create-ailk 0.1.0 → 0.1.1

package/templates/apps/api/src/routes/leads/__tests__/index.test.ts

@@ -52,6 +52,19 @@ import {
 } from "../index";
 import { prisma } from "../../../lib/prisma.js";
 import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
+// #3979 AC1 — the single shared fixture (packages/validation, which apps/api
+// may_import_from per architecture.yaml) for the NewsletterFormInline
+// emitted-body shape, also consumed by the layer-a block test
+// (packages/ui/src/blocks/__tests__/NewsletterFormInline.test.tsx), so a
+// change to the block's emitted keys can't silently leave this layer
+// asserting a stale contract. #4017 D4 extends the same fixture module with
+// the ContactForm `submit`-kind body, consumed by the layer-a section test
+// (packages/ui/src/sections/__tests__/ContactForm.test.tsx).
+import {
+  AGENCY_WAITLIST_LEAD_BODY,
+  CONTACT_FORM_LEAD_BODY,
+  NEWSLETTER_DEFAULT_LEAD_BODY,
+} from "../../../../../../packages/validation/src/__tests__/fixtures/newsletter-lead-body.fixture.js";
 
 const fileEnv = setupLeadFileEnv("index");
 
@@ -82,16 +95,16 @@ describe("POST /api/leads — id isolation", () => {
     delete process.env.LEAD_CAPTURE_INCLUDE_IP;
   });
 
-  it("POST /api/leads/lead — attacker-supplied id is not returned (server uuid used)", async () => {
-    const serverGeneratedId = "cuid-lead-server-1";
+  it("POST /api/leads/submit — attacker-supplied id is not returned (server uuid used)", async () => {
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000a1";
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       payload: {
         id: "attacker",
-        kind: "lead",
+        kind: "submit",
         siteId: "site-abc",
         source: "contact",
         email: "test@example.com",
@@ -110,7 +123,7 @@ describe("POST /api/leads — id isolation", () => {
   });
 
   it("POST /api/leads/subscribe — attacker-supplied id is not returned (server uuid used)", async () => {
-    const serverGeneratedId = "cuid-sub-server-1";
+    const serverGeneratedId = "subscr_00000000-0000-7000-8000-0000000000a2";
     (prisma.subscriber.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const res = await app.inject({
@@ -133,8 +146,114 @@ describe("POST /api/leads — id isolation", () => {
     }
   });
 
+  // #3965 D4 layer (b) — the block's exact emitted shape (layer (a) pins it
+  // as { siteId, source, email } via application/json) persists through the
+  // REAL registered /v1/leads/subscribe plugin. #3979 AC1 retargets the body
+  // literal at the shared fixture (packages/validation) — it had already
+  // drifted from layer-a's own hand-copied literal (different `email`
+  // values), with nothing catching it.
+  it("POST /v1/leads/subscribe — the block's emitted JSON shape ({ siteId, source, email }) is accepted and persisted", async () => {
+    const serverGeneratedId = "subscr_00000000-0000-7000-8000-0000000000b1";
+    (prisma.subscriber.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
+
+    // The exact body NewsletterFormInline emits at its defaults (#3965 D1) —
+    // no `kind` key: buildInput() injects `kind` server-side from the route,
+    // never from the body.
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/leads/subscribe",
+      headers: { "content-type": "application/json" },
+      payload: JSON.stringify(NEWSLETTER_DEFAULT_LEAD_BODY),
+    });
+
+    expect(res.statusCode).toBe(201);
+    const body = res.json();
+    expect(body.id).toBe(serverGeneratedId);
+    expect(body.persisted).toBe("db");
+    expect(prisma.subscriber.create).toHaveBeenCalledTimes(1);
+    const record = await fileEnv.readLastCaptureRecord();
+    expect(record.id).toBe(serverGeneratedId);
+    expect(record.source).toBe(NEWSLETTER_DEFAULT_LEAD_BODY.source);
+  });
+
+  // #3979 AC2 — the agency-waitlist instance (content/en/LandingPage/
+  // agency-waitlist.mdx: action "/v1/leads/submit", source "agency-waitlist",
+  // siteId unset → "default") had NO layer-b case at all before this issue —
+  // only /v1/leads/subscribe was covered. Unconditional 201 (not the
+  // permissive [201, 400] idiom used by the id-isolation tests above), since
+  // this asserts the block's real emitted shape is accepted, not merely that
+  // the id-isolation walls hold regardless of validation outcome.
+  it("POST /v1/leads/submit — the agency-waitlist instance's emitted JSON shape ({ siteId, source, email }) is accepted and persisted", async () => {
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000b2";
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
+
+    // The exact body NewsletterFormInline emits for the agency-waitlist
+    // instance — no `kind`, no `payload` key: buildInput() injects `kind`
+    // server-side from the route and defaults `payload` to {} when absent.
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/leads/submit",
+      headers: { "content-type": "application/json" },
+      payload: JSON.stringify(AGENCY_WAITLIST_LEAD_BODY),
+    });
+
+    expect(res.statusCode).toBe(201);
+    const body = res.json();
+    expect(body.id).toBe(serverGeneratedId);
+    expect(body.persisted).toBe("db");
+    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
+    const record = await fileEnv.readLastCaptureRecord();
+    expect(record.id).toBe(serverGeneratedId);
+    expect(record.source).toBe(AGENCY_WAITLIST_LEAD_BODY.source);
+  });
+
+  // #4017 D4 layer (b) — the ContactForm section's exact emitted shape
+  // (layer (a) pins it as { siteId, source, email, payload } via
+  // application/json) persists through the REAL registered
+  // /v1/leads/submit plugin. `email` is lifted by field name; every other
+  // declared field lands in `payload` — the shared fixture (packages/validation)
+  // is the single definition both layers assert against (#3979 AC1's
+  // pattern), so a change to the section's emitted keys can't silently leave
+  // this layer asserting a stale contract.
+  it("POST /v1/leads/submit — the ContactForm section's emitted JSON shape ({ siteId, source, email, payload }) is accepted and persisted", async () => {
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000b3";
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
+
+    // The exact body ContactForm emits at its component defaults (#4017 D1) —
+    // no `kind` key: buildInput() injects `kind` server-side from the route,
+    // never from the body.
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/leads/submit",
+      headers: { "content-type": "application/json" },
+      payload: JSON.stringify(CONTACT_FORM_LEAD_BODY),
+    });
+
+    expect(res.statusCode).toBe(201);
+    const body = res.json();
+    expect(body.id).toBe(serverGeneratedId);
+    expect(body.persisted).toBe("db");
+    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
+    expect(prisma.lead.create).toHaveBeenCalledWith({
+      data: {
+        siteId: CONTACT_FORM_LEAD_BODY.siteId,
+        source: CONTACT_FORM_LEAD_BODY.source,
+        email: CONTACT_FORM_LEAD_BODY.email,
+        payload: CONTACT_FORM_LEAD_BODY.payload,
+      },
+      select: { id: true },
+    });
+    const record = await fileEnv.readLastCaptureRecord();
+    expect(record.id).toBe(serverGeneratedId);
+    expect(record.source).toBe(CONTACT_FORM_LEAD_BODY.source);
+    expect(record.data).toEqual({
+      email: CONTACT_FORM_LEAD_BODY.email,
+      ...CONTACT_FORM_LEAD_BODY.payload,
+    });
+  });
+
   it("POST /api/leads/callback — attacker-supplied id is not returned (server uuid used)", async () => {
-    const serverGeneratedId = "cuid-cb-server-1";
+    const serverGeneratedId = "callbk_00000000-0000-7000-8000-0000000000a3";
     (prisma.callback.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const res = await app.inject({
@@ -161,14 +280,14 @@ describe("POST /api/leads — id isolation", () => {
   // ── Lead capture store integration cases ──────────────────────────────────
 
   it("file-on-success — appendLeadRecord writes to LEAD_CAPTURE_FILE on successful DB persist", async () => {
-    const serverGeneratedId = "cuid-file-success-1";
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000a4";
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       payload: {
-        kind: "lead",
+        kind: "submit",
         siteId: "site-abc",
         source: "contact",
         email: "test@example.com",
@@ -186,14 +305,14 @@ describe("POST /api/leads — id isolation", () => {
   });
 
   it("dual-write — real lead-capture-store AND DB are both invoked on success", async () => {
-    const serverGeneratedId = "cuid-dual-write-1";
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000a5";
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       payload: {
-        kind: "lead",
+        kind: "submit",
         siteId: "site-abc",
         source: "contact",
         email: "dual@example.com",
@@ -211,14 +330,14 @@ describe("POST /api/leads — id isolation", () => {
   it("disabled — appendLeadRecord is skipped when LEAD_CAPTURE_FILE_DISABLED=true", async () => {
     process.env.LEAD_CAPTURE_FILE_DISABLED = "true";
 
-    const serverGeneratedId = "cuid-disabled-1";
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000a6";
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       payload: {
-        kind: "lead",
+        kind: "submit",
         siteId: "site-abc",
         source: "contact",
         email: "disabled@example.com",
@@ -242,9 +361,9 @@ describe("POST /api/leads — id isolation", () => {
 
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       payload: {
-        kind: "lead",
+        kind: "submit",
         siteId: "site-abc",
         source: "contact",
         email: "nocapture@example.com",
@@ -261,15 +380,15 @@ describe("POST /api/leads — id isolation", () => {
 
   it("IP-include — metadata.ip present in capture record when LEAD_CAPTURE_INCLUDE_IP=true", async () => {
     process.env.LEAD_CAPTURE_INCLUDE_IP = "true";
-    const serverGeneratedId = "cuid-ip-include-1";
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000a7";
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       headers: { "x-forwarded-for": "1.2.3.4" },
       payload: {
-        kind: "lead",
+        kind: "submit",
         siteId: "site-abc",
         source: "contact",
         email: "ip@example.com",
@@ -286,11 +405,11 @@ describe("POST /api/leads — id isolation", () => {
   // ── buildInput branch coverage ─────────────────────────────────────────────
 
   it("lead — payload absent from body defaults to empty object via ?? (payload ?? {} branch)", async () => {
-    const serverGeneratedId = "cuid-nopayload-1";
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000a8";
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const bodyWithoutPayload: Record<string, unknown> = {
-      kind: "lead",
+      kind: "submit",
       siteId: "site-abc",
       source: "contact",
       email: "nopayload@example.com",
@@ -299,7 +418,7 @@ describe("POST /api/leads — id isolation", () => {
 
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       payload: bodyWithoutPayload,
     });
 
@@ -310,7 +429,7 @@ describe("POST /api/leads — id isolation", () => {
   });
 
   it("callback — preferredTime included when provided (preferredTime spread branch)", async () => {
-    const serverGeneratedId = "cuid-callback-ptime-1";
+    const serverGeneratedId = "callbk_00000000-0000-7000-8000-0000000000a9";
     (prisma.callback.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const res = await app.inject({
@@ -333,7 +452,7 @@ describe("POST /api/leads — id isolation", () => {
   });
 
   it("callback — payload absent from body defaults to empty object via ?? (callback payload ?? {} branch)", async () => {
-    const serverGeneratedId = "cuid-callback-nopayload-1";
+    const serverGeneratedId = "callbk_00000000-0000-7000-8000-0000000000aa";
     (prisma.callback.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const bodyWithoutPayload: Record<string, unknown> = {
@@ -361,14 +480,14 @@ describe("POST /api/leads — id isolation", () => {
   it("email skipped — emailKind=skipped logged when env vars are unset", async () => {
     delete process.env.AILK_LEAD_NOTIFICATION_TO;
     delete process.env.AILK_LEAD_NOTIFICATION_FROM;
-    const serverGeneratedId = "cuid-email-skipped-1";
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000ab";
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       payload: {
-        kind: "lead",
+        kind: "submit",
         siteId: "site-abc",
         source: "contact",
         email: "skipped@example.com",
@@ -384,20 +503,178 @@ describe("POST /api/leads — id isolation", () => {
     }
   });
 
+  // ── #4985 — step-flow envelope ({ siteId, source, payload: <record> }) ────
+  // StepFlow (packages/ui/src/sections/StepFlow.tsx L548) posts email INSIDE
+  // `payload`, not top-level. buildInput() now lifts `email` from `payload`
+  // when the top-level field is absent.
+
+  it("envelope submit — { siteId, source, payload: { email, ... } } returns 201, writes one Lead with that email and the full payload, and routes the notification email", async () => {
+    const { sendLeadNotification } = jest.requireMock("@working-theory/email");
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000e1";
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
+
+    const envelopePayload = {
+      email: "envelope@example.com",
+      name: "Envelope Visitor",
+      message: "hello from the step-flow",
+    };
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/leads/submit",
+      payload: {
+        siteId: "site-abc",
+        source: "step-flow",
+        payload: envelopePayload,
+      },
+    });
+
+    expect(res.statusCode).toBe(201);
+    const body = res.json();
+    expect(body.id).toBe(serverGeneratedId);
+    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
+    expect(prisma.lead.create).toHaveBeenCalledWith({
+      data: {
+        siteId: "site-abc",
+        source: "step-flow",
+        email: "envelope@example.com",
+        payload: envelopePayload,
+      },
+      select: { id: true },
+    });
+    expect(sendLeadNotification).toHaveBeenCalledTimes(1);
+    expect(body.email).toHaveProperty("ok", true);
+  });
+
+  it("envelope subscribe — { siteId, source, payload: { email } } returns 201 and writes one Subscriber", async () => {
+    const serverGeneratedId = "subscr_00000000-0000-7000-8000-0000000000e2";
+    (prisma.subscriber.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/leads/subscribe",
+      payload: {
+        siteId: "site-abc",
+        source: "step-flow",
+        payload: { email: "sub-envelope@example.com" },
+      },
+    });
+
+    expect(res.statusCode).toBe(201);
+    const body = res.json();
+    expect(body.id).toBe(serverGeneratedId);
+    expect(prisma.subscriber.create).toHaveBeenCalledTimes(1);
+    expect(prisma.subscriber.create).toHaveBeenCalledWith({
+      data: {
+        siteId: "site-abc",
+        email: "sub-envelope@example.com",
+        source: "step-flow",
+      },
+      select: { id: true },
+    });
+  });
+
+  it("envelope submit — email absent in both the top level and payload → the existing 400 invalid_input", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/leads/submit",
+      payload: {
+        siteId: "site-abc",
+        source: "step-flow",
+        payload: { message: "no email anywhere" },
+      },
+    });
+
+    expect(res.statusCode).toBe(400);
+    const body = res.json();
+    expect(body.error).toBe("invalid_input");
+    expect(prisma.lead.create).not.toHaveBeenCalled();
+  });
+
+  it("envelope subscribe — email absent in both the top level and payload → the existing 400 invalid_input", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/leads/subscribe",
+      payload: {
+        siteId: "site-abc",
+        source: "step-flow",
+        payload: {},
+      },
+    });
+
+    expect(res.statusCode).toBe(400);
+    const body = res.json();
+    expect(body.error).toBe("invalid_input");
+    expect(prisma.subscriber.create).not.toHaveBeenCalled();
+  });
+
+  it("submit — a top-level email wins over a payload email", async () => {
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000e3";
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/leads/submit",
+      payload: {
+        siteId: "site-abc",
+        source: "step-flow",
+        email: "top-level@example.com",
+        payload: { email: "shadowed-payload@example.com", message: "hi" },
+      },
+    });
+
+    expect(res.statusCode).toBe(201);
+    expect(prisma.lead.create).toHaveBeenCalledWith({
+      data: {
+        siteId: "site-abc",
+        source: "step-flow",
+        email: "top-level@example.com",
+        payload: { email: "shadowed-payload@example.com", message: "hi" },
+      },
+      select: { id: true },
+    });
+  });
+
+  it("subscribe — a top-level email wins over a payload email", async () => {
+    const serverGeneratedId = "subscr_00000000-0000-7000-8000-0000000000e4";
+    (prisma.subscriber.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/leads/subscribe",
+      payload: {
+        siteId: "site-abc",
+        source: "step-flow",
+        email: "top-level-sub@example.com",
+        payload: { email: "shadowed-sub@example.com" },
+      },
+    });
+
+    expect(res.statusCode).toBe(201);
+    expect(prisma.subscriber.create).toHaveBeenCalledWith({
+      data: {
+        siteId: "site-abc",
+        email: "top-level-sub@example.com",
+        source: "step-flow",
+      },
+      select: { id: true },
+    });
+  });
+
   it("email error — emailKind=error logged when sendLeadNotification returns ok:false", async () => {
     const { sendLeadNotification } = jest.requireMock("@working-theory/email");
     (sendLeadNotification as jest.Mock).mockResolvedValueOnce({
       ok: false,
       error: { kind: "send_error", message: "SMTP timeout" },
     });
-    const serverGeneratedId = "cuid-email-error-1";
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000ac";
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       payload: {
-        kind: "lead",
+        kind: "submit",
         siteId: "site-abc",
         source: "contact",
         email: "erroremail@example.com",
@@ -413,3 +690,133 @@ describe("POST /api/leads — id isolation", () => {
     }
   });
 });
+
+// ── #4985 — PII-safe logging still holds when email arrives via `payload` ──
+
+describe("POST /v1/leads/submit — structured log stays PII-safe for envelope input", () => {
+  afterEach(async () => {
+    delete process.env.AILK_LEAD_NOTIFICATION_TO;
+    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
+    delete process.env.DATABASE_URL;
+  });
+
+  it("the 'lead routed' log line carries no email or payload value when email is lifted from payload", async () => {
+    jest.clearAllMocks();
+    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+    process.env.DATABASE_URL = "postgres://stub";
+
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000e5";
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
+
+    const logLines: string[] = [];
+    const logCapture = require("fastify")({
+      logger: {
+        level: "info",
+        stream: { write: (msg: string) => logLines.push(msg) },
+      },
+    }) as FastifyInstance;
+    await logCapture.register(leadSubmitRoute);
+    await logCapture.ready();
+
+    try {
+      const res = await logCapture.inject({
+        method: "POST",
+        url: "/v1/leads/submit",
+        payload: {
+          siteId: "site-abc",
+          source: "step-flow",
+          payload: {
+            email: "secret-envelope@example.com",
+            message: "this message body must never be logged",
+          },
+        },
+      });
+
+      expect(res.statusCode).toBe(201);
+
+      const routedLine = logLines.find((line) => line.includes("lead routed"));
+      expect(routedLine).toBeDefined();
+      expect(routedLine).not.toMatch(/secret-envelope@example\.com/);
+      expect(routedLine).not.toMatch(/this message body must never be logged/);
+
+      const logged = JSON.parse(routedLine!) as Record<string, unknown>;
+      expect(logged).not.toHaveProperty("email");
+      expect(logged).not.toHaveProperty("payload");
+      expect(logged).toMatchObject({
+        siteId: "site-abc",
+        kind: "submit",
+        persisted: "db",
+      });
+    } finally {
+      await logCapture.close();
+    }
+  });
+});
+
+// ── D5 — registration binds the client's literal path (issue #3964) ───────────
+//
+// The drift class this issue fixed: every test above hand-supplied the same
+// (wrong) URL the route was actually registered at, so the mismatch between
+// the registered path and the path every consumer calls shipped silently.
+// This suite registers the real exported plugin and asserts against the
+// EXACT literal packages/api-client/src/leads.ts uses (cross-referenced
+// below), so a future re-drift fails here instead of shipping.
+
+describe("POST /v1/leads/submit — registration binds the client's literal path", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+    process.env.DATABASE_URL = "postgres://stub";
+
+    const fastify = require("fastify")();
+    await fastify.register(leadSubmitRoute);
+    app = fastify;
+  });
+
+  afterEach(async () => {
+    await app.close();
+    delete process.env.AILK_LEAD_NOTIFICATION_TO;
+    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
+    delete process.env.DATABASE_URL;
+  });
+
+  it("resolves POST /v1/leads/submit — the exact literal packages/api-client/src/leads.ts's leads.submit() posts to", async () => {
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000d1";
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
+
+    // Cross-reference: packages/api-client/src/leads.ts —
+    //   submit: (payload) => post<LeadWriteResponse>("/v1/leads/submit", payload)
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/leads/submit",
+      payload: {
+        siteId: "site-abc",
+        source: "contact",
+        email: "d5@example.com",
+        payload: { message: "hello" },
+      },
+    });
+
+    expect(res.statusCode).toBe(201);
+    expect(res.json().id).toBe(serverGeneratedId);
+  });
+
+  it("POST /v1/leads/lead — no longer registered (404); the pre-fix path", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/leads/lead",
+      payload: {
+        siteId: "site-abc",
+        source: "contact",
+        email: "old-path@example.com",
+        payload: { message: "hello" },
+      },
+    });
+
+    expect(res.statusCode).toBe(404);
+  });
+});

package/templates/apps/api/src/routes/leads/__tests__/track.test.ts

@@ -74,14 +74,14 @@ describe("POST /api/leads — track() telemetry", () => {
   });
 
   it("calls track('lead-captured') with source and locale on successful submission", async () => {
-    const serverGeneratedId = "cuid-track-success-1";
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000b1";
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       payload: {
-        kind: "lead",
+        kind: "submit",
         siteId: "site-abc",
         source: "newsletter",
         email: "test@example.com",
@@ -108,9 +108,9 @@ describe("POST /api/leads — track() telemetry", () => {
 
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       payload: {
-        kind: "lead",
+        kind: "submit",
         siteId: "site-abc",
         source: "contact",
         email: "fail@example.com",
@@ -125,10 +125,10 @@ describe("POST /api/leads — track() telemetry", () => {
   it("does NOT call track() when validation fails (missing required field → 400 or 503)", async () => {
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       payload: {
         // missing email — required field for lead kind
-        kind: "lead",
+        kind: "submit",
         siteId: "site-abc",
         source: "contact",
         payload: {},
@@ -140,14 +140,14 @@ describe("POST /api/leads — track() telemetry", () => {
   });
 
   it("track() props contain only source and locale — no PII fields", async () => {
-    const serverGeneratedId = "cuid-pii-check-1";
+    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000b2";
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
 
     const res = await app.inject({
       method: "POST",
-      url: "/v1/leads/lead",
+      url: "/v1/leads/submit",
       payload: {
-        kind: "lead",
+        kind: "submit",
         siteId: "site-abc",
         source: "landing-page",
         email: "pii@example.com",