fix(stack): close review findings on the combined identity/reorg PR

- integration vitest config: guard against a CS_IT_SUITE glob that resolves to
  nothing. A renamed/moved integration directory (while the workflow glob still
  points at the old path) would otherwise drop those suites from CI with the
  board staying green — the silent-zero-coverage hole the deleted
  live-coverage-guard used to backstop. Each glob's literal directory prefix
  must exist; `passWithNoTests: false` covers the fully-empty run. (task #12)
- matrix-identity: split the identity-AGNOSTIC `.audit({ metadata })` test into
  its own describe with a plain (non-federated) client. It was sharing the
  federation beforeAll, so a Clerk outage / rotated CLERK_MACHINE_TOKEN would
  fail a test that exercises no identity behaviour. Verified: the audit test
  passes with no Clerk token while the federated tests require one.
- finish the unwrapResult de-dup: lock-context and relational suites now import
  it from @cipherstash/test-kit instead of each re-declaring a local `unwrap`.

Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

Author: coderdan

packages/stack/integration/drizzle-v3/relational.integration.test.ts

@@ -28,6 +28,7 @@ import {
   eqlTypeSlug as slug,
   sortedKeysFor as sortedKeysForKit,
   typedEntries,
+  unwrapResult,
   V3_MATRIX,
 } from '@cipherstash/test-kit'
 import {
@@ -190,11 +191,6 @@ async function selectRowKeys(condition: SQL | undefined): Promise<string[]> {
   return rows.map((row) => row.rowKey)
 }
 
-function unwrap<T>(result: { data?: T; failure?: { message: string } }): T {
-  if (result.failure) throw new Error(result.failure.message)
-  return result.data as T
-}
-
 function encryptedInsertRows(): MatrixPlainRow[] {
   return ROWS.map((rowKey) => {
     const row: MatrixPlainRow = {
@@ -260,7 +256,7 @@ beforeAll(async () => {
     )
   `)
 
-  const encryptedRows = unwrap(
+  const encryptedRows = unwrapResult(
     await client.bulkEncryptModels(encryptedInsertRows(), schema),
   )
   await db.insert(matrixTable).values(encryptedRows)
@@ -276,7 +272,7 @@ beforeAll(async () => {
   // ROW_B exists so the filter proofs below have a row they must EXCLUDE. On a
   // one-row table `gt(balance, 0n)` returning every row is indistinguishable
   // from it returning the right row.
-  const bigintRows = unwrap(
+  const bigintRows = unwrapResult(
     await client.bulkEncryptModels(
       [
         {
@@ -578,7 +574,7 @@ describe('v3 drizzle — relational, needle guards, pagination', () => {
       )
     expect(encrypted).toHaveLength(1)
 
-    const decrypted = unwrap(
+    const decrypted = unwrapResult(
       await client.decryptModel(encrypted[0], bigintSchema),
     )
     expect(decrypted.balance).toBe(BIGINT_BALANCE)

packages/stack/integration/identity/lock-context.integration.test.ts

@@ -33,7 +33,7 @@
  * control.
  */
 import { OidcFederationStrategy } from '@cipherstash/auth'
-import { databaseUrl, V3_MATRIX } from '@cipherstash/test-kit'
+import { databaseUrl, unwrapResult, V3_MATRIX } from '@cipherstash/test-kit'
 import { and, asc as drizzleAsc, eq as drizzleEq, type SQL } from 'drizzle-orm'
 import { integer, pgTable, text } from 'drizzle-orm/pg-core'
 import { drizzle } from 'drizzle-orm/postgres-js'
@@ -75,11 +75,6 @@ let client: Awaited<ReturnType<typeof EncryptionV3>>
 let ops: ReturnType<typeof createEncryptionOperatorsV3>
 let db: ReturnType<typeof drizzle>
 
-function unwrap<T>(result: { data?: T; failure?: { message: string } }): T {
-  if (result.failure) throw new Error(result.failure.message)
-  return result.data as T
-}
-
 /**
  * The outcome of a decrypt attempt that is EXPECTED to be denied. `decrypt`
  * reports denial as a `Result.failure` rather than throwing, so a bare `await`
@@ -177,7 +172,7 @@ beforeAll(async () => {
   `)
 
   // Seed BOTH rows bound to the same lock context.
-  const encryptedRows = unwrap<Array<Record<string, unknown>>>(
+  const encryptedRows = unwrapResult<Array<Record<string, unknown>>>(
     await client
       .bulkEncryptModels(
         [
@@ -214,7 +209,7 @@ describe('v3 drizzle operators with lock context (live pg)', () => {
     )
     expect(row).toBeDefined()
 
-    const decrypted = unwrap(
+    const decrypted = unwrapResult(
       await client.decrypt(row.value as never).withLockContext(IDENTITY_CLAIM),
     )
     expect(decrypted).toBe(SECRET_A)

packages/stack/integration/identity/matrix-identity.integration.test.ts

@@ -105,6 +105,20 @@ describe('v3 typed client identity-aware operations (live)', () => {
     expect(message).toMatch(KEY_DENIAL)
     expect(message).not.toMatch(INFRA_FAULT)
   }, 30000)
+})
+
+// The `.audit({ metadata })` path is identity-AGNOSTIC — it attaches audit
+// metadata to an encrypt, with no lock context and no `sub` binding. It needs
+// only CS credentials, so it gets its own suite with a plain (non-federated)
+// client. Coupling it to the Clerk federation `beforeAll` above would fail this
+// test on a Clerk outage or a rotated `CLERK_MACHINE_TOKEN` — for behaviour it
+// never exercises.
+describe('v3 typed client audit metadata (live)', () => {
+  let client: Awaited<ReturnType<typeof EncryptionV3<[typeof users]>>>
+
+  beforeAll(async () => {
+    client = await EncryptionV3({ schemas: [users] })
+  }, 30000)
 
   it('accepts .audit({ metadata }) on the encrypt path and still round-trips', async () => {
     const encrypted = unwrapResult(

packages/stack/integration/vitest.config.ts

@@ -1,3 +1,4 @@
+import { existsSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { defineConfig } from 'vitest/config'
 import { sharedAlias } from '../../../vitest.shared'
@@ -19,13 +20,46 @@ import { sharedAlias } from '../../../vitest.shared'
  * Scoping matters: the Drizzle suites talk straight to Postgres and the Supabase
  * suites need PostgREST, so a job running both would have to provision both.
  */
+const ROOT = resolve(__dirname, '..')
+
 const SUITE_GLOBS = (
   process.env['CS_IT_SUITE'] ?? 'integration/**/*.integration.test.ts'
 )
   .split(',')
   .map((glob) => glob.trim())
   .filter(Boolean)
 
+/**
+ * Guard against a glob that resolves to nothing — the silent-zero-coverage hole
+ * the deleted `live-coverage-guard.test.ts` used to backstop. A directory
+ * renamed/moved (or a typo) while the workflow's `CS_IT_SUITE` still points at
+ * the old path makes vitest collect the OTHER globs, pass, and drop those suites
+ * with no signal — `passWithNoTests` only catches the all-empty case, and the
+ * no-skips reporter only sees files that were collected.
+ *
+ * The literal directory prefix of each glob (everything before the first glob
+ * metacharacter) must exist. This catches the whole-directory rename directly;
+ * `passWithNoTests: false` (below) still covers a fully-empty run.
+ */
+for (const glob of SUITE_GLOBS) {
+  const literalPrefix = glob
+    .split('/')
+    .slice(
+      0,
+      glob.split('/').findIndex((seg) => /[*?{}[\]]/.test(seg)),
+    )
+    .join('/')
+  // No metacharacter at all → the glob is a literal file path; check it whole.
+  const target = /[*?{}[\]]/.test(glob) ? literalPrefix : glob
+  if (target && !existsSync(resolve(ROOT, target))) {
+    throw new Error(
+      `CS_IT_SUITE glob "${glob}" points at "${target}", which does not exist. ` +
+        'A renamed/moved integration directory would otherwise drop its suites ' +
+        'from CI silently. Fix the glob (or the directory) so the suites run.',
+    )
+  }
+}
+
 export default defineConfig({
   resolve: {
     alias: {
@@ -81,6 +115,10 @@ export default defineConfig({
      */
     silent: 'passed-only',
 
+    // A fully-empty run is a failure, not a pass: paired with the per-glob
+    // directory guard above, a mistyped/renamed suite path can never go green.
+    passWithNoTests: false,
+
     // Fail the run if anything is skipped. A skipped test reads exactly like a
     // passing one, and every silent hole this suite has found took that shape.
     reporters: ['default', resolve(__dirname, 'no-skips-reporter.ts')],