create-ailk 0.17.0 → 0.19.0

package/templates/apps/api/src/routes/leads/__tests__/index.test.ts

@@ -1,1620 +0,0 @@
-/**
- * @file index.test.ts
- * Route-level inject tests for POST /api/leads/:kind
- *
- * Property under test: attacker-supplied `id` in the request body is never
- * persisted. buildInput() explicitly destructures only known fields (first wall).
- * The discriminatedUnion .strict() schema rejects unknown keys (second wall).
- *
- * These tests exercise both walls together at the HTTP boundary.
- *
- * Real dependencies (Issue #507):
- *   - appendLeadRecord (lead-capture-store): real — writes to LEAD_CAPTURE_FILE temp file
- *   - writeLeadFallback (file-fallback): real — writes to AILK_INBOX_FALLBACK_DIR temp dir
- *   - enrichLead (enrichment-shim): real — pass-through shim (no network calls in tests)
- *
- * Mocked:
- *   - prisma (lib/prisma.js): manual mock via __mocks__/prisma.ts — inbox models added
- *   - @working-theory/email: external package boundary — stays mocked
- *   - @working-theory/license: consumed by enrichment-shim; stays mocked to avoid license key dep
- */
-
-import * as fs from "fs/promises";
-
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
-jest.mock("../../../lib/prisma.js");
-
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({
-    ok: true,
-    messageId: "msg-test",
-  }),
-  // #5970 — the request-and-confirm tenant sender. Declared here because the
-  // callback route now reaches it, and because without it the feature-ON cases
-  // below would pass for the wrong reason: with the flag unset,
-  // `sendRequestConfirmLink` no-ops before it ever touches this import.
-  sendRequestConfirmEmail: jest.fn().mockResolvedValue({
-    ok: true,
-    messageId: "msg-confirm",
-  }),
-  sendRequestPaidLinkEmail: jest.fn(),
-}));
-
-// @working-theory/license: consumed transitively by enrichment-shim; mocked to avoid
-// needing a license key in tests.
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-// #7869 — the Idempotency-Key suite asserts a replay records no new capture
-// event; `track` is fire-and-forget and never throws, so mocking it changes
-// nothing for the cases above.
-jest.mock("@working-theory/analytics/server", () => ({ track: jest.fn() }));
-
-import {
-  leadSubmitRoute,
-  leadSubscribeRoute,
-  leadCallbackRoute,
-} from "../index";
-import {
-  MOCK_PERSON_ID,
-  mockNoWorkspace,
-  mockSentinelWorkspaceExists,
-} from "../../../lib/__mocks__/prisma.js";
-import { prisma } from "../../../lib/prisma.js";
-import { __resetSiteWorkspaceCacheForTests } from "../../../lib/site.js";
-import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
-// #3979 AC1 — the single shared fixture (packages/validation, which apps/api
-// may_import_from per architecture.yaml) for the NewsletterFormInline
-// emitted-body shape, also consumed by the layer-a block test
-// (packages/ui/src/blocks/__tests__/NewsletterFormInline.test.tsx), so a
-// change to the block's emitted keys can't silently leave this layer
-// asserting a stale contract. #4017 D4 extends the same fixture module with
-// the ContactForm `submit`-kind body, consumed by the layer-a section test
-// (packages/ui/src/sections/__tests__/ContactForm.test.tsx).
-import {
-  AGENCY_WAITLIST_LEAD_BODY,
-  CONTACT_FORM_LEAD_BODY,
-  NEWSLETTER_DEFAULT_LEAD_BODY,
-} from "../../../../../../packages/validation/src/__tests__/fixtures/newsletter-lead-body.fixture.js";
-
-const fileEnv = setupLeadFileEnv("index");
-
-// #6203 — every lead-capture kind now resolves its tenant SERVER-SIDE
-// (routes/leads/index.ts), never from a body-supplied `siteId`. A test's
-// body may still send a `siteId` (a client-embed artifact, or a spoof
-// attempt) but it is silently ignored — the SEEDED default workspace id
-// (`database/tenancy.ts DEFAULT_WORKSPACE_ID`) is what actually lands, on
-// both `siteId` and the new `workspaceId` column.
-//
-// #6335 — that resolution used to come off the shared prisma mock's
-// PERMISSIVE `workspace.findUnique` default, which resolved any id it was
-// handed. The default is gone, so this suite states the workspace it
-// expects: `stateSentinelWorkspaceExists()` below, called wherever this
-// file clears its mocks.
-const RESOLVED_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
-
-/**
- * A second, real workspace the deployment is NOT serving. The three spoof
- * cases below make it resolvable for their own duration, so "the row did
- * not land there" is a statement about what the route READ rather than a
- * side effect of the id resolving to nothing.
- */
-const FOREIGN_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-00000000dead";
-
-/**
- * #6335 — the ONE workspace every case in this file expects to exist: the
- * seeded sentinel `currentSiteId()`'s "default" alias names. Keyed on the
- * requested id inside the helper, so a body-supplied foreign `siteId`
- * resolves to nothing — which is what makes the spoof cases below prove
- * the route never reads it, rather than proving a permissive mock resolves
- * everything. The resolver's memo is cleared alongside, so no case answers
- * out of a previous one's successful resolution.
- */
-function stateSentinelWorkspaceExists(): void {
-  __resetSiteWorkspaceCacheForTests();
-  mockSentinelWorkspaceExists(prisma);
-}
-
-// ─── Suite setup ──────────────────────────────────────────────────────────────
-
-describe("POST /api/leads — id isolation", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    stateSentinelWorkspaceExists();
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    process.env.DATABASE_URL = "postgres://stub";
-
-    const fastify = require("fastify")();
-    await fastify.register(leadSubmitRoute);
-    await fastify.register(leadSubscribeRoute);
-    await fastify.register(leadCallbackRoute);
-    app = fastify;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env.AILK_LEAD_NOTIFICATION_TO;
-    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
-    delete process.env.DATABASE_URL;
-    delete process.env.LEAD_CAPTURE_FILE_DISABLED;
-    delete process.env.LEAD_CAPTURE_INCLUDE_IP;
-  });
-
-  it("POST /api/leads/submit — attacker-supplied id is not returned (server uuid used)", async () => {
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000a1";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        id: "attacker",
-        kind: "submit",
-        siteId: "site-abc",
-        source: "contact",
-        email: "test@example.com",
-        payload: { message: "hello" },
-      },
-    });
-
-    // buildInput drops `id` before it reaches validation or persistence.
-    // The schema's .strict() would also reject it — both walls active.
-    expect([201, 400]).toContain(res.statusCode);
-    if (res.statusCode === 201) {
-      const body = res.json();
-      expect(body.id).not.toBe("attacker");
-      expect(body.id).toBe(serverGeneratedId);
-    }
-  });
-
-  it("POST /api/leads/subscribe — attacker-supplied id is not returned (server uuid used)", async () => {
-    const serverGeneratedId = "subscr_00000000-0000-7000-8000-0000000000a2";
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/subscribe",
-      payload: {
-        id: "attacker",
-        kind: "subscribe",
-        siteId: "site-abc",
-        email: "sub@example.com",
-        source: "footer",
-      },
-    });
-
-    expect([201, 400]).toContain(res.statusCode);
-    if (res.statusCode === 201) {
-      const body = res.json();
-      expect(body.id).not.toBe("attacker");
-      expect(body.id).toBe(serverGeneratedId);
-    }
-  });
-
-  // #3965 D4 layer (b) — the block's exact emitted shape (layer (a) pins it
-  // as { siteId, source, email } via application/json) persists through the
-  // REAL registered /v1/leads/subscribe plugin. #3979 AC1 retargets the body
-  // literal at the shared fixture (packages/validation) — it had already
-  // drifted from layer-a's own hand-copied literal (different `email`
-  // values), with nothing catching it.
-  it("POST /v1/leads/subscribe — the block's emitted JSON shape ({ siteId, source, email }) is accepted and persisted", async () => {
-    const serverGeneratedId = "subscr_00000000-0000-7000-8000-0000000000b1";
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    // The exact body NewsletterFormInline emits at its defaults (#3965 D1) —
-    // no `kind` key: buildInput() injects `kind` server-side from the route,
-    // never from the body.
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/subscribe",
-      headers: { "content-type": "application/json" },
-      payload: JSON.stringify(NEWSLETTER_DEFAULT_LEAD_BODY),
-    });
-
-    expect(res.statusCode).toBe(201);
-    const body = res.json();
-    expect(body.id).toBe(serverGeneratedId);
-    expect(body.persisted).toBe("db");
-    expect(prisma.subscriber.create).toHaveBeenCalledTimes(1);
-    const record = await fileEnv.readLastCaptureRecord();
-    expect(record.id).toBe(serverGeneratedId);
-    expect(record.source).toBe(NEWSLETTER_DEFAULT_LEAD_BODY.source);
-  });
-
-  // #3979 AC2 — the agency-waitlist instance (content/en/LandingPage/
-  // agency-waitlist.mdx: action "/v1/leads/submit", source "agency-waitlist",
-  // siteId unset → "default") had NO layer-b case at all before this issue —
-  // only /v1/leads/subscribe was covered. Unconditional 201 (not the
-  // permissive [201, 400] idiom used by the id-isolation tests above), since
-  // this asserts the block's real emitted shape is accepted, not merely that
-  // the id-isolation walls hold regardless of validation outcome.
-  it("POST /v1/leads/submit — the agency-waitlist instance's emitted JSON shape ({ siteId, source, email }) is accepted and persisted", async () => {
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000b2";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    // The exact body NewsletterFormInline emits for the agency-waitlist
-    // instance — no `kind`, no `payload` key: buildInput() injects `kind`
-    // server-side from the route and defaults `payload` to {} when absent.
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      headers: { "content-type": "application/json" },
-      payload: JSON.stringify(AGENCY_WAITLIST_LEAD_BODY),
-    });
-
-    expect(res.statusCode).toBe(201);
-    const body = res.json();
-    expect(body.id).toBe(serverGeneratedId);
-    expect(body.persisted).toBe("db");
-    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-    const record = await fileEnv.readLastCaptureRecord();
-    expect(record.id).toBe(serverGeneratedId);
-    expect(record.source).toBe(AGENCY_WAITLIST_LEAD_BODY.source);
-  });
-
-  // #4017 D4 layer (b) — the ContactForm section's exact emitted shape
-  // (layer (a) pins it as { siteId, source, email, payload } via
-  // application/json) persists through the REAL registered
-  // /v1/leads/submit plugin. `email` is lifted by field name; every other
-  // declared field lands in `payload` — the shared fixture (packages/validation)
-  // is the single definition both layers assert against (#3979 AC1's
-  // pattern), so a change to the section's emitted keys can't silently leave
-  // this layer asserting a stale contract.
-  it("POST /v1/leads/submit — the ContactForm section's emitted JSON shape ({ siteId, source, email, payload }) is accepted and persisted", async () => {
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000b3";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    // The exact body ContactForm emits at its component defaults (#4017 D1) —
-    // no `kind` key: buildInput() injects `kind` server-side from the route,
-    // never from the body.
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      headers: { "content-type": "application/json" },
-      payload: JSON.stringify(CONTACT_FORM_LEAD_BODY),
-    });
-
-    expect(res.statusCode).toBe(201);
-    const body = res.json();
-    expect(body.id).toBe(serverGeneratedId);
-    expect(body.persisted).toBe("db");
-    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-    expect(prisma.lead.create).toHaveBeenCalledWith({
-      data: {
-        // #6203 — the RESOLVED workspace, never the body's own `siteId`.
-        siteId: RESOLVED_WORKSPACE_ID,
-        workspaceId: RESOLVED_WORKSPACE_ID,
-        source: CONTACT_FORM_LEAD_BODY.source,
-        email: CONTACT_FORM_LEAD_BODY.email,
-        payload: CONTACT_FORM_LEAD_BODY.payload,
-        // #852 D6 — the Person the shared mock's `person.findFirst` resolves.
-        personId: MOCK_PERSON_ID,
-      },
-      select: { id: true },
-    });
-    const record = await fileEnv.readLastCaptureRecord();
-    expect(record.id).toBe(serverGeneratedId);
-    expect(record.source).toBe(CONTACT_FORM_LEAD_BODY.source);
-    expect(record.data).toEqual({
-      email: CONTACT_FORM_LEAD_BODY.email,
-      ...CONTACT_FORM_LEAD_BODY.payload,
-    });
-  });
-
-  it("POST /api/leads/callback — attacker-supplied id is not returned (server uuid used)", async () => {
-    const serverGeneratedId = "callbk_00000000-0000-7000-8000-0000000000a3";
-    (prisma.callback.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/callback",
-      payload: {
-        id: "attacker",
-        kind: "callback",
-        siteId: "site-abc",
-        name: "Alice",
-        phone: "+15551234567",
-        payload: { notes: "urgent" },
-      },
-    });
-
-    expect([201, 400]).toContain(res.statusCode);
-    if (res.statusCode === 201) {
-      const body = res.json();
-      expect(body.id).not.toBe("attacker");
-      expect(body.id).toBe(serverGeneratedId);
-    }
-  });
-
-  // ── Lead capture store integration cases ──────────────────────────────────
-
-  it("file-on-success — appendLeadRecord writes to LEAD_CAPTURE_FILE on successful DB persist", async () => {
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000a4";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        kind: "submit",
-        siteId: "site-abc",
-        source: "contact",
-        email: "test@example.com",
-        payload: { message: "hello" },
-      },
-    });
-
-    expect([201, 400]).toContain(res.statusCode);
-    if (res.statusCode === 201) {
-      expect(res.json().id).toBe(serverGeneratedId);
-      const record = await fileEnv.readLastCaptureRecord();
-      expect(record.id).toBe(serverGeneratedId);
-      expect(record.source).toBe("contact");
-    }
-  });
-
-  it("dual-write — real lead-capture-store AND DB are both invoked on success", async () => {
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000a5";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        kind: "submit",
-        siteId: "site-abc",
-        source: "contact",
-        email: "dual@example.com",
-        payload: { message: "dual-write test" },
-      },
-    });
-
-    if (res.statusCode === 201) {
-      expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-      const record = await fileEnv.readLastCaptureRecord();
-      expect(typeof record.id).toBe("string");
-    }
-  });
-
-  it("disabled — appendLeadRecord is skipped when LEAD_CAPTURE_FILE_DISABLED=true", async () => {
-    process.env.LEAD_CAPTURE_FILE_DISABLED = "true";
-
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000a6";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        kind: "submit",
-        siteId: "site-abc",
-        source: "contact",
-        email: "disabled@example.com",
-        payload: { message: "no file" },
-      },
-    });
-
-    expect([201, 400]).toContain(res.statusCode);
-    if (res.statusCode === 201) {
-      // The real lead-capture-store short-circuits when LEAD_CAPTURE_FILE_DISABLED=true.
-      // The capture file must not be written.
-      await expect(fs.access(fileEnv.getCaptureFilePath())).rejects.toThrow();
-    }
-  });
-
-  it("config_missing — 503 with lead_capture_not_configured when file disabled and no DATABASE_URL", async () => {
-    process.env.LEAD_CAPTURE_FILE_DISABLED = "true";
-    delete process.env.DATABASE_URL;
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        kind: "submit",
-        siteId: "site-abc",
-        source: "contact",
-        email: "nocapture@example.com",
-        payload: { message: "no config" },
-      },
-    });
-
-    expect(res.statusCode).toBe(503);
-    const body = res.json();
-    expect(body.error).toBe("lead_capture_not_configured");
-    expect(body.message).toBe("Lead capture is not configured.");
-    expect(prisma.lead.create).not.toHaveBeenCalled();
-  });
-
-  it("IP-include — metadata.ip present in capture record when LEAD_CAPTURE_INCLUDE_IP=true", async () => {
-    process.env.LEAD_CAPTURE_INCLUDE_IP = "true";
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000a7";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      headers: { "x-forwarded-for": "1.2.3.4" },
-      payload: {
-        kind: "submit",
-        siteId: "site-abc",
-        source: "contact",
-        email: "ip@example.com",
-        payload: { message: "ip test" },
-      },
-    });
-
-    if (res.statusCode === 201) {
-      const record = await fileEnv.readLastCaptureRecord();
-      expect(record.metadata as Record<string, unknown>).toHaveProperty("ip");
-    }
-  });
-
-  // ── buildInput branch coverage ─────────────────────────────────────────────
-
-  it("lead — payload absent from body defaults to empty object via ?? (payload ?? {} branch)", async () => {
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000a8";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const bodyWithoutPayload: Record<string, unknown> = {
-      kind: "submit",
-      siteId: "site-abc",
-      source: "contact",
-      email: "nopayload@example.com",
-      payload: undefined,
-    };
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: bodyWithoutPayload,
-    });
-
-    expect([201, 400]).toContain(res.statusCode);
-    if (res.statusCode === 201) {
-      expect(res.json().id).toBe(serverGeneratedId);
-    }
-  });
-
-  it("callback — preferredTime included when provided (preferredTime spread branch)", async () => {
-    const serverGeneratedId = "callbk_00000000-0000-7000-8000-0000000000a9";
-    (prisma.callback.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/callback",
-      payload: {
-        kind: "callback",
-        siteId: "site-abc",
-        name: "Alice",
-        phone: "+15551234567",
-        preferredTime: "morning",
-        payload: { notes: "prefers AM" },
-      },
-    });
-
-    expect([201, 400]).toContain(res.statusCode);
-    if (res.statusCode === 201) {
-      expect(res.json().id).toBe(serverGeneratedId);
-    }
-  });
-
-  it("callback — payload absent from body defaults to empty object via ?? (callback payload ?? {} branch)", async () => {
-    const serverGeneratedId = "callbk_00000000-0000-7000-8000-0000000000aa";
-    (prisma.callback.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const bodyWithoutPayload: Record<string, unknown> = {
-      kind: "callback",
-      siteId: "site-abc",
-      name: "Bob",
-      phone: "+15559876543",
-      payload: undefined,
-    };
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/callback",
-      payload: bodyWithoutPayload,
-    });
-
-    expect([201, 400]).toContain(res.statusCode);
-    if (res.statusCode === 201) {
-      expect(res.json().id).toBe(serverGeneratedId);
-    }
-  });
-
-  // ── emailKind branch coverage ──────────────────────────────────────────────
-
-  it("email skipped — emailKind=skipped logged when env vars are unset", async () => {
-    delete process.env.AILK_LEAD_NOTIFICATION_TO;
-    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000ab";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        kind: "submit",
-        siteId: "site-abc",
-        source: "contact",
-        email: "skipped@example.com",
-        payload: { message: "test" },
-      },
-    });
-
-    expect([201, 400]).toContain(res.statusCode);
-    if (res.statusCode === 201) {
-      const body = res.json();
-      expect(body.id).toBe(serverGeneratedId);
-      expect(body.email).toHaveProperty("skipped", true);
-    }
-  });
-
-  // ── #4985 — step-flow envelope ({ siteId, source, payload: <record> }) ────
-  // StepFlow (packages/ui/src/sections/StepFlow.tsx L548) posts email INSIDE
-  // `payload`, not top-level. buildInput() now lifts `email` from `payload`
-  // when the top-level field is absent.
-
-  it("envelope submit — { siteId, source, payload: { email, ... } } returns 201, writes one Lead with that email and the full payload, and routes the notification email", async () => {
-    const { sendLeadNotification } = jest.requireMock("@working-theory/email");
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000e1";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const envelopePayload = {
-      email: "envelope@example.com",
-      name: "Envelope Visitor",
-      message: "hello from the step-flow",
-    };
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        siteId: "site-abc",
-        source: "step-flow",
-        payload: envelopePayload,
-      },
-    });
-
-    expect(res.statusCode).toBe(201);
-    const body = res.json();
-    expect(body.id).toBe(serverGeneratedId);
-    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-    expect(prisma.lead.create).toHaveBeenCalledWith({
-      data: {
-        // #6203 — the RESOLVED workspace; the body's "site-abc" is ignored.
-        siteId: RESOLVED_WORKSPACE_ID,
-        workspaceId: RESOLVED_WORKSPACE_ID,
-        source: "step-flow",
-        email: "envelope@example.com",
-        payload: envelopePayload,
-        // #852 D6 — the Person the shared mock's `person.findFirst` resolves.
-        personId: MOCK_PERSON_ID,
-      },
-      select: { id: true },
-    });
-    expect(sendLeadNotification).toHaveBeenCalledTimes(1);
-    expect(body.email).toHaveProperty("ok", true);
-  });
-
-  it("envelope subscribe — { siteId, source, payload: { email } } returns 201 and writes one Subscriber", async () => {
-    const serverGeneratedId = "subscr_00000000-0000-7000-8000-0000000000e2";
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/subscribe",
-      payload: {
-        siteId: "site-abc",
-        source: "step-flow",
-        payload: { email: "sub-envelope@example.com" },
-      },
-    });
-
-    expect(res.statusCode).toBe(201);
-    const body = res.json();
-    expect(body.id).toBe(serverGeneratedId);
-    expect(prisma.subscriber.create).toHaveBeenCalledTimes(1);
-    expect(prisma.subscriber.create).toHaveBeenCalledWith({
-      data: {
-        // #6203 — the RESOLVED workspace; the body's "site-abc" is ignored.
-        siteId: RESOLVED_WORKSPACE_ID,
-        // #6374 — `subscribers.workspace_id` is NOT NULL as of
-        // database/migrations/20260922120000_tenancy_fence, and
-        // `subscribers_workspace_site_agree` forces it to EQUAL `site_id`.
-        // Asserted as the same RESOLVED value, so a raw alias leaking into
-        // either column fails this test rather than the database.
-        workspaceId: RESOLVED_WORKSPACE_ID,
-        email: "sub-envelope@example.com",
-        source: "step-flow",
-      },
-      select: { id: true },
-    });
-  });
-
-  it("envelope submit — email absent in both the top level and payload → the existing 400 invalid_input", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        siteId: "site-abc",
-        source: "step-flow",
-        payload: { message: "no email anywhere" },
-      },
-    });
-
-    expect(res.statusCode).toBe(400);
-    const body = res.json();
-    expect(body.error).toBe("invalid_input");
-    expect(prisma.lead.create).not.toHaveBeenCalled();
-  });
-
-  it("envelope subscribe — email absent in both the top level and payload → the existing 400 invalid_input", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/subscribe",
-      payload: {
-        siteId: "site-abc",
-        source: "step-flow",
-        payload: {},
-      },
-    });
-
-    expect(res.statusCode).toBe(400);
-    const body = res.json();
-    expect(body.error).toBe("invalid_input");
-    expect(prisma.subscriber.create).not.toHaveBeenCalled();
-  });
-
-  it("submit — a top-level email wins over a payload email", async () => {
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000e3";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        siteId: "site-abc",
-        source: "step-flow",
-        email: "top-level@example.com",
-        payload: { email: "shadowed-payload@example.com", message: "hi" },
-      },
-    });
-
-    expect(res.statusCode).toBe(201);
-    expect(prisma.lead.create).toHaveBeenCalledWith({
-      data: {
-        // #6203 — the RESOLVED workspace; the body's "site-abc" is ignored.
-        siteId: RESOLVED_WORKSPACE_ID,
-        workspaceId: RESOLVED_WORKSPACE_ID,
-        source: "step-flow",
-        email: "top-level@example.com",
-        payload: { email: "shadowed-payload@example.com", message: "hi" },
-        // #852 D6 — the Person the shared mock's `person.findFirst` resolves.
-        personId: MOCK_PERSON_ID,
-      },
-      select: { id: true },
-    });
-  });
-
-  it("subscribe — a top-level email wins over a payload email", async () => {
-    const serverGeneratedId = "subscr_00000000-0000-7000-8000-0000000000e4";
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/subscribe",
-      payload: {
-        siteId: "site-abc",
-        source: "step-flow",
-        email: "top-level-sub@example.com",
-        payload: { email: "shadowed-sub@example.com" },
-      },
-    });
-
-    expect(res.statusCode).toBe(201);
-    expect(prisma.subscriber.create).toHaveBeenCalledWith({
-      data: {
-        // #6203 — the RESOLVED workspace; the body's "site-abc" is ignored.
-        siteId: RESOLVED_WORKSPACE_ID,
-        // #6374 — equal to `siteId` by construction; see the note on the
-        // envelope-subscribe assertion above.
-        workspaceId: RESOLVED_WORKSPACE_ID,
-        email: "top-level-sub@example.com",
-        source: "step-flow",
-      },
-      select: { id: true },
-    });
-  });
-
-  it("email error — emailKind=error logged when sendLeadNotification returns ok:false", async () => {
-    const { sendLeadNotification } = jest.requireMock("@working-theory/email");
-    (sendLeadNotification as jest.Mock).mockResolvedValueOnce({
-      ok: false,
-      error: { kind: "send_error", message: "SMTP timeout" },
-    });
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000ac";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        kind: "submit",
-        siteId: "site-abc",
-        source: "contact",
-        email: "erroremail@example.com",
-        payload: { message: "test" },
-      },
-    });
-
-    expect([201, 400]).toContain(res.statusCode);
-    if (res.statusCode === 201) {
-      const body = res.json();
-      expect(body.id).toBe(serverGeneratedId);
-      expect(body.email).toHaveProperty("ok", false);
-    }
-  });
-});
-
-// ── #4985 — PII-safe logging still holds when email arrives via `payload` ──
-
-describe("POST /v1/leads/submit — structured log stays PII-safe for envelope input", () => {
-  afterEach(async () => {
-    delete process.env.AILK_LEAD_NOTIFICATION_TO;
-    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
-    delete process.env.DATABASE_URL;
-  });
-
-  it("the 'lead routed' log line carries no email or payload value when email is lifted from payload", async () => {
-    jest.clearAllMocks();
-    stateSentinelWorkspaceExists();
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    process.env.DATABASE_URL = "postgres://stub";
-
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000e5";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    const logLines: string[] = [];
-    const logCapture = require("fastify")({
-      logger: {
-        level: "info",
-        stream: { write: (msg: string) => logLines.push(msg) },
-      },
-    }) as FastifyInstance;
-    await logCapture.register(leadSubmitRoute);
-    await logCapture.ready();
-
-    try {
-      const res = await logCapture.inject({
-        method: "POST",
-        url: "/v1/leads/submit",
-        payload: {
-          siteId: "site-abc",
-          source: "step-flow",
-          payload: {
-            email: "secret-envelope@example.com",
-            message: "this message body must never be logged",
-          },
-        },
-      });
-
-      expect(res.statusCode).toBe(201);
-
-      const routedLine = logLines.find((line) => line.includes("lead routed"));
-      expect(routedLine).toBeDefined();
-      expect(routedLine).not.toMatch(/secret-envelope@example\.com/);
-      expect(routedLine).not.toMatch(/this message body must never be logged/);
-
-      const logged = JSON.parse(routedLine!) as Record<string, unknown>;
-      expect(logged).not.toHaveProperty("email");
-      expect(logged).not.toHaveProperty("payload");
-      expect(logged).toMatchObject({
-        // #6203 — the RESOLVED workspace; the body's "site-abc" is ignored.
-        siteId: RESOLVED_WORKSPACE_ID,
-        kind: "submit",
-        persisted: "db",
-      });
-    } finally {
-      await logCapture.close();
-    }
-  });
-});
-
-// ── #6203 AC-4 — tenant resolution: per-kind, unresolved-rejects, spoof-proof ──
-//
-// Every capture kind resolves its tenant SERVER-SIDE (routes/leads/index.ts's
-// header). These tests assert the two halves that matter: (1) an unresolved
-// resolution — DATABASE_URL set, but the alias names no workspace this
-// database holds — rejects the write with a 503 BEFORE any create call, for
-// each of the three kinds; (2) a client-supplied `siteId` naming a DIFFERENT,
-// otherwise-resolvable workspace never places a row there — the resolved
-// value always wins, proving the body value is truly ignored rather than
-// merely unpreferred.
-
-describe("POST /api/leads/:kind — tenant resolution (#6203 AC-4)", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    stateSentinelWorkspaceExists();
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    process.env.DATABASE_URL = "postgres://stub";
-    delete process.env.AILK_SITE_ID;
-
-    const fastify = require("fastify")();
-    await fastify.register(leadSubmitRoute);
-    await fastify.register(leadSubscribeRoute);
-    await fastify.register(leadCallbackRoute);
-    app = fastify;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    __resetSiteWorkspaceCacheForTests();
-    delete process.env.AILK_LEAD_NOTIFICATION_TO;
-    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
-    delete process.env.DATABASE_URL;
-    delete process.env.AILK_SITE_ID;
-  });
-
-  it("submit: an unresolved workspace is a 503 tenant_unresolved and writes no Lead", async () => {
-    mockNoWorkspace(prisma);
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        siteId: "default",
-        source: "contact-form",
-        email: "nobody@example.com",
-        payload: {},
-      },
-    });
-
-    expect(res.statusCode).toBe(503);
-    expect(res.json()).toMatchObject({ error: "tenant_unresolved" });
-    expect(prisma.lead.create).not.toHaveBeenCalled();
-  });
-
-  it("subscribe: an unresolved workspace is a 503 tenant_unresolved and writes no Subscriber", async () => {
-    mockNoWorkspace(prisma);
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/subscribe",
-      payload: { siteId: "default", source: "footer", email: "nobody@example.com" },
-    });
-
-    expect(res.statusCode).toBe(503);
-    expect(res.json()).toMatchObject({ error: "tenant_unresolved" });
-    expect(prisma.subscriber.create).not.toHaveBeenCalled();
-  });
-
-  it("callback: an unresolved workspace is a 503 tenant_unresolved and writes no Callback", async () => {
-    mockNoWorkspace(prisma);
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/callback",
-      payload: { siteId: "default", name: "Nobody", phone: "+15550000000" },
-    });
-
-    expect(res.statusCode).toBe(503);
-    expect(res.json()).toMatchObject({ error: "tenant_unresolved" });
-    expect(prisma.callback.create).not.toHaveBeenCalled();
-  });
-
-  it("submit: a body siteId naming another workspace never places the row there — the resolved workspace always wins", async () => {
-    mockSentinelWorkspaceExists(prisma, FOREIGN_WORKSPACE_ID);
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: "lead_00000000-0000-7000-8000-0000000000f1",
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        // A DIFFERENT workspace id, which this test has deliberately made
-        // RESOLVABLE (`FOREIGN_WORKSPACE_ID` above) — so the row landing on
-        // the sentinel proves buildInput() never reads the body value at
-        // all, rather than proving the read merely failed closed.
-        siteId: FOREIGN_WORKSPACE_ID,
-        source: "contact-form",
-        email: "spoof@example.com",
-        payload: {},
-      },
-    });
-
-    expect(res.statusCode).toBe(201);
-    const { data } = (prisma.lead.create as jest.Mock).mock.calls[0]![0];
-    expect(data.siteId).toBe(RESOLVED_WORKSPACE_ID);
-    expect(data.workspaceId).toBe(RESOLVED_WORKSPACE_ID);
-    expect(data.siteId).not.toBe(FOREIGN_WORKSPACE_ID);
-  });
-
-  it("subscribe: a body siteId naming another workspace never places the row there", async () => {
-    mockSentinelWorkspaceExists(prisma, FOREIGN_WORKSPACE_ID);
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
-      id: "subscr_00000000-0000-7000-8000-0000000000f2",
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/subscribe",
-      payload: {
-        siteId: FOREIGN_WORKSPACE_ID,
-        source: "footer",
-        email: "spoof-sub@example.com",
-      },
-    });
-
-    expect(res.statusCode).toBe(201);
-    const { data } = (prisma.subscriber.create as jest.Mock).mock.calls[0]![0];
-    expect(data.siteId).toBe(RESOLVED_WORKSPACE_ID);
-    expect(data.siteId).not.toBe(FOREIGN_WORKSPACE_ID);
-  });
-
-  it("callback: a body siteId naming another workspace never places the row there", async () => {
-    mockSentinelWorkspaceExists(prisma, FOREIGN_WORKSPACE_ID);
-    (prisma.callback.create as jest.Mock).mockResolvedValue({
-      id: "callbk_00000000-0000-7000-8000-0000000000f3",
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/callback",
-      payload: {
-        siteId: FOREIGN_WORKSPACE_ID,
-        name: "Spoofer",
-        phone: "+15559999999",
-      },
-    });
-
-    expect(res.statusCode).toBe(201);
-    const { data } = (prisma.callback.create as jest.Mock).mock.calls[0]![0];
-    expect(data.siteId).toBe(RESOLVED_WORKSPACE_ID);
-    expect(data.siteId).not.toBe(FOREIGN_WORKSPACE_ID);
-  });
-});
-
-// ── D5 — registration binds the client's literal path (issue #3964) ───────────
-//
-// The drift class this issue fixed: every test above hand-supplied the same
-// (wrong) URL the route was actually registered at, so the mismatch between
-// the registered path and the path every consumer calls shipped silently.
-// This suite registers the real exported plugin and asserts against the
-// EXACT literal packages/api-client/src/leads.ts uses (cross-referenced
-// below), so a future re-drift fails here instead of shipping.
-
-describe("POST /v1/leads/submit — registration binds the client's literal path", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    stateSentinelWorkspaceExists();
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    process.env.DATABASE_URL = "postgres://stub";
-
-    const fastify = require("fastify")();
-    await fastify.register(leadSubmitRoute);
-    app = fastify;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env.AILK_LEAD_NOTIFICATION_TO;
-    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
-    delete process.env.DATABASE_URL;
-  });
-
-  it("resolves POST /v1/leads/submit — the exact literal packages/api-client/src/leads.ts's leads.submit() posts to", async () => {
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000d1";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: serverGeneratedId,
-    });
-
-    // Cross-reference: packages/api-client/src/leads.ts —
-    //   submit: (payload) => post<LeadWriteResponse>("/v1/leads/submit", payload)
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        siteId: "site-abc",
-        source: "contact",
-        email: "d5@example.com",
-        payload: { message: "hello" },
-      },
-    });
-
-    expect(res.statusCode).toBe(201);
-    expect(res.json().id).toBe(serverGeneratedId);
-  });
-
-  it("POST /v1/leads/lead — no longer registered (404); the pre-fix path", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/lead",
-      payload: {
-        siteId: "site-abc",
-        source: "contact",
-        email: "old-path@example.com",
-        payload: { message: "hello" },
-      },
-    });
-
-    expect(res.statusCode).toBe(404);
-  });
-});
-
-// ── #5970 — the route wiring itself, at route grain ────────────────────────
-//
-// The #5970 acceptance review's one residual: the suppression half is measured
-// through the real `routeLead`, and the send half through the real
-// `sendRequestConfirmLink`, but the three lines in `routes/leads/index.ts`
-// that CONNECT them were asserted by construction only. Delete that call and
-// every other test in the branch stays green while the tenant receives zero
-// emails. These two cases drive the endpoint the acceptance criterion names,
-// so that deletion turns something red.
-//
-// NFR-1 is untouched by this block: every pre-existing case above runs with
-// the feature unset, exactly as before, and none of them is edited. What is
-// added here is the feature-ON path, which did not exist to be covered.
-describe("POST /v1/leads/callback — request-and-confirm wiring (#5970)", () => {
-  // Registers its own hooks, so it must sit at describe level. It provisions
-  // the file-fallback destination the second case needs; the first case never
-  // reaches the fallback because its `callback.create` resolves.
-  setupLeadFileEnv();
-
-  const CONFIRM_ENV = [
-    "AILK_REQUEST_CONFIRM_ENABLED",
-    "AILK_REQUEST_CONFIRM_TO",
-    "AILK_REQUEST_CONFIRM_FROM",
-    "AILK_PUBLIC_API_URL",
-  ] as const;
-
-  function enableConfirm() {
-    process.env.AILK_REQUEST_CONFIRM_ENABLED = "true";
-    process.env.AILK_REQUEST_CONFIRM_TO = "owner@example.com";
-    process.env.AILK_REQUEST_CONFIRM_FROM = "hello@example.com";
-    process.env.AILK_PUBLIC_API_URL = "https://api.example.com";
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    process.env.DATABASE_URL = "postgres://stub";
-  }
-
-  afterEach(() => {
-    for (const key of CONFIRM_ENV) delete process.env[key];
-    delete process.env.AILK_LEAD_NOTIFICATION_TO;
-    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
-    delete process.env.DATABASE_URL;
-  });
-
-  /** Awaitable equivalent of the route's fire-and-forget confirm send. */
-  const flush = () => new Promise((resolve) => setImmediate(resolve));
-
-  async function postCallback(fastify: FastifyInstance) {
-    return fastify.inject({
-      method: "POST",
-      url: "/v1/leads/callback",
-      payload: {
-        siteId: "site-abc",
-        name: "Ada Lovelace",
-        phone: "+44 7700 900000",
-        payload: {},
-      },
-    });
-  }
-
-  it("on the DB path the confirm email goes and the generic notification does not", async () => {
-    jest.clearAllMocks();
-    stateSentinelWorkspaceExists();
-    enableConfirm();
-    const email = require("@working-theory/email");
-    (prisma.callback.create as jest.Mock).mockResolvedValue({
-      id: "callbk_00000000-0000-7000-8000-00000000f001",
-    });
-    (prisma.callback.updateMany as jest.Mock).mockResolvedValue({ count: 1 });
-
-    const fastify = require("fastify")({ logger: false }) as FastifyInstance;
-    await fastify.register(leadCallbackRoute);
-    await fastify.ready();
-    try {
-      const res = await postCallback(fastify);
-      expect(res.statusCode).toBe(201);
-      await flush();
-
-      // Exactly one email, and it is the one carrying the confirm link.
-      expect(email.sendRequestConfirmEmail).toHaveBeenCalledTimes(1);
-      expect(email.sendLeadNotification).not.toHaveBeenCalled();
-    } finally {
-      await fastify.close();
-    }
-  });
-
-  it("on the FILE-FALLBACK path the generic notification goes and the confirm email does not", async () => {
-    jest.clearAllMocks();
-    stateSentinelWorkspaceExists();
-    enableConfirm();
-    const email = require("@working-theory/email");
-    (prisma.callback.create as jest.Mock).mockRejectedValue(
-      new Error("connection reset"),
-    );
-
-    const fastify = require("fastify")({ logger: false }) as FastifyInstance;
-    await fastify.register(leadCallbackRoute);
-    await fastify.ready();
-    try {
-      const res = await postCallback(fastify);
-      expect(res.statusCode).toBe(201);
-      await flush();
-
-      // No row exists to carry a credential, so the confirm send must not run
-      // — and the notification it would otherwise supersede must.
-      expect(email.sendRequestConfirmEmail).not.toHaveBeenCalled();
-      expect(email.sendLeadNotification).toHaveBeenCalledTimes(1);
-    } finally {
-      await fastify.close();
-    }
-  });
-});
-
-// ── #6335 — the fixture's own guard ───────────────────────────────────────
-//
-// Every other case in this file proves a ROUTE behaves. This one proves the
-// FIXTURE does: that the shared prisma mock ships `workspace.findUnique`
-// with no implementation at all, so a suite gets "no such workspace" until
-// it says otherwise. Re-adding a permissive default — the #6203 shape this
-// issue removed, or any catch-all under another name — fails here, and
-// fails for that reason rather than as a side effect three suites away.
-//
-// Read from a FRESH module instance so the assertion is about what the file
-// DECLARES, not about whatever the suites above have programmed onto the
-// double they share.
-describe("#6335 — the shared prisma mock declares no workspace default", () => {
-  it("workspace.findUnique ships with no implementation, and answers nothing", async () => {
-    await jest.isolateModulesAsync(async () => {
-      const fresh = (
-        require("../../../lib/__mocks__/prisma.js") as {
-          prisma: { workspace: { findUnique: jest.Mock } };
-        }
-      ).prisma;
-
-      expect(fresh.workspace.findUnique.getMockImplementation()).toBeUndefined();
-      // A bare `jest.fn()` returns `undefined` rather than a promise, and
-      // `await undefined` is `undefined` — which every resolver in
-      // `lib/site.ts` reads as "no such workspace" and rejects. That is the
-      // fail-closed default this fixture is supposed to have.
-      const answer: unknown = fresh.workspace.findUnique({
-        where: { id: "wksp_00000000-0000-7000-8000-0000000000ff" },
-      });
-      expect(answer).toBeUndefined();
-      await expect(Promise.resolve(answer)).resolves.toBeUndefined();
-    });
-  });
-});
-
-// ─── #6730 D2/D5 — email delivery and the production refusal, over HTTP ─────
-
-describe("POST /v1/leads/submit — #6730 delivery modes", () => {
-  let app: FastifyInstance;
-  const ENV_KEYS = [
-    "DATABASE_URL",
-    "NODE_ENV",
-    "RESEND_API_KEY",
-    "AILK_LEAD_NOTIFICATION_TO",
-    "AILK_LEAD_NOTIFICATION_FROM",
-    "LEAD_CAPTURE_FILE",
-    "AILK_INBOX_FALLBACK_DIR",
-  ] as const;
-  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
-  const sendLeadNotification = jest.requireMock("@working-theory/email")
-    .sendLeadNotification as jest.Mock;
-  const writeLeadFallbackSpy = jest.spyOn(
-    jest.requireActual("../../../lib/file-fallback.js"),
-    "writeLeadFallback",
-  );
-
-  const submit = () =>
-    app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        kind: "submit",
-        source: "contact",
-        email: "visitor@example.com",
-        payload: { message: "hello" },
-      },
-    });
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    saved = {};
-    for (const k of ENV_KEYS) saved[k] = process.env[k];
-    for (const k of ENV_KEYS) delete process.env[k];
-    process.env.NODE_ENV = "production";
-    const fastify = require("fastify")();
-    await fastify.register(leadSubmitRoute);
-    app = fastify;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    for (const k of ENV_KEYS) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-  });
-
-  describe("email delivery (no DATABASE_URL, the three email vars)", () => {
-    beforeEach(() => {
-      process.env.RESEND_API_KEY = "re_test";
-      process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-      process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    });
-
-    it("an accepted email → 201 persisted:email; no Prisma write", async () => {
-      sendLeadNotification.mockResolvedValueOnce({ ok: true, messageId: "msg-e" });
-
-      const res = await submit();
-
-      expect(res.statusCode).toBe(201);
-      expect(res.json()).toMatchObject({ persisted: "email" });
-      expect(res.json().id).toMatch(/^email-/);
-      expect(prisma.lead.create).not.toHaveBeenCalled();
-      expect(sendLeadNotification).toHaveBeenCalledTimes(1);
-      expect(sendLeadNotification.mock.calls[0][0].recipientEmail).toBe("owner@example.com");
-    });
-
-    it("a refused email → 503 delivery_failed, never 201", async () => {
-      sendLeadNotification.mockResolvedValueOnce({
-        ok: false,
-        error: { kind: "provider_error", message: "rejected" },
-      });
-
-      const res = await submit();
-
-      expect(res.statusCode).toBe(503);
-      expect(res.json()).toEqual({
-        error: "delivery_failed",
-        message: "The message could not be delivered.",
-      });
-    });
-  });
-
-  it("production with neither → 503 lead_capture_not_configured; no Prisma, no file, no email", async () => {
-    const res = await submit();
-
-    expect(res.statusCode).toBe(503);
-    expect(res.json().error).toBe("lead_capture_not_configured");
-    expect(prisma.lead.create).not.toHaveBeenCalled();
-    expect(writeLeadFallbackSpy).not.toHaveBeenCalled();
-    expect(sendLeadNotification).not.toHaveBeenCalled();
-    await expect(fs.access(fileEnv.getCaptureFilePath())).rejects.toThrow();
-  });
-});
-
-// ── #7869 — Idempotency-Key on submit (spec D1, D3–D7, D10 cases 1–8) ─────────
-//
-// `inbox` delivery (DATABASE_URL set), the sentinel workspace resolvable. The
-// app logs into `logLines` so case 8 can prove the key reaches no log line.
-describe("POST /v1/leads/submit — Idempotency-Key (#7869)", () => {
-  let app: FastifyInstance;
-  let logLines: string[];
-  const KEY = "fixture-retry-0000-0000-0002";
-  const STORED_ID = "lead_00000000-0000-7000-8000-00000000a7a7";
-  const NEW_ID = "lead_00000000-0000-7000-8000-00000000b8b8";
-  const sendLeadNotification = jest.requireMock("@working-theory/email")
-    .sendLeadNotification as jest.Mock;
-  const track = jest.requireMock("@working-theory/analytics/server")
-    .track as jest.Mock;
-
-  const body = {
-    kind: "submit",
-    source: "contact",
-    email: "visitor@example.com",
-    payload: { message: "hello", name: "Jamie" },
-  };
-  const send = (
-    headers: Record<string, string> = {},
-    url = "/v1/leads/submit",
-    payload: Record<string, unknown> = body,
-  ) => app.inject({ method: "POST", url, headers, payload });
-  const keyLookups = () =>
-    jest
-      .mocked(prisma.lead.findUnique)
-      .mock.calls.filter(
-        (c) => "workspaceId_idempotencyKey" in (c[0]?.where ?? {}),
-      );
-  const keyIsNowhere = (resBody: string) => {
-    expect(resBody).not.toContain(KEY);
-    for (const line of logLines) expect(line).not.toContain(KEY);
-  };
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    stateSentinelWorkspaceExists();
-    process.env.DATABASE_URL = "postgres://stub";
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: NEW_ID });
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue(null);
-
-    logLines = [];
-    const fastify = require("fastify")({
-      logger: {
-        level: "info",
-        stream: { write: (msg: string) => logLines.push(msg) },
-      },
-    });
-    await fastify.register(leadSubmitRoute);
-    await fastify.register(leadSubscribeRoute);
-    await fastify.register(leadCallbackRoute);
-    app = fastify;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env.DATABASE_URL;
-    delete process.env.AILK_LEAD_NOTIFICATION_TO;
-    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
-  });
-
-  it("case 1 — no header: one create with no idempotencyKey, no key lookup, 201", async () => {
-    const res = await send();
-
-    expect(res.statusCode).toBe(201);
-    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-    expect(
-      jest.mocked(prisma.lead.create).mock.calls[0]?.[0].data,
-    ).not.toHaveProperty("idempotencyKey");
-    expect(keyLookups()).toHaveLength(0);
-  });
-
-  it("case 2 — a key with no stored row: scoped lookup, the create carries the key, 201", async () => {
-    const res = await send({ "Idempotency-Key": KEY });
-
-    expect(res.statusCode).toBe(201);
-    expect(res.json()).toEqual({
-      id: NEW_ID,
-      persisted: "db",
-      email: { ok: true, messageId: "msg-test" },
-    });
-    expect(keyLookups()[0]?.[0]).toEqual({
-      where: {
-        workspaceId_idempotencyKey: {
-          workspaceId: RESOLVED_WORKSPACE_ID,
-          idempotencyKey: KEY,
-        },
-      },
-      select: { id: true, email: true, source: true, payload: true },
-    });
-    expect(
-      jest.mocked(prisma.lead.create).mock.calls[0]?.[0].data,
-    ).toMatchObject({
-      idempotencyKey: KEY,
-    });
-    keyIsNowhere(res.body);
-  });
-
-  it("case 3 — a stored row with the same email, source and payload (keys reordered) replays: 201, the stored id, no create, no notification, no track, no capture line", async () => {
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
-      id: STORED_ID,
-      email: body.email,
-      source: body.source,
-      payload: { name: "Jamie", message: "hello" },
-    });
-
-    const res = await send({ "Idempotency-Key": KEY });
-
-    expect(res.statusCode).toBe(201);
-    expect(res.json()).toEqual({
-      id: STORED_ID,
-      persisted: "db",
-      email: { skipped: true, reason: "idempotent_replay" },
-    });
-    expect(Object.keys(res.json()).sort()).toEqual([
-      "email",
-      "id",
-      "persisted",
-    ]);
-    expect(prisma.lead.create).not.toHaveBeenCalled();
-    expect(sendLeadNotification).not.toHaveBeenCalled();
-    expect(track).not.toHaveBeenCalled();
-    await expect(fs.access(fileEnv.getCaptureFilePath())).rejects.toThrow();
-    const routed = logLines.find((l) => l.includes("lead routed"));
-    expect(JSON.parse(routed!)).toMatchObject({ replayed: true });
-    keyIsNowhere(res.body);
-  });
-
-  it.each([
-    ["email", { email: "other@example.com" }],
-    ["source", { source: "footer" }],
-    ["payload", { payload: { message: "a different message", name: "Jamie" } }],
-  ])(
-    "case 4 — a stored row with a different %s is 422 idempotency_key_reused, no create, one warn log",
-    async (_field, override) => {
-      (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
-        id: STORED_ID,
-        email: body.email,
-        source: body.source,
-        payload: body.payload,
-        ...override,
-      });
-
-      const res = await send({ "Idempotency-Key": KEY });
-
-      expect(res.statusCode).toBe(422);
-      expect(res.json()).toEqual({
-        error: "idempotency_key_reused",
-        message: "This Idempotency-Key was used for a different lead.",
-      });
-      expect(prisma.lead.create).not.toHaveBeenCalled();
-      const warns = logLines
-        .map((l) => JSON.parse(l) as Record<string, unknown>)
-        .filter((l) => l["outcome"] === "idempotency_conflict");
-      expect(warns).toHaveLength(1);
-      expect(warns[0]).toMatchObject({
-        level: 40,
-        kind: "submit",
-        siteId: RESOLVED_WORKSPACE_ID,
-      });
-      keyIsNowhere(res.body);
-    },
-  );
-
-  it.each([
-    ["empty", ""],
-    ["15 characters", "a".repeat(15)],
-    ["256 characters", "a".repeat(256)],
-    ["a space", "abcdefghij klmnopqrs"],
-    ["a non-ASCII character", "abcdefghijéklmnopqrs"],
-  ])(
-    "case 5 — a malformed key (%s) is 400 invalid_input with no lead read or write",
-    async (_label, key) => {
-      const res = await app.inject({
-        method: "POST",
-        url: "/v1/leads/submit",
-        headers: { "idempotency-key": key },
-        payload: body,
-      });
-
-      expect(res.statusCode).toBe(400);
-      expect(res.json()).toEqual({
-        error: "invalid_input",
-        message: "Idempotency-Key must be 16 to 255 visible ASCII characters.",
-      });
-      expect(prisma.lead.findUnique).not.toHaveBeenCalled();
-      expect(prisma.lead.create).not.toHaveBeenCalled();
-    },
-  );
-
-  it("case 6 — the same key stored only in another workspace is a miss here: create, 201 with the new id", async () => {
-    jest.mocked(prisma.lead.findUnique).mockImplementation((async (args: {
-      where: { workspaceId_idempotencyKey?: { workspaceId: string } };
-    }) =>
-      args.where.workspaceId_idempotencyKey?.workspaceId ===
-      FOREIGN_WORKSPACE_ID
-        ? {
-            id: STORED_ID,
-            email: body.email,
-            source: body.source,
-            payload: body.payload,
-          }
-        : null) as never);
-
-    const res = await send({ "Idempotency-Key": KEY });
-
-    expect(res.statusCode).toBe(201);
-    expect(res.json().id).toBe(NEW_ID);
-    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-  });
-
-  it("case 8 — the key reaches no response body and no log line on a fresh write, a replay or a conflict", async () => {
-    const stored = {
-      id: STORED_ID,
-      email: body.email,
-      source: body.source,
-      payload: body.payload,
-    };
-    (prisma.lead.findUnique as jest.Mock)
-      .mockResolvedValueOnce(null) // fresh write
-      .mockResolvedValueOnce(stored) // replay
-      .mockResolvedValueOnce({ ...stored, email: "other@example.com" }); // conflict
-
-    const statuses: number[] = [];
-    for (let i = 0; i < 3; i++) {
-      const res = await send({ "Idempotency-Key": KEY });
-      statuses.push(res.statusCode);
-      keyIsNowhere(res.body);
-    }
-
-    expect(statuses).toEqual([201, 201, 422]);
-    expect(logLines.length).toBeGreaterThan(0);
-  });
-
-  it("case 7 — subscribe and callback ignore the header", async () => {
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
-      id: "subscr_1",
-    });
-    (prisma.callback.create as jest.Mock).mockResolvedValue({ id: "callbk_1" });
-
-    const sub = await send(
-      { "Idempotency-Key": "bad" },
-      "/v1/leads/subscribe",
-      {
-        kind: "subscribe",
-        email: "sub@example.com",
-        source: "footer",
-      },
-    );
-    const cb = await send({ "Idempotency-Key": KEY }, "/v1/leads/callback", {
-      kind: "callback",
-      name: "Alice",
-      phone: "+15551234567",
-      payload: {},
-    });
-
-    expect(sub.statusCode).toBe(201);
-    expect(cb.statusCode).toBe(201);
-    expect(keyLookups()).toHaveLength(0);
-    expect(
-      jest.mocked(prisma.callback.create).mock.calls[0]?.[0].data,
-    ).not.toHaveProperty("idempotencyKey");
-  });
-});