create-ailk 0.2.0 → 0.3.0

package/templates/.claude/skills/scaffold-commerce/templates/subscription-route.template.ts

@@ -1,446 +0,0 @@
-/**
- * Subscription routes — instantiated by `scaffold-commerce`'s
- * surface-selection branch (SKILL.md § Step 10h, FEAT-023 U5) into the
- * consumer's own `apps/api`. Lands at, e.g.,
- * `apps/api/src/routes/commerce/subscriptions.ts`. TWO handlers with
- * DELIBERATELY OPPOSITE auth postures — do not register them in the same
- * scope:
- *
- *   1. `subscribeHandler` — a PUBLIC, unauthenticated "subscribe" action.
- *      Mirrors `checkout-route.template.ts` exactly (this surface reuses
- *      `createCheckoutSession()`, pinned `mode: "subscription"` — spec §3
- *      design decision: no parallel subscription client module).
- *   2. `subscriptionRoutes` — an ADMIN + TENANT-GUARDED Fastify plugin
- *      exposing the subscription-status READ. Mirrors
- *      `invoice-route.template.ts`'s `requireSiteAdmin` +
- *      `requireSingleTenantScope` guards verbatim (spec §5.3 escalation
- *      boundary: "retrieve-on-view is the v1 default, mirroring U4" — no
- *      subscription webhook is scaffolded at v1).
- *
- * Registration (BOTH required, in DIFFERENT scopes):
- *
- *     // 1. subscribeHandler — public, rate-limited (mirrors checkout):
- *     await fastify.register(async (subscribeScope) => {
- *       subscribeScope.register(rateLimitMiddleware); // apps/api/src/middleware/rate-limit.ts
- *       subscribeScope.post("/api/subscriptions/subscribe", subscribeHandler);
- *     });
- *
- *     // 2. subscriptionRoutes — tenant-guarded admin read (mirrors invoices):
- *     await tenantScope.register(subscriptionRoutes);
- *
- * ── Auth posture — split by handler, on purpose ─────────────────────────────
- * `subscribeHandler` is a storefront "subscribe" action — the recurring-price
- * analog of `checkout-route.template.ts`'s one-time "buy" action. It is
- * intentionally UNAUTHENTICATED and does exactly ONE thing: create a NEW
- * Stripe Checkout Session (`mode: "subscription"`, pinned — never
- * caller-overridable) for ONE OF THE RECURRING PRICES this surface was
- * scaffolded to sell (`ALLOWED_LOOKUP_KEYS`, enforced server-side before any
- * Stripe call). It has NO list/read of existing subscriptions, no
- * update/cancel — see `subscriptionRoutes` below for that, and see the
- * "point management at the U6 portal" design decision (spec §3): this surface
- * never builds self-service cancel/change, it only shows state + a portal
- * link (`packages/ui`'s `SubscriptionStatus`).
- *
- * `subscriptionRoutes` READS an existing subscription's status — a
- * MANAGEMENT-shaped action, so it is authenticated + site-admin + tenant
- * guarded, the OPPOSITE of `subscribeHandler`'s public posture. Do not copy
- * `subscribeHandler`'s public registration for it.
- *
- * ── Entitlement is NOT authorization (repeats the AILK#3744 lesson) ─────────
- * `assertCommerceEntitled()`/`hasFeature("commerce")` answers "does this
- * DEPLOYMENT have commerce?", never "is this caller allowed to do this?" — it
- * is a SCAFFOLD-TIME check (this file is not emitted without
- * `feature:commerce`); there is deliberately no runtime entitlement call
- * here, and none is claimed for either handler.
- *
- * ── v1 tenancy limitation (mirrors invoice-route.template.ts verbatim) ──────
- * `loadStripeSurfaceConfig()` resolves ONE deployment-wide
- * `STRIPE_SECRET_KEY` and v1 has NO per-organization Stripe customer
- * namespace (see `docs/research/commerce-template-audit/subscriptions.md`).
- * A subscription therefore carries no org attribution, so on a multi-tenant
- * deployment there is no honest way to decide whether a caller-supplied
- * `subscriptionId` belongs to the caller's org. `requireSingleTenantScope`
- * admits ONLY the deployment's own operator org (the fixed single-tenant
- * sentinel `DEFAULT_ORG_ID`) and REFUSES every tenant org's admin outright —
- * subscription-status reading is an OPERATOR surface at v1, not a per-tenant
- * self-service one. Lifting the refusal needs a per-org Stripe Connect /
- * customer-namespace model (tracked follow-up, not silently claimed fixed).
- *
- * TEST-MODE ONLY (v1), and the live-key guard has no remaining gap.
- * `assertSandboxKey` (`packages/stripe-client/src/client.ts`) is an ALLOW-LIST
- * as of AILK#3734: it accepts only `sk_test_`, `pk_test_` and `rk_test_` and
- * refuses everything else, so a restricted live key and any future live prefix
- * are refused by construction. It is a shared file outside this template's
- * scope; both handlers below inherit that coverage via
- * `loadStripeSurfaceConfig()` + `getStripeClient()`, never a second/divergent
- * prefix check.
- */
-import { DEFAULT_ORG_ID } from "@working-theory/database/tenancy";
-import type {
-  FastifyPluginAsync,
-  FastifyReply,
-  FastifyRequest,
-} from "fastify";
-import { z } from "zod";
-
-import {
-  createCheckoutSession,
-  retrieveSubscriptionStatus,
-  StripeConfigError,
-  UnknownProductCodeError,
-} from "@working-theory/stripe-client";
-
-import { prisma } from "../../lib/prisma.js";
-import { loadStripeSurfaceConfig } from "./stripe-config.js";
-
-// ═══════════════════════════════════════════════════════════════════════════
-// 1. subscribeHandler — PUBLIC "subscribe" action (mirrors checkout-route)
-// ═══════════════════════════════════════════════════════════════════════════
-
-// ── Purchasable-plan allowlist — SCAFFOLD-TIME EDIT ───────────────────────────
-//
-// The ONLY recurring lookup_keys this surface is allowed to sell. Without
-// this allowlist the route resolves a caller-supplied `lookupKey` against
-// the merchant's ENTIRE Stripe account — the exact one-time-checkout hole
-// closed in PR #3733, applied here for the subscription surface. Step 10h
-// replaces the placeholder below with the recurring lookup_key(s) the
-// consumer selected. Until it does, EVERY subscribe request 404s.
-const ALLOWED_LOOKUP_KEYS: ReadonlySet<string> = new Set<string>([
-  "REPLACE_WITH_YOUR_RECURRING_STRIPE_LOOKUP_KEY",
-]);
-
-const LOOKUP_KEY_REGEX = /^[A-Za-z0-9._-]{1,200}$/;
-const REDIRECT_MAX_LENGTH = 2048;
-
-const SubscribeRequestSchema = z.object({
-  lookupKey: z
-    .string()
-    .regex(LOOKUP_KEY_REGEX, "lookupKey must match /^[A-Za-z0-9._-]{1,200}$/"),
-  successUrl: z
-    .string()
-    .min(1, "successUrl is required")
-    .max(REDIRECT_MAX_LENGTH, "successUrl is too long"),
-  cancelUrl: z
-    .string()
-    .min(1, "cancelUrl is required")
-    .max(REDIRECT_MAX_LENGTH, "cancelUrl is too long"),
-});
-
-/** Site's own origin — the ONLY origin a checkout redirect may resolve to (mirrors checkout-route.template.ts). */
-function loadSiteOrigin(): URL {
-  const raw = process.env.FRONTEND_URL;
-  if (!raw) {
-    throw new Error(
-      "FRONTEND_URL is missing. It is the site origin checkout redirects are locked to.",
-    );
-  }
-  try {
-    return new URL(raw);
-  } catch {
-    throw new Error("FRONTEND_URL is not a valid absolute URL.");
-  }
-}
-
-/** Resolves a caller-supplied redirect against the site's own origin, or null (mirrors checkout-route.template.ts). */
-function toSameOriginRedirect(raw: string, siteOrigin: URL): string | null {
-  let resolved: URL;
-  try {
-    resolved = new URL(raw, siteOrigin);
-  } catch {
-    return null;
-  }
-  if (resolved.protocol !== "https:" && resolved.protocol !== "http:") {
-    return null;
-  }
-  if (resolved.origin !== siteOrigin.origin) {
-    return null;
-  }
-  return resolved.toString();
-}
-
-/**
- * POST handler — creates a test-mode SUBSCRIPTION (`mode: "subscription"`,
- * pinned) Checkout Session for `lookupKey` and returns `{ sessionId, url }`.
- * The caller (the scaffolded `PricingTable` section's `onSubscribe`)
- * redirects the browser to `url` on success.
- *
- * @public-by-design — a storefront "subscribe" action, intentionally
- * UNAUTHENTICATED (the recurring-price analog of checkout's public "buy"; see
- * the file-header "Auth posture" note). It creates ONE allowlisted
- * subscription Checkout Session and reads/mutates nothing else. Its ADMIN
- * sibling `subscriptionRoutes` below is identity + tenant guarded — the marker
- * exempts ONLY this handler (route-template-auth-gate, #3751), never the file.
- */
-export async function subscribeHandler(
-  request: FastifyRequest,
-  reply: FastifyReply,
-): Promise<void> {
-  let siteOrigin: URL;
-  try {
-    if (!process.env.STRIPE_SECRET_KEY || !process.env.STRIPE_PUBLISHABLE_KEY) {
-      throw new Error(
-        "STRIPE_SECRET_KEY / STRIPE_PUBLISHABLE_KEY are missing. Run scaffold-commerce (direct payments path) first.",
-      );
-    }
-    siteOrigin = loadSiteOrigin();
-    loadStripeSurfaceConfig();
-  } catch (err) {
-    if (err instanceof StripeConfigError) {
-      request.log.error(
-        { method: request.method, path: request.url, message: err.message },
-        "[subscriptions] subscribe: LIVE Stripe key REFUSED — live-mode-forbidden",
-      );
-      return reply.status(500).send({ error: "live-mode-forbidden" });
-    }
-    request.log.error(
-      {
-        method: request.method,
-        path: request.url,
-        message: err instanceof Error ? err.message : "unknown",
-      },
-      "[subscriptions] subscribe: config error",
-    );
-    return reply.status(500).send({ error: "config-error" });
-  }
-
-  const parsed = SubscribeRequestSchema.safeParse(request.body);
-  if (!parsed.success) {
-    return reply.status(400).send({
-      error: "validation-error",
-      details: parsed.error.issues,
-    });
-  }
-
-  const { lookupKey, successUrl, cancelUrl } = parsed.data;
-
-  if (!ALLOWED_LOOKUP_KEYS.has(lookupKey)) {
-    request.log.warn(
-      { method: request.method, path: request.url, status: 404 },
-      "[subscriptions] subscribe: lookupKey is not in this surface's allowlist; refused",
-    );
-    return reply.status(404).send({ error: "unknown-product-code" });
-  }
-
-  const safeSuccessUrl = toSameOriginRedirect(successUrl, siteOrigin);
-  const safeCancelUrl = toSameOriginRedirect(cancelUrl, siteOrigin);
-  if (safeSuccessUrl === null || safeCancelUrl === null) {
-    request.log.warn(
-      { method: request.method, path: request.url, status: 400 },
-      "[subscriptions] subscribe: redirect URL is not same-origin; refused",
-    );
-    return reply.status(400).send({ error: "invalid-redirect-url" });
-  }
-
-  try {
-    // Pinned mode: "subscription" — this endpoint can never open a one-time
-    // checkout session, regardless of caller input (spec §3 design decision).
-    const { sessionId, url } = await createCheckoutSession({
-      productCode: lookupKey,
-      successUrl: safeSuccessUrl,
-      cancelUrl: safeCancelUrl,
-      mode: "subscription",
-    });
-
-    request.log.info(
-      {
-        method: request.method,
-        path: request.url,
-        sessionIdPrefix: sessionId.substring(0, 8),
-        status: 201,
-      },
-      "[subscriptions] subscribe: session created",
-    );
-
-    return reply.status(201).send({ sessionId, url });
-  } catch (err) {
-    if (err instanceof UnknownProductCodeError) {
-      return reply.status(404).send({ error: "unknown-product-code" });
-    }
-    if (err instanceof StripeConfigError) {
-      request.log.error(
-        {
-          method: request.method,
-          path: request.url,
-          errName: err.name,
-          message: err.message,
-        },
-        "[subscriptions] subscribe: config error",
-      );
-      return reply.status(500).send({ error: "config-error" });
-    }
-    request.log.error(
-      {
-        method: request.method,
-        path: request.url,
-        errName: err instanceof Error ? err.name : "unknown",
-      },
-      "[subscriptions] subscribe: stripe error; checkout-unavailable",
-    );
-    return reply.status(502).send({ error: "checkout-unavailable" });
-  }
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-// 2. subscriptionRoutes — ADMIN + TENANT-GUARDED status read (mirrors
-//    invoice-route.template.ts's guards verbatim)
-// ═══════════════════════════════════════════════════════════════════════════
-
-function unauthorized(reply: FastifyReply): void {
-  reply.status(401).send({
-    ok: false,
-    error: { code: "unauthorized", message: "Authentication required." },
-  });
-}
-
-function forbidden(reply: FastifyReply): void {
-  reply.status(403).send({
-    ok: false,
-    error: { code: "forbidden", message: "Admin access required." },
-  });
-}
-
-/** Identical for EVERY request — leaks no information about which subscriptions exist (no enumeration oracle). */
-function tenancyUnsupported(reply: FastifyReply): void {
-  reply.status(403).send({
-    ok: false,
-    error: {
-      code: "tenancy_unsupported",
-      message:
-        "Subscription-status reading is unavailable on a multi-tenant deployment: v1 has no per-organization Stripe customer namespace, so a subscription cannot be attributed to an organization.",
-    },
-  });
-}
-
-function invalidBody(reply: FastifyReply): void {
-  reply.status(400).send({
-    ok: false,
-    error: { code: "invalid_body", message: "Invalid request." },
-  });
-}
-
-function serverError(reply: FastifyReply): void {
-  // Never echo the raw Stripe/internal error — it may embed request params.
-  reply.status(500).send({
-    ok: false,
-    error: { code: "internal_error", message: "Something went wrong." },
-  });
-}
-
-/**
- * The site-admin role set. `User.role` is a per-deployment String
- * ("user" | "admin" | "owner") — DISTINCT from the org-membership `Role` enum
- * the multi-tenant module uses. Named rather than compared inline so the next
- * role change is one greppable edit per template; mirrored from
- * `payment-link-route.template.ts:135` because these are copied-not-imported
- * scaffold sources with nowhere to share a constant (AILK#3765).
- */
-const SITE_ADMIN_ROLES: ReadonlySet<string> = new Set(["admin", "owner"]);
-
-/**
- * Gate 1 — requires an authenticated, site-admin caller. `request.userId` is
- * populated by `authPreHandlerPlugin` (see the Registration note above); this
- * re-checks it defensively. Sends the 401/403 itself and returns `null` on
- * denial; the caller's handler must `return` immediately when this returns
- * `null`.
- */
-async function requireSiteAdmin(
-  request: FastifyRequest,
-  reply: FastifyReply,
-): Promise<string | null> {
-  const userId = request.userId;
-  if (!userId) {
-    unauthorized(reply);
-    return null;
-  }
-
-  let role: string | undefined;
-  try {
-    const user = await prisma.user.findUnique({
-      where: { id: userId },
-      select: { role: true },
-    });
-    role = user?.role;
-  } catch (err) {
-    // FAIL CLOSED. Never `catch {}` into the happy path.
-    //
-    // Unwrapped, a rejection here escapes to Fastify's default error handler,
-    // which serializes `error.message` back to the caller — contradicting this
-    // file's own no-raw-echo contract. It always denied; it denied while
-    // leaking.
-    request.log.error(
-      {
-        method: request.method,
-        path: request.url,
-        message: err instanceof Error ? err.message : "unknown",
-      },
-      "[subscriptions] role resolution failed; DENYING",
-    );
-    serverError(reply);
-    return null;
-  }
-
-  // A missing user row (deleted account, stale session) has no role -> denied.
-  if (!role || !SITE_ADMIN_ROLES.has(role)) {
-    forbidden(reply);
-    return null;
-  }
-
-  return userId;
-}
-
-/**
- * Gate 2 — the tenancy guard. v1 resolves ONE deployment-wide
- * `STRIPE_SECRET_KEY` and has no per-org Stripe customer namespace, so a
- * subscription carries no organization attribution — this guard admits ONLY
- * the deployment's own operator org (the fixed single-tenant sentinel
- * `DEFAULT_ORG_ID`) and refuses everyone else, before any Stripe call.
- * Mirrors `invoice-route.template.ts`'s `requireSingleTenantScope` verbatim.
- */
-async function requireSingleTenantScope(
-  request: FastifyRequest,
-  reply: FastifyReply,
-): Promise<boolean> {
-  const tenant = request.tenant;
-  if (!tenant) {
-    forbidden(reply);
-    return false;
-  }
-
-  if (tenant.organizationId !== DEFAULT_ORG_ID) {
-    tenancyUnsupported(reply);
-    return false;
-  }
-
-  return true;
-}
-
-const statusQuerySchema = z.object({
-  subscriptionId: z.string().min(1).max(255),
-});
-
-/**
- * `subscriptionRoutes` — a single GET endpoint: retrieve-on-view by the
- * subscription's own Stripe id (spec §5.3 escalation boundary — no
- * subscription webhook is scaffolded at v1; mirrors
- * `invoice-route.template.ts`'s `?invoiceId=` shape).
- */
-export const subscriptionRoutes: FastifyPluginAsync = async (fastify) => {
-  // GET /v1/commerce/subscriptions?subscriptionId=sub_...
-  fastify.get("/v1/commerce/subscriptions", async (request, reply) => {
-    if (!(await requireSiteAdmin(request, reply))) return;
-    if (!(await requireSingleTenantScope(request, reply))) return;
-
-    const query = statusQuerySchema.safeParse(request.query);
-    if (!query.success) return invalidBody(reply);
-
-    try {
-      loadStripeSurfaceConfig();
-      const status = await retrieveSubscriptionStatus({
-        subscriptionId: query.data.subscriptionId,
-      });
-      return reply.send({ ok: true, data: status });
-    } catch {
-      return serverError(reply);
-    }
-  });
-};

package/templates/apps/api/src/__tests__/server.test.ts

@@ -1,253 +0,0 @@
-/**
- * @file server.test.ts
- * @description Unit tests for server.ts - Server setup
- *
- * Uses the real build() function with real route plugins. All internal modules
- * run real; external boundaries (CORS, rate-limit) are mocked at the plugin
- * boundary since they would require live network/Redis in production.
- */
-
-import { build } from '../server';
-
-// External service boundaries — mocked because they require live infrastructure
-// or have ESM-only transitive deps that Jest's CJS preset cannot resolve:
-//   @fastify/cors, @fastify/rate-limit — Fastify plugins that would require
-//     live network infrastructure (CORS policy sync, Redis store) in unit tests.
-//   @working-theory/email — transitive dep on @react-email/components which is ESM-only
-//     and cannot be resolved by jest-resolve in CommonJS mode.
-jest.mock('@fastify/cors', () => {
-  return jest.fn().mockResolvedValue(undefined);
-});
-
-jest.mock('@fastify/rate-limit', () => {
-  return jest.fn().mockResolvedValue(undefined);
-});
-
-jest.mock('@working-theory/email', () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
-}));
-
-describe('Server', () => {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
-  let app: any;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-  });
-
-  afterEach(async () => {
-    if (app) {
-      await app.close();
-    }
-  });
-
-  describe('build function', () => {
-    it('should build Fastify server instance', async () => {
-      // ACT
-      app = await build();
-
-      // ASSERT
-      expect(app).toBeDefined();
-      expect(typeof app.inject).toBe('function');
-    });
-
-    it('should register health check route returning static OK without external calls', async () => {
-      // ARRANGE
-      app = await build();
-
-      // ACT
-      const response = await app.inject({
-        method: 'GET',
-        url: '/health',
-      });
-
-      // ASSERT
-      expect(response.statusCode).toBe(200);
-      const body = JSON.parse(response.body);
-      expect(body.status).toBe('healthy');
-      expect(body.timestamp).toBeDefined();
-      // No external dependencies in the health check anymore
-      expect(body.platform).toBeUndefined();
-    });
-
-    it('should register root endpoint', async () => {
-      // ARRANGE
-      app = await build();
-
-      // ACT
-      const response = await app.inject({
-        method: 'GET',
-        url: '/',
-      });
-
-      // ASSERT
-      expect(response.statusCode).toBe(200);
-      const body = JSON.parse(response.body);
-      expect(body.name).toBe('AI Launch Kit API');
-      expect(body.endpoints).toBeDefined();
-    });
-
-    it('should register CORS', async () => {
-      // ACT
-      app = await build();
-
-      // ASSERT - CORS should be registered (no error thrown)
-      expect(app).toBeDefined();
-    });
-
-    it('should register all route plugins', async () => {
-      // ARRANGE
-      app = await build();
-
-      // ACT & ASSERT - Test that routes are registered by checking they don't 404
-      const healthResponse = await app.inject({
-        method: 'GET',
-        url: '/health',
-      });
-      expect(healthResponse.statusCode).toBe(200);
-
-      const rootResponse = await app.inject({
-        method: 'GET',
-        url: '/',
-      });
-      expect(rootResponse.statusCode).toBe(200);
-    });
-
-    it('should include all endpoints in root response', async () => {
-      // ARRANGE
-      app = await build();
-
-      // ACT
-      const response = await app.inject({
-        method: 'GET',
-        url: '/',
-      });
-
-      // ASSERT
-      const body = JSON.parse(response.body);
-      expect(body.endpoints).toHaveProperty('health');
-      expect(body.endpoints).toHaveProperty('tokens');
-      expect(body.endpoints).toHaveProperty('profile');
-    });
-
-    it('startup throws when LEAD_CAPTURE_FILE points at a missing directory', async () => {
-      // ARRANGE — set LEAD_CAPTURE_FILE to a path whose parent dir doesn't exist
-      // so the real validateLeadCaptureDir() throws (AC8). Restore after test.
-      const prior = process.env.LEAD_CAPTURE_FILE;
-      process.env.LEAD_CAPTURE_FILE = '/nonexistent-ailk-test-dir/leads.jsonl';
-
-      try {
-        // ACT & ASSERT
-        await expect(build()).rejects.toThrow(/LEAD_CAPTURE_FILE/);
-      } finally {
-        if (prior === undefined) {
-          delete process.env.LEAD_CAPTURE_FILE;
-        } else {
-          process.env.LEAD_CAPTURE_FILE = prior;
-        }
-      }
-    });
-  });
-});
-
-// ── Bootstrap test: raw-body parser scope encapsulation (AC 13) ──────────────
-//
-// Proves that registering the webhooks plugin (with its raw-body parser scoped
-// to application/json) does NOT leak that parser to other routes. The global
-// Fastify JSON parser must remain active for all non-webhook routes.
-
-import Fastify from 'fastify';
-import { webhooksRoutes } from '../routes/webhooks/index.js';
-
-describe('Parser scope — webhooks raw-body parser does not leak', () => {
-  it('other routes still receive parsed JSON objects after webhooks plugin registers', async () => {
-    // Build a minimal server that mirrors the encapsulation pattern in server.ts:
-    //   1. Register a JSON route that echoes the parsed body.
-    //   2. Register the webhooks plugin inside an encapsulated scope with a
-    //      raw-body (buffer) parser.
-    // If the raw-body parser leaks out of the webhooks scope, the echo route
-    // would receive a Buffer instead of a parsed object.
-
-    const server = Fastify({ logger: false });
-
-    // A simple JSON echo route — simulates any existing JSON-parsed route
-    server.post('/api/echo', async (req) => ({ received: req.body }));
-
-    // Mirror of server.ts registration pattern
-    await server.register(async (webhooksScope) => {
-      webhooksScope.addContentTypeParser(
-        'application/json',
-        { parseAs: 'buffer' },
-        (_req, body, done) => {
-          done(null, body);
-        },
-      );
-      await webhooksScope.register(webhooksRoutes);
-    });
-
-    await server.ready();
-
-    try {
-      const response = await server.inject({
-        method: 'POST',
-        url: '/api/echo',
-        payload: { hello: 'world' },
-        headers: { 'content-type': 'application/json' },
-      });
-
-      expect(response.statusCode).toBe(200);
-      const body = JSON.parse(response.body);
-      // Must be a plain object, not a stringified Buffer
-      expect(body.received).toEqual({ hello: 'world' });
-      expect(Buffer.isBuffer(body.received)).toBe(false);
-    } finally {
-      await server.close();
-    }
-  });
-
-  describe('per-scope rate-limit defaults (#5111, DEF-004)', () => {
-    // Real end-to-end behavior against the real in-house rate-limit
-    // middleware (NOT mocked — this repo's convention is to mock only real
-    // external boundaries, never an internal module, see the file header).
-    // aeoScope's `/v1/aeo/score/example` needs no DB/network (a bundled
-    // example, `loadExampleScore()`); flowsScope's `/v1/flows/:slug` with a
-    // schema-invalid slug returns 400 before any DB access — both let the
-    // onRequest rate-limit hook be the only thing under test, regardless of
-    // the eventual handler status.
-    it('caps aeoScope at the strict pre-#4730 default (10/min) — the 11th request 429s', async () => {
-      app = await build();
-      const ip = '198.51.100.11';
-
-      for (let i = 0; i < 10; i++) {
-        const res = await app.inject({
-          method: 'GET',
-          url: '/v1/aeo/score/example',
-          headers: { 'x-forwarded-for': ip },
-        });
-        expect(res.statusCode).not.toBe(429);
-      }
-
-      const eleventh = await app.inject({
-        method: 'GET',
-        url: '/v1/aeo/score/example',
-        headers: { 'x-forwarded-for': ip },
-      });
-      expect(eleventh.statusCode).toBe(429);
-    });
-
-    it('leaves flowsScope above the strict default — 11 requests never 429', async () => {
-      app = await build();
-      const ip = '198.51.100.12';
-
-      for (let i = 0; i < 11; i++) {
-        const res = await app.inject({
-          method: 'GET',
-          url: '/v1/flows/not-a-real-slug!!!',
-          headers: { 'x-forwarded-for': ip },
-        });
-        // Schema-invalid slug → 400, well before any rate limit or DB call.
-        expect(res.statusCode).toBe(400);
-      }
-    });
-  });
-});