create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/openapi/surface-drift.ts

@@ -1,195 +0,0 @@
-/**
- * The comparison instrument for #5314 — diffs the routes the server ACTUALLY
- * registers against each surface that claims to describe them.
- *
- * Two surfaces describe this API's endpoints: the root index `endpoints`
- * object (`server.ts`) and the OpenAPI `paths` object (`spec.ts`). Before
- * #5314 both were hand-maintained literals, and both had drifted — 11 and 7
- * entries against 68 registered routes, with `/v1/project-listings/public`
- * missing from both and `/v1/billing/usage` missing from the root index.
- *
- * This module only COMPARES. The derivation that keeps the surfaces honest
- * lives in `spec.ts` beside the shapes it produces; keeping the comparison
- * separate is what lets the gate assert against a surface it did not build.
- *
- * Deliberately free of any `fastify` or `spec.ts` import: it takes plain data,
- * so the gate can feed it a SERVED document (fetched over `inject`) rather
- * than the object the code under test just returned.
- */
-
-/** One route as Fastify registered it. `url` is Fastify-shaped (`:param`). */
-export interface RegisteredRoute {
-  /** Uppercase HTTP method. HEAD is excluded — Fastify derives it from GET. */
-  method: string;
-  /** Fastify path, e.g. `/v1/content/:type/:slug`. */
-  url: string;
-}
-
-/** One surface's disagreement with the registered route table. */
-export interface SurfaceDiff {
-  /** Which surface this diff describes. */
-  surface: "openapi-paths" | "root-index-endpoints";
-  /** `METHOD /path` registered by the server but absent from the surface. */
-  missingFromSurface: string[];
-  /** `METHOD /path` named by the surface but not registered by the server. */
-  orphanedInSurface: string[];
-}
-
-/**
- * Fastify path → OpenAPI path template: `/v1/content/:type` becomes
- * `/v1/content/{type}`. OpenAPI 3.1 has no `:param` form, so a document that
- * published the Fastify string would be describing a path no client can build.
- */
-export function toOpenApiPath(fastifyPath: string): string {
-  return fastifyPath
-    .split("/")
-    .map((segment) =>
-      segment.startsWith(":") ? `{${segment.slice(1)}}` : segment,
-    )
-    .join("/");
-}
-
-/** The comparison key both sides normalise to: `GET /v1/content/types`. */
-export function routeKey(method: string, path: string): string {
-  return `${method.toUpperCase()} ${path}`;
-}
-
-/** Registered routes as OpenAPI-shaped comparison keys. */
-function registeredOpenApiKeys(routes: RegisteredRoute[]): Set<string> {
-  return new Set(routes.map((r) => routeKey(r.method, toOpenApiPath(r.url))));
-}
-
-/** Registered routes as Fastify-shaped comparison keys. */
-function registeredFastifyKeys(routes: RegisteredRoute[]): Set<string> {
-  return new Set(routes.map((r) => routeKey(r.method, r.url)));
-}
-
-/**
- * The OpenAPI methods a path item declares. Non-method keys an OpenAPI path
- * item may legally carry (`parameters`, `summary`, `description`, `servers`,
- * `$ref`) are not operations and must not be compared as if they were.
- */
-const OPENAPI_METHODS = new Set([
-  "get",
-  "put",
-  "post",
-  "delete",
-  "options",
-  "head",
-  "patch",
-  "trace",
-]);
-
-/**
- * Comparison keys a served OpenAPI `paths` object claims.
- *
- * Takes the served document's `paths` as plain data so the gate can compare
- * what an agent would actually fetch, not what the builder returned.
- */
-export function openApiSurfaceKeys(
-  paths: Record<string, Record<string, unknown>>,
-): Set<string> {
-  const keys = new Set<string>();
-  for (const [path, item] of Object.entries(paths ?? {})) {
-    for (const method of Object.keys(item ?? {})) {
-      if (!OPENAPI_METHODS.has(method.toLowerCase())) continue;
-      if (method.toLowerCase() === "head") continue;
-      keys.add(routeKey(method, path));
-    }
-  }
-  return keys;
-}
-
-/**
- * Comparison keys a root-index `endpoints` object claims.
- *
- * Each value is `"METHOD[/METHOD...] /path"` — the shape the hand-authored
- * object already used (`"GET/PATCH /v1/user/profile"`), preserved so no
- * published entry changes shape. A value that does not parse is reported as
- * an orphan rather than skipped: an unparseable entry is precisely the kind
- * of hand-edit this instrument exists to catch.
- */
-export function rootIndexSurfaceKeys(
-  endpoints: Record<string, string>,
-): Set<string> {
-  const keys = new Set<string>();
-  for (const value of Object.values(endpoints ?? {})) {
-    const match = /^([A-Za-z/]+)\s+(\S+)$/.exec(value ?? "");
-    if (!match?.[1] || !match[2]) {
-      keys.add(`UNPARSEABLE ${value}`);
-      continue;
-    }
-    for (const method of match[1].split("/")) {
-      if (!method) continue;
-      if (method.toUpperCase() === "HEAD") continue;
-      keys.add(routeKey(method, match[2]));
-    }
-  }
-  return keys;
-}
-
-function diff(registered: Set<string>, surface: Set<string>) {
-  return {
-    missingFromSurface: [...registered].filter((k) => !surface.has(k)).sort(),
-    orphanedInSurface: [...surface].filter((k) => !registered.has(k)).sort(),
-  };
-}
-
-/**
- * Diff the registered route table against both surfaces.
- *
- * `paths` is the served OpenAPI `paths` object (OpenAPI-templated); `endpoints`
- * is the served root-index `endpoints` object (Fastify-shaped, matching the
- * strings that surface has always published). Each is compared in its own
- * vocabulary so neither surface is judged against a shape it never used.
- */
-export function compareSurfaces(
-  registered: RegisteredRoute[],
-  paths: Record<string, Record<string, unknown>>,
-  endpoints: Record<string, string>,
-): SurfaceDiff[] {
-  return [
-    {
-      surface: "openapi-paths",
-      ...diff(registeredOpenApiKeys(registered), openApiSurfaceKeys(paths)),
-    },
-    {
-      surface: "root-index-endpoints",
-      ...diff(
-        registeredFastifyKeys(registered),
-        rootIndexSurfaceKeys(endpoints),
-      ),
-    },
-  ];
-}
-
-/** Whether any surface disagrees with the registered route table. */
-export function hasDrift(diffs: SurfaceDiff[]): boolean {
-  return diffs.some(
-    (d) => d.missingFromSurface.length > 0 || d.orphanedInSurface.length > 0,
-  );
-}
-
-/**
- * Render the drift for a failing assertion, or `""` when there is none.
- *
- * A surface that agrees contributes nothing, so the empty string means "no
- * drift" and can be asserted against directly. Counts come first so a reader
- * sees the scale before the list, then EVERY entry — a truncated drift report
- * is how a gate teaches people to ignore it.
- */
-export function formatSurfaceDrift(diffs: SurfaceDiff[]): string {
-  const lines: string[] = [];
-  for (const d of diffs) {
-    if (d.missingFromSurface.length === 0 && d.orphanedInSurface.length === 0) {
-      continue;
-    }
-    lines.push(
-      `${d.surface}: ${d.missingFromSurface.length} registered route(s) missing from the surface, ` +
-        `${d.orphanedInSurface.length} surface entr(ies) with no registered route`,
-    );
-    for (const k of d.missingFromSurface) lines.push(`  missing:  ${k}`);
-    for (const k of d.orphanedInSurface) lines.push(`  orphaned: ${k}`);
-  }
-  return lines.join("\n");
-}

package/templates/apps/api/src/routes/aeo/__tests__/index.test.ts

@@ -1,175 +0,0 @@
-/**
- * @file index.test.ts
- * Route-level inject tests for POST /v1/aeo/score and GET /v1/aeo/score/example
- * (#4666 D5).
- *
- * Mirrors apps/api/src/routes/schedule/__tests__/index.test.ts's shape: a bare
- * Fastify instance with only the routes under test registered; the fetch
- * boundary is stubbed rather than the service, so these tests cover the real
- * crawler + scorer alongside the route's envelope and status mapping. Test
- * URLs use literal public/blocked IP addresses so the SSRF gate's DNS step is
- * never exercised (no real network egress needed).
- */
-import type { FastifyInstance } from "fastify";
-
-import { scoreAeoRoute, exampleAeoRoute } from "../index";
-
-const HOME_HTML =
-  '<html><script type="application/ld+json">{"@type":"HomePage","name":"Home"}</script></html>';
-
-/** Typed as the platform signature so it assigns to `globalThis.fetch` with no cast. */
-type FetchStub = jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
-
-function buildApp(): FastifyInstance {
-  const fastify = require("fastify")();
-  fastify.register(scoreAeoRoute);
-  fastify.register(exampleAeoRoute);
-  return fastify as FastifyInstance;
-}
-
-describe("POST /v1/aeo/score", () => {
-  let app: FastifyInstance;
-  const realFetch = globalThis.fetch;
-
-  beforeEach(() => {
-    app = buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    globalThis.fetch = realFetch;
-    delete process.env["AEO_SCORE_BUDGET_MS"];
-  });
-
-  it("400s on a malformed body", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/aeo/score",
-      payload: { url: "not-a-url" },
-    });
-    expect(res.statusCode).toBe(400);
-    const body = JSON.parse(res.body) as { ok: boolean; error: { code: string } };
-    expect(body.ok).toBe(false);
-    expect(body.error.code).toBe("invalid_input");
-  });
-
-  it("200s with data.status ready for a reachable public-IP host", async () => {
-    const stub: FetchStub = jest.fn(async () => new Response(HOME_HTML));
-    globalThis.fetch = stub;
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/aeo/score",
-      payload: { url: "http://93.184.216.34/" },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = JSON.parse(res.body) as { ok: boolean; data: { status: string; score: number } };
-    expect(body.ok).toBe(true);
-    expect(body.data.status).toBe("ready");
-    expect(typeof body.data.score).toBe("number");
-  });
-
-  it("200s with data.status unavailable/ssrf_blocked for a loopback URL (never 4xx/5xx)", async () => {
-    const stub: FetchStub = jest.fn();
-    globalThis.fetch = stub;
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/aeo/score",
-      payload: { url: "http://127.0.0.1/admin" },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = JSON.parse(res.body) as { ok: boolean; data: { status: string; reason: string } };
-    expect(body.ok).toBe(true);
-    expect(body.data.status).toBe("unavailable");
-    expect(body.data.reason).toBe("ssrf_blocked");
-    expect(stub).not.toHaveBeenCalled();
-  });
-
-  // AILK #4707 — the specific SSRF rejection detail (which internal
-  // hostname/IP triggered the block, or that DNS resolved to one) is an
-  // anonymous-endpoint recon primitive and must never reach the caller; the
-  // response carries only the generic reason enum + a fixed message, with
-  // the specific detail logged server-side only.
-  it("returns a generic message for an SSRF-rejected URL — the specific rejection reason never reaches the response body", async () => {
-    const stub: FetchStub = jest.fn();
-    globalThis.fetch = stub;
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/aeo/score",
-      payload: { url: "http://127.0.0.1/admin" },
-    });
-
-    const body = JSON.parse(res.body) as {
-      ok: boolean;
-      data: { status: string; reason: string; message: string };
-    };
-    expect(body.data.reason).toBe("ssrf_blocked");
-    // Same fixed text flow-engine.ts's aeo_score step already scrubs its
-    // own SSRF-blocked result to (#4663 M1) — one client-facing message
-    // across both aeo_score entry points.
-    expect(body.data.message).toBe("This URL cannot be scored.");
-    expect(body.data.message).not.toMatch(/127\.0\.0\.1/);
-    expect(body.data.message).not.toMatch(/blocked|internal|loopback|metadata/i);
-  });
-
-  it("logs the specific SSRF rejection reason server-side (never returned to the caller)", async () => {
-    const logLines: string[] = [];
-    const logCapture = require("fastify")({
-      logger: {
-        level: "info",
-        stream: { write: (msg: string) => logLines.push(msg) },
-      },
-    }) as FastifyInstance;
-    await logCapture.register(scoreAeoRoute);
-    await logCapture.ready();
-
-    const stub: FetchStub = jest.fn();
-    globalThis.fetch = stub;
-
-    try {
-      await logCapture.inject({
-        method: "POST",
-        url: "/v1/aeo/score",
-        payload: { url: "http://127.0.0.1/admin" },
-      });
-
-      const logText = logLines.join("\n");
-      expect(logText).toMatch(/127\.0\.0\.1/);
-      expect(logText).toMatch(/blocked host/i);
-    } finally {
-      await logCapture.close();
-    }
-  });
-});
-
-describe("GET /v1/aeo/score/example", () => {
-  let app: FastifyInstance;
-
-  beforeEach(() => {
-    app = buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("200s with the bundled example, meta.example true, and the illustrative disclosure wire-visible (acceptance-review finding)", async () => {
-    const res = await app.inject({ method: "GET", url: "/v1/aeo/score/example" });
-    expect(res.statusCode).toBe(200);
-    const body = JSON.parse(res.body) as {
-      ok: boolean;
-      data: { status: string; meta: { example: boolean; sourceUrl: string; illustrative: boolean } };
-    };
-    expect(body.ok).toBe(true);
-    expect(body.data.status).toBe("ready");
-    expect(body.data.meta.example).toBe(true);
-    expect(body.data.meta.sourceUrl).toBe("https://ailaunchkit.ai");
-    // Today's fixture is hand-authored, not a genuine crawl — the caller
-    // must not be told this is a live measurement without qualification.
-    expect(body.data.meta.illustrative).toBe(true);
-  });
-});

package/templates/apps/api/src/routes/aeo/index.ts

@@ -1,107 +0,0 @@
-/**
- * AEO score route group (#4666 D5).
- *
- * Routes:
- *   POST /v1/aeo/score          — score a URL against the four content rules
- *   GET  /v1/aeo/score/example  — the bundled pre-launch annotated example
- *
- * Anonymous, like the sibling `/v1/flows/*` and `/v1/schedule/*` routes — a
- * waitlist respondent has no account. Both routes return `200 { ok: true,
- * data }` for BOTH `ready` and `unavailable` results — an `unavailable`
- * result is a successful call reporting a degraded outcome, not an HTTP
- * error; the caller branches on `data.status`, mirroring how the browser
- * will handle the `computing` state this route never itself emits. Only a
- * malformed request body is a `400 invalid_input`.
- *
- * No MCP twin (a recorded, deliberate exception — brief D7 / apps/api/CLAUDE.md):
- * exposing an arbitrary-URL crawler to anonymous agents is a security-posture
- * decision the AEO Layer 1 MCP tool (`apps/mcp/src/tools/audit.ts`) already
- * declines by staying same-origin-locked.
- *
- * Envelope per apps/api/CLAUDE.md: `{ ok: true, data }` /
- * `{ ok: false, error: { code, message } }`, never 200-with-ok:false.
- *
- * SSRF-reason leak (security review, AILK #4707): `assertUrlSafe`'s reject
- * `reason` text (e.g. "Host x resolves to a blocked address: 10.1.2.3")
- * is a recon primitive for an anonymous caller mapping internal
- * infrastructure via DNS-rebinding probes. It is logged server-side only
- * (`request.log.info`); the response's `data.message` is replaced with the
- * fixed `SSRF_BLOCKED_CLIENT_MESSAGE` for `reason: "ssrf_blocked"`. The
- * `reason` enum itself is unchanged — it is already generic, and is the
- * discriminant the api-client contract keys on. `flow-engine.ts`'s
- * `aeo_score` step landed the identical scrub for its own caller in #4663
- * (M1) and named this route's gap explicitly as out of that fix's scope —
- * this closes it, reusing that fix's exact client-facing message text for
- * consistency across both `aeo_score` entry points.
- */
-import { aeoScoreInputSchema } from "@working-theory/validation";
-import type { FastifyPluginAsync } from "fastify";
-
-import {
-  resolveScoreBudgetMs,
-  loadExampleScore,
-  scoreUrl,
-} from "../../services/aeo-score.js";
-
-const SSRF_BLOCKED_CLIENT_MESSAGE = "This URL cannot be scored.";
-
-export const scoreAeoRoute: FastifyPluginAsync = async (fastify) => {
-  fastify.post("/v1/aeo/score", async (request, reply) => {
-    const parsedBody = aeoScoreInputSchema.safeParse(request.body);
-    if (!parsedBody.success) {
-      return reply.status(400).send({
-        ok: false,
-        error: {
-          code: "invalid_input",
-          message: parsedBody.error.issues[0]?.message ?? "Invalid request body.",
-        },
-      });
-    }
-
-    const budgetMs = resolveScoreBudgetMs(process.env["AEO_SCORE_BUDGET_MS"], {
-      warn: (msg) => request.log.warn(msg),
-    });
-    const data = await scoreUrl(parsedBody.data.url, { budgetMs });
-
-    const host = safeHost(parsedBody.data.url);
-    if (data.status === "ready") {
-      request.log.info(
-        { host, pagesAudited: data.meta.pagesAudited, skipped: data.meta.skipped.length, status: data.status },
-        "aeo score computed",
-      );
-      return reply.send({ ok: true, data });
-    }
-
-    if (data.status === "unavailable") {
-      // The specific rejection detail (e.g. which internal hostname/IP an
-      // SSRF probe resolved to) is logged here, server-side only — never
-      // sent to the caller.
-      request.log.info(
-        { host, status: data.status, reason: data.reason, message: data.message },
-        "aeo score unavailable",
-      );
-      const clientData: typeof data =
-        data.reason === "ssrf_blocked"
-          ? { ...data, message: SSRF_BLOCKED_CLIENT_MESSAGE }
-          : data;
-      return reply.send({ ok: true, data: clientData });
-    }
-
-    return reply.send({ ok: true, data });
-  });
-};
-
-export const exampleAeoRoute: FastifyPluginAsync = async (fastify) => {
-  fastify.get("/v1/aeo/score/example", async (_request, reply) => {
-    return reply.send({ ok: true, data: loadExampleScore() });
-  });
-};
-
-/** Never log the full URL — host only (§ 5.2 Logging: no PII, no query strings). */
-function safeHost(rawUrl: string): string {
-  try {
-    return new URL(rawUrl).host;
-  } catch {
-    return "invalid";
-  }
-}

package/templates/apps/api/src/routes/auth/__tests__/auth-tokens.functional.test.ts

@@ -1,196 +0,0 @@
-/**
- * @file auth-tokens.functional.test.ts
- *
- * End-to-end coverage for the three /api/auth/tokens routes once the dual-mode
- * preHandler (#587) is wired in front. Confirms that:
- *
- *   - Cookie-mode happy path: cookie present + valid Session row + same-origin
- *     POST → handler runs, prisma.apiToken.create is called.
- *   - Bearer-mode happy path: Authorization: Bearer header → ApiToken lookup
- *     succeeds → handler runs.
- *   - Unauthenticated → 401 from the preHandler (handler not reached).
- *
- * Together with `tokens.test.ts` (route-body coverage with userId stub) this
- * locks the spec §5 AC #4 bullet ("All eight existing routes ship functional
- * via cookie AND via bearer; no public paths renamed").
- */
-
-import { createHash } from "node:crypto";
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      findMany: jest.fn(),
-      create: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-      updateMany: jest.fn(),
-    },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../../middleware/auth.js";
-import { tokenRoutes } from "../tokens.js";
-
-const FRONTEND = "https://app.example.com";
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
-  app.register(tokenRoutes);
-  await app.ready();
-  return app;
-}
-
-describe("tokens routes — functional via dual-mode preHandler", () => {
-  let app: FastifyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  describe("cookie mode", () => {
-    it("POST /api/auth/tokens succeeds when authenticated via cookie + same-origin", async () => {
-      (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-        userId: "user_cookie",
-        expiresAt: new Date(Date.now() + 60_000),
-      });
-      (prisma.apiToken.create as jest.Mock).mockResolvedValue({
-        id: "tok_1",
-        name: "desktop",
-        tokenPrefix: "tok_abcdef",
-        clientType: "api",
-        scopes: [],
-        expiresAt: null,
-        createdAt: new Date(),
-      });
-
-      app = await buildApp();
-      const res = await app.inject({
-        method: "POST",
-        url: "/v1/auth/tokens",
-        headers: {
-          cookie: "better-auth.session_token=sess_abc",
-          origin: FRONTEND,
-        },
-        payload: { name: "desktop" },
-      });
-
-      expect(res.statusCode).toBe(201);
-      expect(prisma.apiToken.create).toHaveBeenCalled();
-      expect(
-        (prisma.apiToken.create as jest.Mock).mock.calls[0][0].data.userId,
-      ).toBe("user_cookie");
-    });
-
-    it("GET /api/auth/tokens succeeds when authenticated via cookie (no Origin needed)", async () => {
-      (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-        userId: "user_cookie",
-        expiresAt: new Date(Date.now() + 60_000),
-      });
-      (prisma.apiToken.findMany as jest.Mock).mockResolvedValue([]);
-
-      app = await buildApp();
-      const res = await app.inject({
-        method: "GET",
-        url: "/v1/auth/tokens",
-        headers: { cookie: "better-auth.session_token=sess_abc" },
-      });
-
-      expect(res.statusCode).toBe(200);
-      expect(prisma.apiToken.findMany).toHaveBeenCalledWith(
-        expect.objectContaining({
-          where: { userId: "user_cookie", revokedAt: null },
-        }),
-      );
-    });
-  });
-
-  describe("bearer mode", () => {
-    it("GET /api/auth/tokens succeeds when authenticated via Authorization: Bearer", async () => {
-      const bearer = "tok_live_zzz";
-      const hash = createHash("sha256").update(bearer).digest("hex");
-      (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-        id: "tok_id",
-        userId: "user_bear",
-        expiresAt: null,
-        revokedAt: null,
-      });
-      (prisma.apiToken.findMany as jest.Mock).mockResolvedValue([]);
-
-      app = await buildApp();
-      const res = await app.inject({
-        method: "GET",
-        url: "/v1/auth/tokens",
-        headers: { authorization: `Bearer ${bearer}` },
-      });
-
-      expect(res.statusCode).toBe(200);
-      expect(prisma.apiToken.findUnique).toHaveBeenCalledWith({
-        where: { token: hash },
-        select: { id: true, userId: true, expiresAt: true, revokedAt: true },
-      });
-      expect(prisma.apiToken.findMany).toHaveBeenCalledWith(
-        expect.objectContaining({
-          where: { userId: "user_bear", revokedAt: null },
-        }),
-      );
-    });
-
-    it("DELETE /api/auth/tokens/:id succeeds via bearer; revokes the row", async () => {
-      const bearer = "tok_live_zzz";
-      // Well-formed apitok_ id (ADR-0031): the :id param is validated with
-      // zApiTokenId before any query runs.
-      const targetId = "apitok_00000000-0000-7000-8000-000000000009";
-      (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-        id: "tok_id",
-        userId: "user_bear",
-        expiresAt: null,
-        revokedAt: null,
-      });
-      (prisma.apiToken.updateMany as jest.Mock).mockResolvedValue({ count: 1 });
-
-      app = await buildApp();
-      const res = await app.inject({
-        method: "DELETE",
-        url: `/v1/auth/tokens/${targetId}`,
-        headers: { authorization: `Bearer ${bearer}` },
-      });
-
-      expect(res.statusCode).toBe(200);
-      expect(prisma.apiToken.updateMany).toHaveBeenCalledWith({
-        where: { id: targetId, userId: "user_bear", revokedAt: null },
-        data: { revokedAt: expect.any(Date) },
-      });
-    });
-  });
-
-  describe("unauthenticated", () => {
-    it.each([
-      ["POST", "/v1/auth/tokens"],
-      ["GET", "/v1/auth/tokens"],
-      ["DELETE", "/v1/auth/tokens/tok_x"],
-    ])("%s %s → 401 (handler never runs)", async (method, url) => {
-      app = await buildApp();
-      const res = await app.inject({
-        method: method as "POST" | "GET" | "DELETE",
-        url,
-        payload: method === "POST" ? { name: "x" } : undefined,
-      });
-      expect(res.statusCode).toBe(401);
-      expect(prisma.apiToken.create).not.toHaveBeenCalled();
-      expect(prisma.apiToken.findMany).not.toHaveBeenCalled();
-      expect(prisma.apiToken.updateMany).not.toHaveBeenCalled();
-    });
-  });
-});