@indigoai-us/hq-cloud 6.18.44-alpha.9 → 6.18.44

package/dist/vault-client.test.js

@@ -1,1334 +0,0 @@
-/**
- * VaultClient unit tests (VLT-7 US-001).
- *
- * Uses mocked fetch to assert retry behavior, error mapping, and auth header injection.
- */
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { VaultClient, VaultAuthError, VaultPermissionDeniedError, VaultNotFoundError, VaultConflictError, VaultClientError, pickCanonicalPersonEntity, planLimitRefusalFromError, } from "./vault-client.js";
-import { VaultCredentialScopeError } from "./credential-scope-error.js";
-import { PLAN_LIMIT_UPGRADE_URL, canonicalPlanLimitBody, companyPresignRefusalRow, legacyMembershipPlanLimitBody, } from "./plan-limit.fixtures.js";
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-function jsonResponse(status, body) {
-    return new Response(JSON.stringify(body), {
-        status,
-        headers: { "Content-Type": "application/json" },
-    });
-}
-function textResponse(status, body) {
-    return new Response(body, { status });
-}
-const TEST_CONFIG = {
-    apiUrl: "https://vault.test.example.com",
-    authToken: "test-jwt-token-123",
-};
-let client;
-let fetchSpy;
-beforeEach(() => {
-    client = new VaultClient(TEST_CONFIG);
-    fetchSpy = vi.spyOn(globalThis, "fetch");
-});
-afterEach(() => {
-    vi.restoreAllMocks();
-});
-// ---------------------------------------------------------------------------
-// Auth header injection
-// ---------------------------------------------------------------------------
-describe("auth header injection", () => {
-    it("sends Bearer token on every request", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, { members: [] }));
-        await client.listMembersOfCompany("cmp_abc");
-        expect(fetchSpy).toHaveBeenCalledTimes(1);
-        const [, init] = fetchSpy.mock.calls[0];
-        const headers = init.headers;
-        expect(headers.Authorization).toBe("Bearer test-jwt-token-123");
-    });
-    it("sets Content-Type on POST requests", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, { membership: {}, inviteToken: "tok" }));
-        await client.createInvite({
-            companyUid: "cmp_abc",
-            role: "member",
-            invitedBy: "psn_xyz",
-        });
-        const [, init] = fetchSpy.mock.calls[0];
-        const headers = init.headers;
-        expect(headers["Content-Type"]).toBe("application/json");
-    });
-});
-describe("company skill registration", () => {
-    it("posts canonical skill bytes to the authoritative registration route", async () => {
-        const content = "---\nname: Call Prep\n---\n";
-        const stamped = "---\nskill_uid: skl_CREATED1\nname: Call Prep\n---\n";
-        fetchSpy.mockResolvedValueOnce(jsonResponse(201, {
-            ok: true,
-            skillUid: "skl_CREATED1",
-            path: "skills/call-prep/SKILL.md",
-            vaultPath: "skills/call-prep/SKILL.md",
-            content: stamped,
-            action: "created",
-            accessPolicy: "open",
-            skill: {
-                name: "Call Prep",
-                description: "",
-                tags: [],
-            },
-        }));
-        const result = await client.registerCompanySkill("acme team", {
-            path: "skills/call-prep/SKILL.md",
-            content,
-        });
-        expect(result.skillUid).toBe("skl_CREATED1");
-        expect(fetchSpy).toHaveBeenCalledWith("https://vault.test.example.com/v1/files/skills/company/acme%20team/register", expect.objectContaining({
-            method: "POST",
-            body: JSON.stringify({
-                path: "skills/call-prep/SKILL.md",
-                content,
-            }),
-        }));
-    });
-    it("marks metadata reconciliation only after the caller confirms the bytes landed", async () => {
-        const content = "---\nskill_uid: skl_CREATED1\nname: Call Prep\n---\n";
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            ok: true,
-            skillUid: "skl_CREATED1",
-            path: "skills/call-prep/SKILL.md",
-            vaultPath: "skills/call-prep/SKILL.md",
-            content,
-            action: "reused",
-            accessPolicy: "preserved",
-            skill: { name: "Call Prep", description: "", tags: ["sales"] },
-        }));
-        await client.registerCompanySkill("acme", {
-            path: "skills/call-prep/SKILL.md",
-            content,
-            landed: true,
-        });
-        expect(fetchSpy).toHaveBeenCalledWith("https://vault.test.example.com/v1/files/skills/company/acme/register", expect.objectContaining({
-            method: "POST",
-            body: JSON.stringify({
-                path: "skills/call-prep/SKILL.md",
-                content,
-                landed: true,
-            }),
-        }));
-    });
-    it("rejects a response that does not contain a valid stamped identity", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            ok: true,
-            skillUid: "not-a-skill-id",
-            path: "skills/call-prep/SKILL.md",
-            vaultPath: "skills/call-prep/SKILL.md",
-            content: "---\nname: Call Prep\n---\n",
-            action: "created",
-            accessPolicy: "open",
-            skill: { name: "Call Prep", description: "", tags: [] },
-        }));
-        await expect(client.registerCompanySkill("acme", {
-            path: "skills/call-prep/SKILL.md",
-            content: "---\nname: Call Prep\n---\n",
-        })).rejects.toThrow(/invalid response/i);
-    });
-});
-// ---------------------------------------------------------------------------
-// Error mapping
-// ---------------------------------------------------------------------------
-describe("error mapping", () => {
-    it("maps 401 to VaultAuthError", async () => {
-        fetchSpy.mockImplementation(() => Promise.resolve(jsonResponse(401, { message: "Token expired" })));
-        await expect(client.listMembersOfCompany("cmp_abc")).rejects.toThrow(VaultAuthError);
-    });
-    it("maps 403 to VaultPermissionDeniedError", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(403, { message: "Admin required" }));
-        await expect(client.listMembersOfCompany("cmp_abc")).rejects.toThrow(VaultPermissionDeniedError);
-    });
-    it("maps 404 to VaultNotFoundError", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(404, { message: "Not found" }));
-        await expect(client.entity.get("cmp_missing")).rejects.toThrow(VaultNotFoundError);
-    });
-    it("maps 409 to VaultConflictError", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(409, { message: "Already accepted" }));
-        await expect(client.acceptInvite("tok", "psn_abc")).rejects.toThrow(VaultConflictError);
-    });
-    it("carries the vault's code and path on a refusal so callers can name the file", async () => {
-        // The skill-register 409 body names the object it is about; before this
-        // the client kept only the sentence, so a company-level abort read
-        // "this path" with no path (undrdog, 2026-09-11).
-        fetchSpy.mockResolvedValueOnce(jsonResponse(409, {
-            error: "The landed skill does not carry the registered identity for this path",
-            code: "SKILL_REGISTER_LANDED_IDENTITY_MISMATCH",
-            path: "skills/workflow-preflight/SKILL.md",
-        }));
-        const err = await client
-            .registerCompanySkill("acme", {
-            path: "skills/workflow-preflight/SKILL.md",
-            content: "---\nskill_uid: skl_X\n---\n",
-            landed: true,
-        })
-            .catch((e) => e);
-        expect(err).toBeInstanceOf(VaultConflictError);
-        expect(err).toMatchObject({
-            statusCode: 409,
-            message: "The landed skill does not carry the registered identity for this path",
-            code: "SKILL_REGISTER_LANDED_IDENTITY_MISMATCH",
-            path: "skills/workflow-preflight/SKILL.md",
-        });
-    });
-    it("names the requested skill path when a 409 body does not", async () => {
-        // The undrdog abort logged path:"(company)" because older vault bodies
-        // were a bare sentence. The client already knows which file it posted.
-        fetchSpy.mockResolvedValueOnce(jsonResponse(409, {
-            error: "The landed skill does not carry the registered identity for this path",
-        }));
-        const err = await client
-            .registerCompanySkill("undrdog", {
-            path: "skills/workflow-preflight/SKILL.md",
-            content: "---\nskill_uid: skl_X\n---\n",
-            landed: true,
-        })
-            .catch((e) => e);
-        expect(err).toBeInstanceOf(VaultConflictError);
-        expect(err).toMatchObject({
-            statusCode: 409,
-            path: "skills/workflow-preflight/SKILL.md",
-        });
-    });
-    it("does not replace a path the vault body already named", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(409, {
-            error: "The landed skill does not carry the registered identity for this path",
-            path: "skills/workflow-intake/SKILL.md",
-        }));
-        const err = await client
-            .registerCompanySkill("undrdog", {
-            path: "skills/workflow-preflight/SKILL.md",
-            content: "---\nskill_uid: skl_X\n---\n",
-            landed: true,
-        })
-            .catch((e) => e);
-        expect(err).toMatchObject({ path: "skills/workflow-intake/SKILL.md" });
-    });
-    it("leaves code and path unset when the error body has none", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(409, { message: "Already accepted" }));
-        const err = (await client
-            .acceptInvite("tok", "psn_abc")
-            .catch((e) => e));
-        expect(err.code).toBeUndefined();
-        expect(err.path).toBeUndefined();
-    });
-    it("keeps error, code, message and the parsed refusal from the canonical 402 hard-stop body", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(402, canonicalPlanLimitBody()));
-        const err = await client.acceptInvite("tok", "psn_abc").catch((error) => error);
-        expect(err).toBeInstanceOf(VaultClientError);
-        expect(err).toMatchObject({
-            statusCode: 402,
-            message: "New files are paused while Acme is over its Starter limits.",
-            code: "PLAN_LIMIT_EXCEEDED",
-            errorCode: "plan_limit_reached",
-            upgradeUrl: PLAN_LIMIT_UPGRADE_URL,
-            planLimit: {
-                upgradeUrl: PLAN_LIMIT_UPGRADE_URL,
-                error: "plan_limit_reached",
-                code: "PLAN_LIMIT_EXCEEDED",
-                blocked: "files.create",
-                resources: [
-                    { resource: "storageBytes", used: 11_811_160_064, limit: 10_737_418_240 },
-                ],
-                fixOptions: { storageBytes: 10_737_418_240 },
-            },
-        });
-        expect(planLimitRefusalFromError(err)).toEqual(err.planLimit);
-    });
-    it("recognises the legacy membership 402 as a plan-limit refusal", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(402, legacyMembershipPlanLimitBody()));
-        const err = await client.acceptInvite("tok", "psn_abc").catch((error) => error);
-        expect(planLimitRefusalFromError(err)).toEqual({
-            upgradeUrl: PLAN_LIMIT_UPGRADE_URL,
-            code: "PLAN_LIMIT_EXCEEDED",
-            resources: [{ resource: "users", used: 5, limit: 5 }],
-        });
-    });
-    it("does not treat an unrelated 4xx as a plan-limit refusal", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(403, { error: "forbidden", code: "FILES_PRESIGN_FORBIDDEN" }));
-        const err = await client.acceptInvite("tok", "psn_abc").catch((error) => error);
-        expect(err).toMatchObject({ errorCode: "forbidden", code: "FILES_PRESIGN_FORBIDDEN" });
-        expect(planLimitRefusalFromError(err)).toBeNull();
-        expect(planLimitRefusalFromError(new Error("boom"))).toBeNull();
-    });
-    it("keeps the server's exact per-item company presign refusal row", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            results: [
-                companyPresignRefusalRow("docs/paused.md"),
-                { key: "docs/read.md", op: "get", url: "https://s3.example.test/read" },
-            ],
-            expiresAt: "2026-09-24T00:00:00.000Z",
-        }));
-        const response = await client.presign({
-            companyUid: "cmp_01ABCDEF",
-            keys: [
-                { key: "docs/paused.md", op: "put" },
-                { key: "docs/read.md", op: "get" },
-            ],
-        });
-        expect(response.results[0]).toEqual({
-            key: "docs/paused.md",
-            op: "put",
-            error: "New files are paused while Acme is over its Starter limits.",
-            code: "PLAN_LIMIT_EXCEEDED",
-            upgradeUrl: PLAN_LIMIT_UPGRADE_URL,
-        });
-        expect(response.results[1]).toMatchObject({ url: "https://s3.example.test/read" });
-    });
-    it("does not treat a marker-less 402 or a non-https upgrade link as a plan-limit refusal", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(402, { message: "Add a card to continue", upgradeUrl: PLAN_LIMIT_UPGRADE_URL }));
-        const billing = await client.acceptInvite("tok", "psn_abc").catch((error) => error);
-        expect(billing).toMatchObject({ statusCode: 402, upgradeUrl: PLAN_LIMIT_UPGRADE_URL });
-        expect(planLimitRefusalFromError(billing)).toBeNull();
-        fetchSpy.mockResolvedValueOnce(jsonResponse(402, { ...canonicalPlanLimitBody(), upgradeUrl: "http://billing.example.test/acme" }));
-        const insecure = await client.acceptInvite("tok", "psn_abc").catch((error) => error);
-        expect(planLimitRefusalFromError(insecure)).toBeNull();
-        // Hand-built errors follow the same rule.
-        expect(planLimitRefusalFromError(new VaultClientError("Plan limit reached", 402, undefined, { upgradeUrl: PLAN_LIMIT_UPGRADE_URL }))).toBeNull();
-    });
-    it("checkFilesAdmission posts the admission body to the presign route with one attempt", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, { allowed: true }));
-        await expect(client.checkFilesAdmission("cmp_01ABCDEF")).resolves.toEqual({ allowed: true });
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe(`${TEST_CONFIG.apiUrl}/v1/files/presign`);
-        expect(init.method).toBe("POST");
-        expect(JSON.parse(String(init.body))).toEqual({ admission: true, companyUid: "cmp_01ABCDEF" });
-        fetchSpy.mockResolvedValueOnce(jsonResponse(402, canonicalPlanLimitBody()));
-        const refused = await client.checkFilesAdmission("cmp_01ABCDEF").catch((error) => error);
-        expect(planLimitRefusalFromError(refused)).toMatchObject({ upgradeUrl: PLAN_LIMIT_UPGRADE_URL });
-        // A 5xx is not retried: the caller treats it as "unknown".
-        fetchSpy.mockClear();
-        fetchSpy.mockResolvedValueOnce(jsonResponse(503, { message: "unavailable" }));
-        await expect(client.checkFilesAdmission("cmp_01ABCDEF")).rejects.toMatchObject({ statusCode: 503 });
-        expect(fetchSpy).toHaveBeenCalledTimes(1);
-    });
-    it("preserves upgradeUrl on an item plan-limit presign row", async () => {
-        const upgradeUrl = "https://billing.example.test/company/acme";
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            results: [
-                {
-                    key: "shared/paused.md",
-                    op: "put",
-                    error: "Plan limit reached",
-                    code: "PLAN_LIMIT_REACHED",
-                    upgradeUrl,
-                },
-            ],
-            expiresAt: "2026-09-24T00:00:00.000Z",
-        }));
-        const response = await client.presign({
-            companyUid: "cmp_01ABCDEF",
-            op: "put",
-            keys: [{ key: "shared/paused.md", op: "put" }],
-        });
-        expect(response.results[0]).toMatchObject({
-            code: "PLAN_LIMIT_REACHED",
-            upgradeUrl,
-        });
-    });
-    it("preserves error message from response body", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(403, { message: "Only admins can invite" }));
-        try {
-            await client.createInvite({
-                companyUid: "cmp_abc",
-                role: "member",
-                invitedBy: "psn_xyz",
-            });
-            expect.fail("Should have thrown");
-        }
-        catch (err) {
-            expect(err).toBeInstanceOf(VaultPermissionDeniedError);
-            expect(err.message).toBe("Only admins can invite");
-        }
-    });
-    it("handles non-JSON error bodies gracefully", async () => {
-        fetchSpy.mockResolvedValueOnce(textResponse(404, "Not Found"));
-        try {
-            await client.entity.findBySlug("company", "test");
-            expect.fail("Should have thrown");
-        }
-        catch (err) {
-            expect(err).toBeInstanceOf(VaultNotFoundError);
-            expect(err.message).toBe("Not Found");
-        }
-    });
-});
-// ---------------------------------------------------------------------------
-// Retry behavior
-// ---------------------------------------------------------------------------
-describe("retry behavior", () => {
-    it("retries on 429 and succeeds on second attempt", async () => {
-        fetchSpy
-            .mockResolvedValueOnce(jsonResponse(429, { message: "Rate limited" }))
-            .mockResolvedValueOnce(jsonResponse(200, { members: [{ personUid: "psn_1" }] }));
-        const result = await client.listMembersOfCompany("cmp_abc");
-        expect(result).toHaveLength(1);
-        expect(fetchSpy).toHaveBeenCalledTimes(2);
-    });
-    it("retries on 500 and succeeds on third attempt", async () => {
-        fetchSpy
-            .mockResolvedValueOnce(jsonResponse(500, { message: "Internal error" }))
-            .mockResolvedValueOnce(jsonResponse(502, { message: "Bad gateway" }))
-            .mockResolvedValueOnce(jsonResponse(200, { membership: { role: "admin" } }));
-        const result = await client.updateRole({
-            membershipKey: "psn_1#cmp_abc",
-            newRole: "admin",
-            updaterUid: "psn_owner",
-            companyUid: "cmp_abc",
-        });
-        expect(result.role).toBe("admin");
-        expect(fetchSpy).toHaveBeenCalledTimes(3);
-    });
-    it("throws after exhausting all retries on persistent 500", async () => {
-        fetchSpy.mockImplementation(() => Promise.resolve(jsonResponse(500, { message: "Down" })));
-        await expect(client.listMembersOfCompany("cmp_abc")).rejects.toThrow(VaultClientError);
-        // 1 initial + 3 retries = 4
-        expect(fetchSpy).toHaveBeenCalledTimes(4);
-    });
-    // Regression: the deploy access-gate 401 of 2026-07-19. A token that expired
-    // mid-request is recoverable — callers passing a getter can mint a fresh one —
-    // but the client threw instead of retrying, so a transient auth lapse surfaced
-    // as a hard failure and the caller degraded a members-only gate to a password.
-    it("retries a 401 once when the token getter yields a fresh token", async () => {
-        const tokens = ["stale-token", "fresh-token"];
-        const getToken = vi.fn(async () => tokens.shift() ?? "fresh-token");
-        const c = new VaultClient({ ...TEST_CONFIG, authToken: getToken });
-        fetchSpy
-            .mockResolvedValueOnce(jsonResponse(401, { message: "Token expired" }))
-            .mockResolvedValueOnce(jsonResponse(200, { members: [{ personUid: "psn_1" }] }));
-        const result = await c.listMembersOfCompany("cmp_abc");
-        expect(result).toHaveLength(1);
-        expect(fetchSpy).toHaveBeenCalledTimes(2);
-        const authHeader = (call) => fetchSpy.mock.calls[call][1].headers;
-        expect(authHeader(0).Authorization).toBe("Bearer stale-token");
-        expect(authHeader(1).Authorization).toBe("Bearer fresh-token");
-    });
-    it("does not retry a 401 when the getter returns the same token", async () => {
-        const getToken = vi.fn(async () => "unchanging-token");
-        const c = new VaultClient({ ...TEST_CONFIG, authToken: getToken });
-        fetchSpy.mockResolvedValue(jsonResponse(401, { message: "Nope" }));
-        await expect(c.listMembersOfCompany("cmp_abc")).rejects.toThrow(VaultAuthError);
-        expect(fetchSpy).toHaveBeenCalledTimes(1);
-    });
-    // Review finding: the auth retry used to share the transient budget, so a
-    // 401 on the LAST attempt set the flag, hit `continue`, and fell out of the
-    // loop having never actually retried — the recovery silently did nothing in
-    // exactly the case it was written for.
-    it("still retries when the 401 lands on the final attempt", async () => {
-        const tokens = ["stale", "stale", "stale", "stale", "fresh"];
-        const getToken = vi.fn(async () => tokens.shift() ?? "fresh");
-        const c = new VaultClient({ ...TEST_CONFIG, authToken: getToken });
-        // Burn the whole transient budget first (attempts 0,1,2), so the 401 lands
-        // on attempt 3 — the last one the shared-budget loop would ever run.
-        fetchSpy
-            .mockResolvedValueOnce(jsonResponse(500, { message: "boom" }))
-            .mockResolvedValueOnce(jsonResponse(500, { message: "boom" }))
-            .mockResolvedValueOnce(jsonResponse(500, { message: "boom" }))
-            .mockResolvedValueOnce(jsonResponse(401, { message: "Token expired" }))
-            .mockResolvedValueOnce(jsonResponse(200, { members: [{ personUid: "psn_1" }] }));
-        const result = await c.listMembersOfCompany("cmp_abc");
-        expect(result).toHaveLength(1);
-        // 5th call only happens if the auth retry got its own budget.
-        expect(fetchSpy).toHaveBeenCalledTimes(5);
-    });
-    // Review finding: a 401 consumed a transient-retry slot, so a request that
-    // hit an auth lapse had fewer retries left for genuine 5xx afterwards.
-    it("does not spend transient-retry budget on the auth retry", async () => {
-        const tokens = ["stale", "fresh"];
-        const getToken = vi.fn(async () => tokens.shift() ?? "fresh");
-        const c = new VaultClient({ ...TEST_CONFIG, authToken: getToken });
-        // 401 (free retry) then three 500s — the full transient budget must still
-        // be available, so the 4th call succeeds.
-        fetchSpy
-            .mockResolvedValueOnce(jsonResponse(401, { message: "Token expired" }))
-            .mockResolvedValueOnce(jsonResponse(500, { message: "boom" }))
-            .mockResolvedValueOnce(jsonResponse(500, { message: "boom" }))
-            .mockResolvedValueOnce(jsonResponse(500, { message: "boom" }))
-            .mockResolvedValueOnce(jsonResponse(200, { members: [{ personUid: "psn_1" }] }));
-        const result = await c.listMembersOfCompany("cmp_abc");
-        expect(result).toHaveLength(1);
-        expect(fetchSpy).toHaveBeenCalledTimes(5);
-    });
-    it("retries a 401 at most once even if the token keeps changing", async () => {
-        let n = 0;
-        const getToken = vi.fn(async () => `token-${n++}`);
-        const c = new VaultClient({ ...TEST_CONFIG, authToken: getToken });
-        // mockImplementation (not mockResolvedValue): each attempt needs its own
-        // Response, since the body can only be read once.
-        fetchSpy.mockImplementation(() => Promise.resolve(jsonResponse(401, { message: "Still no" })));
-        await expect(c.listMembersOfCompany("cmp_abc")).rejects.toThrow(VaultAuthError);
-        // 1 initial + exactly 1 auth retry — never a retry storm against the authorizer
-        expect(fetchSpy).toHaveBeenCalledTimes(2);
-    });
-    it("does not retry on 403 (non-transient)", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(403, { message: "Forbidden" }));
-        await expect(client.createInvite({
-            companyUid: "cmp_abc",
-            role: "member",
-            invitedBy: "psn_xyz",
-        })).rejects.toThrow(VaultPermissionDeniedError);
-        expect(fetchSpy).toHaveBeenCalledTimes(1);
-    });
-    it("retries on network errors (fetch throws)", async () => {
-        fetchSpy
-            .mockRejectedValueOnce(new Error("ECONNRESET"))
-            .mockResolvedValueOnce(jsonResponse(200, { members: [] }));
-        const result = await client.listMembersOfCompany("cmp_abc");
-        expect(result).toEqual([]);
-        expect(fetchSpy).toHaveBeenCalledTimes(2);
-    });
-});
-// ---------------------------------------------------------------------------
-// API surface
-// ---------------------------------------------------------------------------
-describe("API surface", () => {
-    it("createInvite sends correct body and URL", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            membership: { membershipKey: "psn_1#cmp_abc", role: "member", status: "pending" },
-            inviteToken: "tok_secure_random",
-        }));
-        const result = await client.createInvite({
-            companyUid: "cmp_abc",
-            role: "member",
-            invitedBy: "psn_owner",
-            inviteeEmail: "alice@example.com",
-        });
-        expect(result.inviteToken).toBe("tok_secure_random");
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/membership/invite");
-        expect(JSON.parse(init.body)).toEqual({
-            companyUid: "cmp_abc",
-            role: "member",
-            invitedBy: "psn_owner",
-            inviteeEmail: "alice@example.com",
-        });
-    });
-    it("acceptInvite sends token and personUid", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            membership: { status: "active", role: "member" },
-        }));
-        const result = await client.acceptInvite("tok_abc", "psn_invitee");
-        expect(result.membership.status).toBe("active");
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/membership/accept");
-        expect(JSON.parse(init.body)).toEqual({
-            token: "tok_abc",
-            personUid: "psn_invitee",
-        });
-    });
-    it("postTelemetryEvents sends action events without personUid", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, { contractVersion: 1, ok: true, written: 1, skipped: [] }));
-        const batch = {
-            events: [
-                {
-                    eventName: "sync_runner_completed",
-                    app: "hq-cloud",
-                    source: "sync-runner",
-                    occurredAt: "2026-07-07T12:00:00.000Z",
-                    companyUid: "cmp_abc",
-                    sessionId: "sync_123",
-                    schemaVersion: 1,
-                    properties: {
-                        result: "completed",
-                        fileCount: 2,
-                    },
-                },
-            ],
-        };
-        const result = await client.postTelemetryEvents(batch);
-        expect(result).toEqual({ ok: true, written: 1, skipped: [] });
-        expect(fetchSpy).toHaveBeenCalledTimes(1);
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/v1/telemetry/events");
-        expect(init.method.toUpperCase()).toBe("POST");
-        const body = JSON.parse(init.body);
-        expect(body).toEqual(batch);
-        expect(JSON.stringify(body)).not.toContain("personUid");
-    });
-    it("postTelemetryEvents normalizes the compatible pre-v1 accepted response", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, { accepted: 2, deduped: 1 }));
-        const batch = { events: [] };
-        await expect(client.postTelemetryEvents(batch)).resolves.toEqual({
-            ok: true,
-            written: 2,
-            skipped: [],
-        });
-    });
-    it("updateRole sends correct payload", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            membership: { role: "guest", allowedPrefixes: ["docs/"] },
-        }));
-        const result = await client.updateRole({
-            membershipKey: "psn_1#cmp_abc",
-            newRole: "guest",
-            allowedPrefixes: ["docs/"],
-            updaterUid: "psn_admin",
-            companyUid: "cmp_abc",
-        });
-        expect(result.role).toBe("guest");
-        expect(result.allowedPrefixes).toEqual(["docs/"]);
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/membership/role");
-        expect(JSON.parse(init.body)).toEqual({
-            membershipKey: "psn_1#cmp_abc",
-            newRole: "guest",
-            allowedPrefixes: ["docs/"],
-            updaterUid: "psn_admin",
-            companyUid: "cmp_abc",
-        });
-    });
-    it("entity.get calls correct URL", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            entity: { uid: "cmp_abc", slug: "acme", type: "company", status: "active" },
-        }));
-        const entity = await client.entity.get("cmp_abc");
-        expect(entity.slug).toBe("acme");
-        const [url] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/entity/cmp_abc");
-    });
-    it("entity.findBySlug calls correct URL", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            entity: { uid: "cmp_abc", slug: "acme", type: "company", status: "active" },
-        }));
-        const entity = await client.entity.findBySlug("company", "acme");
-        expect(entity.uid).toBe("cmp_abc");
-        const [url] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/entity/by-slug/company/acme");
-    });
-    it("revokeMembership calls POST /membership/revoke with companyUid", async () => {
-        fetchSpy.mockResolvedValueOnce(new Response(null, { status: 204 }));
-        await client.revokeMembership("psn_1#cmp_abc", "cmp_abc");
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/membership/revoke");
-        expect(init.method).toBe("POST");
-        expect(JSON.parse(init.body)).toEqual({
-            membershipKey: "psn_1#cmp_abc",
-            companyUid: "cmp_abc",
-        });
-    });
-    it("listPendingInvites calls correct URL", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, { invites: [{ status: "pending" }] }));
-        const invites = await client.listPendingInvites("cmp_abc");
-        expect(invites).toHaveLength(1);
-        const [url] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/membership/company/cmp_abc/pending");
-    });
-    it("listMyMemberships hits GET /membership/me and unwraps memberships[]", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            memberships: [
-                { membershipKey: "psn_1#cmp_a", role: "owner", status: "active" },
-                { membershipKey: "psn_1#cmp_b", role: "member", status: "active" },
-            ],
-        }));
-        const memberships = await client.listMyMemberships();
-        expect(memberships).toHaveLength(2);
-        expect(memberships[0].membershipKey).toBe("psn_1#cmp_a");
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/membership/me");
-        expect(init.method).toBe("GET");
-        // No body on GET.
-        expect(init.body).toBeUndefined();
-    });
-    it("listMyMemberships returns [] for callers with no person entity (bootstrap case)", async () => {
-        // Server returns 200 + { memberships: [] } rather than 404 when the
-        // caller is signed in but hasn't been provisioned yet. The SDK must
-        // surface an empty array, NOT throw — hq-sync-runner relies on this
-        // to emit `setup-needed` without catching HTTP errors.
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, { memberships: [] }));
-        const memberships = await client.listMyMemberships();
-        expect(memberships).toEqual([]);
-    });
-    it("listMyPendingInvitesByEmail hits GET /membership/pending-by-email", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            invites: [
-                {
-                    membershipKey: "email:stefan@getindigo.ai#cmp_abc",
-                    companyUid: "cmp_abc",
-                    role: "owner",
-                    invitedBy: "sub-admin",
-                    invitedAt: "2026-04-20T00:00:00Z",
-                },
-            ],
-        }));
-        const invites = await client.listMyPendingInvitesByEmail();
-        expect(invites).toHaveLength(1);
-        expect(invites[0].companyUid).toBe("cmp_abc");
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/membership/pending-by-email");
-        expect(init.method).toBe("GET");
-    });
-    it("listMyPendingInvitesByEmail returns [] when server omits the key", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-        const invites = await client.listMyPendingInvitesByEmail();
-        expect(invites).toEqual([]);
-    });
-    it("claimPendingInvitesByEmail POSTs personUid to /membership/claim-by-email", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-        await client.claimPendingInvitesByEmail("ent_person_stefan");
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/membership/claim-by-email");
-        expect(init.method).toBe("POST");
-        expect(JSON.parse(init.body)).toEqual({
-            personUid: "ent_person_stefan",
-        });
-    });
-});
-describe("response validation (F26)", () => {
-    it("F26: validates a valid files/list response and returns typed data", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            objects: [
-                {
-                    key: "shared/docs/a.txt",
-                    size: 123,
-                    lastModified: "2026-05-20T12:00:00.000Z",
-                    storageClass: "DEEP_ARCHIVE",
-                    etag: "abc123",
-                    permission: "read",
-                },
-            ],
-            cursor: null,
-            truncated: false,
-        }));
-        const page = await client.listFiles("cmp_abc", "shared/docs/");
-        expect(page.objects[0]).toEqual({
-            key: "shared/docs/a.txt",
-            size: 123,
-            lastModified: "2026-05-20T12:00:00.000Z",
-            storageClass: "DEEP_ARCHIVE",
-            etag: "abc123",
-            permission: "read",
-        });
-        expect(page.cursor).toBeNull();
-        expect(page.truncated).toBe(false);
-    });
-    it("F26: defaults omitted files/list paging fields", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-        const page = await client.listFiles("cmp_abc", "shared/docs/");
-        expect(page).toEqual({
-            objects: [],
-            cursor: null,
-            truncated: false,
-        });
-    });
-    it("F26: accepts an older files/list row that omits storageClass", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            objects: [{
-                    key: "shared/docs/older-server.txt",
-                    size: 9,
-                    lastModified: "2026-05-20T12:00:00.000Z",
-                    etag: "old-server-etag",
-                    permission: "read",
-                }],
-        }));
-        const page = await client.listFiles("cmp_abc", "shared/docs/");
-        expect(page.objects[0].storageClass).toBeUndefined();
-    });
-    it("F26: defaults omitted telemetry opt-in fields to disabled", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-        const optIn = await client.getTelemetryOptIn();
-        expect(optIn).toEqual({ enabled: false, updatedAt: null });
-    });
-    it("F26: maps a malformed files/list response to VaultClientError", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            objects: [
-                {
-                    key: "shared/docs/a.txt",
-                    size: 123,
-                    lastModified: "2026-05-20T12:00:00.000Z",
-                    permission: "read",
-                },
-            ],
-            cursor: null,
-            truncated: false,
-        }));
-        await expect(client.listFiles("cmp_abc")).rejects.toMatchObject({
-            name: "VaultClientError",
-            statusCode: 502,
-        });
-    });
-});
-describe("VaultClient identity bootstrap", () => {
-    let client;
-    let fetchSpy;
-    beforeEach(() => {
-        fetchSpy = vi.spyOn(globalThis, "fetch");
-        fetchSpy.mockResolvedValue(jsonResponse(200, {}));
-        client = new VaultClient({
-            apiUrl: "https://vault.test.example.com",
-            authToken: "test-token",
-            region: "us-east-1",
-        });
-    });
-    afterEach(() => {
-        fetchSpy.mockRestore();
-    });
-    it("entity.listByType GETs /entity/by-type/{type}", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            entities: [
-                {
-                    uid: "ent_person_stefan",
-                    slug: "stefan-johnson",
-                    type: "person",
-                    status: "active",
-                },
-            ],
-        }));
-        const entities = await client.entity.listByType("person");
-        expect(entities).toHaveLength(1);
-        const [url] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/entity/by-type/person");
-    });
-    it("entity.listByType returns [] when server omits the key", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-        const entities = await client.entity.listByType("person");
-        expect(entities).toEqual([]);
-    });
-    it("ensureMyPersonEntity short-circuits when a person entity already exists", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            entities: [
-                {
-                    uid: "ent_person_existing",
-                    slug: "already-there",
-                    type: "person",
-                    status: "active",
-                },
-            ],
-        }));
-        const person = await client.ensureMyPersonEntity({
-            ownerSub: "sub-abc",
-            displayName: "Stefan Johnson",
-        });
-        expect(person.uid).toBe("ent_person_existing");
-        // Only one HTTP call — list. No POST /entity.
-        expect(fetchSpy).toHaveBeenCalledTimes(1);
-    });
-    it("ensureMyPersonEntity POSTs /entity with a slug derived from displayName when none exist", async () => {
-        fetchSpy
-            .mockResolvedValueOnce(jsonResponse(200, { entities: [] }))
-            .mockResolvedValueOnce(jsonResponse(200, {
-            entity: {
-                uid: "ent_person_new",
-                slug: "stefan-johnson",
-                type: "person",
-                status: "active",
-            },
-        }));
-        const person = await client.ensureMyPersonEntity({
-            ownerSub: "sub-abc",
-            displayName: "Stefan Johnson",
-        });
-        expect(person.uid).toBe("ent_person_new");
-        expect(fetchSpy).toHaveBeenCalledTimes(2);
-        const [url, init] = fetchSpy.mock.calls[1];
-        expect(url).toBe("https://vault.test.example.com/entity");
-        expect(init.method).toBe("POST");
-        expect(JSON.parse(init.body)).toEqual({
-            type: "person",
-            name: "Stefan Johnson",
-            slug: "stefan-johnson",
-        });
-    });
-    it("ensureMyPersonEntity falls back to user-<sub-suffix> when displayName slugifies to empty", async () => {
-        fetchSpy
-            .mockResolvedValueOnce(jsonResponse(200, { entities: [] }))
-            .mockResolvedValueOnce(jsonResponse(200, {
-            entity: {
-                uid: "ent_person_new",
-                slug: "user-12345678",
-                type: "person",
-                status: "active",
-            },
-        }));
-        await client.ensureMyPersonEntity({
-            ownerSub: "sub-abcdef12345678",
-            displayName: "!!!",
-        });
-        const [, init] = fetchSpy.mock.calls[1];
-        const body = JSON.parse(init.body);
-        expect(body.slug).toBe("user-12345678");
-    });
-    it("listByType_roundtrips_createdAt", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            entities: [
-                {
-                    uid: "prs_x",
-                    slug: "alice",
-                    type: "person",
-                    status: "active",
-                    createdAt: "2026-01-01T00:00:00Z",
-                },
-            ],
-        }));
-        const entities = await client.entity.listByType("person");
-        expect(entities).toHaveLength(1);
-        expect(entities[0].createdAt).toBe("2026-01-01T00:00:00Z");
-    });
-    it("ensureMyPersonEntity_picks_oldest_when_multiple", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            entities: [
-                { uid: "prs_b", slug: "b", type: "person", status: "active", createdAt: "2026-03-01T00:00:00Z" },
-                { uid: "prs_a", slug: "a", type: "person", status: "active", createdAt: "2026-01-01T00:00:00Z" },
-                { uid: "prs_c", slug: "c", type: "person", status: "active", createdAt: "2026-06-01T00:00:00Z" },
-            ],
-        }));
-        const person = await client.ensureMyPersonEntity({
-            ownerSub: "sub-multi",
-            displayName: "Multi User",
-        });
-        expect(person.uid).toBe("prs_a");
-        expect(fetchSpy).toHaveBeenCalledTimes(1);
-    });
-    it("ensureMyPersonEntity_handles_missing_createdAt_deterministically", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            entities: [
-                { uid: "prs_z", slug: "z", type: "person", status: "active" },
-                { uid: "prs_a", slug: "a", type: "person", status: "active" },
-            ],
-        }));
-        const person = await client.ensureMyPersonEntity({
-            ownerSub: "sub-nodates",
-            displayName: "No Dates User",
-        });
-        // Both missing createdAt → "" tie, uid tiebreak selects prs_a
-        expect(person.uid).toBe("prs_a");
-        expect(fetchSpy).toHaveBeenCalledTimes(1);
-    });
-    it("pickCanonicalPersonEntity_picks_oldest_tiebreak_uid", () => {
-        const list = [
-            { uid: "prs_b", slug: "b", type: "person", status: "active", createdAt: "2026-01-02T00:00:00Z" },
-            { uid: "prs_a", slug: "a", type: "person", status: "active", createdAt: "2026-01-01T00:00:00Z" },
-        ];
-        // Older createdAt wins
-        expect(pickCanonicalPersonEntity(list)?.uid).toBe("prs_a");
-        // Same createdAt: uid tiebreak (lexicographic ascending)
-        const tieList = [
-            { uid: "prs_z", slug: "z", type: "person", status: "active", createdAt: "2026-01-01T00:00:00Z" },
-            { uid: "prs_a", slug: "a", type: "person", status: "active", createdAt: "2026-01-01T00:00:00Z" },
-        ];
-        expect(pickCanonicalPersonEntity(tieList)?.uid).toBe("prs_a");
-    });
-    it("pickCanonicalPersonEntity_handles_missing_createdAt_deterministically", () => {
-        // undefined createdAt coalesces to "" which sorts before any ISO date string.
-        // So the entity with undefined createdAt wins on the createdAt comparison.
-        // When two entities both lack createdAt, uid tiebreak applies.
-        const list = [
-            { uid: "prs_b", slug: "b", type: "person", status: "active", createdAt: "2026-01-01T00:00:00Z" },
-            { uid: "prs_a", slug: "a", type: "person", status: "active" },
-        ];
-        // "" < "2026-..." so prs_a (undefined→"") wins
-        expect(pickCanonicalPersonEntity(list)?.uid).toBe("prs_a");
-        // Both undefined: uid tiebreak
-        const bothUndefined = [
-            { uid: "prs_z", slug: "z", type: "person", status: "active" },
-            { uid: "prs_a", slug: "a", type: "person", status: "active" },
-        ];
-        expect(pickCanonicalPersonEntity(bothUndefined)?.uid).toBe("prs_a");
-    });
-    it("pickCanonicalPersonEntity_filters_out_non_person_types", () => {
-        const mixed = [
-            { uid: "cmp_x", slug: "x", type: "company", status: "active", createdAt: "2025-01-01T00:00:00Z" },
-            { uid: "prs_b", slug: "b", type: "person", status: "active", createdAt: "2026-01-02T00:00:00Z" },
-        ];
-        const result = pickCanonicalPersonEntity(mixed);
-        expect(result?.uid).toBe("prs_b");
-        expect(result?.type).toBe("person");
-    });
-    it("sts.vend roundtrips POST /sts/vend with companyUid", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            credentials: {
-                accessKeyId: "AKIAIOSFODNN7EXAMPLE",
-                secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
-                sessionToken: "FwoGZXIvYXdzEBY...",
-            },
-            expiresAt: "2026-01-01T01:00:00.000Z",
-        }));
-        const result = await client.sts.vend({ companyUid: "cmp_x" });
-        expect(result.credentials.accessKeyId).toBe("AKIAIOSFODNN7EXAMPLE");
-        expect(result.credentials.sessionToken).toBe("FwoGZXIvYXdzEBY...");
-        expect(typeof result.expiresAt).toBe("string");
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/sts/vend");
-        expect(init.method.toUpperCase()).toBe("POST");
-        expect(JSON.parse(init.body)).toEqual({ companyUid: "cmp_x" });
-    });
-    it("sts.vend refuses a legacy 200 response whose credentials dropped writes", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            credentials: {
-                accessKeyId: "AKIAIOSFODNN7EXAMPLE",
-                secretAccessKey: "secret",
-                sessionToken: "token",
-                policyTruncated: true,
-                droppedWriteGrantPrefixes: [
-                    "data/intelligence/deployment-tests/*",
-                    "data/intelligence/founder-signals/*",
-                ],
-                retainedGrantPrefixes: ["knowledge/*"],
-            },
-            expiresAt: "2026-01-01T01:00:00.000Z",
-        }));
-        await expect(client.sts.vend({ companyUid: "cmp_x" })).rejects.toMatchObject({
-            name: "VaultCredentialScopeError",
-            code: "POLICY_WRITE_SCOPE_TRUNCATED",
-            droppedWriteGrantPrefixes: [
-                "data/intelligence/deployment-tests/*",
-                "data/intelligence/founder-signals/*",
-            ],
-            retainedGrantPrefixes: ["knowledge/*"],
-        });
-    });
-    it("sts.vend maps the server's typed 422 refusal without losing prefix diagnostics", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(422, {
-            error: "Vault write credentials cannot represent 2 granted prefixes",
-            code: "POLICY_WRITE_SCOPE_TRUNCATED",
-            droppedWriteGrantPrefixes: [
-                "data/intelligence/deployment-tests/*",
-                "data/intelligence/founder-signals/*",
-            ],
-            retainedGrantPrefixes: ["knowledge/*"],
-            remediation: "Use presigned company-vault access.",
-        }));
-        const error = await client.sts
-            .vend({ companyUid: "cmp_x" })
-            .catch((caught) => caught);
-        expect(error).toBeInstanceOf(VaultCredentialScopeError);
-        expect(error).toMatchObject({
-            statusCode: 422,
-            code: "POLICY_WRITE_SCOPE_TRUNCATED",
-            retainedGrantPrefixes: ["knowledge/*"],
-        });
-        expect(error.message).toContain("deployment-tests/*");
-        expect(error.message).toContain("Use presigned company-vault access");
-    });
-    it("vendSelf_roundtrip", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            credentials: {
-                accessKeyId: "AKIAIOSFODNN7EXAMPLE",
-                secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
-                sessionToken: "FwoGZXIvYXdzEBY...",
-            },
-            expiresAt: "2026-01-01T01:00:00.000Z",
-        }));
-        const result = await client.sts.vendSelf({ personUid: "prs_x" });
-        expect(result.credentials.accessKeyId).toBe("AKIAIOSFODNN7EXAMPLE");
-        expect(result.credentials.secretAccessKey).toBe("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY");
-        expect(result.credentials.sessionToken).toBe("FwoGZXIvYXdzEBY...");
-        expect(typeof result.expiresAt).toBe("string");
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/sts/vend-self");
-        expect(init.method.toUpperCase()).toBe("POST");
-        expect(JSON.parse(init.body)).toEqual({ personUid: "prs_x" });
-    });
-});
-// ---------------------------------------------------------------------------
-// Browse-vs-sync SDK methods (US-004)
-//
-// listMyExplicitGrants, getMembershipSyncConfig, setMembershipSyncConfig
-// wrap the US-002/US-003 hq-pro endpoints. Tests assert URL shape, payload
-// shape, error mapping (401/404/network), and the empty-grants fallback
-// that lets call sites treat "no grants" as a normal state.
-// ---------------------------------------------------------------------------
-describe("listMyExplicitGrants (US-004)", () => {
-    it("GETs /v1/files/grants with the company query param and returns grants[]", async () => {
-        const grant = {
-            companyUid: "cmp_abc",
-            path: "shared/docs",
-            permission: "read",
-            source: "person",
-        };
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            grants: [grant],
-            computedAt: "2026-05-20T12:00:00.000Z",
-        }));
-        const grants = await client.listMyExplicitGrants("cmp_abc");
-        expect(grants).toEqual([grant]);
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/v1/files/grants?company=cmp_abc");
-        expect(init.method).toBe("GET");
-        expect(init.body).toBeUndefined();
-    });
-    it("parses creator-sourced grants", async () => {
-        const grant = {
-            companyUid: "cmp_abc",
-            path: "personal/psn_creator",
-            permission: "admin",
-            source: "creator",
-        };
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            grants: [grant],
-            computedAt: "2026-05-20T12:00:00.000Z",
-        }));
-        const grants = await client.listMyExplicitGrants("cmp_abc");
-        expect(grants[0]?.source).toBe("creator");
-        expect(grants).toEqual([grant]);
-    });
-    it("URL-encodes the companyUid query parameter", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, { grants: [], computedAt: "2026-05-20T12:00:00.000Z" }));
-        await client.listMyExplicitGrants("cmp/with spaces&weird=chars");
-        const [url] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/v1/files/grants?company=cmp%2Fwith%20spaces%26weird%3Dchars");
-    });
-    it("returns [] when the server omits the grants key (empty graph)", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, { computedAt: "2026-05-20T12:00:00.000Z" }));
-        const grants = await client.listMyExplicitGrants("cmp_abc");
-        expect(grants).toEqual([]);
-    });
-    it("maps 401 to VaultAuthError", async () => {
-        fetchSpy.mockImplementation(() => Promise.resolve(jsonResponse(401, { error: "Missing or invalid authorization token" })));
-        await expect(client.listMyExplicitGrants("cmp_abc")).rejects.toThrow(VaultAuthError);
-    });
-    it("maps 404 to VaultNotFoundError", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(404, { error: "Unknown route" }));
-        await expect(client.listMyExplicitGrants("cmp_abc")).rejects.toThrow(VaultNotFoundError);
-    });
-    it("surfaces transport errors after exhausting retries", async () => {
-        fetchSpy.mockRejectedValue(new Error("ECONNREFUSED"));
-        await expect(client.listMyExplicitGrants("cmp_abc")).rejects.toThrow(/ECONNREFUSED/);
-        // 1 initial + 3 retries = 4 attempts on a persistent network error.
-        expect(fetchSpy).toHaveBeenCalledTimes(4);
-    });
-});
-describe("getMembershipSyncConfig (US-004)", () => {
-    it("GETs /v1/memberships/{id}/sync-config and returns the row verbatim", async () => {
-        const row = {
-            membershipId: "psn_1#cmp_abc",
-            syncMode: "custom",
-            customPaths: ["shared/docs", "personal/psn_1"],
-            isDefault: false,
-            updatedAt: "2026-05-20T12:00:00.000Z",
-            updatedBy: "psn_admin",
-        };
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, row));
-        const result = await client.getMembershipSyncConfig("psn_1#cmp_abc");
-        expect(result).toEqual(row);
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe(
-        // `#` in the membershipKey MUST be URL-encoded — otherwise the
-        // server sees a fragment, not a path segment.
-        "https://vault.test.example.com/v1/memberships/psn_1%23cmp_abc/sync-config");
-        expect(init.method).toBe("GET");
-        expect(init.body).toBeUndefined();
-    });
-    it("returns the default row (isDefault: true) without updatedAt/updatedBy", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            membershipId: "psn_1#cmp_abc",
-            syncMode: "all",
-            isDefault: true,
-        }));
-        const result = await client.getMembershipSyncConfig("psn_1#cmp_abc");
-        expect(result.isDefault).toBe(true);
-        expect(result.updatedAt).toBeUndefined();
-        expect(result.updatedBy).toBeUndefined();
-    });
-    it("maps 401 to VaultAuthError", async () => {
-        fetchSpy.mockImplementation(() => Promise.resolve(jsonResponse(401, { error: "Token expired" })));
-        await expect(client.getMembershipSyncConfig("psn_1#cmp_abc")).rejects.toThrow(VaultAuthError);
-    });
-    it("maps 404 to VaultNotFoundError (membership tombstoned or missing)", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(404, {
-            error: "Membership not found or not active: psn_1#cmp_abc",
-        }));
-        await expect(client.getMembershipSyncConfig("psn_1#cmp_abc")).rejects.toThrow(VaultNotFoundError);
-    });
-    it("surfaces network errors after retry exhaustion", async () => {
-        fetchSpy.mockRejectedValue(new Error("socket hang up"));
-        await expect(client.getMembershipSyncConfig("psn_1#cmp_abc")).rejects.toThrow(/socket hang up/);
-        expect(fetchSpy).toHaveBeenCalledTimes(4);
-    });
-});
-describe("setMembershipSyncConfig (US-004)", () => {
-    it("PUTs the partial body to /v1/memberships/{id}/sync-config", async () => {
-        const persisted = {
-            membershipId: "psn_1#cmp_abc",
-            syncMode: "custom",
-            customPaths: ["shared/docs"],
-            isDefault: false,
-            updatedAt: "2026-05-20T12:00:00.000Z",
-            updatedBy: "psn_1",
-        };
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, persisted));
-        const result = await client.setMembershipSyncConfig("psn_1#cmp_abc", {
-            syncMode: "custom",
-            customPaths: ["shared/docs"],
-        });
-        expect(result).toEqual(persisted);
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/v1/memberships/psn_1%23cmp_abc/sync-config");
-        expect(init.method).toBe("PUT");
-        const headers = init.headers;
-        expect(headers["Content-Type"]).toBe("application/json");
-        expect(headers.Authorization).toBe("Bearer test-jwt-token-123");
-        expect(JSON.parse(init.body)).toEqual({
-            syncMode: "custom",
-            customPaths: ["shared/docs"],
-        });
-    });
-    it("supports the shared mode without customPaths", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            membershipId: "psn_1#cmp_abc",
-            syncMode: "shared",
-            isDefault: false,
-            updatedAt: "2026-05-20T12:00:00.000Z",
-            updatedBy: "psn_1",
-        }));
-        const result = await client.setMembershipSyncConfig("psn_1#cmp_abc", {
-            syncMode: "shared",
-        });
-        expect(result.syncMode).toBe("shared");
-        expect(result.customPaths).toBeUndefined();
-        const [, init] = fetchSpy.mock.calls[0];
-        expect(JSON.parse(init.body)).toEqual({ syncMode: "shared" });
-    });
-    it("maps 401 to VaultAuthError", async () => {
-        fetchSpy.mockImplementation(() => Promise.resolve(jsonResponse(401, { error: "Token expired" })));
-        await expect(client.setMembershipSyncConfig("psn_1#cmp_abc", { syncMode: "all" })).rejects.toThrow(VaultAuthError);
-    });
-    it("maps 404 to VaultNotFoundError when the membership is gone", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(404, { error: "Membership not found" }));
-        await expect(client.setMembershipSyncConfig("psn_1#cmp_abc", { syncMode: "all" })).rejects.toThrow(VaultNotFoundError);
-    });
-    it("maps 409 to VaultConflictError", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(409, { error: "Concurrent write conflict" }));
-        await expect(client.setMembershipSyncConfig("psn_1#cmp_abc", { syncMode: "all" })).rejects.toThrow(VaultConflictError);
-    });
-    it("surfaces network errors after retry exhaustion", async () => {
-        fetchSpy.mockRejectedValue(new Error("ETIMEDOUT"));
-        await expect(client.setMembershipSyncConfig("psn_1#cmp_abc", { syncMode: "all" })).rejects.toThrow(/ETIMEDOUT/);
-        const syncConfigCalls = fetchSpy.mock.calls.filter(([url]) => String(url).includes("/v1/memberships/psn_1%23cmp_abc/sync-config"));
-        expect(syncConfigCalls).toHaveLength(4);
-    });
-});
-// ---------------------------------------------------------------------------
-// Refreshable authToken getter
-//
-// Regression for the personal-sync 401: a captured `authToken` string can
-// outlive Cognito's 60-min access token TTL during long multi-company
-// fanouts, causing mid-flight `refreshEntityContext` calls to 401. The
-// getter form lets every request resolve the latest token from disk.
-// ---------------------------------------------------------------------------
-describe("authToken getter (refreshable token)", () => {
-    // Response bodies can only be read once, so each mock call needs a fresh
-    // Response. Using mockImplementation (not mockResolvedValue) ensures a new
-    // Response instance per request — same pattern as the retry tests above.
-    function alwaysOk(body) {
-        fetchSpy.mockImplementation(() => Promise.resolve(jsonResponse(200, body)));
-    }
-    it("calls the getter on every request", async () => {
-        const getter = vi.fn(async () => "first-token");
-        const c = new VaultClient({
-            apiUrl: "https://vault.test.example.com",
-            authToken: getter,
-        });
-        alwaysOk({ members: [] });
-        await c.listMembersOfCompany("cmp_abc");
-        await c.listMembersOfCompany("cmp_abc");
-        await c.listMembersOfCompany("cmp_abc");
-        expect(getter).toHaveBeenCalledTimes(3);
-    });
-    it("picks up a rotated token without recreating the client", async () => {
-        let current = "stale-token";
-        const c = new VaultClient({
-            apiUrl: "https://vault.test.example.com",
-            authToken: async () => current,
-        });
-        alwaysOk({ members: [] });
-        await c.listMembersOfCompany("cmp_abc");
-        const [, firstInit] = fetchSpy.mock.calls[0];
-        expect(firstInit.headers.Authorization).toBe("Bearer stale-token");
-        // Simulate the menubar refreshing ~/.hq/cognito-tokens.json mid-flight.
-        current = "fresh-token";
-        await c.listMembersOfCompany("cmp_abc");
-        const [, secondInit] = fetchSpy.mock.calls[1];
-        expect(secondInit.headers.Authorization).toBe("Bearer fresh-token");
-    });
-    it("supports a sync getter (returns plain string, not a promise)", async () => {
-        const c = new VaultClient({
-            apiUrl: "https://vault.test.example.com",
-            authToken: () => "sync-token",
-        });
-        alwaysOk({ members: [] });
-        await c.listMembersOfCompany("cmp_abc");
-        const [, init] = fetchSpy.mock.calls[0];
-        expect(init.headers.Authorization).toBe("Bearer sync-token");
-    });
-    it("static-string authToken still works (back-compat)", async () => {
-        const c = new VaultClient({
-            apiUrl: "https://vault.test.example.com",
-            authToken: "static-token",
-        });
-        alwaysOk({ members: [] });
-        await c.listMembersOfCompany("cmp_abc");
-        await c.listMembersOfCompany("cmp_abc");
-        const calls = fetchSpy.mock.calls;
-        for (const [, init] of calls) {
-            expect(init.headers.Authorization).toBe("Bearer static-token");
-        }
-    });
-});
-// ---------------------------------------------------------------------------
-// Raw vend (POST /vend, purpose-aware after US-009)
-// ---------------------------------------------------------------------------
-describe("vend (POST /vend, purpose-aware)", () => {
-    it("POSTs to /vend with paths/operations/purpose and returns credentials + policySize", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            credentials: {
-                accessKeyId: "AKIA-BROWSE",
-                secretAccessKey: "secret",
-                sessionToken: "token",
-                expiration: "2026-05-20T13:00:00.000Z",
-            },
-            paths: ["shared/docs/"],
-            operations: "read-only",
-            purpose: "browse",
-            policySize: 412,
-            requestId: "req_xyz",
-        }));
-        const out = await client.vend({
-            paths: ["shared/docs/"],
-            operations: "read-only",
-            purpose: "browse",
-        });
-        expect(out.purpose).toBe("browse");
-        expect(out.policySize).toBe(412);
-        expect(out.credentials.accessKeyId).toBe("AKIA-BROWSE");
-        expect(out.credentials.sessionToken).toBe("token");
-        const [url, init] = fetchSpy.mock.calls[0];
-        expect(url).toBe("https://vault.test.example.com/vend");
-        expect(init.method.toUpperCase()).toBe("POST");
-        expect(JSON.parse(init.body)).toEqual({
-            paths: ["shared/docs/"],
-            operations: "read-only",
-            purpose: "browse",
-        });
-    });
-    it("forwards purpose='sync' verbatim (no client-side defaulting)", async () => {
-        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
-            credentials: {
-                accessKeyId: "k",
-                secretAccessKey: "s",
-                sessionToken: "t",
-                expiration: "2026-05-20T13:00:00.000Z",
-            },
-            paths: ["shared/"],
-            operations: "read-only",
-            purpose: "sync",
-            policySize: 200,
-        }));
-        await client.vend({
-            paths: ["shared/"],
-            operations: "read-only",
-            purpose: "sync",
-            duration: 1800,
-        });
-        const [, init] = fetchSpy.mock.calls[0];
-        expect(JSON.parse(init.body)).toEqual({
-            paths: ["shared/"],
-            operations: "read-only",
-            purpose: "sync",
-            duration: 1800,
-        });
-    });
-});
-//# sourceMappingURL=vault-client.test.js.map