@anteros/core 0.0.44 → 0.0.47

package/tests/api-external-guards.test.ts

@@ -0,0 +1,304 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { createApp } from "../server/hono";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { useRest } from "../database/rest";
+
+/**
+ * External-API guards (issues #32 and #33) — and their **external-only** scope:
+ * the in-process `rest` keeps the full surface (replacement documents, computed
+ * aggregation fields), while a client of `/api/...` cannot use them to bypass
+ * validation or to read a `privateFields` value under another name.
+ */
+
+const TENANT = "api-guards";
+const DB = "mongodb://localhost:27017/_API_GUARDS_TEST";
+
+let rest: InstanceType<typeof useRest>;
+let internal: InstanceType<typeof useRest>;
+let server: any;
+let url = "";
+let personId = "";
+
+async function call(collection: string, action: string, body?: any) {
+    const res = await fetch(`${url}/api/${TENANT}/collections/${collection}/${action}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    return { status: res.status, body: (await res.json()) as any };
+}
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000 },
+        tenants: [{ id: TENANT, dir: "src", database: { uri: DB } }],
+    });
+    await syncTenants();
+
+    (cfg as any).collections = [
+        {
+            _tenant_: TENANT,
+            slug: "people",
+            fields: [
+                { name: "name", type: "string", required: true },
+                { name: "password", type: "string" },
+                { name: "secret_token", type: "string" },
+                { name: "nickname", type: "string" },
+                { name: "role", type: "string" },
+            ],
+            api: { access: { "*": true }, privateFields: ["password", /^secret_/], readOnlyFields: ["role"] },
+        },
+        {
+            _tenant_: TENANT,
+            slug: "notes",
+            fields: [
+                { name: "title", type: "string" },
+                { name: "owner", type: "relationship", relation: { to: "people" } },
+                { name: "secretRef", type: "relationship", relation: { to: "secrets" } },
+            ],
+            api: { access: { "*": true } },
+        },
+        {
+            _tenant_: TENANT,
+            slug: "secrets",
+            fields: [{ name: "code", type: "string" }],
+            api: { access: { find: false } },
+        },
+    ];
+
+    rest = new useRest({ internal: false, tenant_id: TENANT });
+    internal = new useRest({ internal: true, tenant_id: TENANT });
+
+    const app = createApp();
+    server = Bun.serve({ port: 0, fetch: app.fetch });
+    url = server.url.href.replace(/\/$/, "");
+
+    for (const name of ["people", "notes", "secrets", "_locks_", "_audit_"]) {
+        try { await rest.db.collection(name).drop(); } catch {}
+    }
+    const person: any = await rest.insertOne("people", {
+        name: "Ada",
+        password: "hash-ada",
+        secret_token: "tok-ada",
+    });
+    personId = person._id;
+    const secret: any = await rest.insertOne("secrets", { code: "s3cret" });
+    await rest.insertOne("notes", { title: "n1", owner: personId, secretRef: secret._id });
+});
+
+afterAll(async () => {
+    for (const name of ["people", "notes", "_locks_", "_audit_"]) {
+        try { await rest.db.collection(name).drop(); } catch {}
+    }
+    try { server.stop(true); } catch {}
+});
+
+describe("external mutations — operator documents only (#32)", () => {
+    it("refuses an empty update, a replacement document and an array", async () => {
+        const cases = [{ update: {} }, { update: { name: "Replaced" } }, { update: [] }];
+        for (const body of cases) {
+            const res = await call("people", "updateOne", { id: personId, ...body });
+            expect({ body, status: res.status, code: res.body.code })
+                .toEqual({ body, status: 400, code: "INVALID_UPDATE" });
+        }
+    });
+
+    it("still accepts an operator update", async () => {
+        const res = await call("people", "updateOne", { id: personId, update: { $set: { name: "Ada 2" } } });
+        expect(res.status).toBe(200);
+        expect((await rest.findOne("people", personId))?.name).toBe("Ada 2");
+    });
+
+    it("applies the same rule to updateMany", async () => {
+        const bad = await call("people", "updateMany", { ids: [personId], update: { name: "x" } });
+        expect(bad.status).toBe(400);
+        expect(bad.body.code).toBe("INVALID_UPDATE");
+    });
+
+    it("refuses `$rename` and unsetting a required field", async () => {
+        const rename = await call("people", "updateOne", { id: personId, update: { $rename: { nickname: "password" } } });
+        expect(rename.status).toBe(400);
+        expect(rename.body.code).toBe("INVALID_UPDATE");
+
+        const unset = await call("people", "updateOne", { id: personId, update: { $unset: { name: "" } } });
+        expect(unset.status).toBe(400);
+        expect(unset.body.code).toBe("INVALID_UPDATE");
+    });
+
+    it("leaves the in-process `rest` unchanged (internal callers keep `$rename` etc.)", async () => {
+        const doc: any = await rest.insertOne("people", { name: "Bob", password: "hash-bob", nickname: "bobby" });
+        await internal.updateOne("people", doc._id, { $rename: { nickname: "name" } } as any);
+        expect((await rest.findOne("people", doc._id))?.name).toBe("bobby");
+    });
+});
+
+describe("external reads — private fields cannot be aliased (#33)", () => {
+    it("refuses a reference to a private field in an expression", async () => {
+        const pipelines = [
+            [{ $addFields: { leak: "$password" } }],
+            [{ $project: { leak: { $concat: ["$password"] } } }],
+            [{ $group: { _id: "$password" } }],
+            [{ $replaceRoot: { newRoot: { leak: "$password" } } }],
+            [{ $addFields: { leak: "$$ROOT.password" } }],
+        ];
+        for (const pipeline of pipelines) {
+            const res = await call("people", "aggregate", { pipeline });
+            expect({ pipeline, status: res.status, code: res.body.code })
+                .toEqual({ pipeline, status: 400, code: "PRIVATE_FIELD_REFERENCE" });
+        }
+    });
+
+    it("refuses operators that move a field without a `$path`", async () => {
+        const res = await call("people", "aggregate", { pipeline: [{ $addFields: { leak: { $getField: "password" } } }] });
+        expect(res.status).toBe(400);
+        expect(res.body.code).toBe("PRIVATE_FIELD_REFERENCE");
+    });
+
+    it("refuses a joined private field under an alias", async () => {
+        const res = await call("notes", "aggregate", {
+            pipeline: [
+                { $lookup: { from: "people", as: "p" } },
+                { $addFields: { leak: "$p.secret_token" } },
+            ],
+        });
+        expect(res.status).toBe(400);
+        expect(res.body.code).toBe("PRIVATE_FIELD_REFERENCE");
+    });
+
+    it("still allows an aggregate that does not touch a private field", async () => {
+        const res = await call("people", "aggregate", {
+            pipeline: [{ $group: { _id: "$name", n: { $sum: 1 } } }],
+        });
+        expect(res.status).toBe(200);
+        expect(Array.isArray(res.body)).toBe(true);
+    });
+
+    it("still masks a directly-projected private field", async () => {
+        const res = await call("people", "find", { params: { $project: { name: 1, password: 1, secret_token: 1 } } });
+        expect(res.status).toBe(200);
+        for (const doc of res.body) {
+            expect(doc.password).toBeUndefined();
+            expect(doc.secret_token).toBeUndefined();
+        }
+    });
+
+    it("leaves the in-process `rest` unchanged (internal aggregates may compute)", async () => {
+        const docs: any[] = await internal.aggregate("people", [
+            { $match: { name: { $in: ["Ada 2", "Ada", "Bobby"] } } },
+            { $addFields: { leak: "$password" } },
+        ]);
+        expect(docs.length).toBeGreaterThan(0);
+        expect(docs[0].leak).toBeString();
+    });
+});
+
+describe("external reads — joins honour the target access rule (#36)", () => {
+    it("refuses a lookup on a collection the caller cannot read", async () => {
+        const res = await call("notes", "aggregate", {
+            pipeline: [{ $lookup: { from: "secrets", as: "s" } }],
+        });
+        expect(res.status).toBe(401);
+        expect(res.body.code).toBe("ACCESS_DENIED");
+    });
+
+    it("refuses a lookup on an internal collection", async () => {
+        const res = await call("notes", "aggregate", {
+            pipeline: [{ $lookup: { from: "_audit_", as: "a" } }],
+        });
+        expect(res.status).toBe(403);
+        expect(res.body.code).toBe("LOOKUP_TARGET_FORBIDDEN");
+    });
+
+    it("refuses an $include on a related collection the caller cannot read", async () => {
+        const res = await call("notes", "find", { params: { $include: ["secretRef"] } });
+        expect(res.status).toBe(401);
+        expect(res.body.code).toBe("ACCESS_DENIED");
+    });
+
+    it("still allows a join on a readable collection", async () => {
+        const res = await call("notes", "aggregate", {
+            pipeline: [{ $lookup: { from: "people", localField: "owner", foreignField: "_id", as: "p" } }],
+        });
+        expect(res.status).toBe(200);
+    });
+
+    it("leaves the in-process `rest` unchanged (internal lookups still work)", async () => {
+        const docs: any[] = await internal.aggregate("notes", [
+            { $lookup: { from: "secrets", localField: "secretRef", foreignField: "_id", as: "s" } },
+        ]);
+        expect(docs.length).toBeGreaterThan(0);
+        expect(Array.isArray(docs[0].s)).toBe(true);
+    });
+});
+
+describe("external API — body shape and generic errors (#21, #24, #47)", () => {
+    it("returns a generic not-found message (no tenant/collection echo)", async () => {
+        const res = await call("does-not-exist", "find", { params: {} });
+        expect(res.status).toBe(400);
+        expect(res.body.code).toBe("COLLECTION_NOT_FOUND");
+        expect(res.body.message).toBe("Resource not found");
+        expect(res.body.message).not.toContain("does-not-exist");
+    });
+
+    it("refuses malformed insert/update/delete bodies", async () => {
+        const cases: Array<[string, any, string]> = [
+            ["insertOne", {}, "INVALID_BODY"],
+            ["insertOne", { data: "not-an-object" }, "INVALID_BODY"],
+            ["insertMany", { data: { name: "x" } }, "INVALID_BODY"],
+            ["findOne", { id: { $ne: null } }, "INVALID_ID"],
+            ["updateOne", { id: { $ne: null }, update: { $set: { name: "x" } } }, "INVALID_ID"],
+            ["deleteOne", { id: { $ne: null } }, "INVALID_ID"],
+            ["updateMany", { ids: "not-an-array", update: { $set: { name: "x" } } }, "INVALID_BODY"],
+            ["deleteMany", { ids: [{}] }, "INVALID_BODY"],
+        ];
+
+        for (const [action, body, code] of cases) {
+            const res = await call("people", action, body);
+            expect({ action, status: res.status, code: res.body.code })
+                .toEqual({ action, status: 400, code });
+        }
+    });
+
+    it("still accepts a well-formed insert", async () => {
+        const res = await call("people", "insertOne", { data: { name: "Cara" } });
+        expect(res.status).toBe(200);
+    });
+});
+
+describe("in-process `rest` — `$rename` cannot target a read-only field (#43)", () => {
+    it("refuses a rename to a read-only field, allows a normal one", async () => {
+        const doc: any = await rest.insertOne("people", { name: "Ren", nickname: "ren" });
+
+        await expect(internal.updateOne("people", doc._id, { $rename: { nickname: "role" } } as any))
+            .rejects.toMatchObject({ code: "READONLY_FIELD" });
+
+        await internal.updateOne("people", doc._id, { $rename: { nickname: "name" } } as any);
+        expect((await rest.findOne("people", doc._id))?.name).toBe("ren");
+    });
+});
+
+describe("collection definitions — a definition that disappears mid-call", () => {
+    it("fails with COLLECTION_NOT_FOUND instead of a TypeError on `col.hooks`", async () => {
+        const saved = (cfg as any).collections;
+        let reads = 0;
+        Object.defineProperty(cfg, "collections", {
+            configurable: true,
+            get() {
+                reads += 1;
+                return reads === 1 ? saved : [];
+            },
+        });
+
+        try {
+            const code = await internal.find("people").then(
+                () => "resolved",
+                (error: any) => error?.code,
+            );
+            // One read for the guard, one for the method's own (checked) resolution.
+            expect({ reads, code }).toEqual({ reads: 2, code: "COLLECTION_NOT_FOUND" });
+        } finally {
+            Object.defineProperty(cfg, "collections", { configurable: true, writable: true, value: saved });
+        }
+    });
+});

package/tests/attachment.test.ts

@@ -1,5 +1,8 @@
 import { describe, it, expect } from "bun:test";
 import { deflateRawSync } from "node:zlib";
+import { mkdtemp, rm, symlink } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
 import { openZip } from "../lib/zip";
 import { docxText, resolveAttachments, xlsxText, MAX_FILE_BYTES } from "../lib/attachment";
 import { openaiMessages, anthropicMessages } from "../lib/providers";
@@ -239,3 +242,63 @@ describe("attachments through a provider", () => {
         });
     });
 });
+
+describe("resolveAttachments — path containment (issue #29)", () => {
+    const base = "packages/core/tests/fixtures/attachment";
+
+    it("still reads a path inside the base directory", async () => {
+        const parts = await resolveAttachments(["data.csv"], { baseDir: base });
+        expect(parts).toHaveLength(1);
+        expect((parts[0] as any).text).toContain("ref,total");
+    });
+
+    it("refuses a `..` path that escapes the base directory", async () => {
+        const error: any = await resolveAttachments(["../../../package.json"], { baseDir: base }).catch((err) => err);
+        expect(error.code).toBe("AGENT_FILE_INVALID");
+        expect(error.message).toContain("escapes the base directory");
+    });
+
+    it("refuses an absolute path outside the base directory", async () => {
+        const error: any = await resolveAttachments(["/etc/hosts"], { baseDir: base }).catch((err) => err);
+        expect(error.code).toBe("AGENT_FILE_INVALID");
+    });
+
+    it("refuses a symlink that points outside the base directory", async () => {
+        const dir = await mkdtemp(join(tmpdir(), "anteros-attach-"));
+        try {
+            await symlink("/etc/hosts", join(dir, "link.txt"));
+            const error: any = await resolveAttachments(["link.txt"], { baseDir: dir }).catch((err) => err);
+            expect(error.code).toBe("AGENT_FILE_INVALID");
+        } finally {
+            await rm(dir, { recursive: true, force: true });
+        }
+    });
+
+    it("refuses a directory", async () => {
+        const dir = await mkdtemp(join(tmpdir(), "anteros-attach-"));
+        try {
+            const error: any = await resolveAttachments(["."], { baseDir: dir }).catch((err) => err);
+            expect(error.code).toBe("AGENT_FILE_NOT_FOUND");
+        } finally {
+            await rm(dir, { recursive: true, force: true });
+        }
+    });
+});
+
+describe("zip — decompression bounds (#41)", () => {
+    it("refuses an entry whose declared inflated size exceeds the limit", () => {
+        const big = "a".repeat(10 * 1024 * 1024 + 1);
+        const bytes = makeZip({ "word/document.xml": big });
+        // The archive itself stays small (deflate), the entry expands past the cap.
+        expect(bytes.byteLength).toBeLessThan(10 * 1024 * 1024);
+
+        let error: any;
+        try {
+            openZip(bytes).read("word/document.xml");
+        } catch (err) {
+            error = err;
+        }
+        expect(error?.code).toBe("AGENT_FILE_INVALID");
+        expect(error?.message).toContain("expands beyond");
+    });
+});

package/tests/audit-redact.test.ts

@@ -5,7 +5,7 @@ import { formatConfig, cfg } from "../server/config";
 import { syncTenants } from "../database/tenant";
 import { useRest } from "../database/rest";
 import { AUDIT_COLLECTION } from "../database/audit";
-import { REDACTED, redactPayload } from "../lib/redact";
+import { REDACTED, redactPayload, redactText } from "../lib/redact";
 
 const TENANT = "redact-test";
 const DB = "mongodb://localhost:27017/_AUDIT_REDACT_TEST";
@@ -257,3 +257,28 @@ describe("audit redaction — configuration", () => {
         expect(logged.operation.input.data.password).toBe(REDACTED);
     });
 });
+
+describe("audit — error and token redaction (#40)", () => {
+    it("masks secrets embedded in a free-text error message", async () => {
+        await rest.audit.log({
+            action: "custom-redact",
+            collection: SLUG,
+            error: { message: "login failed password=supersecret token: abc123", code: "LOGIN_FAILED" },
+        });
+
+        const logged: any = await rest.db.collection(AUDIT_COLLECTION).findOne(
+            { "operation.action": "custom-redact" },
+            { sort: { ts: -1 } },
+        );
+        expect(logged).not.toBeNull();
+        expect(logged.operation.error.message).not.toContain("supersecret");
+        expect(logged.operation.error.message).not.toContain("abc123");
+        expect(logged.operation.error.message).toContain(REDACTED);
+    });
+
+    it("redacts the whole `token` object (its key is sensitive)", () => {
+        expect(redactPayload({ token: { decoded: { secret: "x", sub: "u1" } } }))
+            .toEqual({ token: REDACTED });
+        expect(redactText("ok")).toBe("ok");
+    });
+});

package/tests/field-encryption.test.ts

@@ -5,6 +5,7 @@ import { formatConfig, cfg } from "../server/config";
 import { syncTenants } from "../database/tenant";
 import { syncCollections } from "../database/collection";
 import { resolve } from "../utils/crypto";
+import { decryptFields } from "../database/field.crypto";
 
 const TENANT = "enc-test";
 const DB = "mongodb://localhost:27017/_DB_ENC_TEST";
@@ -74,7 +75,7 @@ describe("field-level encryption", () => {
 
         // explicit MANUAL decryption (utils.crypt.resolve())
         const cipher = resolve();
-        const dec = await cipher.decrypt<string>(one.ssn, true);
+        const dec = await cipher.decrypt<string>(one.ssn, true, "enc-test:patients:ssn");
         expect(dec).toBe("123-45-6789");
     });
 
@@ -147,7 +148,7 @@ describe("field-level encryption — encryptionOptions.path (json sub-paths)", (
 
         // manual decryption
         const cipher = resolve();
-        const zip = await cipher.decrypt<string>(list[0].address.zip, true);
+        const zip = await cipher.decrypt<string>(list[0].address.zip, true, "enc-test:patients:address");
         expect(zip).toBe("75000");
     });
 
@@ -181,7 +182,7 @@ describe("field-level encryption — encryptionOptions.path (json sub-paths)", (
         expect(up2.address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
         const cipher = resolve();
-        expect(await cipher.decrypt<string>(raw!.address.zip, true)).toBe("06100");
+        expect(await cipher.decrypt<string>(raw!.address.zip, true, "enc-test:patients:address")).toBe("06100");
     });
 
     it("rejects $inc on an encrypted sub-path", async () => {
@@ -191,3 +192,46 @@ describe("field-level encryption — encryptionOptions.path (json sub-paths)", (
         ).rejects.toThrow(/ENCRYPTED_FIELD_OPERATOR|not supported/);
     });
 });
+
+describe("field-level encryption — AAD and path hardening (#44)", () => {
+    it("binds ciphertext to tenant:collection:field", async () => {
+        const doc: any = await rest.insertOne("patients", { name: "AAD", ssn: "555-55-5555" });
+        const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
+        const cipher = resolve();
+
+        expect(await cipher.decrypt<string>(raw!.ssn, true, "enc-test:patients:ssn")).toBe("555-55-5555");
+        await expect(cipher.decrypt(raw!.ssn, true, "other-tenant:patients:ssn")).rejects.toThrow(/Decryption failed/);
+        await expect(cipher.decrypt(raw!.ssn, true, "enc-test:other:ssn")).rejects.toThrow(/Decryption failed/);
+    });
+
+    it("still decrypts legacy ciphertext without AAD", async () => {
+        const cipher = resolve();
+        const legacy = await cipher.encrypt(JSON.stringify("legacy-value")); // no AAD (pre-#44)
+        const out = await decryptFields({ _tenant_: TENANT, slug: "patients", fields: [{ name: "ssn", encryption: true }] } as any, { ssn: legacy });
+        expect(out.ssn).toBe("legacy-value");
+    });
+
+    it("decryptFields decrypts whole fields and configured sub-paths", async () => {
+        const doc: any = await rest.insertOne("patients", {
+            name: "Dec",
+            ssn: "777-77-7777",
+            profile: { city: "Paris" },
+            address: { zip: "75001", city: "Paris" },
+        });
+        const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
+        const col = (cfg as any).collections[0];
+        const out = await decryptFields(col, raw);
+
+        expect(out.ssn).toBe("777-77-7777");
+        expect(out.profile).toEqual({ city: "Paris" });
+        expect(out.address.zip).toBe("75001");
+        expect(out.address.city).toBe("Paris");
+    });
+
+    it("refuses a sub-path write inside an `encryption: true` field", async () => {
+        const doc: any = await rest.insertOne("patients", { name: "Sub", ssn: "000-00-0000" });
+        await expect(
+            rest.updateOne("patients", doc._id, { $set: { "ssn.x": "plain" } as any }),
+        ).rejects.toThrow(/ENCRYPTED_FIELD_OPERATOR|sub-path/);
+    });
+});

package/tests/filters-hardening.test.ts

@@ -0,0 +1,81 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { useRest } from "../database/rest";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { syncCollections } from "../database/collection";
+
+/**
+ * #45 — filters/pipelines that reach MongoDB through the internal methods are
+ * sanitized like `find`: no `$where`/`$expr`/`$function`, bounded `$regex`/`$in`.
+ */
+
+const TENANT = "filters-hardening";
+const DB = "mongodb://localhost:27017/_FILTERS_HARDENING_TEST";
+
+let rest: InstanceType<typeof useRest>;
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000 },
+        tenants: [{ id: TENANT, dir: "src", database: { uri: DB } }],
+    });
+    await syncTenants();
+    await syncCollections();
+    (cfg as any).collections = [{
+        _tenant_: TENANT,
+        slug: "items",
+        fields: [
+            { name: "title", type: "string" },
+            { name: "count", type: "number" },
+        ],
+        api: { access: { "*": true } },
+    }];
+    rest = new useRest({ internal: false, tenant_id: TENANT });
+    try { await rest.db.collection("items").drop(); } catch {}
+});
+
+afterAll(async () => {
+    try { await rest.db.collection("items").drop(); } catch {}
+    try { await rest.db.collection("_locks_").drop(); } catch {}
+});
+
+describe("internal methods — safe filters (#45)", () => {
+    it("refuses `$where` in findOneAndUpdate / bulkWrite / countDocuments", async () => {
+        const calls: Array<[string, () => Promise<any>]> = [
+            ["findOneAndUpdate", () => rest.findOneAndUpdate("items", { $where: "true" } as any, { $set: { count: 1 } })],
+            ["bulkWrite", () => rest.bulkWrite("items", [{ updateOne: { filter: { $where: "true" }, update: { $set: { count: 1 } } } } as any])],
+            ["countDocuments", () => rest.countDocuments("items", { $where: "true" } as any)],
+        ];
+        for (const [name, call] of calls) {
+            const error: any = await call().catch((err) => err);
+            expect({ name, code: error?.code }).toEqual({ name, code: "UNAUTHORIZED_MATCH_KEYS" });
+        }
+    });
+
+    it("still accepts a normal filter", async () => {
+        const doc: any = await rest.insertOne("items", { title: "ok", count: 1 });
+        const updated: any = await rest.findOneAndUpdate("items", { _id: { $eq: doc._id } } as any, { $set: { count: 2 } });
+        expect(updated?.count).toBe(2);
+    });
+});
+
+describe("aggregate — bounded operators (#45)", () => {
+    it("refuses an over-long `$regex`", async () => {
+        const error: any = await rest.aggregate("items", [
+            { $match: { title: { $regex: "a".repeat(1001) } } },
+        ]).catch((err) => err);
+        expect(error?.code).toBe("REGEX_TOO_LONG");
+    });
+
+    it("refuses an oversized `$in`", async () => {
+        const error: any = await rest.aggregate("items", [
+            { $match: { title: { $in: Array.from({ length: 10001 }, (_, index) => `v${index}`) } } },
+        ]).catch((err) => err);
+        expect(error?.code).toBe("ARRAY_OPERATOR_TOO_LARGE");
+    });
+
+    it("still accepts a bounded pipeline", async () => {
+        const docs = await rest.aggregate("items", [{ $match: { title: { $in: ["ok"] } } }]);
+        expect(Array.isArray(docs)).toBe(true);
+    });
+});

package/tests/fixtures/ai-tenant/ai/agents/support/billing.agent.ts

@@ -0,0 +1,9 @@
+import { define } from "../../../../../../index";
+
+/** Its own sub-directory — the sibling tool is resolved there. */
+export default define.Agent({
+    id: "billing",
+    description: "Handles refunds.",
+    instructions: "You handle billing.",
+    provider: { model: "test-model", apiKey: "fixture-key", baseUrl: "http://127.0.0.1:1", options: { retries: 0 } },
+});

package/tests/fixtures/ai-tenant/ai/agents/support/billing.tool.ts

@@ -0,0 +1,9 @@
+import { define, v } from "../../../../../../index";
+
+/** Loaded for `billing.agent.ts`, in the same sub-directory. */
+export default define.Tool({
+    id: "refund",
+    description: "Refunds an order",
+    inputSchema: v.object({ order: v.string().required() }),
+    execute: async ({ order }: any) => ({ order, status: "refunded" }),
+});

package/tests/fixtures/ai-tenant/ai/agents/support.agent.ts

@@ -0,0 +1,9 @@
+import { define } from "../../../../../index";
+
+/** Agent of the `ai/` fixture — its tools come from the sibling `.tool.ts`. */
+export default define.Agent({
+    id: "support",
+    description: "Answers support questions, with a co-located tool.",
+    instructions: "You are a support agent.",
+    provider: { model: "test-model", apiKey: "fixture-key", baseUrl: "http://127.0.0.1:1", options: { retries: 0 } },
+});

package/tests/fixtures/ai-tenant/ai/agents/support.tool.ts

@@ -0,0 +1,9 @@
+import { define, v } from "../../../../../index";
+
+/** Loaded automatically for `support.agent.ts` (same directory, same basename). */
+export default define.Tool({
+    id: "greet",
+    description: "Greets the caller",
+    inputSchema: v.object({ name: v.string().required() }),
+    execute: async ({ name }: any) => ({ hello: name }),
+});

package/tests/fixtures/ai-tenant/ai/mcp/resources/readme.resource.ts

@@ -0,0 +1,9 @@
+import { define } from "../../../../../../index";
+
+/** MCP resource exposed by URI. */
+export default define.McpResource({
+    name: "readme",
+    description: "The tenant readme",
+    uri: "readme://tenant",
+    read: async () => ({ contents: [{ uri: "readme://tenant", text: "hello" }] }),
+});

package/tests/fixtures/ai-tenant/ai/mcp/tools/echo.tool.ts

@@ -0,0 +1,9 @@
+import { define, v } from "../../../../../../index";
+
+/** MCP tool served by the tenant's MCP endpoint. */
+export default define.McpTool({
+    name: "echo",
+    description: "Echoes the given text",
+    inputSchema: v.object({ text: v.string().required() }),
+    exec: async ({ args }) => ({ content: [{ type: "text", text: String(args.text) }] }),
+});