create-ailk 0.2.0 → 0.4.0

package/templates/apps/api/src/routes/deliverables/index.ts

@@ -1,200 +0,0 @@
-/**
- * Deliverables route group (#3961 D5; extended FEAT-074 U4b, #4718 D4).
- *
- * Routes:
- *   GET /v1/deliverables/:grantId — stream the grant's asset bytes
- *
- * The capability-token download route — a lead-facing URL (an email-click
- * download), not an agent-facing business-data endpoint. No MCP twin (the
- * same no-twin class as the identity-bound `/v1/workspaces/*` and
- * `/v1/billing/*` routes — apps/api/CLAUDE.md § Endpoint conventions). No
- * siteId in the URL: the grant id alone resolves both the asset and its
- * site (a stable-id ref, ADR 0009 invariant 1 posture — never a
- * cross-namespace `@relation`).
- *
- * A `grant.assetId` prefixed `playbook:` (FEAT-074 U4b, #4718 D4) is the
- * VIRTUAL asset a `deliverable-fulfillment.ts` playbook grant mints — it
- * skips the `DeliverableAsset` lookup entirely, loads the lead's NEWEST
- * `PlaybookInstance` for `(grant.siteId, grant.leadId, experimentKey)`, and
- * renders it to a PDF on request (`renderPlaybookPdf`, D1 — never a stored
- * blob). Every other `assetId` follows the unchanged operator-uploaded path
- * below.
- *
- * Every miss — unknown id, malformed id, grant-without-asset, a `playbook:`
- * grant with no matching `PlaybookInstance` — is a UNIFORM 404
- * (`{ ok:false, error:{ code:'not_found' } }`): no route distinguishes
- * "wrong token" from "no such asset," so nothing here is an enumeration
- * oracle. Repeated downloads on one grant are allowed — a lead re-opening
- * their email is the normal case, so the grant is never consumed on read.
- *
- * A render failure (`PlaybookRenderError` — the vendored library no longer
- * declares a play the stored instance names, D1's "library defect, not a
- * render branch" posture) is deliberately NOT folded into the uniform-404
- * contract above — it is a genuine internal error, not a token/asset miss.
- * Caught, logged with `{grantId, experimentKey}` (never PII) so an on-call
- * engineer can diagnose a library-drift incident from logs alone, and
- * reported as a `500` (mirrors `waitlist-experiments/respond.ts`'s
- * contract-drift posture).
- */
-import { logger } from "@working-theory/observability";
-import type { FastifyPluginAsync } from "fastify";
-
-import { resolveLocale } from "../../lib/locales.js";
-import { prisma } from "../../lib/prisma.js";
-import type { PlaybookSource } from "../../services/playbook-compile.js";
-import { PlaybookRenderError, renderPlaybookPdf } from "../../services/playbook-render.js";
-
-type DeliverableGrantRow = {
-  id: string;
-  siteId: string;
-  assetId: string;
-  leadId: string;
-};
-
-type DeliverableAssetRow = {
-  id: string;
-  siteId: string;
-  filename: string;
-  contentType: string;
-  bytes: Buffer;
-};
-
-type PlaybookInstanceRow = {
-  level: number;
-  source: unknown;
-  markdown: string;
-};
-
-const PLAYBOOK_ASSET_PREFIX = "playbook:";
-
-const NOT_FOUND = {
-  ok: false as const,
-  error: { code: "not_found", message: "Not found." },
-};
-
-const DELIVERABLES_NOT_CONFIGURED = {
-  ok: false as const,
-  error: {
-    code: "deliverables_not_configured",
-    message: "Deliverables are not configured.",
-  },
-};
-
-const RENDER_FAILED = {
-  ok: false as const,
-  error: { code: "render_failed", message: "Failed to render the document." },
-};
-
-/**
- * Strip CR/LF (header injection — the same class of guard
- * @working-theory/email's `hasCRLF` applies to header-bound strings) and
- * collapse anything outside a safe charset to `_`. `filename` is
- * operator-authored (the `deliverable:upload` CLI's `--filename`, or the
- * uploaded file's own basename) — it MUST NOT reach the
- * `Content-Disposition` header un-sanitized.
- */
-function sanitizeFilename(filename: string): string {
-  const stripped = filename.replace(/[\r\n]/g, "");
-  const safe = stripped.replace(/[^a-zA-Z0-9._\- ]/g, "_");
-  return safe.length > 0 ? safe : "download";
-}
-
-/**
- * `playbook-level-<N>.pdf`, `playbook-gate.pdf` for Level 0 (spec §2.1's
- * never-say-Level-0 rule — a download filename is customer-visible; mirrors
- * `renderPlaybookPdf`'s own Gate-vs-Level chrome-label split). Passed
- * through `sanitizeFilename` like every other filename this route serves.
- */
-function playbookFilename(level: number): string {
-  return level === 0 ? "playbook-gate.pdf" : `playbook-level-${level}.pdf`;
-}
-
-export const deliverableDownloadRoute: FastifyPluginAsync = async (fastify) => {
-  fastify.get<{ Params: { grantId: string }; Querystring: { locale?: string } }>(
-    "/v1/deliverables/:grantId",
-    async (request, reply) => {
-      if (!process.env.DATABASE_URL) {
-        // Constant across every grantId (not attacker-distinguishing) —
-        // this guard sits OUTSIDE the uniform-404 contract, which covers
-        // only per-token misses.
-        return reply.status(503).send(DELIVERABLES_NOT_CONFIGURED);
-      }
-
-      const { grantId } = request.params;
-
-      const grant = (await prisma.deliverableGrant.findUnique({
-        where: { id: grantId },
-      })) as DeliverableGrantRow | null;
-
-      if (!grant) {
-        return reply.status(404).send(NOT_FOUND);
-      }
-
-      // FEAT-074 U4b (#4718) D4 — the `playbook:` virtual asset: skip the
-      // DeliverableAsset lookup entirely, resolve the lead's NEWEST
-      // PlaybookInstance for (siteId, leadId, experimentKey), and render it
-      // on request. Tenancy: scoped by grant.siteId + grant.leadId ALONE —
-      // never a request-supplied id (spec §2.2 Tenancy).
-      if (grant.assetId.startsWith(PLAYBOOK_ASSET_PREFIX)) {
-        const experimentKey = grant.assetId.slice(PLAYBOOK_ASSET_PREFIX.length);
-
-        const instance = (await prisma.playbookInstance.findFirst({
-          where: { siteId: grant.siteId, leadId: grant.leadId, experimentKey },
-          orderBy: { createdAt: "desc" },
-          select: { level: true, source: true, markdown: true },
-        })) as PlaybookInstanceRow | null;
-
-        if (!instance) {
-          return reply.status(404).send(NOT_FOUND);
-        }
-
-        const locale = resolveLocale(request.query.locale);
-
-        let bytes: Uint8Array;
-        try {
-          bytes = await renderPlaybookPdf({
-            source: instance.source as PlaybookSource,
-            markdown: instance.markdown,
-            locale,
-          });
-        } catch (err) {
-          if (!(err instanceof PlaybookRenderError)) throw err;
-          logger.error(
-            { grantId, experimentKey, err: err.message },
-            "[deliverables] playbook render failed — the vendored library no longer declares a play this instance names",
-          );
-          return reply.status(500).send(RENDER_FAILED);
-        }
-
-        const filename = sanitizeFilename(playbookFilename(instance.level));
-
-        return reply
-          .header("Content-Type", "application/pdf")
-          .header("Content-Disposition", `attachment; filename="${filename}"`)
-          .header("X-Content-Type-Options", "nosniff")
-          .send(Buffer.from(bytes));
-      }
-
-      const asset = (await prisma.deliverableAsset.findUnique({
-        where: { id: grant.assetId },
-      })) as DeliverableAssetRow | null;
-
-      if (!asset || asset.siteId !== grant.siteId) {
-        return reply.status(404).send(NOT_FOUND);
-      }
-
-      const filename = sanitizeFilename(asset.filename);
-
-      return reply
-        .header("Content-Type", asset.contentType)
-        .header("Content-Disposition", `attachment; filename="${filename}"`)
-        // The operator-supplied contentType is echoed verbatim above; this
-        // origin also serves /v1/auth/* cookies, so nosniff stops a
-        // mis-typed or malicious contentType from being MIME-sniffed by
-        // the browser into an executable context (#4002, #3961
-        // security-review — Medium/Low, non-blocking on #3961's Pass).
-        .header("X-Content-Type-Options", "nosniff")
-        .send(asset.bytes);
-    },
-  );
-};

package/templates/apps/api/src/routes/flow-checkouts/__tests__/index.test.ts

@@ -1,443 +0,0 @@
-/**
- * @file index.test.ts
- *
- * THE ACCEPTANCE GATE for the respondent checkouts route (#4984).
- * Registration mirrors server.ts: REAL `authPreHandlerPlugin ->
- * flowCheckoutRoutes` (auth only, no tenant guard), mocked `lib/prisma.js`.
- * Proves: no session → the preHandler's own 401, untouched; an unverified
- * user → 403 `email_unverified` with NO Lead / FlowCheckout read; a verified
- * respondent → 200 with exactly their promoted leads' checkouts, newest
- * first, ten keys per row, parsing under the contract schema; a foreign
- * user's checkout and an UN-promoted lead carrying the caller's own email
- * never appear (the promotion link is the only join — email never matches);
- * an `email` query parameter is never read; every where clause carries the
- * current siteId.
- */
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-import { flowCheckoutMeResponseSchema } from "@working-theory/validation";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-    user: { findUnique: jest.fn() },
-    lead: { findMany: jest.fn() },
-    flowCheckout: { findMany: jest.fn() },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../../middleware/auth.js";
-import { flowCheckoutRoutes } from "../index.js";
-
-const FRONTEND = "https://app.example.com";
-const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
-const SITE = "wksp_00000000-0000-7000-8000-000000000001";
-const OTHER_SITE = "wksp_00000000-0000-7000-8000-000000000002";
-
-const USERS: Record<string, { id: string; email: string; emailVerified: boolean }> = {
-  alice: { id: "alice", email: "alice@example.com", emailVerified: true },
-  // Email+password account whose address was never verified.
-  mallory: { id: "mallory", email: "mallory@example.com", emailVerified: false },
-  bob: { id: "bob", email: "bob@example.com", emailVerified: true },
-  carol: { id: "carol", email: "carol@example.com", emailVerified: true },
-};
-
-const SESSION_ROWS: Record<string, Record<string, unknown>> = {
-  cookie_alice: { id: "sess_alice", userId: "alice", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
-  cookie_mallory: { id: "sess_mallory", userId: "mallory", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
-  cookie_bob: { id: "sess_bob", userId: "bob", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
-};
-
-type LeadRow = { id: string; siteId: string; email: string; promotedUserId: string | null };
-
-/**
- * alice's lead is promoted to her; carol's lead is promoted to carol; bob's
- * lead carries HIS email but was never promoted — so bob owns nothing at
- * read time, whatever his address says.
- */
-const LEADS: LeadRow[] = [
-  { id: "lead_a1", siteId: SITE, email: "alice@example.com", promotedUserId: "alice" },
-  { id: "lead_c1", siteId: SITE, email: "carol@example.com", promotedUserId: "carol" },
-  { id: "lead_b1", siteId: SITE, email: "bob@example.com", promotedUserId: null },
-  // alice again, at ANOTHER site — must never be read under SITE.
-  { id: "lead_a2", siteId: OTHER_SITE, email: "alice@example.com", promotedUserId: "alice" },
-];
-
-const CHECKOUTS = [
-  {
-    id: "flchk_alice_created",
-    siteId: SITE,
-    leadId: "lead_a1",
-    sessionId: "flsess_a1",
-    flowSlug: "ailk-reco",
-    experimentKey: "ailk-reco",
-    offerKey: "pro",
-    seats: 1,
-    period: "monthly",
-    creditStop: {},
-    amountMinor: 4900,
-    currency: "usd",
-    quote: { total: 4900 },
-    permalink: "/r/abc",
-    stripeSessionId: null,
-    status: "created",
-    completedAt: null,
-    createdAt: new Date("2026-09-05T00:00:00.000Z"),
-  },
-  {
-    id: "flchk_alice_completed",
-    siteId: SITE,
-    leadId: "lead_a1",
-    sessionId: "flsess_a1",
-    flowSlug: "ailk-reco",
-    experimentKey: "ailk-reco",
-    offerKey: "pro_plus",
-    seats: 2,
-    period: "annual",
-    creditStop: {},
-    amountMinor: 99000,
-    currency: "usd",
-    quote: { total: 99000 },
-    permalink: "/r/def",
-    stripeSessionId: "cs_test_alice",
-    status: "completed",
-    completedAt: new Date("2026-09-03T00:00:05.000Z"),
-    createdAt: new Date("2026-09-03T00:00:00.000Z"),
-  },
-  {
-    id: "flchk_foreign",
-    siteId: SITE,
-    leadId: "lead_c1",
-    sessionId: "flsess_c1",
-    flowSlug: "ailk-reco",
-    experimentKey: "ailk-reco",
-    offerKey: "pro",
-    seats: 1,
-    period: "monthly",
-    creditStop: {},
-    amountMinor: 4900,
-    currency: "usd",
-    quote: { total: 4900 },
-    permalink: "/r/ghi",
-    stripeSessionId: "cs_test_carol",
-    status: "completed",
-    completedAt: new Date("2026-09-04T00:00:05.000Z"),
-    createdAt: new Date("2026-09-04T00:00:00.000Z"),
-  },
-  {
-    id: "flchk_unpromoted",
-    siteId: SITE,
-    leadId: "lead_b1",
-    sessionId: "flsess_b1",
-    flowSlug: "ailk-reco",
-    experimentKey: "ailk-reco",
-    offerKey: "starter",
-    seats: 1,
-    period: "monthly",
-    creditStop: {},
-    amountMinor: 1900,
-    currency: "usd",
-    quote: { total: 1900 },
-    permalink: "/r/jkl",
-    stripeSessionId: "cs_test_bob",
-    status: "completed",
-    completedAt: new Date("2026-09-04T00:00:05.000Z"),
-    createdAt: new Date("2026-09-04T00:00:00.000Z"),
-  },
-  {
-    id: "flchk_other_site",
-    siteId: OTHER_SITE,
-    leadId: "lead_a2",
-    sessionId: "flsess_a2",
-    flowSlug: "ailk-reco",
-    experimentKey: "ailk-reco",
-    offerKey: "pro",
-    seats: 1,
-    period: "monthly",
-    creditStop: {},
-    amountMinor: 4900,
-    currency: "usd",
-    quote: { total: 4900 },
-    permalink: "/r/mno",
-    stripeSessionId: "cs_test_other",
-    status: "completed",
-    completedAt: new Date("2026-09-06T00:00:05.000Z"),
-    createdAt: new Date("2026-09-06T00:00:00.000Z"),
-  },
-];
-
-type LeadWhere = { siteId: string; promotedUserId?: string; email?: unknown };
-type CheckoutWhere = { siteId: string; leadId: { in: string[] } };
-
-function installFixtureMocks(): void {
-  (prisma.session.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { token?: string } }) =>
-      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
-  );
-  (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue(null);
-  (prisma.user.findUnique as jest.Mock).mockImplementation(({ where }: { where: { id: string } }) =>
-    Promise.resolve(USERS[where.id] ?? null),
-  );
-  // The promotion link is the ONLY join the SERVICE may use: a where clause
-  // carrying `email` is a contract violation and returns nothing.
-  (prisma.lead.findMany as jest.Mock).mockImplementation(({ where }: { where: LeadWhere }) => {
-    expect(where).not.toHaveProperty("email");
-    if ("email" in where) return Promise.resolve([]);
-    return Promise.resolve(
-      LEADS.filter((lead) => lead.siteId === where.siteId && lead.promotedUserId === where.promotedUserId).map(
-        (lead) => ({ id: lead.id }),
-      ),
-    );
-  });
-  (prisma.flowCheckout.findMany as jest.Mock).mockImplementation(({ where }: { where: CheckoutWhere }) =>
-    Promise.resolve(
-      CHECKOUTS.filter((row) => row.siteId === where.siteId && where.leadId.in.includes(row.leadId)).sort(
-        (a, b) => b.createdAt.getTime() - a.createdAt.getTime(),
-      ),
-    ),
-  );
-}
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  await app.register(async (authScope) => {
-    await authScope.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
-    await authScope.register(flowCheckoutRoutes);
-  });
-  await app.ready();
-  return app;
-}
-
-const cookie = (token: string) => ({ cookie: `better-auth.session_token=${token}` });
-const URL_ME = "/v1/flow-checkouts/me";
-const CONTRACT_KEYS = [
-  "id",
-  "flowSlug",
-  "experimentKey",
-  "offerKey",
-  "status",
-  "amountMinor",
-  "currency",
-  "period",
-  "completedAt",
-  "createdAt",
-].sort();
-
-const leadWhere = (call = 0) => (prisma.lead.findMany as jest.Mock).mock.calls[call][0].where as LeadWhere;
-const checkoutWhere = (call = 0) =>
-  (prisma.flowCheckout.findMany as jest.Mock).mock.calls[call][0].where as CheckoutWhere;
-
-let app: FastifyInstance;
-
-beforeEach(async () => {
-  jest.clearAllMocks();
-  process.env.AILK_SITE_ID = SITE;
-  installFixtureMocks();
-  app = await buildApp();
-});
-
-afterEach(async () => {
-  await app.close();
-});
-
-afterAll(() => {
-  delete process.env.AILK_SITE_ID;
-});
-
-describe("GET /v1/flow-checkouts/me — auth", () => {
-  it("no session cookie and no bearer → the preHandler's existing 401, untouched; no User/Lead read", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME });
-
-    expect(res.statusCode).toBe(401);
-    expect(res.json()).toEqual({ error: "unauthorized" });
-    expect(prisma.user.findUnique).not.toHaveBeenCalled();
-    expect(prisma.lead.findMany).not.toHaveBeenCalled();
-    expect(prisma.flowCheckout.findMany).not.toHaveBeenCalled();
-  });
-
-  it("an expired / unknown cookie → 401", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_nobody") });
-
-    expect(res.statusCode).toBe(401);
-    expect(prisma.lead.findMany).not.toHaveBeenCalled();
-    expect(prisma.flowCheckout.findMany).not.toHaveBeenCalled();
-  });
-
-  it("unverified email → 403 email_unverified, BEFORE any Lead / FlowCheckout read", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_mallory") });
-
-    expect(res.statusCode).toBe(403);
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "email_unverified", message: expect.any(String) },
-    });
-    expect(prisma.lead.findMany).not.toHaveBeenCalled();
-    expect(prisma.flowCheckout.findMany).not.toHaveBeenCalled();
-  });
-});
-
-describe("GET /v1/flow-checkouts/me — the read", () => {
-  it("verified respondent → 200 with exactly her two rows, newest first, ten keys each, parsing under flowCheckoutMeResponseSchema", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_alice") });
-
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as { ok: true; data: Record<string, unknown>[] };
-    expect(body.ok).toBe(true);
-    expect(Array.isArray(body.data)).toBe(true);
-    expect(body.data).toHaveLength(2);
-    for (const row of body.data) expect(Object.keys(row).sort()).toEqual(CONTRACT_KEYS);
-    expect(flowCheckoutMeResponseSchema.parse(body.data)).toEqual([
-      {
-        id: "flchk_alice_created",
-        flowSlug: "ailk-reco",
-        experimentKey: "ailk-reco",
-        offerKey: "pro",
-        status: "created",
-        amountMinor: 4900,
-        currency: "usd",
-        period: "monthly",
-        completedAt: null,
-        createdAt: "2026-09-05T00:00:00.000Z",
-      },
-      {
-        id: "flchk_alice_completed",
-        flowSlug: "ailk-reco",
-        experimentKey: "ailk-reco",
-        offerKey: "pro_plus",
-        status: "completed",
-        amountMinor: 99000,
-        currency: "usd",
-        period: "annual",
-        completedAt: "2026-09-03T00:00:05.000Z",
-        createdAt: "2026-09-03T00:00:00.000Z",
-      },
-    ]);
-    // Nobody else's row, no un-promoted row, no other site's row, and no
-    // Stripe id / permalink / email leaves the process.
-    expect(res.body).not.toContain("flchk_foreign");
-    expect(res.body).not.toContain("flchk_unpromoted");
-    expect(res.body).not.toContain("flchk_other_site");
-    expect(res.body).not.toContain("cs_test");
-    expect(res.body).not.toContain("/r/");
-    expect(res.body).not.toContain("lead_");
-    expect(res.body).not.toContain("flsess_");
-    expect(res.body).not.toContain("@example.com");
-  });
-
-  it("verified user whose only lead carries his email but was never promoted → 200 [] (email never matches)", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_bob") });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({ ok: true, data: [] });
-    expect(leadWhere()).toEqual({ siteId: SITE, promotedUserId: "bob" });
-    // No lead → no FlowCheckout read at all.
-    expect(prisma.flowCheckout.findMany).not.toHaveBeenCalled();
-  });
-
-  it("an `email` query parameter is never read — the SESSION user's rows resolve, never the parameter's", async () => {
-    // bob is verified and owns nothing; naming alice's email must not read alice's rows.
-    const smuggled = await app.inject({
-      method: "GET",
-      url: `${URL_ME}?email=alice%40example.com`,
-      headers: cookie("cookie_bob"),
-    });
-    expect(smuggled.statusCode).toBe(200);
-    expect((smuggled.json() as { data: unknown[] }).data).toEqual([]);
-    expect(leadWhere().promotedUserId).toBe("bob");
-    expect(leadWhere()).not.toHaveProperty("email");
-
-    // …and alice naming someone else's email still gets HER OWN rows.
-    jest.clearAllMocks();
-    installFixtureMocks();
-    const own = await app.inject({
-      method: "GET",
-      url: `${URL_ME}?email=bob%40example.com`,
-      headers: cookie("cookie_alice"),
-    });
-    expect(own.statusCode).toBe(200);
-    const rows = (own.json() as { data: { id: string }[] }).data;
-    expect(rows.map((row) => row.id)).toEqual(["flchk_alice_created", "flchk_alice_completed"]);
-    expect(leadWhere().promotedUserId).toBe("alice");
-    expect(leadWhere()).not.toHaveProperty("email");
-  });
-
-  it("every where clause carries the current siteId (AILK_SITE_ID) — never a post-filter", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_alice") });
-
-    expect(res.statusCode).toBe(200);
-    expect(leadWhere().siteId).toBe(SITE);
-    expect(checkoutWhere().siteId).toBe(SITE);
-    // Only the leads promoted to alice AT THIS SITE feed the checkout read.
-    expect(checkoutWhere().leadId.in).toEqual(["lead_a1"]);
-  });
-
-  it("a bearer API token resolves the SAME userId path — alice's rows, the same promotion-link where clause, no email", async () => {
-    // The preHandler's second mode: cookie absent, Authorization: Bearer <token>.
-    // The token row's userId is the identity — the service's gates apply unchanged.
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_alice",
-      userId: "alice",
-      expiresAt: null,
-      revokedAt: null,
-    });
-    const res = await app.inject({
-      method: "GET",
-      url: URL_ME,
-      headers: { authorization: "Bearer alice-opaque-token" },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as { ok: true; data: Array<{ id: string }> };
-    expect(body.data.map((row) => row.id)).toEqual(["flchk_alice_created", "flchk_alice_completed"]);
-    expect(leadWhere()).toEqual({ siteId: SITE, promotedUserId: "alice" });
-  });
-
-  it("a bearer token for an unverified user → 403 email_unverified, same as the cookie path", async () => {
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_mallory",
-      userId: "mallory",
-      expiresAt: null,
-      revokedAt: null,
-    });
-    const res = await app.inject({
-      method: "GET",
-      url: URL_ME,
-      headers: { authorization: "Bearer mallory-opaque-token" },
-    });
-
-    expect(res.statusCode).toBe(403);
-    expect(prisma.lead.findMany).not.toHaveBeenCalled();
-  });
-
-  it("a row that drifts out of the contract (a 4-letter currency) → 500 internal_error, and no row content leaves the process", async () => {
-    (prisma.flowCheckout.findMany as jest.Mock).mockResolvedValue([
-      {
-        id: "flchk_drift",
-        flowSlug: "ailk-reco",
-        experimentKey: "ailk-reco",
-        offerKey: "pro",
-        status: "created",
-        amountMinor: 4900,
-        currency: "usdx",
-        period: "monthly",
-        completedAt: null,
-        createdAt: new Date("2026-09-05T00:00:00.000Z"),
-      },
-    ]);
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_alice") });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "internal_error", message: expect.any(String) },
-    });
-    expect(res.body).not.toContain("flchk_drift");
-    expect(res.body).not.toContain("usdx");
-  });
-});