@workos/oagen-emitters 0.18.4 → 0.19.1

package/src/rust/enums.ts

@@ -1,5 +1,6 @@
 import type { Enum, EmitterContext, GeneratedFile } from '@workos/oagen';
 import { typeName, moduleName, variantName } from './naming.js';
+import { isEnumInScope, fileExistsAfterRun, priorManifestBasenames } from '../shared/resolved-ops.js';
 
 /**
  * Generate one Rust source file per enum under `src/enums/`, plus a
@@ -17,7 +18,7 @@ import { typeName, moduleName, variantName } from './naming.js';
  *     variant and re-serialize as the canonical wire string.
  *   - `Display`, `FromStr`, and `AsRef<str>` are implemented for ergonomics.
  */
-export function generateEnums(enums: Enum[], _ctx: EmitterContext): GeneratedFile[] {
+export function generateEnums(enums: Enum[], ctx: EmitterContext): GeneratedFile[] {
   const files: GeneratedFile[] = [];
   const seen = new Set<string>();
   const moduleNames: string[] = [];
@@ -27,13 +28,34 @@ export function generateEnums(enums: Enum[], _ctx: EmitterContext): GeneratedFil
     const mod = moduleName(e.name);
     if (seen.has(mod)) continue;
     seen.add(mod);
-    moduleNames.push(mod);
 
-    files.push({
-      path: `src/enums/${mod}.rs`,
-      content: renderEnum(e),
-      overwriteExisting: true,
-    });
+    // Only the per-enum `.rs` FILE write is scoped (FR-1.4); an out-of-scope
+    // enum's existing `.rs` file stays untouched on disk.
+    const inScope = isEnumInScope(e.name, ctx);
+    const path = `src/enums/${mod}.rs`;
+    if (inScope) {
+      files.push({
+        path,
+        content: renderEnum(e),
+        overwriteExisting: true,
+      });
+    }
+
+    // Declare the module only if its file will exist on disk after this run, so
+    // a scoped run never declares a brand-new out-of-scope enum it doesn't emit.
+    if (fileExistsAfterRun(path, inScope, ctx)) {
+      moduleNames.push(mod);
+    }
+  }
+
+  // Scoped runs: retain barrel entries for enum files still on disk (prior
+  // manifest) that the current spec no longer produces (e.g. renamed for
+  // another service), since out-of-scope code may still reference them.
+  for (const base of priorManifestBasenames(ctx, 'src/enums', '.rs', new Set(['mod']))) {
+    if (!seen.has(base)) {
+      seen.add(base);
+      moduleNames.push(base);
+    }
   }
 
   files.push({

package/src/rust/fixtures.ts

@@ -1,12 +1,19 @@
-import type { ApiSpec, GeneratedFile, Model, Enum, TypeRef } from '@workos/oagen';
+import type { ApiSpec, GeneratedFile, Model, Enum, TypeRef, EmitterContext } from '@workos/oagen';
 import { walkTypeRef } from '@workos/oagen';
 import { moduleName } from './naming.js';
+import { isModelInScope, fileExistsAfterRun } from '../shared/resolved-ops.js';
 
 /**
  * Generate JSON test fixture files under `tests/fixtures/`. The Rust tests
  * pull these in via `include_str!` so no I/O is required at test time.
+ *
+ * Scoped runs only emit a fixture for a model whose file will exist on disk
+ * after the run (in-scope, or already present from a prior run). Emitting a
+ * fixture for a brand-new out-of-scope model would add a stray file for a model
+ * the SDK can't even reference yet; in-scope tests only `include_str!` fixtures
+ * for in-scope models, so gating here is safe.
  */
-export function generateFixtures(spec: ApiSpec): GeneratedFile[] {
+export function generateFixtures(spec: ApiSpec, ctx: EmitterContext): GeneratedFile[] {
   const files: GeneratedFile[] = [];
   const modelMap = new Map(spec.models.map((m) => [m.name, m]));
   const enumMap = new Map(spec.enums.map((e) => [e.name, e]));
@@ -17,8 +24,10 @@ export function generateFixtures(spec: ApiSpec): GeneratedFile[] {
     if (model.fields.length === 0) continue;
     seen.add(model.name);
 
-    const fixture = generateModelFixture(model, modelMap, enumMap, new Set());
     const path = `tests/fixtures/${moduleName(model.name)}.json`;
+    if (!fileExistsAfterRun(path, isModelInScope(model.name, ctx), ctx)) continue;
+
+    const fixture = generateModelFixture(model, modelMap, enumMap, new Set());
     files.push({
       path,
       content: JSON.stringify(fixture, null, 2) + '\n',

package/src/rust/models.ts

@@ -2,6 +2,7 @@ import type { Model, EmitterContext, GeneratedFile, Field, TypeRef } from '@work
 import { typeName, domainFieldName, moduleName } from './naming.js';
 import { mapTypeRef, makeOptional, UnionRegistry } from './type-map.js';
 import { applySecretRedaction } from './secret.js';
+import { isModelInScope, fileExistsAfterRun, priorManifestBasenames } from '../shared/resolved-ops.js';
 
 const HEADER_PLACEHOLDER = ''; // engine prepends fileHeader()
 
@@ -32,15 +33,45 @@ export function generateModels(models: Model[], ctx: EmitterContext, registry: U
     const mod = moduleName(model.name);
     if (seen.has(mod)) continue;
     seen.add(mod);
-    moduleNames.push(mod);
 
+    // renderModel registers inline unions into `registry` as a side effect, and
+    // `_unions.rs` is rendered later (in generateClient) from that registry — so
+    // it MUST run for every model, even out-of-scope ones, or scoped runs drop
+    // unions. Compute content unconditionally; only the per-model `.rs` FILE write
+    // is scoped (FR-1.4) — an out-of-scope model's existing `.rs` file stays
+    // untouched on disk.
+    const inScope = isModelInScope(model.name, ctx);
     const hintPath = ctx.overlayLookup?.fileBySymbol?.get(model.name);
     const path = hintPath ?? `src/models/${mod}.rs`;
-    files.push({
-      path,
-      content: renderModel(model, registry, taggedVariantFields.get(model.name)),
-      overwriteExisting: true,
-    });
+    const content = renderModel(model, registry, taggedVariantFields.get(model.name));
+    if (inScope) {
+      files.push({
+        path,
+        content,
+        overwriteExisting: true,
+      });
+    }
+
+    // Declare the module only if its `.rs` file will exist on disk after this
+    // run: in-scope (emitted just now) or already present from a prior run. A
+    // scoped run must NOT declare a brand-new out-of-scope model whose file it
+    // never emits — that dangling `mod` is what broke the build. A full run
+    // declares every module (fileExistsAfterRun ⇒ true when scoping is inert).
+    if (fileExistsAfterRun(path, inScope, ctx)) {
+      moduleNames.push(mod);
+    }
+  }
+
+  // Scoped runs: retain barrel entries for model files still on disk (prior
+  // manifest) that the current spec no longer produces — e.g. a model renamed
+  // for another service. Out-of-scope code we did not regenerate may still
+  // reference them, so dropping the `mod` would break the build. De-duped
+  // against the modules declared above; a full run yields nothing here.
+  for (const base of priorManifestBasenames(ctx, 'src/models', '.rs', new Set([UNIONS_MODULE, 'mod']))) {
+    if (!seen.has(base)) {
+      seen.add(base);
+      moduleNames.push(base);
+    }
   }
 
   // Always include the unions module in the barrel so downstream stages

package/src/rust/resources.ts

@@ -14,7 +14,7 @@ import { fieldName, domainFieldName, methodName, typeName, moduleName, variantNa
 import { mapTypeRef, makeOptional, UnionRegistry } from './type-map.js';
 import { applySecretRedaction } from './secret.js';
 import { parsePathTemplate } from '../shared/path-template.js';
-import { groupByMount, buildResolvedLookup } from '../shared/resolved-ops.js';
+import { groupByMount, buildResolvedLookup, isMountInScope } from '../shared/resolved-ops.js';
 import { resolveWrapperParams, type ResolvedWrapperParam } from '../shared/wrapper-utils.js';
 
 /**
@@ -32,7 +32,14 @@ export function generateResources(_services: Service[], ctx: EmitterContext, reg
     if (group.operations.length === 0) continue;
     const basename = moduleName(mountName);
     const struct = mountStructName(mountName);
+    // The barrel (`src/resources/mod.rs`) must list every mount's module so
+    // Rust compiles even in a scoped run — `exports` is collected from the
+    // FULL groupByMount set regardless of scope.
     exports.push({ module: basename, struct });
+    // Only the per-service resource `.rs` FILE write is scoped. In a scoped
+    // run we skip emitting files for out-of-scope mounts, but the barrel above
+    // still references their modules (their existing `.rs` files stay on disk).
+    if (!isMountInScope(mountName, ctx)) continue;
     files.push({
       path: `src/resources/${basename}.rs`,
       content: renderMountGroup(mountName, group.resolvedOps, ctx, registry, lookup),

package/src/rust/tests.ts

@@ -11,7 +11,7 @@ import type {
   TypeRef,
 } from '@workos/oagen';
 import { methodName, moduleName, typeName } from './naming.js';
-import { groupByMount } from '../shared/resolved-ops.js';
+import { scopedMountGroups } from '../shared/resolved-ops.js';
 import { exampleFor, generateFixtures } from './fixtures.js';
 import { resolveWrapperParams } from '../shared/wrapper-utils.js';
 import { isInlineEnvelopeList } from './resources.js';
@@ -35,7 +35,7 @@ import { isInlineEnvelopeList } from './resources.js';
 export function generateTests(spec: ApiSpec, ctx: EmitterContext): GeneratedFile[] {
   const files: GeneratedFile[] = [];
 
-  files.push(...generateFixtures(spec));
+  files.push(...generateFixtures(spec, ctx));
 
   files.push({
     path: 'tests/common/mod.rs',
@@ -43,7 +43,7 @@ export function generateTests(spec: ApiSpec, ctx: EmitterContext): GeneratedFile
     overwriteExisting: true,
   });
 
-  const groups = groupByMount(ctx);
+  const groups = scopedMountGroups(ctx);
   const modelMap = new Map(spec.models.map((m) => [m.name, m]));
   const enumMap = new Map(spec.enums.map((e) => [e.name, e]));
 

package/src/shared/resolved-ops.ts

@@ -94,6 +94,110 @@ export function groupByMount(ctx: EmitterContext): Map<string, MountGroup> {
   return groups;
 }
 
+/**
+ * Like {@link groupByMount}, but for a scoped (`--services`) run returns ONLY the
+ * mount groups the run selected (`ctx.scopedServices`, POST-MOUNT names). When
+ * scoping is inactive the full set is returned unchanged.
+ *
+ * Use this for PER-SERVICE resource/test emission. Do NOT use it for
+ * aggregate/barrel files (Rust `mod.rs`, Ruby `client.rbi`, the root client) —
+ * those must continue to list every service, so they keep calling
+ * {@link groupByMount} over the full set; otherwise a scoped run would drop
+ * sibling modules and break the build/type-check.
+ */
+export function scopedMountGroups(ctx: EmitterContext): Map<string, MountGroup> {
+  const groups = groupByMount(ctx);
+  const scope = ctx.scopedServices;
+  if (!scope || scope.size === 0) return groups;
+  return new Map([...groups].filter(([mountName]) => scope.has(mountName)));
+}
+
+/**
+ * True when a POST-MOUNT service name should be emitted in the current run.
+ * Inactive scoping (no `ctx.scopedServices`) ⇒ everything is in scope. Use this
+ * for inline per-service gates (e.g. manifest loops keyed by `getMountTarget`).
+ */
+export function isMountInScope(mountName: string, ctx: EmitterContext): boolean {
+  const scope = ctx.scopedServices;
+  return !scope || scope.size === 0 || scope.has(mountName);
+}
+
+/**
+ * True when a MODEL's per-model FILE should be written in the current run (FR-1.4).
+ * A scoped run sets `ctx.scopedModelNames` to the models reachable from the
+ * selected services; out-of-scope models are left untouched on disk. Inactive
+ * scoping ⇒ everything is in scope. NOTE: gate only the per-model FILE write —
+ * the model must still appear in barrels/indexes (built from the full set) so the
+ * untouched on-disk file stays importable.
+ */
+export function isModelInScope(modelName: string, ctx: EmitterContext): boolean {
+  const scope = ctx.scopedModelNames;
+  return !scope || scope.has(modelName);
+}
+
+/** Like {@link isModelInScope} but for an ENUM's per-enum file (`ctx.scopedEnumNames`). */
+export function isEnumInScope(enumName: string, ctx: EmitterContext): boolean {
+  const scope = ctx.scopedEnumNames;
+  return !scope || scope.has(enumName);
+}
+
+/** True when a scoped (`--services`) run is active. */
+export function isScopedRun(ctx: EmitterContext): boolean {
+  return !!ctx.scopedServices && ctx.scopedServices.size > 0;
+}
+
+/**
+ * Barrel/index inclusion gate for one item (model, enum, fixture) under a
+ * scoped run. A barrel/index may only reference an item whose per-item FILE
+ * EXISTS ON DISK after the run — otherwise the reference dangles and the SDK
+ * fails to compile (the bug this guards: a brand-new model belonging to an
+ * out-of-scope service gets declared in `mod.rs`/`__init__.py` but its source
+ * file is never emitted). That on-disk set is:
+ *   in-scope items (freshly emitted this run) ∪ items already on disk
+ *   (recorded in the prior manifest, left untouched because scoped runs never
+ *   prune).
+ * Inactive scoping ⇒ always true (a full run emits and declares everything).
+ *
+ * `relPath` is the per-item file path the emitter writes (e.g.
+ * `src/models/foo.rs`); `inScope` is the per-item scope predicate result
+ * (`isModelInScope` / `isEnumInScope`).
+ */
+export function fileExistsAfterRun(relPath: string, inScope: boolean, ctx: EmitterContext): boolean {
+  if (!isScopedRun(ctx)) return true;
+  return inScope || (ctx.priorTargetManifestPaths?.has(relPath) ?? false);
+}
+
+/**
+ * Per-item basenames recorded in the prior manifest directly under `dir` (e.g.
+ * `src/models`) with extension `ext` (e.g. `.rs`), EXCLUDING `reserved` names
+ * (barrels such as `mod`, `_unions`, `__init__`). A scoped run uses this to
+ * RETAIN barrel declarations for items that were renamed/removed from the spec
+ * but whose files still sit on disk — and may still be referenced by
+ * out-of-scope code the scoped run did not regenerate (e.g. a stale resource
+ * file). Returns `[]` for a full run or when no prior manifest is available;
+ * the caller is responsible for de-duping against items it already emitted.
+ */
+export function priorManifestBasenames(
+  ctx: EmitterContext,
+  dir: string,
+  ext: string,
+  reserved: Set<string> = new Set(),
+): string[] {
+  if (!isScopedRun(ctx)) return [];
+  const paths = ctx.priorTargetManifestPaths;
+  if (!paths) return [];
+  const prefix = dir.endsWith('/') ? dir : `${dir}/`;
+  const out: string[] = [];
+  for (const p of paths) {
+    if (!p.startsWith(prefix) || !p.endsWith(ext)) continue;
+    const base = p.slice(prefix.length, p.length - ext.length);
+    if (base.includes('/')) continue; // direct children only
+    if (reserved.has(base)) continue;
+    out.push(base);
+  }
+  return out;
+}
+
 /**
  * Get the mount target for an IR service.
  * Checks the first resolved operation that belongs to this service.

package/test/dotnet/scoped-aggregates.test.ts

@@ -0,0 +1,247 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { dotnetEmitter } from '../../src/dotnet/index.js';
+import { generateTests } from '../../src/dotnet/tests.js';
+import { discriminatedUnions } from '../../src/dotnet/type-map.js';
+import { primeEnumAliases } from '../../src/dotnet/enums.js';
+import type { EmitterContext, ApiSpec, Model, Service } from '@workos/oagen';
+import { defaultSdkBehavior } from '@workos/oagen';
+
+/**
+ * Scoped (`--services`) runs emit per-model `Entities/*.cs` only for in-scope
+ * models, but the polymorphic-dispatch aggregates (discriminated-union JSON
+ * converters, per-model test fixtures) were previously built from the FULL
+ * spec. A brand-new out-of-scope variant would then be referenced by a
+ * converter whose `.cs` file is never emitted (CS0246). These tests assert the
+ * `fileExistsAfterRun` gate excludes brand-new out-of-scope items while
+ * retaining renamed/removed-but-still-on-disk ones.
+ */
+const emptySpec: ApiSpec = {
+  name: 'Test',
+  version: '1.0.0',
+  baseUrl: '',
+  services: [],
+  models: [],
+  enums: [],
+  sdk: defaultSdkBehavior(),
+};
+
+describe('dotnet/scoped aggregates', () => {
+  beforeEach(() => {
+    // discriminatedUnions is module-global and accumulates across mapTypeRef
+    // calls; clear it so each test sees only the unions it registers.
+    discriminatedUnions.clear();
+    primeEnumAliases([]);
+  });
+
+  it('gates the discriminated-union converter to variants whose .cs exists after a scoped run', () => {
+    // Parent model has a field typed as a discriminated union over three
+    // event-payload variants:
+    //   - UserCreated:             in-scope this run (emitted now)
+    //   - OrganizationDomainStandAlone: NOT in scope, but on disk (prior run) → retained
+    //   - SessionReauthenticated:  brand-new, NOT in scope, NOT on disk → excluded
+    const models: Model[] = [
+      {
+        name: 'WebhookEnvelope',
+        fields: [
+          { name: 'id', type: { kind: 'primitive', type: 'string' }, required: true },
+          {
+            name: 'payload',
+            type: {
+              kind: 'union',
+              variants: [
+                { kind: 'model', name: 'UserCreated' },
+                { kind: 'model', name: 'OrganizationDomainStandAlone' },
+                { kind: 'model', name: 'SessionReauthenticated' },
+              ],
+              discriminator: {
+                property: 'event',
+                mapping: {
+                  'user.created': 'UserCreated',
+                  'organization_domain.verified': 'OrganizationDomainStandAlone',
+                  'session.reauthenticated': 'SessionReauthenticated',
+                },
+              },
+            },
+            required: true,
+          },
+        ],
+      },
+      {
+        name: 'UserCreated',
+        fields: [{ name: 'user_id', type: { kind: 'primitive', type: 'string' }, required: true }],
+      },
+      {
+        name: 'OrganizationDomainStandAlone',
+        fields: [{ name: 'domain', type: { kind: 'primitive', type: 'string' }, required: true }],
+      },
+      {
+        name: 'SessionReauthenticated',
+        fields: [{ name: 'session_id', type: { kind: 'primitive', type: 'string' }, required: true }],
+      },
+    ];
+
+    const ctx: EmitterContext = {
+      namespace: 'workos',
+      namespacePascal: 'WorkOS',
+      spec: { ...emptySpec, models },
+      // Scoped to the WebhookEnvelope + UserCreated surface only.
+      scopedServices: new Set(['Webhooks']),
+      scopedModelNames: new Set(['WebhookEnvelope', 'UserCreated']),
+      // OrganizationDomainStandAlone exists on disk from a prior full run; the
+      // brand-new SessionReauthenticated does not.
+      priorTargetManifestPaths: new Set([
+        'src/WorkOS.net/Entities/WebhookEnvelope.cs',
+        'src/WorkOS.net/Entities/UserCreated.cs',
+        'src/WorkOS.net/Entities/OrganizationDomainStandAlone.cs',
+      ]),
+    };
+
+    const files = dotnetEmitter.generateModels!(models, ctx);
+    const converter = files.find((f) => f.path.includes('DiscriminatorConverter.cs'));
+    expect(converter).toBeDefined();
+    const content = converter!.content;
+
+    // In-scope variant is dispatched.
+    expect(content).toContain('case "user.created": return jObject.ToObject<UserCreated>(serializer);');
+    // Renamed/removed-but-on-disk variant is retained.
+    expect(content).toContain(
+      'case "organization_domain.verified": return jObject.ToObject<OrganizationDomainStandAlone>(serializer);',
+    );
+    // Brand-new out-of-scope variant is EXCLUDED (its .cs is never emitted → CS0246).
+    expect(content).not.toContain('SessionReauthenticated');
+    expect(content).not.toContain('session.reauthenticated');
+  });
+
+  it('emits all converter variants on a full (unscoped) run', () => {
+    const models: Model[] = [
+      {
+        name: 'WebhookEnvelope',
+        fields: [
+          {
+            name: 'payload',
+            type: {
+              kind: 'union',
+              variants: [
+                { kind: 'model', name: 'UserCreated' },
+                { kind: 'model', name: 'SessionReauthenticated' },
+              ],
+              discriminator: {
+                property: 'event',
+                mapping: {
+                  'user.created': 'UserCreated',
+                  'session.reauthenticated': 'SessionReauthenticated',
+                },
+              },
+            },
+            required: true,
+          },
+        ],
+      },
+      {
+        name: 'UserCreated',
+        fields: [{ name: 'user_id', type: { kind: 'primitive', type: 'string' }, required: true }],
+      },
+      {
+        name: 'SessionReauthenticated',
+        fields: [{ name: 'session_id', type: { kind: 'primitive', type: 'string' }, required: true }],
+      },
+    ];
+
+    // No scopedServices → full run; every variant is dispatched.
+    const ctx: EmitterContext = {
+      namespace: 'workos',
+      namespacePascal: 'WorkOS',
+      spec: { ...emptySpec, models },
+    };
+
+    const files = dotnetEmitter.generateModels!(models, ctx);
+    const converter = files.find((f) => f.path.includes('DiscriminatorConverter.cs'))!;
+    expect(converter.content).toContain('ToObject<UserCreated>');
+    expect(converter.content).toContain('ToObject<SessionReauthenticated>');
+  });
+
+  it('gates per-model fixtures to models whose file exists after a scoped run', () => {
+    const models: Model[] = [
+      {
+        name: 'OrganizationMembership',
+        fields: [{ name: 'id', type: { kind: 'primitive', type: 'string' }, required: true }],
+      },
+      {
+        name: 'OrganizationDomainStandAlone',
+        fields: [{ name: 'domain', type: { kind: 'primitive', type: 'string' }, required: true }],
+      },
+      {
+        name: 'SessionReauthenticated',
+        fields: [{ name: 'session_id', type: { kind: 'primitive', type: 'string' }, required: true }],
+      },
+    ];
+
+    const services: Service[] = [
+      {
+        name: 'OrganizationMemberships',
+        operations: [
+          {
+            name: 'getOrganizationMembership',
+            httpMethod: 'get',
+            path: '/organization_memberships/{id}',
+            pathParams: [{ name: 'id', type: { kind: 'primitive', type: 'string' }, required: true }],
+            queryParams: [],
+            headerParams: [],
+            response: { kind: 'model', name: 'OrganizationMembership' },
+            errors: [],
+            injectIdempotencyKey: false,
+          },
+        ],
+      },
+    ];
+
+    const spec: ApiSpec = { ...emptySpec, services, models };
+    const ctx: EmitterContext = {
+      namespace: 'workos',
+      namespacePascal: 'WorkOS',
+      spec,
+      scopedServices: new Set(['OrganizationMemberships']),
+      scopedModelNames: new Set(['OrganizationMembership']),
+      // The renamed/removed model is on disk; the brand-new one is not.
+      priorTargetManifestPaths: new Set([
+        'test/WorkOSTests/testdata/organization_membership.json',
+        'test/WorkOSTests/testdata/organization_domain_stand_alone.json',
+      ]),
+    };
+
+    const files = generateTests(spec, ctx);
+    const paths = files.map((f) => f.path);
+
+    // In-scope model fixture is emitted.
+    expect(paths).toContain('testdata/organization_membership.json');
+    // Renamed/removed-but-on-disk fixture is retained.
+    expect(paths).toContain('testdata/organization_domain_stand_alone.json');
+    // Brand-new out-of-scope fixture is EXCLUDED (stray file for an
+    // unreferenceable model).
+    expect(paths.some((p) => p.includes('session_reauthenticated'))).toBe(false);
+  });
+
+  it('emits all per-model fixtures on a full (unscoped) run', () => {
+    const models: Model[] = [
+      {
+        name: 'OrganizationMembership',
+        fields: [{ name: 'id', type: { kind: 'primitive', type: 'string' }, required: true }],
+      },
+      {
+        name: 'SessionReauthenticated',
+        fields: [{ name: 'session_id', type: { kind: 'primitive', type: 'string' }, required: true }],
+      },
+    ];
+    const spec: ApiSpec = { ...emptySpec, models };
+    const ctx: EmitterContext = {
+      namespace: 'workos',
+      namespacePascal: 'WorkOS',
+      spec,
+    };
+
+    const files = generateTests(spec, ctx);
+    const paths = files.map((f) => f.path);
+    expect(paths).toContain('testdata/organization_membership.json');
+    expect(paths.some((p) => p.includes('session_reauthenticated'))).toBe(true);
+  });
+});