create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-org-billing.test.ts

@@ -1,301 +0,0 @@
-/**
- * POST /api/webhooks/stripe — org-scoped billing path (#3601, spec AC2/AC4)
- *
- * Covers the Organization billing-link branch keyed on
- * metadata.organizationId (spec D2), proof-based since #9067 D13 (AC-7): a
- * checkout with organizationId links the Organization (real org AND
- * individual-as-default-org) only when the row recorded that session and has
- * no customer, idempotently; an unrecorded session, a bound customer and any
- * customer.created write nothing and log `org_bind_unproven`. A checkout
- * WITHOUT organizationId takes the User path and never touches the
- * Organization (single-tenant, degrade-clean regression floor).
- *
- * Companion to stripe.test.ts (the User-path tests, which stay unmodified —
- * AC4 regression floor).
- */
-import { Writable } from "node:stream";
-
-import type { FastifyInstance } from "fastify";
-import Fastify from "fastify";
-
-// ── Mocks (mirror stripe.test.ts) ────────────────────────────────────────────
-
-const mockTrack = jest.fn().mockResolvedValue(undefined);
-// Commerce claim (D-64, #5796): the receiver is a base-tree primitive gated on
-// the JWT `commerce` claim, so every case in this file is a COMMERCE-CLAIMED
-// deployment — which is what each one was already asserting before the gate
-// existed. The unclaimed matrix lives in
-// `src/__tests__/commerce-claim-registration.test.ts`.
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "pro",
-    plan: "pro-monthly",
-    features: ["commerce"],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-jest.mock("@working-theory/analytics/server", () => ({
-  track: (...args: unknown[]) => mockTrack(...args),
-}));
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../../lib/prisma.js");
-
-const mockVerifyWebhookSignature = jest.fn();
-class MockStripeWebhookSignatureError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "StripeWebhookSignatureError";
-  }
-}
-jest.mock("@working-theory/stripe-client", () => ({
-  verifyWebhookSignature: (...args: unknown[]) =>
-    mockVerifyWebhookSignature(...args),
-  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
-  assertSandboxKey: jest.fn(),
-  createCheckoutSession: jest.fn(),
-  getStripeClient: jest.fn(),
-  STRIPE_API_VERSION: "2024-06-20",
-  StripeConfigError: class StripeConfigError extends Error {},
-  UnknownProductCodeError: class UnknownProductCodeError extends Error {},
-  WEBHOOK_TOLERANCE_SECONDS: 300,
-}));
-
-import * as configModule from "../../../config/index.js";
-import { prisma } from "../../../lib/prisma.js";
-import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
-import { stripeWebhookHandler } from "../stripe.js";
-
-// The sentinel default Organization id (orgs-of-one billing anchor).
-const DEFAULT_ORG_ID = "org_00000000-0000-7000-8000-000000000001";
-const REAL_ORG_ID = "org_00000000-0000-7000-8000-0000000000ab";
-
-const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
-const VALID_SIGNATURE = "t=1234,v1=abc";
-
-let logLines: string[] = [];
-
-async function buildTestServer(): Promise<FastifyInstance> {
-  logLines = [];
-  const stream = new Writable({
-    write(chunk, _encoding, done) {
-      logLines.push(String(chunk));
-      done();
-    },
-  });
-  const server = Fastify({ logger: { level: "info", stream } });
-  await server.register(async (scope) => {
-    scope.addContentTypeParser(
-      "application/json",
-      { parseAs: "buffer" },
-      (_req, body, done) => done(null, body),
-    );
-    scope.post("/v1/webhooks/stripe", stripeWebhookHandler);
-  });
-  await server.ready();
-  return server;
-}
-
-function checkoutEvent(
-  id: string,
-  metadata: Record<string, string> | null,
-  customer = "cus_test_org_123",
-  sessionId = "cs_test_org",
-) {
-  return {
-    id,
-    type: "checkout.session.completed",
-    data: {
-      object: {
-        id: sessionId,
-        amount_total: 9900,
-        currency: "usd",
-        customer,
-        customer_details: { email: "org-admin@example.com" },
-        metadata,
-      },
-    },
-  };
-}
-
-async function fire(server: FastifyInstance) {
-  return server.inject({
-    method: "POST",
-    url: "/v1/webhooks/stripe",
-    payload: VALID_BODY,
-    headers: {
-      "content-type": "application/json",
-      "stripe-signature": VALID_SIGNATURE,
-    },
-  });
-}
-
-describe("POST /api/webhooks/stripe — org-scoped billing (#3601, proof-based since #9067 D13)", () => {
-  let server: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    __resetIdempotencyStore();
-    jest.replaceProperty(configModule, "config", {
-      ...configModule.config,
-      STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
-    });
-    (prisma.organization.findFirst as jest.Mock).mockResolvedValue(null);
-    (prisma.organization.updateMany as jest.Mock).mockResolvedValue({ count: 1 });
-    server = await buildTestServer();
-  });
-
-  afterEach(async () => {
-    await server.close();
-    jest.restoreAllMocks();
-  });
-
-  /** The arm's `org_bind_unproven` lines, each with no customer or Organization id. */
-  function unprovenLines(...ids: string[]): string[] {
-    const lines = logLines.filter((line) => line.includes("org_bind_unproven"));
-    for (const line of lines) for (const id of ids) expect(line).not.toContain(id);
-    return lines;
-  }
-
-  function boundWrite(organizationId: string, sessionId: string, customerId: string) {
-    return {
-      where: { id: organizationId, planCheckoutSessionId: sessionId, billingCustomerId: null },
-      data: { billingProvider: "stripe", billingCustomerId: customerId, planCheckoutSessionId: null },
-    };
-  }
-
-  // AC-7 — the recorded session binds into an empty column, clearing the record.
-  it("binds the Organization only to the plan session it recorded, idempotent on replay", async () => {
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_org_001", { organizationId: "org_1" }, "cus_1", "cs_1"),
-    );
-    const r1 = await fire(server);
-    expect(r1.statusCode).toBe(200);
-    expect(prisma.organization.updateMany).toHaveBeenCalledTimes(1);
-    expect(prisma.organization.updateMany).toHaveBeenCalledWith(boundWrite("org_1", "cs_1", "cus_1"));
-    expect(prisma.organization.update).not.toHaveBeenCalled();
-    // The User path is never taken for an org checkout.
-    expect(prisma.user.update).not.toHaveBeenCalled();
-    expect(unprovenLines()).toHaveLength(0);
-
-    // Replay the SAME event id → the duplicate check stops it before the arm.
-    const r2 = await fire(server);
-    expect(r2.statusCode).toBe(200);
-    expect(prisma.organization.updateMany).toHaveBeenCalledTimes(1);
-  });
-
-  // AC-7 — a second delivery of the same session under a new event id, after
-  // binding, is the idempotent no-op (typed-composite match).
-  it("is a no-op when the org is already linked to this customer (typed-composite match)", async () => {
-    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce({
-      id: "org_1",
-      billingProvider: "stripe",
-      billingCustomerId: "cus_1",
-    });
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_org_002", { organizationId: "org_1" }, "cus_1", "cs_1"),
-    );
-    const r = await fire(server);
-    expect(r.statusCode).toBe(200);
-    expect(prisma.organization.updateMany).not.toHaveBeenCalled();
-    expect(prisma.organization.update).not.toHaveBeenCalled();
-    expect(logLines.some((line) => line.includes("idempotent no-op"))).toBe(true);
-  });
-
-  // AC-7 — the row holds another session id or none, or already holds a
-  // customer: the guarded write moves no row, so nothing binds.
-  it.each([
-    ["holds another session id or none", { organizationId: "org_1" }],
-    ["already holds cus_other", { organizationId: "org_1" }],
-  ])("writes nothing and logs org_bind_unproven when the row %s", async (_label, metadata) => {
-    (prisma.organization.updateMany as jest.Mock).mockResolvedValueOnce({ count: 0 });
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_org_003", metadata, "cus_1", "cs_1"),
-    );
-    const r = await fire(server);
-    expect(r.statusCode).toBe(200);
-    expect(prisma.organization.update).not.toHaveBeenCalled();
-    expect(prisma.user.update).not.toHaveBeenCalled();
-    expect(unprovenLines("cus_1", "org_1")).toHaveLength(1);
-  });
-
-  // AC2 — an individual is billed on their sentinel default Organization
-  // (orgs-of-one): the SAME org path, under the same proof.
-  it("bills an individual on their sentinel default Organization (orgs-of-one)", async () => {
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_org_004", { organizationId: DEFAULT_ORG_ID }, "cus_individual_xyz", "cs_indiv"),
-    );
-    const r = await fire(server);
-    expect(r.statusCode).toBe(200);
-    expect(prisma.organization.updateMany).toHaveBeenCalledWith(
-      boundWrite(DEFAULT_ORG_ID, "cs_indiv", "cus_individual_xyz"),
-    );
-    expect(prisma.user.update).not.toHaveBeenCalled();
-  });
-
-  // AC4 — a checkout WITHOUT organizationId takes the User path unchanged; the
-  // Organization is never touched (single-tenant degrade-clean regression).
-  it("takes the User path (never touches Organization) when no organizationId is present", async () => {
-    const customerId = "cus_single_tenant";
-    (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce({
-      id: "usr_st",
-      email: "org-admin@example.com",
-      billingProvider: null,
-      billingCustomerId: null,
-    });
-    (prisma.user.update as jest.Mock).mockResolvedValueOnce({ id: "usr_st" });
-
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent(
-        "evt_st_004",
-        { productId: "pro", ailk_user_id: "usr_st" },
-        customerId,
-      ),
-    );
-    const r = await fire(server);
-    expect(r.statusCode).toBe(200);
-    expect(prisma.user.update).toHaveBeenCalledTimes(1);
-    expect(prisma.organization.findFirst).not.toHaveBeenCalled();
-    expect(prisma.organization.update).not.toHaveBeenCalled();
-    expect(prisma.organization.updateMany).not.toHaveBeenCalled();
-  });
-
-  // AC-7 — a customer's own metadata proves nothing: customer.created binds no Organization.
-  it("writes nothing and logs org_bind_unproven on customer.created with metadata.organizationId", async () => {
-    mockVerifyWebhookSignature.mockReturnValue({
-      id: "evt_cust_005",
-      type: "customer.created",
-      data: {
-        object: {
-          id: "cus_created_org",
-          email: "org-admin@example.com",
-          metadata: { organizationId: REAL_ORG_ID },
-        },
-      },
-    });
-    const r = await fire(server);
-    expect(r.statusCode).toBe(200);
-    expect(prisma.organization.findFirst).not.toHaveBeenCalled();
-    expect(prisma.organization.update).not.toHaveBeenCalled();
-    expect(prisma.organization.updateMany).not.toHaveBeenCalled();
-    expect(prisma.user.update).not.toHaveBeenCalled();
-    expect(unprovenLines("cus_created_org", REAL_ORG_ID)).toHaveLength(1);
-  });
-
-  // A DB failure on the org link never throws (200 still returned).
-  it("returns 200 even when the org billing update throws", async () => {
-    (prisma.organization.updateMany as jest.Mock).mockRejectedValueOnce(
-      new Error("db unreachable"),
-    );
-
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_org_006", { organizationId: REAL_ORG_ID }),
-    );
-    const r = await fire(server);
-    expect(r.statusCode).toBe(200);
-    expect(JSON.parse(r.body)).toEqual({ received: true });
-  });
-});

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-proposal-paid.test.ts

@@ -1,369 +0,0 @@
-/**
- * POST /v1/webhooks/stripe — the proposal paid stamp (#8516 D13; spec
- * docs/specs/8516-proposals-as-an-artifact-kind-spec.md AC-6, AC-7).
- *
- * The signed-event harness is `stripe-request-paid.test.ts`'s (that suite is
- * left unedited). The Prisma boundary is the in-memory, where-honouring
- * double, so the stamp's two statements in `lib/proposal-paid-store.ts` run
- * against real rows seeded in two workspaces, and the audit row is the one
- * the real `recordWorkspaceAuditAction` writes through `auditLog.create`.
- */
-import type { FastifyInstance } from "fastify";
-import Fastify from "fastify";
-
-// Commerce claim (D-64, #5796): every case here is a COMMERCE-CLAIMED
-// deployment, the same posture the sibling webhook suites take.
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "pro",
-    plan: "pro-monthly",
-    features: ["commerce"],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-jest.mock("@working-theory/analytics/server", () => ({
-  track: jest.fn().mockResolvedValue(undefined),
-}));
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); the in-memory double is the repo-standard where-honouring test double for it.
-jest.mock("../../../lib/prisma.js", () =>
-  jest
-    .requireActual<typeof import("../../../__tests__/factories/in-memory-prisma")>(
-      "../../../__tests__/factories/in-memory-prisma",
-    )
-    .createInMemoryPrisma(),
-);
-
-const mockVerifyWebhookSignature = jest.fn();
-class MockStripeWebhookSignatureError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "StripeWebhookSignatureError";
-  }
-}
-jest.mock("@working-theory/stripe-client", () => ({
-  verifyWebhookSignature: (...args: unknown[]) =>
-    mockVerifyWebhookSignature(...args),
-  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
-  assertSandboxKey: jest.fn(),
-  createCheckoutSession: jest.fn(),
-  getStripeClient: jest.fn(),
-  STRIPE_API_VERSION: "2024-06-20",
-  StripeConfigError: class StripeConfigError extends Error {},
-  UnknownProductCodeError: class UnknownProductCodeError extends Error {},
-  WEBHOOK_TOLERANCE_SECONDS: 300,
-}));
-
-import * as configModule from "../../../config/index.js";
-import { stripeWebhookHandler } from "../stripe.js";
-import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
-import { prisma } from "../../../lib/prisma.js";
-
-type Row = Record<string, unknown>;
-
-// eslint-disable-next-line no-restricted-syntax -- the in-memory double exposes its store, call log and jest.fn delegates on keys the real client type does not declare
-const fake = prisma as unknown as {
-  __db: Record<string, Row[]>;
-  __calls: Array<{ model: string; op: string }>;
-  auditLog: { create: jest.Mock };
-  piece: { updateMany: jest.Mock; findFirst: jest.Mock };
-};
-const store = fake.__db;
-const calls = fake.__calls;
-const auditCreate = fake.auditLog.create;
-
-const WS_A1 = "wksp_0190f3a2-7c1d-7e4a-9b2c-0000000000a1";
-const WS_A2 = "wksp_0190f3a2-7c1d-7e4a-9b2c-0000000000a2";
-const PERSON_A1 = "person_0190f3a2-7c1d-7e4a-9b2c-0000000000c1";
-const PERSON_A2 = "person_0190f3a2-7c1d-7e4a-9b2c-0000000000c2";
-const PIECE_A1 = "piece_0190f3a2-7c1d-7e4a-9b2c-0000000000b1";
-const PIECE_A2 = "piece_0190f3a2-7c1d-7e4a-9b2c-0000000000b2";
-const SESSION_ID = "cs_test_proposal_first_session";
-const OTHER_SESSION_ID = "cs_test_proposal_second_session";
-
-/** An approved, priced, unpaid proposal of `workspaceId`. */
-function proposal(id: string, workspaceId: string, personId: string): Row {
-  return {
-    id,
-    workspaceId,
-    personId,
-    title: "Patio proposal",
-    stage: "in-review",
-    needsClient: true,
-    kind: "proposal",
-    approvedAt: new Date("2026-10-13T10:00:00.000Z"),
-    priceAmount: 125000,
-    priceCurrency: "usd",
-    checkoutSessionId: SESSION_ID,
-    checkoutUrl: "https://checkout.stripe.com/c/pay/cs_test_proposal",
-    checkoutExpiresAt: new Date("2026-10-14T13:00:00.000Z"),
-    paidAt: null,
-    paidSessionId: null,
-    createdAt: new Date("2026-10-13T09:00:00.000Z"),
-    updatedAt: new Date("2026-10-13T10:00:00.000Z"),
-  };
-}
-
-function piece(id: string): Row {
-  const row = store["piece"]!.find((r) => r["id"] === id);
-  if (!row) throw new Error(`no seeded piece ${id}`);
-  return row;
-}
-
-function auditRows(): Row[] {
-  return store["auditLog"] ?? [];
-}
-
-function pieceCalls(): Array<{ model: string; op: string }> {
-  return calls.filter((c) => c.model === "piece");
-}
-
-function paidEvent(
-  eventId: string,
-  object: Record<string, unknown> = {},
-): Record<string, unknown> {
-  return {
-    id: eventId,
-    type: "checkout.session.completed",
-    data: {
-      object: {
-        id: SESSION_ID,
-        payment_status: "paid",
-        amount_total: 125000,
-        currency: "usd",
-        payment_link: null,
-        metadata: { ailk_proposal: PIECE_A1, ailk_workspace: WS_A1 },
-        ...object,
-      },
-    },
-  };
-}
-
-async function buildTestServer(): Promise<FastifyInstance> {
-  const server = Fastify({ logger: false });
-  await server.register(async (webhooksScope) => {
-    webhooksScope.addContentTypeParser(
-      "application/json",
-      { parseAs: "buffer" },
-      (_req, body, done) => {
-        done(null, body);
-      },
-    );
-    webhooksScope.post("/v1/webhooks/stripe", stripeWebhookHandler);
-  });
-  await server.ready();
-  return server;
-}
-
-const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
-const HEADERS = {
-  "content-type": "application/json",
-  "stripe-signature": "t=1234,v1=abc",
-};
-
-let server: FastifyInstance;
-
-beforeEach(async () => {
-  jest.clearAllMocks();
-  __resetIdempotencyStore();
-  for (const key of Object.keys(store)) delete store[key];
-  calls.length = 0;
-  store["piece"] = [
-    proposal(PIECE_A1, WS_A1, PERSON_A1),
-    proposal(PIECE_A2, WS_A2, PERSON_A2),
-  ];
-  jest.replaceProperty(configModule, "config", {
-    ...configModule.config,
-    STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
-  });
-  server = await buildTestServer();
-});
-
-afterEach(async () => {
-  await server.close();
-});
-
-async function post(event: Record<string, unknown>) {
-  mockVerifyWebhookSignature.mockReturnValue(event);
-  return server.inject({
-    method: "POST",
-    url: "/v1/webhooks/stripe",
-    payload: VALID_BODY,
-    headers: HEADERS,
-  });
-}
-
-// ── A paid session stamps once and is audited as Stripe (AC-7) ─────────────
-
-describe("a signed, paid proposal session", () => {
-  it("stamps paid_at and paid_session_id once and writes one people.proposal.paid succeeded row", async () => {
-    const res = await post(paidEvent("evt_test_proposal_paid"));
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body)).toEqual({ received: true });
-
-    const stamped = piece(PIECE_A1);
-    expect(stamped["paidAt"]).toBeInstanceOf(Date);
-    expect(stamped["paidSessionId"]).toBe(SESSION_ID);
-    // The other workspace's proposal is untouched.
-    expect(piece(PIECE_A2)["paidAt"]).toBeNull();
-    expect(piece(PIECE_A2)["paidSessionId"]).toBeNull();
-
-    expect(auditCreate).toHaveBeenCalledTimes(1);
-    expect(auditRows()).toHaveLength(1);
-    expect(auditRows()[0]).toMatchObject({
-      workspaceId: WS_A1,
-      actorType: "system",
-      actorId: "stripe",
-      action: "people.proposal.paid",
-      targetType: "piece",
-      targetId: PIECE_A1,
-      metadata: {
-        v: 2,
-        outcome: "succeeded",
-        tool: "proposal.paid",
-        idempotencyKey: "evt_test_proposal_paid",
-      },
-    });
-    expect(auditRows()[0]!["metadata"]).not.toHaveProperty("failureReason");
-  });
-
-  it("stamps a zero-due completion too (no_payment_required)", async () => {
-    await post(
-      paidEvent("evt_test_proposal_zero", { payment_status: "no_payment_required" }),
-    );
-    expect(piece(PIECE_A1)["paidSessionId"]).toBe(SESSION_ID);
-    expect(auditRows()).toHaveLength(1);
-    expect(auditRows()[0]!["metadata"]).toMatchObject({ outcome: "succeeded" });
-  });
-});
-
-// ── Replays and second charges (AC-7, SEC-8516-F) ──────────────────────────
-
-describe("a repeated or second payment", () => {
-  it("the same event after a restart (hasSeen cleared) leaves the row unchanged and writes nothing", async () => {
-    const event = paidEvent("evt_test_proposal_replay");
-    await post(event);
-    const paidAt = piece(PIECE_A1)["paidAt"] as Date;
-    const rowsAfterFirst = auditRows().map((r) => ({ ...r }));
-    expect(rowsAfterFirst).toHaveLength(1);
-
-    // A fresh process has an empty in-memory dedup store.
-    __resetIdempotencyStore();
-    auditCreate.mockClear();
-
-    const res = await post(event);
-    expect(res.statusCode).toBe(200);
-    expect(piece(PIECE_A1)["paidAt"]).toBe(paidAt);
-    expect(piece(PIECE_A1)["paidSessionId"]).toBe(SESSION_ID);
-    expect(auditCreate).not.toHaveBeenCalled();
-    expect(auditRows()).toEqual(rowsAfterFirst);
-  });
-
-  it("a second, different paid session for the same proposal writes one failed row (already_paid)", async () => {
-    await post(paidEvent("evt_test_proposal_first"));
-    const paidAt = piece(PIECE_A1)["paidAt"] as Date;
-    auditCreate.mockClear();
-
-    const res = await post(
-      paidEvent("evt_test_proposal_second", { id: OTHER_SESSION_ID }),
-    );
-    expect(res.statusCode).toBe(200);
-
-    // The first payment's stamp stands.
-    expect(piece(PIECE_A1)["paidAt"]).toBe(paidAt);
-    expect(piece(PIECE_A1)["paidSessionId"]).toBe(SESSION_ID);
-
-    expect(auditCreate).toHaveBeenCalledTimes(1);
-    expect(auditRows()).toHaveLength(2);
-    expect(auditRows()[1]).toMatchObject({
-      workspaceId: WS_A1,
-      actorType: "system",
-      actorId: "stripe",
-      action: "people.proposal.paid",
-      targetType: "piece",
-      targetId: PIECE_A1,
-      metadata: {
-        outcome: "failed",
-        failureReason: "already_paid",
-        idempotencyKey: "evt_test_proposal_second",
-      },
-    });
-  });
-});
-
-// ── A session that is not paid (AC-7) ──────────────────────────────────────
-
-describe("a completed session that is not paid", () => {
-  it("writes one failed row (not_paid) and stamps nothing", async () => {
-    const res = await post(
-      paidEvent("evt_test_proposal_unpaid", { payment_status: "unpaid" }),
-    );
-    expect(res.statusCode).toBe(200);
-
-    expect(piece(PIECE_A1)["paidAt"]).toBeNull();
-    expect(piece(PIECE_A1)["paidSessionId"]).toBeNull();
-    expect(pieceCalls()).toEqual([]);
-
-    expect(auditRows()).toHaveLength(1);
-    expect(auditRows()[0]).toMatchObject({
-      workspaceId: WS_A1,
-      actorType: "system",
-      actorId: "stripe",
-      action: "people.proposal.paid",
-      targetId: PIECE_A1,
-      metadata: {
-        outcome: "failed",
-        failureReason: "not_paid",
-        idempotencyKey: "evt_test_proposal_unpaid",
-      },
-    });
-  });
-});
-
-// ── No server metadata, no query (AC-7) ────────────────────────────────────
-
-describe("a session without the server's proposal metadata", () => {
-  it.each([
-    ["no metadata at all", undefined],
-    ["an empty metadata object", {}],
-    ["only ailk_proposal", { ailk_proposal: PIECE_A1 }],
-    ["only ailk_workspace", { ailk_workspace: WS_A1 }],
-    ["malformed ids", { ailk_proposal: "piece_nope", ailk_workspace: "wksp_nope" }],
-  ])("makes no piece query and writes no row (%s)", async (_label, metadata) => {
-    const res = await post(paidEvent("evt_test_proposal_nometa", { metadata }));
-    expect(res.statusCode).toBe(200);
-    expect(pieceCalls()).toEqual([]);
-    expect(auditRows()).toHaveLength(0);
-    expect(piece(PIECE_A1)["paidAt"]).toBeNull();
-  });
-});
-
-// ── Workspace A never reaches workspace B (AC-6) ───────────────────────────
-
-describe("a paid event whose metadata pairs WS_A1 with a piece of WS_A2", () => {
-  it("stamps nothing and writes no row", async () => {
-    const res = await post(
-      paidEvent("evt_test_proposal_cross", {
-        metadata: { ailk_proposal: PIECE_A2, ailk_workspace: WS_A1 },
-      }),
-    );
-    expect(res.statusCode).toBe(200);
-
-    expect(piece(PIECE_A2)["paidAt"]).toBeNull();
-    expect(piece(PIECE_A2)["paidSessionId"]).toBeNull();
-    expect(piece(PIECE_A1)["paidAt"]).toBeNull();
-    expect(auditRows()).toHaveLength(0);
-
-    // Every piece statement was scoped by the metadata's workspace.
-    const pieceDelegate = fake.piece;
-    expect(pieceDelegate.updateMany).toHaveBeenCalledTimes(1);
-    expect(pieceDelegate.findFirst).toHaveBeenCalledTimes(1);
-    for (const mock of [pieceDelegate.updateMany, pieceDelegate.findFirst]) {
-      for (const [args] of mock.mock.calls as Array<[{ where: Row }]>) {
-        expect(args.where).toMatchObject({ id: PIECE_A2, workspaceId: WS_A1 });
-      }
-    }
-  });
-});