@open-mercato/ai-assistant 0.5.1-develop.3036.f02c281f23 → 0.5.1-develop.3045.b4b3320cc2

package/src/modules/ai_assistant/api/ai/agents/[agentId]/mutation-policy/route.ts

@@ -0,0 +1,380 @@
+import { NextResponse, type NextRequest } from 'next/server'
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { getAgent, loadAgentRegistry } from '../../../../../lib/agent-registry'
+import { hasRequiredFeatures } from '../../../../../lib/auth'
+import {
+  isKnownMutationPolicy,
+  isMutationPolicyEscalation,
+} from '../../../../../lib/agent-policy'
+import { AiAgentMutationPolicyOverrideRepository } from '../../../../../data/repositories/AiAgentMutationPolicyOverrideRepository'
+import type { AiAgentMutationPolicyOverride } from '../../../../../data/entities'
+import type {
+  AiAgentDefinition,
+  AiAgentMutationPolicy,
+} from '../../../../../lib/ai-agent-definition'
+
+const agentIdPattern = /^[a-z0-9_]+\.[a-z0-9_]+$/
+
+const agentIdParamSchema = z.object({
+  agentId: z
+    .string()
+    .regex(agentIdPattern, 'agentId must match "<module>.<agent>" (lowercase, digits, underscores only)'),
+})
+
+const mutationPolicySchema = z.enum([
+  'read-only',
+  'confirm-required',
+  'destructive-confirm-required',
+])
+
+const mutationPolicyRequestSchema = z.object({
+  mutationPolicy: mutationPolicySchema,
+  notes: z.string().max(2000).optional(),
+})
+
+const VIEW_FEATURE = 'ai_assistant.view'
+const MANAGE_FEATURE = 'ai_assistant.settings.manage'
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'AI Assistant',
+  summary: 'Tenant-scoped mutationPolicy override for an AI agent',
+  methods: {
+    GET: {
+      operationId: 'aiAssistantGetMutationPolicyOverride',
+      summary:
+        'Read the effective mutationPolicy for an agent — code-declared value plus any tenant override.',
+      description:
+        'Returns `{ agentId, codeDeclared, override }` where `codeDeclared` is the agent\'s ' +
+        'compiled-in `mutationPolicy` and `override` is the persisted tenant-scoped override ' +
+        '(or `null`). Requires `ai_assistant.view`.',
+      responses: [
+        {
+          status: 200,
+          description: 'Effective mutationPolicy payload.',
+          mediaType: 'application/json',
+        },
+      ],
+      errors: [
+        { status: 400, description: 'Invalid agent id.' },
+        { status: 401, description: 'Unauthenticated caller.' },
+        { status: 403, description: 'Caller lacks `ai_assistant.view`.' },
+        { status: 404, description: 'Unknown agent id.' },
+      ],
+    },
+    POST: {
+      operationId: 'aiAssistantSaveMutationPolicyOverride',
+      summary:
+        'Set (or replace) the tenant-scoped mutationPolicy override for this agent.',
+      description:
+        'Body: `{ mutationPolicy: "read-only" | "confirm-required" | "destructive-confirm-required", notes? }`. ' +
+        'The override MUST NOT escalate beyond the agent\'s code-declared policy. Escalation attempts ' +
+        'are rejected with 400 + `code: "escalation_not_allowed"`. Requires `ai_assistant.settings.manage`.',
+      requestBody: {
+        contentType: 'application/json',
+        description: 'Body: `{ mutationPolicy, notes? }`.',
+        schema: mutationPolicyRequestSchema,
+      },
+      responses: [
+        {
+          status: 200,
+          description: 'Override persisted.',
+          mediaType: 'application/json',
+        },
+      ],
+      errors: [
+        { status: 400, description: 'Invalid agent id, malformed body, or escalation attempt.' },
+        { status: 401, description: 'Unauthenticated caller.' },
+        { status: 403, description: 'Caller lacks `ai_assistant.settings.manage`.' },
+        { status: 404, description: 'Unknown agent id.' },
+      ],
+    },
+    DELETE: {
+      operationId: 'aiAssistantClearMutationPolicyOverride',
+      summary: 'Remove the tenant-scoped mutationPolicy override for this agent.',
+      description:
+        'Deletes the override row if it exists; subsequent calls fall back to the agent\'s ' +
+        'code-declared policy. Idempotent — returns 200 even when no override exists. Requires ' +
+        '`ai_assistant.settings.manage`.',
+      responses: [
+        {
+          status: 200,
+          description: 'Override cleared (or already absent).',
+          mediaType: 'application/json',
+        },
+      ],
+      errors: [
+        { status: 400, description: 'Invalid agent id.' },
+        { status: 401, description: 'Unauthenticated caller.' },
+        { status: 403, description: 'Caller lacks `ai_assistant.settings.manage`.' },
+        { status: 404, description: 'Unknown agent id.' },
+      ],
+    },
+  },
+}
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },
+  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },
+  DELETE: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },
+}
+
+interface RouteContext {
+  params: Promise<{ agentId: string }>
+}
+
+function jsonError(
+  status: number,
+  message: string,
+  code: string,
+  extra?: Record<string, unknown>,
+): NextResponse {
+  return NextResponse.json({ error: message, code, ...(extra ?? {}) }, { status })
+}
+
+interface ResolvedAuth {
+  tenantId: string | null
+  organizationId: string | null
+  userId: string
+  isSuperAdmin: boolean
+  features: string[]
+  container: Awaited<ReturnType<typeof createRequestContainer>>
+  rbacService: RbacService
+}
+
+async function resolveAuthOrRespond(
+  req: NextRequest,
+  requiredFeature: string,
+): Promise<ResolvedAuth | NextResponse> {
+  const auth = await getAuthFromRequest(req)
+  if (!auth) {
+    return jsonError(401, 'Unauthorized', 'unauthenticated')
+  }
+  const container = await createRequestContainer()
+  const rbacService = container.resolve<RbacService>('rbacService')
+  const acl = await rbacService.loadAcl(auth.sub, {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+  })
+  if (!hasRequiredFeatures([requiredFeature], acl.features, acl.isSuperAdmin, rbacService)) {
+    return jsonError(403, `Caller lacks required feature "${requiredFeature}".`, 'forbidden')
+  }
+  return {
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+    userId: auth.sub,
+    isSuperAdmin: acl.isSuperAdmin,
+    features: acl.features,
+    container,
+    rbacService,
+  }
+}
+
+function serializeOverride(row: AiAgentMutationPolicyOverride) {
+  return {
+    id: row.id,
+    agentId: row.agentId,
+    mutationPolicy: row.mutationPolicy,
+    notes: row.notes ?? null,
+    createdByUserId: row.createdByUserId ?? null,
+    createdAt: row.createdAt?.toISOString?.() ?? new Date().toISOString(),
+    updatedAt: row.updatedAt?.toISOString?.() ?? new Date().toISOString(),
+  }
+}
+
+function codeDeclaredPolicy(agent: AiAgentDefinition): AiAgentMutationPolicy {
+  const declared = agent.mutationPolicy
+  return declared && isKnownMutationPolicy(declared) ? declared : 'read-only'
+}
+
+export async function GET(req: NextRequest, context: RouteContext): Promise<Response> {
+  const authResult = await resolveAuthOrRespond(req, VIEW_FEATURE)
+  if (authResult instanceof NextResponse) return authResult
+
+  const rawParams = await context.params
+  const paramResult = agentIdParamSchema.safeParse(rawParams)
+  if (!paramResult.success) {
+    return jsonError(400, 'Invalid agent id.', 'validation_error', {
+      issues: paramResult.error.issues,
+    })
+  }
+
+  try {
+    await loadAgentRegistry()
+    const agent = getAgent(paramResult.data.agentId)
+    if (!agent) {
+      return jsonError(404, `Unknown agent "${paramResult.data.agentId}".`, 'agent_unknown')
+    }
+
+    const declared = codeDeclaredPolicy(agent)
+    if (!authResult.tenantId) {
+      return NextResponse.json({
+        agentId: agent.id,
+        codeDeclared: declared,
+        override: null,
+      })
+    }
+
+    const em = authResult.container.resolve<EntityManager>('em')
+    const repo = new AiAgentMutationPolicyOverrideRepository(em)
+    const current = await repo.get(agent.id, {
+      tenantId: authResult.tenantId,
+      organizationId: authResult.organizationId,
+    })
+
+    return NextResponse.json({
+      agentId: agent.id,
+      codeDeclared: declared,
+      override: current ? serializeOverride(current) : null,
+    })
+  } catch (error) {
+    console.error('[AI Mutation Policy GET] Failure:', error)
+    return jsonError(
+      500,
+      error instanceof Error ? error.message : 'Failed to load mutationPolicy override.',
+      'internal_error',
+    )
+  }
+}
+
+export async function POST(req: NextRequest, context: RouteContext): Promise<Response> {
+  const authResult = await resolveAuthOrRespond(req, MANAGE_FEATURE)
+  if (authResult instanceof NextResponse) return authResult
+
+  const rawParams = await context.params
+  const paramResult = agentIdParamSchema.safeParse(rawParams)
+  if (!paramResult.success) {
+    return jsonError(400, 'Invalid agent id.', 'validation_error', {
+      issues: paramResult.error.issues,
+    })
+  }
+
+  let parsedBody: unknown
+  try {
+    parsedBody = await req.json()
+  } catch {
+    return jsonError(400, 'Request body must be valid JSON.', 'validation_error')
+  }
+
+  const bodyResult = mutationPolicyRequestSchema.safeParse(parsedBody)
+  if (!bodyResult.success) {
+    return jsonError(400, 'Invalid request body.', 'validation_error', {
+      issues: bodyResult.error.issues,
+    })
+  }
+
+  try {
+    await loadAgentRegistry()
+    const agent = getAgent(paramResult.data.agentId)
+    if (!agent) {
+      return jsonError(404, `Unknown agent "${paramResult.data.agentId}".`, 'agent_unknown')
+    }
+
+    const declared = codeDeclaredPolicy(agent)
+    if (isMutationPolicyEscalation(declared, bodyResult.data.mutationPolicy)) {
+      return jsonError(
+        400,
+        `Cannot set mutationPolicy="${bodyResult.data.mutationPolicy}" for agent "${agent.id}": ` +
+          `the agent\'s code-declared policy is "${declared}". Upgrading beyond the declared ` +
+          `policy is a code-level change, not a configuration change.`,
+        'escalation_not_allowed',
+        { codeDeclared: declared, requested: bodyResult.data.mutationPolicy },
+      )
+    }
+
+    if (!authResult.tenantId) {
+      return jsonError(
+        400,
+        'Caller has no tenant context; cannot persist tenant-scoped mutationPolicy override.',
+        'tenant_required',
+      )
+    }
+
+    const em = authResult.container.resolve<EntityManager>('em')
+    const repo = new AiAgentMutationPolicyOverrideRepository(em)
+    const saved = await repo.set(
+      {
+        agentId: agent.id,
+        mutationPolicy: bodyResult.data.mutationPolicy,
+        notes: bodyResult.data.notes ?? null,
+      },
+      {
+        tenantId: authResult.tenantId,
+        organizationId: authResult.organizationId,
+        userId: authResult.userId,
+      },
+    )
+
+    return NextResponse.json({
+      ok: true,
+      agentId: agent.id,
+      codeDeclared: declared,
+      override: serializeOverride(saved),
+    })
+  } catch (error) {
+    console.error('[AI Mutation Policy POST] Failure:', error)
+    return jsonError(
+      500,
+      error instanceof Error ? error.message : 'Failed to save mutationPolicy override.',
+      'internal_error',
+    )
+  }
+}
+
+export async function DELETE(req: NextRequest, context: RouteContext): Promise<Response> {
+  const authResult = await resolveAuthOrRespond(req, MANAGE_FEATURE)
+  if (authResult instanceof NextResponse) return authResult
+
+  const rawParams = await context.params
+  const paramResult = agentIdParamSchema.safeParse(rawParams)
+  if (!paramResult.success) {
+    return jsonError(400, 'Invalid agent id.', 'validation_error', {
+      issues: paramResult.error.issues,
+    })
+  }
+
+  try {
+    await loadAgentRegistry()
+    const agent = getAgent(paramResult.data.agentId)
+    if (!agent) {
+      return jsonError(404, `Unknown agent "${paramResult.data.agentId}".`, 'agent_unknown')
+    }
+
+    const declared = codeDeclaredPolicy(agent)
+    if (!authResult.tenantId) {
+      return NextResponse.json({
+        ok: true,
+        agentId: agent.id,
+        codeDeclared: declared,
+        override: null,
+        cleared: false,
+      })
+    }
+
+    const em = authResult.container.resolve<EntityManager>('em')
+    const repo = new AiAgentMutationPolicyOverrideRepository(em)
+    const cleared = await repo.clear(agent.id, {
+      tenantId: authResult.tenantId,
+      organizationId: authResult.organizationId,
+    })
+
+    return NextResponse.json({
+      ok: true,
+      agentId: agent.id,
+      codeDeclared: declared,
+      override: null,
+      cleared,
+    })
+  } catch (error) {
+    console.error('[AI Mutation Policy DELETE] Failure:', error)
+    return jsonError(
+      500,
+      error instanceof Error ? error.message : 'Failed to clear mutationPolicy override.',
+      'internal_error',
+    )
+  }
+}

package/src/modules/ai_assistant/api/ai/agents/[agentId]/prompt-override/__tests__/route.test.ts

@@ -0,0 +1,333 @@
+import type { AiAgentDefinition } from '../../../../../../lib/ai-agent-definition'
+import {
+  resetAgentRegistryForTests,
+  seedAgentRegistryForTests,
+} from '../../../../../../lib/agent-registry'
+
+const authMock = jest.fn()
+const loadAclMock = jest.fn()
+const createRequestContainerMock = jest.fn()
+const repoGetLatestMock = jest.fn()
+const repoSaveMock = jest.fn()
+const repoListVersionsMock = jest.fn()
+
+jest.mock('@open-mercato/shared/lib/auth/server', () => ({
+  getAuthFromRequest: (...args: unknown[]) => authMock(...args),
+}))
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: (...args: unknown[]) => createRequestContainerMock(...args),
+}))
+
+jest.mock('../../../../../../data/repositories/AiAgentPromptOverrideRepository', () => ({
+  AiAgentPromptOverrideRepository: jest.fn().mockImplementation(() => ({
+    getLatest: repoGetLatestMock,
+    save: repoSaveMock,
+    listVersions: repoListVersionsMock,
+  })),
+}))
+
+import { GET, POST } from '../route'
+
+function makeAgent(
+  overrides: Partial<AiAgentDefinition> & Pick<AiAgentDefinition, 'id' | 'moduleId'>,
+): AiAgentDefinition {
+  return {
+    label: `${overrides.id} label`,
+    description: `${overrides.id} description`,
+    systemPrompt: 'You are a test agent.',
+    allowedTools: [],
+    ...overrides,
+  }
+}
+
+function buildRequest(body: unknown, method: 'GET' | 'POST' = 'POST'): Request {
+  return new Request('http://localhost/api/ai_assistant/ai/agents/catalog.assistant/prompt-override', {
+    method,
+    headers: { 'content-type': 'application/json' },
+    body: method === 'GET' ? undefined : JSON.stringify(body),
+  })
+}
+
+function buildParams(agentId: string) {
+  return { params: Promise.resolve({ agentId }) }
+}
+
+describe('prompt-override route (Step 5.3)', () => {
+  let consoleErrorSpy: jest.SpyInstance
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    resetAgentRegistryForTests()
+    consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {})
+    authMock.mockResolvedValue({
+      sub: 'user-1',
+      tenantId: 'tenant-1',
+      orgId: 'org-1',
+    })
+    loadAclMock.mockResolvedValue({
+      features: ['ai_assistant.settings.manage'],
+      isSuperAdmin: false,
+    })
+    createRequestContainerMock.mockResolvedValue({
+      resolve: (name: string) => {
+        if (name === 'rbacService') {
+          return {
+            loadAcl: loadAclMock,
+            hasAllFeatures: (required: string[], granted: string[]) =>
+              required.every((feature) => granted.includes(feature)),
+          }
+        }
+        if (name === 'em') {
+          return {}
+        }
+        return null
+      },
+    })
+    repoGetLatestMock.mockResolvedValue(null)
+    repoListVersionsMock.mockResolvedValue([])
+    repoSaveMock.mockImplementation(async (input: any) => ({
+      id: 'row-1',
+      agentId: input.agentId,
+      version: 1,
+      sections: input.sections,
+      notes: input.notes ?? null,
+      createdByUserId: null,
+      createdAt: new Date('2026-04-18T00:00:00Z'),
+      updatedAt: new Date('2026-04-18T00:00:01Z'),
+    }))
+  })
+
+  afterEach(() => {
+    consoleErrorSpy.mockRestore()
+  })
+
+  afterAll(() => {
+    resetAgentRegistryForTests()
+  })
+
+  describe('POST', () => {
+    it('returns 401 when unauthenticated', async () => {
+      authMock.mockResolvedValueOnce(null)
+
+      const response = await POST(
+        buildRequest({ sections: {} }) as any,
+        buildParams('catalog.assistant'),
+      )
+
+      expect(response.status).toBe(401)
+      const json = await response.json()
+      expect(json.code).toBe('unauthenticated')
+    })
+
+    it('returns 403 when the caller lacks ai_assistant.settings.manage', async () => {
+      loadAclMock.mockResolvedValueOnce({
+        features: ['ai_assistant.view'],
+        isSuperAdmin: false,
+      })
+      seedAgentRegistryForTests([
+        makeAgent({ id: 'catalog.assistant', moduleId: 'catalog' }),
+      ])
+
+      const response = await POST(
+        buildRequest({ sections: { role: 'You are friendly.' } }) as any,
+        buildParams('catalog.assistant'),
+      )
+
+      expect(response.status).toBe(403)
+      const json = await response.json()
+      expect(json.code).toBe('forbidden')
+    })
+
+    it('returns 404 for an unknown agent id', async () => {
+      seedAgentRegistryForTests([
+        makeAgent({ id: 'catalog.assistant', moduleId: 'catalog' }),
+      ])
+
+      const response = await POST(
+        buildRequest({ sections: {} }) as any,
+        buildParams('catalog.missing'),
+      )
+
+      expect(response.status).toBe(404)
+      const json = await response.json()
+      expect(json.code).toBe('agent_unknown')
+    })
+
+    it('returns 400 when body is not JSON-shaped as expected', async () => {
+      seedAgentRegistryForTests([
+        makeAgent({ id: 'catalog.assistant', moduleId: 'catalog' }),
+      ])
+
+      const response = await POST(
+        buildRequest({ sections: 'not-an-object' }) as any,
+        buildParams('catalog.assistant'),
+      )
+
+      expect(response.status).toBe(400)
+      const json = await response.json()
+      expect(json.code).toBe('validation_error')
+    })
+
+    it('returns 400 when the agentId param is malformed', async () => {
+      const response = await POST(
+        buildRequest({ sections: {} }) as any,
+        buildParams('NotAValidId'),
+      )
+
+      expect(response.status).toBe(400)
+      const json = await response.json()
+      expect(json.code).toBe('validation_error')
+    })
+
+    it('returns 400 with reserved_key when the body contains a policy key', async () => {
+      seedAgentRegistryForTests([
+        makeAgent({ id: 'catalog.assistant', moduleId: 'catalog' }),
+      ])
+
+      const response = await POST(
+        buildRequest({
+          sections: { mutationPolicy: 'allow writes', role: 'Be nice.' },
+        }) as any,
+        buildParams('catalog.assistant'),
+      )
+
+      expect(response.status).toBe(400)
+      const json = await response.json()
+      expect(json.code).toBe('reserved_key')
+      expect(json.reservedKeys).toContain('mutationPolicy')
+      expect(repoSaveMock).not.toHaveBeenCalled()
+    })
+
+    it('happy path: returns 200 with { ok: true, version } on successful save', async () => {
+      seedAgentRegistryForTests([
+        makeAgent({ id: 'catalog.assistant', moduleId: 'catalog' }),
+      ])
+
+      const response = await POST(
+        buildRequest({
+          sections: { role: 'You are a friendly product expert.' },
+          notes: 'Friendly tone rollout.',
+        }) as any,
+        buildParams('catalog.assistant'),
+      )
+
+      expect(response.status).toBe(200)
+      const json = await response.json()
+      expect(json.ok).toBe(true)
+      expect(json.agentId).toBe('catalog.assistant')
+      expect(json.version).toBe(1)
+      expect(typeof json.updatedAt).toBe('string')
+      expect(repoSaveMock).toHaveBeenCalledTimes(1)
+      expect(repoSaveMock.mock.calls[0][0]).toMatchObject({
+        agentId: 'catalog.assistant',
+        sections: { role: 'You are a friendly product expert.' },
+        notes: 'Friendly tone rollout.',
+      })
+      expect(repoSaveMock.mock.calls[0][1]).toMatchObject({
+        tenantId: 'tenant-1',
+        organizationId: 'org-1',
+        userId: 'user-1',
+      })
+    })
+
+    it('accepts legacy overrides key as an alias for sections', async () => {
+      seedAgentRegistryForTests([
+        makeAgent({ id: 'catalog.assistant', moduleId: 'catalog' }),
+      ])
+
+      const response = await POST(
+        buildRequest({ overrides: { role: 'legacy shape' } }) as any,
+        buildParams('catalog.assistant'),
+      )
+      expect(response.status).toBe(200)
+      const json = await response.json()
+      expect(json.ok).toBe(true)
+      expect(repoSaveMock.mock.calls[0][0].sections).toEqual({ role: 'legacy shape' })
+    })
+  })
+
+  describe('GET', () => {
+    it('returns 401 when unauthenticated', async () => {
+      authMock.mockResolvedValueOnce(null)
+      const response = await GET(
+        buildRequest(null, 'GET') as any,
+        buildParams('catalog.assistant'),
+      )
+      expect(response.status).toBe(401)
+    })
+
+    it('returns 404 for an unknown agent id', async () => {
+      seedAgentRegistryForTests([
+        makeAgent({ id: 'catalog.assistant', moduleId: 'catalog' }),
+      ])
+      const response = await GET(
+        buildRequest(null, 'GET') as any,
+        buildParams('catalog.missing'),
+      )
+      expect(response.status).toBe(404)
+    })
+
+    it('returns { agentId, override: null, versions: [] } when no overrides exist', async () => {
+      seedAgentRegistryForTests([
+        makeAgent({ id: 'catalog.assistant', moduleId: 'catalog' }),
+      ])
+      repoGetLatestMock.mockResolvedValueOnce(null)
+      repoListVersionsMock.mockResolvedValueOnce([])
+
+      const response = await GET(
+        buildRequest(null, 'GET') as any,
+        buildParams('catalog.assistant'),
+      )
+      expect(response.status).toBe(200)
+      const json = await response.json()
+      expect(json).toEqual({
+        agentId: 'catalog.assistant',
+        override: null,
+        versions: [],
+      })
+    })
+
+    it('returns serialized latest + history rows', async () => {
+      seedAgentRegistryForTests([
+        makeAgent({ id: 'catalog.assistant', moduleId: 'catalog' }),
+      ])
+      const latest = {
+        id: 'row-2',
+        agentId: 'catalog.assistant',
+        version: 2,
+        sections: { role: 'v2' },
+        notes: null,
+        createdByUserId: 'user-1',
+        createdAt: new Date('2026-04-17T00:00:00Z'),
+        updatedAt: new Date('2026-04-18T00:00:00Z'),
+      }
+      repoGetLatestMock.mockResolvedValueOnce(latest)
+      repoListVersionsMock.mockResolvedValueOnce([
+        latest,
+        {
+          id: 'row-1',
+          agentId: 'catalog.assistant',
+          version: 1,
+          sections: { role: 'v1' },
+          notes: null,
+          createdByUserId: 'user-1',
+          createdAt: new Date('2026-04-16T00:00:00Z'),
+          updatedAt: new Date('2026-04-16T00:00:01Z'),
+        },
+      ])
+
+      const response = await GET(
+        buildRequest(null, 'GET') as any,
+        buildParams('catalog.assistant'),
+      )
+      expect(response.status).toBe(200)
+      const json = await response.json()
+      expect(json.agentId).toBe('catalog.assistant')
+      expect(json.override.version).toBe(2)
+      expect(json.versions).toHaveLength(2)
+      expect(json.versions[0].version).toBe(2)
+      expect(json.versions[1].version).toBe(1)
+    })
+  })
+})