create-ailk 0.1.0

package/templates/apps/api/src/lib/__tests__/file-fallback.test.ts

@@ -0,0 +1,144 @@
+/**
+ * @file file-fallback.test.ts
+ * @description Unit tests for file-fallback.ts — writeLeadFallback
+ *
+ * Test path deviation from spec §3: spec states apps/api/__tests__/lib/,
+ * but jest.config.cjs roots at <rootDir>/src, so tests live at
+ * apps/api/src/lib/__tests__/ to match the existing repo convention.
+ */
+
+import * as fs from "fs/promises";
+import * as os from "os";
+import * as path from "path";
+
+import { writeLeadFallback } from "../file-fallback.js";
+import type { FallbackLead } from "../file-fallback.js";
+
+function makeLead(overrides: Partial<FallbackLead> = {}): FallbackLead {
+  return {
+    id: "abc123de",
+    siteId: "site-001",
+    source: "oss-form",
+    email: "test@example.com",
+    payload: { message: "hello" },
+    createdAt: "2026-05-08T12:00:00.000Z",
+    ...overrides,
+  };
+}
+
+let tmpDir: string;
+
+beforeEach(async () => {
+  tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "file-fallback-test-"));
+  process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
+});
+
+afterEach(async () => {
+  delete process.env.AILK_INBOX_FALLBACK_DIR;
+  await fs.rm(tmpDir, { recursive: true, force: true });
+});
+
+describe("writeLeadFallback", () => {
+  it("happy path: writes <timestamp>-<id>.json; file content parses back to lead", async () => {
+    const lead = makeLead();
+    const result = await writeLeadFallback(lead);
+
+    expect(result).toMatchObject({ ok: true });
+    if (!result.ok) throw new Error("expected ok");
+
+    const raw = await fs.readFile(result.path, "utf8");
+    const parsed = JSON.parse(raw);
+    expect(parsed).toMatchObject({ id: lead.id, email: lead.email });
+    expect(result.path).toContain(`-${lead.id}.json`);
+  });
+
+  it("directory creation: creates target dir if it does not exist", async () => {
+    const nested = path.join(tmpDir, "new-subdir", "inbox");
+    process.env.AILK_INBOX_FALLBACK_DIR = nested;
+
+    const lead = makeLead();
+    const result = await writeLeadFallback(lead);
+
+    expect(result).toMatchObject({ ok: true });
+    const stat = await fs.stat(nested);
+    expect(stat.isDirectory()).toBe(true);
+  });
+
+  it("invalid createdAt falls back to current ISO timestamp", async () => {
+    const lead = makeLead({ createdAt: "not-a-date" });
+    const result = await writeLeadFallback(lead);
+
+    expect(result).toMatchObject({ ok: true });
+    if (!result.ok) throw new Error("expected ok");
+
+    // Filename must match the ISO-derived pattern: YYYY-MM-DDTHH-MM-SS.mmmZ-<id>.json
+    const filename = path.basename(result.path);
+    expect(filename).toMatch(
+      /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}\.\d{3}Z-abc123de\.json$/,
+    );
+  });
+
+  it("path traversal via lead.id: rejected with invalid_id (no fs touch)", async () => {
+    const lead = makeLead({ id: "../../etc/passwd" });
+    const result = await writeLeadFallback(lead);
+
+    expect(result).toMatchObject({ ok: false, error: { kind: "invalid_id" } });
+    const files = await fs.readdir(tmpDir);
+    expect(files).toHaveLength(0);
+  });
+
+  it("path traversal via env var: resolved path stays inside targetDir", async () => {
+    // Env var with traversal — operator-controlled but function validates
+    const resolved = path.resolve(
+      process.cwd(),
+      `${tmpDir}/legit/../../${path.basename(tmpDir)}`,
+    );
+    process.env.AILK_INBOX_FALLBACK_DIR = `${tmpDir}/legit/../../${path.basename(tmpDir)}`;
+
+    const lead = makeLead();
+    const result = await writeLeadFallback(lead);
+
+    // The resolved dir is valid — write succeeds; path stays inside resolved targetDir
+    expect(result).toMatchObject({ ok: true });
+    if (!result.ok) throw new Error("expected ok");
+    expect(result.path.startsWith(resolved)).toBe(true);
+  });
+
+  it("filesystem error: returns fs_error result; does not throw", async () => {
+    // Make targetDir a file (not a directory) to force mkdir failure
+    await fs.rm(tmpDir, { recursive: true });
+    await fs.writeFile(tmpDir, "not-a-dir");
+
+    const lead = makeLead();
+    const result = await writeLeadFallback(lead);
+
+    expect(result).toMatchObject({ ok: false, error: { kind: "fs_error" } });
+  });
+
+  it("Windows-compat: colons are replaced with hyphens in the timestamp portion of the filename", async () => {
+    const lead = makeLead({ createdAt: "2026-05-08T12:00:00.000Z" });
+    const result = await writeLeadFallback(lead);
+
+    expect(result).toMatchObject({ ok: true });
+    if (!result.ok) throw new Error("expected ok");
+
+    const filename = path.basename(result.path);
+    expect(filename).not.toContain(":");
+  });
+
+  it("crafted createdAt traversal: ISO validator rejects non-ISO, falls back to current, writes inside targetDir", async () => {
+    const lead = makeLead({ createdAt: "../2026" });
+    const result = await writeLeadFallback(lead);
+
+    // ISO validator rejects '../2026' → falls back to new Date().toISOString()
+    // Write succeeds inside targetDir; no escape file created
+    expect(result).toMatchObject({ ok: true });
+    if (!result.ok) throw new Error("expected ok");
+    expect(result.path.startsWith(tmpDir)).toBe(true);
+
+    // Confirm no file was written outside tmpDir (escape path would be one level up)
+    const escapedDir = path.resolve(tmpDir, "..");
+    const escapedFile = path.join(escapedDir, `2026-${lead.id}.json`);
+    await expect(fs.stat(escapedFile)).rejects.toThrow();
+  });
+});

package/templates/apps/api/src/lib/__tests__/fixtures/HomePage/home.mdx

@@ -0,0 +1,8 @@
+---
+type: HomePage
+slug: home
+title: AI Launch Kit
+description: AX-first OSS template for shipping software with API and MCP.
+---
+
+Home content.

package/templates/apps/api/src/lib/__tests__/lead-capture-store.test.ts

@@ -0,0 +1,227 @@
+/**
+ * @file lead-capture-store.test.ts
+ * Unit tests for the lead-capture-store write path (Issue #27 Unit 1).
+ *
+ * All fs operations are mocked; no real disk I/O in these tests.
+ * Acceptance criteria covered (spec §5.1):
+ *   AC1  — file write on every successful submission (always-on by default)
+ *   AC3  — IPs default OFF; opt-in via LEAD_CAPTURE_INCLUDE_IP=true
+ *   AC4  — LEAD_CAPTURE_FILE_DISABLED=true short-circuits write
+ *   AC5  — LEAD_CAPTURE_FILE env drives output path
+ *   AC7  — 50 concurrent writes land without corruption (POSIX O_APPEND atomicity)
+ *   AC8  — startup-time directory check (tested in server.test.ts)
+ *   AC9  — LeadCaptureRecord shape validated by Zod schema
+ *   AC14 — appendLeadRecord resolves ok:false on fs error (never throws)
+ */
+
+// ─── fs mock ─────────────────────────────────────────────────────────────────
+const mockAppendFile = jest.fn();
+const mockAccess = jest.fn();
+const mockMkdir = jest.fn();
+
+jest.mock("fs/promises", () => ({
+  appendFile: (...args: unknown[]) => mockAppendFile(...args),
+  access: (...args: unknown[]) => mockAccess(...args),
+  mkdir: (...args: unknown[]) => mockMkdir(...args),
+}));
+
+import {
+  appendLeadRecord,
+  validateLeadCaptureDir,
+} from "../lead-capture-store.js";
+import type { LeadCaptureRecord } from "../lead-capture-store.js";
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+const record: LeadCaptureRecord = {
+  id: "cuid-test-1",
+  createdAt: "2024-01-01T00:00:00.000Z",
+  source: "contact",
+  data: { email: "test@example.com", message: "hello" },
+  metadata: {},
+};
+
+// ─── Tests ───────────────────────────────────────────────────────────────────
+
+describe("appendLeadRecord", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockAppendFile.mockResolvedValue(undefined);
+    mockMkdir.mockResolvedValue(undefined);
+    // Clear lead-capture env vars
+    delete process.env.LEAD_CAPTURE_FILE;
+    delete process.env.LEAD_CAPTURE_FILE_DISABLED;
+    delete process.env.LEAD_CAPTURE_INCLUDE_IP;
+  });
+
+  afterEach(() => {
+    delete process.env.LEAD_CAPTURE_FILE;
+    delete process.env.LEAD_CAPTURE_FILE_DISABLED;
+    delete process.env.LEAD_CAPTURE_INCLUDE_IP;
+  });
+
+  // AC1 — always-on by default (no env set)
+  it("writes a JSONL line by default (always-on)", async () => {
+    const result = await appendLeadRecord(record);
+
+    expect(result.ok).toBe(true);
+    expect(mockAppendFile).toHaveBeenCalledTimes(1);
+    // Verify the written content is valid JSON with a newline
+    const [, content, opts] = mockAppendFile.mock.calls[0];
+    expect(opts).toMatchObject({ flag: "a" });
+    const parsed = JSON.parse(content.trimEnd());
+    expect(parsed.id).toBe(record.id);
+    expect(parsed.source).toBe(record.source);
+  });
+
+  // AC5 — LEAD_CAPTURE_FILE drives output path
+  it("uses LEAD_CAPTURE_FILE env for output path", async () => {
+    process.env.LEAD_CAPTURE_FILE = "/tmp/test-leads.jsonl";
+    const result = await appendLeadRecord(record);
+
+    expect(result.ok).toBe(true);
+    expect(mockAppendFile).toHaveBeenCalledWith(
+      "/tmp/test-leads.jsonl",
+      expect.any(String),
+      expect.objectContaining({ flag: "a" }),
+    );
+  });
+
+  // AC5 — defaults to apps/api/leads.jsonl relative to cwd when unset
+  it("defaults to apps/api/leads.jsonl when LEAD_CAPTURE_FILE not set", async () => {
+    const result = await appendLeadRecord(record);
+
+    expect(result.ok).toBe(true);
+    const [filePath] = mockAppendFile.mock.calls[0];
+    expect(filePath).toMatch(/leads\.jsonl$/);
+  });
+
+  // AC4 — LEAD_CAPTURE_FILE_DISABLED=true skips the write
+  it("short-circuits write when LEAD_CAPTURE_FILE_DISABLED=true", async () => {
+    process.env.LEAD_CAPTURE_FILE_DISABLED = "true";
+    const result = await appendLeadRecord(record);
+
+    expect(result.ok).toBe(true);
+    expect((result as { ok: true; skipped: true }).skipped).toBe(true);
+    expect(mockAppendFile).not.toHaveBeenCalled();
+  });
+
+  // AC3 — IPs default OFF
+  it("does not include IP by default", async () => {
+    const recordWithIp: LeadCaptureRecord = {
+      ...record,
+      metadata: { ip: "1.2.3.4" },
+    };
+    const result = await appendLeadRecord(recordWithIp);
+
+    expect(result.ok).toBe(true);
+    const [, content] = mockAppendFile.mock.calls[0];
+    const parsed = JSON.parse(content.trimEnd());
+    expect(parsed.metadata?.ip).toBeUndefined();
+  });
+
+  // AC3 — LEAD_CAPTURE_INCLUDE_IP=true includes the IP
+  it("includes IP when LEAD_CAPTURE_INCLUDE_IP=true", async () => {
+    process.env.LEAD_CAPTURE_INCLUDE_IP = "true";
+    const recordWithIp: LeadCaptureRecord = {
+      ...record,
+      metadata: { ip: "1.2.3.4" },
+    };
+    const result = await appendLeadRecord(recordWithIp);
+
+    expect(result.ok).toBe(true);
+    const [, content] = mockAppendFile.mock.calls[0];
+    const parsed = JSON.parse(content.trimEnd());
+    expect(parsed.metadata?.ip).toBe("1.2.3.4");
+  });
+
+  // AC14 — never throws; returns ok:false on fs error
+  it("returns ok:false on fs error, never throws", async () => {
+    mockAppendFile.mockRejectedValue(new Error("ENOSPC: no space"));
+
+    const result = await appendLeadRecord(record);
+
+    expect(result.ok).toBe(false);
+    expect((result as { ok: false; error: string }).error).toMatch(/ENOSPC/);
+    await expect(appendLeadRecord(record)).resolves.toBeDefined();
+  });
+
+  // Written content must be JSONL (one JSON object per line + newline)
+  it("writes valid JSONL format (one JSON object + trailing newline)", async () => {
+    await appendLeadRecord(record);
+    const [, content] = mockAppendFile.mock.calls[0];
+    expect(content).toMatch(/\n$/);
+    // Must parse as JSON
+    expect(() => JSON.parse(content.trimEnd())).not.toThrow();
+  });
+
+  // AC7 — 50-concurrent write integrity (atomicity via O_APPEND flag)
+  // We verify the flag is set and all 50 calls complete successfully.
+  // Real O_APPEND atomicity is kernel-guaranteed for local filesystems.
+  it("50 concurrent writes all resolve ok:true with flag:a", async () => {
+    const promises = Array.from({ length: 50 }, (_, i) =>
+      appendLeadRecord({ ...record, id: `cuid-${i}` }),
+    );
+    const results = await Promise.all(promises);
+    expect(results).toHaveLength(50);
+    results.forEach((r) => expect(r.ok).toBe(true));
+    // All calls use flag:'a'
+    mockAppendFile.mock.calls.forEach(([, , opts]) => {
+      expect(opts).toMatchObject({ flag: "a" });
+    });
+    expect(mockAppendFile).toHaveBeenCalledTimes(50);
+  });
+
+  // Record shape must match LeadCaptureRecord (id, createdAt, source, data, metadata)
+  it("written JSONL contains all required top-level fields", async () => {
+    await appendLeadRecord(record);
+    const [, content] = mockAppendFile.mock.calls[0];
+    const parsed = JSON.parse(content.trimEnd());
+    expect(parsed).toHaveProperty("id");
+    expect(parsed).toHaveProperty("createdAt");
+    expect(parsed).toHaveProperty("source");
+    expect(parsed).toHaveProperty("data");
+    expect(parsed).toHaveProperty("metadata");
+  });
+});
+
+describe("validateLeadCaptureDir", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    delete process.env.LEAD_CAPTURE_FILE;
+    delete process.env.LEAD_CAPTURE_FILE_DISABLED;
+  });
+
+  afterEach(() => {
+    delete process.env.LEAD_CAPTURE_FILE;
+    delete process.env.LEAD_CAPTURE_FILE_DISABLED;
+  });
+
+  // AC8 — no LEAD_CAPTURE_FILE set → no-op (validation passes)
+  it("resolves without error when LEAD_CAPTURE_FILE not set", async () => {
+    await expect(validateLeadCaptureDir()).resolves.toBeUndefined();
+  });
+
+  // AC8 — LEAD_CAPTURE_FILE_DISABLED → no-op
+  it("resolves without error when LEAD_CAPTURE_FILE_DISABLED=true", async () => {
+    process.env.LEAD_CAPTURE_FILE_DISABLED = "true";
+    process.env.LEAD_CAPTURE_FILE = "/nonexistent/dir/leads.jsonl";
+    await expect(validateLeadCaptureDir()).resolves.toBeUndefined();
+  });
+
+  // AC8 — directory exists → resolves
+  it("resolves when LEAD_CAPTURE_FILE directory exists", async () => {
+    process.env.LEAD_CAPTURE_FILE = "/tmp/exists/leads.jsonl";
+    mockAccess.mockResolvedValue(undefined);
+    await expect(validateLeadCaptureDir()).resolves.toBeUndefined();
+  });
+
+  // AC8 — directory missing → throws
+  it("throws when LEAD_CAPTURE_FILE directory does not exist", async () => {
+    process.env.LEAD_CAPTURE_FILE = "/nonexistent/dir/leads.jsonl";
+    mockAccess.mockRejectedValue(
+      Object.assign(new Error("ENOENT"), { code: "ENOENT" }),
+    );
+    await expect(validateLeadCaptureDir()).rejects.toThrow(/LEAD_CAPTURE_FILE/);
+  });
+});

package/templates/apps/api/src/lib/__tests__/outbound-http.test.ts

@@ -0,0 +1,125 @@
+/**
+ * outbound-http — fetch wrapper with timeout + SSRF allow-list.
+ *
+ * Every outbound HTTP call originating from apps/api/src/lib goes through this
+ * wrapper. Two guarantees:
+ *
+ *   1. Default 10s timeout via AbortSignal.timeout
+ *   2. SSRF allow-list — RFC 1918 / loopback / link-local addresses are rejected
+ *      unless explicitly allowed (test-mode escape hatch only)
+ *
+ * The wrapper is forward-looking — apps/api/src/lib currently has no outbound
+ * fetch callsites — so the wrapper exists and tests pin its contract before
+ * the first consumer arrives.
+ */
+import { ssrfBlocked, outboundFetch } from "../outbound-http.js";
+
+describe("outbound-http — SSRF allow-list", () => {
+  it.each([
+    ["http://127.0.0.1/path", "loopback"],
+    ["http://127.255.0.1/path", "loopback"],
+    ["http://localhost/path", "loopback hostname"],
+    ["http://10.0.0.1/", "RFC 1918 10/8"],
+    ["http://10.255.255.255/", "RFC 1918 10/8 edge"],
+    ["http://172.16.0.1/", "RFC 1918 172.16/12"],
+    ["http://172.31.255.255/", "RFC 1918 172.16/12 edge"],
+    ["http://192.168.0.1/", "RFC 1918 192.168/16"],
+    ["http://192.168.255.255/", "RFC 1918 192.168/16 edge"],
+    ["http://169.254.169.254/latest/meta-data/", "AWS metadata link-local"],
+    ["http://169.254.0.1/", "link-local"],
+    ["http://[::1]/", "IPv6 loopback"],
+    ["http://0.0.0.0/", "all-interfaces wildcard"],
+  ])("rejects %s (%s)", (url) => {
+    expect(ssrfBlocked(url)).toBe(true);
+  });
+
+  it.each([
+    ["https://api.stripe.com/v1/x", "public Stripe"],
+    ["https://api.example.com/path", "generic public host"],
+    ["http://8.8.8.8/", "public IP"],
+    ["https://172.15.0.1/", "172.15 is OUT of RFC 1918 172.16/12"],
+    ["https://172.32.0.1/", "172.32 is OUT of RFC 1918 172.16/12"],
+  ])("allows %s (%s)", (url) => {
+    expect(ssrfBlocked(url)).toBe(false);
+  });
+
+  it("rejects non-HTTP schemes", () => {
+    expect(ssrfBlocked("file:///etc/passwd")).toBe(true);
+    expect(ssrfBlocked("ftp://example.com/")).toBe(true);
+    expect(ssrfBlocked("javascript:alert(1)")).toBe(true);
+    expect(ssrfBlocked("gopher://example.com/")).toBe(true);
+  });
+
+  it("rejects unparseable URLs", () => {
+    expect(ssrfBlocked("not a url")).toBe(true);
+    expect(ssrfBlocked("")).toBe(true);
+  });
+});
+
+describe("outbound-http — outboundFetch", () => {
+  let originalFetch: typeof globalThis.fetch;
+
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  it("rejects SSRF-blocked URLs before issuing a network call", async () => {
+    const fetchSpy: jest.Mock<ReturnType<typeof globalThis.fetch>, Parameters<typeof globalThis.fetch>> =
+      jest.fn();
+    globalThis.fetch = fetchSpy;
+
+    await expect(outboundFetch("http://127.0.0.1/admin")).rejects.toThrow(
+      /SSRF|disallowed|forbidden/i,
+    );
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("issues fetch on an allowed URL with a default timeout signal", async () => {
+    const fetchSpy: typeof globalThis.fetch = jest.fn(async (_url, init) => {
+      // confirm AbortSignal is wired
+      expect((init as RequestInit | undefined)?.signal).toBeDefined();
+      return new Response("ok", { status: 200 });
+    });
+    globalThis.fetch = fetchSpy;
+
+    const res = await outboundFetch("https://api.example.com/x");
+    expect(res.status).toBe(200);
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it("aborts when timeout elapses before fetch resolves", async () => {
+    // Mock fetch to honor the abort signal — simulates a real slow server.
+    const slowFetch: typeof globalThis.fetch = async (_url, init) => {
+      return new Promise((_resolve, reject) => {
+        (init as RequestInit | undefined)?.signal?.addEventListener(
+          "abort",
+          () => {
+            reject(new DOMException("aborted", "AbortError"));
+          },
+        );
+      });
+    };
+    globalThis.fetch = slowFetch;
+
+    await expect(
+      outboundFetch("https://api.example.com/slow", { timeoutMs: 50 }),
+    ).rejects.toThrow(/abort|timeout/i);
+  });
+
+  it("respects the per-call allowPrivate escape hatch (test/dev only)", async () => {
+    const fetchSpy: typeof globalThis.fetch = jest.fn(
+      async () => new Response("ok", { status: 200 }),
+    );
+    globalThis.fetch = fetchSpy;
+
+    const res = await outboundFetch("http://127.0.0.1/local-svc", {
+      allowPrivate: true,
+    });
+    expect(res.status).toBe(200);
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+  });
+});

package/templates/apps/api/src/lib/__tests__/prisma.test.ts

@@ -0,0 +1,165 @@
+/**
+ * Unit tests for the prisma.ts singleton — verify construction, log routing,
+ * and globalThis caching behaviour without touching the real adapter or DB.
+ */
+
+const mockPrismaInstance = {
+  $connect: jest.fn(),
+  $disconnect: jest.fn(),
+  user: {},
+  apiToken: {},
+  userData: {},
+};
+
+const MockPrismaClient = jest.fn().mockImplementation((options) => {
+  expect(options).toBeDefined();
+  expect(options.adapter).toBeDefined();
+  return mockPrismaInstance;
+});
+
+// Mock @prisma/adapter-pg so the import in prisma.ts doesn't construct a
+// real pg.Pool against DATABASE_URL.
+const MockPrismaPg = jest.fn().mockImplementation((config) => {
+  expect(config).toBeDefined();
+  expect(config.connectionString).toBeDefined();
+  return { __mockAdapter: true };
+});
+
+jest.mock('@prisma/adapter-pg', () => ({
+  PrismaPg: MockPrismaPg,
+}));
+
+jest.mock('@working-theory/database', () => ({
+  PrismaClient: MockPrismaClient,
+}));
+
+describe('Prisma Client', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = { ...originalEnv };
+    // Clear global prisma
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+    (globalThis as any).prisma = undefined;
+    jest.clearAllMocks();
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+    (globalThis as any).prisma = undefined;
+  });
+
+  describe('PrismaClient initialization', () => {
+    it('should create new PrismaClient instance when globalThis.prisma is undefined', () => {
+      // ARRANGE
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      (globalThis as any).prisma = undefined;
+      process.env.NODE_ENV = 'test';
+
+      // ACT
+      const { prisma } = require('../prisma');
+
+      // ASSERT
+      expect(prisma).toBeDefined();
+      const { PrismaClient } = require('@working-theory/database');
+      expect(PrismaClient).toHaveBeenCalled();
+    });
+
+    it('should use existing globalThis.prisma instance if available', () => {
+      // ARRANGE
+      const mockPrisma = { $connect: jest.fn(), user: {} };
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      (globalThis as any).prisma = mockPrisma;
+
+      // ACT
+      const { prisma } = require('../prisma');
+
+      // ASSERT
+      expect(prisma).toBe(mockPrisma);
+      const { PrismaClient } = require('@working-theory/database');
+      expect(PrismaClient).not.toHaveBeenCalled();
+    });
+
+    it('should configure logging for development environment', () => {
+      // ARRANGE
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      (globalThis as any).prisma = undefined;
+      process.env.NODE_ENV = 'development';
+
+      // ACT
+      require('../prisma');
+
+      // ASSERT
+      const { PrismaClient } = require('@working-theory/database');
+      expect(PrismaClient).toHaveBeenCalledWith({
+        adapter: expect.objectContaining({ __mockAdapter: true }),
+        log: ['query', 'error', 'warn'],
+      });
+    });
+
+    it('should configure minimal logging for production environment', () => {
+      // ARRANGE
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      (globalThis as any).prisma = undefined;
+      process.env.NODE_ENV = 'production';
+
+      // ACT
+      require('../prisma');
+
+      // ASSERT
+      const { PrismaClient } = require('@working-theory/database');
+      expect(PrismaClient).toHaveBeenCalledWith({
+        adapter: expect.objectContaining({ __mockAdapter: true }),
+        log: ['error'],
+      });
+    });
+
+    it('should configure minimal logging for test environment', () => {
+      // ARRANGE
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      (globalThis as any).prisma = undefined;
+      process.env.NODE_ENV = 'test';
+
+      // ACT
+      require('../prisma');
+
+      // ASSERT
+      const { PrismaClient } = require('@working-theory/database');
+      expect(PrismaClient).toHaveBeenCalledWith({
+        adapter: expect.objectContaining({ __mockAdapter: true }),
+        log: ['error'],
+      });
+    });
+
+    it('should store prisma instance in globalThis for non-production environments', () => {
+      // ARRANGE
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      (globalThis as any).prisma = undefined;
+      process.env.NODE_ENV = 'development';
+
+      // ACT
+      const { prisma } = require('../prisma');
+
+      // ASSERT
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      expect((globalThis as any).prisma).toBe(prisma);
+    });
+
+    it('should not store prisma instance in globalThis for production', () => {
+      // ARRANGE
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      (globalThis as any).prisma = undefined;
+      process.env.NODE_ENV = 'production';
+
+      // ACT
+      const { prisma } = require('../prisma');
+
+      // ASSERT
+      // In production, it should not be stored in globalThis
+      // But the instance should still be created
+      expect(prisma).toBeDefined();
+    });
+  });
+});