create-ailk 0.2.0 → 0.3.0

package/templates/apps/api/src/routes/webhooks/README.md

@@ -1,80 +0,0 @@
-# Webhooks — `apps/api/src/routes/webhooks/`
-
-Stripe webhook receiver at `POST /v1/webhooks/stripe`. Verifies
-signatures, dispatches events via a `switch`, and fires server-side
-telemetry. Handles `customer.created`, `checkout.session.completed`, and
-`checkout.session.expired` (the last two also stamp the recommender's
-buyer row — below).
-
-## How to add a new event handler
-
-Add a `case` arm to the `switch` in `stripe.ts`:
-
-```ts
-case "invoice.payment_succeeded": {
-  const invoice = event.data.object as { ... };
-  await fireTelemetryWithTimeout(request, "invoice-paid", { ... });
-  break;
-}
-```
-
-Customer forks edit `stripe.ts` directly. v1 ships no pluggable handler
-registry — if multiple forks request one, file an issue.
-
-## Recommender purchase stamp (#4838)
-
-A Checkout Session the recommender opened (`POST /v1/flows/:slug/checkout`,
-#4841) carries `metadata.flowCheckoutId` — the `FlowCheckout` buyer row's
-id. On `checkout.session.completed` the handler stamps that row
-`status: "completed"` (+ `completedAt`, `stripeSessionId`,
-`stripeCustomerId`); on `checkout.session.expired` it stamps
-`status: "expired"`. Both are ONE guarded update —
-`updateMany({ where: { id, status: "created" } })` — so the stamp is
-at-most-once regardless of the in-memory store below: a replay, a restart
-between deliveries, or a late `expired` after a `completed` matches zero
-rows and logs `outcome: "stale_or_unknown"`. A charged `amount_total` that
-differs from the quoted `amountMinor` is logged (`expected` / `received`)
-and the row is still stamped — the quote is never overwritten. The stamp
-runs beside the telemetry + billing tasks, never instead of them, and an
-event without the key never touches `flowCheckout`. Always 200.
-
-## Idempotency caveat (load-bearing)
-
-Stripe uses **at-least-once delivery semantics** and occasionally
-double-delivers events. The in-memory store (`lib/webhook-idempotency.ts`)
-short-circuits a replayed `event.id` within one process; it is not durable
-across a restart or a second API instance. Telemetry-only side effects make
-that an acceptable counting drift.
-
-**A side effect with write semantics carries its own durable layer.** The
-recommender stamp above uses a guarded conditional update (the row's
-`status: "created"` is the key). A future write that cannot be expressed as
-a guarded update (confirmation email, refund processing) needs a
-`webhook_events` table keyed on `event.id` with an early-return for
-already-seen IDs — add it first.
-
-## Env contract
-
-Both vars are **server-only** — never use a `NEXT_PUBLIC_` prefix.
-
-| Var                     | Required                     | Notes                                                                                                                                                                                                                                                                                                                                                                                          |
-| ----------------------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `STRIPE_WEBHOOK_SECRET` | For the route to do anything | `whsec_*` from Stripe Dashboard                                                                                                                                                                                                                                                                                                                                                                |
-| `STRIPE_SECRET_KEY`     | For checkout + sandbox check | Must match an allow-listed test-mode prefix (`sk_test_*` / `pk_test_*` / `rk_test_*`); anything else — including live and restricted-live keys — is runtime-blocked by `assertSandboxKey`. The commit-time hook is a partial backstop only: it greps for `sk_live_` / `pk_live_` and does **not** catch restricted-live (`rk_live_`) keys, so the runtime allow-list is the load-bearing guard |
-
-Without `STRIPE_WEBHOOK_SECRET`, the route returns 503 on every request.
-
-## Deployment note
-
-Customer forks must:
-
-1. Configure a Stripe Dashboard webhook endpoint pointing at
-   `https://<your-host>/v1/webhooks/stripe`.
-2. Copy the endpoint's **Signing secret** (`whsec_*`) into
-   `STRIPE_WEBHOOK_SECRET` in their environment.
-
-Without both, telemetry will not fire and 503s will be logged.
-
-## Brief
-
-`docs/internal/decisions/ailk-stripe-webhook-receiver.md`

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-flow-checkout.test.ts

@@ -1,315 +0,0 @@
-/**
- * POST /api/webhooks/stripe — the recommender FlowCheckout stamp (#4838).
- *
- * The stripe.test.ts mock shape: `@working-theory/analytics/server` `track`,
- * the prisma auto-mock, `@working-theory/stripe-client`'s
- * `verifyWebhookSignature` at the package boundary. AC-1 … AC-5. The four
- * pre-existing webhook suites are the regression floor and are not edited.
- * AC-6 (#4862) adds the `no_payment_required` (zero-due) case.
- */
-import type { FastifyInstance } from "fastify";
-import Fastify from "fastify";
-
-const mockTrack = jest.fn().mockResolvedValue(undefined);
-jest.mock("@working-theory/analytics/server", () => ({
-  track: (...args: unknown[]) => mockTrack(...args),
-}));
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../../lib/prisma.js");
-
-const mockVerifyWebhookSignature = jest.fn();
-class MockStripeWebhookSignatureError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "StripeWebhookSignatureError";
-  }
-}
-jest.mock("@working-theory/stripe-client", () => ({
-  verifyWebhookSignature: (...args: unknown[]) => mockVerifyWebhookSignature(...args),
-  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
-  assertSandboxKey: jest.fn(),
-  createCheckoutSession: jest.fn(),
-  getStripeClient: jest.fn(),
-  STRIPE_API_VERSION: "2024-06-20",
-  StripeConfigError: class StripeConfigError extends Error {},
-  UnknownProductCodeError: class UnknownProductCodeError extends Error {},
-  WEBHOOK_TOLERANCE_SECONDS: 300,
-}));
-
-import * as configModule from "../../../config/index.js";
-import { stripeWebhookHandler } from "../stripe.js";
-import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
-import { prisma } from "../../../lib/prisma.js";
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-const FLOW_CHECKOUT_ID = "flchk_test_1";
-const SESSION_ID = "cs_test_session_12345678901234567890";
-const CUSTOMER_ID = "cus_test_12345678901234567890";
-const EMAIL = "alice@example.com";
-const PERMALINK = "eyJ2ZXJzaW9uIjoxLCJmbG93U2x1ZyI6ImFpbGstcmVjbyJ9";
-
-function sessionEvent(type: "checkout.session.completed" | "checkout.session.expired", object: Record<string, unknown> = {}) {
-  return {
-    id: "evt_test_12345678abcdef",
-    type,
-    data: {
-      object: {
-        id: SESSION_ID,
-        payment_status: "paid",
-        amount_total: 24900,
-        currency: "usd",
-        customer: CUSTOMER_ID,
-        customer_details: { email: EMAIL },
-        metadata: { flowCheckoutId: FLOW_CHECKOUT_ID, flowSlug: "ailk-reco", offerKey: "pro", permalink: PERMALINK },
-        ...object,
-      },
-    },
-  };
-}
-
-type LogCall = [unknown, string?];
-const logCalls: LogCall[] = [];
-
-async function buildTestServer(): Promise<FastifyInstance> {
-  const server = Fastify({ logger: false });
-  await server.register(async (webhooksScope) => {
-    webhooksScope.addContentTypeParser("application/json", { parseAs: "buffer" }, (_req, body, done) => {
-      done(null, body);
-    });
-    webhooksScope.addHook("onRequest", async (request) => {
-      for (const level of ["info", "warn", "error"] as const) {
-        const original = request.log[level].bind(request.log);
-        request.log[level] = ((...args: unknown[]) => {
-          logCalls.push(args as LogCall);
-          return (original as (...a: unknown[]) => void)(...args);
-        }) as typeof request.log.info;
-      }
-    });
-    webhooksScope.post("/v1/webhooks/stripe", stripeWebhookHandler);
-  });
-  await server.ready();
-  return server;
-}
-
-const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
-const HEADERS = { "content-type": "application/json", "stripe-signature": "t=1234,v1=abc" };
-
-let server: FastifyInstance;
-
-beforeEach(async () => {
-  jest.clearAllMocks();
-  logCalls.length = 0;
-  __resetIdempotencyStore();
-  jest.replaceProperty(configModule, "config", {
-    ...configModule.config,
-    STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
-  });
-  (prisma.flowCheckout.findUnique as jest.Mock).mockResolvedValue({ amountMinor: 24900 });
-  (prisma.flowCheckout.updateMany as jest.Mock).mockResolvedValue({ count: 1 });
-  (prisma.user.findFirst as jest.Mock).mockResolvedValue(null);
-  (prisma.user.findUnique as jest.Mock).mockResolvedValue(null);
-  server = await buildTestServer();
-});
-
-afterEach(async () => {
-  await server.close();
-  jest.restoreAllMocks();
-});
-
-async function post() {
-  return server.inject({ method: "POST", url: "/v1/webhooks/stripe", payload: VALID_BODY, headers: HEADERS });
-}
-
-function stampCall() {
-  expect(prisma.flowCheckout.updateMany).toHaveBeenCalledTimes(1);
-  return (prisma.flowCheckout.updateMany as jest.Mock).mock.calls[0][0];
-}
-
-// ── AC-1 — completed stamps the row once, guarded, beside the legacy tasks ──
-
-describe("AC-1 — completed stamps the row once, guarded, beside the legacy tasks", () => {
-  it("stamps completed with the guard, the session id and the customer; telemetry + billing still run", async () => {
-    mockVerifyWebhookSignature.mockReturnValue(sessionEvent("checkout.session.completed"));
-    const res = await post();
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body)).toEqual({ received: true });
-
-    const call = stampCall();
-    expect(call.where).toEqual({ id: FLOW_CHECKOUT_ID, status: "created" });
-    expect(call.data.status).toBe("completed");
-    expect(call.data.completedAt).toBeInstanceOf(Date);
-    expect(call.data.stripeSessionId).toBe(SESSION_ID);
-    expect(call.data.stripeCustomerId).toBe(CUSTOMER_ID);
-
-    // The legacy tasks, exactly as stripe.test.ts asserts them.
-    expect(mockTrack).toHaveBeenCalledTimes(1);
-    expect(mockTrack).toHaveBeenCalledWith("purchase-completed", {
-      amount: 24900,
-      currency: "usd",
-      productId: undefined,
-      eventType: "checkout.session.completed",
-      eventIdPrefix: "evt_test",
-    });
-    expect(prisma.user.findFirst).toHaveBeenCalledWith({
-      where: { billingProvider: "stripe", billingCustomerId: CUSTOMER_ID },
-    });
-    expect(prisma.user.findUnique).toHaveBeenCalledWith({ where: { email: EMAIL } });
-  });
-});
-
-// ── AC-2 — expired stamps expired ───────────────────────────────────────────
-
-describe("AC-2 — expired stamps expired", () => {
-  it("stamps status expired under the same guard, with no completedAt", async () => {
-    mockVerifyWebhookSignature.mockReturnValue(sessionEvent("checkout.session.expired"));
-    const res = await post();
-    expect(res.statusCode).toBe(200);
-    const call = stampCall();
-    expect(call.where.status).toBe("created");
-    expect(call.where.id).toBe(FLOW_CHECKOUT_ID);
-    expect(call.data).toEqual({ status: "expired" });
-    expect(call.data).not.toHaveProperty("completedAt");
-    expect(prisma.flowCheckout.findUnique).not.toHaveBeenCalled();
-    expect(mockTrack).not.toHaveBeenCalled();
-  });
-});
-
-// ── AC-3 — the legacy paths are byte-unchanged ──────────────────────────────
-
-describe("AC-3 — the legacy paths are byte-unchanged", () => {
-  it("an event without flowCheckoutId never touches prisma.flowCheckout", async () => {
-    mockVerifyWebhookSignature.mockReturnValue(
-      sessionEvent("checkout.session.completed", { metadata: { productId: "starter" } }),
-    );
-    const res = await post();
-    expect(res.statusCode).toBe(200);
-    expect(prisma.flowCheckout.findUnique).not.toHaveBeenCalled();
-    expect(prisma.flowCheckout.updateMany).not.toHaveBeenCalled();
-    expect(mockTrack).toHaveBeenCalledTimes(1);
-  });
-
-  it("an expired event without the key is a no-op 200 that logs the unhandled-event line", async () => {
-    mockVerifyWebhookSignature.mockReturnValue(sessionEvent("checkout.session.expired", { metadata: null }));
-    expect((await post()).statusCode).toBe(200);
-    expect(prisma.flowCheckout.updateMany).not.toHaveBeenCalled();
-    const unhandled = logCalls.find((c) => c[1] === "unhandled webhook event");
-    expect(unhandled?.[0]).toEqual({ eventType: "checkout.session.expired", eventIdPrefix: "evt_test" });
-  });
-
-  it("a completed session that is not paid logs `unpaid` and does NOT stamp — the row stays created", async () => {
-    mockVerifyWebhookSignature.mockReturnValue(
-      sessionEvent("checkout.session.completed", { payment_status: "unpaid" }),
-    );
-    expect((await post()).statusCode).toBe(200);
-    expect(prisma.flowCheckout.findUnique).not.toHaveBeenCalled();
-    expect(prisma.flowCheckout.updateMany).not.toHaveBeenCalled();
-    const unpaid = logCalls.find((c) => (c[0] as { outcome?: string })?.outcome === "unpaid");
-    expect(unpaid?.[0]).toEqual({
-      eventIdPrefix: "evt_test",
-      flowCheckoutIdPrefix: FLOW_CHECKOUT_ID.substring(0, 8),
-      outcome: "unpaid",
-    });
-    // The legacy tasks still ran for the event.
-    expect(mockTrack).toHaveBeenCalledTimes(1);
-  });
-});
-
-// ── AC-6 — a zero-due (no_payment_required) session stamps completed ───────
-
-describe("AC-6 — no_payment_required stamps completed exactly as paid (#4862)", () => {
-  it("stamps completed with the guard, the session id and the customer; telemetry + billing still run", async () => {
-    mockVerifyWebhookSignature.mockReturnValue(
-      sessionEvent("checkout.session.completed", { payment_status: "no_payment_required" }),
-    );
-    const res = await post();
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body)).toEqual({ received: true });
-
-    const call = stampCall();
-    expect(call.where).toEqual({ id: FLOW_CHECKOUT_ID, status: "created" });
-    expect(call.data.status).toBe("completed");
-    expect(call.data.completedAt).toBeInstanceOf(Date);
-    expect(call.data.stripeSessionId).toBe(SESSION_ID);
-    expect(call.data.stripeCustomerId).toBe(CUSTOMER_ID);
-
-    expect(mockTrack).toHaveBeenCalledTimes(1);
-    const unpaid = logCalls.find((c) => (c[0] as { outcome?: string })?.outcome === "unpaid");
-    expect(unpaid).toBeUndefined();
-  });
-});
-
-// ── AC-4 — never a retry storm ──────────────────────────────────────────────
-
-describe("AC-4 — never a retry storm", () => {
-  it("count 0 logs stale_or_unknown and still 200s", async () => {
-    (prisma.flowCheckout.updateMany as jest.Mock).mockResolvedValue({ count: 0 });
-    mockVerifyWebhookSignature.mockReturnValue(sessionEvent("checkout.session.completed"));
-    expect((await post()).statusCode).toBe(200);
-    const stale = logCalls.find((c) => (c[0] as { outcome?: string })?.outcome === "stale_or_unknown");
-    expect(stale).toBeDefined();
-  });
-
-  it("an updateMany rejection logs an error and still 200s", async () => {
-    (prisma.flowCheckout.updateMany as jest.Mock).mockRejectedValue(new Error("db down"));
-    mockVerifyWebhookSignature.mockReturnValue(sessionEvent("checkout.session.completed"));
-    expect((await post()).statusCode).toBe(200);
-    const failed = logCalls.find((c) => (c[0] as { outcome?: string })?.outcome === "stamp_failed");
-    expect(failed).toBeDefined();
-  });
-
-  it("a charged amount that differs from the quote logs both integers and STILL stamps completed", async () => {
-    mockVerifyWebhookSignature.mockReturnValue(sessionEvent("checkout.session.completed", { amount_total: 25000 }));
-    expect((await post()).statusCode).toBe(200);
-    const mismatch = logCalls.find((c) => (c[0] as { outcome?: string })?.outcome === "amount_mismatch");
-    expect(mismatch?.[0]).toEqual({
-      eventIdPrefix: "evt_test",
-      flowCheckoutIdPrefix: FLOW_CHECKOUT_ID.substring(0, 8),
-      outcome: "amount_mismatch",
-      expected: 24900,
-      received: 25000,
-    });
-    expect(stampCall().data.status).toBe("completed");
-  });
-});
-
-// ── AC-5 — PII boundary ─────────────────────────────────────────────────────
-
-describe("AC-5 — PII boundary", () => {
-  it.each([
-    ["the AC-1 event", sessionEvent("checkout.session.completed"), null],
-    ["the AC-4 mismatch event", sessionEvent("checkout.session.completed", { amount_total: 25000 }), null],
-    [
-      "the stamp_failed branch",
-      sessionEvent("checkout.session.completed"),
-      new Error(`connection refused for ${EMAIL} at ${CUSTOMER_ID}`),
-    ],
-  ])("every log line for %s carries no email, customer_details, permalink, or a full cus_/cs_ id", async (_name, event, rejection) => {
-    if (rejection) (prisma.flowCheckout.updateMany as jest.Mock).mockRejectedValue(rejection);
-    mockVerifyWebhookSignature.mockReturnValue(event);
-    expect((await post()).statusCode).toBe(200);
-    const ALLOWED = new Set(["eventIdPrefix", "flowCheckoutIdPrefix", "outcome", "expected", "received", "errName"]);
-    const stampLines = logCalls.filter((c) => typeof c[0] === "object" && c[0] !== null && "flowCheckoutIdPrefix" in c[0]);
-    expect(stampLines.length).toBeGreaterThan(0);
-    for (const line of stampLines) {
-      for (const key of Object.keys(line[0] as object)) expect(ALLOWED.has(key)).toBe(true);
-    }
-    if (rejection) {
-      const failed = stampLines.find((c) => (c[0] as { outcome?: string }).outcome === "stamp_failed");
-      expect(failed?.[0]).toEqual({
-        eventIdPrefix: "evt_test",
-        flowCheckoutIdPrefix: FLOW_CHECKOUT_ID.substring(0, 8),
-        outcome: "stamp_failed",
-        errName: "Error",
-      });
-    }
-    for (const line of logCalls) {
-      const text = JSON.stringify(line);
-      expect(text).not.toContain(EMAIL);
-      expect(text).not.toContain("customer_details");
-      expect(text).not.toContain(PERMALINK);
-      for (const token of text.match(/\b(?:cus|cs)_[A-Za-z0-9_]+/g) ?? []) expect(token.length).toBeLessThanOrEqual(8);
-    }
-  });
-});

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-idempotency.test.ts

@@ -1,247 +0,0 @@
-/**
- * Stripe webhook idempotency — replay protection at the AILK layer.
- *
- * Stripe guarantees at-least-once delivery; an `event.id` can arrive multiple
- * times (network retries, dashboard manual replay). The handler MUST be
- * idempotent: a second arrival with the same `event.id` returns 200 without
- * re-firing telemetry or any side effect.
- *
- * Implementation: module-scoped store with TTL — see
- * `apps/api/src/lib/webhook-idempotency.ts` for the deliberate single-replica
- * trade-off vs. a durable table.
- */
-import type { FastifyInstance } from "fastify";
-import Fastify from "fastify";
-
-// ── Mocks ────────────────────────────────────────────────────────────────────
-
-const mockConfig: { STRIPE_WEBHOOK_SECRET: string | undefined } = {
-  STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
-};
-// eslint-disable-next-line no-restricted-syntax -- mirrors stripe.test.ts mock pattern
-jest.mock("../../../config/index.js", () => ({
-  get config() {
-    return mockConfig;
-  },
-}));
-
-const mockTrack = jest.fn().mockResolvedValue(undefined);
-jest.mock("@working-theory/analytics/server", () => ({
-  track: (...args: unknown[]) => mockTrack(...args),
-}));
-
-const mockVerifyWebhookSignature = jest.fn();
-class MockStripeWebhookSignatureError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "StripeWebhookSignatureError";
-  }
-}
-// eslint-disable-next-line no-restricted-syntax -- mirrors stripe.test.ts mock pattern
-jest.mock("../../../lib/stripe.js", () => ({
-  verifyWebhookSignature: (...args: unknown[]) =>
-    mockVerifyWebhookSignature(...args),
-  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
-}));
-
-import { stripeWebhookHandler } from "../stripe.js";
-import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-function buildFakeEvent(id: string, overrides: Record<string, unknown> = {}) {
-  return {
-    id,
-    type: "checkout.session.completed",
-    data: {
-      object: {
-        amount_total: 4999,
-        currency: "usd",
-        metadata: { productId: "starter" },
-      },
-    },
-    ...overrides,
-  };
-}
-
-async function buildTestServer(): Promise<FastifyInstance> {
-  const server = Fastify({ logger: false });
-
-  await server.register(async (webhooksScope) => {
-    webhooksScope.addContentTypeParser(
-      "application/json",
-      { parseAs: "buffer" },
-      (_req, body, done) => {
-        done(null, body);
-      },
-    );
-    webhooksScope.post("/v1/webhooks/stripe", stripeWebhookHandler);
-  });
-
-  await server.ready();
-  return server;
-}
-
-const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
-const VALID_SIGNATURE = "t=1234,v1=abc";
-
-// ── Tests ────────────────────────────────────────────────────────────────────
-
-describe("POST /api/webhooks/stripe — idempotency", () => {
-  let server: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    __resetIdempotencyStore();
-    mockConfig.STRIPE_WEBHOOK_SECRET = "whsec_test_secret";
-    server = await buildTestServer();
-  });
-
-  afterEach(async () => {
-    await server.close();
-  });
-
-  it("processes a first-time event normally (200 + track called)", async () => {
-    const event = buildFakeEvent("evt_first_time_aaaa");
-    mockVerifyWebhookSignature.mockReturnValue(event);
-
-    const response = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    expect(response.statusCode).toBe(200);
-    expect(JSON.parse(response.body)).toEqual({ received: true });
-    expect(mockTrack).toHaveBeenCalledTimes(1);
-  });
-
-  it("returns 200 on replay of same event.id without re-firing telemetry", async () => {
-    const event = buildFakeEvent("evt_replay_same_id_bbbb");
-    mockVerifyWebhookSignature.mockReturnValue(event);
-
-    // First delivery — processed normally
-    const first = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    expect(first.statusCode).toBe(200);
-    expect(mockTrack).toHaveBeenCalledTimes(1);
-
-    // Second delivery — same event.id, should be treated as duplicate
-    const second = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    expect(second.statusCode).toBe(200);
-    expect(JSON.parse(second.body)).toEqual({ received: true });
-    // Telemetry must NOT have fired again
-    expect(mockTrack).toHaveBeenCalledTimes(1);
-  });
-
-  it("processes distinct event.ids independently", async () => {
-    const eventA = buildFakeEvent("evt_distinct_aaaa");
-    const eventB = buildFakeEvent("evt_distinct_bbbb");
-
-    mockVerifyWebhookSignature.mockReturnValueOnce(eventA);
-    await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    mockVerifyWebhookSignature.mockReturnValueOnce(eventB);
-    await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    expect(mockTrack).toHaveBeenCalledTimes(2);
-  });
-
-  it("logs duplicate detection at info level on replay", async () => {
-    const event = buildFakeEvent("evt_logs_duplicate_cccc");
-    mockVerifyWebhookSignature.mockReturnValue(event);
-
-    const logLines: Array<Record<string, unknown>> = [];
-    const logCapture = Fastify({
-      logger: {
-        level: "info",
-        stream: {
-          write(msg: string) {
-            logLines.push(JSON.parse(msg) as Record<string, unknown>);
-          },
-        },
-      },
-    });
-
-    await logCapture.register(async (scope) => {
-      scope.addContentTypeParser(
-        "application/json",
-        { parseAs: "buffer" },
-        (_req, body, done) => {
-          done(null, body);
-        },
-      );
-      scope.post("/v1/webhooks/stripe", stripeWebhookHandler);
-    });
-    await logCapture.ready();
-
-    try {
-      // First delivery
-      await logCapture.inject({
-        method: "POST",
-        url: "/v1/webhooks/stripe",
-        payload: VALID_BODY,
-        headers: {
-          "content-type": "application/json",
-          "stripe-signature": VALID_SIGNATURE,
-        },
-      });
-      // Replay
-      logLines.length = 0;
-      await logCapture.inject({
-        method: "POST",
-        url: "/v1/webhooks/stripe",
-        payload: VALID_BODY,
-        headers: {
-          "content-type": "application/json",
-          "stripe-signature": VALID_SIGNATURE,
-        },
-      });
-
-      const matched = logLines.some((line) => {
-        const msg = String(line["msg"] ?? "");
-        return msg.includes("duplicate") || msg.includes("idempotent");
-      });
-      expect(matched).toBe(true);
-    } finally {
-      await logCapture.close();
-    }
-  });
-});