create-ailk 0.24.0 → 0.26.0

package/templates/apps/mcp/__tests__/start_purchase.test.ts

@@ -1,448 +0,0 @@
-/**
- * `start_purchase` — the MCP half of the API↔MCP parity proof (#5971 D7),
- * plus FR-1 and FR-2, rewritten for #6001's redirect fix.
- *
- * `apps/api` cannot import `apps/mcp` and vice versa, so neither side can
- * call the other in a test. The evidence is the SHARED SEAM asserted from
- * both ends — `CreateSessionPayload` / `CheckoutSessionResponse` in
- * `packages/api-client/src/checkout.ts`:
- *
- *   here          — the tool calls `checkout.createSession` with EXACTLY the
- *                   payload object the route validates, and its return value
- *                   deep-equals `{ url }` from the seam;
- *   the API end    — `apps/api/src/routes/checkout/__tests__/sessions.test.ts`
- *                   § "parity with the payload the MCP tool builds (#5971)"
- *                   feeds that same payload to the route and pins its reply.
- *
- * Idiom: `apps/mcp/__tests__/search_content.test.ts`, the worked example root
- * `CLAUDE.md` § API ↔ MCP parity names.
- *
- * #6001: three security reviews on PR #5991 (two High, one Medium) found
- * that an anonymous MCP caller could forward its own successUrl/cancelUrl to
- * `checkout.createSession` — the payment succeeds so no fraud signal fires,
- * making it a phishing-amplification open redirect off the seller's real
- * checkout — and that `allowPromotionCodes` had no reason to be
- * caller-controlled on an anonymous surface either. The tool now validates
- * against `purchaseMcpInputSchema` (a strict productCode+quantity-only pick
- * of the shared schema), so it can never build a payload containing a
- * caller-supplied redirect: both `successUrl` and `cancelUrl` are ALWAYS
- * derived from `AILK_BASE_URL`, and `allowPromotionCodes` is never forwarded.
- *
- * Nothing here reaches Stripe or a licence server (NFR-6).
- */
-
-import { checkout } from "@working-theory/api-client";
-import { getMcpToolCatalog } from "@working-theory/metadata";
-import { purchaseMcpInputSchema } from "@working-theory/validation";
-
-import {
-  __setMcpCommerceClaimForTest,
-  resetMcpCommerceClaim,
-} from "../src/lib/commerce-claim.js";
-import { ailkPurchase } from "../src/tools/purchase.js";
-
-jest.mock("@working-theory/api-client", () => ({
-  checkout: { createSession: jest.fn() },
-}));
-
-const createSession = checkout.createSession as jest.MockedFunction<
-  typeof checkout.createSession
->;
-
-const HOSTED_URL = "https://checkout.stripe.com/c/pay/cs_test_abc123";
-
-function sessionCreated() {
-  return {
-    ok: true as const,
-    body: { sessionId: "cs_test_abc123", url: HOSTED_URL },
-  };
-}
-
-beforeEach(() => {
-  __setMcpCommerceClaimForTest("claimed");
-  process.env.AILK_BASE_URL = "https://example.com";
-});
-
-afterEach(() => {
-  jest.clearAllMocks();
-  resetMcpCommerceClaim();
-  delete process.env.AILK_BASE_URL;
-});
-
-describe("start_purchase — parity with the payload POST /v1/checkout/sessions takes (#5971, #6001)", () => {
-  it("calls checkout.createSession with EXACTLY the route's payload shape, redirects derived — never caller-supplied", async () => {
-    createSession.mockResolvedValueOnce(sessionCreated());
-
-    await ailkPurchase({
-      productCode: "growth_monthly",
-      quantity: 2,
-    });
-
-    expect(createSession).toHaveBeenCalledTimes(1);
-    expect(createSession).toHaveBeenCalledWith({
-      productCode: "growth_monthly",
-      quantity: 2,
-      successUrl:
-        "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
-      cancelUrl: "https://example.com/purchase/cancel",
-    });
-  });
-
-  it("omits quantity entirely when it is not supplied", async () => {
-    createSession.mockResolvedValueOnce(sessionCreated());
-
-    await ailkPurchase({ productCode: "growth_monthly" });
-
-    const payload = createSession.mock.calls[0]![0];
-    expect(payload).not.toHaveProperty("quantity");
-    expect(payload).not.toHaveProperty("allowPromotionCodes");
-  });
-
-  it("derives both redirect URLs from AILK_BASE_URL — always, not only when omitted (#6001)", async () => {
-    createSession.mockResolvedValueOnce(sessionCreated());
-
-    await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(createSession).toHaveBeenCalledWith({
-      productCode: "growth_monthly",
-      successUrl:
-        "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
-      cancelUrl: "https://example.com/purchase/cancel",
-    });
-  });
-});
-
-describe("start_purchase — FR-1: the hosted Checkout URL", () => {
-  it("returns { url } deep-equal to the seam's url, and nothing else", async () => {
-    createSession.mockResolvedValueOnce(sessionCreated());
-
-    const result = await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(result).toEqual({ url: HOSTED_URL });
-  });
-
-  it("does NOT surface the route's sessionId (D5 — it identifies a buyer's session)", async () => {
-    createSession.mockResolvedValueOnce(sessionCreated());
-
-    const result = await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(result).not.toHaveProperty("sessionId");
-  });
-
-  it("the URL it returns is Stripe-hosted — nothing is charged in-tool", async () => {
-    createSession.mockResolvedValueOnce(sessionCreated());
-
-    const result = await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect((result as { url: string }).url).toMatch(
-      /^https:\/\/checkout\.stripe\.com\//,
-    );
-  });
-});
-
-describe("start_purchase — FR-2: an unknown offering", () => {
-  it("does NOT echo the caller's product code back (route invariant parity)", async () => {
-    createSession.mockResolvedValueOnce({
-      ok: false as const,
-      status: 404,
-      body: { error: "unknown-product-code" },
-    });
-
-    const result = await ailkPurchase({ productCode: "no-such-offering_monthly" });
-
-    // The HTTP twin states and tests "Error responses never echo user input";
-    // parity means the pair answers alike (#5971 security review, Low).
-    expect(JSON.stringify(result)).not.toContain("no-such-offering");
-  });
-
-  it("returns a typed not_found body rather than throwing", async () => {
-    createSession.mockResolvedValueOnce({
-      ok: false as const,
-      status: 404,
-      body: { error: "unknown-product-code" },
-    });
-
-    const result = await ailkPurchase({ productCode: "no-such-offering_monthly" });
-
-    expect(result).toMatchObject({ error: "not_found" });
-  });
-
-  it("makes exactly one call — createSession — and reaches no Stripe stub", async () => {
-    createSession.mockResolvedValueOnce({
-      ok: false as const,
-      status: 404,
-      body: { error: "unknown-product-code" },
-    });
-
-    await ailkPurchase({ productCode: "no-such-offering_monthly" });
-
-    expect(createSession).toHaveBeenCalledTimes(1);
-  });
-
-  it("maps a non-404 route failure to a typed body too", async () => {
-    createSession.mockResolvedValueOnce({
-      ok: false as const,
-      status: 502,
-      body: { error: "checkout-unavailable" },
-    });
-
-    const result = await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-  });
-});
-
-describe("start_purchase — invalid input never reaches the seam", () => {
-  it("rejects a product code the route's regex would reject", async () => {
-    const result = await ailkPurchase({ productCode: "has spaces" });
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("rejects a quantity above the route's maximum", async () => {
-    const result = await ailkPurchase({
-      productCode: "pro-plan",
-      quantity: 1000,
-    });
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-});
-
-describe("start_purchase — the redirect fix (#6001): a caller-supplied redirect fails validation, not merely gets ignored", () => {
-  it("rejects a call carrying a caller-supplied successUrl — even a plausible-looking one, not just javascript:", async () => {
-    const result = await ailkPurchase({
-      productCode: "pro-plan",
-      successUrl: "https://attacker.example/phish",
-    } as never);
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("rejects a javascript: redirect URL exactly as the route would — via the same rejection path as any other successUrl", async () => {
-    const result = await ailkPurchase({
-      productCode: "pro-plan",
-      successUrl: "javascript:alert(1)",
-    } as never);
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("rejects a call carrying a caller-supplied cancelUrl", async () => {
-    const result = await ailkPurchase({
-      productCode: "pro-plan",
-      cancelUrl: "https://attacker.example/cancelled",
-    } as never);
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("rejects a call carrying allowPromotionCodes", async () => {
-    const result = await ailkPurchase({
-      productCode: "pro-plan",
-      allowPromotionCodes: true,
-    } as never);
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-});
-
-// ── #8935 — the full Offerings lookup_key ───────────────────────────────────
-//
-// The tool takes a price by its full lookup_key (contract §3.7) and refuses an
-// ungrammatical one before any HTTP call, with the same not-found body every
-// route 404 maps to (A3, A5). The route decides the workspace and whether the
-// key is shown and org-enabled (A1, #8931); the mocked seam below answers with
-// the route's Offerings-path `201` body, `reply.status(201).send({ sessionId,
-// url })`. Spec: `docs/specs/8935-start-purchase-sells-a-named-spec.md`.
-
-const OFFERINGS_URL = "https://checkout.stripe.com/c/pay/cs_test_offerings";
-
-function offeringsSessionCreated() {
-  return {
-    ok: true as const,
-    body: { sessionId: "cs_test_offerings", url: OFFERINGS_URL },
-  };
-}
-
-const NOT_FOUND = {
-  error: "not_found",
-  message: "No offering matches that product code.",
-};
-
-describe("start_purchase — a shown, org-enabled lookup_key gets the route's hosted URL (#8935 AC-1)", () => {
-  const keys = [
-    "growth_monthly",
-    "growth_yearly",
-    "basic_once",
-    "samhenry-coaching_monthly",
-    `${"a".repeat(40)}_monthly`,
-  ];
-
-  it.each(keys)(
-    "%s reaches the route byte for byte and returns { url } only",
-    async (key) => {
-      createSession.mockResolvedValueOnce(offeringsSessionCreated());
-
-      const result = await ailkPurchase({ productCode: key });
-
-      expect(result).toEqual({ url: OFFERINGS_URL });
-      expect(result).not.toHaveProperty("sessionId");
-      expect(createSession).toHaveBeenCalledTimes(1);
-      // One argument, the payload — no init, so no header of the tool's own.
-      expect(createSession.mock.calls[0]).toHaveLength(1);
-      expect(createSession.mock.calls[0]![0]).toEqual({
-        productCode: key,
-        successUrl:
-          "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
-        cancelUrl: "https://example.com/purchase/cancel",
-      });
-    },
-  );
-
-  it("the 48-character key is the longest §3.7 allows", () => {
-    expect(keys[4]).toHaveLength(48);
-  });
-
-  it("forwards quantity alongside the key", async () => {
-    createSession.mockResolvedValueOnce(offeringsSessionCreated());
-
-    await ailkPurchase({ productCode: "growth_monthly", quantity: 2 });
-
-    expect(createSession.mock.calls[0]![0]).toEqual({
-      productCode: "growth_monthly",
-      quantity: 2,
-      successUrl:
-        "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
-      cancelUrl: "https://example.com/purchase/cancel",
-    });
-  });
-});
-
-describe("start_purchase — an ungrammatical key is refused before any call, with the route-404 body (#8935 AC-2)", () => {
-  const ungrammatical = [
-    "pro-plan",
-    "Growth_Monthly",
-    "growth_pro_monthly",
-    "wendi_retainer",
-    "growth_quarterly",
-    "growth_",
-    "_monthly",
-    `${"a".repeat(41)}_monthly`,
-  ];
-
-  it.each(ungrammatical)(
-    "%s passes the shared schema but answers not_found with no call and no echo",
-    async (key) => {
-      expect(purchaseMcpInputSchema.safeParse({ productCode: key }).success).toBe(
-        true,
-      );
-
-      const result = await ailkPurchase({ productCode: key });
-
-      expect(result).toEqual(NOT_FOUND);
-      expect(createSession).not.toHaveBeenCalled();
-      expect(JSON.stringify(result)).not.toContain(key);
-    },
-  );
-
-  it("the 49-character key is one past the §3.7 bound", () => {
-    expect(ungrammatical[7]).toHaveLength(49);
-  });
-
-  it.each([
-    ["{ error: unknown-product-code }", { error: "unknown-product-code" }],
-    ["null", null],
-    ["{}", {}],
-  ])(
-    "every route 404 maps to the same body, whatever the route's body (%s)",
-    async (_label, body) => {
-      createSession.mockResolvedValueOnce({
-        ok: false as const,
-        status: 404,
-        body,
-      } as never);
-
-      const result = await ailkPurchase({ productCode: "growth_monthly" });
-
-      expect(result).toEqual(NOT_FOUND);
-      expect(JSON.stringify(result)).not.toContain("growth_monthly");
-    },
-  );
-
-  it("the pre-call refusal and the route-404 mapping are one value", async () => {
-    const refused = await ailkPurchase({ productCode: "pro-plan" });
-    createSession.mockResolvedValueOnce({
-      ok: false as const,
-      status: 404,
-      body: { error: "unknown-product-code" },
-    });
-    const mapped = await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(refused).toEqual(mapped);
-  });
-
-  it("a code the route's regex refuses still answers validation_failed, with no call", async () => {
-    const result = await ailkPurchase({ productCode: "has spaces" });
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-});
-
-describe("start_purchase — the claim and the strict schema still answer first (#8935 AC-3)", () => {
-  it("an unclaimed site answers the module-disabled body for an ungrammatical key, with no call", async () => {
-    __setMcpCommerceClaimForTest("unclaimed");
-
-    const result = await ailkPurchase({ productCode: "Growth_Monthly" });
-
-    expect(result).toEqual({ error: "not_found", message: "Not found" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it.each(["workspaceId", "organizationId", "site", "metadata"])(
-    "a direct call carrying %s fails validation, with no call",
-    async (field) => {
-      const result = await ailkPurchase({
-        productCode: "growth_monthly",
-        [field]: "attacker-chosen",
-      } as never);
-
-      expect(result).toMatchObject({ error: "validation_failed" });
-      expect(createSession).not.toHaveBeenCalled();
-    },
-  );
-
-  it("the input schema has exactly productCode and quantity", () => {
-    expect(Object.keys(purchaseMcpInputSchema.shape)).toEqual([
-      "productCode",
-      "quantity",
-    ]);
-  });
-});
-
-describe("start_purchase — the catalog description names the lookup key (#8935 AC-5)", () => {
-  it("tells an agent to pass the lookupKey get_pricing or get_offerings returns", () => {
-    const entry = getMcpToolCatalog({ addons: { commerce: true } }).find(
-      (tool) => tool.name === "start_purchase",
-    );
-
-    expect(entry?.description).toBe(
-      "Start a purchase for an offering on this site. Provide the price's full lookup key as productCode — the lookupKey that get_pricing or get_offerings returns, such as growth_monthly — and an optional quantity; returns a Stripe-hosted Checkout URL for the buyer to complete payment on. Nothing is charged by this tool.",
-    );
-    for (const phrase of [
-      "lookupKey",
-      "get_pricing",
-      "get_offerings",
-      "Nothing is charged by this tool",
-    ]) {
-      expect(entry?.description).toContain(phrase);
-    }
-  });
-});

package/templates/apps/mcp/__tests__/submit_lead.test.ts

@@ -1,222 +0,0 @@
-/**
- * Tests for the capture_lead MCP tool handler.
- *
- * The tool takes the body `POST /v1/leads/submit` takes and returns the
- * route's 201 body (#7171 AC-11 — the tool adopted the API). Verified here:
- * 1. Malformed input → { ok: false, error: { kind: 'invalid_input', issues } }, api-client never called
- * 2. Happy path → posts exactly the parsed body to apiClient.leads.submit —
- *    no `siteId`, whatever AILK_SITE_ID says, and no stamped `source` — and
- *    returns the route's body unchanged, `email` included
- * 3. API 400 / 503 / 429 → { ok: false, error: { kind: 'api_error', status } }
- * 4. #7397 — the spoke marker `payload.site` from AILK_LEAD_SITE, spread last
- * 5. #8073 — forwards the trusted caller address + AILK_VISITOR_FORWARD_KEY
- *    as the two visitor-forwarding headers only when both are present
- */
-
-import {
-  LEAD_SITE_MARKER_KEY,
-  leadSubmitBodySchema,
-} from "@working-theory/validation";
-import { ailkCaptureLead } from "../src/tools/capture_lead.js";
-import { trustedCallerAddress } from "../src/request-context.js";
-
-// Mock @working-theory/api-client before importing the handler. Everything
-// but `apiClient.leads.submit` stays the ACTUAL implementation — in
-// particular `visitorForwardHeaders`, which `request-context.ts` (imported
-// above, for `trustedCallerAddress`) reads for real.
-jest.mock("@working-theory/api-client", () => {
-  const actual = jest.requireActual("@working-theory/api-client");
-  return {
-    ...actual,
-    apiClient: {
-      ...actual.apiClient,
-      leads: { ...actual.apiClient.leads, submit: jest.fn() },
-    },
-  };
-});
-
-
-const { apiClient } = require("@working-theory/api-client") as {
-  apiClient: { leads: { submit: jest.Mock } };
-};
-
-/** The route body, as an agent sends it. */
-const VALID_INPUT = {
-  source: "mcp",
-  email: "jane@example.com",
-  payload: { name: "Jane Smith", message: "I am interested in your services." },
-};
-
-/** The route's 201 body, as the api-client hands it back. */
-const WIRE = {
-  id: "lead_00000000-0000-7000-8000-0000000000d1",
-  persisted: "db",
-  email: { ok: true, messageId: "msg-1" },
-};
-
-beforeEach(() => {
-  jest.clearAllMocks();
-  // The exact-body assertions below assume no spoke marker (#7397).
-  delete process.env.AILK_LEAD_SITE;
-  delete process.env.AILK_SITE_ID;
-});
-
-describe("ailkCaptureLead — input validation", () => {
-  it("rejects malformed input (no source) without calling api-client", async () => {
-    const result = await ailkCaptureLead({ email: "not-an-email" } as never);
-
-    expect(result).toMatchObject({ ok: false, error: { kind: "invalid_input" } });
-    if (!result.ok && result.error.kind === "invalid_input") {
-      expect(result.error.issues.length).toBeGreaterThan(0);
-    }
-    expect(apiClient.leads.submit).not.toHaveBeenCalled();
-  });
-
-  it("admits the StepFlow envelope — email inside payload, none at the top level — as the route does", async () => {
-    apiClient.leads.submit.mockResolvedValueOnce({ ok: true, body: WIRE });
-    const envelope = { source: "step-flow", payload: { email: "env@example.com" } };
-
-    await ailkCaptureLead(envelope);
-
-    expect(apiClient.leads.submit).toHaveBeenCalledWith(envelope);
-  });
-});
-
-describe("ailkCaptureLead — happy path", () => {
-  it("posts exactly the parsed body and returns the route's body unchanged, email included", async () => {
-    apiClient.leads.submit.mockResolvedValueOnce({ ok: true, body: WIRE });
-
-    const result = await ailkCaptureLead(VALID_INPUT);
-
-    expect(apiClient.leads.submit).toHaveBeenCalledWith(VALID_INPUT);
-    expect(result).toEqual(WIRE);
-  });
-
-  it("never sends a siteId, whatever AILK_SITE_ID says, and strips one the agent sent", async () => {
-    process.env.AILK_SITE_ID = "site-abc";
-    apiClient.leads.submit.mockResolvedValueOnce({ ok: true, body: WIRE });
-
-    await ailkCaptureLead({ ...VALID_INPUT, siteId: "site-xyz" } as never);
-
-    expect(apiClient.leads.submit.mock.calls[0][0]).toEqual(VALID_INPUT);
-  });
-});
-
-describe("ailkCaptureLead — API error mapping", () => {
-  it.each([400, 503, 429])(
-    "maps API %i to { ok: false, error: { kind: 'api_error', status } }",
-    async (status) => {
-      apiClient.leads.submit.mockResolvedValueOnce({
-        ok: false,
-        status,
-        body: { error: "refused" },
-      });
-
-      const result = await ailkCaptureLead(VALID_INPUT);
-
-      expect(result).toEqual({ ok: false, error: { kind: "api_error", status } });
-    },
-  );
-});
-
-// #7397 — a spoke of a hub-and-spokes deployment is marked in the lead
-// PAYLOAD (`payload.site`). The marker comes from the MCP server's own env,
-// so an MCP-origin lead reaches the hub inbox attributed; it is the one key
-// the tool adds to the body the agent sent.
-describe("ailkCaptureLead — payload site marker (#7397)", () => {
-  it("names the marker key 'site', the key the issue's hub-and-spokes design names", () => {
-    expect(LEAD_SITE_MARKER_KEY).toBe("site");
-  });
-
-  it("spreads payload.site from AILK_LEAD_SITE LAST, over an agent's own value", async () => {
-    process.env.AILK_LEAD_SITE = "spoke-a.example";
-    apiClient.leads.submit.mockResolvedValueOnce({ ok: true, body: WIRE });
-
-    await ailkCaptureLead({
-      ...VALID_INPUT,
-      payload: { ...VALID_INPUT.payload, site: "agent-said" },
-    });
-
-    expect(apiClient.leads.submit).toHaveBeenCalledWith({
-      ...VALID_INPUT,
-      payload: { ...VALID_INPUT.payload, site: "spoke-a.example" },
-    });
-  });
-
-  it("marks a body the agent sent without a payload", async () => {
-    process.env.AILK_LEAD_SITE = "spoke-a.example";
-    apiClient.leads.submit.mockResolvedValueOnce({ ok: true, body: WIRE });
-
-    await ailkCaptureLead({ source: "mcp", email: "jane@example.com" });
-
-    const body = apiClient.leads.submit.mock.calls[0][0] as Record<string, unknown>;
-    expect(body["payload"]).toEqual({ site: "spoke-a.example" });
-    expect(leadSubmitBodySchema.safeParse(body).success).toBe(true);
-  });
-
-  it.each([
-    ["unset", undefined],
-    ["empty", ""],
-    ["whitespace only", "   "],
-  ])("sends the payload as it came when AILK_LEAD_SITE is %s", async (_label, value) => {
-    if (value !== undefined) process.env.AILK_LEAD_SITE = value;
-    apiClient.leads.submit.mockResolvedValueOnce({ ok: true, body: WIRE });
-
-    await ailkCaptureLead(VALID_INPUT);
-
-    expect(apiClient.leads.submit.mock.calls[0][0]).toEqual(VALID_INPUT);
-  });
-
-  it("trims surrounding whitespace from AILK_LEAD_SITE", async () => {
-    process.env.AILK_LEAD_SITE = "  spoke-a.example\n";
-    apiClient.leads.submit.mockResolvedValueOnce({ ok: true, body: WIRE });
-
-    await ailkCaptureLead(VALID_INPUT);
-
-    const call = apiClient.leads.submit.mock.calls[0][0] as { payload: Record<string, unknown> };
-    expect(call.payload["site"]).toBe("spoke-a.example");
-  });
-});
-
-describe("ailkCaptureLead — visitor-forwarding headers (#8073)", () => {
-  afterEach(() => {
-    delete process.env.AILK_VISITOR_FORWARD_KEY;
-  });
-
-  it("calls api-client with exactly one argument when there is no trusted address", async () => {
-    apiClient.leads.submit.mockResolvedValueOnce({ ok: true, body: WIRE });
-    process.env.AILK_VISITOR_FORWARD_KEY = "spoke-key";
-
-    await ailkCaptureLead(VALID_INPUT);
-
-    expect(apiClient.leads.submit.mock.calls[0]).toHaveLength(1);
-  });
-
-  it("forwards the trusted address and the forward key as the two visitor headers", async () => {
-    apiClient.leads.submit.mockResolvedValueOnce({ ok: true, body: WIRE });
-    process.env.AILK_VISITOR_FORWARD_KEY = "spoke-key";
-
-    await trustedCallerAddress.run("203.0.113.9", () =>
-      ailkCaptureLead(VALID_INPUT),
-    );
-
-    const init = apiClient.leads.submit.mock.calls[0][1] as
-      | { headers?: Record<string, string> }
-      | undefined;
-    expect(init?.headers).toEqual({
-      "x-ailk-visitor-ip": "203.0.113.9",
-      "x-ailk-visitor-forward-key": "spoke-key",
-    });
-  });
-
-  it("sends no headers when there is a trusted address but no forward key", async () => {
-    apiClient.leads.submit.mockResolvedValueOnce({ ok: true, body: WIRE });
-    delete process.env.AILK_VISITOR_FORWARD_KEY;
-
-    await trustedCallerAddress.run("203.0.113.9", () =>
-      ailkCaptureLead(VALID_INPUT),
-    );
-
-    expect(apiClient.leads.submit.mock.calls[0]).toHaveLength(1);
-  });
-});