bonecode 1.0.0 → 1.2.0

package/bone/output/session/src/tests.ts

@@ -1,326 +1,326 @@
-// Generated by BoneScript compiler. DO NOT EDIT.
-// Regression tests derived from capability declarations.
-// Run: npx ts-node src/tests.ts
-
-import * as http from "http";
-
-const BASE_URL = process.env.TEST_BASE_URL || "http://localhost:3000";
-const AUTH_TOKEN = process.env.TEST_AUTH_TOKEN || "";
-
-let passed = 0;
-let failed = 0;
-
-async function request(method: string, path: string, body?: any): Promise<{ status: number; data: any }> {
-  const url = new URL(path, BASE_URL);
-  const res = await fetch(url.toString(), {
-    method,
-    headers: {
-      "Content-Type": "application/json",
-      ...(AUTH_TOKEN ? { "Authorization": `Bearer ${AUTH_TOKEN}` } : {}),
-    },
-    body: body ? JSON.stringify(body) : undefined,
-  });
-  const data = await res.json().catch(() => ({}));
-  return { status: res.status, data };
-}
-
-async function test(name: string, fn: () => Promise<void>): Promise<void> {
-  try {
-    await fn();
-    console.log(`  ✓ ${name}`);
-    passed++;
-  } catch (e: any) {
-    console.log(`  ✗ ${name}: ${e.message}`);
-    failed++;
-  }
-}
-
-function assert(condition: boolean, message: string): void {
-  if (!condition) throw new Error(message);
-}
-
-(async () => {
-// ─── ProjectService Tests ─────────────────────────────────────────────────────
-
-console.log("\nProjectService — CRUD");
-
-let __project_id: string;
-
-await test("POST /projects — creates entity", async () => {
-  const { status, data } = await request("POST", "/projects", {"root_commit_hash":"test_value","worktree":"test_value","vcs":"test_value","name":"test_value","sandboxes":{}});
-  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
-  assert(data.id, "Response must have id");
-  __project_id = data.id;
-});
-
-await test("GET /projects/:id — reads entity", async () => {
-  const { status, data } = await request("GET", `/projects/${__project_id}`);
-  assert(status === 200, `Expected 200, got ${status}`);
-  assert(data.id === __project_id, "ID must match");
-});
-
-await test("GET /projects — lists entities", async () => {
-  const { status, data } = await request("GET", "/projects");
-  assert(status === 200, `Expected 200, got ${status}`);
-  assert(Array.isArray(data.items), "Response must have items array");
-  assert(typeof data.total === "number", "Response must have total");
-});
-
-await test("GET /projects — rejects unauthenticated", async () => {
-  const res = await fetch(`${BASE_URL}/projects`);
-  assert(res.status === 401, `Expected 401, got ${res.status}`);
-});
-
-await test("DELETE /projects/:id — deletes entity", async () => {
-  const { status } = await request("DELETE", `/projects/${__project_id}`);
-  assert(status === 204, `Expected 204, got ${status}`);
-});
-
-await test("GET /projects/:id — returns 404 after delete", async () => {
-  const { status } = await request("GET", `/projects/${__project_id}`);
-  assert(status === 404, `Expected 404, got ${status}`);
-});
-
-// ─── SessionService Tests ─────────────────────────────────────────────────────
-
-console.log("\nSessionService — CRUD");
-
-let __session_id: string;
-
-await test("POST /sessions — creates entity", async () => {
-  const { status, data } = await request("POST", "/sessions", {"slug":"test_value","project_id":"00000000-0000-0000-0000-000000000001","workspace_id":null,"parent_id":null,"directory":"test_value","title":"test_value","version":"test_value","share_url":null,"summary_additions":null,"summary_deletions":null,"summary_files":null,"summary_diffs":null,"revert_data":null,"permission_ruleset":null});
-  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
-  assert(data.id, "Response must have id");
-  __session_id = data.id;
-});
-
-await test("GET /sessions/:id — reads entity", async () => {
-  const { status, data } = await request("GET", `/sessions/${__session_id}`);
-  assert(status === 200, `Expected 200, got ${status}`);
-  assert(data.id === __session_id, "ID must match");
-});
-
-await test("GET /sessions — lists entities", async () => {
-  const { status, data } = await request("GET", "/sessions");
-  assert(status === 200, `Expected 200, got ${status}`);
-  assert(Array.isArray(data.items), "Response must have items array");
-  assert(typeof data.total === "number", "Response must have total");
-});
-
-await test("GET /sessions — rejects unauthenticated", async () => {
-  const res = await fetch(`${BASE_URL}/sessions`);
-  assert(res.status === 401, `Expected 401, got ${res.status}`);
-});
-
-await test("POST /sessions/archive-session — capability executes", async () => {
-  const { status, data } = await request("POST", "/sessions/archive-session", {
-    session_id: __session_id,
-  });
-  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
-  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
-});
-
-await test("POST /sessions/archive-session — returns 401 without auth", async () => {
-  const res = await fetch(`${BASE_URL}/sessions/archive-session`, { method: "POST" });
-  assert(res.status === 401, `Expected 401, got ${res.status}`);
-});
-
-await test("POST /sessions/delete-session — capability executes", async () => {
-  const { status, data } = await request("POST", "/sessions/delete-session", {
-    session_id: __session_id,
-  });
-  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
-  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
-});
-
-await test("POST /sessions/delete-session — returns 401 without auth", async () => {
-  const res = await fetch(`${BASE_URL}/sessions/delete-session`, { method: "POST" });
-  assert(res.status === 401, `Expected 401, got ${res.status}`);
-});
-
-await test("POST /sessions/add-message — capability executes", async () => {
-  const { status, data } = await request("POST", "/sessions/add-message", {
-    session_id: __session_id,
-  });
-  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
-  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
-});
-
-await test("POST /sessions/add-message — returns 401 without auth", async () => {
-  const res = await fetch(`${BASE_URL}/sessions/add-message`, { method: "POST" });
-  assert(res.status === 401, `Expected 401, got ${res.status}`);
-});
-
-await test("POST /sessions/update-part — capability executes", async () => {
-  const { status, data } = await request("POST", "/sessions/update-part", {
-    session_id: __session_id,
-  });
-  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
-  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
-});
-
-await test("POST /sessions/update-part — returns 401 without auth", async () => {
-  const res = await fetch(`${BASE_URL}/sessions/update-part`, { method: "POST" });
-  assert(res.status === 401, `Expected 401, got ${res.status}`);
-});
-
-await test("POST /sessions/compact-session — capability executes", async () => {
-  const { status, data } = await request("POST", "/sessions/compact-session", {
-    session_id: __session_id,
-  });
-  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
-  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
-});
-
-await test("POST /sessions/compact-session — returns 401 without auth", async () => {
-  const res = await fetch(`${BASE_URL}/sessions/compact-session`, { method: "POST" });
-  assert(res.status === 401, `Expected 401, got ${res.status}`);
-});
-
-// State machine: Session
-await test("PUT /sessions/:id — rejects invalid state transition", async () => {
-  const { status, data } = await request("PUT", `/sessions/${__session_id}`, {
-    state: "__invalid_state__",
-  });
-  assert(status === 422, `Expected 422 for invalid transition, got ${status}`);
-  assert(data.error?.code === "INVALID_TRANSITION", "Error code must be INVALID_TRANSITION");
-});
-
-await test("DELETE /sessions/:id — deletes entity", async () => {
-  const { status } = await request("DELETE", `/sessions/${__session_id}`);
-  assert(status === 204, `Expected 204, got ${status}`);
-});
-
-await test("GET /sessions/:id — returns 404 after delete", async () => {
-  const { status } = await request("GET", `/sessions/${__session_id}`);
-  assert(status === 404, `Expected 404, got ${status}`);
-});
-
-// ─── MessageService Tests ─────────────────────────────────────────────────────
-
-console.log("\nMessageService — CRUD");
-
-let __message_id: string;
-
-await test("POST /messages — creates entity", async () => {
-  const { status, data } = await request("POST", "/messages", {"session_id":"00000000-0000-0000-0000-000000000001","role":"test_value","model_id":null,"provider_id":null,"tokens_input":null,"tokens_output":null,"cost_usd":null,"error":null});
-  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
-  assert(data.id, "Response must have id");
-  __message_id = data.id;
-});
-
-await test("GET /messages/:id — reads entity", async () => {
-  const { status, data } = await request("GET", `/messages/${__message_id}`);
-  assert(status === 200, `Expected 200, got ${status}`);
-  assert(data.id === __message_id, "ID must match");
-});
-
-await test("GET /messages — lists entities", async () => {
-  const { status, data } = await request("GET", "/messages");
-  assert(status === 200, `Expected 200, got ${status}`);
-  assert(Array.isArray(data.items), "Response must have items array");
-  assert(typeof data.total === "number", "Response must have total");
-});
-
-await test("GET /messages — rejects unauthenticated", async () => {
-  const res = await fetch(`${BASE_URL}/messages`);
-  assert(res.status === 401, `Expected 401, got ${res.status}`);
-});
-
-await test("DELETE /messages/:id — deletes entity", async () => {
-  const { status } = await request("DELETE", `/messages/${__message_id}`);
-  assert(status === 204, `Expected 204, got ${status}`);
-});
-
-await test("GET /messages/:id — returns 404 after delete", async () => {
-  const { status } = await request("GET", `/messages/${__message_id}`);
-  assert(status === 404, `Expected 404, got ${status}`);
-});
-
-// ─── PartService Tests ─────────────────────────────────────────────────────
-
-console.log("\nPartService — CRUD");
-
-let __part_id: string;
-
-await test("POST /parts — creates entity", async () => {
-  const { status, data } = await request("POST", "/parts", {"message_id":"00000000-0000-0000-0000-000000000001","session_id":"00000000-0000-0000-0000-000000000001","part_type":"test_value","data":{},"order_index":1});
-  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
-  assert(data.id, "Response must have id");
-  __part_id = data.id;
-});
-
-await test("GET /parts/:id — reads entity", async () => {
-  const { status, data } = await request("GET", `/parts/${__part_id}`);
-  assert(status === 200, `Expected 200, got ${status}`);
-  assert(data.id === __part_id, "ID must match");
-});
-
-await test("GET /parts — lists entities", async () => {
-  const { status, data } = await request("GET", "/parts");
-  assert(status === 200, `Expected 200, got ${status}`);
-  assert(Array.isArray(data.items), "Response must have items array");
-  assert(typeof data.total === "number", "Response must have total");
-});
-
-await test("GET /parts — rejects unauthenticated", async () => {
-  const res = await fetch(`${BASE_URL}/parts`);
-  assert(res.status === 401, `Expected 401, got ${res.status}`);
-});
-
-await test("DELETE /parts/:id — deletes entity", async () => {
-  const { status } = await request("DELETE", `/parts/${__part_id}`);
-  assert(status === 204, `Expected 204, got ${status}`);
-});
-
-await test("GET /parts/:id — returns 404 after delete", async () => {
-  const { status } = await request("GET", `/parts/${__part_id}`);
-  assert(status === 404, `Expected 404, got ${status}`);
-});
-
-// ─── PermissionService Tests ─────────────────────────────────────────────────────
-
-console.log("\nPermissionService — CRUD");
-
-let __permission_id: string;
-
-await test("POST /permissions — creates entity", async () => {
-  const { status, data } = await request("POST", "/permissions", {"session_id":"00000000-0000-0000-0000-000000000001","tool_name":"test_value","pattern":null,"decision":"test_value","expires_at":null});
-  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
-  assert(data.id, "Response must have id");
-  __permission_id = data.id;
-});
-
-await test("GET /permissions/:id — reads entity", async () => {
-  const { status, data } = await request("GET", `/permissions/${__permission_id}`);
-  assert(status === 200, `Expected 200, got ${status}`);
-  assert(data.id === __permission_id, "ID must match");
-});
-
-await test("GET /permissions — lists entities", async () => {
-  const { status, data } = await request("GET", "/permissions");
-  assert(status === 200, `Expected 200, got ${status}`);
-  assert(Array.isArray(data.items), "Response must have items array");
-  assert(typeof data.total === "number", "Response must have total");
-});
-
-await test("GET /permissions — rejects unauthenticated", async () => {
-  const res = await fetch(`${BASE_URL}/permissions`);
-  assert(res.status === 401, `Expected 401, got ${res.status}`);
-});
-
-await test("DELETE /permissions/:id — deletes entity", async () => {
-  const { status } = await request("DELETE", `/permissions/${__permission_id}`);
-  assert(status === 204, `Expected 204, got ${status}`);
-});
-
-await test("GET /permissions/:id — returns 404 after delete", async () => {
-  const { status } = await request("GET", `/permissions/${__permission_id}`);
-  assert(status === 404, `Expected 404, got ${status}`);
-});
-
-console.log(`\n════════════════════════════════════════`);
-console.log(`Results: ${passed} passed, ${failed} failed`);
-console.log("═".repeat(40));
-if (failed > 0) process.exit(1);
+// Generated by BoneScript compiler. DO NOT EDIT.
+// Regression tests derived from capability declarations.
+// Run: npx ts-node src/tests.ts
+
+import * as http from "http";
+
+const BASE_URL = process.env.TEST_BASE_URL || "http://localhost:3000";
+const AUTH_TOKEN = process.env.TEST_AUTH_TOKEN || "";
+
+let passed = 0;
+let failed = 0;
+
+async function request(method: string, path: string, body?: any): Promise<{ status: number; data: any }> {
+  const url = new URL(path, BASE_URL);
+  const res = await fetch(url.toString(), {
+    method,
+    headers: {
+      "Content-Type": "application/json",
+      ...(AUTH_TOKEN ? { "Authorization": `Bearer ${AUTH_TOKEN}` } : {}),
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  const data = await res.json().catch(() => ({}));
+  return { status: res.status, data };
+}
+
+async function test(name: string, fn: () => Promise<void>): Promise<void> {
+  try {
+    await fn();
+    console.log(`  ✓ ${name}`);
+    passed++;
+  } catch (e: any) {
+    console.log(`  ✗ ${name}: ${e.message}`);
+    failed++;
+  }
+}
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) throw new Error(message);
+}
+
+(async () => {
+// ─── ProjectService Tests ─────────────────────────────────────────────────────
+
+console.log("\nProjectService — CRUD");
+
+let __project_id: string;
+
+await test("POST /projects — creates entity", async () => {
+  const { status, data } = await request("POST", "/projects", {"root_commit_hash":"test_value","worktree":"test_value","vcs":"test_value","name":"test_value","sandboxes":{}});
+  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
+  assert(data.id, "Response must have id");
+  __project_id = data.id;
+});
+
+await test("GET /projects/:id — reads entity", async () => {
+  const { status, data } = await request("GET", `/projects/${__project_id}`);
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(data.id === __project_id, "ID must match");
+});
+
+await test("GET /projects — lists entities", async () => {
+  const { status, data } = await request("GET", "/projects");
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(Array.isArray(data.items), "Response must have items array");
+  assert(typeof data.total === "number", "Response must have total");
+});
+
+await test("GET /projects — rejects unauthenticated", async () => {
+  const res = await fetch(`${BASE_URL}/projects`);
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("DELETE /projects/:id — deletes entity", async () => {
+  const { status } = await request("DELETE", `/projects/${__project_id}`);
+  assert(status === 204, `Expected 204, got ${status}`);
+});
+
+await test("GET /projects/:id — returns 404 after delete", async () => {
+  const { status } = await request("GET", `/projects/${__project_id}`);
+  assert(status === 404, `Expected 404, got ${status}`);
+});
+
+// ─── SessionService Tests ─────────────────────────────────────────────────────
+
+console.log("\nSessionService — CRUD");
+
+let __session_id: string;
+
+await test("POST /sessions — creates entity", async () => {
+  const { status, data } = await request("POST", "/sessions", {"slug":"test_value","project_id":"00000000-0000-0000-0000-000000000001","workspace_id":null,"parent_id":null,"directory":"test_value","title":"test_value","version":"test_value","share_url":null,"summary_additions":null,"summary_deletions":null,"summary_files":null,"summary_diffs":null,"revert_data":null,"permission_ruleset":null});
+  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
+  assert(data.id, "Response must have id");
+  __session_id = data.id;
+});
+
+await test("GET /sessions/:id — reads entity", async () => {
+  const { status, data } = await request("GET", `/sessions/${__session_id}`);
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(data.id === __session_id, "ID must match");
+});
+
+await test("GET /sessions — lists entities", async () => {
+  const { status, data } = await request("GET", "/sessions");
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(Array.isArray(data.items), "Response must have items array");
+  assert(typeof data.total === "number", "Response must have total");
+});
+
+await test("GET /sessions — rejects unauthenticated", async () => {
+  const res = await fetch(`${BASE_URL}/sessions`);
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("POST /sessions/archive-session — capability executes", async () => {
+  const { status, data } = await request("POST", "/sessions/archive-session", {
+    session_id: __session_id,
+  });
+  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
+  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
+});
+
+await test("POST /sessions/archive-session — returns 401 without auth", async () => {
+  const res = await fetch(`${BASE_URL}/sessions/archive-session`, { method: "POST" });
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("POST /sessions/delete-session — capability executes", async () => {
+  const { status, data } = await request("POST", "/sessions/delete-session", {
+    session_id: __session_id,
+  });
+  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
+  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
+});
+
+await test("POST /sessions/delete-session — returns 401 without auth", async () => {
+  const res = await fetch(`${BASE_URL}/sessions/delete-session`, { method: "POST" });
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("POST /sessions/add-message — capability executes", async () => {
+  const { status, data } = await request("POST", "/sessions/add-message", {
+    session_id: __session_id,
+  });
+  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
+  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
+});
+
+await test("POST /sessions/add-message — returns 401 without auth", async () => {
+  const res = await fetch(`${BASE_URL}/sessions/add-message`, { method: "POST" });
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("POST /sessions/update-part — capability executes", async () => {
+  const { status, data } = await request("POST", "/sessions/update-part", {
+    session_id: __session_id,
+  });
+  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
+  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
+});
+
+await test("POST /sessions/update-part — returns 401 without auth", async () => {
+  const res = await fetch(`${BASE_URL}/sessions/update-part`, { method: "POST" });
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("POST /sessions/compact-session — capability executes", async () => {
+  const { status, data } = await request("POST", "/sessions/compact-session", {
+    session_id: __session_id,
+  });
+  // Capability may return 200 (success) or 422 (precondition failed) — both are valid
+  assert([200, 422].includes(status), `Expected 200 or 422, got ${status}: ${JSON.stringify(data)}`);
+});
+
+await test("POST /sessions/compact-session — returns 401 without auth", async () => {
+  const res = await fetch(`${BASE_URL}/sessions/compact-session`, { method: "POST" });
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+// State machine: Session
+await test("PUT /sessions/:id — rejects invalid state transition", async () => {
+  const { status, data } = await request("PUT", `/sessions/${__session_id}`, {
+    state: "__invalid_state__",
+  });
+  assert(status === 422, `Expected 422 for invalid transition, got ${status}`);
+  assert(data.error?.code === "INVALID_TRANSITION", "Error code must be INVALID_TRANSITION");
+});
+
+await test("DELETE /sessions/:id — deletes entity", async () => {
+  const { status } = await request("DELETE", `/sessions/${__session_id}`);
+  assert(status === 204, `Expected 204, got ${status}`);
+});
+
+await test("GET /sessions/:id — returns 404 after delete", async () => {
+  const { status } = await request("GET", `/sessions/${__session_id}`);
+  assert(status === 404, `Expected 404, got ${status}`);
+});
+
+// ─── MessageService Tests ─────────────────────────────────────────────────────
+
+console.log("\nMessageService — CRUD");
+
+let __message_id: string;
+
+await test("POST /messages — creates entity", async () => {
+  const { status, data } = await request("POST", "/messages", {"session_id":"00000000-0000-0000-0000-000000000001","role":"test_value","model_id":null,"provider_id":null,"tokens_input":null,"tokens_output":null,"cost_usd":null,"error":null});
+  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
+  assert(data.id, "Response must have id");
+  __message_id = data.id;
+});
+
+await test("GET /messages/:id — reads entity", async () => {
+  const { status, data } = await request("GET", `/messages/${__message_id}`);
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(data.id === __message_id, "ID must match");
+});
+
+await test("GET /messages — lists entities", async () => {
+  const { status, data } = await request("GET", "/messages");
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(Array.isArray(data.items), "Response must have items array");
+  assert(typeof data.total === "number", "Response must have total");
+});
+
+await test("GET /messages — rejects unauthenticated", async () => {
+  const res = await fetch(`${BASE_URL}/messages`);
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("DELETE /messages/:id — deletes entity", async () => {
+  const { status } = await request("DELETE", `/messages/${__message_id}`);
+  assert(status === 204, `Expected 204, got ${status}`);
+});
+
+await test("GET /messages/:id — returns 404 after delete", async () => {
+  const { status } = await request("GET", `/messages/${__message_id}`);
+  assert(status === 404, `Expected 404, got ${status}`);
+});
+
+// ─── PartService Tests ─────────────────────────────────────────────────────
+
+console.log("\nPartService — CRUD");
+
+let __part_id: string;
+
+await test("POST /parts — creates entity", async () => {
+  const { status, data } = await request("POST", "/parts", {"message_id":"00000000-0000-0000-0000-000000000001","session_id":"00000000-0000-0000-0000-000000000001","part_type":"test_value","data":{},"order_index":1});
+  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
+  assert(data.id, "Response must have id");
+  __part_id = data.id;
+});
+
+await test("GET /parts/:id — reads entity", async () => {
+  const { status, data } = await request("GET", `/parts/${__part_id}`);
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(data.id === __part_id, "ID must match");
+});
+
+await test("GET /parts — lists entities", async () => {
+  const { status, data } = await request("GET", "/parts");
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(Array.isArray(data.items), "Response must have items array");
+  assert(typeof data.total === "number", "Response must have total");
+});
+
+await test("GET /parts — rejects unauthenticated", async () => {
+  const res = await fetch(`${BASE_URL}/parts`);
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("DELETE /parts/:id — deletes entity", async () => {
+  const { status } = await request("DELETE", `/parts/${__part_id}`);
+  assert(status === 204, `Expected 204, got ${status}`);
+});
+
+await test("GET /parts/:id — returns 404 after delete", async () => {
+  const { status } = await request("GET", `/parts/${__part_id}`);
+  assert(status === 404, `Expected 404, got ${status}`);
+});
+
+// ─── PermissionService Tests ─────────────────────────────────────────────────────
+
+console.log("\nPermissionService — CRUD");
+
+let __permission_id: string;
+
+await test("POST /permissions — creates entity", async () => {
+  const { status, data } = await request("POST", "/permissions", {"session_id":"00000000-0000-0000-0000-000000000001","tool_name":"test_value","pattern":null,"decision":"test_value","expires_at":null});
+  assert(status === 201, `Expected 201, got ${status}: ${JSON.stringify(data)}`);
+  assert(data.id, "Response must have id");
+  __permission_id = data.id;
+});
+
+await test("GET /permissions/:id — reads entity", async () => {
+  const { status, data } = await request("GET", `/permissions/${__permission_id}`);
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(data.id === __permission_id, "ID must match");
+});
+
+await test("GET /permissions — lists entities", async () => {
+  const { status, data } = await request("GET", "/permissions");
+  assert(status === 200, `Expected 200, got ${status}`);
+  assert(Array.isArray(data.items), "Response must have items array");
+  assert(typeof data.total === "number", "Response must have total");
+});
+
+await test("GET /permissions — rejects unauthenticated", async () => {
+  const res = await fetch(`${BASE_URL}/permissions`);
+  assert(res.status === 401, `Expected 401, got ${res.status}`);
+});
+
+await test("DELETE /permissions/:id — deletes entity", async () => {
+  const { status } = await request("DELETE", `/permissions/${__permission_id}`);
+  assert(status === 204, `Expected 204, got ${status}`);
+});
+
+await test("GET /permissions/:id — returns 404 after delete", async () => {
+  const { status } = await request("GET", `/permissions/${__permission_id}`);
+  assert(status === 404, `Expected 404, got ${status}`);
+});
+
+console.log(`\n════════════════════════════════════════`);
+console.log(`Results: ${passed} passed, ${failed} failed`);
+console.log("═".repeat(40));
+if (failed > 0) process.exit(1);
 })().catch(e => { console.error(e); process.exit(1); });