create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/routes/project-listings/__tests__/drafts.test.ts

@@ -1,1268 +0,0 @@
-// Not marked oss: false (D-48/#5366 escalation) — tests the
-// always-shipping project-listings anonymous surface; see
-// routes/project-listings/me.ts's header comment.
-/**
- * @file drafts.test.ts
- *
- * THE ACCEPTANCE GATE for the draft lifecycle (#5036 D1/D7) — the three
- * anonymous routes that replaced the single `POST /v1/project-listings`
- * create: `start`, `patch` and `submit`.
- *
- * Real routes and real services, mocked `lib/prisma.js` backed by a small
- * in-memory row store, so a patch genuinely WRITES and a later read genuinely
- * READS BACK. A `jest.fn()` returning a canned object could not tell a
- * round-trip from a no-op, and the round-trip is the thing under test.
- * `routeLead` runs for real against a per-test temp path
- * (`setupLeadFileEnv`), matching the create test's discipline before it;
- * `@working-theory/email` and `@working-theory/license` stay mocked (external
- * package boundaries — see docs/lessons/project-listings/02).
- *
- * `slack-notify` is NOT mocked, deliberately: `AILK_SLACK_BOT_TOKEN` is unset
- * here, so `postListingApplication` takes its own documented no-op branch
- * (`slack-skipped`) and never reaches `fetch`. Stubbing the module would be
- * mocking internal code to avoid a boundary that is already closed.
- *
- * Four of these fail QUIETLY if they regress, which is why each is here:
- *   - a draft created from name and email alone must PERSIST, and a
- *     single-field patch must round-trip — otherwise the lifecycle silently
- *     stores nothing and the founder loses ten steps of work;
- *   - an incomplete draft at submit must be refused with the missing fields
- *     NAMED, not silently accepted into `requested`;
- *   - a resume token must grant ONE listing and nothing else, since it is the
- *     only credential on an anonymous surface;
- *   - drafts must COUNT toward the two-listing limit, or the limit is evaded
- *     by never submitting.
- */
-import { createHash } from "node:crypto";
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
-jest.mock("../../../lib/prisma.js");
-
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
-  // #5406 — `start` now reaches the resume email. Declared here for the reason
-  // docs/lessons/project-listings/04 records: a mock factory that omits an
-  // export the code under test calls leaves it `undefined` at the callsite.
-  // These suites configure no `resumeEmail`, so the send short-circuits before
-  // this is reached; it is declared so a future fixture that DOES configure
-  // one fails on its assertion rather than on a missing mock.
-  sendListingResumeEmail: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-resume" }),
-}));
-
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-import { logger } from "@working-theory/observability";
-import {
-  resolveConsentStatement,
-  SITE_CONSENT_CONFIG_DEFAULTS,
-} from "@working-theory/validation";
-
-import {
-  mockNoWorkspace,
-  mockWorkspaceExists,
-} from "../../../lib/__mocks__/prisma.js";
-import { prisma } from "../../../lib/prisma.js";
-import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
-import {
-  MAX_CONSENT_KEYS, UNRECOVERABLE_CONSENT_STATEMENT } from "../../../services/consent.js";
-import { patchProjectListingDraftRoute } from "../patch-draft.js";
-import { startProjectListingRoute } from "../start.js";
-import { submitProjectListingRoute } from "../submit.js";
-
-// ─── Fixtures ───────────────────────────────────────────────────────────────
-
-const opt = (value: string, label: string) => ({ value, label });
-
-const VALID_QUESTIONS = {
-  q2: {
-    prompt: "Why are you here?",
-    options: [opt("scale", "Scaling my team"), opt("just-curious", "Just curious")],
-  },
-  q3: { prompt: "Stage?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
-  q4: { prompt: "Team size?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
-  q5: {
-    prompt: "Urgency?",
-    options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")],
-  },
-  q6: {
-    prompt: "Pain?",
-    options: [
-      opt("low", "Low"),
-      opt("medium", "Medium"),
-      opt("high", "High"),
-      opt("critical", "Critical"),
-    ],
-  },
-  q7: { prompt: "Anything else?" },
-  extras: [],
-};
-
-/**
- * The site is named by its PUBLIC KEY now (#5048 D2) — `siteId` never travels
- * in a request body. `installStore` maps this key to `SITE_ID` the way a
- * `SiteListingConfig.publicKey` row does.
- */
-const SITE_ID = "site-1";
-const SITE_KEY = "site-1-public-key";
-
-const START_PAYLOAD = {
-  siteKey: SITE_KEY,
-  founderName: "Ada Founder",
-  founderEmail: "ada@example.com",
-  consent: true,
-};
-
-/**
- * #6314 — the magnets `capturedByFlowSlug` may name. The resolve runs against
- * the RESOLVED workspace id (`resolveWorkspaceIdForSite(SITE_ID)`), which this
- * suite's `mockWorkspaceExists(prisma, SITE_ID)` makes `SITE_ID` itself.
- */
-const WS_OTHER = "wksp_00000000-0000-7000-8000-0000000000bb";
-const LISTICLE_ID = "flow_00000000-0000-7000-8000-0000000000d1";
-const FOREIGN_LISTICLE_ID = "flow_00000000-0000-7000-8000-0000000000d2";
-const CONTACT_FLOW_ID = "flow_00000000-0000-7000-8000-0000000000d3";
-
-const FLOW_DEFINITION_ROWS: Row[] = [
-  {
-    id: LISTICLE_ID,
-    siteId: SITE_ID,
-    workspaceId: SITE_ID,
-    slug: "founder-list",
-    kind: "listicle",
-    status: "live",
-  },
-  // A listicle magnet of ANOTHER workspace. Its slug is a public path segment,
-  // so a stranger can name it — the resolve's `siteId`/`workspaceId` terms are
-  // what make naming it inert.
-  {
-    id: FOREIGN_LISTICLE_ID,
-    siteId: WS_OTHER,
-    workspaceId: WS_OTHER,
-    slug: "other-list",
-    kind: "listicle",
-    status: "live",
-  },
-  // A NON-listicle magnet in THIS workspace: the `kind: "listicle"` term in
-  // the resolve is what stops an application being filed against it.
-  {
-    id: CONTACT_FLOW_ID,
-    siteId: SITE_ID,
-    workspaceId: SITE_ID,
-    slug: "contact-us",
-    kind: "contact",
-    status: "live",
-  },
-];
-
-/** Everything the ten steps after step one collect. */
-const COMPLETE_APPLICATION = {
-  name: "My Project",
-  headline: "Ten words or fewer for the tile title here",
-  oneLiner: "A short sentence describing what the project does for its people.",
-  problem: "The problem is real and this describes it.",
-  product: "wireframes",
-  commitment: "part-time",
-  teamComposition: "co-founders",
-  faqs: [
-    { question: "Q one?", answer: "A one." },
-    { question: "Q two?", answer: "A two." },
-    { question: "Q three?", answer: "A three." },
-  ],
-  address: "1 Founder Way, Springfield",
-  questions: VALID_QUESTIONS,
-};
-
-// ─── The in-memory row store the Prisma mock is backed by ───────────────────
-
-type Row = Record<string, unknown>;
-
-let rows: Row[];
-let nextId: number;
-
-function matches(row: Row, where: Record<string, unknown>): boolean {
-  return Object.entries(where).every(([key, value]) => {
-    if (key === "OR") {
-      return (value as Record<string, unknown>[]).some((clause) => matches(row, clause));
-    }
-    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
-      const clause = value as Record<string, unknown>;
-      if ("in" in clause) return (clause["in"] as unknown[]).includes(row[key]);
-      if ("not" in clause) return row[key] !== clause["not"];
-      if ("gt" in clause) return (row[key] as Date) > (clause["gt"] as Date);
-      if ("startsWith" in clause) {
-        return typeof row[key] === "string" && (row[key] as string).startsWith(clause["startsWith"] as string);
-      }
-    }
-    return row[key] === value;
-  });
-}
-
-function installStore(): void {
-  // #6335 — the shared prisma mock no longer resolves ANY requested
-  // workspace id. `startProjectListingDraft` stamps the row's `workspaceId`
-  // by resolving the site it was filed against (`resolveWorkspaceIdForSite`,
-  // services/project-listings.ts), so this suite states the ONE site it is
-  // built around. Keyed on the requested id — nothing else resolves.
-  mockWorkspaceExists(prisma, SITE_ID);
-
-  rows = [];
-  nextId = 1;
-
-  (prisma.lead.create as jest.Mock).mockImplementation(() =>
-    Promise.resolve({ id: `lead_00000000-0000-7000-8000-00000000000${nextId}` }),
-  );
-  // One delegate, two lookups (#5048 D2): `where.publicKey` is the site-key
-  // resolution (`siteIdForPublicKey`), `where.siteId` the config read
-  // (`listingConfigFor`). No config row for the latter, so the platform
-  // defaults apply — the behaviour every test below was written against.
-  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
-      if (where.publicKey !== undefined) {
-        return Promise.resolve(where.publicKey === SITE_KEY ? { siteId: SITE_ID } : null);
-      }
-      return Promise.resolve(null);
-    },
-  );
-
-  // #5275 — `start` writes the row and its grant in one interactive
-  // transaction; the mock hands the same store-backed client through.
-  (prisma.$transaction as jest.Mock).mockImplementation(
-    async (fn: (tx: typeof prisma) => Promise<unknown>) => fn(prisma),
-  );
-  (prisma.projectListing.create as jest.Mock).mockImplementation(
-    ({ data }: { data: Row }) => {
-      const now = new Date();
-      const row: Row = {
-        id: `prjl_00000000-0000-7000-8000-00000000000${nextId++}`,
-        slug: null,
-        name: null,
-        oneLiner: null,
-        problem: null,
-        url: null,
-        product: null,
-        commitment: null,
-        teamComposition: null,
-        faqs: null,
-        anythingElse: null,
-        address: null,
-        questions: null,
-        // #5407 — a row written before the columns existed, and a freshly
-        // started draft on a site that asks for one name line: parts null,
-        // no phone, no verification stamp.
-        founderFirstName: null,
-        founderLastName: null,
-        founderPhone: null,
-        emailVerifiedAt: null,
-        founderCompany: null,
-        leadId: null,
-        headline: null,
-        logoMarkUrl: null,
-        logoWordmarkUrl: null,
-        solution: null,
-        featured: false,
-        decidedAt: null,
-        decidedBy: null,
-        issueUrl: null,
-        experimentKey: null,
-        windowEndsAt: null,
-        createdAt: now,
-        updatedAt: now,
-        ...data,
-      };
-      rows.push(row);
-      return Promise.resolve(row);
-    },
-  );
-
-  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
-    ({ where }: { where: Record<string, unknown> }) =>
-      Promise.resolve(rows.find((row) => matches(row, where)) ?? null),
-  );
-
-  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
-    ({ where }: { where: Record<string, unknown> }) =>
-      Promise.resolve(rows.filter((row) => matches(row, where))),
-  );
-
-  (prisma.projectListing.update as jest.Mock).mockImplementation(
-    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
-      const row = rows.find((r) => matches(r, where));
-      Object.assign(row!, data, { updatedAt: new Date() });
-      return Promise.resolve(row);
-    },
-  );
-
-  (prisma.projectListing.updateMany as jest.Mock).mockImplementation(
-    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
-      const matched = rows.filter((r) => matches(r, where));
-      matched.forEach((r) => Object.assign(r, data, { updatedAt: new Date() }));
-      return Promise.resolve({ count: matched.length });
-    },
-  );
-
-  // #5275 — the grant write `start` now makes. Append-only, so the mock only
-  // needs to resolve; the start tests below assert on what it was called with.
-  (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
-    ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
-  );
-
-  // #6314 — the capturing-magnet resolve. Honours EVERY term the service
-  // passes, so a resolve that dropped `workspaceId` or `kind` would match a
-  // row it must not and fail the assertions below.
-  (prisma.flowDefinition.findFirst as jest.Mock).mockImplementation(
-    ({ where }: { where: Record<string, unknown> }) =>
-      Promise.resolve(
-        FLOW_DEFINITION_ROWS.find((row) => matches(row, where)) ?? null,
-      ),
-  );
-}
-
-// ─── Helpers ────────────────────────────────────────────────────────────────
-
-const sha256 = (value: string) => createHash("sha256").update(value).digest("hex");
-
-const bearer = (token: string) => ({ authorization: `Bearer ${token}` });
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  await app.register(startProjectListingRoute);
-  await app.register(patchProjectListingDraftRoute);
-  await app.register(submitProjectListingRoute);
-  await app.ready();
-  return app;
-}
-
-async function startDraft(
-  app: FastifyInstance,
-  overrides: Record<string, unknown> = {},
-): Promise<{ id: string; resumeToken: string }> {
-  const res = await app.inject({
-    method: "POST",
-    url: "/v1/project-listings",
-    payload: { ...START_PAYLOAD, ...overrides },
-  });
-  expect(res.statusCode).toBe(201);
-  return (res.json() as { ok: true; data: { id: string; resumeToken: string } }).data;
-}
-
-// ─── Tests ──────────────────────────────────────────────────────────────────
-
-describe("the draft lifecycle (#5036 D1)", () => {
-  setupLeadFileEnv("project-listing-drafts");
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  // ── start ──
-
-  it("start: a draft created from name and email alone PERSISTS", async () => {
-    const { id, resumeToken } = await startDraft(app);
-
-    expect(id).toMatch(/^prjl_/);
-    expect(resumeToken.length).toBeGreaterThan(0);
-
-    // The row exists, at `draft`, carrying nothing but the identity — every
-    // application field still null. This is the "nullable at rest" invariant
-    // seen from the outside: without it the create itself would have failed.
-    const row = rows[0]!;
-    expect(row["status"]).toBe("draft");
-    expect(row["founderEmail"]).toBe("ada@example.com");
-    expect(row["name"]).toBeNull();
-    expect(row["oneLiner"]).toBeNull();
-    expect(row["product"]).toBeNull();
-    expect(row["questions"]).toBeNull();
-    expect(row["slug"]).toBeNull();
-
-    // NO Lead at step one. The contact is already captured on this row, and
-    // `routeLead` mails the operator — which on an anonymous route would let a
-    // stranger fill the operator's inbox by opening drafts they never finish
-    // (PR #5042 security review, finding 4). The Lead waits for `submit`.
-    expect(prisma.lead.create).not.toHaveBeenCalled();
-    expect(row["leadId"]).toBeNull();
-  });
-
-  it("start: lowercases the founder's email, so the limit cannot be evaded by case", async () => {
-    // Postgres text equality is case-sensitive, so without this the
-    // concurrent-listing limit is evaded by holding down shift. (Surrounding
-    // whitespace needs no test: `z.string().email()` refuses it outright.)
-    await startDraft(app, { founderEmail: "Ada@Example.COM" });
-    expect(rows[0]!["founderEmail"]).toBe("ada@example.com");
-  });
-
-  it("start: stores a DIGEST of the resume token, never the token", async () => {
-    const { resumeToken } = await startDraft(app);
-    const stored = rows[0]!["resumeTokenHash"];
-
-    expect(stored).not.toBe(resumeToken);
-    expect(stored).toBe(sha256(resumeToken));
-    // 256 bits of CSPRNG output, base64url-encoded.
-    expect(Buffer.from(resumeToken, "base64url")).toHaveLength(32);
-  });
-
-  it("start: two drafts get different tokens", async () => {
-    const first = await startDraft(app);
-    const second = await startDraft(app, { founderEmail: "grace@example.com" });
-    expect(first.resumeToken).not.toBe(second.resumeToken);
-  });
-
-  it("start: refuses a payload that declines consent", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: { ...START_PAYLOAD, consent: false },
-    });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { ok: boolean }).ok).toBe(false);
-    expect(rows).toHaveLength(0);
-  });
-
-  // ── start: the consent grant (#5275 D7/D11) ──
-
-  it.each([
-    ["DECLINES the required purpose", { service_terms: false }],
-    ["is EMPTY beside the literal", {}],
-    ["OMITS the required purpose", { marketing: true }],
-  ])(
-    "start: a consents map that %s is a 400 and creates no row and no grant",
-    async (_label, consents) => {
-      const res = await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: { ...START_PAYLOAD, consents, locale: "en" },
-      });
-      expect(res.statusCode).toBe(400);
-      const body = res.json() as { ok: boolean; error: { code: string; message: string } };
-      expect(body.ok).toBe(false);
-      expect(body.error.code).toBe("invalid_input");
-      expect(body.error.message).toMatch(/service_terms/);
-      expect(rows).toHaveLength(0);
-      expect(prisma.consentGrant.createMany).not.toHaveBeenCalled();
-    },
-  );
-
-  it("start: a consents map with more than MAX_CONSENT_KEYS purposes is a 400", async () => {
-    const consents: Record<string, boolean> = { service_terms: true };
-    for (let i = 0; i < MAX_CONSENT_KEYS; i += 1) consents[`junk_${i}`] = true;
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: { ...START_PAYLOAD, consents, locale: "en" },
-    });
-    expect(res.statusCode).toBe(400);
-    expect(rows).toHaveLength(0);
-  });
-
-  it("start: a grant write that fails takes the row with it — one transaction, no stranded listing", async () => {
-    (prisma.$transaction as jest.Mock).mockImplementation(
-      async (fn: (tx: typeof prisma) => Promise<unknown>) => {
-        const before = rows.length;
-        try {
-          return await fn(prisma);
-        } catch (err) {
-          rows.splice(before); // roll back the in-memory store
-          throw err;
-        }
-      },
-    );
-    (prisma.consentGrant.createMany as jest.Mock).mockRejectedValueOnce(new Error("db down"));
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: { ...START_PAYLOAD, consents: { service_terms: true }, locale: "en" },
-    });
-    expect(res.statusCode).toBe(500);
-    expect(rows).toHaveLength(0);
-  });
-
-  it("start: a body carrying consents records one grant per purpose with the DEFAULT statement text", async () => {
-    const { id } = await startDraft(app, { consents: { service_terms: true }, locale: "en" });
-
-    // The expected wording is DERIVED from the registry the server resolves
-    // from, never retyped — the whole point is that the row carries the string
-    // the renderer showed, not a string this test happens to agree with.
-    const purpose = SITE_CONSENT_CONFIG_DEFAULTS.purposes[0]!;
-    const { statement } = resolveConsentStatement(purpose, "en");
-
-    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(1);
-    const { data } = (prisma.consentGrant.createMany as jest.Mock).mock.calls[0]![0] as {
-      data: Row[];
-    };
-    expect(data).toHaveLength(1);
-    expect(data[0]).toMatchObject({
-      siteId: SITE_ID,
-      subjectType: "project_listing",
-      subjectId: id,
-      purposeId: "service_terms",
-      granted: true,
-      locale: "en",
-      statement,
-      statementHash: sha256(statement),
-      // #8438 D3 — a listing names no magnet slug, so the source is `api`.
-      source: "api",
-      personId: null,
-      policyVersion: 1,
-    });
-    expect(data[0]!["statement"]).not.toBe(UNRECOVERABLE_CONSENT_STATEMENT);
-    // The row's own consentAt is untouched by the grant write (spec §2.3).
-    expect(rows[0]!["consentAt"]).toBeInstanceOf(Date);
-  });
-
-  it("start: a body carrying only the legacy literal records ONE grant marked unrecoverable", async () => {
-    const { id } = await startDraft(app);
-
-    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(1);
-    const { data } = (prisma.consentGrant.createMany as jest.Mock).mock.calls[0]![0] as {
-      data: Row[];
-    };
-    expect(data).toHaveLength(1);
-    expect(data[0]).toMatchObject({
-      siteId: SITE_ID,
-      subjectType: "project_listing",
-      subjectId: id,
-      purposeId: "service_terms",
-      granted: true,
-      locale: "und",
-      statement: UNRECOVERABLE_CONSENT_STATEMENT,
-      statementHash: sha256(UNRECOVERABLE_CONSENT_STATEMENT),
-      source: "api",
-    });
-    // Never today's wording for a legacy call — that would fabricate evidence (D11).
-    expect(data[0]!["statement"]).not.toContain("You agree to being contacted");
-  });
-
-  // ── #6314 — the capturing magnet, written at START ────────────────────────
-
-  it("AC-5: a capturedByFlowSlug naming a live listicle magnet of the resolved site writes that magnet's ID, and the response body is byte-unchanged", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
-    });
-    expect(res.statusCode).toBe(201);
-    // The hard-floor response contract does not move: `{ id, resumeToken }`
-    // and nothing else. The column is NEVER echoed back to the anonymous
-    // caller (spec § 9 SEC-12).
-    expect(Object.keys(res.json().data).sort()).toEqual(["id", "resumeToken"]);
-
-    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
-
-    // D1 — ALL FOUR terms in ONE query, and only the slug came from the body.
-    const call = (prisma.flowDefinition.findFirst as jest.Mock).mock
-      .calls[0]?.[0] as { where: Record<string, unknown> };
-    expect(call.where).toEqual({
-      slug: "founder-list",
-      siteId: SITE_ID,
-      workspaceId: SITE_ID,
-      kind: "listicle",
-    });
-  });
-
-  it("a start body carrying NO capturedByFlowSlug writes NULL, and makes no resolve query at all", async () => {
-    await startDraft(app);
-    expect(rows[0]!["capturedByFlowId"] ?? null).toBeNull();
-    expect(prisma.flowDefinition.findFirst).not.toHaveBeenCalled();
-  });
-
-  it.each([
-    ["names nothing at all", "no-such-magnet"],
-    ["names ANOTHER workspace's listicle magnet", "other-list"],
-    ["names a NON-listicle magnet in this workspace", "contact-us"],
-  ])(
-    "AC-6: a capturedByFlowSlug that %s writes NULL and still returns a 201 indistinguishable from a body that named no slug",
-    async (_label, slug) => {
-      const withSlug = await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: { ...START_PAYLOAD, capturedByFlowSlug: slug },
-      });
-      expect(withSlug.statusCode).toBe(201);
-      expect(rows[0]!["capturedByFlowId"] ?? null).toBeNull();
-
-      // Indistinguishable on the wire from the no-slug case: same status, same
-      // key set, same envelope. A distinguishable error would turn this
-      // anonymous route into a cross-workspace magnet-slug oracle (SEC-02).
-      const withoutSlug = await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: START_PAYLOAD,
-      });
-      expect(withoutSlug.statusCode).toBe(withSlug.statusCode);
-      expect(Object.keys(withoutSlug.json().data).sort()).toEqual(
-        Object.keys(withSlug.json().data).sort(),
-      );
-    },
-  );
-
-  it("AC-13: an UNRESOLVED slug is logged, PII-safe — routing metadata only, never the founder's identity or either credential", async () => {
-    const warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined);
-    try {
-      const res = await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: {
-          ...START_PAYLOAD,
-          capturedByFlowSlug: "no-such-magnet",
-        },
-      });
-      expect(res.statusCode).toBe(201);
-
-      const call = warn.mock.calls.find(
-        (c) =>
-          typeof c[0] === "object" &&
-          c[0] !== null &&
-          "capturedByFlowSlug" in (c[0] as Record<string, unknown>),
-      );
-      expect(call).toBeDefined();
-      const meta = call![0] as Record<string, unknown>;
-      // Routing metadata ONLY. Silence here is what would make a stale or
-      // mis-wired consuming site produce a permanently empty Applications list
-      // indistinguishable from "no applications yet" (SEC-03).
-      expect(Object.keys(meta).sort()).toEqual([
-        "capturedByFlowSlug",
-        "listingId",
-        "siteId",
-      ]);
-      const serialized = JSON.stringify(meta);
-      expect(serialized).not.toContain("ada@example.com");
-      expect(serialized).not.toContain("Ada Founder");
-      expect(serialized).not.toContain(rows[0]!["resumeTokenHash"]);
-      expect(serialized).not.toContain(rows[0]!["emailVerifyNonceHash"]);
-    } finally {
-      warn.mockRestore();
-    }
-  });
-
-  it("AC-6: a capturedByFlowSlug lookup that THROWS degrades like an unresolvable slug — 201, NULL attribution, and a PII-safe warn distinct from the unresolved line", async () => {
-    (prisma.flowDefinition.findFirst as jest.Mock).mockRejectedValueOnce(
-      new Error("statement timeout"),
-    );
-    const warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined);
-    try {
-      const res = await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
-      });
-      expect(res.statusCode).toBe(201);
-      expect(rows[0]!["capturedByFlowId"] ?? null).toBeNull();
-
-      const call = warn.mock.calls.find(
-        (c) => typeof c[1] === "string" && c[1].includes("lookup failed"),
-      );
-      expect(call).toBeDefined();
-      const meta = call![0] as Record<string, unknown>;
-      expect(Object.keys(meta).sort()).toEqual([
-        "capturedByFlowSlug",
-        "err",
-        "workspaceId",
-      ]);
-      // `JSON.stringify` cannot see an Error's NON-ENUMERABLE own properties —
-      // `message` and `stack` among them — so stringifying `meta` alone would
-      // pass whatever the error held and assert nothing. Pull them out by name.
-      const err = meta["err"] as Error;
-      const serialized = [
-        JSON.stringify(meta),
-        err?.message ?? "",
-        err?.stack ?? "",
-      ].join("\n");
-      expect(serialized).not.toContain("ada@example.com");
-      expect(serialized).not.toContain("Ada Founder");
-
-      // The real guarantee is STRUCTURAL, not this assertion: the catch wraps
-      // only the `findFirst`, whose scope holds no founder field at all. This
-      // check is a tripwire over that property, never the proof of it.
-      const line = call![1] as string;
-      expect(line).toContain("lookup failed");
-      expect(line).not.toContain("resolved to no listicle magnet");
-    } finally {
-      warn.mockRestore();
-    }
-  });
-
-  it("a lookup that THROWS does NOT also emit the unresolved-slug line — during a DB incident that would be a false magnet-configuration signal", async () => {
-    (prisma.flowDefinition.findFirst as jest.Mock).mockRejectedValueOnce(
-      new Error("statement timeout"),
-    );
-    const warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined);
-    try {
-      const res = await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
-      });
-      expect(res.statusCode).toBe(201);
-      expect(rows[0]!["capturedByFlowId"] ?? null).toBeNull();
-
-      const messages = warn.mock.calls.map((c) => String(c[1] ?? ""));
-      // Exactly one line, and it is the accurate one. The throw never
-      // established that no such magnet exists.
-      expect(
-        messages.filter((m) => m.includes("resolved to no listicle magnet")),
-      ).toHaveLength(0);
-      expect(messages.filter((m) => m.includes("lookup failed"))).toHaveLength(1);
-    } finally {
-      warn.mockRestore();
-    }
-  });
-
-  it("a RESOLVED slug logs nothing — the warn line is the unresolved case's signal, not a per-application line", async () => {
-    const warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined);
-    try {
-      await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
-      });
-      expect(
-        warn.mock.calls.filter(
-          (c) =>
-            typeof c[0] === "object" &&
-            c[0] !== null &&
-            "capturedByFlowSlug" in (c[0] as Record<string, unknown>),
-        ),
-      ).toHaveLength(0);
-    } finally {
-      warn.mockRestore();
-    }
-  });
-
-  it("AC-7: capturedByFlowId is WRITE-ONCE — no patch and no submit changes it, and no patch body can reach it", async () => {
-    const { id, resumeToken } = (await (async () => {
-      const res = await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
-      });
-      expect(res.statusCode).toBe(201);
-      return res.json().data as { id: string; resumeToken: string };
-    })());
-
-    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
-
-    // A patch that tries to name the column outright is a `.strict()` 400 —
-    // the key is not on any patch schema, so no body can reach the column.
-    const injected = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer(resumeToken),
-      payload: { capturedByFlowId: FOREIGN_LISTICLE_ID },
-    });
-    expect(injected.statusCode).toBe(400);
-    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
-
-    // A legitimate patch leaves it untouched.
-    const patched = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer(resumeToken),
-      payload: { name: "My Project" },
-    });
-    expect(patched.statusCode).toBe(200);
-    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
-
-    // And so does submit.
-    await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer(resumeToken),
-      payload: COMPLETE_APPLICATION,
-    });
-    const submitted = await app.inject({
-      method: "POST",
-      url: `/v1/project-listings/drafts/${id}/submit`,
-      headers: bearer(resumeToken),
-    });
-    expect(submitted.statusCode).toBe(200);
-    expect(rows[0]!["status"]).toBe("requested");
-    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
-  });
-
-  // ── patch ──
-
-  it("patch: a SINGLE-field patch round-trips", async () => {
-    const { id, resumeToken } = await startDraft(app);
-
-    const res = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer(resumeToken),
-      payload: { oneLiner: "Just the one field, saved on its own." },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as { ok: boolean; data: Record<string, unknown> };
-    expect(body.ok).toBe(true);
-    expect(body.data["oneLiner"]).toBe("Just the one field, saved on its own.");
-    // Still a draft, still incomplete — `patch` asserts no completeness.
-    expect(body.data["status"]).toBe("draft");
-    expect(body.data["name"]).toBeNull();
-  });
-
-  it("patch: a later patch MERGES rather than replacing", async () => {
-    const { id, resumeToken } = await startDraft(app);
-
-    await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer(resumeToken),
-      payload: { name: "Step three" },
-    });
-    const res = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer(resumeToken),
-      payload: { address: "1 Founder Way" },
-    });
-
-    const body = res.json() as { data: Record<string, unknown> };
-    // The earlier step survives the later one — the failure this guards is a
-    // patch that blanks the nine fields the founder already filled in.
-    expect(body.data["name"]).toBe("Step three");
-    expect(body.data["address"]).toBe("1 Founder Way");
-  });
-
-  it("patch: refuses an empty body", async () => {
-    const { id, resumeToken } = await startDraft(app);
-    const res = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer(resumeToken),
-      payload: {},
-    });
-    expect(res.statusCode).toBe(400);
-  });
-
-  it("patch: 401s with no resume token at all", async () => {
-    const { id } = await startDraft(app);
-    const res = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      payload: { name: "No credential" },
-    });
-    expect(res.statusCode).toBe(401);
-  });
-
-  // ── the token's binding ──
-
-  it("a resume token grants ONE listing and no other", async () => {
-    const first = await startDraft(app);
-    const second = await startDraft(app, { founderEmail: "grace@example.com" });
-
-    // The first founder's token, presented against the second's listing.
-    const res = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${second.id}`,
-      headers: bearer(first.resumeToken),
-      payload: { name: "Not mine to write" },
-    });
-
-    expect(res.statusCode).toBe(404);
-    // And nothing was written to the row it was aimed at.
-    const target = rows.find((r) => r["id"] === second.id)!;
-    expect(target["name"]).toBeNull();
-  });
-
-  it("a wrong token is a 404, indistinguishable from an unknown draft", async () => {
-    const { id } = await startDraft(app);
-
-    const wrongToken = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer("not-the-token"),
-      payload: { name: "x" },
-    });
-    const unknownDraft = await app.inject({
-      method: "PATCH",
-      url: "/v1/project-listings/drafts/prjl_00000000-0000-7000-8000-0000000000ff",
-      headers: bearer("not-the-token"),
-      payload: { name: "x" },
-    });
-
-    expect(wrongToken.statusCode).toBe(404);
-    expect(unknownDraft.statusCode).toBe(404);
-    expect(wrongToken.json()).toEqual(unknownDraft.json());
-  });
-
-  // ── submit ──
-
-  it("submit: an INCOMPLETE draft is refused with the missing fields NAMED", async () => {
-    const { id, resumeToken } = await startDraft(app);
-    // Two of the eleven required fields filled in; nine still missing.
-    await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer(resumeToken),
-      payload: { name: "My Project", address: "1 Founder Way" },
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: `/v1/project-listings/drafts/${id}/submit`,
-      headers: bearer(resumeToken),
-    });
-
-    expect(res.statusCode).toBe(422);
-    const body = res.json() as { error: { code: string; missingFields: string[] } };
-    expect(body.error.code).toBe("incomplete_application");
-    // NAMED, so the form can send the founder to the step that owns each one.
-    expect(body.error.missingFields).toEqual(
-      expect.arrayContaining([
-        "commitment",
-        "faqs",
-        "headline",
-        "oneLiner",
-        "problem",
-        "product",
-        "questions",
-        "teamComposition",
-      ]),
-    );
-    // The two fields that WERE filled in are not reported missing.
-    expect(body.error.missingFields).not.toContain("name");
-    expect(body.error.missingFields).not.toContain("address");
-    // And the row did not move.
-    expect(rows.find((r) => r["id"] === id)!["status"]).toBe("draft");
-  });
-
-  it("submit: a COMPLETE draft transitions to `requested` and returns the derived slug", async () => {
-    const { id, resumeToken } = await startDraft(app);
-    await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer(resumeToken),
-      payload: COMPLETE_APPLICATION,
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: `/v1/project-listings/drafts/${id}/submit`,
-      headers: bearer(resumeToken),
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({ ok: true, data: { id, slug: "my-project" } });
-
-    const row = rows.find((r) => r["id"] === id)!;
-    expect(row["status"]).toBe("requested");
-    // The Lead is written HERE, once, for a completed application.
-    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-    const lead = (prisma.lead.create as jest.Mock).mock.calls[0][0];
-    expect(lead.data.source).toBe("projects-apply");
-    expect(lead.data.email).toBe("ada@example.com");
-    expect(row["leadId"]).not.toBeNull();
-    expect(row["slug"]).toBe("my-project");
-    // The token is spent: a leak after submission grants nothing.
-    expect(row["resumeTokenHash"]).toBeNull();
-  });
-
-  // #8661 D4 — a listing's slug becomes its diagnostic flow's slug, so the
-  // standard magnets' slugs are taken; any other name is unchanged.
-  it.each([
-    ["Contact", "contact-2"],
-    ["Onboarding", "onboarding-2"],
-    ["Atlas", "atlas"],
-  ])("submit: a draft named %s is stored at %s (#8661 D4, AC-2)", async (name, slug) => {
-    const { id, resumeToken } = await startDraft(app);
-    await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer(resumeToken),
-      payload: { ...COMPLETE_APPLICATION, name },
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: `/v1/project-listings/drafts/${id}/submit`,
-      headers: bearer(resumeToken),
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({ ok: true, data: { id, slug } });
-    expect(rows.find((r) => r["id"] === id)!["slug"]).toBe(slug);
-  });
-
-  it("submit: a spent token cannot patch or re-submit the listing", async () => {
-    const { id, resumeToken } = await startDraft(app);
-    await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer(resumeToken),
-      payload: COMPLETE_APPLICATION,
-    });
-    await app.inject({
-      method: "POST",
-      url: `/v1/project-listings/drafts/${id}/submit`,
-      headers: bearer(resumeToken),
-    });
-
-    const patchAgain = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${id}`,
-      headers: bearer(resumeToken),
-      payload: { name: "Renamed after the fact" },
-    });
-    const submitAgain = await app.inject({
-      method: "POST",
-      url: `/v1/project-listings/drafts/${id}/submit`,
-      headers: bearer(resumeToken),
-    });
-
-    expect(patchAgain.statusCode).toBe(404);
-    expect(submitAgain.statusCode).toBe(404);
-    expect(rows.find((r) => r["id"] === id)!["name"]).toBe("My Project");
-  });
-
-  it("submit: 401s with no resume token at all", async () => {
-    const { id } = await startDraft(app);
-    const res = await app.inject({
-      method: "POST",
-      url: `/v1/project-listings/drafts/${id}/submit`,
-    });
-    expect(res.statusCode).toBe(401);
-  });
-
-  // ── the concurrent-listing limit (#5036 D7) ──
-
-  it("a third concurrent listing is refused at submit — and one of the two is a DRAFT", async () => {
-    // One already ACTIVE listing for this founder…
-    const active = await startDraft(app);
-    Object.assign(rows.find((r) => r["id"] === active.id)!, {
-      status: "active",
-      slug: "already-live",
-      windowEndsAt: new Date(Date.now() + 86_400_000),
-    });
-
-    // …and one still a DRAFT. If drafts did not count, the limit would be
-    // evaded by simply never submitting — which is the state a ten-step form
-    // leaves a founder in by default.
-    await startDraft(app);
-
-    // The third.
-    const third = await startDraft(app);
-    await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${third.id}`,
-      headers: bearer(third.resumeToken),
-      payload: COMPLETE_APPLICATION,
-    });
-    const res = await app.inject({
-      method: "POST",
-      url: `/v1/project-listings/drafts/${third.id}/submit`,
-      headers: bearer(third.resumeToken),
-    });
-
-    expect(res.statusCode).toBe(409);
-    expect((res.json() as { error: { code: string } }).error.code).toBe("listing_limit_reached");
-    expect(rows.find((r) => r["id"] === third.id)!["status"]).toBe("draft");
-  });
-
-  it("a long-abandoned draft stops holding a slot", async () => {
-    // Drafts count — that is D7, and it is what stops the limit being evaded by
-    // never submitting. But `founderEmail` is unverified here, so a draft that
-    // counted FOREVER would let two anonymous requests lock a named founder out
-    // permanently, with no operator remedy (PR #5042 security review, finding
-    // 1). The window is what makes that lockout expire.
-    for (let i = 0; i < 2; i += 1) {
-      const stale = await startDraft(app);
-      Object.assign(rows.find((r) => r["id"] === stale.id)!, {
-        createdAt: new Date(Date.now() - 15 * 24 * 60 * 60 * 1000),
-      });
-    }
-
-    const third = await startDraft(app);
-    await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${third.id}`,
-      headers: bearer(third.resumeToken),
-      payload: COMPLETE_APPLICATION,
-    });
-    const res = await app.inject({
-      method: "POST",
-      url: `/v1/project-listings/drafts/${third.id}/submit`,
-      headers: bearer(third.resumeToken),
-    });
-
-    expect(res.statusCode).toBe(200);
-  });
-
-  it("a FRESH draft still holds a slot", async () => {
-    // The other half of the window: two drafts created today do bind, so the
-    // limit is not evaded by simply not pressing submit.
-    await startDraft(app);
-    await startDraft(app);
-
-    const third = await startDraft(app);
-    await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${third.id}`,
-      headers: bearer(third.resumeToken),
-      payload: COMPLETE_APPLICATION,
-    });
-    const res = await app.inject({
-      method: "POST",
-      url: `/v1/project-listings/drafts/${third.id}/submit`,
-      headers: bearer(third.resumeToken),
-    });
-
-    expect(res.statusCode).toBe(409);
-  });
-
-  it("a TERMINAL listing does not count toward the limit", async () => {
-    // Two listings, but both terminal: one rejected, one whose window elapsed
-    // (which reads `closed`, computed, with no job having run).
-    const rejected = await startDraft(app);
-    Object.assign(rows.find((r) => r["id"] === rejected.id)!, {
-      status: "rejected",
-      slug: "turned-down",
-    });
-    const expired = await startDraft(app);
-    Object.assign(rows.find((r) => r["id"] === expired.id)!, {
-      status: "active",
-      slug: "ran-its-course",
-      windowEndsAt: new Date(Date.now() - 86_400_000),
-    });
-
-    const third = await startDraft(app);
-    await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${third.id}`,
-      headers: bearer(third.resumeToken),
-      payload: COMPLETE_APPLICATION,
-    });
-    const res = await app.inject({
-      method: "POST",
-      url: `/v1/project-listings/drafts/${third.id}/submit`,
-      headers: bearer(third.resumeToken),
-    });
-
-    expect(res.statusCode).toBe(200);
-  });
-
-  it("the limit is scoped to one founder — another founder's listings do not count", async () => {
-    for (const email of ["grace@example.com", "alan@example.com"]) {
-      const other = await startDraft(app, { founderEmail: email });
-      Object.assign(rows.find((r) => r["id"] === other.id)!, {
-        status: "active",
-        slug: `live-${email.split("@")[0]}`,
-        windowEndsAt: new Date(Date.now() + 86_400_000),
-      });
-    }
-
-    const mine = await startDraft(app);
-    await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/drafts/${mine.id}`,
-      headers: bearer(mine.resumeToken),
-      payload: COMPLETE_APPLICATION,
-    });
-    const res = await app.inject({
-      method: "POST",
-      url: `/v1/project-listings/drafts/${mine.id}/submit`,
-      headers: bearer(mine.resumeToken),
-    });
-
-    expect(res.statusCode).toBe(200);
-  });
-
-  // ── logging ──
-
-  it("no founder PII and no resume token reaches the route's own log line", async () => {
-    // Scoped to the log statements THIS route makes. Fastify's built-in
-    // request/response logging serializes the raw request (body included) and
-    // `inject`'s own harness stashes the response payload on it — neither is
-    // this route's doing, and neither is what the PII boundary is about. What
-    // is this route's doing is the one `request.log.info` call below.
-    const calls: Record<string, unknown>[] = [];
-    const logging = Fastify({
-      logger: {
-        level: "info",
-        hooks: {
-          logMethod(args: unknown[], method: (...a: never[]) => void) {
-            if (typeof args[1] === "string" && args[1] === "project listing draft started") {
-              calls.push(args[0] as Record<string, unknown>);
-            }
-            method.apply(this, args as never[]);
-          },
-        },
-      },
-      disableRequestLogging: true,
-    });
-    await logging.register(startProjectListingRoute);
-    await logging.ready();
-
-    const res = await logging.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: START_PAYLOAD,
-    });
-    const { resumeToken } = (res.json() as { data: { resumeToken: string } }).data;
-
-    expect(calls).toHaveLength(1);
-    const serialized = JSON.stringify(calls[0]);
-    expect(serialized).not.toContain("ada@example.com");
-    expect(serialized).not.toContain("Ada Founder");
-    expect(serialized).not.toContain(resumeToken);
-    // Routing metadata only.
-    expect(Object.keys(calls[0]!).sort()).toEqual(["ip", "listingId", "siteId"]);
-
-    await logging.close();
-  });
-});
-
-// ── #6335 — the explicit workspace setup above is load-bearing ────────────
-//
-// Every case in this file states that this suite's site has a workspace.
-// This one takes that away, and proves the statement was doing work rather
-// than decorating the setup: `startProjectListingDraft` resolves the site it
-// is filing against (`resolveWorkspaceIdForSite`, services/project-listings.ts)
-// and refuses BEFORE any row is written. With the shared prisma mock's old
-// permissive default in place this case could not be written at all — every
-// id resolved, so the fail-closed path was unreachable from a route test.
-describe("#6335 — start fails closed when the site names no workspace", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    mockNoWorkspace(prisma);
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("answers 503 tenant_unresolved and creates no ProjectListing", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: START_PAYLOAD,
-    });
-
-    expect(res.statusCode).toBe(503);
-    expect((res.json() as { error: { code: string } }).error.code).toBe(
-      "tenant_unresolved",
-    );
-    expect(prisma.projectListing.create).not.toHaveBeenCalled();
-    expect(rows).toHaveLength(0);
-  });
-});