chore: drop the version-param fix and TODOS.md from this PR

Staging fixed the deployment version route param independently (#6560,
`z.coerce.number()`) and covers both the numeric and `active` cases in
`deployments.test.ts`, so this branch's variant and its regression test
are redundant. Revert the contract to staging's exactly, leaving this PR
scoped to the deploy permission change.

Also drop TODOS.md and rewrite the two comments that pointed at it so
each one states its own condition for removal.

Author: mzxchandra

TODOS.md

@@ -118,8 +118,9 @@ export const PATCH = withRouteHandler(
          * `write` member must still be able to rename an already-public server.
          *
          * This route calls the orchestration layer directly rather than the
-         * application use case, so the use case's gate does not apply here —
-         * see the TODO about migrating both MCP server routes.
+         * application use case, so `updateWorkflowMcpDeploymentServer`'s gate
+         * does not apply here and the rule has to be repeated. Delete this copy
+         * once the route goes through that use case.
          */
         if (body.isPublic === true) {
           const [current] = await db

apps/sim/app/api/mcp/workflow-servers/[id]/route.ts

@@ -120,8 +120,9 @@ export const POST = withRouteHandler(
          * `withMcpAuth('write')` covers managing the server, but a public
          * server skips authentication on the serve path, so publishing one is
          * admin-only. This route calls the orchestration layer directly rather
-         * than the application use case, so the use case's gate does not apply
-         * here — see the TODO about migrating both MCP server routes.
+         * than the application use case, so `createWorkflowMcpDeploymentServer`'s
+         * gate does not apply here and the rule has to be repeated. Delete this
+         * copy once the route goes through that use case.
          */
         if (
           increasesPublicExposure(body.isPublic, false) &&

apps/sim/app/api/mcp/workflow-servers/route.ts

@@ -26,26 +26,9 @@ export const deploymentVersionParamsSchema = z.object({
   version: z.coerce.number().int().positive(),
 })
 
-/**
- * Route params arrive as strings, so the numeric branch must coerce — a bare
- * `z.number()` here makes every numeric version unreachable and leaves
- * `active` as the only satisfiable value. Coercion of `'active'` yields NaN,
- * fails `.int()`, and falls through to the literal branch, so ordering is safe.
- *
- * The numeric branch is `number | string` piped into the coercion rather than a
- * bare `z.coerce.number()`: a coerced member widens the union's `z.input` to
- * `unknown`, which would let a client pass anything at compile time and fail
- * only at runtime — the exact drift this schema exists to prevent.
- */
 export const deploymentVersionOrActiveParamsSchema = z.object({
   id: z.string().min(1, 'Invalid workflow ID'),
-  version: z.union([
-    z
-      .union([z.number(), z.string()])
-      .transform((value) => (typeof value === 'number' ? value : Number(value)))
-      .pipe(z.number().int().positive()),
-    z.literal('active'),
-  ]),
+  version: z.union([z.coerce.number().int().positive(), z.literal('active')]),
 })
 
 export const deploymentVersionRouteParamsSchema = z.object({

apps/sim/lib/api/contracts/deployments.ts

@@ -66,8 +66,8 @@ describe('deployment permission matrix', () => {
    * surface routed through the operation registry. The v1 REST API
    * (`resolveV1DeploymentWorkflow`) predates the registry and runs its own
    * `validateWorkspaceAccess`, resolving a workspace key to its creator — so a
-   * workspace key can still deploy there. That gap is pre-existing and tracked
-   * separately; do not read these assertions as covering v1.
+   * workspace key can still deploy there. That gap is pre-existing and out of
+   * scope here; do not read these assertions as covering v1.
    */
   describe('deployment operations reject workspace API keys', () => {
     it.each([