@bevel-software/platform-core-backend 0.15.1 → 0.20.0

package/dist/shared/kb-walk.d.ts

@@ -1,52 +0,0 @@
-/**
- * THE walk of a knowledge-base checkout.
- *
- * Every reader of the tree — the access resolver looking for rules, plugin
- * discovery looking for manifests, a rename looking for grants, the catalog
- * scanners — used to carry a recursive `readdir` loop of its own, each with
- * its own skip list, its own idea of what an unreadable folder means and its
- * own visiting order. Two loops that disagree on one of those are two
- * answers to "what is in the tree", and every such disagreement was a bug.
- *
- * So there is one loop, and it decides three things once:
- *
- *   - WHAT IS SKIPPED: {@link isSkippedEntry} — dot-entries (`.git`, a parked
- *     delete) and vendored dependencies. Nothing else is pruned; a listener
- *     that stops at a leaf of its own (a skill folder, a plugin folder)
- *     simply ignores what lies beneath it.
- *   - IN WHAT ORDER: each folder's entries in {@link comparePathComponents}
- *     order, so "first by path" means the same thing to every listener.
- *   - WHAT A HOLE IS: a folder that exists but could not be listed is
- *     reported as an event and in the result — never thrown, never silently
- *     skipped — so a reader can show what it saw and a writer can refuse.
- *     A folder that vanished between listing and visiting is not a hole.
- *
- * Listeners see the same events in the same order; what each makes of them
- * is its own business (`.bevelignore` included — the explorer honours it,
- * the resolver must not, so it is a listener's decision, not the walk's).
- */
-export declare function isSkippedEntry(name: string): boolean;
-/** A directory entry as the walk presents it: a name and what it is. */
-export interface WalkedEntry {
-    name: string;
-    isDirectory(): boolean;
-    isFile(): boolean;
-}
-export interface KbWalkListener {
-    /** A folder was listed. `rel` is repo-relative (`''` for the root); `entries` are its children, skipped ones removed, in walk order. */
-    onDir?(rel: string, entries: readonly WalkedEntry[]): void | Promise<void>;
-    /** A file was seen. `dir` is its folder (`''` for the root), `name` its basename. */
-    onFile?(dir: string, name: string): void | Promise<void>;
-    /** A folder that exists but could not be listed. */
-    onHole?(rel: string, err: unknown): void | Promise<void>;
-}
-export interface KbWalkResult {
-    /** Every folder that could not be listed, repo-relative (`''` for the root). */
-    holes: string[];
-}
-/**
- * Walk the checkout at `root`, driving every listener from one traversal.
- * A missing root is an empty tree. Listener errors propagate untouched.
- */
-export declare function walkKb(root: string, listeners: readonly KbWalkListener[]): Promise<KbWalkResult>;
-//# sourceMappingURL=kb-walk.d.ts.map

package/dist/shared/kb-walk.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kb-walk.d.ts","sourceRoot":"","sources":["../../src/shared/kb-walk.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wEAAwE;AACxE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,IAAI,OAAO,CAAC;IACvB,MAAM,IAAI,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,wIAAwI;IACxI,KAAK,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,qFAAqF;IACrF,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,oDAAoD;IACpD,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAiCtG"}

package/dist/shared/kb-walk.js

@@ -1,76 +0,0 @@
-import path from 'node:path';
-import fs from 'node:fs/promises';
-import { isAbsence } from './fs-errors.js';
-import { comparePathComponents } from './path-order.js';
-/**
- * THE walk of a knowledge-base checkout.
- *
- * Every reader of the tree — the access resolver looking for rules, plugin
- * discovery looking for manifests, a rename looking for grants, the catalog
- * scanners — used to carry a recursive `readdir` loop of its own, each with
- * its own skip list, its own idea of what an unreadable folder means and its
- * own visiting order. Two loops that disagree on one of those are two
- * answers to "what is in the tree", and every such disagreement was a bug.
- *
- * So there is one loop, and it decides three things once:
- *
- *   - WHAT IS SKIPPED: {@link isSkippedEntry} — dot-entries (`.git`, a parked
- *     delete) and vendored dependencies. Nothing else is pruned; a listener
- *     that stops at a leaf of its own (a skill folder, a plugin folder)
- *     simply ignores what lies beneath it.
- *   - IN WHAT ORDER: each folder's entries in {@link comparePathComponents}
- *     order, so "first by path" means the same thing to every listener.
- *   - WHAT A HOLE IS: a folder that exists but could not be listed is
- *     reported as an event and in the result — never thrown, never silently
- *     skipped — so a reader can show what it saw and a writer can refuse.
- *     A folder that vanished between listing and visiting is not a hole.
- *
- * Listeners see the same events in the same order; what each makes of them
- * is its own business (`.bevelignore` included — the explorer honours it,
- * the resolver must not, so it is a listener's decision, not the walk's).
- */
-export function isSkippedEntry(name) {
-    return name.startsWith('.') || name === 'node_modules';
-}
-/**
- * Walk the checkout at `root`, driving every listener from one traversal.
- * A missing root is an empty tree. Listener errors propagate untouched.
- */
-export async function walkKb(root, listeners) {
-    const holes = [];
-    const visit = async (abs, rel) => {
-        let listed;
-        try {
-            listed = await fs.readdir(abs, { withFileTypes: true });
-        }
-        catch (err) {
-            if (isAbsence(err)) {
-                // The root: a checkout without this tree, an empty walk. Deeper: a
-                // folder that vanished between listing and visiting — not a hole.
-                return;
-            }
-            holes.push(rel);
-            for (const l of listeners)
-                await l.onHole?.(rel, err);
-            return;
-        }
-        const entries = listed
-            .filter((e) => !isSkippedEntry(e.name) && (e.isDirectory() || e.isFile()))
-            .sort((a, b) => comparePathComponents(a.name, b.name));
-        for (const l of listeners)
-            await l.onDir?.(rel, entries);
-        for (const entry of entries) {
-            const childRel = rel ? `${rel}/${entry.name}` : entry.name;
-            if (entry.isDirectory()) {
-                await visit(path.join(abs, entry.name), childRel);
-            }
-            else {
-                for (const l of listeners)
-                    await l.onFile?.(rel, entry.name);
-            }
-        }
-    };
-    await visit(root, '');
-    return { holes };
-}
-//# sourceMappingURL=kb-walk.js.map

package/dist/shared/kb-walk.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kb-walk.js","sourceRoot":"","sources":["../../src/shared/kb-walk.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,cAAc,CAAC;AACzD,CAAC;AAuBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,SAAoC;IAC7E,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,KAAK,GAAG,KAAK,EAAE,GAAW,EAAE,GAAW,EAAiB,EAAE;QAC9D,IAAI,MAAkC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,mEAAmE;gBACnE,kEAAkE;gBAClE,OAAO;YACT,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,CAAC,IAAI,SAAS;gBAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAkB,MAAM;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;aACzE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAC3D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,SAAS;oBAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/src/modules/diff/diff-paths.ts

@@ -1,9 +0,0 @@
-import path from 'node:path';
-
-export function assertWithinDirectory(absolutePath: string, dir: string): void {
-  const resolved = path.resolve(absolutePath);
-  const root = path.resolve(dir);
-  if (!resolved.startsWith(root + path.sep) && resolved !== root) {
-    throw new Error('Path traversal detected');
-  }
-}

package/src/modules/mcp/__tests__/mcp-session-store.test.ts

@@ -1,151 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { McpSessionStore } from '../mcp-session-store.js';
-
-/**
- * Builds a store with a controllable clock so the idle-TTL and eviction
- * paths don't depend on real time. Tests bump `clock.ts` directly between
- * operations.
- */
-function makeStore(opts: { idleTtlMs?: number; maxSessions?: number } = {}) {
-  const clock = { ts: 1_000_000 };
-  const store = new McpSessionStore({
-    idleTtlMs: opts.idleTtlMs ?? 60_000,
-    maxSessions: opts.maxSessions ?? 100,
-    now: () => clock.ts,
-  });
-  return { store, clock };
-}
-
-describe('McpSessionStore', () => {
-  it('create + get round-trips the session', () => {
-    const { store } = makeStore();
-    store.create('sess-1', 'user-A');
-
-    const session = store.get('sess-1');
-    expect(session?.userId).toBe('user-A');
-  });
-
-  it('get bumps lastTouchedAt so an active session never ages out under steady use', () => {
-    const { store, clock } = makeStore({ idleTtlMs: 1000 });
-    store.create('sess-1', 'user-A');
-
-    // Advance just below TTL and touch; advance again just below TTL and
-    // touch. Total elapsed > TTL, but no single gap exceeds it.
-    clock.ts += 900;
-    expect(store.get('sess-1')).not.toBeNull();
-    clock.ts += 900;
-    expect(store.get('sess-1')).not.toBeNull();
-  });
-
-  it('get returns null and drops the session once idle longer than ttl', () => {
-    const { store, clock } = makeStore({ idleTtlMs: 1000 });
-    store.create('sess-1', 'user-A');
-
-    clock.ts += 1500;
-    expect(store.get('sess-1')).toBeNull();
-    // The sweep ran during the get, so the entry is actually gone.
-    expect(store.size()).toBe(0);
-  });
-
-  it('evicts the oldest-touched session when the size cap is hit', () => {
-    const { store, clock } = makeStore({ maxSessions: 2 });
-
-    store.create('old', 'user-A');
-    clock.ts += 10;
-    store.create('middle', 'user-B');
-    clock.ts += 10;
-    // Touch `middle` so `old` is the oldest-touched.
-    store.get('middle');
-
-    clock.ts += 10;
-    store.create('new', 'user-C');
-
-    expect(store.get('old')).toBeNull();
-    expect(store.get('middle')).not.toBeNull();
-    expect(store.get('new')).not.toBeNull();
-    expect(store.size()).toBe(2);
-  });
-
-  it('delete removes an entry immediately', () => {
-    const { store } = makeStore();
-    store.create('sess-1', 'user-A');
-    store.delete('sess-1');
-    expect(store.get('sess-1')).toBeNull();
-  });
-
-  describe('onEvict', () => {
-    it('fires the listener with the session id when the TTL sweep drops an entry', () => {
-      const { store, clock } = makeStore({ idleTtlMs: 1000 });
-      const evicted: string[] = [];
-      store.onEvict((id) => evicted.push(id));
-      store.create('sess-1', 'user-A');
-
-      clock.ts += 1500;
-      store.get('sess-1'); // triggers sweep
-
-      expect(evicted).toEqual(['sess-1']);
-    });
-
-    it('fires the listener with the session id when the size cap evicts the oldest', () => {
-      const { store, clock } = makeStore({ maxSessions: 2 });
-      const evicted: string[] = [];
-      store.onEvict((id) => evicted.push(id));
-
-      store.create('old', 'user-A');
-      clock.ts += 10;
-      store.create('middle', 'user-B');
-      clock.ts += 10;
-      store.get('middle'); // bumps middle, so `old` is oldest-touched
-
-      clock.ts += 10;
-      store.create('new', 'user-C');
-
-      expect(evicted).toEqual(['old']);
-    });
-
-    it('does NOT fire on explicit delete() — that path is the consumer asking for removal', () => {
-      const { store } = makeStore();
-      const evicted: string[] = [];
-      store.onEvict((id) => evicted.push(id));
-      store.create('sess-1', 'user-A');
-
-      store.delete('sess-1');
-
-      expect(evicted).toEqual([]);
-    });
-
-    it('keeps sweeping the remaining entries when a listener throws', () => {
-      const { store, clock } = makeStore({ idleTtlMs: 1000 });
-      const evicted: string[] = [];
-      store.onEvict((id) => {
-        if (id === 'sess-1') throw new Error('bad listener');
-        evicted.push(id);
-      });
-      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-
-      store.create('sess-1', 'user-A');
-      store.create('sess-2', 'user-B');
-      clock.ts += 1500;
-      store.create('trigger', 'user-C'); // sweep runs at create time too
-
-      // Both 'sess-1' (listener threw) and 'sess-2' must have been swept;
-      // we observe sess-2 in `evicted` and sess-1 via the warn spy.
-      expect(evicted).toContain('sess-2');
-      expect(warn).toHaveBeenCalled();
-      warn.mockRestore();
-    });
-
-    it('returns an unsubscribe function that stops further notifications', () => {
-      const { store, clock } = makeStore({ idleTtlMs: 1000 });
-      const evicted: string[] = [];
-      const off = store.onEvict((id) => evicted.push(id));
-
-      store.create('sess-1', 'user-A');
-      off();
-      clock.ts += 1500;
-      store.get('sess-1');
-
-      expect(evicted).toEqual([]);
-    });
-  });
-});

package/src/modules/mcp/__tests__/mcp.routes.session.test.ts

@@ -1,226 +0,0 @@
-import type { Request as ExpressRequest, Response as ExpressResponse } from 'express';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { closeMountedRoutes, mountMcpRoutes } from './mcp-routes-harness.js';
-
-/**
- * Session routing on the MCP transport routes — how `/api/mcp` answers a
- * request whose `Mcp-Session-Id` it cannot resolve.
- *
- * The distinction is load-bearing rather than cosmetic. Streamable HTTP makes
- * HTTP 404 on a request bearing a session id the signal a client re-initializes
- * on; 400 means "you sent something malformed", which has no recovery. These
- * routes used to answer both misses — no session id, and a session id from a
- * session that no longer exists — with one 400 on POST and one 404 on
- * GET/DELETE, so a client whose session died with the server (a restart wipes
- * the in-process map) was told its request was malformed and stayed stranded.
- *
- * Locked down here:
- *   - the two misses map to distinct, spec-correct codes on every verb;
- *   - both bodies are real JSON-RPC error objects, since this router answers
- *     before the SDK transport that would otherwise have shaped them;
- *   - an `initialize` carrying a STALE session id still opens a new session —
- *     the recovery path itself, which the old "no session id" guard blocked;
- *   - the live-session and cross-user branches are untouched.
- */
-
-/** The id the FIRST session minted in a test gets; `openSession` establishes it. */
-const SESSION_ID = 'sess-1';
-
-afterEach(async () => {
-  await closeMountedRoutes();
-  vi.restoreAllMocks();
-});
-
-/**
- * A createSession stub shaped like the real one: it hands back a transport
- * whose `handleRequest` reports the session id it served, and announces the
- * session through `onSessionInitialized` from INSIDE that first call — which
- * is when the SDK transport really fires it, and the only ordering the route's
- * `active.set` closure can observe without a TDZ error.
- *
- * Each call mints a DISTINCT id (`sess-1`, `sess-2`, …) rather than a constant.
- * With a constant, a route that wrongly minted a second session answered with
- * a body identical to the correct one, so "no second session" could only ever
- * be asserted through the call count. Numbering them puts the mistake in the
- * response itself: a reply naming `sess-2` IS the extra session.
- */
-function makeMcpService() {
-  let minted = 0;
-  const createSession = vi.fn(
-    async (
-      userId: string,
-      _tokenId: string | null,
-      _bearer: string,
-      onSessionInitialized: (sessionId: string) => void,
-    ) => {
-      minted += 1;
-      const sessionId = `sess-${minted}`;
-      let announced = false;
-      const transport = {
-        sessionId,
-        onclose: undefined as undefined | (() => void),
-        handleRequest: vi.fn(async (_req: ExpressRequest, res: ExpressResponse) => {
-          if (!announced) {
-            announced = true;
-            onSessionInitialized(sessionId);
-          }
-          res.status(200).json({ forwarded: true, sessionId, userId });
-        }),
-        close: vi.fn(async () => {}),
-      };
-      const server = { connect: vi.fn(async () => {}), close: vi.fn(async () => {}) };
-      return { transport, server };
-    },
-  );
-  return { onSessionEvicted: () => {}, createSession };
-}
-
-async function mount(): Promise<{ baseUrl: string; createSession: ReturnType<typeof vi.fn> }> {
-  const mcpService = makeMcpService();
-  const baseUrl = await mountMcpRoutes({ mcpService });
-  return { baseUrl, createSession: mcpService.createSession };
-}
-
-const INITIALIZE = {
-  jsonrpc: '2.0',
-  id: 0,
-  method: 'initialize',
-  params: { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'c', version: '0' } },
-};
-const TOOL_CALL = { jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} };
-
-async function send(
-  baseUrl: string,
-  opts: { method?: string; sessionId?: string; body?: unknown; user?: string } = {},
-): Promise<Response> {
-  const { method = 'POST', sessionId, body, user } = opts;
-  return fetch(`${baseUrl}/api/mcp`, {
-    method,
-    headers: {
-      'Content-Type': 'application/json',
-      Accept: 'application/json, text/event-stream',
-      ...(sessionId ? { 'mcp-session-id': sessionId } : {}),
-      ...(user ? { 'x-test-user': user } : {}),
-    },
-    ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
-  });
-}
-
-/** Open a real session so `active` holds SESSION_ID. */
-async function openSession(baseUrl: string): Promise<void> {
-  const res = await send(baseUrl, { body: INITIALIZE });
-  expect(res.status).toBe(200);
-}
-
-describe('POST /mcp session routing', () => {
-  it('answers an unknown session id with 404 / -32001, the re-initialize signal', async () => {
-    const { baseUrl } = await mount();
-    const res = await send(baseUrl, { sessionId: 'sess-from-before-the-restart', body: TOOL_CALL });
-    expect(res.status).toBe(404);
-    await expect(res.json()).resolves.toEqual({
-      jsonrpc: '2.0',
-      error: { code: -32001, message: 'Session not found' },
-      id: null,
-    });
-  });
-
-  it('answers a missing session id with 400 / -32000 — a different code from the miss above', async () => {
-    const { baseUrl } = await mount();
-    const res = await send(baseUrl, { body: TOOL_CALL });
-    expect(res.status).toBe(400);
-    await expect(res.json()).resolves.toEqual({
-      jsonrpc: '2.0',
-      error: { code: -32000, message: 'Bad Request: Mcp-Session-Id header is required' },
-      id: null,
-    });
-  });
-
-  it('opens a new session for an initialize that still carries a STALE session id', async () => {
-    const { baseUrl, createSession } = await mount();
-    // Exactly what a client does after a server restart: it re-initializes
-    // before it has any reason to drop the id it was given last time.
-    const res = await send(baseUrl, { sessionId: 'sess-from-before-the-restart', body: INITIALIZE });
-    expect(res.status).toBe(200);
-    await expect(res.json()).resolves.toMatchObject({ forwarded: true, sessionId: SESSION_ID });
-    expect(createSession).toHaveBeenCalledTimes(1);
-  });
-
-  it('opens a new session for an initialize with no session id', async () => {
-    const { baseUrl, createSession } = await mount();
-    const res = await send(baseUrl, { body: INITIALIZE });
-    expect(res.status).toBe(200);
-    expect(createSession).toHaveBeenCalledTimes(1);
-  });
-
-  it('forwards to the live transport once a session exists', async () => {
-    const { baseUrl, createSession } = await mount();
-    await openSession(baseUrl);
-    const res = await send(baseUrl, { sessionId: SESSION_ID, body: TOOL_CALL });
-    expect(res.status).toBe(200);
-    await expect(res.json()).resolves.toMatchObject({ forwarded: true, sessionId: SESSION_ID });
-    // No second session: the live branch was taken, not the initialize branch.
-    expect(createSession).toHaveBeenCalledTimes(1);
-  });
-
-  it('routes an initialize over a LIVE session to that session, minting no second one', async () => {
-    // The guard this pins is branch ORDER, and only this change made it
-    // load-bearing: `initialize` used to be gated on `!sessionIdHeader`, so
-    // the live-session branch and the initialize branch were mutually
-    // exclusive and their order did not matter. Without that gate, an
-    // initialize check placed first would match here too — and silently mint
-    // a second session over a working one, which is the failure the route
-    // comment and the PR both promise cannot happen.
-    //
-    // What is asserted is what this ROUTER owes: the request reached the
-    // existing transport and no new session was created. Rejecting a
-    // re-initialize is the SDK transport's own job (`-32600 Server already
-    // initialized`), and asserting that here would be asserting against the
-    // stub rather than against the code under test.
-    const { baseUrl, createSession } = await mount();
-    await openSession(baseUrl); // mints sess-1
-    const res = await send(baseUrl, { sessionId: SESSION_ID, body: INITIALIZE });
-    expect(res.status).toBe(200);
-    // sess-1, not sess-2: the live transport answered, not a fresh one.
-    await expect(res.json()).resolves.toMatchObject({ forwarded: true, sessionId: SESSION_ID });
-    expect(createSession).toHaveBeenCalledTimes(1);
-  });
-
-  it('still refuses another user’s live session with 403', async () => {
-    const { baseUrl } = await mount();
-    await openSession(baseUrl); // owned by user-A
-    const res = await send(baseUrl, { sessionId: SESSION_ID, body: TOOL_CALL, user: 'user-B' });
-    expect(res.status).toBe(403);
-    // JSON-RPC like every other answer this router gives before the SDK
-    // transport — a client parsing /api/mcp bodies as JSON-RPC must not hit a
-    // bare `{ error }` on this one branch.
-    await expect(res.json()).resolves.toEqual({
-      jsonrpc: '2.0',
-      error: { code: -32003, message: 'Session does not belong to this user' },
-      id: null,
-    });
-  });
-});
-
-describe.each(['GET', 'DELETE'])('%s /mcp session routing', (method) => {
-  it('answers an unknown session id with 404 / -32001', async () => {
-    const { baseUrl } = await mount();
-    const res = await send(baseUrl, { method, sessionId: 'sess-from-before-the-restart' });
-    expect(res.status).toBe(404);
-    await expect(res.json()).resolves.toEqual({
-      jsonrpc: '2.0',
-      error: { code: -32001, message: 'Session not found' },
-      id: null,
-    });
-  });
-
-  it('answers a missing session id with 400 / -32000', async () => {
-    const { baseUrl } = await mount();
-    const res = await send(baseUrl, { method });
-    expect(res.status).toBe(400);
-    await expect(res.json()).resolves.toEqual({
-      jsonrpc: '2.0',
-      error: { code: -32000, message: 'Bad Request: Mcp-Session-Id header is required' },
-      id: null,
-    });
-  });
-});