@imgly/codesign-mcp 0.1.6 → 0.1.7

package/dist/test/test/http/server.test.js

@@ -1,338 +0,0 @@
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import request from 'supertest';
-import { createCodesignHttpServer } from '../../src/http/server.js';
-import { WorkspaceAuthError } from '../../src/http/workspace-auth.js';
-import { ScopedWorkspaceFS } from '../../src/workspace/scoped.js';
-import { InMemoryWorkspaceFS } from '../../src/workspace/in-memory.js';
-const FIXTURES = {
-    'docs/alpha/SKILL.md': '---\nname: alpha\ndescription: First.\n---\n# Alpha'
-};
-let nextEngineId = 0;
-function makeServer() {
-    return createCodesignHttpServer({
-        assets: FIXTURES,
-        maxSessions: 5,
-        idleTimeoutMs: 60_000,
-        // Replace the real CE.SDK headless bootstrap with a deterministic fake so
-        // the integration test runs in milliseconds, not seconds. The fake engine
-        // owns its own scriptsRun array, asserting per-session isolation.
-        createSession: async () => {
-            const engine = { id: nextEngineId++, scriptsRun: [] };
-            const tools = [
-                {
-                    name: 'echo',
-                    description: 'Echo arg back',
-                    inputSchema: {
-                        type: 'object',
-                        properties: { msg: { type: 'string' } },
-                        required: ['msg']
-                    },
-                    call: async (args) => {
-                        const msg = args.msg;
-                        return { content: [{ type: 'text', text: msg }] };
-                    }
-                },
-                {
-                    // Records the input on this session's engine and reads back the
-                    // list of all scripts seen so far. Used by the isolation test to
-                    // prove two sessions don't share engine state.
-                    name: 'engine_record',
-                    description: 'Record a string into the session engine, return all recorded so far',
-                    inputSchema: {
-                        type: 'object',
-                        properties: { msg: { type: 'string' } },
-                        required: ['msg']
-                    },
-                    call: async (args) => {
-                        const msg = args.msg;
-                        engine.scriptsRun.push(msg);
-                        return {
-                            content: [
-                                { type: 'text', text: engine.scriptsRun.join(',') }
-                            ]
-                        };
-                    }
-                }
-            ];
-            return { engine, tools };
-        }
-    });
-}
-describe('createCodesignHttpServer', () => {
-    let app;
-    let baseUrl;
-    let server;
-    beforeEach(async () => {
-        nextEngineId = 0;
-        app = await makeServer();
-        await new Promise((resolve) => {
-            server = app.listen(0, '127.0.0.1', resolve);
-        });
-        const addr = server.address();
-        baseUrl = `http://127.0.0.1:${addr.port}/mcp`;
-    });
-    afterEach(async () => {
-        await new Promise((resolve) => server.close(() => resolve()));
-        await app.shutdown();
-    });
-    async function connect() {
-        const transport = new StreamableHTTPClientTransport(new URL(baseUrl));
-        const client = new Client({ name: 'test', version: '0' });
-        await client.connect(transport);
-        return { client, sessionId: transport.sessionId };
-    }
-    it('initialize creates a new session and returns its id', async () => {
-        const { client, sessionId } = await connect();
-        expect(sessionId).toMatch(/[0-9a-f-]{36}/i); // uuid shape
-        expect(app.sessions.size).toBe(1);
-        await client.close();
-    });
-    it("listResources returns the asset bundle's skill files for that session", async () => {
-        const { client } = await connect();
-        const list = await client.listResources();
-        expect(list.resources.map((r) => r.uri)).toEqual([
-            'codesign://docs/alpha/SKILL.md'
-        ]);
-        await client.close();
-    });
-    it("callTool routes to the session's own engine", async () => {
-        const { client } = await connect();
-        const result = await client.callTool({
-            name: 'echo',
-            arguments: { msg: 'hi' }
-        });
-        expect(result.content).toEqual([{ type: 'text', text: 'hi' }]);
-        await client.close();
-    });
-    it('two parallel clients get distinct sessions and engines', async () => {
-        const a = await connect();
-        const b = await connect();
-        expect(a.sessionId).toBeDefined();
-        expect(b.sessionId).toBeDefined();
-        expect(a.sessionId).not.toBe(b.sessionId);
-        expect(app.sessions.size).toBe(2);
-        await a.client.close();
-        await b.client.close();
-    });
-    it('session cap: returns 503 when maxSessions is reached', async () => {
-        await app.shutdown(); // dismiss the default 5-session app
-        app = await createCodesignHttpServer({
-            assets: FIXTURES,
-            maxSessions: 2,
-            idleTimeoutMs: 60_000,
-            createSession: async () => ({
-                engine: { id: nextEngineId++, scriptsRun: [] },
-                tools: []
-            })
-        });
-        await new Promise((resolve) => server.close(() => resolve()));
-        await new Promise((resolve) => {
-            server = app.listen(0, '127.0.0.1', resolve);
-        });
-        const addr = server.address();
-        baseUrl = `http://127.0.0.1:${addr.port}/mcp`;
-        const a = await connect();
-        const b = await connect();
-        // 3rd init request should be rejected at the HTTP layer with 503.
-        const initBody = {
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'initialize',
-            params: {
-                protocolVersion: '2025-03-26',
-                capabilities: {},
-                clientInfo: { name: 't', version: '0' }
-            }
-        };
-        const r = await fetch(baseUrl, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                accept: 'application/json, text/event-stream'
-            },
-            body: JSON.stringify(initBody)
-        });
-        expect(r.status).toBe(503);
-        expect(r.headers.get('retry-after')).toBe('30');
-        const json = (await r.json());
-        expect(json.error.code).toBe(-32000);
-        expect(json.error.message).toMatch(/session cap/i);
-        await a.client.close();
-        await b.client.close();
-    });
-    it('unknown session id: returns 404 with -32001', async () => {
-        const r = await fetch(baseUrl, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                accept: 'application/json, text/event-stream',
-                'mcp-session-id': '00000000-0000-0000-0000-000000000000'
-            },
-            body: JSON.stringify({
-                jsonrpc: '2.0',
-                id: 1,
-                method: 'tools/list',
-                params: {}
-            })
-        });
-        expect(r.status).toBe(404);
-        const json = (await r.json());
-        expect(json.error.code).toBe(-32001);
-        expect(json.error.message).toMatch(/unknown session/);
-    });
-    it('graceful DELETE /mcp terminates the session and frees its slot', async () => {
-        const { sessionId } = await connect();
-        expect(sessionId).toBeDefined();
-        expect(app.sessions.size).toBe(1);
-        const r = await fetch(baseUrl, {
-            method: 'DELETE',
-            headers: { 'mcp-session-id': sessionId }
-        });
-        expect(r.status).toBe(200);
-        // onsessionclosed → sessionMgr.delete: the slot (and its engine) is
-        // reclaimed immediately, not left squatting until idle eviction.
-        expect(app.sessions.size).toBe(0);
-        // The id is now unknown — a follow-up request 404s.
-        const followUp = await fetch(baseUrl, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                accept: 'application/json, text/event-stream',
-                'mcp-session-id': sessionId
-            },
-            body: JSON.stringify({
-                jsonrpc: '2.0',
-                id: 1,
-                method: 'tools/list',
-                params: {}
-            })
-        });
-        expect(followUp.status).toBe(404);
-    });
-    it('auth middleware rejects requests with 401 when configured to', async () => {
-        await app.shutdown();
-        await new Promise((resolve) => server.close(() => resolve()));
-        app = await createCodesignHttpServer({
-            assets: FIXTURES,
-            maxSessions: 5,
-            idleTimeoutMs: 60_000,
-            createSession: async () => ({
-                engine: { id: nextEngineId++, scriptsRun: [] },
-                tools: []
-            }),
-            auth: (req, res, next) => {
-                if (req.header('authorization') !== 'Bearer testtoken') {
-                    res.status(401).json({ error: 'unauthorized' });
-                    return;
-                }
-                next();
-            }
-        });
-        await new Promise((resolve) => {
-            server = app.listen(0, '127.0.0.1', resolve);
-        });
-        const addr = server.address();
-        baseUrl = `http://127.0.0.1:${addr.port}/mcp`;
-        const r = await fetch(baseUrl, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                accept: 'application/json, text/event-stream'
-            },
-            body: JSON.stringify({
-                jsonrpc: '2.0',
-                id: 1,
-                method: 'initialize',
-                params: {}
-            })
-        });
-        expect(r.status).toBe(401);
-    });
-    it('engine state is isolated per session: mutation in one is invisible to the other', async () => {
-        const a = await connect();
-        const b = await connect();
-        // Record on a — only a should see it.
-        const aResult = await a.client.callTool({
-            name: 'engine_record',
-            arguments: { msg: 'from-a' }
-        });
-        expect(aResult.content).toEqual([{ type: 'text', text: 'from-a' }]);
-        // Record on b — should NOT include from-a.
-        const bResult = await b.client.callTool({
-            name: 'engine_record',
-            arguments: { msg: 'from-b' }
-        });
-        expect(bResult.content).toEqual([{ type: 'text', text: 'from-b' }]);
-        // Re-record on a — should append to a's history, still no b.
-        const aResult2 = await a.client.callTool({
-            name: 'engine_record',
-            arguments: { msg: 'again' }
-        });
-        expect(aResult2.content).toEqual([{ type: 'text', text: 'from-a,again' }]);
-        await a.client.close();
-        await b.client.close();
-    });
-    it('passes the resolved workspaceId to createSession on initialize', async () => {
-        const seen = [];
-        const testApp = await createCodesignHttpServer({
-            assets: {},
-            maxSessions: 4,
-            idleTimeoutMs: 60_000,
-            resolveWorkspaceId: (req) => req.header('x-workspace-id') ?? 'fallback',
-            createSession: async ({ workspaceId }) => {
-                seen.push(workspaceId);
-                return { engine: {}, tools: [] };
-            }
-        });
-        await request(testApp)
-            .post('/mcp')
-            .set('x-workspace-id', 'u/acme')
-            .set('content-type', 'application/json')
-            .send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });
-        expect(seen).toEqual(['u/acme']);
-        await testApp.shutdown();
-    });
-    it('returns 401 when resolveWorkspaceId throws WorkspaceAuthError', async () => {
-        const testApp = await createCodesignHttpServer({
-            assets: {},
-            maxSessions: 4,
-            idleTimeoutMs: 60_000,
-            resolveWorkspaceId: () => {
-                throw new WorkspaceAuthError('missing header');
-            },
-            createSession: async () => ({ engine: {}, tools: [] })
-        });
-        const res = await request(testApp)
-            .post('/mcp')
-            .set('content-type', 'application/json')
-            .send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });
-        expect(res.status).toBe(401);
-        expect(res.body.error.code).toBe(-32002);
-        expect(res.body.error.message).toBe('missing header');
-        await testApp.shutdown();
-    });
-    it('returns 400 (not a hang) when the resolved workspaceId is malformed', async () => {
-        const testApp = await createCodesignHttpServer({
-            assets: {},
-            maxSessions: 4,
-            idleTimeoutMs: 60_000,
-            // header mode-style: return an illegal id that ScopedWorkspaceFS will reject
-            resolveWorkspaceId: () => '../escape',
-            createSession: async ({ workspaceId }) => {
-                // mirror cli/http.ts: constructing the scoped fs validates the id
-                new ScopedWorkspaceFS(new InMemoryWorkspaceFS(), workspaceId);
-                return { engine: {}, tools: [] };
-            }
-        });
-        const res = await request(testApp)
-            .post('/mcp')
-            .set('content-type', 'application/json')
-            .send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });
-        expect(res.status).toBe(400);
-        expect(res.body.error.code).toBe(-32602); // invalid params
-        await testApp.shutdown();
-    });
-});
-//# sourceMappingURL=server.test.js.map

package/dist/test/test/http/server.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"server.test.js","sourceRoot":"","sources":["../../../../test/http/server.test.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE,MAAM,QAAQ,GAAG;IACf,qBAAqB,EAAE,qDAAqD;CAC7E,CAAC;AAOF,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,SAAS,UAAU;IACjB,OAAO,wBAAwB,CAAC;QAC9B,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,CAAC;QACd,aAAa,EAAE,MAAM;QACrB,0EAA0E;QAC1E,0EAA0E;QAC1E,kEAAkE;QAClE,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,MAAM,MAAM,GAAe,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG;gBACZ;oBACE,IAAI,EAAE,MAAM;oBACZ,WAAW,EAAE,eAAe;oBAC5B,WAAW,EAAE;wBACX,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBACvC,QAAQ,EAAE,CAAC,KAAK,CAAC;qBAClB;oBACD,IAAI,EAAE,KAAK,EAAE,IAAa,EAAE,EAAE;wBAC5B,MAAM,GAAG,GAAI,IAAwB,CAAC,GAAG,CAAC;wBAC1C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;oBAC7D,CAAC;iBACF;gBACD;oBACE,gEAAgE;oBAChE,iEAAiE;oBACjE,+CAA+C;oBAC/C,IAAI,EAAE,eAAe;oBACrB,WAAW,EACT,qEAAqE;oBACvE,WAAW,EAAE;wBACX,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBACvC,QAAQ,EAAE,CAAC,KAAK,CAAC;qBAClB;oBACD,IAAI,EAAE,KAAK,EAAE,IAAa,EAAE,EAAE;wBAC5B,MAAM,GAAG,GAAI,IAAwB,CAAC,GAAG,CAAC;wBAC1C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAC5B,OAAO;4BACL,OAAO,EAAE;gCACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;6BAC7D;yBACF,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,GAAyD,CAAC;IAC9D,IAAI,OAAe,CAAC;IACpB,IAAI,MAAqC,CAAC;IAE1C,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,YAAY,GAAG,CAAC,CAAC;QACjB,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QAC7C,OAAO,GAAG,oBAAoB,IAAI,CAAC,IAAI,MAAM,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,OAAO;QAIpB,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IAED,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QAC9C,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa;QAC1D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/C,gCAAgC;SACjC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,oCAAoC;QAC1D,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACnC,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC1B,MAAM,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;gBAC9C,KAAK,EAAE,EAAE;aACV,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QAC7C,OAAO,GAAG,oBAAoB,IAAI,CAAC,IAAI,MAAM,CAAC;QAE9C,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,kEAAkE;QAClE,MAAM,QAAQ,GAAG;YACf,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE;gBACN,eAAe,EAAE,YAAY;gBAC7B,YAAY,EAAE,EAAE;gBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;aACxC;SACF,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;SAC/B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAE3B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAEnD,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;gBAC7C,gBAAgB,EAAE,sCAAsC;aACzD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAE3B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAElC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YAC7B,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,gBAAgB,EAAE,SAAmB,EAAE;SACnD,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAElC,oDAAoD;QACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;gBAC7C,gBAAgB,EAAE,SAAmB;aACtC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACnC,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC1B,MAAM,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;gBAC9C,KAAK,EAAE,EAAE;aACV,CAAC;YACF,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,kBAAkB,EAAE,CAAC;oBACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAChD,OAAO;gBACT,CAAC;gBACD,IAAI,EAAE,CAAC;YACT,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QAC7C,OAAO,GAAG,oBAAoB,IAAI,CAAC,IAAI,MAAM,CAAC;QAE9C,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAE1B,sCAAsC;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;YACtC,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEpE,2CAA2C;QAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;YACtC,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEpE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvC,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QAE3E,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC;YAC7C,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,UAAU;YACvE,aAAa,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;gBACvC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACvB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACnC,CAAC;SACF,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,OAAO,CAAC;aACnB,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC;aAC/B,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;aACvC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC;YAC7C,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,kBAAkB,EAAE,GAAG,EAAE;gBACvB,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YACjD,CAAC;YACD,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;aAC/B,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;aACvC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC;YAC7C,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,6EAA6E;YAC7E,kBAAkB,EAAE,GAAG,EAAE,CAAC,WAAW;YACrC,aAAa,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;gBACvC,kEAAkE;gBAClE,IAAI,iBAAiB,CAAC,IAAI,mBAAmB,EAAE,EAAE,WAAW,CAAC,CAAC;gBAC9D,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACnC,CAAC;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;aAC/B,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;aACvC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;QAC3D,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import type { AddressInfo } from 'node:net';\nimport { Client } from '@modelcontextprotocol/sdk/client/index.js';\nimport { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';\nimport { afterEach, beforeEach, describe, expect, it } from 'vitest';\nimport request from 'supertest';\nimport { createCodesignHttpServer } from '../../src/http/server.js';\nimport { WorkspaceAuthError } from '../../src/http/workspace-auth.js';\nimport { ScopedWorkspaceFS } from '../../src/workspace/scoped.js';\nimport { InMemoryWorkspaceFS } from '../../src/workspace/in-memory.js';\n\nconst FIXTURES = {\n  'docs/alpha/SKILL.md': '---\\nname: alpha\\ndescription: First.\\n---\\n# Alpha'\n};\n\ninterface FakeEngine {\n  id: number;\n  scriptsRun: string[];\n}\n\nlet nextEngineId = 0;\n\nfunction makeServer() {\n  return createCodesignHttpServer({\n    assets: FIXTURES,\n    maxSessions: 5,\n    idleTimeoutMs: 60_000,\n    // Replace the real CE.SDK headless bootstrap with a deterministic fake so\n    // the integration test runs in milliseconds, not seconds. The fake engine\n    // owns its own scriptsRun array, asserting per-session isolation.\n    createSession: async () => {\n      const engine: FakeEngine = { id: nextEngineId++, scriptsRun: [] };\n      const tools = [\n        {\n          name: 'echo',\n          description: 'Echo arg back',\n          inputSchema: {\n            type: 'object',\n            properties: { msg: { type: 'string' } },\n            required: ['msg']\n          },\n          call: async (args: unknown) => {\n            const msg = (args as { msg: string }).msg;\n            return { content: [{ type: 'text' as const, text: msg }] };\n          }\n        },\n        {\n          // Records the input on this session's engine and reads back the\n          // list of all scripts seen so far. Used by the isolation test to\n          // prove two sessions don't share engine state.\n          name: 'engine_record',\n          description:\n            'Record a string into the session engine, return all recorded so far',\n          inputSchema: {\n            type: 'object',\n            properties: { msg: { type: 'string' } },\n            required: ['msg']\n          },\n          call: async (args: unknown) => {\n            const msg = (args as { msg: string }).msg;\n            engine.scriptsRun.push(msg);\n            return {\n              content: [\n                { type: 'text' as const, text: engine.scriptsRun.join(',') }\n              ]\n            };\n          }\n        }\n      ];\n      return { engine, tools };\n    }\n  });\n}\n\ndescribe('createCodesignHttpServer', () => {\n  let app: Awaited<ReturnType<typeof createCodesignHttpServer>>;\n  let baseUrl: string;\n  let server: ReturnType<typeof app.listen>;\n\n  beforeEach(async () => {\n    nextEngineId = 0;\n    app = await makeServer();\n    await new Promise<void>((resolve) => {\n      server = app.listen(0, '127.0.0.1', resolve);\n    });\n    const addr = server.address() as AddressInfo;\n    baseUrl = `http://127.0.0.1:${addr.port}/mcp`;\n  });\n\n  afterEach(async () => {\n    await new Promise<void>((resolve) => server.close(() => resolve()));\n    await app.shutdown();\n  });\n\n  async function connect(): Promise<{\n    client: Client;\n    sessionId: string | undefined;\n  }> {\n    const transport = new StreamableHTTPClientTransport(new URL(baseUrl));\n    const client = new Client({ name: 'test', version: '0' });\n    await client.connect(transport);\n    return { client, sessionId: transport.sessionId };\n  }\n\n  it('initialize creates a new session and returns its id', async () => {\n    const { client, sessionId } = await connect();\n    expect(sessionId).toMatch(/[0-9a-f-]{36}/i); // uuid shape\n    expect(app.sessions.size).toBe(1);\n    await client.close();\n  });\n\n  it(\"listResources returns the asset bundle's skill files for that session\", async () => {\n    const { client } = await connect();\n    const list = await client.listResources();\n    expect(list.resources.map((r) => r.uri)).toEqual([\n      'codesign://docs/alpha/SKILL.md'\n    ]);\n    await client.close();\n  });\n\n  it(\"callTool routes to the session's own engine\", async () => {\n    const { client } = await connect();\n    const result = await client.callTool({\n      name: 'echo',\n      arguments: { msg: 'hi' }\n    });\n    expect(result.content).toEqual([{ type: 'text', text: 'hi' }]);\n    await client.close();\n  });\n\n  it('two parallel clients get distinct sessions and engines', async () => {\n    const a = await connect();\n    const b = await connect();\n    expect(a.sessionId).toBeDefined();\n    expect(b.sessionId).toBeDefined();\n    expect(a.sessionId).not.toBe(b.sessionId);\n    expect(app.sessions.size).toBe(2);\n    await a.client.close();\n    await b.client.close();\n  });\n\n  it('session cap: returns 503 when maxSessions is reached', async () => {\n    await app.shutdown(); // dismiss the default 5-session app\n    app = await createCodesignHttpServer({\n      assets: FIXTURES,\n      maxSessions: 2,\n      idleTimeoutMs: 60_000,\n      createSession: async () => ({\n        engine: { id: nextEngineId++, scriptsRun: [] },\n        tools: []\n      })\n    });\n    await new Promise<void>((resolve) => server.close(() => resolve()));\n    await new Promise<void>((resolve) => {\n      server = app.listen(0, '127.0.0.1', resolve);\n    });\n    const addr = server.address() as AddressInfo;\n    baseUrl = `http://127.0.0.1:${addr.port}/mcp`;\n\n    const a = await connect();\n    const b = await connect();\n    // 3rd init request should be rejected at the HTTP layer with 503.\n    const initBody = {\n      jsonrpc: '2.0',\n      id: 1,\n      method: 'initialize',\n      params: {\n        protocolVersion: '2025-03-26',\n        capabilities: {},\n        clientInfo: { name: 't', version: '0' }\n      }\n    };\n    const r = await fetch(baseUrl, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        accept: 'application/json, text/event-stream'\n      },\n      body: JSON.stringify(initBody)\n    });\n    expect(r.status).toBe(503);\n    expect(r.headers.get('retry-after')).toBe('30');\n    const json = (await r.json()) as {\n      error: { code: number; message: string };\n    };\n    expect(json.error.code).toBe(-32000);\n    expect(json.error.message).toMatch(/session cap/i);\n\n    await a.client.close();\n    await b.client.close();\n  });\n\n  it('unknown session id: returns 404 with -32001', async () => {\n    const r = await fetch(baseUrl, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        accept: 'application/json, text/event-stream',\n        'mcp-session-id': '00000000-0000-0000-0000-000000000000'\n      },\n      body: JSON.stringify({\n        jsonrpc: '2.0',\n        id: 1,\n        method: 'tools/list',\n        params: {}\n      })\n    });\n    expect(r.status).toBe(404);\n    const json = (await r.json()) as {\n      error: { code: number; message: string };\n    };\n    expect(json.error.code).toBe(-32001);\n    expect(json.error.message).toMatch(/unknown session/);\n  });\n\n  it('graceful DELETE /mcp terminates the session and frees its slot', async () => {\n    const { sessionId } = await connect();\n    expect(sessionId).toBeDefined();\n    expect(app.sessions.size).toBe(1);\n\n    const r = await fetch(baseUrl, {\n      method: 'DELETE',\n      headers: { 'mcp-session-id': sessionId as string }\n    });\n    expect(r.status).toBe(200);\n    // onsessionclosed → sessionMgr.delete: the slot (and its engine) is\n    // reclaimed immediately, not left squatting until idle eviction.\n    expect(app.sessions.size).toBe(0);\n\n    // The id is now unknown — a follow-up request 404s.\n    const followUp = await fetch(baseUrl, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        accept: 'application/json, text/event-stream',\n        'mcp-session-id': sessionId as string\n      },\n      body: JSON.stringify({\n        jsonrpc: '2.0',\n        id: 1,\n        method: 'tools/list',\n        params: {}\n      })\n    });\n    expect(followUp.status).toBe(404);\n  });\n\n  it('auth middleware rejects requests with 401 when configured to', async () => {\n    await app.shutdown();\n    await new Promise<void>((resolve) => server.close(() => resolve()));\n    app = await createCodesignHttpServer({\n      assets: FIXTURES,\n      maxSessions: 5,\n      idleTimeoutMs: 60_000,\n      createSession: async () => ({\n        engine: { id: nextEngineId++, scriptsRun: [] },\n        tools: []\n      }),\n      auth: (req, res, next) => {\n        if (req.header('authorization') !== 'Bearer testtoken') {\n          res.status(401).json({ error: 'unauthorized' });\n          return;\n        }\n        next();\n      }\n    });\n    await new Promise<void>((resolve) => {\n      server = app.listen(0, '127.0.0.1', resolve);\n    });\n    const addr = server.address() as AddressInfo;\n    baseUrl = `http://127.0.0.1:${addr.port}/mcp`;\n\n    const r = await fetch(baseUrl, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        accept: 'application/json, text/event-stream'\n      },\n      body: JSON.stringify({\n        jsonrpc: '2.0',\n        id: 1,\n        method: 'initialize',\n        params: {}\n      })\n    });\n    expect(r.status).toBe(401);\n  });\n\n  it('engine state is isolated per session: mutation in one is invisible to the other', async () => {\n    const a = await connect();\n    const b = await connect();\n\n    // Record on a — only a should see it.\n    const aResult = await a.client.callTool({\n      name: 'engine_record',\n      arguments: { msg: 'from-a' }\n    });\n    expect(aResult.content).toEqual([{ type: 'text', text: 'from-a' }]);\n\n    // Record on b — should NOT include from-a.\n    const bResult = await b.client.callTool({\n      name: 'engine_record',\n      arguments: { msg: 'from-b' }\n    });\n    expect(bResult.content).toEqual([{ type: 'text', text: 'from-b' }]);\n\n    // Re-record on a — should append to a's history, still no b.\n    const aResult2 = await a.client.callTool({\n      name: 'engine_record',\n      arguments: { msg: 'again' }\n    });\n    expect(aResult2.content).toEqual([{ type: 'text', text: 'from-a,again' }]);\n\n    await a.client.close();\n    await b.client.close();\n  });\n\n  it('passes the resolved workspaceId to createSession on initialize', async () => {\n    const seen: string[] = [];\n    const testApp = await createCodesignHttpServer({\n      assets: {},\n      maxSessions: 4,\n      idleTimeoutMs: 60_000,\n      resolveWorkspaceId: (req) => req.header('x-workspace-id') ?? 'fallback',\n      createSession: async ({ workspaceId }) => {\n        seen.push(workspaceId);\n        return { engine: {}, tools: [] };\n      }\n    });\n    await request(testApp)\n      .post('/mcp')\n      .set('x-workspace-id', 'u/acme')\n      .set('content-type', 'application/json')\n      .send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });\n    expect(seen).toEqual(['u/acme']);\n    await testApp.shutdown();\n  });\n\n  it('returns 401 when resolveWorkspaceId throws WorkspaceAuthError', async () => {\n    const testApp = await createCodesignHttpServer({\n      assets: {},\n      maxSessions: 4,\n      idleTimeoutMs: 60_000,\n      resolveWorkspaceId: () => {\n        throw new WorkspaceAuthError('missing header');\n      },\n      createSession: async () => ({ engine: {}, tools: [] })\n    });\n    const res = await request(testApp)\n      .post('/mcp')\n      .set('content-type', 'application/json')\n      .send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });\n    expect(res.status).toBe(401);\n    expect(res.body.error.code).toBe(-32002);\n    expect(res.body.error.message).toBe('missing header');\n    await testApp.shutdown();\n  });\n\n  it('returns 400 (not a hang) when the resolved workspaceId is malformed', async () => {\n    const testApp = await createCodesignHttpServer({\n      assets: {},\n      maxSessions: 4,\n      idleTimeoutMs: 60_000,\n      // header mode-style: return an illegal id that ScopedWorkspaceFS will reject\n      resolveWorkspaceId: () => '../escape',\n      createSession: async ({ workspaceId }) => {\n        // mirror cli/http.ts: constructing the scoped fs validates the id\n        new ScopedWorkspaceFS(new InMemoryWorkspaceFS(), workspaceId);\n        return { engine: {}, tools: [] };\n      }\n    });\n    const res = await request(testApp)\n      .post('/mcp')\n      .set('content-type', 'application/json')\n      .send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });\n    expect(res.status).toBe(400);\n    expect(res.body.error.code).toBe(-32602); // invalid params\n    await testApp.shutdown();\n  });\n});\n"]}

package/dist/test/test/http/session-id-header.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=session-id-header.test.d.ts.map

package/dist/test/test/http/session-id-header.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-id-header.test.d.ts","sourceRoot":"","sources":["../../../../test/http/session-id-header.test.ts"],"names":[],"mappings":""}

package/dist/test/test/http/session-id-header.test.js

@@ -1,76 +0,0 @@
-import request from 'supertest';
-import { describe, expect, it } from 'vitest';
-import { createCodesignHttpServer } from '../../src/http/server.js';
-// The transport echoes the session id it assigned in the `mcp-session-id`
-// response header. We assert that, with `trustedSessionIdHeader` configured,
-// an inbound header value becomes the session id verbatim — and without it,
-// the server still mints its own (a normal uuid, not our injected value).
-const INIT_BODY = {
-    jsonrpc: '2.0',
-    id: 1,
-    method: 'initialize',
-    params: {
-        protocolVersion: '2024-11-05',
-        capabilities: {},
-        clientInfo: { name: 'test', version: '0.0.0' }
-    }
-};
-describe('trustedSessionIdHeader', () => {
-    it('uses the inbound header value as the session id on initialize', async () => {
-        const app = await createCodesignHttpServer({
-            assets: {},
-            maxSessions: 4,
-            idleTimeoutMs: 60_000,
-            trustedSessionIdHeader: 'x-mcp-session-id',
-            resolveWorkspaceId: (_req, sid) => `s/${sid}`,
-            createSession: async () => ({ engine: {}, tools: [] })
-        });
-        const res = await request(app)
-            .post('/mcp')
-            .set('accept', 'application/json, text/event-stream')
-            .set('content-type', 'application/json')
-            .set('x-mcp-session-id', 'worker-minted-123')
-            .send(INIT_BODY);
-        expect(res.headers['mcp-session-id']).toBe('worker-minted-123');
-        await app.shutdown();
-    });
-    it('mints its own id when the header is absent', async () => {
-        const app = await createCodesignHttpServer({
-            assets: {},
-            maxSessions: 4,
-            idleTimeoutMs: 60_000,
-            trustedSessionIdHeader: 'x-mcp-session-id',
-            resolveWorkspaceId: (_req, sid) => `s/${sid}`,
-            createSession: async () => ({ engine: {}, tools: [] })
-        });
-        const res = await request(app)
-            .post('/mcp')
-            .set('accept', 'application/json, text/event-stream')
-            .set('content-type', 'application/json')
-            .send(INIT_BODY);
-        expect(res.headers['mcp-session-id']).toBeDefined();
-        expect(res.headers['mcp-session-id']).not.toBe('worker-minted-123');
-        expect(res.headers['mcp-session-id']).toMatch(/^[0-9a-f-]{36}$/i);
-        await app.shutdown();
-    });
-    it('mints its own id when the header is present but empty', async () => {
-        const app = await createCodesignHttpServer({
-            assets: {},
-            maxSessions: 4,
-            idleTimeoutMs: 60_000,
-            trustedSessionIdHeader: 'x-mcp-session-id',
-            resolveWorkspaceId: (_req, sid) => `s/${sid}`,
-            createSession: async () => ({ engine: {}, tools: [] })
-        });
-        const res = await request(app)
-            .post('/mcp')
-            .set('accept', 'application/json, text/event-stream')
-            .set('content-type', 'application/json')
-            .set('x-mcp-session-id', '')
-            .send(INIT_BODY);
-        expect(res.headers['mcp-session-id']).toBeDefined();
-        expect(res.headers['mcp-session-id']).toMatch(/^[0-9a-f-]{36}$/i);
-        await app.shutdown();
-    });
-});
-//# sourceMappingURL=session-id-header.test.js.map

package/dist/test/test/http/session-id-header.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-id-header.test.js","sourceRoot":"","sources":["../../../../test/http/session-id-header.test.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,SAAS,GAAG;IAChB,OAAO,EAAE,KAAK;IACd,EAAE,EAAE,CAAC;IACL,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE;QACN,eAAe,EAAE,YAAY;QAC7B,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;KAC/C;CACF,CAAC;AAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACzC,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,sBAAsB,EAAE,kBAAkB;YAC1C,kBAAkB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE;YAC7C,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,CAAC,QAAQ,EAAE,qCAAqC,CAAC;aACpD,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;aACvC,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;aAC5C,IAAI,CAAC,SAAS,CAAC,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChE,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACzC,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,sBAAsB,EAAE,kBAAkB;YAC1C,kBAAkB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE;YAC7C,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,CAAC,QAAQ,EAAE,qCAAqC,CAAC;aACpD,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;aACvC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAClE,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACzC,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,sBAAsB,EAAE,kBAAkB;YAC1C,kBAAkB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE;YAC7C,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,CAAC,QAAQ,EAAE,qCAAqC,CAAC;aACpD,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;aACvC,GAAG,CAAC,kBAAkB,EAAE,EAAE,CAAC;aAC3B,IAAI,CAAC,SAAS,CAAC,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAClE,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import request from 'supertest';\nimport { describe, expect, it } from 'vitest';\nimport { createCodesignHttpServer } from '../../src/http/server.js';\n\n// The transport echoes the session id it assigned in the `mcp-session-id`\n// response header. We assert that, with `trustedSessionIdHeader` configured,\n// an inbound header value becomes the session id verbatim — and without it,\n// the server still mints its own (a normal uuid, not our injected value).\nconst INIT_BODY = {\n  jsonrpc: '2.0',\n  id: 1,\n  method: 'initialize',\n  params: {\n    protocolVersion: '2024-11-05',\n    capabilities: {},\n    clientInfo: { name: 'test', version: '0.0.0' }\n  }\n};\n\ndescribe('trustedSessionIdHeader', () => {\n  it('uses the inbound header value as the session id on initialize', async () => {\n    const app = await createCodesignHttpServer({\n      assets: {},\n      maxSessions: 4,\n      idleTimeoutMs: 60_000,\n      trustedSessionIdHeader: 'x-mcp-session-id',\n      resolveWorkspaceId: (_req, sid) => `s/${sid}`,\n      createSession: async () => ({ engine: {}, tools: [] })\n    });\n    const res = await request(app)\n      .post('/mcp')\n      .set('accept', 'application/json, text/event-stream')\n      .set('content-type', 'application/json')\n      .set('x-mcp-session-id', 'worker-minted-123')\n      .send(INIT_BODY);\n    expect(res.headers['mcp-session-id']).toBe('worker-minted-123');\n    await app.shutdown();\n  });\n\n  it('mints its own id when the header is absent', async () => {\n    const app = await createCodesignHttpServer({\n      assets: {},\n      maxSessions: 4,\n      idleTimeoutMs: 60_000,\n      trustedSessionIdHeader: 'x-mcp-session-id',\n      resolveWorkspaceId: (_req, sid) => `s/${sid}`,\n      createSession: async () => ({ engine: {}, tools: [] })\n    });\n    const res = await request(app)\n      .post('/mcp')\n      .set('accept', 'application/json, text/event-stream')\n      .set('content-type', 'application/json')\n      .send(INIT_BODY);\n    expect(res.headers['mcp-session-id']).toBeDefined();\n    expect(res.headers['mcp-session-id']).not.toBe('worker-minted-123');\n    expect(res.headers['mcp-session-id']).toMatch(/^[0-9a-f-]{36}$/i);\n    await app.shutdown();\n  });\n\n  it('mints its own id when the header is present but empty', async () => {\n    const app = await createCodesignHttpServer({\n      assets: {},\n      maxSessions: 4,\n      idleTimeoutMs: 60_000,\n      trustedSessionIdHeader: 'x-mcp-session-id',\n      resolveWorkspaceId: (_req, sid) => `s/${sid}`,\n      createSession: async () => ({ engine: {}, tools: [] })\n    });\n    const res = await request(app)\n      .post('/mcp')\n      .set('accept', 'application/json, text/event-stream')\n      .set('content-type', 'application/json')\n      .set('x-mcp-session-id', '')\n      .send(INIT_BODY);\n    expect(res.headers['mcp-session-id']).toBeDefined();\n    expect(res.headers['mcp-session-id']).toMatch(/^[0-9a-f-]{36}$/i);\n    await app.shutdown();\n  });\n});\n"]}

package/dist/test/test/http/session-manager.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=session-manager.test.d.ts.map

package/dist/test/test/http/session-manager.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-manager.test.d.ts","sourceRoot":"","sources":["../../../../test/http/session-manager.test.ts"],"names":[],"mappings":""}

package/dist/test/test/http/session-manager.test.js

@@ -1,97 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { SessionCapExceededError, SessionManager, SessionNotFoundError } from '../../src/http/session-manager.js';
-describe('SessionManager', () => {
-    let nextEngineId;
-    let createdEngines;
-    let mgr;
-    beforeEach(() => {
-        vi.useFakeTimers();
-        vi.setSystemTime(new Date('2026-05-09T00:00:00Z'));
-        nextEngineId = 0;
-        createdEngines = [];
-        mgr = new SessionManager({
-            maxSessions: 3,
-            idleTimeoutMs: 60_000,
-            create: async () => {
-                const engine = { id: nextEngineId++, disposed: false };
-                createdEngines.push(engine);
-                return { id: `s-${engine.id}`, engine };
-            },
-            destroy: async (s) => {
-                s.engine.disposed = true;
-            }
-        });
-    });
-    afterEach(() => {
-        vi.useRealTimers();
-    });
-    it('create() returns a fresh session and registers it under its id', async () => {
-        const s = await mgr.create();
-        expect(s.id).toBe('s-0');
-        expect(s.engine.id).toBe(0);
-        expect(mgr.get(s.id)).toBe(s);
-    });
-    it('get() returns undefined for unknown ids', () => {
-        expect(mgr.get('nope')).toBeUndefined();
-    });
-    it('touch() updates lastActivityAt so the session survives idle eviction', async () => {
-        const a = await mgr.create();
-        vi.advanceTimersByTime(50_000);
-        mgr.touch(a.id);
-        vi.advanceTimersByTime(50_000); // total 100s; without touch a would be evicted
-        await mgr.evictIdle();
-        expect(mgr.get(a.id)).toBe(a);
-        expect(a.engine.disposed).toBe(false);
-    });
-    it('evictIdle() destroys sessions older than idleTimeoutMs', async () => {
-        const a = await mgr.create();
-        const b = await mgr.create();
-        vi.advanceTimersByTime(30_000);
-        mgr.touch(b.id); // bump b only
-        vi.advanceTimersByTime(40_000); // a is now 70s idle, b only 40s
-        await mgr.evictIdle();
-        expect(mgr.get(a.id)).toBeUndefined();
-        expect(a.engine.disposed).toBe(true);
-        expect(mgr.get(b.id)).toBe(b);
-        expect(b.engine.disposed).toBe(false);
-    });
-    it('create() throws SessionCapExceededError once maxSessions is reached', async () => {
-        await mgr.create();
-        await mgr.create();
-        await mgr.create();
-        await expect(mgr.create()).rejects.toBeInstanceOf(SessionCapExceededError);
-    });
-    it('delete() destroys a session and removes it', async () => {
-        const a = await mgr.create();
-        await mgr.delete(a.id);
-        expect(mgr.get(a.id)).toBeUndefined();
-        expect(a.engine.disposed).toBe(true);
-    });
-    it('delete() of an unknown id throws SessionNotFoundError', async () => {
-        await expect(mgr.delete('nope')).rejects.toBeInstanceOf(SessionNotFoundError);
-    });
-    it('destroyAll() shuts down every active session', async () => {
-        const a = await mgr.create();
-        const b = await mgr.create();
-        await mgr.destroyAll();
-        expect(mgr.get(a.id)).toBeUndefined();
-        expect(mgr.get(b.id)).toBeUndefined();
-        expect(a.engine.disposed).toBe(true);
-        expect(b.engine.disposed).toBe(true);
-    });
-    it('forwards a context object to the create callback', async () => {
-        const seen = [];
-        const mgr = new SessionManager({
-            maxSessions: 10,
-            idleTimeoutMs: 60_000,
-            create: (ctx) => {
-                seen.push(ctx?.workspaceId);
-                return { id: ctx?.workspaceId ?? 'none' };
-            },
-            destroy: () => { }
-        });
-        await mgr.create({ workspaceId: 'u/a' });
-        expect(seen).toEqual(['u/a']);
-    });
-});
-//# sourceMappingURL=session-manager.test.js.map

package/dist/test/test/http/session-manager.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-manager.test.js","sourceRoot":"","sources":["../../../../test/http/session-manager.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,oBAAoB,EACrB,MAAM,mCAAmC,CAAC;AAY3C,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,YAAoB,CAAC;IACzB,IAAI,cAA4B,CAAC;IACjC,IAAI,GAAgC,CAAC;IAErC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,EAAE,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACnD,YAAY,GAAG,CAAC,CAAC;QACjB,cAAc,GAAG,EAAE,CAAC;QACpB,GAAG,GAAG,IAAI,cAAc,CAAc;YACpC,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,MAAM,GAAe,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;gBACnE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YAC3B,CAAC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QAC7B,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChB,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,+CAA+C;QAC/E,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QAC7B,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc;QAC/B,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,gCAAgC;QAChE,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CACrD,oBAAoB,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAA8B,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,cAAc,CAA0C;YACtE,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,MAAM;YACrB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;gBACd,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC5B,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,IAAI,MAAM,EAAE,CAAC;YAC5C,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';\nimport {\n  SessionCapExceededError,\n  SessionManager,\n  SessionNotFoundError\n} from '../../src/http/session-manager.js';\n\ninterface FakeEngine {\n  id: number;\n  disposed: boolean;\n}\n\ninterface FakeSession {\n  id: string;\n  engine: FakeEngine;\n}\n\ndescribe('SessionManager', () => {\n  let nextEngineId: number;\n  let createdEngines: FakeEngine[];\n  let mgr: SessionManager<FakeSession>;\n\n  beforeEach(() => {\n    vi.useFakeTimers();\n    vi.setSystemTime(new Date('2026-05-09T00:00:00Z'));\n    nextEngineId = 0;\n    createdEngines = [];\n    mgr = new SessionManager<FakeSession>({\n      maxSessions: 3,\n      idleTimeoutMs: 60_000,\n      create: async () => {\n        const engine: FakeEngine = { id: nextEngineId++, disposed: false };\n        createdEngines.push(engine);\n        return { id: `s-${engine.id}`, engine };\n      },\n      destroy: async (s) => {\n        s.engine.disposed = true;\n      }\n    });\n  });\n\n  afterEach(() => {\n    vi.useRealTimers();\n  });\n\n  it('create() returns a fresh session and registers it under its id', async () => {\n    const s = await mgr.create();\n    expect(s.id).toBe('s-0');\n    expect(s.engine.id).toBe(0);\n    expect(mgr.get(s.id)).toBe(s);\n  });\n\n  it('get() returns undefined for unknown ids', () => {\n    expect(mgr.get('nope')).toBeUndefined();\n  });\n\n  it('touch() updates lastActivityAt so the session survives idle eviction', async () => {\n    const a = await mgr.create();\n    vi.advanceTimersByTime(50_000);\n    mgr.touch(a.id);\n    vi.advanceTimersByTime(50_000); // total 100s; without touch a would be evicted\n    await mgr.evictIdle();\n    expect(mgr.get(a.id)).toBe(a);\n    expect(a.engine.disposed).toBe(false);\n  });\n\n  it('evictIdle() destroys sessions older than idleTimeoutMs', async () => {\n    const a = await mgr.create();\n    const b = await mgr.create();\n    vi.advanceTimersByTime(30_000);\n    mgr.touch(b.id); // bump b only\n    vi.advanceTimersByTime(40_000); // a is now 70s idle, b only 40s\n    await mgr.evictIdle();\n    expect(mgr.get(a.id)).toBeUndefined();\n    expect(a.engine.disposed).toBe(true);\n    expect(mgr.get(b.id)).toBe(b);\n    expect(b.engine.disposed).toBe(false);\n  });\n\n  it('create() throws SessionCapExceededError once maxSessions is reached', async () => {\n    await mgr.create();\n    await mgr.create();\n    await mgr.create();\n    await expect(mgr.create()).rejects.toBeInstanceOf(SessionCapExceededError);\n  });\n\n  it('delete() destroys a session and removes it', async () => {\n    const a = await mgr.create();\n    await mgr.delete(a.id);\n    expect(mgr.get(a.id)).toBeUndefined();\n    expect(a.engine.disposed).toBe(true);\n  });\n\n  it('delete() of an unknown id throws SessionNotFoundError', async () => {\n    await expect(mgr.delete('nope')).rejects.toBeInstanceOf(\n      SessionNotFoundError\n    );\n  });\n\n  it('destroyAll() shuts down every active session', async () => {\n    const a = await mgr.create();\n    const b = await mgr.create();\n    await mgr.destroyAll();\n    expect(mgr.get(a.id)).toBeUndefined();\n    expect(mgr.get(b.id)).toBeUndefined();\n    expect(a.engine.disposed).toBe(true);\n    expect(b.engine.disposed).toBe(true);\n  });\n\n  it('forwards a context object to the create callback', async () => {\n    const seen: Array<string | undefined> = [];\n    const mgr = new SessionManager<{ id: string }, { workspaceId: string }>({\n      maxSessions: 10,\n      idleTimeoutMs: 60_000,\n      create: (ctx) => {\n        seen.push(ctx?.workspaceId);\n        return { id: ctx?.workspaceId ?? 'none' };\n      },\n      destroy: () => {}\n    });\n    await mgr.create({ workspaceId: 'u/a' });\n    expect(seen).toEqual(['u/a']);\n  });\n});\n"]}

package/dist/test/test/http/workspace-auth.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=workspace-auth.test.d.ts.map

package/dist/test/test/http/workspace-auth.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"workspace-auth.test.d.ts","sourceRoot":"","sources":["../../../../test/http/workspace-auth.test.ts"],"names":[],"mappings":""}