create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/flows/__tests__/index.test.ts

@@ -0,0 +1,752 @@
+/**
+ * @file index.test.ts
+ * Route-level inject tests for GET /v1/flows/:slug and
+ * POST /v1/flows/:slug/steps (#3956 D4).
+ *
+ * Mirrors apps/api/src/routes/leads/__tests__/index.test.ts's shape: a bare
+ * Fastify instance with only the routes under test registered, prisma
+ * mocked via __mocks__/prisma.ts.
+ */
+
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
+jest.mock("../../../lib/prisma.js");
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({
+    ok: true,
+    messageId: "msg-test",
+  }),
+}));
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+import { flowAggregateSchema } from "@working-theory/validation";
+
+import {
+  getFlowAggregateRoute,
+  getFlowRoute,
+  submitFlowStepRoute,
+} from "../index";
+import { prisma } from "../../../lib/prisma.js";
+
+const en = (s: string) => ({ en: s });
+
+function contactFirstFlow() {
+  return {
+    slug: "get-a-quote",
+    defaultLocale: "en",
+    steps: [
+      {
+        key: "contact",
+        type: "field" as const,
+        copy: { title: en("Let's get started") },
+        fields: [
+          {
+            name: "email",
+            inputType: "email" as const,
+            required: true,
+            mapsTo: "email" as const,
+            copy: { label: en("Email") },
+          },
+        ],
+      },
+      {
+        key: "budget",
+        type: "segmentation" as const,
+        copy: { title: en("What's your budget?") },
+        questions: [
+          {
+            name: "budget",
+            options: [{ value: "small", label: en("Under $10k") }],
+          },
+        ],
+      },
+    ],
+  };
+}
+
+// contactFirstFlow() with a two-option driving question + a segments band
+// map on "budget" (#3959 D1) — small -> "starter", large -> "enterprise".
+// Landing "budget" both lands the band map AND completes the session (no
+// trailing message step), the HTTP-layer analog of the engine-level
+// terminal-segmentation-step fixture.
+function contactFirstFlowWithSegments() {
+  const flow = contactFirstFlow();
+  const budgetStep = flow.steps.find((s) => s.key === "budget")!;
+  (
+    budgetStep as typeof budgetStep & { segments?: unknown }
+  ).questions = [
+    {
+      name: "budget",
+      options: [
+        { value: "small", label: en("Under $10k") },
+        { value: "large", label: en("$10k+") },
+      ],
+    },
+  ];
+  (budgetStep as typeof budgetStep & { segments?: unknown }).segments = {
+    question: "budget",
+    bands: [
+      { key: "starter", values: ["small"] },
+      { key: "enterprise", values: ["large"] },
+    ],
+  };
+  return flow;
+}
+
+describe("GET /v1/flows/:slug and POST /v1/flows/:slug/steps", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    process.env.DATABASE_URL = "postgres://stub";
+
+    const fastify = require("fastify")();
+    await fastify.register(getFlowRoute);
+    await fastify.register(submitFlowStepRoute);
+    app = fastify;
+  });
+
+  afterEach(async () => {
+    await app.close();
+    delete process.env.DATABASE_URL;
+    delete process.env.AILK_SITE_ID;
+  });
+
+  // ── GET /v1/flows/:slug ──────────────────────────────────────────────────
+
+  it("GET — returns the ok:true envelope carrying the flow config", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      config: contactFirstFlow(),
+    });
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/flows/get-a-quote",
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.ok).toBe(true);
+    expect(body.data.slug).toBe("get-a-quote");
+    expect(body.data.steps.map((s: { type: string }) => s.type)).toEqual([
+      "field",
+      "segmentation",
+    ]);
+  });
+
+  it("GET — 404 flow_not_found for an unknown slug", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/flows/does-not-exist",
+    });
+
+    expect(res.statusCode).toBe(404);
+    const body = res.json();
+    expect(body).toEqual({
+      ok: false,
+      error: { code: "flow_not_found", message: expect.any(String) },
+    });
+  });
+
+  it("GET — 503 flows_not_configured when DATABASE_URL is unset", async () => {
+    delete process.env.DATABASE_URL;
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/flows/get-a-quote",
+    });
+
+    expect(res.statusCode).toBe(503);
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "flows_not_configured", message: expect.any(String) },
+    });
+  });
+
+  it("GET — 400 invalid_input for a malformed slug", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/flows/Not_A_Valid_Slug!",
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.json().error.code).toBe("invalid_input");
+  });
+
+  // ── POST /v1/flows/:slug/steps — AC2 walk at the HTTP layer ─────────────
+
+  it("POST — AC2: submitting the contact step persists a partial lead and never auto-completes", async () => {
+    const sessionId = "flsess_00000000-0000-7000-8000-0000000000f1";
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      id: "flow_00000000-0000-7000-8000-0000000000f0",
+      config: contactFirstFlow(),
+    });
+    (prisma.flowSession.create as jest.Mock).mockResolvedValue({
+      id: sessionId,
+      siteId: "default",
+      state: {},
+      email: null,
+      leadId: null,
+      completedAt: null,
+    });
+    (prisma.flowSession.update as jest.Mock).mockResolvedValue({});
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/flows/get-a-quote/steps",
+      payload: {
+        stepKey: "contact",
+        values: { email: "abandoner@example.com" },
+      },
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body).toEqual({
+      ok: true,
+      data: {
+        sessionId,
+        landed: "contact",
+        nextStepKey: "budget",
+        completed: false,
+      },
+    });
+    expect(prisma.flowSession.update).toHaveBeenCalledWith({
+      where: { id: sessionId },
+      data: {
+        state: { contact: { email: "abandoner@example.com" } },
+        // #4663 D1/D2 — flags is re-derived + persisted on EVERY landing.
+        flags: {},
+        email: "abandoner@example.com",
+      },
+    });
+    expect(prisma.lead.create).not.toHaveBeenCalled();
+  });
+
+  it("POST — 400 invalid_input for a missing required field", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      id: "flow_x",
+      config: contactFirstFlow(),
+    });
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/flows/get-a-quote/steps",
+      payload: { stepKey: "contact", values: {} },
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.json().error.code).toBe("invalid_input");
+  });
+
+  it("POST — 404 flow_not_found for a step submission against an unknown flow (no sessionId)", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/flows/does-not-exist/steps",
+      payload: { stepKey: "contact", values: {} },
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json().error.code).toBe("flow_not_found");
+  });
+
+  it("POST — 409 step_conflict for an unknown stepKey", async () => {
+    (prisma.flowSession.findUnique as jest.Mock).mockResolvedValue({
+      id: "flsess_x",
+      siteId: "default",
+      flowSlug: "get-a-quote",
+      configSnapshot: contactFirstFlow(),
+      state: {},
+      email: null,
+      completedAt: null,
+    });
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/flows/get-a-quote/steps",
+      payload: {
+        sessionId: "flsess_x",
+        stepKey: "does_not_exist",
+        values: {},
+      },
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().error.code).toBe("step_conflict");
+  });
+
+  it("POST — 503 flows_not_configured when DATABASE_URL is unset", async () => {
+    delete process.env.DATABASE_URL;
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/flows/get-a-quote/steps",
+      payload: { stepKey: "contact", values: {} },
+    });
+
+    expect(res.statusCode).toBe(503);
+    expect(res.json().error.code).toBe("flows_not_configured");
+  });
+
+  it("POST — 400 invalid_input for an unknown top-level body key (.strict())", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/flows/get-a-quote/steps",
+      payload: { stepKey: "contact", values: {}, unexpected: true },
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.json().error.code).toBe("invalid_input");
+  });
+
+  // ── AC4 at the HTTP layer — completion returns leadId ───────────────────
+
+  it("POST — completing the final step returns completed:true with leadId", async () => {
+    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+    const leadRowId = "lead_00000000-0000-7000-8000-0000000000f2";
+
+    (prisma.flowSession.findUnique as jest.Mock).mockResolvedValue({
+      id: "flsess_y",
+      siteId: "default",
+      flowSlug: "get-a-quote",
+      configSnapshot: contactFirstFlow(),
+      state: { contact: { email: "done@example.com" } },
+      email: "done@example.com",
+      leadId: null,
+      completedAt: null,
+    });
+    (prisma.flowSession.update as jest.Mock).mockResolvedValue({});
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: leadRowId });
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/flows/get-a-quote/steps",
+      payload: {
+        sessionId: "flsess_y",
+        stepKey: "budget",
+        values: { budget: "small" },
+      },
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.data.completed).toBe(true);
+    expect(body.data.leadId).toBe(leadRowId);
+
+    delete process.env.AILK_LEAD_NOTIFICATION_TO;
+    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
+  });
+
+  // ── AC1 at the HTTP layer — the two-submission divergence walk (#3959) ──
+
+  it("AC1 — two full walks differing only on the segmentation answer derive distinct segments, each surfaced in the response", async () => {
+    const definitionRow = {
+      id: "flow_00000000-0000-7000-8000-0000000000f3",
+      config: contactFirstFlowWithSegments(),
+    };
+    const sessionA = "flsess_00000000-0000-7000-8000-0000000000a1";
+    const sessionB = "flsess_00000000-0000-7000-8000-0000000000b1";
+
+    // ── Walk A: contact -> budget:"small" -> segment "starter" ──
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValueOnce(
+      definitionRow,
+    );
+    (prisma.flowSession.create as jest.Mock).mockResolvedValueOnce({
+      id: sessionA,
+      siteId: "default",
+      state: {},
+      email: null,
+      segment: null,
+      leadId: null,
+      completedAt: null,
+    });
+    (prisma.flowSession.update as jest.Mock).mockResolvedValueOnce({});
+
+    const resA1 = await app.inject({
+      method: "POST",
+      url: "/v1/flows/get-a-quote/steps",
+      payload: { stepKey: "contact", values: { email: "a@example.com" } },
+    });
+    expect(resA1.statusCode).toBe(200);
+
+    (prisma.flowSession.findUnique as jest.Mock).mockResolvedValueOnce({
+      id: sessionA,
+      siteId: "default",
+      flowSlug: "get-a-quote",
+      configSnapshot: contactFirstFlowWithSegments(),
+      state: { contact: { email: "a@example.com" } },
+      email: "a@example.com",
+      segment: null,
+      leadId: null,
+      completedAt: null,
+    });
+    (prisma.flowSession.update as jest.Mock).mockResolvedValueOnce({});
+    (prisma.lead.create as jest.Mock).mockResolvedValueOnce({
+      id: "lead_a",
+    });
+
+    const resA2 = await app.inject({
+      method: "POST",
+      url: "/v1/flows/get-a-quote/steps",
+      payload: {
+        sessionId: sessionA,
+        stepKey: "budget",
+        values: { budget: "small" },
+      },
+    });
+    expect(resA2.statusCode).toBe(200);
+    const bodyA = resA2.json();
+    expect(bodyA.data.segment).toBe("starter");
+    expect(prisma.lead.create).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          payload: expect.objectContaining({ segment: "starter" }),
+        }),
+      }),
+    );
+
+    // ── Walk B: contact -> budget:"large" -> segment "enterprise" ──
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValueOnce(
+      definitionRow,
+    );
+    (prisma.flowSession.create as jest.Mock).mockResolvedValueOnce({
+      id: sessionB,
+      siteId: "default",
+      state: {},
+      email: null,
+      segment: null,
+      leadId: null,
+      completedAt: null,
+    });
+    (prisma.flowSession.update as jest.Mock).mockResolvedValueOnce({});
+
+    const resB1 = await app.inject({
+      method: "POST",
+      url: "/v1/flows/get-a-quote/steps",
+      payload: { stepKey: "contact", values: { email: "b@example.com" } },
+    });
+    expect(resB1.statusCode).toBe(200);
+
+    (prisma.flowSession.findUnique as jest.Mock).mockResolvedValueOnce({
+      id: sessionB,
+      siteId: "default",
+      flowSlug: "get-a-quote",
+      configSnapshot: contactFirstFlowWithSegments(),
+      state: { contact: { email: "b@example.com" } },
+      email: "b@example.com",
+      segment: null,
+      leadId: null,
+      completedAt: null,
+    });
+    (prisma.flowSession.update as jest.Mock).mockResolvedValueOnce({});
+    (prisma.lead.create as jest.Mock).mockResolvedValueOnce({
+      id: "lead_b",
+    });
+
+    const resB2 = await app.inject({
+      method: "POST",
+      url: "/v1/flows/get-a-quote/steps",
+      payload: {
+        sessionId: sessionB,
+        stepKey: "budget",
+        values: { budget: "large" },
+      },
+    });
+    expect(resB2.statusCode).toBe(200);
+    const bodyB = resB2.json();
+    expect(bodyB.data.segment).toBe("enterprise");
+    expect(prisma.lead.create).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          payload: expect.objectContaining({ segment: "enterprise" }),
+        }),
+      }),
+    );
+
+    // Distinct segments, distinct leads — the AC1 divergence.
+    expect(bodyA.data.segment).not.toBe(bodyB.data.segment);
+  });
+
+  it("POST — a client-posted `segment` value in `values` never surfaces in the response or the session write (D2 makes it unrepresentable as a declared name)", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      id: "flow_x",
+      config: contactFirstFlow(),
+    });
+    (prisma.flowSession.create as jest.Mock).mockResolvedValue({
+      id: "flsess_z",
+      siteId: "default",
+      state: {},
+      email: null,
+      segment: null,
+      leadId: null,
+      completedAt: null,
+    });
+    (prisma.flowSession.update as jest.Mock).mockResolvedValue({});
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/flows/get-a-quote/steps",
+      payload: {
+        stepKey: "contact",
+        values: { email: "a@example.com", segment: "attacker-value" },
+      },
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.data.segment).toBeUndefined();
+    expect(prisma.flowSession.update).toHaveBeenCalledWith({
+      where: { id: "flsess_z" },
+      data: {
+        state: { contact: { email: "a@example.com" } },
+        flags: {},
+        email: "a@example.com",
+      },
+    });
+  });
+});
+
+// ── GET /v1/flows/:slug/aggregate (#4771) ────────────────────────────────
+
+function aggregateConfig() {
+  return {
+    key: "founder-diagnostic",
+    mode: "lead-capture" as const,
+    status: "live" as const,
+    waitlists: [{ key: "general", flowSlug: "founder-diagnostic-general" }],
+    questionSet: {
+      version: 1 as const,
+      questions: [
+        {
+          id: "role",
+          prompt: en("Role?"),
+          answerType: "single" as const,
+          options: [
+            { value: "founder", label: en("Founder") },
+            { value: "other", label: en("Other") },
+          ],
+          resultsReveal: true as const,
+        },
+        {
+          id: "team_size",
+          prompt: en("Team size?"),
+          answerType: "single" as const,
+          options: [{ value: "solo", label: en("Solo") }],
+        },
+      ],
+    },
+    tracking: {
+      version: 1 as const,
+      utm: { source: "utm_source", medium: "utm_medium", campaign: "utm_campaign" },
+      waitlists: { general: { campaign: "gen-campaign", channels: ["organic"] } },
+    },
+    stripeConfigRef: null,
+  };
+}
+
+describe("GET /v1/flows/:slug/aggregate", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    process.env.DATABASE_URL = "postgres://stub";
+
+    const fastify = require("fastify")();
+    await fastify.register(getFlowAggregateRoute);
+    app = fastify;
+  });
+
+  afterEach(async () => {
+    await app.close();
+    delete process.env.DATABASE_URL;
+    delete process.env.AILK_SITE_ID;
+  });
+
+  it("AC1/AC3/AC4: returns only the flagged question, per-option counts, and no PII, at any nesting depth", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      id: "flow_00000000-0000-7000-8000-000000000001",
+    });
+    (prisma.waitlistExperiment.findMany as jest.Mock).mockResolvedValue([
+      {
+        id: "wlexp_00000000-0000-7000-8000-000000000001",
+        siteId: "default",
+        config: aggregateConfig(),
+      },
+    ]);
+    (prisma.flowSession.findMany as jest.Mock).mockResolvedValue([
+      {
+        siteId: "default",
+        flowSlug: "founder-diagnostic-general",
+        completedAt: new Date("2026-09-01T00:00:00.000Z"),
+        leadId: null,
+        state: { role_step: { role: "founder" } },
+      },
+      {
+        siteId: "default",
+        flowSlug: "founder-diagnostic-general",
+        completedAt: new Date("2026-09-02T00:00:00.000Z"),
+        leadId: null,
+        state: { role_step: { role: "other" } },
+      },
+    ]);
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/flows/founder-diagnostic-general/aggregate",
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.ok).toBe(true);
+    expect(body.data.slug).toBe("founder-diagnostic-general");
+    expect(body.data.respondents).toBe(2);
+    // AC3 — team_size is unflagged and must be absent.
+    expect(body.data.questions.map((q: { id: string }) => q.id)).toEqual(["role"]);
+    const role = body.data.questions[0];
+    expect(role.answered).toBe(2);
+    const byValue = new Map(
+      role.options.map((o: { value: string; count: number }) => [o.value, o.count]),
+    );
+    expect(byValue.get("founder")).toBe(1);
+    expect(byValue.get("other")).toBe(1);
+    // AC2 — the response validates against flowAggregateSchema (against the
+    // ACTUAL service output, not a hand-written fixture — the .strict()
+    // check this schema-parse exercises is what would catch an unnamed
+    // leaked key, e.g. leadId/siteId/completedAt, that the name-based regex
+    // sweeps below cannot see).
+    expect(flowAggregateSchema.safeParse(body.data).success).toBe(true);
+    // AC2 — no email/name/session id/score anywhere in the serialized body.
+    const serialized = JSON.stringify(body);
+    expect(serialized).not.toMatch(/email/i);
+    expect(serialized).not.toMatch(/name/i);
+    expect(serialized).not.toMatch(/session/i);
+    expect(serialized).not.toMatch(/score/i);
+  });
+
+  it("AC5: an unknown slug returns 404 flow_not_found", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/flows/does-not-exist/aggregate",
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "flow_not_found", message: expect.any(String) },
+    });
+  });
+
+  it("AC5: a known flow with no backing register returns questions: [] with a truthful respondents", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      id: "flow_00000000-0000-7000-8000-000000000002",
+    });
+    (prisma.waitlistExperiment.findMany as jest.Mock).mockResolvedValue([]);
+    (prisma.flowSession.findMany as jest.Mock).mockResolvedValue([
+      {
+        siteId: "default",
+        flowSlug: "no-register-flow",
+        completedAt: new Date("2026-09-01T00:00:00.000Z"),
+        leadId: null,
+        state: {},
+      },
+    ]);
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/flows/no-register-flow/aggregate",
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.ok).toBe(true);
+    expect(body.data.questions).toEqual([]);
+    expect(body.data.respondents).toBe(1);
+  });
+
+  it("AC6: excludes an incomplete session (completedAt: null)", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      id: "flow_00000000-0000-7000-8000-000000000003",
+    });
+    (prisma.waitlistExperiment.findMany as jest.Mock).mockImplementation(
+      ({ where }: { where: { siteId: string } }) =>
+        Promise.resolve(
+          where.siteId === "default"
+            ? [
+                {
+                  id: "wlexp_00000000-0000-7000-8000-000000000001",
+                  siteId: "default",
+                  config: aggregateConfig(),
+                },
+              ]
+            : [],
+        ),
+    );
+    (prisma.flowSession.findMany as jest.Mock).mockImplementation(
+      ({ where }: { where: { completedAt?: { not: unknown } } }) =>
+        Promise.resolve(
+          where.completedAt?.not === null
+            ? [
+                {
+                  siteId: "default",
+                  flowSlug: "founder-diagnostic-general",
+                  completedAt: new Date("2026-09-01T00:00:00.000Z"),
+                  leadId: null,
+                  state: { role_step: { role: "founder" } },
+                },
+              ]
+            : [],
+        ),
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/flows/founder-diagnostic-general/aggregate",
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.respondents).toBe(1);
+  });
+
+  it("400 invalid_input for a malformed slug", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/flows/Not_A_Valid_Slug!/aggregate",
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.json().error.code).toBe("invalid_input");
+  });
+
+  it("503 flows_not_configured when DATABASE_URL is unset", async () => {
+    delete process.env.DATABASE_URL;
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/flows/founder-diagnostic-general/aggregate",
+    });
+
+    expect(res.statusCode).toBe(503);
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "flows_not_configured", message: expect.any(String) },
+    });
+  });
+});