@openparachute/vault 0.7.3-rc.13 → 0.7.3-rc.2

package/src/routing.ts

@@ -1,23 +1,15 @@
 /**
  * HTTP request router for the multi-vault server.
  *
- * Per-vault resources live under `/vault/<name>/...` — a request names the
- * vault it targets in the URL. The one exception is the canonical root `/mcp`
- * endpoint (U1), which is vault-AGNOSTIC: the vault is derived from the token,
- * not the URL. A fresh install creates a vault named `default`, so
- * `/vault/default/...` is the baseline URL for single-vault deployments.
+ * All per-vault resources live under `/vault/<name>/...`. There is no
+ * unscoped fallback — a request must name the vault it targets. A fresh
+ * install creates a vault named `default`, so `/vault/default/...` is the
+ * baseline URL for single-vault deployments.
  *
  * Dispatch shape:
  *
  *   /.well-known/parachute.json        — NOT served here (CLI owns it at
  *                                        origin root; vault never handles it)
- *   /.well-known/oauth-protected-resource/mcp
- *                                      — root-endpoint PRM (RFC 9728) for the
- *                                        canonical `/mcp` below (U1)
- *   /mcp[/*]                           — canonical root MCP endpoint; the vault
- *                                        is DERIVED FROM THE TOKEN, then the
- *                                        request re-dispatches through the same
- *                                        per-vault machinery (U1)
  *   /health                            — liveness ping, vault names leaked
  *                                        only to authenticated callers
  *   /vaults/list                       — public vault-name discovery (can be
@@ -29,20 +21,15 @@
  *   /vault/<name>/.well-known/oauth-*  — discovery forwarder; metadata names
  *                                        the hub as the authorization server
  *                                        (vault is resource-server only)
- *   /vault/<name>/mcp[/*]              — MCP endpoint (Bearer auth); the
- *                                        URL-addressed twin of root `/mcp`,
- *                                        untouched and permanent
+ *   /vault/<name>/mcp[/*]              — MCP endpoint (Bearer auth)
  *   /vault/<name>/view/<idOrPath>      — auth-aware HTML view
  *   /vault/<name>/public/<noteId>      — legacy alias → /view redirect
  *   /vault/<name>                      — vault metadata + stats (auth)
  *   /vault/<name>/api/...              — REST surface (auth)
  *
- * The root `/mcp` here is NOT the old unscoped compat prefix (that pre-0.5.0
- * `/mcp` — an alias for a single default vault — is gone). It's the token-
- * derived door: same auth machinery as the per-vault endpoint, reached without
- * the client having to know the vault's URL name. There is still deliberately
- * no compat for the old `/api/*`, `/oauth/*`, `/view/*`, or `/vaults/<name>/*`
- * prefixes; clients using those must re-authenticate and point at the new URLs.
+ * There is deliberately no compat for the old `/api/*`, `/mcp`, `/oauth/*`,
+ * `/view/*`, or `/vaults/<name>/*` prefixes. Clients must re-authenticate
+ * after the upgrade and point at the new URLs.
  *
  * **No standalone OAuth issuer.** vault does not mint OAuth tokens or
  * render a consent UI. Hub is the issuer; vault validates hub-signed
@@ -63,7 +50,6 @@ import {
 import {
   authenticateVaultRequest,
   authenticateGlobalRequest,
-  deriveVaultFromToken,
   extractApiKey,
 } from "./auth.ts";
 import { hasScopeForVault, hasMigrateScopeForVault, SCOPE_ADMIN, SCOPE_READ, scopeForMethod, verbForMethod } from "./scopes.ts";
@@ -92,7 +78,6 @@ import { handleTriggers } from "./triggers-api.ts";
 import { expandTokenTagScope } from "./tag-scope.ts";
 import {
   handleProtectedResource,
-  handleRootProtectedResource,
   handleAuthorizationServer,
   getBaseUrl,
 } from "./oauth-discovery.ts";
@@ -118,7 +103,6 @@ import {
 } from "./mirror-routes.ts";
 import { getMirrorManager } from "./mirror-registry.ts";
 import { buildUsageReport } from "./usage.ts";
-import { handleTicketSpend } from "./attachment-tickets.ts";
 
 /**
  * Decorate a 401 response from the MCP endpoint with the RFC 9728 challenge
@@ -150,58 +134,6 @@ async function withMcpChallenge(
   return new Response(body, { status: 401, headers });
 }
 
-/**
- * 401 + RFC 9728 challenge for the canonical ROOT `/mcp` endpoint (U1), when
- * the token is absent / invalid / names no single vault. Mirrors
- * `withMcpChallenge` but points at the ROOT protected-resource metadata
- * (`/.well-known/oauth-protected-resource/mcp`) rather than a vault-scoped one,
- * since the root resource is vault-agnostic. A spec-following MCP client
- * follows this pointer to the root PRM, discovers the hub, and requests the
- * un-narrowed scopes the hub's consent picker narrows to a chosen vault.
- */
-function rootMcpChallenge(req: Request): Response {
-  const base = getBaseUrl(req);
-  return Response.json(
-    { error: "Unauthorized", message: "API key required" },
-    {
-      status: 401,
-      headers: {
-        "WWW-Authenticate": `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource/mcp"`,
-      },
-    },
-  );
-}
-
-/**
- * Shared scoped-MCP dispatch tail used by BOTH the URL-addressed per-vault
- * endpoint (`/vault/<name>/mcp`) and the token-derived root endpoint (`/mcp`,
- * U1). Runs the FULL per-vault auth machinery via `authenticateVaultRequest`
- * (audience strict-check, `vault_scope` pin, broad-scope rejection, tag-scope
- * parse) and, on success, hands off to `handleScopedMcp`. A 401 is decorated
- * with the per-vault RFC 9728 challenge. Because both entry points funnel
- * through this one function, a root request behaves byte-identically to the
- * same token at the per-vault URL — and, for the root, the re-validation here
- * is the authoritative gate: a derivation that named the wrong vault fails the
- * audience strict-check, it never bypasses it.
- */
-async function dispatchScopedMcp(
-  req: Request,
-  vaultName: string,
-  vaultConfig: VaultConfig,
-): Promise<Response> {
-  const auth = await authenticateVaultRequest(req, vaultConfig);
-  if ("error" in auth) return withMcpChallenge(auth.error, req, vaultName);
-  // Thread the RAW caller bearer (the exact credential the session presented)
-  // into the MCP layer so the manage-token tool can forward it to hub's
-  // mint-token attenuation proxy (vault#403, MGT). Only the raw validated
-  // bearer — never a fabricated one. extractApiKey returns the same value
-  // `authenticateVaultRequest` validated above; non-forwardable credentials
-  // (env-var secret, legacy pvt_*) are handled by manage-token itself (it only
-  // forwards JWT-shaped bearers).
-  const callerBearer = extractApiKey(req);
-  return handleScopedMcp(req, vaultName, auth, callerBearer);
-}
-
 /**
  * Check if a /view request has a valid API key (header or ?key= query param).
  * Returns true if authenticated, false if not. Never rejects — unauthenticated
@@ -327,18 +259,6 @@ export async function route(
     return handleAuthorizationServer(req, vaultName);
   }
 
-  // Root-endpoint protected-resource metadata (RFC 9728 §3.1 path-insertion)
-  // for the canonical `/mcp` endpoint (U1). The root resource is vault-
-  // agnostic — the target vault is derived from the token, not the URL — so
-  // this document carries no vault name and advertises the un-narrowed
-  // `vault:read` / `vault:write` scopes; the hub's consent picker narrows them
-  // to a chosen vault at authorization time. Distinct from the per-vault
-  // insertion shapes above (which require a `/vault/<name>` segment), so there
-  // is no overlap. The `rootMcpChallenge` 401 points clients here.
-  if (path === "/.well-known/oauth-protected-resource/mcp") {
-    return handleRootProtectedResource(req);
-  }
-
   // ---------------------------------------------------------------------
   // Cross-vault / origin-root endpoints
   // ---------------------------------------------------------------------
@@ -447,43 +367,6 @@ export async function route(
     return Response.json({ vaults });
   }
 
-  // ---------------------------------------------------------------------
-  // Canonical root MCP endpoint — token-derived vault dispatch (U1).
-  //
-  // `POST /mcp` (plus the GET/DELETE the streamable-HTTP transport uses, and
-  // the `/mcp/*` subpaths) is the vault-AGNOSTIC entry point: the target vault
-  // is derived from the TOKEN, not the URL. We validate the bearer with the
-  // same scope-guard trust kernel the per-vault path uses, read the vault name
-  // from the token's claims, then RE-DISPATCH through the identical per-vault
-  // machinery (`dispatchScopedMcp` → `authenticateVaultRequest` →
-  // `handleScopedMcp`). The re-dispatch re-validates WITH the audience pin, so
-  // a bad derivation fails the inner check rather than bypassing it (defense in
-  // depth). The legacy URL-addressed `/vault/<name>/mcp` is untouched and lives
-  // forever.
-  //
-  // No / invalid / unnameable token → 401 whose `WWW-Authenticate` points at
-  // the ROOT PRM (`/.well-known/oauth-protected-resource/mcp`), so a spec-
-  // following MCP client discovers the hub and requests the un-narrowed scopes
-  // its consent picker narrows to a chosen vault.
-  if (path === "/mcp" || path.startsWith("/mcp/")) {
-    const derived = await deriveVaultFromToken(req);
-    if ("error" in derived) {
-      return rootMcpChallenge(req);
-    }
-    const vaultConfig = readVaultConfig(derived.vaultName);
-    if (!vaultConfig) {
-      // A validly-signed hub token naming a vault that isn't on THIS server.
-      // Mirror the per-vault 404 (`/vault/<name>/mcp` on a missing vault) — the
-      // holder knows which vault their token targets; nothing is leaked to an
-      // anonymous caller (they never validate a token to reach here).
-      return Response.json(
-        { error: "Vault not found", vault: derived.vaultName },
-        { status: 404 },
-      );
-    }
-    return dispatchScopedMcp(req, derived.vaultName, vaultConfig);
-  }
-
   // ---------------------------------------------------------------------
   // Per-vault routing: /vault/<name>/...
   // ---------------------------------------------------------------------
@@ -607,40 +490,28 @@ export async function route(
     return handleAuthorizationServer(req, vaultName);
   }
 
-  // Attachment ticket spend (attachment-tickets design, Wave 1) — no auth
-  // beyond the ticket itself; the ticket IS the credential (single-use,
-  // short TTL, scoped to exactly one upload slot or one attachment's
-  // bytes). Deliberately placed BEFORE `authenticateVaultRequest` below —
-  // a bearer-less runtime (a bare `curl`) must be able to spend a ticket
-  // without ever holding this vault's API key. The path segment
-  // (`/tickets/<id>`) is outside the authed `/api` tree and outside
-  // `/mcp` on purpose — see `request-attachment-upload`/`-download`
-  // (core/src/mcp.ts) for where tickets are minted.
-  const vaultTicketMatch = subpath.match(/^\/tickets\/([^/]+)$/);
-  if (vaultTicketMatch) {
-    const ticketId = decodeURIComponent(vaultTicketMatch[1]!);
-    const store = getVaultStore(vaultName);
-    return handleTicketSpend(req, ticketId, vaultName, store);
-  }
-
-  // MCP (per-vault, single-vault session) — the URL names the vault. Shares
-  // the exact dispatch tail with the token-derived root `/mcp` (U1), so both
-  // behave identically. Handled BEFORE the shared authenticated-surface auth
-  // below because `dispatchScopedMcp` owns its own auth + 401 challenge; a
-  // non-MCP 401 further down never carries the RFC 9728 challenge (it's
-  // MCP-only).
-  if (subpath === "/mcp" || subpath.startsWith("/mcp/")) {
-    return dispatchScopedMcp(req, vaultName, vaultConfig);
-  }
-
   // ---------------------------------------------------------------------
   // Authenticated surface
   // ---------------------------------------------------------------------
 
   const store = getVaultStore(vaultName);
   const auth = await authenticateVaultRequest(req, vaultConfig);
+  const isScopedMcp = subpath === "/mcp" || subpath.startsWith("/mcp/");
   if ("error" in auth) {
-    return auth.error;
+    return isScopedMcp ? withMcpChallenge(auth.error, req, vaultName) : auth.error;
+  }
+
+  // MCP (per-vault, single-vault session).
+  if (isScopedMcp) {
+    // Thread the RAW caller bearer (the exact credential the session
+    // presented) into the MCP layer so the manage-token tool can forward it
+    // to hub's mint-token attenuation proxy (vault#403, MGT). Only the raw
+    // validated bearer — never a fabricated one. extractApiKey returns the
+    // same value `authenticateVaultRequest` validated above; non-forwardable
+    // credentials (env-var secret, legacy pvt_*) are handled by manage-token
+    // itself (it only forwards JWT-shaped bearers).
+    const callerBearer = extractApiKey(req);
+    return handleScopedMcp(req, vaultName, auth, callerBearer);
   }
 
   // Bare `/vault/<name>` — single-vault root. Returns name, description,

package/src/scopes.ts

@@ -263,28 +263,6 @@ export function validateMintedScopes(
   return { ok: true };
 }
 
-/**
- * Distinct vault names NAMED by narrowed `vault:<name>:<verb>` scopes in the
- * granted list. Broad `vault:<verb>` scopes name no vault (a legacy/operator
- * shape) and are skipped; the `migrate` axis isn't a read/write/admin verb so
- * `decomposeVaultScope` returns null for it and it too is skipped.
- *
- * Used by the canonical root `/mcp` endpoint (U1) to read the target vault
- * from a token's scope claim — one of three agreeing sources (scope / `aud` /
- * single-element `vault_scope`) that `deriveVaultFromToken` cross-checks. A
- * hub-minted token carries scopes for exactly one vault, so this returns a
- * single-element list in practice; a return of length ≠ 1 signals a
- * malformed/multi-vault scope set the derivation treats as a disagreement.
- */
-export function narrowedVaultNames(granted: string[]): string[] {
-  const names = new Set<string>();
-  for (const s of granted) {
-    const d = decomposeVaultScope(s);
-    if (d && d.vault !== null) names.add(d.vault);
-  }
-  return [...names];
-}
-
 /**
  * Detect a broad `vault:<verb>` scope in a granted list. Hub-issued JWTs
  * must NOT carry broad vault scopes — the hub mints `vault:<name>:<verb>` so

package/src/server.ts

@@ -21,7 +21,6 @@ import { migrateVaultKeys } from "./token-store.ts";
 import { resolveFirstBootVaultName, reservedNameSquatWarnings } from "./vault-name.ts";
 import { getVaultStore, getVaultNameForStore, getSharedEmbeddingProvider } from "./vault-store.ts";
 import { EmbeddingWorker, registerEmbeddingHook } from "./embedding-worker.ts";
-import { startAttachmentTicketSweep, stopAttachmentTicketSweep } from "./attachment-tickets.ts";
 import { seedOnboardingNotesBestEffort } from "./onboarding-seed.ts";
 import { defaultHookRegistry } from "../core/src/hooks.ts";
 import { registerTriggers } from "./triggers.ts";
@@ -238,11 +237,6 @@ const embeddingWorker = new EmbeddingWorker({
 registerEmbeddingHook(defaultHookRegistry, embeddingWorker, (store) => getVaultNameForStore(store as never));
 embeddingWorker.start();
 
-// Attachment-ticket sweep (vault#612) — drops expired-unspent tickets from
-// the in-process store so an abandoned mint (an agent that never curls)
-// doesn't sit in memory forever. See src/attachment-tickets.ts.
-startAttachmentTicketSweep();
-
 if (process.env.VAULT_AUTH_TOKEN?.trim()) {
   console.log("[auth] VAULT_AUTH_TOKEN set — server-wide operator bearer active");
 }
@@ -625,7 +619,6 @@ async function shutdown(signal: string): Promise<void> {
         // Then drain hooks + stop the transcription/embedding workers in
         // parallel.
         embeddingWorker.stop();
-        stopAttachmentTicketSweep();
         await Promise.all([
           defaultHookRegistry.drain(),
           transcriptionWorker?.stop() ?? Promise.resolve(),

package/src/storage.test.ts

@@ -30,7 +30,7 @@ const testDir = join(
 process.env.PARACHUTE_HOME = testDir;
 process.env.ASSETS_DIR = join(testDir, "assets");
 
-const { handleStorage, MAX_UPLOAD_BYTES, MAX_REQUEST_BODY_BYTES, parseByteRangeHeader } = await import("./routes.ts");
+const { handleStorage, MAX_UPLOAD_BYTES, MAX_REQUEST_BODY_BYTES } = await import("./routes.ts");
 const { expandTokenTagScope } = await import("./tag-scope.ts");
 
 // The upload-allowlist tests never touch the store (POST /upload writes to
@@ -564,202 +564,3 @@ describe("storage POST parity (finding D)", () => {
     expect(res.status).toBe(404);
   });
 });
-
-// ---------------------------------------------------------------------------
-// REST Range (206) — vault attachments-for-agents design D9, the REST twin
-// of MCP's content_offset/content_length.
-// ---------------------------------------------------------------------------
-
-describe("parseByteRangeHeader", () => {
-  test("no header → null (full response)", () => {
-    expect(parseByteRangeHeader(null, 100)).toBeNull();
-  });
-
-  test("bytes=0-99 on a 100-byte file → the whole file as one satisfiable range", () => {
-    expect(parseByteRangeHeader("bytes=0-99", 100)).toEqual({ start: 0, end: 99 });
-  });
-
-  test("bytes=10-19 → an inclusive mid-file window", () => {
-    expect(parseByteRangeHeader("bytes=10-19", 100)).toEqual({ start: 10, end: 19 });
-  });
-
-  test("bytes=90- (open-ended) → reads to EOF", () => {
-    expect(parseByteRangeHeader("bytes=90-", 100)).toEqual({ start: 90, end: 99 });
-  });
-
-  test("bytes=-10 (suffix range) → the last 10 bytes", () => {
-    expect(parseByteRangeHeader("bytes=-10", 100)).toEqual({ start: 90, end: 99 });
-  });
-
-  test("bytes=-1000 (suffix longer than the file) → clamps to the whole file", () => {
-    expect(parseByteRangeHeader("bytes=-1000", 100)).toEqual({ start: 0, end: 99 });
-  });
-
-  test("bytes=50-1000 (end past EOF) → clamps end to the last byte", () => {
-    expect(parseByteRangeHeader("bytes=50-1000", 100)).toEqual({ start: 50, end: 99 });
-  });
-
-  test("start past EOF → null (this function's own contract; a real Bun.serve() socket overrides with a native 416 — see doc comment)", () => {
-    expect(parseByteRangeHeader("bytes=100-200", 100)).toBeNull();
-    expect(parseByteRangeHeader("bytes=1000-", 100)).toBeNull();
-  });
-
-  test("start > end → null (malformed)", () => {
-    expect(parseByteRangeHeader("bytes=50-10", 100)).toBeNull();
-  });
-
-  test("bytes=- (both empty) → null", () => {
-    expect(parseByteRangeHeader("bytes=-", 100)).toBeNull();
-  });
-
-  test("a multi-range list (bytes=0-10,20-30) → null (ignored per D9, not an error)", () => {
-    expect(parseByteRangeHeader("bytes=0-10,20-30", 100)).toBeNull();
-  });
-
-  test("an unrecognized unit → null", () => {
-    expect(parseByteRangeHeader("items=0-10", 100)).toBeNull();
-  });
-
-  test("garbage value → null, not a throw", () => {
-    expect(parseByteRangeHeader("bytes=abc-def", 100)).toBeNull();
-    expect(parseByteRangeHeader("nonsense", 100)).toBeNull();
-  });
-
-  test("a zero-byte file → null regardless of header (nothing to range over)", () => {
-    expect(parseByteRangeHeader("bytes=0-0", 0)).toBeNull();
-  });
-});
-
-describe("storage GET Range support (vault attachments-for-agents design D9)", () => {
-  const VAULT = "range-vault";
-  // 26 bytes, byte-identical to its own index — content[i] === i (0x00..0x19)
-  // — so any slice's bytes can be asserted exactly by index, not just length.
-  const CONTENT = Buffer.from(Array.from({ length: 26 }, (_, i) => i));
-
-  async function setup(): Promise<{ store: SqliteStore; assets: string; relPath: string }> {
-    const store = freshStore();
-    const assets = join(testDir, "assets", VAULT, "data");
-    mkdirSync(join(assets, "2026-05-28"), { recursive: true });
-    process.env.ASSETS_DIR = assets;
-
-    const relPath = "2026-05-28/ranged.bin";
-    writeFileSync(join(assets, relPath), CONTENT);
-    const note = await store.createNote("range note", { tags: ["misc"] });
-    await store.addAttachment(note.id, relPath, "application/octet-stream");
-
-    return { store, assets, relPath };
-  }
-
-  function getReq(reqPath: string, range?: string): Request {
-    const headers: Record<string, string> = {};
-    if (range !== undefined) headers.range = range;
-    return new Request(`http://localhost:1940/storage/${reqPath}`, { method: "GET", headers });
-  }
-
-  test("no Range header → 200, full body, Accept-Ranges advertised", async () => {
-    const { store, relPath } = await setup();
-    const res = await handleStorage(getReq(relPath), `/${relPath}`, VAULT, store);
-    expect(res.status).toBe(200);
-    expect(res.headers.get("Accept-Ranges")).toBe("bytes");
-    expect(res.headers.get("Content-Length")).toBe("26");
-    expect(res.headers.has("Content-Range")).toBe(false);
-    const body = Buffer.from(await res.arrayBuffer());
-    expect(body.equals(CONTENT)).toBe(true);
-  });
-
-  test("Range: bytes=0-9 → 206, first 10 bytes, correct Content-Range", async () => {
-    const { store, relPath } = await setup();
-    const res = await handleStorage(getReq(relPath, "bytes=0-9"), `/${relPath}`, VAULT, store);
-    expect(res.status).toBe(206);
-    expect(res.headers.get("Content-Range")).toBe("bytes 0-9/26");
-    expect(res.headers.get("Content-Length")).toBe("10");
-    expect(res.headers.get("Accept-Ranges")).toBe("bytes");
-    expect(res.headers.get("X-Content-Type-Options")).toBe("nosniff");
-    const body = Buffer.from(await res.arrayBuffer());
-    expect(body.equals(CONTENT.subarray(0, 10))).toBe(true);
-  });
-
-  test("Range: bytes=16-25 (to EOF) → 206, correct tail bytes", async () => {
-    const { store, relPath } = await setup();
-    const res = await handleStorage(getReq(relPath, "bytes=16-25"), `/${relPath}`, VAULT, store);
-    expect(res.status).toBe(206);
-    expect(res.headers.get("Content-Range")).toBe("bytes 16-25/26");
-    const body = Buffer.from(await res.arrayBuffer());
-    expect(body.equals(CONTENT.subarray(16, 26))).toBe(true);
-  });
-
-  test("Range: bytes=-5 (suffix) → 206, last 5 bytes", async () => {
-    const { store, relPath } = await setup();
-    const res = await handleStorage(getReq(relPath, "bytes=-5"), `/${relPath}`, VAULT, store);
-    expect(res.status).toBe(206);
-    expect(res.headers.get("Content-Range")).toBe("bytes 21-25/26");
-    const body = Buffer.from(await res.arrayBuffer());
-    expect(body.equals(CONTENT.subarray(21, 26))).toBe(true);
-  });
-
-  test("paging the whole file via sequential ranges reassembles byte-identical content", async () => {
-    const { store, relPath } = await setup();
-    const chunkSize = 7; // doesn't divide 26 evenly — exercises a short final chunk
-    const chunks: Buffer[] = [];
-    for (let start = 0; start < 26; start += chunkSize) {
-      const end = Math.min(start + chunkSize - 1, 25);
-      const res = await handleStorage(getReq(relPath, `bytes=${start}-${end}`), `/${relPath}`, VAULT, store);
-      expect(res.status).toBe(206);
-      chunks.push(Buffer.from(await res.arrayBuffer()));
-    }
-    expect(Buffer.concat(chunks).equals(CONTENT)).toBe(true);
-  });
-
-  test("a malformed Range header → 200 full response, not an error (D9: ignore, don't fail)", async () => {
-    const { store, relPath } = await setup();
-    const res = await handleStorage(getReq(relPath, "not-a-range"), `/${relPath}`, VAULT, store);
-    expect(res.status).toBe(200);
-    expect(res.headers.has("Content-Range")).toBe(false);
-    const body = Buffer.from(await res.arrayBuffer());
-    expect(body.equals(CONTENT)).toBe(true);
-  });
-
-  test("a multi-range Range header → 200 full response (multipart ranges unsupported, ignored per D9)", async () => {
-    const { store, relPath } = await setup();
-    const res = await handleStorage(getReq(relPath, "bytes=0-5,10-15"), `/${relPath}`, VAULT, store);
-    expect(res.status).toBe(200);
-    const body = Buffer.from(await res.arrayBuffer());
-    expect(body.equals(CONTENT)).toBe(true);
-  });
-
-  test("an unsatisfiable Range (start past EOF) → handleStorage's OWN logic returns 200 (parseByteRangeHeader's null contract)", async () => {
-    // IMPORTANT — this is NOT the whole live story. `handleStorage` is
-    // called here directly, in-process, so this only exercises OUR
-    // fallback logic (parseByteRangeHeader → null → the unranged 200
-    // branch). Live-verified against a real `Bun.serve()` socket (not
-    // this harness): Bun's own runtime independently reinterprets the
-    // incoming `Range` header on a `Bun.file()`-backed response body and
-    // overrides an out-of-bounds range with a native
-    // **416 Range Not Satisfiable** — RFC 7233-correct, and kept, not
-    // fought. This in-process harness has no socket for Bun's native
-    // layer to intercept, so it can only ever observe the 200 our own
-    // code returns — see `parseByteRangeHeader`'s doc comment
-    // (`src/routes.ts`) for the full explanation.
-    const { store, relPath } = await setup();
-    const res = await handleStorage(getReq(relPath, "bytes=1000-2000"), `/${relPath}`, VAULT, store);
-    expect(res.status).toBe(200);
-    const body = Buffer.from(await res.arrayBuffer());
-    expect(body.equals(CONTENT)).toBe(true);
-  });
-
-  test("Range is still honored for a tag-scoped in-scope request (206)", async () => {
-    const { store, relPath } = await setup();
-    const ctx = await tagScopeCtx(store, ["misc"]);
-    const res = await handleStorage(getReq(relPath, "bytes=0-3"), `/${relPath}`, VAULT, store, ctx);
-    expect(res.status).toBe(206);
-    const body = Buffer.from(await res.arrayBuffer());
-    expect(body.equals(CONTENT.subarray(0, 4))).toBe(true);
-  });
-
-  test("Range on an out-of-scope attachment still 404s (same confinement guard, byte-identical to the non-ranged path)", async () => {
-    const { store, relPath } = await setup();
-    const ctx = await tagScopeCtx(store, ["totally-unrelated-tag"]);
-    const res = await handleStorage(getReq(relPath, "bytes=0-3"), `/${relPath}`, VAULT, store, ctx);
-    expect(res.status).toBe(404);
-  });
-});