create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/services/__tests__/deliverable-fulfillment.test.ts

@@ -1,877 +0,0 @@
-/**
- * @file deliverable-fulfillment.test.ts
- * @description Unit tests for the deliverable-fulfillment service (#3961
- * D3/D4/D5/D7).
- *
- * External dependency boundaries mocked:
- *   - @working-theory/database (via moduleNameMapper → prisma-client.js mock; prisma singleton via __mocks__/prisma.ts)
- *   - @working-theory/email sendDeliverableEmail
- *   - @working-theory/observability logger
- */
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
-jest.mock("../../lib/prisma.js");
-
-const mockSendDeliverableEmail = jest.fn();
-jest.mock("@working-theory/email", () => ({
-  sendDeliverableEmail: (...args: unknown[]) =>
-    mockSendDeliverableEmail(...args),
-}));
-
-const mockLoggerInfo = jest.fn();
-const mockLoggerWarn = jest.fn();
-const mockLoggerError = jest.fn();
-jest.mock("@working-theory/observability", () => ({
-  logger: {
-    info: (...args: unknown[]) => mockLoggerInfo(...args),
-    warn: (...args: unknown[]) => mockLoggerWarn(...args),
-    error: (...args: unknown[]) => mockLoggerError(...args),
-    debug: jest.fn(),
-  },
-}));
-
-import { prisma } from "../../lib/prisma.js";
-import {
-  fulfillDeliverable,
-  listSendlessGrants,
-  type FulfillDeliverableInput,
-} from "../deliverable-fulfillment";
-
-// ─── Fixtures ─────────────────────────────────────────────────────────────────
-
-const en = (s: string) => ({ en: s });
-
-const SITE_ID = "site-abc";
-const SESSION_ID = "flsess_00000000-0000-7000-8000-0000000000c1";
-const LEAD_ID = "lead_00000000-0000-7000-8000-0000000000e1";
-const GRANT_ID = "dgrant_00000000-0000-7000-8000-0000000000g1";
-
-// #6257 — the seeded sentinel workspace the `"default"` alias resolves to
-// (`@working-theory/database/tenancy`'s DEFAULT_WORKSPACE_ID), with a
-// sentinel-shaped organizationId so `resolveSentinelWorkspaceRow`'s own
-// `isSentinel` check passes. Used by ONE test — the `listSendlessGrants`
-// resolution test, the only test in this file that exercises an alias at
-// all — to prove that read scopes by the id it RESOLVED rather than by the
-// alias string the CLI was given. The other fence tests below run no
-// resolution: `fulfillDeliverable` is handed an already-resolved id.
-const SENTINEL_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
-const SENTINEL_ORGANIZATION_ID = "org_00000000-0000-7000-8000-000000000001";
-
-function deliverablesBlock() {
-  return {
-    assets: [
-      { segment: "small", assetKey: "guide-small" },
-      { segment: "large", assetKey: "guide-large" },
-      { assetKey: "guide-default" },
-    ],
-    copy: {
-      subject: en("Here's your guide"),
-      body: en("Thanks — your download is attached."),
-    },
-  };
-}
-
-function baseConfigSnapshot() {
-  return {
-    slug: "get-a-quote",
-    defaultLocale: "en",
-    steps: [],
-    deliverables: deliverablesBlock(),
-  };
-}
-
-function baseInput(
-  overrides: Partial<FulfillDeliverableInput> = {},
-): FulfillDeliverableInput {
-  return {
-    siteId: SITE_ID,
-    flowSlug: "get-a-quote",
-    configSnapshot: baseConfigSnapshot(),
-    segment: "small",
-    leadId: LEAD_ID,
-    sessionId: SESSION_ID,
-    email: "lead@example.com",
-    locale: "en",
-    ...overrides,
-  };
-}
-
-describe("fulfillDeliverable", () => {
-  const originalEnv = process.env;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    process.env = {
-      ...originalEnv,
-      AILK_PUBLIC_API_URL: "https://api.example.com",
-      AILK_DELIVERABLE_EMAIL_FROM: "deliverable-default@example.com",
-    };
-    mockSendDeliverableEmail.mockResolvedValue({
-      ok: true,
-      messageId: "msg-test",
-    });
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue({
-      id: "dasset_00000000-0000-7000-8000-0000000000a1",
-      siteId: SITE_ID,
-      key: "guide-small",
-    });
-    (prisma.deliverableGrant.create as jest.Mock).mockResolvedValue({
-      id: GRANT_ID,
-    });
-    (prisma.deliverableGrant.update as jest.Mock).mockResolvedValue({
-      id: GRANT_ID,
-    });
-  });
-
-  afterEach(() => {
-    process.env = originalEnv;
-  });
-
-  // ── D3 — segment → entry resolution ──────────────────────────────────────
-
-  it("resolves the segment-matched entry and mints a grant for its asset", async () => {
-    await fulfillDeliverable(baseInput({ segment: "small" }));
-
-    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: {
-          siteId_key: { siteId: SITE_ID, key: "guide-small" },
-          // #6257 — the legacy store's read is fenced by the same resolved
-          // workspace id the grant is minted under.
-          workspaceId: SITE_ID,
-        },
-      }),
-    );
-  });
-
-  it("selects only the id on the legacy DeliverableAsset lookup, never the bytes blob (#9248)", async () => {
-    await fulfillDeliverable(baseInput({ segment: "small" }));
-
-    // `DeliverableAsset.bytes` is the file itself; this read exists only to
-    // learn the row's id, so the query must name that one column.
-    const [[args]] = (prisma.deliverableAsset.findUnique as jest.Mock).mock
-      .calls as [[{ select?: Record<string, unknown> }]];
-    expect(args.select).toEqual({ id: true });
-  });
-
-  it("resolves the OTHER segment's entry when segment differs (two-segment divergence, AC1)", async () => {
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue({
-      id: "dasset_00000000-0000-7000-8000-0000000000a2",
-      siteId: SITE_ID,
-      key: "guide-large",
-    });
-
-    await fulfillDeliverable(baseInput({ segment: "large" }));
-
-    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: {
-          siteId_key: { siteId: SITE_ID, key: "guide-large" },
-          workspaceId: SITE_ID,
-        },
-      }),
-    );
-  });
-
-  it("falls back to the default entry when segment is undefined (N=1 degenerate case)", async () => {
-    await fulfillDeliverable(baseInput({ segment: undefined }));
-
-    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: {
-          siteId_key: { siteId: SITE_ID, key: "guide-default" },
-          workspaceId: SITE_ID,
-        },
-      }),
-    );
-  });
-
-  it("falls back to the default entry when segment is derived but unmapped", async () => {
-    await fulfillDeliverable(baseInput({ segment: "unmapped-segment" }));
-
-    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: {
-          siteId_key: { siteId: SITE_ID, key: "guide-default" },
-          workspaceId: SITE_ID,
-        },
-      }),
-    );
-  });
-
-  it("skips (no grant, no send) when no entry matches and there is no default", async () => {
-    await fulfillDeliverable(
-      baseInput({
-        segment: "unmapped-segment",
-        configSnapshot: {
-          ...baseConfigSnapshot(),
-          deliverables: {
-            assets: [{ segment: "small", assetKey: "guide-small" }],
-            copy: deliverablesBlock().copy,
-          },
-        },
-      }),
-    );
-
-    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
-    // #6310 FR8: a no_entry resolution exits before EITHER store is read.
-    expect(prisma.flowDefinition.findUnique).not.toHaveBeenCalled();
-    expect(prisma.asset.findFirst).not.toHaveBeenCalled();
-    expect(prisma.deliverableGrant.create).not.toHaveBeenCalled();
-    expect(mockSendDeliverableEmail).not.toHaveBeenCalled();
-    // AC4: no_entry is a pre-mint outcome — no grant exists to stamp.
-    expect(prisma.deliverableGrant.update).not.toHaveBeenCalled();
-    expect(mockLoggerInfo).toHaveBeenCalledWith(
-      expect.objectContaining({
-        siteId: SITE_ID,
-        flowSlug: "get-a-quote",
-        sessionId: SESSION_ID,
-      }),
-      expect.any(String),
-    );
-  });
-
-  // ── D3 — missing asset row ────────────────────────────────────────────────
-
-  it("skips (no grant, no send) when the config-referenced asset row is missing", async () => {
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(null);
-
-    await fulfillDeliverable(baseInput());
-
-    expect(prisma.deliverableGrant.create).not.toHaveBeenCalled();
-    expect(mockSendDeliverableEmail).not.toHaveBeenCalled();
-    // AC4: asset_missing is a pre-mint outcome — no grant exists to stamp.
-    expect(prisma.deliverableGrant.update).not.toHaveBeenCalled();
-    expect(mockLoggerInfo).toHaveBeenCalled();
-  });
-
-  // ── FEAT-074 U4b (#4718) D4 — the playbook: virtual asset ────────────────
-
-  function playbookConfigSnapshot() {
-    return {
-      slug: "targeting-maturity",
-      defaultLocale: "en",
-      steps: [],
-      deliverables: {
-        assets: [{ assetKey: "playbook:targeting-maturity" }],
-        copy: {
-          subject: en("Your Playbook is ready"),
-          body: en("Your Playbook is ready to download."),
-        },
-      },
-    };
-  }
-
-  it("skips the DeliverableAsset lookup and mints the grant with assetId = entry.assetKey when a PlaybookInstance exists (AC-3)", async () => {
-    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue({
-      id: "pbk_00000000-0000-7000-8000-0000000000p1",
-    });
-
-    await fulfillDeliverable(
-      baseInput({ segment: undefined, configSnapshot: playbookConfigSnapshot() }),
-    );
-
-    expect(prisma.playbookInstance.findFirst).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: {
-          siteId: SITE_ID,
-          // #6257 — the playbook existence check is fenced too.
-          workspaceId: SITE_ID,
-          leadId: LEAD_ID,
-          experimentKey: "targeting-maturity",
-        },
-      }),
-    );
-    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
-    // AC-3: EXACTLY one grant -- toHaveBeenCalledTimes, not merely
-    // toHaveBeenCalledWith (which would pass even on a second, unasserted
-    // call).
-    expect(prisma.deliverableGrant.create).toHaveBeenCalledTimes(1);
-    expect(prisma.deliverableGrant.create).toHaveBeenCalledWith(
-      expect.objectContaining({
-        data: expect.objectContaining({
-          siteId: SITE_ID,
-          assetId: "playbook:targeting-maturity",
-          leadId: LEAD_ID,
-          sessionId: SESSION_ID,
-        }),
-      }),
-    );
-    // AC-3: the send-and-stamp tail reaches sendStatus = sent WITH the
-    // /v1/deliverables/<grantId> link -- asserted on the actual email call,
-    // not merely "an email was sent."
-    expect(mockSendDeliverableEmail).toHaveBeenCalledTimes(1);
-    expect(mockSendDeliverableEmail).toHaveBeenCalledWith(
-      expect.objectContaining({
-        downloadLink: `https://api.example.com/v1/deliverables/${GRANT_ID}`,
-      }),
-    );
-    expect(prisma.deliverableGrant.update).toHaveBeenCalledWith({
-      where: { id: GRANT_ID },
-      data: { sendStatus: "sent", sendAt: expect.any(Date) },
-    });
-  });
-
-  it("logs playbook_missing, mints no grant, and sends no email when the lead has no PlaybookInstance (AC-4)", async () => {
-    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue(null);
-
-    await fulfillDeliverable(
-      baseInput({ segment: undefined, configSnapshot: playbookConfigSnapshot() }),
-    );
-
-    expect(prisma.deliverableGrant.create).not.toHaveBeenCalled();
-    expect(mockSendDeliverableEmail).not.toHaveBeenCalled();
-    // playbook_missing is a pre-mint outcome — no grant exists to stamp
-    // (the same posture as asset_missing).
-    expect(prisma.deliverableGrant.update).not.toHaveBeenCalled();
-    expect(mockLoggerInfo).toHaveBeenCalledWith(
-      expect.objectContaining({
-        siteId: SITE_ID,
-        sessionId: SESSION_ID,
-        outcome: "playbook_missing",
-      }),
-      expect.any(String),
-    );
-  });
-
-  it("an ordinary (non-playbook:) assetKey never queries playbookInstance (no false-positive branch)", async () => {
-    await fulfillDeliverable(baseInput());
-
-    expect(prisma.playbookInstance.findFirst).not.toHaveBeenCalled();
-    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalled();
-  });
-
-  it("a playbook: deliverable issues zero Asset or FlowDefinition reads (#6310 FR8)", async () => {
-    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue({
-      id: "pbk_00000000-0000-7000-8000-0000000000p1",
-    });
-
-    await fulfillDeliverable(
-      baseInput({ segment: undefined, configSnapshot: playbookConfigSnapshot() }),
-    );
-
-    expect(prisma.flowDefinition.findUnique).not.toHaveBeenCalled();
-    expect(prisma.asset.findFirst).not.toHaveBeenCalled();
-  });
-
-  // ── #6310 D1/D2/D4/D5/D15 — Asset-first resolution ───────────────────────
-
-  const WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
-  const OTHER_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000002";
-  const NEW_ASSET_ID = "asset_00000000-0000-7000-8000-0000000000b1";
-
-  it("resolves against the workspace Asset store first, and mints the grant with the asset_ id AND workspaceId (D1/D2/D15)", async () => {
-    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
-      workspaceId: WORKSPACE_ID,
-    });
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: NEW_ASSET_ID, tags: [] });
-
-    await fulfillDeliverable(baseInput());
-
-    expect(prisma.flowDefinition.findUnique).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: { siteId_slug: { siteId: SITE_ID, slug: "get-a-quote" } },
-        select: { workspaceId: true },
-      }),
-    );
-    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
-      where: { workspaceId: WORKSPACE_ID, key: "guide-small" },
-      select: { id: true, tags: true },
-    });
-    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
-    expect(prisma.deliverableGrant.create).toHaveBeenCalledWith(
-      expect.objectContaining({
-        data: expect.objectContaining({
-          siteId: SITE_ID,
-          assetId: NEW_ASSET_ID,
-          workspaceId: WORKSPACE_ID,
-          leadId: LEAD_ID,
-          sessionId: SESSION_ID,
-        }),
-      }),
-    );
-  });
-
-  it("falls back to the legacy DeliverableAsset store on an Asset miss, and mints a grant with NO workspaceId (D2/D3)", async () => {
-    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
-      workspaceId: WORKSPACE_ID,
-    });
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
-
-    await fulfillDeliverable(baseInput());
-
-    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: {
-          siteId_key: { siteId: SITE_ID, key: "guide-small" },
-          // #6257 — the legacy store's read is fenced by the same resolved
-          // workspace id the grant is minted under.
-          workspaceId: SITE_ID,
-        },
-      }),
-    );
-    const [[createArgs]] = (prisma.deliverableGrant.create as jest.Mock).mock
-      .calls as [[{ data: Record<string, unknown> }]];
-    expect(createArgs.data["assetId"]).toBe(
-      "dasset_00000000-0000-7000-8000-0000000000a1",
-    );
-    // #6374 D4 / AC-8 — this mint site now ALWAYS stamps `workspaceId`,
-    // including on the legacy `dasset_` arm this test exercises, and the
-    // value is the grant's own `siteId`. NULL remains the sentinel for the
-    // rows that already EXIST (the migration touches none of them); it is no
-    // longer the sentinel for a row this code mints, because a mint always
-    // knows its workspace. The download route is unaffected: it branches on
-    // the `assetId` PREFIX and consults `workspaceId` only on the `asset_`
-    // arm.
-    expect(createArgs.data["workspaceId"]).toBe(createArgs.data["siteId"]);
-    expect(createArgs.data["workspaceId"]).toBe(SITE_ID);
-  });
-
-  it("prefers the Asset match over an existing legacy DeliverableAsset row at the SAME key (D2 order)", async () => {
-    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
-      workspaceId: WORKSPACE_ID,
-    });
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: NEW_ASSET_ID, tags: [] });
-    // beforeEach's default deliverableAsset.findUnique mock already resolves
-    // a row at this key — it must never even be consulted.
-
-    await fulfillDeliverable(baseInput());
-
-    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
-    expect(prisma.deliverableGrant.create).toHaveBeenCalledWith(
-      expect.objectContaining({
-        data: expect.objectContaining({ assetId: NEW_ASSET_ID }),
-      }),
-    );
-  });
-
-  it("skips the Asset lookup entirely when the definition's workspaceId is null — never guesses one (D5)", async () => {
-    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
-      workspaceId: null,
-    });
-
-    await fulfillDeliverable(baseInput());
-
-    expect(prisma.asset.findFirst).not.toHaveBeenCalled();
-    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalled();
-  });
-
-  it("skips the Asset lookup entirely when no FlowDefinition row resolves (D5)", async () => {
-    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue(null);
-
-    await fulfillDeliverable(baseInput());
-
-    expect(prisma.asset.findFirst).not.toHaveBeenCalled();
-    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalled();
-  });
-
-  it("mints no grant and logs asset_missing when NEITHER store resolves the key", async () => {
-    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
-      workspaceId: WORKSPACE_ID,
-    });
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(null);
-
-    await fulfillDeliverable(baseInput());
-
-    expect(prisma.deliverableGrant.create).not.toHaveBeenCalled();
-    expect(mockLoggerInfo).toHaveBeenCalledWith(
-      expect.objectContaining({ outcome: "asset_missing" }),
-      expect.any(String),
-    );
-  });
-
-  // ── #8848 D3 — the minted grant id, and a deliverable flow's Asset-only store ──
-
-  it("resolves { grantId } equal to the created row's id on a successful mint", async () => {
-    await expect(fulfillDeliverable(baseInput())).resolves.toEqual({ grantId: GRANT_ID });
-  });
-
-  it("resolves undefined on the asset_missing path", async () => {
-    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({ workspaceId: WORKSPACE_ID });
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(null);
-
-    await expect(fulfillDeliverable(baseInput())).resolves.toBeUndefined();
-  });
-
-  it("a gated file snapshot whose key names only a legacy DeliverableAsset mints no grant (SEC-8848-B)", async () => {
-    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({ workspaceId: WORKSPACE_ID });
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
-    const configSnapshot = {
-      ...baseConfigSnapshot(),
-      deliverables: { ...deliverablesBlock(), assets: [{ assetKey: "listing-acme-2026-10-12" }] },
-      deliverable: { kind: "file", gated: true, title: en("Q3"), geometry: "letter", pages: 3 },
-    };
-
-    await expect(
-      fulfillDeliverable(baseInput({ segment: undefined, configSnapshot })),
-    ).resolves.toBeUndefined();
-
-    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
-    expect(prisma.deliverableGrant.create).not.toHaveBeenCalled();
-    expect(mockLoggerInfo).toHaveBeenCalledWith(
-      expect.objectContaining({ outcome: "asset_missing" }),
-      expect.any(String),
-    );
-  });
-
-  it("the same legacy-only key on a flow with no deliverable block still mints (NFR1)", async () => {
-    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({ workspaceId: WORKSPACE_ID });
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
-    const configSnapshot = {
-      ...baseConfigSnapshot(),
-      deliverables: { ...deliverablesBlock(), assets: [{ assetKey: "listing-acme-2026-10-12" }] },
-    };
-
-    await expect(
-      fulfillDeliverable(baseInput({ segment: undefined, configSnapshot })),
-    ).resolves.toEqual({ grantId: GRANT_ID });
-    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalled();
-  });
-
-  it("never reaches a key that exists only in ANOTHER workspace (NFR3) — the lookup is scoped to this flow's own workspaceId alone", async () => {
-    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
-      workspaceId: WORKSPACE_ID,
-    });
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(null);
-
-    await fulfillDeliverable(baseInput());
-
-    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
-      where: { workspaceId: WORKSPACE_ID, key: "guide-small" },
-      select: { id: true, tags: true },
-    });
-    expect(prisma.asset.findFirst).not.toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: expect.objectContaining({ workspaceId: OTHER_WORKSPACE_ID }),
-      }),
-    );
-  });
-
-  // ── D5 — grant mint ───────────────────────────────────────────────────────
-
-  it("mints the grant with assetId/leadId/sessionId", async () => {
-    await fulfillDeliverable(baseInput());
-
-    expect(prisma.deliverableGrant.create).toHaveBeenCalledWith(
-      expect.objectContaining({
-        data: expect.objectContaining({
-          siteId: SITE_ID,
-          assetId: "dasset_00000000-0000-7000-8000-0000000000a1",
-          leadId: LEAD_ID,
-          sessionId: SESSION_ID,
-        }),
-      }),
-    );
-  });
-
-  // ── AC5 — mint-before-send is preserved (regression floor) ──────────────
-
-  it("still calls deliverableGrant.create before sendDeliverableEmail (AC5)", async () => {
-    await fulfillDeliverable(baseInput());
-
-    const createOrder = (prisma.deliverableGrant.create as jest.Mock).mock
-      .invocationCallOrder[0];
-    const sendOrder = mockSendDeliverableEmail.mock.invocationCallOrder[0];
-    expect(createOrder).toBeLessThan(sendOrder);
-  });
-
-  // ── AC4 — the three post-mint outcomes all stamp ─────────────────────────
-
-  it("stamps sendStatus: 'sent' + a non-null sendAt on a successful send", async () => {
-    await fulfillDeliverable(baseInput());
-
-    expect(prisma.deliverableGrant.update).toHaveBeenCalledWith({
-      where: { id: GRANT_ID },
-      data: { sendStatus: "sent", sendAt: expect.any(Date) },
-    });
-  });
-
-  // ── AC2 — link = base + grant id, no PII ────────────────────────────────
-
-  it("builds the download link from AILK_PUBLIC_API_URL + the grant id, with no PII", async () => {
-    await fulfillDeliverable(baseInput({ email: "lead-with-pii@example.com" }));
-
-    const [call] = mockSendDeliverableEmail.mock.calls;
-    expect(call[0].downloadLink).toBe(
-      `https://api.example.com/v1/deliverables/${GRANT_ID}`,
-    );
-    expect(call[0].downloadLink).not.toContain("lead-with-pii@example.com");
-    expect(call[0].downloadLink).not.toContain(LEAD_ID);
-  });
-
-  it("sends to the lead's email (recipient)", async () => {
-    await fulfillDeliverable(baseInput());
-
-    const [call] = mockSendDeliverableEmail.mock.calls;
-    expect(call[0].to).toBe("lead@example.com");
-  });
-
-  // ── D7 — copy resolution at locale, with defaultLocale fallback ────────────
-
-  it("resolves copy at the completion request's locale", async () => {
-    const configSnapshot = {
-      ...baseConfigSnapshot(),
-      deliverables: {
-        assets: [{ assetKey: "guide-default" }],
-        copy: {
-          subject: { en: "Here's your guide", "pt-BR": "Aqui está seu guia" },
-          body: {
-            en: "Thanks — your download is attached.",
-            "pt-BR": "Obrigado — seu download está anexado.",
-          },
-        },
-      },
-    };
-
-    await fulfillDeliverable(
-      baseInput({ configSnapshot, locale: "pt-BR", segment: undefined }),
-    );
-
-    const [call] = mockSendDeliverableEmail.mock.calls;
-    expect(call[0].subject).toBe("Aqui está seu guia");
-    expect(call[0].body).toBe("Obrigado — seu download está anexado.");
-  });
-
-  it("falls back to defaultLocale when the completion locale has no copy key", async () => {
-    const configSnapshot = {
-      ...baseConfigSnapshot(),
-      deliverables: {
-        assets: [{ assetKey: "guide-default" }],
-        copy: {
-          subject: { en: "Here's your guide" },
-          body: { en: "Thanks — your download is attached." },
-        },
-      },
-    };
-
-    await fulfillDeliverable(
-      baseInput({ configSnapshot, locale: "fr", segment: undefined }),
-    );
-
-    const [call] = mockSendDeliverableEmail.mock.calls;
-    expect(call[0].subject).toBe("Here's your guide");
-  });
-
-  it("resolves cta when present", async () => {
-    const configSnapshot = {
-      ...baseConfigSnapshot(),
-      deliverables: {
-        assets: [{ assetKey: "guide-default" }],
-        copy: {
-          subject: en("Here's your guide"),
-          body: en("Thanks — your download is attached."),
-          cta: en("Download now"),
-        },
-      },
-    };
-
-    await fulfillDeliverable(baseInput({ configSnapshot, segment: undefined }));
-
-    const [call] = mockSendDeliverableEmail.mock.calls;
-    expect(call[0].cta).toBe("Download now");
-  });
-
-  // ── sender-env fallback chain ────────────────────────────────────────────
-
-  it("uses AILK_DELIVERABLE_EMAIL_FROM when set", async () => {
-    process.env["AILK_DELIVERABLE_EMAIL_FROM"] = "deliverable@example.com";
-
-    await fulfillDeliverable(baseInput());
-
-    const [call] = mockSendDeliverableEmail.mock.calls;
-    expect(call[0].fromAddress).toBe("deliverable@example.com");
-  });
-
-  it("falls back to AILK_LEAD_NOTIFICATION_FROM when AILK_DELIVERABLE_EMAIL_FROM is unset", async () => {
-    delete process.env["AILK_DELIVERABLE_EMAIL_FROM"];
-    process.env["AILK_LEAD_NOTIFICATION_FROM"] = "owner-noreply@example.com";
-
-    await fulfillDeliverable(baseInput());
-
-    const [call] = mockSendDeliverableEmail.mock.calls;
-    expect(call[0].fromAddress).toBe("owner-noreply@example.com");
-  });
-
-  it("skips the send (grant NOT wasted) when neither from-address env is set", async () => {
-    delete process.env["AILK_DELIVERABLE_EMAIL_FROM"];
-    delete process.env["AILK_LEAD_NOTIFICATION_FROM"];
-
-    await fulfillDeliverable(baseInput());
-
-    expect(prisma.deliverableGrant.create).toHaveBeenCalled();
-    expect(mockSendDeliverableEmail).not.toHaveBeenCalled();
-    expect(mockLoggerInfo).toHaveBeenCalled();
-    // AC4: sender_unconfigured is a post-mint outcome — it stamps too.
-    expect(prisma.deliverableGrant.update).toHaveBeenCalledWith({
-      where: { id: GRANT_ID },
-      data: { sendStatus: "sender_unconfigured", sendAt: expect.any(Date) },
-    });
-  });
-
-  // ── D4 — no deliverables block: opt-in per flow ─────────────────────────
-
-  it("does nothing when configSnapshot.deliverables is absent (opt-in per flow)", async () => {
-    await fulfillDeliverable(
-      baseInput({
-        configSnapshot: { ...baseConfigSnapshot(), deliverables: undefined },
-      }),
-    );
-
-    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
-    expect(prisma.deliverableGrant.create).not.toHaveBeenCalled();
-    expect(mockSendDeliverableEmail).not.toHaveBeenCalled();
-  });
-
-  // ── PII-safe logging ─────────────────────────────────────────────────────
-
-  it("never logs email or copy values", async () => {
-    delete process.env["AILK_DELIVERABLE_EMAIL_FROM"];
-    delete process.env["AILK_LEAD_NOTIFICATION_FROM"];
-
-    await fulfillDeliverable(baseInput({ email: "sentinel-pii@example.com" }));
-
-    const allLogCalls = [
-      ...mockLoggerInfo.mock.calls,
-      ...mockLoggerWarn.mock.calls,
-      ...mockLoggerError.mock.calls,
-    ];
-    for (const call of allLogCalls) {
-      expect(JSON.stringify(call)).not.toContain("sentinel-pii@example.com");
-    }
-  });
-
-  // ── Email send failure — logged, not thrown ──────────────────────────────
-
-  it("logs (does not throw) when the email send fails", async () => {
-    mockSendDeliverableEmail.mockResolvedValue({
-      ok: false,
-      error: { kind: "send_failed", message: "Resend down" },
-    });
-
-    await expect(fulfillDeliverable(baseInput())).resolves.toEqual({ grantId: GRANT_ID });
-    expect(mockLoggerInfo).toHaveBeenCalled();
-    // AC4: send_failed is a post-mint outcome — it stamps too.
-    expect(prisma.deliverableGrant.update).toHaveBeenCalledWith({
-      where: { id: GRANT_ID },
-      data: { sendStatus: "send_failed", sendAt: expect.any(Date) },
-    });
-  });
-
-  // ── #3998 D5 — a stamp failure is caught, never escalated ────────────────
-
-  it("does not throw when the stamp write itself rejects", async () => {
-    (prisma.deliverableGrant.update as jest.Mock).mockRejectedValue(
-      new Error("connection reset"),
-    );
-
-    await expect(fulfillDeliverable(baseInput())).resolves.toEqual({ grantId: GRANT_ID });
-    expect(mockSendDeliverableEmail).toHaveBeenCalled();
-    expect(mockLoggerWarn).toHaveBeenCalledWith(
-      expect.objectContaining({ grantId: GRANT_ID, outcome: "sent" }),
-      expect.any(String),
-    );
-  });
-});
-
-// ─── #6257 — the fence: every fenced read carries workspaceId ───────────────
-
-/**
- * Unit C2's contract for this service (#6257 AC-1/AC-2). Three of its reads
- * are workspace-scopable and are scoped here; the rest are keyed on the grant
- * id itself — the capability token — and carry a global-key marker comment
- * at the call site instead.
- *
- * `fulfillDeliverable`'s `siteId` is the session's own, resolved before it
- * reaches this service (#6254/#6374 AC-7); `listSendlessGrants` takes an
- * OPERATOR-SUPPLIED alias off the `deliverable:resend` CLI, so it resolves
- * that alias itself and fails closed when it names no workspace.
- */
-describe("#6257 — every fenced read carries workspaceId", () => {
-  const originalEnv = process.env;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    process.env = {
-      ...originalEnv,
-      AILK_PUBLIC_API_URL: "https://api.example.com",
-      AILK_DELIVERABLE_EMAIL_FROM: "deliverable-default@example.com",
-    };
-    mockSendDeliverableEmail.mockResolvedValue({ ok: true, messageId: "msg-test" });
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue({
-      id: "dasset_00000000-0000-7000-8000-0000000000a1",
-      siteId: SITE_ID,
-      key: "guide-small",
-    });
-    (prisma.deliverableGrant.create as jest.Mock).mockResolvedValue({ id: GRANT_ID });
-    (prisma.deliverableGrant.update as jest.Mock).mockResolvedValue({ id: GRANT_ID });
-    (prisma.deliverableGrant.findMany as jest.Mock).mockResolvedValue([]);
-  });
-
-  afterEach(() => {
-    process.env = originalEnv;
-  });
-
-  it("scopes the LEGACY DeliverableAsset lookup by the session's workspace id", async () => {
-    await fulfillDeliverable(baseInput());
-
-    const { where } = (prisma.deliverableAsset.findUnique as jest.Mock).mock.calls[0][0];
-    expect(where.workspaceId).toBe(SITE_ID);
-    expect(where.siteId_key).toEqual({ siteId: SITE_ID, key: "guide-small" });
-  });
-
-  it("scopes the PlaybookInstance existence check by the session's workspace id", async () => {
-    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue({ id: "pbk_1" });
-
-    await fulfillDeliverable(
-      baseInput({
-        segment: undefined,
-        configSnapshot: {
-          slug: "get-a-quote",
-          defaultLocale: "en",
-          steps: [],
-          deliverables: {
-            assets: [{ assetKey: "playbook:targeting-maturity" }],
-            copy: { subject: en("x"), body: en("y") },
-          },
-        },
-      }),
-    );
-
-    expect(
-      (prisma.playbookInstance.findFirst as jest.Mock).mock.calls[0][0].where.workspaceId,
-    ).toBe(SITE_ID);
-  });
-
-  it("listSendlessGrants resolves the CLI alias and scopes the list by the RESOLVED workspace id", async () => {
-    // The `"default"` alias resolves to the seeded sentinel workspace — the
-    // list must be scoped by THAT id, never by the alias string the operator
-    // typed on the command line. Passing the alias and asserting the SENTINEL
-    // id back is what discriminates a resolution from a passthrough: a test
-    // that passed the workspace id as the alias would assert the same string
-    // either way and could not fail (security review, round 1).
-    (prisma.workspace.findUnique as jest.Mock).mockImplementation(
-      async ({ where }: { where: { id: string } }) =>
-        where.id === SENTINEL_WORKSPACE_ID
-          ? { id: SENTINEL_WORKSPACE_ID, organizationId: SENTINEL_ORGANIZATION_ID }
-          : null,
-    );
-
-    await listSendlessGrants({ siteId: "default" });
-
-    const { where } = (prisma.deliverableGrant.findMany as jest.Mock).mock.calls[0][0];
-    expect(where.workspaceId).toBe(SENTINEL_WORKSPACE_ID);
-    expect(where.siteId).toBe(SENTINEL_WORKSPACE_ID);
-    expect(where.workspaceId).not.toBe("default");
-    expect(where.sendStatus).toBeNull();
-  });
-
-  it("listSendlessGrants fails closed on an alias that resolves to no workspace", async () => {
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue(null);
-
-    await expect(listSendlessGrants({ siteId: "no-such-site" })).resolves.toEqual([]);
-    expect(prisma.deliverableGrant.findMany).not.toHaveBeenCalled();
-  });
-});