test: migrate AVA→Vitest with event-based waits (stacked on #131)

[zeevmoney]

• What kind of change does this PR introduce?

  Test infrastructure modernization. PR#2 of a 3-PR stack — stacked on ci: pin actions to SHA and run full test suite on PRs #131 (base branch per-15306/ci-pin-actions-tests-on-pr, not main). No shipped SDK source changes. Linear: PER-15315.

• What is the current behavior?

  • Tests run on AVA 3, compiled via tsup to build/** then run from the built JS.
  • e2e tests wait for cloud→PDP propagation with hardcoded sleep(10s) / setTimeout, which is slow and flaky once they run in CI.
  • Two specs (bulk_test.spec.ts, e2e/lists.e2e.spec.ts) are orphaned — run by no script.

• What is the new behavior?

  • AVA → Vitest 4.1. One vitest.config.ts with four projects: unit (parallel), module-imports, integration (serial), e2e (serial). Backend projects run single-fork / maxWorkers:1 and as separate vitest invocations so they never collide on the shared env. test:ci:unit / test:ci:full script names are unchanged, so PR#1's ci.yaml needs no edit.
  • No timer-based waits. A new waitFor / waitForCheck helper polls the actual permit.check() until it converges (bounded timeout) — replacing every sleep. The rebac gate now waits until all step assertions converge (positives true and negatives false); lists waits until the bulk-created users are listable before asserting counts.
  • Quality pass on every spec. fixtures.ts is now a createTestClient() factory; handleApiError throws (fail-fast); try/catch(t.fail)/finally → try/finally; all t.* → expect. Every e2e spec now fully and tolerantly cleans up what it creates in afterAll, so the serial suite is order-independent.
  • Orphaned specs wired in. bulk_test.spec.ts → e2e/bulk.e2e.spec.ts (self-contained schema + full cleanup; preserves the only bulkRelationshipTuples coverage). lists.e2e.spec.ts is prefix-scoped + cleaned up (no more absolute-count coupling).
  • Module-import specs load the built bundle (build/index.{js,mjs}) to keep packaging/entry-point regression coverage; those scripts retain a build prerequisite.
  • Deps: drop ava, @ava/typescript, nyc, @istanbuljs/nyc-config-typescript, codecov, ts-node, open-cli; add vitest@^4.1, @vitest/coverage-v8@^4.1; @types/node@^20; skipLibCheck for Vitest's d.ts.

• Other information:

  How it was tested

  • yarn test:ci:unit (the no-backend gate: unit + module-imports) — 60 tests pass. yarn build + tsc clean, yarn lint clean.
  • Integration + e2e specs compile and are discovered by Vitest; they require a live Permit env + PDP and are exercised by the test:ci:full path in CI (this PR's CI run validates them end-to-end). They could not be run on a live backend locally.
  • New deterministic unit/wait-for-sync.spec.ts pins the waitForSync header contract (X-Wait-Timeout / X-Timeout-Policy, PDP basePath, no-op without proxyFactsViaPdp) with no network.

  Notable decisions

  • local_facts "Check skip wait" asserted a result before propagation — inherently racy. It's now it.skip with an explanatory comment, and its contract is covered deterministically by the new unit test.
  • The 100% nyc coverage gate (never enforced in CI) is dropped; @vitest/coverage-v8 is available via yarn coverage, scoped to the unit-covered modules.

  Known limitation

  • e2e behavior against a live PDP is validated by CI on this PR, not locally. If the first CI run reveals timing/propagation tuning needs (poll budgets, lists search-match semantics), expect a small follow-up commit.

  Deferred to PR#3 (coverage expansion)

  • Strengthening the "does-not-throw"-only bulk assertions and the access-level early-returns; broader unit coverage of the waitForSync edge branches.

Generated with Claude Code

[linear-code]

PER-15315