create-ailk 0.21.0 → 0.23.0

package/templates/apps/api/src/routes/content/__tests__/pricing.test.ts

@@ -0,0 +1,753 @@
+/**
+ * @file pricing.test.ts
+ * GET /v1/content/pricing — the HTTP twin of the `get_pricing` MCP tool
+ * (#7178).
+ *
+ * Uses the real content adapter backed by a per-test temp dir (Issue #507).
+ * The resolver is spied on only for the 404 and 500 arms.
+ *
+ * The `Product` fixtures are written here rather than through
+ * `writeFixturePage`, whose frontmatter parameter is `Record<string, string>`
+ * and so can express neither a nested `schema` nor a numeric `price`.
+ */
+
+import * as fs from "fs/promises";
+import * as path from "path";
+import { Writable } from "node:stream";
+
+import cors from "@fastify/cors";
+import {
+  currentShownSet,
+  getPricingTiers,
+  pricingTiersFromShownSet,
+  type ContentAdapter,
+} from "@working-theory/content-adapters";
+import { logger } from "@working-theory/observability";
+import {
+  shownOfferingsAnswerSchema,
+  type ShownOfferingsAnswer,
+} from "@working-theory/validation";
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+import { setupContentFixture } from "../../../__tests__/factories/content-fixture";
+import { getContentAdapter } from "../../../lib/content-adapter";
+import * as publicSiteResolver from "../../../services/public-site-resolver.js";
+import { contentRoutes } from "../index";
+import * as commerceClaim from "../../../lib/require-commerce-claim.js";
+import { prisma } from "../../../lib/prisma.js";
+import * as offeringsServices from "../../../services/offerings/index.js";
+import {
+  FIXTURE_NOW,
+  FIXTURE_ORG,
+  FIXTURE_ORG_2_WS,
+  FIXTURE_WS,
+  FIXTURE_WS_2,
+  OFFERINGS_FIXTURE_CATALOG,
+  seedOfferings,
+} from "../../../services/offerings/__tests__/fixtures.js";
+import { offeringsRoute } from "../offerings";
+import { pricingRoute } from "../pricing";
+import * as shownOfferings from "../shown-offerings";
+import type { ShownOfferingsRouteOptions } from "../shown-offerings";
+
+// #8933 — the Offerings services read and write the in-memory double, so a
+// seeded connected workspace answers its shown set. The content cases above
+// never resolve a workspace (no spoke key, the MDX adapter), so they never
+// reach it.
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); the in-memory double is the repo-standard where-honouring test double for it.
+jest.mock("../../../lib/prisma.js", () =>
+  jest
+    .requireActual<
+      typeof import("../../../__tests__/factories/in-memory-prisma")
+    >("../../../__tests__/factories/in-memory-prisma")
+    .createInMemoryPrisma(),
+);
+
+/** While set, the shown-set mapping throws (AC-3) — a plain switch, not a mock. */
+const mockMappingThrows = { on: false };
+
+// The real package, with the shown-set mapping behind a switch a case can
+// throw through. Not a stand-in: every other export is the real one.
+jest.mock("@working-theory/content-adapters", () => {
+  const actual = jest.requireActual<
+    typeof import("@working-theory/content-adapters")
+  >("@working-theory/content-adapters");
+  return {
+    __esModule: true,
+    ...actual,
+    pricingTiersFromShownSet: (
+      ...args: Parameters<typeof actual.pricingTiersFromShownSet>
+    ) => {
+      if (mockMappingThrows.on) {
+        throw new Error("mapping refused Growth: For a growing practice.");
+      }
+      return actual.pricingTiersFromShownSet(...args);
+    },
+  };
+});
+
+const fixture = setupContentFixture();
+
+/** Writes a `Product` MDX page into the default-locale path. */
+async function writeProduct(
+  slug: string,
+  lines: readonly string[],
+): Promise<void> {
+  const dir = path.join(fixture.getContentRoot(), "en", "Product");
+  await fs.mkdir(dir, { recursive: true });
+  const frontmatter = [`type: "Product"`, `slug: "${slug}"`, ...lines].join(
+    "\n",
+  );
+  await fs.writeFile(
+    path.join(dir, `${slug}.mdx`),
+    `---\n${frontmatter}\n---\n\nBody copy.\n`,
+    "utf8",
+  );
+}
+
+async function seedPricing(): Promise<void> {
+  await writeProduct("pricing", [
+    `title: "Pricing"`,
+    `description: "Every plan."`,
+    "schema:",
+    "  offers:",
+    "    - name: Starter",
+    "      price: 49",
+    "      priceCurrency: USD",
+    "      description: One site.",
+    "    - name: Pro",
+    "      price: 149",
+    "      priceCurrency: USD",
+    "      description: Every module.",
+  ]);
+  await writeProduct("priced", [
+    `title: "Standard"`,
+    `description: "The flagship marketing template."`,
+    `summary: "A marketing site with docs, scheduling and flows."`,
+    "price: 249",
+    "priceCurrency: USD",
+  ]);
+  await writeProduct("free", [
+    `title: "Standard (Free)"`,
+    `description: "The free marketing template."`,
+  ]);
+}
+
+type Tier = { name: string; price: string | number };
+
+function tiersOf(body: string): Tier[] {
+  return (JSON.parse(body) as { data: { tiers: Tier[] } }).data.tiers;
+}
+
+describe("GET /v1/content/pricing", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    app = require("fastify")();
+    await app.register(contentRoutes);
+  });
+
+  afterEach(async () => {
+    jest.restoreAllMocks();
+    await app.close();
+  });
+
+  it("answers 200 with the default page's tiers in the API envelope", async () => {
+    await seedPricing();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/pricing",
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(JSON.parse(res.body).ok).toBe(true);
+    expect(tiersOf(res.body).map((t) => t.name)).toEqual(["Starter", "Pro"]);
+  });
+
+  it("answers the page's own price as one tier for ?slug=priced", async () => {
+    await seedPricing();
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/pricing?slug=priced",
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(tiersOf(res.body)).toEqual([
+      expect.objectContaining({ name: "Standard", price: 249 }),
+    ]);
+  });
+
+  it.each(["free", "no-such-page"])(
+    "answers 200 with data null for ?slug=%s — no pricing is not a 404",
+    async (slug) => {
+      await seedPricing();
+
+      const res = await app.inject({
+        method: "GET",
+        url: `/v1/content/pricing?slug=${slug}`,
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(JSON.parse(res.body)).toEqual({ ok: true, data: null });
+    },
+  );
+
+  it.each(["Pricing", "_drafts", "..%2Fhome"])(
+    "refuses ?slug=%s as the tool refuses it, echoing no issues",
+    async (slug) => {
+      const res = await app.inject({
+        method: "GET",
+        url: `/v1/content/pricing?slug=${slug}`,
+      });
+
+      expect(res.statusCode).toBe(400);
+      const body = JSON.parse(res.body);
+      expect(body.ok).toBe(false);
+      expect(body.error.code).toBe("validation_failed");
+      expect(body).not.toHaveProperty("details");
+      expect(body).not.toHaveProperty("issues");
+      expect(body.error).not.toHaveProperty("details");
+      expect(body.error).not.toHaveProperty("issues");
+    },
+  );
+
+  it("refuses a malformed locale, and falls back for an unknown well-formed one", async () => {
+    await seedPricing();
+
+    const malformed = await app.inject({
+      method: "GET",
+      url: "/v1/content/pricing?locale=english",
+    });
+    expect(malformed.statusCode).toBe(400);
+    expect(JSON.parse(malformed.body).error.code).toBe("validation_failed");
+
+    const unknown = await app.inject({
+      method: "GET",
+      url: "/v1/content/pricing?locale=zz",
+    });
+    expect(unknown.statusCode).toBe(200);
+    expect(tiersOf(unknown.body).map((t) => t.name)).toEqual([
+      "Starter",
+      "Pro",
+    ]);
+  });
+
+  it("leaves /v1/content/Pricing to the type list", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/Pricing",
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(JSON.parse(res.body)["@type"]).toBe("ItemList");
+  });
+
+  it("answers 404 not_found when no public site resolves", async () => {
+    jest
+      .spyOn(publicSiteResolver, "resolvePublicContentAdapter")
+      .mockResolvedValue(null);
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/pricing",
+    });
+
+    expect(res.statusCode).toBe(404);
+    const body = JSON.parse(res.body);
+    expect(body.ok).toBe(false);
+    expect(body.error.code).toBe("not_found");
+    // The 404 depends on the spoke key too, so a URL-keyed cache must not
+    // serve one bad key's 404 to another site.
+    expect(String(res.headers["vary"]).toLowerCase()).toContain(
+      "x-ailk-spoke-key",
+    );
+  });
+
+  it("answers 500 internal_error and leaks nothing when the read throws", async () => {
+    const failing: Pick<
+      ContentAdapter,
+      "extractStructuredData" | "getPageBySlug"
+    > = {
+      extractStructuredData: (async () => {
+        throw new Error("secret-path");
+      }) as ContentAdapter["extractStructuredData"],
+      getPageBySlug: async () => null,
+    };
+    jest
+      .spyOn(publicSiteResolver, "resolvePublicContentAdapter")
+      .mockResolvedValue(failing as ContentAdapter);
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/pricing",
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(JSON.parse(res.body).error.code).toBe("internal_error");
+    expect(res.body).not.toContain("secret-path");
+    expect(res.body).not.toContain("stack");
+  });
+
+  /**
+   * D5 — API ↔ MCP parity evidence for #7178.
+   *
+   * The route must return EXACTLY what `getPricingTiers` returns for the
+   * options the `get_pricing` tool builds from the same arguments.
+   * `apps/api` cannot import `apps/mcp`, so the shared seam is asserted:
+   * `apps/mcp/__tests__/get_pricing.test.ts` pins the other half — tool
+   * answer ≡ `getPricingTiers` — and the two compose into the 1:1 claim.
+   */
+  describe("parity with the seam the MCP tool calls (#7178 D5)", () => {
+    it.each([
+      ["", undefined],
+      ["?slug=priced&locale=en", "priced"],
+      ["?slug=free&locale=en", "free"],
+    ])("deep-equals getPricingTiers for %j", async (search, slug) => {
+      await seedPricing();
+
+      const res = await app.inject({
+        method: "GET",
+        url: `/v1/content/pricing${search}`,
+      });
+      expect(res.statusCode).toBe(200);
+
+      const expected = await getPricingTiers(getContentAdapter(), {
+        slug,
+        locale: "en",
+      });
+      expect(JSON.parse(res.body).data).toEqual(
+        JSON.parse(JSON.stringify(expected)),
+      );
+    });
+  });
+});
+
+describe("GET /v1/content/pricing — Vary beside CORS", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    app = require("fastify")();
+    // Registered as `server.ts` registers it, so CORS's `Vary: Origin` is
+    // written before the route adds its own value.
+    await app.register(cors, {
+      origin: ["https://a.example"],
+      credentials: true,
+    });
+    await app.register(contentRoutes);
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("appends x-ailk-spoke-key to Vary and keeps Origin", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/pricing",
+      headers: { origin: "https://a.example" },
+    });
+
+    expect(res.statusCode).toBe(200);
+    const vary = String(res.headers["vary"])
+      .split(",")
+      .map((v) => v.trim().toLowerCase());
+    expect(vary).toEqual(
+      expect.arrayContaining(["origin", "x-ailk-spoke-key"]),
+    );
+    expect(res.headers["access-control-allow-origin"]).toBe(
+      "https://a.example",
+    );
+  });
+});
+
+/**
+ * #8933 (spec docs/specs/8933-get-pricing-and-get-offerings-spec.md) — on a
+ * connected workspace the `pricing` page answers the workspace's Offerings
+ * shown set, read through #8924's `readShownOfferings` over #8876's real
+ * services, the in-memory database and the seed at `FIXTURE_NOW`. The
+ * resolver's workspace read and the commerce claim are spied; the content
+ * adapter is the real fixture one, so every fallback is compared with
+ * today's `getPricingTiers` answer over it.
+ */
+describe("GET /v1/content/pricing — the Offerings shown set (#8933)", () => {
+  type Row = Record<string, unknown>;
+  // The in-memory double exposes its store, which the PrismaClient type the
+  // import carries does not name, so it is named here once.
+  // eslint-disable-next-line no-restricted-syntax -- justified above
+  const db = prisma as unknown as { __db: Record<string, Row[]> };
+
+  const SECOND = 1000;
+  const HOUR = 60 * 60 * SECOND;
+  const at = (offsetMs: number) => new Date(FIXTURE_NOW.getTime() + offsetMs);
+
+  /** The seed's shown set as an agent reads it (AC-1). */
+  const EXPECTED_TIERS = [
+    {
+      name: "Basic",
+      price: 99,
+      priceCurrency: "USD",
+      description: "One site, set up once.",
+      interval: null,
+      lookupKey: "basic_once",
+    },
+    {
+      name: "Growth",
+      price: 49,
+      priceCurrency: "USD",
+      description: "For a growing practice.\nEverything in Basic.",
+      interval: "month",
+      lookupKey: "growth_monthly",
+    },
+    {
+      name: "Growth",
+      price: 490,
+      priceCurrency: "USD",
+      description: "For a growing practice.\nEverything in Basic.",
+      interval: "year",
+      lookupKey: "growth_yearly",
+    },
+    {
+      name: "SEO audit",
+      price: 15,
+      priceCurrency: "USD",
+      interval: "month",
+      lookupKey: "seo-audit_monthly",
+    },
+  ];
+
+  /** Every product name, description, feature string, lookup key and id in the catalog. */
+  const FIXTURE_TEXT: string[] = [
+    ...OFFERINGS_FIXTURE_CATALOG.products.flatMap((product) => [
+      product.name,
+      ...(product.description ? [product.description] : []),
+      ...(product.marketing_features ?? []).map((feature) => feature.name),
+      product.id,
+    ]),
+    ...OFFERINGS_FIXTURE_CATALOG.prices.flatMap((price) => [
+      price.id,
+      ...(price.lookup_key ? [price.lookup_key] : []),
+    ]),
+    "prod_",
+    "price_",
+  ];
+
+  let logLines: string[] = [];
+  let loggerCalls: unknown[][] = [];
+  let apps: FastifyInstance[] = [];
+  let resolveWorkspace: jest.SpyInstance;
+  let resolveClaim: jest.SpyInstance;
+
+  /** A Fastify with a log stream and the three routes that read the shown set. */
+  async function buildApp(
+    options: ShownOfferingsRouteOptions = {},
+  ): Promise<FastifyInstance> {
+    const stream = new Writable({
+      write(chunk: Buffer, _encoding, callback) {
+        logLines.push(chunk.toString());
+        callback();
+      },
+    });
+    const app = Fastify({ logger: { level: "trace", stream } });
+    await app.register(pricingRoute, options);
+    await app.register(offeringsRoute, options);
+    await app.register(shownOfferings.shownOfferingsRoute, options);
+    apps.push(app);
+    return app;
+  }
+
+  async function get(app: FastifyInstance, url = "/v1/content/pricing") {
+    const response = await app.inject({ method: "GET", url });
+    return { response, body: JSON.parse(response.body) as Row };
+  }
+
+  function resolvedTo(workspaceId: string): void {
+    resolveWorkspace.mockResolvedValue({ kind: "resolved", workspaceId });
+  }
+
+  /** Today's content answer for the default page — what every fallback must equal. */
+  async function contentAnswer(slug?: string) {
+    return JSON.parse(
+      JSON.stringify(
+        await getPricingTiers(getContentAdapter(), { slug, locale: "en" }),
+      ),
+    ) as unknown;
+  }
+
+  /** The request log's lines whose `outcome` is `outcome`. */
+  function linesWithOutcome(outcome: string): Row[] {
+    return logLines
+      .map((line) => JSON.parse(line) as Row)
+      .filter((line) => line.outcome === outcome);
+  }
+
+  function capturedLogText(): string {
+    return [
+      ...logLines,
+      ...loggerCalls.map((call) => JSON.stringify(call)),
+    ].join("\n");
+  }
+
+  /** A `sourceFor` that answers the fixture catalog and counts each source call. */
+  function countingSourceFor(
+    answer: () => Promise<typeof OFFERINGS_FIXTURE_CATALOG> = async () =>
+      structuredClone(OFFERINGS_FIXTURE_CATALOG),
+  ) {
+    const calls: string[] = [];
+    const sourceFor: offeringsServices.OfferingsSourceFor = (
+      organizationId,
+    ) => ({
+      listActiveCatalog: () => {
+        calls.push(organizationId);
+        return answer();
+      },
+    });
+    return { sourceFor, calls };
+  }
+
+  /** Waits, a macrotask at a time, until `done()` holds (at most a second). */
+  async function until(done: () => boolean): Promise<void> {
+    for (let i = 0; i < 200 && !done(); i += 1) {
+      await new Promise((resolve) => setTimeout(resolve, 5));
+    }
+  }
+
+  beforeEach(async () => {
+    for (const key of Object.keys(db.__db)) delete db.__db[key];
+    offeringsServices.resetOfferingsRefreshStateForTests();
+    await seedOfferings(prisma, { now: FIXTURE_NOW });
+    await seedPricing();
+    logLines = [];
+    loggerCalls = [];
+    mockMappingThrows.on = false;
+    for (const level of ["error", "warn", "info", "debug"] as const) {
+      jest.spyOn(logger, level).mockImplementation(((...args: unknown[]) => {
+        loggerCalls.push([level, ...args]);
+      }) as never);
+    }
+    resolveWorkspace = jest.spyOn(publicSiteResolver, "resolvePublicWorkspace");
+    resolvedTo(FIXTURE_WS);
+    resolveClaim = jest
+      .spyOn(commerceClaim, "resolveCommerceClaim")
+      .mockResolvedValue("claimed");
+  });
+
+  afterEach(async () => {
+    // AC-5 (T6): across every case, no log line carries Stripe text.
+    const text = capturedLogText();
+    for (const fragment of FIXTURE_TEXT) expect(text).not.toContain(fragment);
+    mockMappingThrows.on = false;
+    await Promise.all(apps.map((app) => app.close()));
+    apps = [];
+    jest.restoreAllMocks();
+  });
+
+  describe("a connected workspace answers its shown set (AC-1)", () => {
+    it.each(["/v1/content/pricing", "/v1/content/pricing?slug=pricing&locale=en"])(
+      "%s answers the shown set's tiers in the API envelope",
+      async (url) => {
+        const app = await buildApp({ now: () => FIXTURE_NOW });
+        const { response, body } = await get(app, url);
+        expect(response.statusCode).toBe(200);
+        expect(body).toEqual({ ok: true, data: { tiers: EXPECTED_TIERS } });
+        expect((body.data as { tiers: Row[] }).tiers[3]).not.toHaveProperty(
+          "description",
+        );
+      },
+    );
+
+    it("deep-equals pricingTiersFromShownSet over the shared read's answer", async () => {
+      const app = await buildApp({ now: () => FIXTURE_NOW });
+      const read = await get(app, "/v1/content/shown-offerings");
+      const answer: ShownOfferingsAnswer = shownOfferingsAnswerSchema.parse(
+        read.body.data,
+      );
+      const shownSet = currentShownSet(answer);
+      expect(shownSet).not.toBeNull();
+
+      const { body } = await get(app);
+      expect(body.data).toEqual(
+        JSON.parse(JSON.stringify(pricingTiersFromShownSet(shownSet!))),
+      );
+    });
+
+    it("reads the snapshot through readShownOfferings, with the route's options", async () => {
+      const read = jest.spyOn(shownOfferings, "readShownOfferings");
+      const options = { now: () => FIXTURE_NOW };
+      const app = await buildApp(options);
+      await get(app);
+      expect(read).toHaveBeenCalledTimes(1);
+      expect(read.mock.calls[0]![1]).toBe(options);
+    });
+
+    it("answers another page's tiers from its content, reading no shown set", async () => {
+      const read = jest.spyOn(shownOfferings, "readShownOfferings");
+      const app = await buildApp({ now: () => FIXTURE_NOW });
+      const { response, body } = await get(app, "/v1/content/pricing?slug=priced");
+      expect(response.statusCode).toBe(200);
+      expect(body.data).toEqual(await contentAnswer("priced"));
+      expect(read).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("every other case answers page content exactly as before (AC-3)", () => {
+    it.each([
+      ["the Organization's second workspace (no selection)", FIXTURE_WS_2],
+      ["the second Organization's workspace (no connection)", FIXTURE_ORG_2_WS],
+    ])("%s", async (_name, workspaceId) => {
+      resolvedTo(workspaceId);
+      const app = await buildApp({ now: () => FIXTURE_NOW });
+      const { response, body } = await get(app);
+      expect(response.statusCode).toBe(200);
+      expect(body.data).toEqual(await contentAnswer());
+    });
+
+    it("an expired snapshot (25 hours old)", async () => {
+      const app = await buildApp({ now: () => at(25 * HOUR) });
+      const { response, body } = await get(app);
+      expect(response.statusCode).toBe(200);
+      expect(body.data).toEqual(await contentAnswer());
+    });
+
+    it.each(["unclaimed", "undetermined"] as const)(
+      "a %s licence",
+      async (claim) => {
+        resolveClaim.mockResolvedValue(claim);
+        const app = await buildApp({ now: () => FIXTURE_NOW });
+        const { response, body } = await get(app);
+        expect(response.statusCode).toBe(200);
+        expect(body.data).toEqual(await contentAnswer());
+      },
+    );
+
+    it("a site with no workspace to resolve (not-required)", async () => {
+      resolveWorkspace.mockRestore();
+      const read = jest.spyOn(shownOfferings, "readShownOfferings");
+      const app = await buildApp({ now: () => FIXTURE_NOW });
+      const { response, body } = await get(app);
+      expect(response.statusCode).toBe(200);
+      expect(body.data).toEqual(await contentAnswer());
+      // The content answer came from the read's own `unconnected` arm, not
+      // from a failure that would also have landed on page content.
+      await expect(read.mock.results[0]!.value).resolves.toEqual({
+        status: "unconnected",
+      });
+      expect(linesWithOutcome("shown_set_failed")).toEqual([]);
+    });
+
+    it("a shown-set read that rejects logs one fixed warn and answers content, never a 500", async () => {
+      jest
+        .spyOn(shownOfferings, "readShownOfferings")
+        .mockRejectedValue(new Error("read refused One site, set up once."));
+      const app = await buildApp({ now: () => FIXTURE_NOW });
+      const { response, body } = await get(app);
+      expect(response.statusCode).toBe(200);
+      expect(body.data).toEqual(await contentAnswer());
+      expect(linesWithOutcome("shown_set_failed")).toEqual([
+        expect.objectContaining({ level: 40, errName: "Error" }),
+      ]);
+      expect(capturedLogText()).not.toContain("read refused");
+    });
+
+    it("a mapping that throws answers content, never a 500", async () => {
+      mockMappingThrows.on = true;
+      const app = await buildApp({ now: () => FIXTURE_NOW });
+      const { response, body } = await get(app);
+      expect(response.statusCode).toBe(200);
+      expect(body.data).toEqual(await contentAnswer());
+      expect(linesWithOutcome("shown_set_failed")).toHaveLength(1);
+      expect(capturedLogText()).not.toContain("mapping refused");
+    });
+  });
+
+  describe("no request calls Stripe itself (AC-4, T7)", () => {
+    it("a snapshot 30 seconds old answers five sequential requests with no source call", async () => {
+      const refresh = jest.spyOn(offeringsServices, "refreshWorkspaceSnapshot");
+      const { sourceFor, calls } = countingSourceFor();
+      const app = await buildApp({ sourceFor, now: () => at(30 * SECOND) });
+      for (let i = 0; i < 5; i += 1) {
+        const { body } = await get(app);
+        expect((body.data as { tiers: Row[] }).tiers).toHaveLength(4);
+      }
+      expect(calls).toEqual([]);
+      expect(refresh).not.toHaveBeenCalled();
+    });
+
+    it("five concurrent stale requests across the three reads make one source call between them", async () => {
+      const refresh = jest.spyOn(offeringsServices, "refreshWorkspaceSnapshot");
+      let release!: () => void;
+      const held = new Promise<void>((resolve) => (release = resolve));
+      const { sourceFor, calls } = countingSourceFor(async () => {
+        await held;
+        return structuredClone(OFFERINGS_FIXTURE_CATALOG);
+      });
+      const app = await buildApp({ sourceFor, now: () => at(61 * SECOND) });
+
+      const pending = Promise.all(
+        [
+          "/v1/content/pricing",
+          "/v1/content/offerings",
+          "/v1/content/shown-offerings",
+          "/v1/content/pricing",
+          "/v1/content/offerings",
+        ].map((url) => get(app, url)),
+      );
+      await until(() => refresh.mock.calls.length === 5);
+      release();
+      const answers = await pending;
+
+      expect(calls).toEqual([FIXTURE_ORG]);
+      for (const { response } of answers) expect(response.statusCode).toBe(200);
+      expect(refresh).toHaveBeenCalledTimes(5);
+      for (const call of refresh.mock.calls) {
+        expect(call[2]).not.toHaveProperty("force");
+      }
+    });
+
+    it("registered with no options, a stale snapshot is served and never refreshed", async () => {
+      const refresh = jest.spyOn(offeringsServices, "refreshWorkspaceSnapshot");
+      const app = await buildApp({ now: () => at(61 * SECOND) });
+      const { body } = await get(app);
+      expect((body.data as { tiers: Row[] }).tiers).toHaveLength(4);
+      expect(refresh).not.toHaveBeenCalled();
+    });
+
+    it("a refresh that rejects with Stripe text logs none of it", async () => {
+      const keyBody = "x".repeat(24);
+      const { sourceFor } = countingSourceFor(async () => {
+        throw new Error(`Growth refused for rk_test_${keyBody}`);
+      });
+      const app = await buildApp({ sourceFor, now: () => at(61 * SECOND) });
+      const { response } = await get(app);
+      expect(response.statusCode).toBe(200);
+      const text = capturedLogText();
+      expect(text).not.toContain("rk_test_");
+      expect(text).not.toContain(keyBody);
+    });
+
+    it("neither twin file holds a force token or a services/offerings import", () => {
+      for (const file of ["pricing.ts", "offerings.ts"]) {
+        const source = require("fs").readFileSync(
+          path.join(__dirname, "..", file),
+          "utf8",
+        ) as string;
+        expect(source).not.toMatch(/\bforce\b/);
+        expect(source).not.toContain("services/offerings");
+      }
+    });
+
+    it("no file under apps/mcp/src imports Stripe", () => {
+      const fsSync = require("fs") as typeof import("fs");
+      const root = path.join(__dirname, "..", "..", "..", "..", "..", "mcp", "src");
+      const files = (fsSync.readdirSync(root, { recursive: true }) as string[])
+        .filter((file) => file.endsWith(".ts"));
+      expect(files.length).toBeGreaterThan(0);
+      for (const file of files) {
+        const source = fsSync.readFileSync(path.join(root, file), "utf8");
+        expect(source).not.toMatch(/from ["'](stripe|@working-theory\/stripe-client)["']/);
+      }
+    });
+  });
+});