first.objects).toEqual([]);
-        expect(first.nextContinuationToken).toBe("page-two-cursor");
-        const second = await io.listObjects({
-            prefix,
-            continuationToken: first.nextContinuationToken,
-        });
-        expect(second.objects.map(({ key }) => key)).toEqual(["a/api/issues/[id]/route.ts"]);
-        expect(calls).toEqual([
-            { companyUid: COMPANY, prefix: "a/api/issues/", cursor: "incoming-cursor" },
-            { companyUid: COMPANY, prefix: "a/api/issues/", cursor: "page-two-cursor" },
-        ]);
-    });
-    it("leaves a normal prefix and its result page unchanged", async () => {
-        const { vault, calls } = makeForbiddenPrefixVault(new Map([
-            [undefined, {
-                    objects: [vaultObject("a/b/file.txt"), vaultObject("outside/file.txt")],
-                    cursor: null,
-                    truncated: false,
-                }],
-        ]));
-        const io = new PresignObjectIO(vault, COMPANY);
-        const res = await io.listObjects({ prefix: "a/b/" });
-        expect(calls).toEqual([
-            { companyUid: COMPANY, prefix: "a/b/", cursor: undefined },
-        ]);
-        expect(res.objects.map(({ key }) => key)).toEqual([
-            "a/b/file.txt",
-            "outside/file.txt",
-        ]);
-    });
-    it("returns an empty ancestor when a bracket occurs in the first segment", () => {
-        expect(safeVaultListPrefixAncestor("[id]/route.ts")).toBe("");
-    });
-    it.each([
-        ["?", "a/api/issues?state=open", "a/api/"],
-        ["#", "a/api/issues#fragment", "a/api/"],
-        ["\\", "a/api\\issues/route.ts", "a/"],
-        ["]", "a/api/issues]/route.ts", "a/api/"],
-    ])("computes the ancestor before %s", (_character, prefix, expected) => {
-        expect(safeVaultListPrefixAncestor(prefix)).toBe(expected);
-    });
-    it("returns a prefix without forbidden characters unchanged", () => {
-        expect(safeVaultListPrefixAncestor("a/b/")).toBe("a/b/");
-    });
-});
-describe("PresignObjectIO.deleteObject", () => {
-    let fetchMock;
-    beforeEach(() => {
-        fetchMock = vi.fn();
-        vi.stubGlobal("fetch", fetchMock);
-    });
-    afterEach(() => vi.unstubAllGlobals());
-    it("sends op:delete and DELETEs the signed URL", async () => {
-        const { vault, presignCalls, setPresign } = makeVault();
-        setPresign([{ key: "shared/a.md", op: "delete", url: "https://s3/del" }]);
-        fetchMock.mockResolvedValue(new Response(null, { status: 204 }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.deleteObject("shared/a.md");
-        expect(presignCalls[0].op).toBe("delete");
-        expect(fetchMock.mock.calls[0][1].method).toBe("DELETE");
-    });
-    it("treats a 404 DELETE as success (idempotent)", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "gone", op: "delete", url: "https://s3/del" }]);
-        fetchMock.mockResolvedValue(new Response("", { status: 404 }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await expect(io.deleteObject("gone")).resolves.toBeUndefined();
-    });
-});
-describe("PresignObjectIO.headObject", () => {
-    let fetchMock;
-    beforeEach(() => {
-        fetchMock = vi.fn();
-        vi.stubGlobal("fetch", fetchMock);
-    });
-    afterEach(() => {
-        vi.unstubAllGlobals();
-        vi.restoreAllMocks();
-    });
-    it("reads headers (etag/size/lastModified/metadata) via a presigned GET", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "shared/a.md", op: "get", url: "https://s3/get" }]);
-        fetchMock.mockResolvedValue(new Response(Buffer.from("ignored-body"), {
-            status: 200,
-            headers: {
-                etag: '"feedface"',
-                "content-length": "123",
-                "last-modified": "Wed, 01 Jan 2026 00:00:00 GMT",
-                "x-amz-meta-created-at": "2026-01-01T00:00:00.000Z",
-            },
-        }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        const head = await io.headObject("shared/a.md");
-        expect(head).not.toBeNull();
-        expect(head.etag).toBe("feedface");
-        expect(head.size).toBe(123);
-        expect(head.metadata).toEqual({
-            "created-at": "2026-01-01T00:00:00.000Z",
-        });
-        expect(head.lastModified.getTime()).toBe(Date.parse("Wed, 01 Jan 2026 00:00:00 GMT"));
-    });
-    it("returns null on 404", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "gone", op: "get", url: "https://s3/get" }]);
-        fetchMock.mockResolvedValue(new Response("", { status: 404 }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        expect(await io.headObject("gone")).toBeNull();
-    });
-    it("returns null on a server-confirmed FILES_PRESIGN_NOT_FOUND (absence, not denial — no GET issued)", async () => {
-        // The presign lambda HEAD'd S3 and confirmed absence. Unlike a read
-        // DENIAL (Forbidden, below), this is unambiguous "object missing", so
-        // headObject reports absent (null) and the push creates the new object —
-        // never reaching a 403-masked presigned GET.
-        const { vault, setPresign } = makeVault();
-        setPresign([
-            {
-                key: "new.md",
-                op: "get",
-                error: "Object not found: 'new.md'",
-                code: "FILES_PRESIGN_NOT_FOUND",
-            },
-        ]);
-        const io = new PresignObjectIO(vault, COMPANY);
-        expect(await io.headObject("new.md")).toBeNull();
-        expect(fetchMock).not.toHaveBeenCalled();
-    });
-    it("reuses primed absence and refusal rows without confusing GET with PUT", async () => {
-        vi.spyOn(console, "warn").mockImplementation(() => undefined);
-        const calls = [];
-        let uploaded = false;
-        const vault = {
-            presign: async (input) => {
-                calls.push({ op: input.op, keys: input.keys.map((item) => item.key) });
-                return {
-                    results: input.keys.map((item) => {
-                        if (input.op === "put") {
-                            return { key: item.key, op: "put", url: "https://s3/put" };
-                        }
-                        if (item.key === "missing.md" && uploaded) {
-                            return { key: item.key, op: "get", url: "https://s3/get" };
-                        }
-                        return item.key === "missing.md"
-                            ? {
-                                key: item.key,
-                                op: "get",
-                                error: "Object not found",
-                                code: "FILES_PRESIGN_NOT_FOUND",
-                            }
-                            : {
-                                key: item.key,
-                                op: "get",
-                                error: "permission refused",
-                                code: "FILES_PRESIGN_FORBIDDEN",
-                            };
-                    }),
-                    expiresAt: "2099-01-01T00:00:00.000Z",
-                };
-            },
-            listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-        };
-        fetchMock.mockImplementation(async (_url, init) => {
-            if (init?.method === "PUT")
-                uploaded = true;
-            return new Response(null, { status: 200, headers: { etag: '"created"' } });
-        });
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.prime("get", [{ key: "missing.md" }, { key: "denied.md" }]);
-        expect(await io.headObject("missing.md")).toBeNull();
-        await expect(io.headObject("denied.md")).rejects.toMatchObject({ name: "Forbidden" });
-        await expect(io.headObject("denied.md")).rejects.toMatchObject({ name: "Forbidden" });
-        await io.prime("put", [{ key: "missing.md" }]);
-        await io.putObject({ key: "missing.md", body: Buffer.from("new"), contentType: "text/plain" });
-        expect(await io.headObject("missing.md")).not.toBeNull();
-        expect(calls).toEqual([
-            { op: "get", keys: ["missing.md", "denied.md"] },
-            { op: "put", keys: ["missing.md"] },
-            { op: "get", keys: ["missing.md"] },
-        ]);
-        expect(fetchMock).toHaveBeenCalledTimes(2);
-    });
-    it("throws Forbidden when presign denies the key — denial is NOT absence", async () => {
-        // Regression: pre-fix this returned null ("absent"), which made
-        // share.ts's push guard (`if (remoteMeta)`) skip every conflict check
-        // and issue an unconditional PUT — a transient denial mid-pass silently
-        // clobbered newer remote bytes (2026-06-10..12 vault regression storm).
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "secret/x", op: "get", error: "forbidden" }]);
-        const io = new PresignObjectIO(vault, COMPANY);
-        await expect(io.headObject("secret/x")).rejects.toMatchObject({
-            name: "Forbidden",
-        });
-        expect(fetchMock).not.toHaveBeenCalled();
-    });
-    it("throws Forbidden on a presigned-GET 403 — same SDK-parity contract", async () => {
-        // Expired presigned URL, expired signing creds, KMS or bucket-policy
-        // denial all surface as 403 on the signed GET. Unknown state — must
-        // never read as "object missing".
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "shared/a.md", op: "get", url: "https://s3/get" }]);
-        fetchMock.mockResolvedValue(new Response("AccessDenied", { status: 403 }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await expect(io.headObject("shared/a.md")).rejects.toMatchObject({
-            name: "Forbidden",
-        });
-    });
-    it("still returns null on a definitive 404 (key truly absent)", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "gone2", op: "get", url: "https://s3/get" }]);
-        fetchMock.mockResolvedValue(new Response("", { status: 404 }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        expect(await io.headObject("gone2")).toBeNull();
-    });
-});
-describe("PresignObjectIO.prime — refusal caching", () => {
-    afterEach(() => vi.restoreAllMocks());
-    it("uses only batch calls for 8,000 refused PUT keys and retries with a new instance", async () => {
-        vi.spyOn(console, "warn").mockImplementation(() => undefined);
-        const batchCalls = [];
-        let singleKeyCalls = 0;
-        const vault = {
-            presign: async (input) => {
-                if (input.expiresIn === undefined)
-                    singleKeyCalls++;
-                else
-                    batchCalls.push({ op: input.op, count: input.keys.length });
-                return {
-                    results: input.keys.map((item) => input.op === "get"
-                        ? {
-                            key: item.key,
-                            op: "get",
-                            error: "Object not found",
-                            code: "FILES_PRESIGN_NOT_FOUND",
-                        }
-                        : {
-                            key: item.key,
-                            op: "put",
-                            error: "forbidden",
-                            code: "FILES_PRESIGN_FORBIDDEN",
-                        }),
-                    expiresAt: "2099-01-01T00:00:00.000Z",
-                };
-            },
-            listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-        };
-        const keys = Array.from({ length: 8_000 }, (_, index) => ({ key: `write/${index}` }));
-        const firstRun = new PresignObjectIO(vault, COMPANY);
-        await firstRun.prime("get", keys);
-        await firstRun.prime("put", keys);
-        for (const { key } of keys) {
-            expect(await firstRun.headObject(key)).toBeNull();
-            expect(await firstRun.headObject(key)).toBeNull();
-            expect(await firstRun.headObject(key)).toBeNull();
-            await expect(firstRun.putObject({ key, body: Buffer.from("x"), contentType: "text/plain" }))
-                .rejects.toMatchObject({ name: "Forbidden" });
-        }
-        expect(batchCalls).toEqual([
-            ...Array.from({ length: 8 }, () => ({ op: "get", count: 1_000 })),
-            ...Array.from({ length: 8 }, () => ({ op: "put", count: 1_000 })),
-        ]);
-        expect(singleKeyCalls).toBe(0);
-        const secondRun = new PresignObjectIO(vault, COMPANY);
-        await expect(secondRun.putObject({
-            key: "write/0",
-            body: Buffer.from("x"),
-            contentType: "text/plain",
-        })).rejects.toMatchObject({ name: "Forbidden" });
-        expect(singleKeyCalls).toBe(1);
-    });
-    it("uses only batch calls for 13,000 refused GET keys", async () => {
-        vi.spyOn(console, "warn").mockImplementation(() => undefined);
-        const batchCalls = [];
-        let singleKeyCalls = 0;
-        const vault = {
-            presign: async (input) => {
-                if (input.expiresIn === undefined)
-                    singleKeyCalls++;
-                else
-                    batchCalls.push({ op: input.op, count: input.keys.length });
-                return {
-                    results: input.keys.map((item) => ({
-                        key: item.key,
-                        op: "get",
-                        error: "permission refused",
-                        code: "FILES_PRESIGN_FORBIDDEN",
-                    })),
-                    expiresAt: "2099-01-01T00:00:00.000Z",
-                };
-            },
-            listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-        };
-        const keys = Array.from({ length: 13_000 }, (_, index) => ({ key: `journal/${index}` }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.prime("get", keys);
-        for (const { key } of keys) {
-            await expect(io.headObject(key)).rejects.toMatchObject({ name: "Forbidden" });
-        }
-        expect(batchCalls).toEqual(Array.from({ length: 13 }, () => ({ op: "get", count: 1_000 })));
-        expect(singleKeyCalls).toBe(0);
-    });
-});
-/**
- * Echo vault: presign returns one signed row per requested key (url derived
- * from op+key) and records call count + total keys, so prime/cache tests can
- * assert "N files → ceil(N/100) presign calls, then zero".
- */
-function makeEchoVault() {
-    let calls = 0;
-    let totalKeys = 0;
-    const vault = {
-        presign: async (input) => {
-            calls++;
-            totalKeys += input.keys.length;
-            return {
-                results: input.keys.map((k) => ({
-                    key: k.key,
-                    op: k.op ?? input.op ?? "get",
-                    url: `https://signed/${k.op ?? input.op}/${encodeURIComponent(k.key)}`,
-                    ...(k.op === "put" || input.op === "put"
-                        ? { headers: { "content-type": "text/plain" } }
-                        : {}),
-                    expiresIn: input.expiresIn ?? 900,
-                })),
-                expiresAt: "2099-01-01T00:00:00.000Z",
-            };
-        },
-        listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-    };
-    return {
-        vault,
-        calls: () => calls,
-        totalKeys: () => totalKeys,
-    };
-}
-describe("PresignObjectIO.prime — plan-limit refusals", () => {
-    function refusingVault(mode) {
-        const presignKeys = [];
-        const vault = {
-            presign: async (input) => {
-                presignKeys.push(input.keys.map((k) => k.key));
-                if (mode === "batch-402") {
-                    throw vaultErrorFromResponse(402, JSON.stringify(canonicalPlanLimitBody()));
-                }
-                return {
-                    results: input.keys.map((k) => companyPresignRefusalRow(k.key)),
-                    expiresAt: "2099-01-01T00:00:00.000Z",
-                };
-            },
-            listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-        };
-        return { vault, presignKeys };
-    }
-    for (const mode of ["batch-402", "per-item"]) {
-        it(`reports a primed ${mode} refusal on upload without presigning the key again`, async () => {
-            const { vault, presignKeys } = refusingVault(mode);
-            const io = new PresignObjectIO(vault, COMPANY);
-            await io.prime("put", [{ key: "a.md" }, { key: "b.md" }]);
-            expect(presignKeys).toEqual([["a.md", "b.md"]]);
-            for (const key of ["a.md", "b.md"]) {
-                await expect(io.putObject({ key, body: Buffer.from("x"), contentType: "text/markdown" })).rejects.toMatchObject({
-                    statusCode: 402,
-                    path: key,
-                    upgradeUrl: PLAN_LIMIT_UPGRADE_URL,
-                });
-            }
-            // One batch presign for both keys; the uploads never presigned again.
-            expect(presignKeys).toEqual([["a.md", "b.md"]]);
-            // The cached refusal is consumed once: a later upload asks the server.
-            await expect(io.putObject({ key: "a.md", body: Buffer.from("x"), contentType: "text/markdown" })).rejects.toMatchObject({ statusCode: 402 });
-            expect(presignKeys).toEqual([["a.md", "b.md"], ["a.md"]]);
-        });
-    }
-    it("does not cache refusals for a refused GET prime", async () => {
-        const { vault, presignKeys } = refusingVault("batch-402");
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.prime("get", [{ key: "a.md" }]);
-        await expect(io.putObject({ key: "a.md", body: Buffer.from("x"), contentType: "text/markdown" })).rejects.toMatchObject({ statusCode: 402 });
-        expect(presignKeys).toEqual([["a.md"], ["a.md"]]);
-    });
-});
-describe("PresignObjectIO.checkFilesAdmission", () => {
-    afterEach(() => setFilesAdmissionTimeoutMsForTesting(undefined));
-    function admissionVault(answer) {
-        const calls = [];
-        const vault = {
-            presign: async () => ({ results: [], expiresAt: "2099-01-01T00:00:00.000Z" }),
-            listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-            checkFilesAdmission: async (companyUid) => {
-                calls.push(companyUid);
-                return answer();
-            },
-        };
-        return { vault, calls };
-    }
-    it("reports allowed on 200 {allowed:true}", async () => {
-        const { vault, calls } = admissionVault(async () => admissionAllowedBody());
-        await expect(new PresignObjectIO(vault, "cmp_acme").checkFilesAdmission()).resolves.toEqual({
-            state: "allowed",
-        });
-        expect(calls).toEqual(["cmp_acme"]);
-    });
-    it("reports refused with the fresh refusal on a 402 plan-limit body", async () => {
-        const { vault } = admissionVault(async () => {
-            throw vaultErrorFromResponse(402, JSON.stringify(canonicalPlanLimitBody()));
-        });
-        const outcome = await new PresignObjectIO(vault, "cmp_acme").checkFilesAdmission();
-        expect(outcome).toMatchObject({
-            state: "refused",
-            refusal: { upgradeUrl: PLAN_LIMIT_UPGRADE_URL, blocked: "files.create" },
-        });
-    });
-    it.each([
-        ["400 from a server without the admission check", 400, admissionUnsupportedBody()],
-        ["403", 403, { message: "Forbidden" }],
-        ["404", 404, { message: "Not found" }],
-        ["503", 503, { message: "unavailable" }],
-    ])("reports unknown for %s", async (_label, status, body) => {
-        const { vault } = admissionVault(async () => {
-            throw vaultErrorFromResponse(status, JSON.stringify(body));
-        });
-        await expect(new PresignObjectIO(vault, "cmp_acme").checkFilesAdmission()).resolves.toEqual({
-            state: "unknown",
-            reason: `http-${status}`,
-        });
-    });
-    it("reports unknown on a network error and on a timeout", async () => {
-        const failing = admissionVault(async () => {
-            throw new TypeError("fetch failed");
-        });
-        await expect(new PresignObjectIO(failing.vault, "cmp_acme").checkFilesAdmission()).resolves.toEqual({
-            state: "unknown",
-            reason: "request-failed",
-        });
-        setFilesAdmissionTimeoutMsForTesting(20);
-        const hanging = admissionVault(() => new Promise(() => { }));
-        await expect(new PresignObjectIO(hanging.vault, "cmp_acme").checkFilesAdmission()).resolves.toEqual({
-            state: "unknown",
-            reason: "timeout",
-        });
-    });
-    it("never asks for a non-company vault or a client without the check", async () => {
-        const { vault, calls } = admissionVault(async () => ({ allowed: true }));
-        await expect(new PresignObjectIO(vault, "prs_me").checkFilesAdmission()).resolves.toMatchObject({
-            state: "unknown",
-        });
-        expect(calls).toEqual([]);
-        const { checkFilesAdmission: _drop, ...withoutCheck } = vault;
-        await expect(new PresignObjectIO(withoutCheck, "cmp_acme").checkFilesAdmission()).resolves.toMatchObject({ state: "unknown" });
-    });
-});
-describe("PresignObjectIO.prime — batch URL cache", () => {
-    let fetchMock;
-    beforeEach(() => {
-        fetchMock = vi.fn(async () => new Response(Buffer.from("x"), { status: 200 }));
-        vi.stubGlobal("fetch", fetchMock);
-    });
-    afterEach(() => vi.unstubAllGlobals());
-    it("chunks at 1000 keys per presign call (the server batch cap)", async () => {
-        const { vault, calls, totalKeys } = makeEchoVault();
-        const io = new PresignObjectIO(vault, COMPANY);
-        const keys = Array.from({ length: 2500 }, (_, i) => ({ key: `k${i}` }));
-        await io.prime("get", keys);
-        expect(calls()).toBe(3); // 1000 + 1000 + 500
-        expect(totalKeys()).toBe(2500);
-    });
-    it("primed getObject reuses the cache — zero extra presign calls", async () => {
-        const { vault, calls } = makeEchoVault();
-        const io = new PresignObjectIO(vault, COMPANY);
-        const keys = Array.from({ length: 5 }, (_, i) => ({ key: `f${i}` }));
-        await io.prime("get", keys);
-        const afterPrime = calls(); // 1 chunk
-        for (const k of keys)
-            await io.getObject(k.key);
-        expect(calls()).toBe(afterPrime); // no new presign calls
-        expect(fetchMock).toHaveBeenCalledTimes(5); // but the bytes were fetched
-        // The fetched URL is the primed (cached) one.
-        expect(fetchMock.mock.calls[0][0]).toBe("https://signed/get/f0");
-    });
-    it("F21: consumes primed GET URLs instead of retaining them", async () => {
-        const { vault, calls } = makeEchoVault();
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.prime("get", [{ key: "single" }]);
-        const afterPrime = calls();
-        await io.getObject("single");
-        expect(calls()).toBe(afterPrime);
-        await io.getObject("single");
-        expect(calls()).toBe(afterPrime + 1);
-        expect(fetchMock).toHaveBeenCalledTimes(2);
-    });
-    it("R-F21: reuses a primed GET for later HEAD and clears stale primed PUT on fenced PUT", async () => {
-        fetchMock.mockImplementation(async () => (new Response(Buffer.from("body"), {
-            status: 200,
-            headers: {
-                etag: '"etag-1"',
-                "content-length": "4",
-                "last-modified": "Wed, 01 Jan 2026 00:00:00 GMT",
-            },
-        })));
-        const { vault, calls } = makeEchoVault();
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.prime("get", [{ key: "doc.md" }]);
-        const afterGetPrime = calls();
-        const got = await io.getObject("doc.md");
-        expect(got.body.toString("utf-8")).toBe("body");
-        const head = await io.headObject("doc.md");
-        expect(head?.etag).toBe("etag-1");
-        expect(calls()).toBe(afterGetPrime);
-        expect(fetchMock.mock.calls[0][0]).toBe("https://signed/get/doc.md");
-        expect(fetchMock.mock.calls[1][0]).toBe("https://signed/get/doc.md");
-        await io.prime("put", [
-            { key: "stale.md", op: "put", contentType: "text/plain" },
-        ]);
-        expect(io.hasPrimedPut("stale.md")).toBe(true);
-        const afterPutPrime = calls();
-        await io.putObject({
-            key: "stale.md",
-            body: Buffer.from("new body"),
-            contentType: "text/plain",
-            ifMatch: "old-etag",
-        });
-        expect(calls()).toBe(afterPutPrime + 1);
-        expect(io.hasPrimedPut("stale.md")).toBe(false);
-    });
-    it("primed GET cache also serves headObject (HEAD reuses GET URLs)", async () => {
-        const { vault, calls } = makeEchoVault();
-        fetchMock.mockResolvedValue(new Response(Buffer.from(""), {
-            status: 200,
-            headers: { etag: '"e"', "content-length": "0" },
-        }));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.prime("get", [{ key: "doc.md" }]);
-        const afterPrime = calls();
-        const head = await io.headObject("doc.md");
-        expect(head).not.toBeNull();
-        expect(calls()).toBe(afterPrime); // head used the cached GET url, no presign
-    });
-    it("a key NOT primed falls back to a single presign", async () => {
-        const { vault, calls } = makeEchoVault();
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.prime("get", [{ key: "primed" }]);
-        const afterPrime = calls();
-        await io.getObject("not-primed");
-        expect(calls()).toBe(afterPrime + 1);
-    });
-    it("prime(put) sends checksumSha256 per key from hq-content-sha256 metadata", async () => {
-        const hexA = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
-        const hexB = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
-        const { vault, presignCalls } = makeVault();
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.prime("put", [
-            {
-                key: "a.md",
-                op: "put",
-                contentType: "text/plain",
-                metadata: { "hq-content-sha256": hexA },
-            },
-            {
-                key: "b.md",
-                op: "put",
-                contentType: "text/plain",
-                metadata: { "hq-content-sha256": hexB },
-            },
-            { key: "c.md", op: "put", contentType: "text/plain" },
-        ]);
-        expect(presignCalls).toHaveLength(1);
-        expect(presignCalls[0].op).toBe("put");
-        const keys = presignCalls[0].keys;
-        expect(keys[0]).toMatchObject({
-            key: "a.md",
-            checksumSha256: Buffer.from(hexA, "hex").toString("base64"),
-        });
-        expect(keys[1]).toMatchObject({
-            key: "b.md",
-            checksumSha256: Buffer.from(hexB, "hex").toString("base64"),
-        });
-        expect(keys[2].key).toBe("c.md");
-        expect(keys[2].checksumSha256).toBeUndefined();
-    });
-    it("empty prime is a no-op (no presign call)", async () => {
-        const { vault, calls } = makeEchoVault();
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.prime("get", []);
-        expect(calls()).toBe(0);
-    });
-    it("a chunk that throws doesn't fail prime; those keys fall back per-file", async () => {
-        let calls = 0;
-        const vault = {
-            presign: async (input) => {
-                calls++;
-                if (calls === 1)
-                    throw new Error("transient");
-                return {
-                    results: input.keys.map((k) => ({
-                        key: k.key,
-                        op: "get",
-                        url: `https://signed/get/${k.key}`,
-                        expiresIn: 900,
-                    })),
-                    expiresAt: "2099-01-01T00:00:00.000Z",
-                };
-            },
-            listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-        };
-        const io = new PresignObjectIO(vault, COMPANY);
-        // Single chunk that throws — prime resolves anyway, key stays uncached.
-        await expect(io.prime("get", [{ key: "k" }])).resolves.toBeUndefined();
-        // getObject then single-presigns (call #2 succeeds).
-        await io.getObject("k");
-        expect(calls).toBe(2);
-    });
-});
-describe("presignObjectIOFactory — memoization", () => {
-    afterEach(() => setObjectIOFactory(null));
-    it("returns the SAME instance per companyUid so prime + transfer share a cache", () => {
-        const { vault } = makeEchoVault();
-        const factory = presignObjectIOFactory(vault);
-        const a1 = factory(ctx());
-        const a2 = factory(ctx());
-        expect(a1).toBe(a2); // same company → same instance
-        const other = factory({ ...ctx(), uid: "cmp_other" });
-        expect(other).not.toBe(a1); // different company → different instance
-    });
-});
-describe("PresignObjectIO — transient-failure retry (SDK parity)", () => {
-    afterEach(() => {
-        vi.useRealTimers();
-        vi.unstubAllGlobals();
-    });
-    it("retries a transient 503 then succeeds", async () => {
-        vi.useFakeTimers();
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "k", op: "get", url: "https://s3/get" }]);
-        const fetchMock = vi
-            .fn()
-            .mockResolvedValueOnce(new Response("SlowDown", { status: 503 }))
-            .mockResolvedValueOnce(new Response(Buffer.from("ok"), { status: 200 }));
-        vi.stubGlobal("fetch", fetchMock);
-        const io = new PresignObjectIO(vault, COMPANY);
-        const pr = io.getObject("k");
-        await vi.runAllTimersAsync();
-        const res = await pr;
-        expect(res.body.toString("utf-8")).toBe("ok");
-        expect(fetchMock).toHaveBeenCalledTimes(2);
-    });
-    it("retries a network error (fetch throws) then succeeds", async () => {
-        vi.useFakeTimers();
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "k", op: "get", url: "https://s3/get" }]);
-        const fetchMock = vi
-            .fn()
-            .mockRejectedValueOnce(new Error("socket hang up"))
-            .mockResolvedValueOnce(new Response(Buffer.from("ok"), { status: 200 }));
-        vi.stubGlobal("fetch", fetchMock);
-        const io = new PresignObjectIO(vault, COMPANY);
-        const pr = io.getObject("k");
-        await vi.runAllTimersAsync();
-        const res = await pr;
-        expect(res.body.toString("utf-8")).toBe("ok");
-        expect(fetchMock).toHaveBeenCalledTimes(2);
-    });
-    it("throws after exhausting retries on persistent 503 (initial + 3 retries = 4)", async () => {
-        vi.useFakeTimers();
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "k", op: "get", url: "https://s3/get" }]);
-        const fetchMock = vi.fn().mockResolvedValue(new Response("err", { status: 503 }));
-        vi.stubGlobal("fetch", fetchMock);
-        const io = new PresignObjectIO(vault, COMPANY);
-        const pr = io.getObject("k").catch((e) => e);
-        await vi.runAllTimersAsync();
-        const err = await pr;
-        expect(String(err)).toMatch(/503/);
-        expect(fetchMock).toHaveBeenCalledTimes(4);
-    });
-    it("does NOT retry a definitive 404", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "gone", op: "get", url: "https://s3/get" }]);
-        const fetchMock = vi.fn().mockResolvedValue(new Response("", { status: 404 }));
-        vi.stubGlobal("fetch", fetchMock);
-        const io = new PresignObjectIO(vault, COMPANY);
-        await expect(io.getObject("gone")).rejects.toMatchObject({ name: "NotFound" });
-        expect(fetchMock).toHaveBeenCalledTimes(1);
-    });
-    /**
-     * Pam Beesly (Indigo) 2026-08-13: bulk company pull left primed GETs past
-     * X-Amz-Expires=1800. Pre-fix, 403 "Request has expired" was definitive —
-     * no re-presign — so those keys permanently failed the pass (partial=true).
-     */
-    it("re-presigns and retries when a primed GET URL returns 403 Request has expired", async () => {
-        vi.useFakeTimers();
-        let presignCalls = 0;
-        const vault = {
-            presign: async (input) => {
-                presignCalls++;
-                const n = presignCalls;
-                return {
-                    results: input.keys.map((k) => ({
-                        key: k.key,
-                        op: "get",
-                        url: `https://s3/get-v${n}/${k.key}`,
-                        expiresIn: 1800,
-                    })),
-                    expiresAt: "2099-01-01T00:00:00.000Z",
-                };
-            },
-            listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-        };
-        const expiredXml = '<?xml version="1.0" encoding="UTF-8"?>\n' +
-            "<Error><Code>AccessDenied</Code><Message>Request has expired</Message>" +
-            "<X-Amz-Expires>1800</X-Amz-Expires></Error>";
-        const transportGet = vi
-            .fn()
-            .mockResolvedValueOnce({
-            status: 403,
-            headers: new Headers(),
-            body: (async function* () {
-                yield Buffer.from(expiredXml);
-            })(),
-            destroy: () => undefined,
-        })
-            .mockResolvedValueOnce({
-            status: 200,
-            headers: new Headers({ "x-amz-meta-hq-mode": "644" }),
-            body: (async function* () {
-                yield Buffer.from("fresh-bytes");
-            })(),
-            destroy: () => undefined,
-        });
-        setPresignedGetTransportForTesting({ get: transportGet });
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.prime("get", [{ key: "projects/hq-desktop-installer/prd.json" }]);
-        expect(presignCalls).toBe(1);
-        const pr = io.getObject("projects/hq-desktop-installer/prd.json");
-        await vi.runAllTimersAsync();
-        const res = await pr;
-        expect(res.body.toString("utf-8")).toBe("fresh-bytes");
-        expect(res.metadata).toEqual({ "hq-mode": "644" });
-        // prime + one re-presign after expiry
-        expect(presignCalls).toBe(2);
-        expect(transportGet).toHaveBeenCalledTimes(2);
-        expect(transportGet.mock.calls[0][0]).toContain("get-v1/");
-        expect(transportGet.mock.calls[1][0]).toContain("get-v2/");
-    });
-    /**
-     * Memory-regression guard: getObjectStream must hand back a live body, not
-     * drain the whole object first. Mid-stream EPIPE recovery is the
-     * downloadFile whole-temp seam (s3.test.ts), not a buffer-in-transport loop.
-     */
-    it("getObjectStream yields without buffering the full object first", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "projects/large.bin", op: "get", url: "https://s3/get" }]);
-        let secondChunkPulled = false;
-        let resolveSecondChunk;
-        const secondChunkGate = new Promise((resolve) => {
-            resolveSecondChunk = resolve;
-        });
-        const transportGet = vi.fn(async () => ({
-            status: 200,
-            headers: new Headers({ "x-amz-meta-hq-mode": "644" }),
-            body: (async function* () {
-                yield Buffer.from("first-chunk-");
-                // Stall the rest of the body until the test has already received the
-                // first yield — proves getObjectStream returned before full drain.
-                await secondChunkGate;
-                secondChunkPulled = true;
-                yield Buffer.from("second-chunk");
-            })(),
-            destroy: () => undefined,
-        }));
-        setPresignedGetTransportForTesting({ get: transportGet });
-        const io = new PresignObjectIO(vault, COMPANY);
-        // Must resolve without waiting for second-chunk (true streaming).
-        const streamed = await io.getObjectStream("projects/large.bin");
-        expect(streamed.metadata).toEqual({ "hq-mode": "644" });
-        expect(secondChunkPulled).toBe(false);
-        const iterator = streamed.body[Symbol.asyncIterator]();
-        const first = await iterator.next();
-        expect(Buffer.from(first.value).toString("utf-8")).toBe("first-chunk-");
-        expect(secondChunkPulled).toBe(false);
-        resolveSecondChunk();
-        const second = await iterator.next();
-        expect(Buffer.from(second.value).toString("utf-8")).toBe("second-chunk");
-        expect(secondChunkPulled).toBe(true);
-        expect((await iterator.next()).done).toBe(true);
-        expect(transportGet).toHaveBeenCalledTimes(1);
-    });
-    it("surfaces mid-stream EPIPE from getObject without buffering/retrying in the stream seam", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "projects/mission-control/prd.json", op: "get", url: "https://s3/get" }]);
-        const transportGet = vi.fn(async () => ({
-            status: 200,
-            headers: new Headers(),
-            body: (async function* () {
-                yield Buffer.from("partial-");
-                throw Object.assign(new Error("write EPIPE"), { code: "EPIPE" });
-            })(),
-            destroy: () => undefined,
-        }));
-        setPresignedGetTransportForTesting({ get: transportGet });
-        const io = new PresignObjectIO(vault, COMPANY);
-        // getObject drains the live stream; mid-stream cuts propagate so the
-        // downloadFile seam (not this layer) owns whole-attempt recovery.
-        await expect(io.getObject("projects/mission-control/prd.json")).rejects.toMatchObject({ code: "EPIPE" });
-        expect(transportGet).toHaveBeenCalledTimes(1);
-    });
-    it("does NOT re-presign or retry a non-expired 403 AccessDenied (auth denial)", async () => {
-        const { vault, presignCalls, setPresign } = makeVault();
-        setPresign([{ key: "secret/x", op: "get", url: "https://s3/get" }]);
-        const transportGet = vi.fn(async () => ({
-            status: 403,
-            headers: new Headers(),
-            body: (async function* () {
-                yield Buffer.from("<Error><Code>AccessDenied</Code><Message>Access Denied</Message></Error>");
-            })(),
-            destroy: () => undefined,
-        }));
-        setPresignedGetTransportForTesting({ get: transportGet });
-        const io = new PresignObjectIO(vault, COMPANY);
-        await expect(io.getObject("secret/x")).rejects.toMatchObject({
-            name: "Forbidden",
-        });
-        expect(presignCalls).toHaveLength(1);
-        expect(transportGet).toHaveBeenCalledTimes(1);
-    });
-    it("does NOT retry a non-transient 400 on presigned GET", async () => {
-        const { vault, setPresign } = makeVault();
-        setPresign([{ key: "k", op: "get", url: "https://s3/get" }]);
-        const transportGet = vi.fn(async () => ({
-            status: 400,
-            headers: new Headers(),
-            body: (async function* () {
-                yield Buffer.from("Bad Request");
-            })(),
-            destroy: () => undefined,
-        }));
-        setPresignedGetTransportForTesting({ get: transportGet });
-        const io = new PresignObjectIO(vault, COMPANY);
-        await expect(io.getObject("k")).rejects.toThrow(/presigned GET failed for k: 400/);
-        expect(transportGet).toHaveBeenCalledTimes(1);
-    });
-    it("headObject re-presigns on 403 Request has expired then returns metadata", async () => {
-        vi.useFakeTimers();
-        let presignCalls = 0;
-        const vault = {
-            presign: async (input) => {
-                presignCalls++;
-                return {
-                    results: input.keys.map((k) => ({
-                        key: k.key,
-                        op: "get",
-                        url: `https://s3/head-v${presignCalls}/${k.key}`,
-                    })),
-                    expiresAt: "2099-01-01T00:00:00.000Z",
-                };
-            },
-            listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-        };
-        const expiredXml = "<Error><Code>AccessDenied</Code><Message>Request has expired</Message>" +
-            "<X-Amz-Expires>1800</X-Amz-Expires></Error>";
-        const transportGet = vi
-            .fn()
-            .mockResolvedValueOnce({
-            status: 403,
-            headers: new Headers(),
-            body: (async function* () {
-                yield Buffer.from(expiredXml);
-            })(),
-            destroy: () => undefined,
-        })
-            .mockResolvedValueOnce({
-            status: 200,
-            headers: new Headers({
-                etag: '"abc"',
-                "content-length": "9",
-                "last-modified": "Wed, 01 Jan 2026 00:00:00 GMT",
-            }),
-            body: (async function* () {
-                yield Buffer.from("not-used");
-            })(),
-            destroy: () => undefined,
-        });
-        setPresignedGetTransportForTesting({ get: transportGet });
-        const io = new PresignObjectIO(vault, COMPANY);
-        const pr = io.headObject("shared/a.md");
-        await vi.runAllTimersAsync();
-        const head = await pr;
-        expect(head).toMatchObject({ etag: "abc", size: 9 });
-        expect(presignCalls).toBe(2);
-        expect(transportGet).toHaveBeenCalledTimes(2);
-    });
-});
-import { VaultClientError } from "./vault-client.js";
-describe("PresignObjectIO — 429 circuit breaker", () => {
-    afterEach(() => vi.unstubAllGlobals());
-    it("trips on a 429: uncached keys fail fast (no further presign), primed keys still work", async () => {
-        let presignCalls = 0;
-        const vault = {
-            presign: async (input) => {
-                presignCalls++;
-                if (input.keys.some((k) => k.key === "primed")) {
-                    return {
-                        results: input.keys.map((k) => ({
-                            key: k.key,
-                            op: k.op ?? "get",
-                            url: `https://s/${k.key}`,
-                            expiresIn: 900,
-                        })),
-                        expiresAt: "2099-01-01T00:00:00.000Z",
-                    };
-                }
-                throw new VaultClientError("Rate limit exceeded: 100 requests per hour", 429);
-            },
-            listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-        };
-        vi.stubGlobal("fetch", vi.fn(async () => new Response(Buffer.from("x"), { status: 200 })));
-        const io = new PresignObjectIO(vault, COMPANY);
-        await io.prime("get", [{ key: "primed" }]); // caches "primed"
-        await expect(io.getObject("uncached1")).rejects.toMatchObject({
-            name: "RateLimited",
-        });
-        const afterTrip = presignCalls;
-        // Second uncached key fails fast — NO new presign call.
-        await expect(io.getObject("uncached2")).rejects.toMatchObject({
-            name: "RateLimited",
-        });
-        expect(presignCalls).toBe(afterTrip);
-        // The primed key still resolves from cache (no presign needed).
-        const r = await io.getObject("primed");
-        expect(r.body.toString("utf-8")).toBe("x");
-    });
-    it("prime stops minting once a chunk 429s (breaker trips, remaining chunks skipped)", async () => {
-        let calls = 0;
-        const vault = {
-            presign: async () => {
-                calls++;
-                throw new VaultClientError("rate", 429);
-            },
-            listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-        };
-        const io = new PresignObjectIO(vault, COMPANY);
-        // 10 chunks (10k keys @ 1000); concurrency is 4, so at most the first
-        // concurrent batch fires before the breaker trips — far fewer than 10.
-        await io.prime("get", Array.from({ length: 10_000 }, (_, i) => ({ key: `k${i}` })));
-        expect(calls).toBeLessThanOrEqual(4);
-        expect(calls).toBeLessThan(10);
-    });
-});
-describe("PresignObjectIO.hasPrimedPut", () => {
-    it("reflects a put prime", async () => {
-        const { vault } = makeEchoVault();
-        const io = new PresignObjectIO(vault, COMPANY);
-        expect(io.hasPrimedPut("k")).toBe(false);
-        await io.prime("put", [
-            { key: "k", op: "put", contentType: "text/plain", metadata: { "hq-mode": "644" } },
-        ]);
-        expect(io.hasPrimedPut("k")).toBe(true);
-        // A different, unprimed key stays false.
-        expect(io.hasPrimedPut("other")).toBe(false);
-    });
-});
-describe("presignObjectIOFactory — personal vaults route to S3 SDK", () => {
-    it("routes a person entity (prs_*) to S3SdkObjectIO, a company (cmp_*) to presign", () => {
-        const { vault } = makeEchoVault();
-        const factory = presignObjectIOFactory(vault);
-        const company = factory({ ...ctx(), uid: "cmp_real" });
-        const personal = factory({ ...ctx(), uid: "prs_real" });
-        expect(company).toBeInstanceOf(PresignObjectIO);
-        // Personal vaults use the membership-less vend-self model; the
-        // membership-gated presign endpoints 403 for them, so they stay on STS.
-        expect(personal).toBeInstanceOf(S3SdkObjectIO);
-    });
-});
-describe("PresignObjectIO — core HTTP presigned GET", () => {
-    function streamingVault(baseUrl) {
-        return {
-            presign: async (input) => ({
-                results: input.keys.map((key) => ({
-                    key: key.key,
-                    op: "get",
-                    url: `${baseUrl}/${key.key}`,
-                })),
-                expiresAt: "2099-01-01T00:00:00.000Z",
-            }),
-            listFiles: async () => ({ objects: [], cursor: null, truncated: false }),
-        };
-    }
-    it("destroys an early-exit response and rejects a FIN-short body", async () => {
-        setPresignedGetTransportForTesting(null);
-        let responseClosed;
-        const server = http.createServer((req, res) => {
-            if (req.url === "/short") {
-                res.writeHead(200, { "content-length": "10" });
-                res.end("short");
-                return;
-            }
-            res.writeHead(200, { "content-length": "131072" });
-            res.write(Buffer.alloc(65_536, 1));
-            responseClosed = once(res, "close");
-            const finish = setTimeout(() => res.end(Buffer.alloc(65_536, 2)), 1_000);
-            res.once("close", () => clearTimeout(finish));
-        });
-        server.listen(0, "127.0.0.1");
-        await once(server, "listening");
-        const address = server.address();
-        if (!address || typeof address === "string") {
-            throw new Error("test server did not bind a TCP port");
-        }
-        try {
-            const io = new PresignObjectIO(streamingVault(`http://127.0.0.1:${address.port}`), COMPANY);
-            const streamed = await io.getObjectStream("large");
-            const iterator = streamed.body[Symbol.asyncIterator]();
-            expect((await iterator.next()).value).toBeInstanceOf(Uint8Array);
-            await iterator.return?.();
-            if (!responseClosed)
-                throw new Error("response did not start streaming");
-            await expect(responseClosed).resolves.toBeDefined();
-            await expect(io.getObject("short")).rejects.toMatchObject({
-                code: "ERR_HQ_TRUNCATED_RESPONSE",
-                message: expect.stringMatching(/content-length mismatch/),
-            });
-        }
-        finally {
-            server.close();
-            await once(server, "close");
-        }
-    });
-    it.runIf(process.platform === "win32" && /^(22|24)\./.test(process.versions.node))("keeps a child FIN safe after the consumer has applied backpressure", async () => {
-        setPresignedGetTransportForTesting(null);
-        const child = spawn(process.execPath, [
-            "-e",
-            [
-                "const http = require('node:http');",
-                "const body = Buffer.alloc(524288, 7);",
-                "const server = http.createServer((_req, res) => {",
-                "  res.writeHead(200, { 'content-length': String(body.length) });",
-                "  for (let offset = 0; offset < body.length; offset += 16384) res.write(body.subarray(offset, offset + 16384));",
-                "  res.end();",
-                "});",
-                "server.listen(0, '127.0.0.1', () => process.stdout.write(String(server.address().port) + '\\n'));",
-                "process.on('SIGTERM', () => server.close(() => process.exit(0)));",
-            ].join("\n"),
-        ], { stdio: ["ignore", "pipe", "inherit"] });
-        const port = await new Promise((resolve, reject) => {
-            child.once("error", reject);
-            child.stdout?.once("data", (data) => resolve(Number(data.toString())));
-            child.once("exit", (code) => reject(new Error(`child server exited (${code})`)));
-        });
-        try {
-            const io = new PresignObjectIO(streamingVault(`http://127.0.0.1:${port}`), COMPANY);
-            const streamed = await io.getObjectStream("bulk");
-            await new Promise((resolve) => setTimeout(resolve, 40));
-            let bytes = 0;
-            for await (const chunk of streamed.body)
-                bytes += chunk.byteLength;
-            expect(bytes).toBe(524_288);
-        }
-        finally {
-            child.kill("SIGTERM");
-        }
-    });
-});
-describe("presigned GET node body wrapper", () => {
-    it("keeps a socket error raised before iteration for the reader instead of throwing it", async () => {
-        const { PassThrough } = await import("node:stream");
-        const { checkedNodeBodyForTesting } = await import("./object-io.js");
-        const message = new PassThrough();
-        const unhandled = [];
-        const onUncaught = (error) => { unhandled.push(error); };
-        process.on("uncaughtException", onUncaught);
-        try {
-            const body = checkedNodeBodyForTesting(message, undefined);
-            message.emit("error", new Error("socket reset before iteration"));
-            await new Promise((resolve) => setImmediate(resolve));
-            expect(unhandled).toEqual([]);
-            const read = (async () => {
-                for await (const _chunk of body) { /* drain */ }
-            })();
-            await expect(read).rejects.toThrow("socket reset before iteration");
-        }
-        finally {
-            process.off("uncaughtException", onUncaught);
-        }
-    });
-});
-//# sourceMappingURL=object-io.test.js.map