create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/project-listings/__tests__/copy-edit.test.ts

@@ -0,0 +1,815 @@
+// oss: false
+/**
+ * @file copy-edit.test.ts
+ *
+ * THE ACCEPTANCE GATE for `PATCH /v1/project-listings/:id/copy` — the
+ * operator's copy edit, the third review outcome beside approve and reject.
+ *
+ * Registration mirrors `tenant-isolation.test.ts` and `server.ts`: REAL
+ * `authPreHandlerPlugin -> tenantPreHandlerPlugin -> projectListingTenantRoutes`,
+ * mocked `lib/prisma.js`. Going through the real `projectListingTenantRoutes`
+ * plugin is deliberate and load-bearing: this route is reached only via the
+ * dynamic `TENANT_HANDLERS` table (#5182), never a static import, so a row
+ * missing from that table fails every case here rather than passing on an
+ * import the production server does not make.
+ *
+ * The `derived body` block is the load-bearing group. Its cases assert bounds
+ * NOBODY declared in this repo's route layer — the word caps, the
+ * exactly-three-FAQ rule, the fixed Q5 urgency values, the single-line
+ * headline rule — which hold only because the body is
+ * `projectListingApplicationFieldsSchema.pick(…).partial().strict()`. Replace
+ * that derivation with a hand-written `z.object({ headline: z.string(), … })`
+ * and every REJECTION case in that block fails, which is what makes them tests
+ * of the derivation rather than of the route.
+ *
+ * The two ACCEPTANCE cases in that block (a ten-word headline, a 600-character
+ * problem) are the lower halves of boundary probes and discriminate nothing on
+ * their own — any schema that accepts anything passes them. They are paired
+ * with the rejection case one unit above the bound, and are only meaningful as
+ * that pair.
+ */
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// `services/project-listings.ts` imports `routeLead` from `lead-routing.js` at
+// module scope, which transitively imports `@working-theory/email` and
+// `@working-theory/license` — mocked purely so that import chain resolves,
+// mirroring `tenant-isolation.test.ts`.
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: { findUnique: jest.fn(), update: jest.fn().mockResolvedValue(undefined) },
+    workspace: { findUnique: jest.fn(), count: jest.fn() },
+    membership: { findUnique: jest.fn() },
+    projectListing: { findFirst: jest.fn(), findMany: jest.fn(), updateMany: jest.fn() },
+    siteListingConfig: { findUnique: jest.fn() },
+    waitlistScore: { count: jest.fn() },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../../middleware/auth.js";
+import { tenantPreHandlerPlugin } from "../../../middleware/tenant.js";
+import { projectListingTenantRoutes } from "../index.js";
+
+const FRONTEND = "https://app.example.com";
+const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
+const WINDOW_OPEN = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
+const WINDOW_ELAPSED = new Date(Date.now() - 24 * 60 * 60 * 1000);
+
+const ORG_A = "org_00000000-0000-7000-8000-000000000001";
+const WS_A = "wksp_00000000-0000-7000-8000-000000000001";
+const ORG_B = "org_01991234-5678-7000-8000-0000000000bb";
+const WS_B = "wksp_00000000-0000-7000-8000-0000000000bb";
+
+const WORKSPACES = [
+  { id: WS_A, organizationId: ORG_A },
+  { id: WS_B, organizationId: ORG_B },
+];
+
+const MEMBERSHIPS = [
+  { organizationId: ORG_A, userId: "alice", role: "owner" },
+  { organizationId: ORG_B, userId: "erin", role: "admin" },
+  { organizationId: ORG_B, userId: "carol", role: "member" },
+];
+
+const SESSION_ROWS: Record<string, Record<string, unknown>> = {
+  cookie_alice: {
+    id: "sess_alice",
+    userId: "alice",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG_A,
+    activeWorkspaceId: WS_A,
+  },
+  cookie_erin: {
+    id: "sess_erin",
+    userId: "erin",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG_B,
+    activeWorkspaceId: WS_B,
+  },
+  cookie_carol: {
+    id: "sess_carol",
+    userId: "carol",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG_B,
+    activeWorkspaceId: WS_B,
+  },
+};
+
+const opt = (value: string, label: string) => ({ value, label });
+
+/** A valid `questions` instance — every refinement the package declares satisfied. */
+const QUESTIONS = {
+  q2: { prompt: "Why now?", options: [opt("scale", "Scale"), opt("just-curious", "Just curious")] },
+  q3: { prompt: "What stage?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q4: { prompt: "What team?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q5: {
+    prompt: "How urgent?",
+    options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")],
+  },
+  q6: {
+    prompt: "How painful?",
+    options: [opt("low", "Low"), opt("medium", "Medium"), opt("high", "High"), opt("critical", "Critical")],
+  },
+  q7: { prompt: "Anything else?" },
+  extras: [],
+};
+
+/** Exactly three — the detail page's fixed FAQ slot. */
+const FAQS = [
+  { question: "What is it?", answer: "A thing." },
+  { question: "Who is it for?", answer: "Founders." },
+  { question: "What does it cost?", answer: "Nothing." },
+];
+
+const LISTING_A = "prjl_00000000-0000-7000-8000-0000000000a1";
+const LISTING_B = "prjl_00000000-0000-7000-8000-0000000000b1";
+
+const ORIGINAL_HEADLINE = "The headline the applicant submitted";
+const ORIGINAL_ONE_LINER = "The one-liner the applicant submitted.";
+const ORIGINAL_PROBLEM = "The problem the applicant described.";
+
+function makeRow(overrides: Partial<Record<string, unknown>> = {}) {
+  return {
+    id: LISTING_A,
+    siteId: WS_A,
+    leadId: "lead_00000000-0000-7000-8000-000000000001",
+    slug: "my-project",
+    name: "My Project",
+    headline: ORIGINAL_HEADLINE,
+    oneLiner: ORIGINAL_ONE_LINER,
+    problem: ORIGINAL_PROBLEM,
+    url: null,
+    product: "working-prototype",
+    commitment: "part-time",
+    teamComposition: "just-me",
+    faqs: FAQS,
+    anythingElse: "A private note to the reviewer.",
+    address: "1 Example Street, Exampleton, EX1 2AM",
+    questions: QUESTIONS,
+    founderName: "Ada Founder",
+    founderEmail: "ada@example.com",
+    founderCompany: null,
+    logoMarkUrl: null,
+    logoWordmarkUrl: null,
+    featured: false,
+    status: "requested",
+    consentAt: new Date("2026-09-01T00:00:00.000Z"),
+    decidedAt: null,
+    decidedBy: null,
+    submittedCopy: null,
+    copyEditedAt: null,
+    copyEditedBy: null,
+    issueUrl: null,
+    experimentKey: null,
+    windowDays: 21,
+    windowEndsAt: null,
+    slackChannel: null,
+    slackTs: null,
+    createdAt: new Date("2026-09-01T00:00:00.000Z"),
+    updatedAt: new Date("2026-09-01T00:00:00.000Z"),
+    ...overrides,
+  };
+}
+
+/**
+ * Evaluate one `where` term against a row, covering only the operators this
+ * route's own WHERE actually uses: scalar equality and `windowEndsAt: { gt }`.
+ * `OR` is evaluated as a disjunction over these same terms, which is what
+ * makes the computed-`closed` cases below a real test of the route's guard
+ * rather than of the mock.
+ */
+function matchesTerm(row: Record<string, unknown>, term: Record<string, unknown>): boolean {
+  return Object.entries(term).every(([key, expected]) => {
+    if (key === "OR") {
+      return (expected as Record<string, unknown>[]).some((t) => matchesTerm(row, t));
+    }
+    if (expected !== null && typeof expected === "object" && "gt" in expected) {
+      const actual = row[key];
+      const bound = (expected as { gt: Date }).gt;
+      return actual instanceof Date && actual.getTime() > bound.getTime();
+    }
+    return row[key] === expected;
+  });
+}
+
+function installFixtureMocks(rows = [makeRow()]): void {
+  (prisma.session.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { token?: string } }) =>
+      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
+  );
+  (prisma.workspace.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { id?: string } }) =>
+      Promise.resolve(WORKSPACES.find((w) => w.id === where.id) ?? null),
+  );
+  (prisma.workspace.count as jest.Mock).mockResolvedValue(WORKSPACES.length);
+  (prisma.membership.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { organizationId_userId?: { organizationId: string; userId: string } } }) => {
+      const key = where.organizationId_userId;
+      if (!key) return Promise.resolve(null);
+      return Promise.resolve(
+        MEMBERSHIPS.find((m) => m.organizationId === key.organizationId && m.userId === key.userId) ??
+          null,
+      );
+    },
+  );
+
+  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.find((r) => matchesTerm(r, where)) ?? null),
+  );
+  // The guarded compare-and-swap: a row is mutated only when EVERY `where`
+  // term matches, so a status the route refuses returns `{ count: 0 }` with the
+  // row untouched — the property every refusal case below asserts.
+  (prisma.projectListing.updateMany as jest.Mock).mockImplementation(
+    ({ where, data }: { where: Record<string, unknown>; data: Record<string, unknown> }) => {
+      const row = rows.find((r) => matchesTerm(r, where));
+      if (!row) return Promise.resolve({ count: 0 });
+      Object.assign(row, data);
+      return Promise.resolve({ count: 1 });
+    },
+  );
+  // No `SiteListingConfig` row — `listingConfigFor` falls back to
+  // `SITE_LISTING_CONFIG_DEFAULTS`, whose word caps are the platform's ten and
+  // twenty-five and whose `collectedFields` names every application field. That
+  // is the shape most sites run in, and it is what makes the derived-body
+  // assertions below read against the package's own defaults. The configured
+  // cases install a row of their own.
+  (prisma.siteListingConfig.findUnique as jest.Mock).mockResolvedValue(null);
+  (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(0);
+}
+
+/** Install a site config row, for the cases that exercise configured bounds. */
+function installSiteConfig(data: Record<string, unknown>): void {
+  (prisma.siteListingConfig.findUnique as jest.Mock).mockResolvedValue({ data });
+}
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(async (scope) => {
+    await scope.register(tenantPreHandlerPlugin);
+    await scope.register(projectListingTenantRoutes);
+  });
+  await app.ready();
+  return app;
+}
+
+function cookieHeaders(token: string): Record<string, string> {
+  return { cookie: `better-auth.session_token=${token}`, origin: FRONTEND };
+}
+
+function copyPatch(
+  app: FastifyInstance,
+  payload: unknown,
+  { cookie = "cookie_alice", id = LISTING_A }: { cookie?: string; id?: string } = {},
+) {
+  return app.inject({
+    method: "PATCH",
+    url: `/v1/project-listings/${id}/copy`,
+    headers: cookieHeaders(cookie),
+    payload: payload as Record<string, unknown>,
+  });
+}
+
+describe("PATCH /v1/project-listings/:id/copy", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  // ── Registration ────────────────────────────────────────────────────────
+
+  it("is reachable through the dynamic TENANT_HANDLERS table, not a static import", async () => {
+    installFixtureMocks();
+    const res = await copyPatch(app, { headline: "A trimmed headline" });
+    // A 404 from Fastify's own router (route not registered) carries no `ok`
+    // envelope; anything with one means the handler ran.
+    expect(res.statusCode).not.toBe(404);
+    expect(res.json()).toHaveProperty("ok");
+    expect(app.hasRoute({ method: "PATCH", url: "/v1/project-listings/:id/copy" })).toBe(true);
+  });
+
+  // ── The happy paths ─────────────────────────────────────────────────────
+
+  it("edits a `requested` listing's headline and returns the changed row", async () => {
+    const rows = [makeRow({ status: "requested" })];
+    installFixtureMocks(rows);
+    const res = await copyPatch(app, { headline: "A trimmed headline" });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.headline).toBe("A trimmed headline");
+    expect(rows[0]!.headline).toBe("A trimmed headline");
+  });
+
+  it("edits an `active` listing whose window is still in force", async () => {
+    const rows = [makeRow({ status: "active", windowEndsAt: WINDOW_OPEN })];
+    installFixtureMocks(rows);
+    const res = await copyPatch(app, { oneLiner: "A trimmed one-liner." });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.oneLiner).toBe("A trimmed one-liner.");
+    expect(rows[0]!.oneLiner).toBe("A trimmed one-liner.");
+  });
+
+  it("edits a featured `active` listing, which is window-exempt", async () => {
+    const rows = [makeRow({ status: "active", featured: true, windowEndsAt: null })];
+    installFixtureMocks(rows);
+    const res = await copyPatch(app, { problem: "A trimmed problem." });
+    expect(res.statusCode).toBe(200);
+    expect(rows[0]!.problem).toBe("A trimmed problem.");
+  });
+
+  it("writes only the keys the operator sent, leaving the rest of the copy alone", async () => {
+    const rows = [makeRow()];
+    installFixtureMocks(rows);
+    const res = await copyPatch(app, { headline: "Only this one" });
+    expect(res.statusCode).toBe(200);
+    expect(rows[0]!.oneLiner).toBe(ORIGINAL_ONE_LINER);
+    expect(rows[0]!.problem).toBe(ORIGINAL_PROBLEM);
+    expect(rows[0]!.faqs).toEqual(FAQS);
+    expect(rows[0]!.questions).toEqual(QUESTIONS);
+  });
+
+  it("edits `questions`, whose prompts and option labels render publicly", async () => {
+    const rows = [makeRow()];
+    installFixtureMocks(rows);
+    const edited = { ...QUESTIONS, q7: { prompt: "A civil closing question?" } };
+    const res = await copyPatch(app, { questions: edited });
+    expect(res.statusCode).toBe(200);
+    expect((rows[0]!.questions as typeof QUESTIONS).q7.prompt).toBe("A civil closing question?");
+  });
+
+  // ── The status floor ────────────────────────────────────────────────────
+
+  it.each([
+    ["draft", { status: "draft" }],
+    ["rejected", { status: "rejected" }],
+    ["closed (an `active` row whose window has elapsed)", {
+      status: "active",
+      windowEndsAt: WINDOW_ELAPSED,
+    }],
+    ["closed (a non-featured `active` row carrying no window at all)", {
+      status: "active",
+      windowEndsAt: null,
+    }],
+  ])("refuses a %s listing and leaves every copy field untouched", async (_name, overrides) => {
+    const rows = [makeRow(overrides)];
+    installFixtureMocks(rows);
+    const res = await copyPatch(app, { headline: "Should never land" });
+    expect(res.statusCode).toBe(404);
+    expect(rows[0]!.headline).toBe(ORIGINAL_HEADLINE);
+    expect(rows[0]!.submittedCopy).toBeNull();
+    expect(rows[0]!.copyEditedAt).toBeNull();
+    expect(rows[0]!.copyEditedBy).toBeNull();
+  });
+
+  // ── Derived body — the load-bearing block ───────────────────────────────
+  //
+  // Every REJECTION case here asserts a bound this route never declares. They
+  // pass only because the body is derived from
+  // `projectListingApplicationFieldsSchema.pick(…)`; against a hand-written
+  // `z.object({ headline: z.string(), oneLiner: z.string(), problem:
+  // z.string(), faqs: z.array(...), questions: z.record(...) })` every one of
+  // them fails — verified by actually making that substitution and watching
+  // them go red. The two acceptance cases are boundary lower-halves and do not
+  // discriminate on their own; see the file docstring.
+
+  describe("derived body", () => {
+    it("rejects an eleven-word headline, on the package's ten-word cap", async () => {
+      const rows = [makeRow()];
+      installFixtureMocks(rows);
+      const res = await copyPatch(app, {
+        headline: "one two three four five six seven eight nine ten eleven",
+      });
+      expect(res.statusCode).toBe(400);
+      expect(res.json().error.code).toBe("invalid_input");
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+      expect(rows[0]!.headline).toBe(ORIGINAL_HEADLINE);
+    });
+
+    it("accepts a ten-word headline, so the cap is the package's and not an off-by-one", async () => {
+      installFixtureMocks();
+      const res = await copyPatch(app, {
+        headline: "one two three four five six seven eight nine ten",
+      });
+      expect(res.statusCode).toBe(200);
+    });
+
+    it("rejects a twenty-six-word one-liner, on the package's twenty-five-word cap", async () => {
+      installFixtureMocks();
+      const words = Array.from({ length: 26 }, (_v, i) => `w${i}`).join(" ");
+      const res = await copyPatch(app, { oneLiner: words });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+    });
+
+    it("rejects two FAQs, on the package's exactly-three rule", async () => {
+      const rows = [makeRow()];
+      installFixtureMocks(rows);
+      const res = await copyPatch(app, { faqs: FAQS.slice(0, 2) });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+      expect(rows[0]!.faqs).toEqual(FAQS);
+    });
+
+    it("rejects four FAQs on the same rule", async () => {
+      installFixtureMocks();
+      const res = await copyPatch(app, {
+        faqs: [...FAQS, { question: "One more?", answer: "No." }],
+      });
+      expect(res.statusCode).toBe(400);
+    });
+
+    it("rejects a q5 option value outside its fixed urgency set", async () => {
+      const rows = [makeRow()];
+      installFixtureMocks(rows);
+      const res = await copyPatch(app, {
+        questions: {
+          ...QUESTIONS,
+          q5: {
+            prompt: "How urgent?",
+            options: [opt("whenever", "Whenever"), opt("planning", "Soon"), opt("exploring", "Someday")],
+          },
+        },
+      });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+      expect(rows[0]!.questions).toEqual(QUESTIONS);
+    });
+
+    it("rejects a headline carrying a newline, on the package's single-line rule", async () => {
+      const rows = [makeRow()];
+      installFixtureMocks(rows);
+      const res = await copyPatch(app, { headline: "Two\nlines" });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+      expect(rows[0]!.headline).toBe(ORIGINAL_HEADLINE);
+    });
+
+    it.each([
+      ["headline", 121],
+      ["oneLiner", 401],
+      ["problem", 601],
+    ])("rejects a `%s` one character over the package's character cap", async (field, len) => {
+      installFixtureMocks();
+      // Single characters separated by spaces stay well inside every WORD cap,
+      // so only the character bound can be what rejects this.
+      const value = "a".repeat(len);
+      const res = await copyPatch(app, { [field]: value });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+    });
+
+    it("accepts a `problem` exactly at the 600-character cap", async () => {
+      installFixtureMocks();
+      const res = await copyPatch(app, { problem: "a".repeat(600) });
+      expect(res.statusCode).toBe(200);
+    });
+
+    it.each(["headline", "oneLiner", "problem"])(
+      "rejects an empty `%s`, on the package's min-length rule",
+      async (field) => {
+        installFixtureMocks();
+        const res = await copyPatch(app, { [field]: "" });
+        expect(res.statusCode).toBe(400);
+        expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+      },
+    );
+
+    it("rejects an empty FAQ answer, on the package's inner bounds", async () => {
+      installFixtureMocks();
+      const res = await copyPatch(app, {
+        faqs: [{ question: "What is it?", answer: "" }, FAQS[1]!, FAQS[2]!],
+      });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+    });
+
+    it("rejects an over-long FAQ answer, on the package's 1000-character inner cap", async () => {
+      installFixtureMocks();
+      const res = await copyPatch(app, {
+        faqs: [{ question: "What is it?", answer: "a".repeat(1001) }, FAQS[1]!, FAQS[2]!],
+      });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+    });
+
+    it("rejects an extra FAQ key, because the FAQ entry schema is strict too", async () => {
+      installFixtureMocks();
+      const res = await copyPatch(app, {
+        faqs: [{ question: "What is it?", answer: "A thing.", note: "x" }, FAQS[1]!, FAQS[2]!],
+      });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+    });
+
+    it("rejects a q2 whose final option is not the fixed `just-curious` bail-out", async () => {
+      installFixtureMocks();
+      const res = await copyPatch(app, {
+        questions: {
+          ...QUESTIONS,
+          q2: { prompt: "Why now?", options: [opt("scale", "Scale"), opt("growth", "Growth")] },
+        },
+      });
+      expect(res.statusCode).toBe(400);
+    });
+  });
+
+  // ── The founder's extra questions ───────────────────────────────────────
+  //
+  // `questions` is replaced wholesale, and `extras` carries a `.default([])` in
+  // the package schema — so a payload omitting the key parses to `extras: []`,
+  // which is indistinguishable from a deliberate clear. Accepting it would
+  // silently delete up to three founder-authored questions. The route refuses
+  // the ambiguous body instead.
+
+  describe("questions.extras", () => {
+    const EXTRAS = [
+      { prompt: "An extra question?", options: [opt("a", "A"), opt("b", "B")] },
+    ];
+
+    it("refuses a `questions` payload that omits `extras`, rather than clearing them", async () => {
+      const rows = [makeRow({ questions: { ...QUESTIONS, extras: EXTRAS } })];
+      installFixtureMocks(rows);
+
+      const { extras: _dropped, ...withoutExtras } = QUESTIONS;
+      const res = await copyPatch(app, { questions: withoutExtras });
+
+      expect(res.statusCode).toBe(400);
+      expect(res.json().error.message).toContain("extras");
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+      expect((rows[0]!.questions as { extras: unknown }).extras).toEqual(EXTRAS);
+    });
+
+    it("accepts an explicit empty `extras`, which is how the operator clears them", async () => {
+      const rows = [makeRow({ questions: { ...QUESTIONS, extras: EXTRAS } })];
+      installFixtureMocks(rows);
+      const res = await copyPatch(app, { questions: { ...QUESTIONS, extras: [] } });
+      expect(res.statusCode).toBe(200);
+      expect((rows[0]!.questions as { extras: unknown }).extras).toEqual([]);
+    });
+
+    it("preserves the founder's extras when the operator sends them back unchanged", async () => {
+      const rows = [makeRow({ questions: { ...QUESTIONS, extras: EXTRAS } })];
+      installFixtureMocks(rows);
+      const res = await copyPatch(app, {
+        questions: { ...QUESTIONS, extras: EXTRAS, q7: { prompt: "A trimmed closing question?" } },
+      });
+      expect(res.statusCode).toBe(200);
+      const written = rows[0]!.questions as { extras: unknown; q7: { prompt: string } };
+      expect(written.extras).toEqual(EXTRAS);
+      expect(written.q7.prompt).toBe("A trimmed closing question?");
+    });
+
+    it("does not require `extras` when the body carries no `questions` at all", async () => {
+      installFixtureMocks();
+      const res = await copyPatch(app, { headline: "A trimmed headline" });
+      expect(res.statusCode).toBe(200);
+    });
+  });
+
+  // ── The SITE's configured bounds, not the platform's ────────────────────
+  //
+  // Since #5048 D5/D6 the word caps and the collected field set are the site's
+  // own configuration. The applicant's write path compiles its schema from
+  // them; so must the operator's, or the two disagree about the same listing.
+
+  describe("site-configured bounds", () => {
+    it("accepts a fourteen-word headline on a site configured to fifteen", async () => {
+      installFixtureMocks();
+      installSiteConfig({ wordCaps: { headline: 15, oneLiner: 25 } });
+      const res = await copyPatch(app, {
+        headline: "one two three four five six seven eight nine ten eleven twelve thirteen fourteen",
+      });
+      // Against the platform default of ten this is a 400. The operator must be
+      // able to re-save copy the applicant was legitimately allowed to submit.
+      expect(res.statusCode).toBe(200);
+    });
+
+    it("rejects a seven-word headline on a site configured to six", async () => {
+      const rows = [makeRow()];
+      installFixtureMocks(rows);
+      installSiteConfig({ wordCaps: { headline: 6, oneLiner: 25 } });
+      const res = await copyPatch(app, { headline: "one two three four five six seven" });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+      expect(rows[0]!.headline).toBe(ORIGINAL_HEADLINE);
+    });
+
+    it("refuses a field the site does not collect, so the operator cannot author one", async () => {
+      const rows = [makeRow()];
+      installFixtureMocks(rows);
+      installSiteConfig({ collectedFields: ["name", "headline", "oneLiner", "problem"] });
+      const res = await copyPatch(app, { faqs: FAQS });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+      expect(rows[0]!.faqs).toEqual(FAQS);
+    });
+
+    it("still accepts a field the site does collect, on that same narrowed config", async () => {
+      installFixtureMocks();
+      installSiteConfig({ collectedFields: ["name", "headline", "oneLiner", "problem"] });
+      const res = await copyPatch(app, { headline: "A trimmed headline" });
+      expect(res.statusCode).toBe(200);
+    });
+
+    it("400s rather than 500s on a site collecting none of the five copy fields", async () => {
+      installFixtureMocks();
+      // `pickCollected` THROWS on an empty mask — it guards the applicant's
+      // surface, where a schema requiring nothing is never legitimate. Reaching
+      // it here would be a 500, so the route refuses first.
+      installSiteConfig({ collectedFields: ["name", "url"] });
+      const res = await copyPatch(app, { headline: "A trimmed headline" });
+      expect(res.statusCode).toBe(400);
+      expect(res.json().error.code).toBe("invalid_input");
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+    });
+  });
+
+  // ── Strictness and the at-least-one-key refine ──────────────────────────
+
+  it("rejects an unknown key, because the derived body is strict", async () => {
+    const rows = [makeRow()];
+    installFixtureMocks(rows);
+    const res = await copyPatch(app, { headline: "Fine", somethingElse: "nope" });
+    expect(res.statusCode).toBe(400);
+    expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+    expect(rows[0]!.headline).toBe(ORIGINAL_HEADLINE);
+  });
+
+  it.each(["name", "url", "product", "commitment", "teamComposition", "address", "founderCompany", "anythingElse"])(
+    "rejects `%s`, which is outside the editable set, and writes nothing",
+    async (field) => {
+      const rows = [makeRow()];
+      installFixtureMocks(rows);
+      const res = await copyPatch(app, { headline: "Fine", [field]: "whatever" });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+      expect(rows[0]!.name).toBe("My Project");
+      expect(rows[0]!.anythingElse).toBe("A private note to the reviewer.");
+    },
+  );
+
+  it.each(["status", "featured", "decidedBy", "siteId", "submittedCopy", "copyEditedBy"])(
+    "rejects `%s`, so the copy route cannot reach the decision or audit surface",
+    async (field) => {
+      const rows = [makeRow()];
+      installFixtureMocks(rows);
+      const res = await copyPatch(app, { [field]: "active" });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+      expect(rows[0]!.status).toBe("requested");
+    },
+  );
+
+  it("rejects an empty body, on the at-least-one-key refine `.partial()` would otherwise allow", async () => {
+    const rows = [makeRow()];
+    installFixtureMocks(rows);
+    const res = await copyPatch(app, {});
+    expect(res.statusCode).toBe(400);
+    expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+    expect(rows[0]!.copyEditedAt).toBeNull();
+  });
+
+  // ── The write-once snapshot ─────────────────────────────────────────────
+
+  it("captures the applicant's submitted copy on the FIRST edit", async () => {
+    const rows = [makeRow()];
+    installFixtureMocks(rows);
+    const res = await copyPatch(app, { headline: "A trimmed headline" });
+    expect(res.statusCode).toBe(200);
+    expect(rows[0]!.submittedCopy).toEqual({
+      headline: ORIGINAL_HEADLINE,
+      oneLiner: ORIGINAL_ONE_LINER,
+      problem: ORIGINAL_PROBLEM,
+      faqs: FAQS,
+      questions: QUESTIONS,
+    });
+  });
+
+  it("leaves the snapshot at its first-edit value on a SECOND edit", async () => {
+    const rows = [makeRow()];
+    installFixtureMocks(rows);
+
+    const first = await copyPatch(app, { headline: "First trim" });
+    expect(first.statusCode).toBe(200);
+    const afterFirst = structuredClone(rows[0]!.submittedCopy);
+
+    const second = await copyPatch(app, { headline: "Second trim", problem: "Second problem." });
+    expect(second.statusCode).toBe(200);
+
+    // The row moved; the snapshot did not.
+    expect(rows[0]!.headline).toBe("Second trim");
+    expect(rows[0]!.problem).toBe("Second problem.");
+    expect(rows[0]!.submittedCopy).toEqual(afterFirst);
+    expect((rows[0]!.submittedCopy as { headline: string }).headline).toBe(ORIGINAL_HEADLINE);
+    expect((rows[0]!.submittedCopy as { problem: string }).problem).toBe(ORIGINAL_PROBLEM);
+  });
+
+  it("does not re-send the snapshot at all on a second edit", async () => {
+    installFixtureMocks();
+    await copyPatch(app, { headline: "First trim" });
+    await copyPatch(app, { headline: "Second trim" });
+
+    const writes = (prisma.projectListing.updateMany as jest.Mock).mock.calls.map(
+      ([arg]) => (arg as { data: Record<string, unknown> }).data,
+    );
+    expect(writes).toHaveLength(2);
+    expect(writes[0]).toHaveProperty("submittedCopy");
+    expect(writes[1]).not.toHaveProperty("submittedCopy");
+  });
+
+  it("stamps copyEditedAt and copyEditedBy on EVERY successful edit, from the session's user", async () => {
+    const rows = [makeRow()];
+    installFixtureMocks(rows);
+
+    await copyPatch(app, { headline: "First trim" });
+    expect(rows[0]!.copyEditedBy).toBe("alice");
+    const firstStamp = rows[0]!.copyEditedAt as Date;
+    expect(firstStamp).toBeInstanceOf(Date);
+
+    await copyPatch(app, { headline: "Second trim" });
+    expect(rows[0]!.copyEditedBy).toBe("alice");
+    expect((rows[0]!.copyEditedAt as Date).getTime()).toBeGreaterThanOrEqual(firstStamp.getTime());
+  });
+
+  it("never returns the audit columns on the wire — the response is the unchanged row contract", async () => {
+    installFixtureMocks();
+    const res = await copyPatch(app, { headline: "A trimmed headline" });
+    expect(res.statusCode).toBe(200);
+    const body = res.json().data;
+    expect(body).not.toHaveProperty("submittedCopy");
+    expect(body).not.toHaveProperty("copyEditedAt");
+    expect(body).not.toHaveProperty("copyEditedBy");
+  });
+
+  // ── Tenant isolation, matching tenant-isolation.test.ts's posture ────────
+
+  it("404s a copy edit against another site's listing id, writing nothing", async () => {
+    const rows = [makeRow(), makeRow({ id: LISTING_B, siteId: WS_B, headline: "Site B's headline" })];
+    installFixtureMocks(rows);
+    const res = await copyPatch(app, { headline: "Cross-tenant" }, { id: LISTING_B });
+    expect(res.statusCode).toBe(404);
+    expect(rows[1]!.headline).toBe("Site B's headline");
+    expect(rows[1]!.submittedCopy).toBeNull();
+  });
+
+  it("404s an unknown id indistinguishably from a foreign one", async () => {
+    const rows = [makeRow(), makeRow({ id: LISTING_B, siteId: WS_B })];
+    installFixtureMocks(rows);
+    const foreign = await copyPatch(app, { headline: "Cross-tenant" }, { id: LISTING_B });
+    const missing = await copyPatch(
+      app,
+      { headline: "Cross-tenant" },
+      { id: "prjl_00000000-0000-7000-8000-00000000dead" },
+    );
+    expect(missing.statusCode).toBe(404);
+    expect(missing.body).toBe(foreign.body);
+  });
+
+  it("403s a member, before any listing read", async () => {
+    installFixtureMocks([makeRow({ id: LISTING_B, siteId: WS_B })]);
+    const res = await copyPatch(app, { headline: "Nope" }, { cookie: "cookie_carol", id: LISTING_B });
+    expect(res.statusCode).toBe(403);
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+    expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+  });
+
+  it("401s with no cookie, before any listing read", async () => {
+    installFixtureMocks();
+    const res = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/${LISTING_A}/copy`,
+      payload: { headline: "Nope" },
+    });
+    expect(res.statusCode).toBe(401);
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("400s a malformed :id", async () => {
+    installFixtureMocks();
+    const res = await copyPatch(app, { headline: "Nope" }, { id: "not-a-valid-id" });
+    expect(res.statusCode).toBe(400);
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+});