create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/routes/project-listings/__tests__/resume-email.test.ts

@@ -1,872 +0,0 @@
-/**
- * @file resume-email.test.ts
- *
- * THE ACCEPTANCE GATE for the resume email's SEND (#5406) — the fire-and-forget
- * side effect `POST /v1/project-listings` gained.
- *
- * Four properties fail quietly if they regress, which is why each is here:
- *   - the send is OPT-IN, so a site already mailing its own resume link (the
- *     reason this issue exists) does not start sending a second one;
- *   - the 201 is never delayed or failed by Resend, because the draft has
- *     already committed and the founder must get their token back;
- *   - nothing logs the founder's address, their name, or the resume token —
- *     the one credential on this anonymous draft, which also rides the LINK;
- *   - the site's config is read PER SEND, so editing the row changes the next
- *     email with no rebuild and no module reload.
- *
- * Real route, real service, mocked `lib/prisma.js` over a small in-memory row
- * store (the `drafts.test.ts` discipline). `@working-theory/email` is mocked
- * because it is an external package boundary whose own contract is tested in
- * `packages/email/__tests__/send-listing-resume-email.test.ts` — and because
- * this container has no egress, so no email could be sent regardless.
- * `@working-theory/license` is mocked for the reason
- * docs/lessons/project-listings/02 records: the route barrel drags in
- * `routeLead`'s import chain whether or not a test exercises it.
- */
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
-jest.mock("../../../lib/prisma.js");
-
-const mockSendResumeEmail = jest.fn();
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
-  sendListingResumeEmail: (...args: unknown[]) => mockSendResumeEmail(...args),
-}));
-
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-const mockLoggerInfo = jest.fn();
-const mockLoggerWarn = jest.fn();
-const mockLoggerError = jest.fn();
-jest.mock("@working-theory/observability", () => ({
-  logger: {
-    info: (...args: unknown[]) => mockLoggerInfo(...args),
-    warn: (...args: unknown[]) => mockLoggerWarn(...args),
-    error: (...args: unknown[]) => mockLoggerError(...args),
-    debug: jest.fn(),
-  },
-}));
-
-import {
-  mockNoWorkspace,
-  mockWorkspaceExists,
-} from "../../../lib/__mocks__/prisma.js";
-import { prisma } from "../../../lib/prisma.js";
-import { startProjectListingRoute } from "../start.js";
-
-// ─── Fixtures ───────────────────────────────────────────────────────────────
-
-const SITE_ID = "site-1";
-const SITE_KEY = "site-1-public-key";
-
-const FOUNDER_EMAIL = "ada@example.com";
-const FOUNDER_NAME = "Ada Founder";
-
-const START_PAYLOAD = {
-  siteKey: SITE_KEY,
-  founderName: FOUNDER_NAME,
-  founderEmail: FOUNDER_EMAIL,
-  consent: true,
-};
-
-const BASE_URL = "https://samhenry.org/projects/apply/start";
-
-/** The minimum a site writes to turn the email on. */
-const RESUME_EMAIL_ON = { fromAddress: "hello@samhenry.org", baseUrl: BASE_URL };
-
-// ─── The in-memory row store ────────────────────────────────────────────────
-
-type Row = Record<string, unknown>;
-
-let rows: Row[];
-let nextId: number;
-/** What `prisma.siteListingConfig.findUnique({ where: { siteId } })` answers. */
-let storedConfig: Record<string, unknown> | null;
-/**
- * The siteId `SITE_KEY` resolves to. `SITE_ID` for every test that does not
- * care; the per-site budget's tests each claim their OWN site, because the
- * cap's once-per-window log is remembered PER SITE in module state and two
- * tests sharing a site would share that memory (#5414).
- */
-let resolvedSiteId: string;
-
-function matches(row: Row, where: Record<string, unknown>): boolean {
-  return Object.entries(where).every(([key, value]) => {
-    // The per-recipient cap's window clause.
-    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
-      const clause = value as Record<string, unknown>;
-      if ("gt" in clause) return (row[key] as Date) > (clause["gt"] as Date);
-    }
-    return row[key] === value;
-  });
-}
-
-function installStore(): void {
-  // #6335 — the shared prisma mock no longer resolves ANY requested
-  // workspace id. `startProjectListingDraft` stamps the row's `workspaceId`
-  // by resolving the site it was filed against (`resolveWorkspaceIdForSite`,
-  // services/project-listings.ts), so this suite states the ONE site it is
-  // built around. Keyed on the requested id — nothing else resolves.
-  mockWorkspaceExists(prisma, SITE_ID);
-
-  rows = [];
-  nextId = 1;
-  storedConfig = null;
-  resolvedSiteId = SITE_ID;
-
-  // One delegate, two lookups: `where.publicKey` is the site-key resolution,
-  // `where.siteId` the config read.
-  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
-      if (where.publicKey !== undefined) {
-        return Promise.resolve(where.publicKey === SITE_KEY ? { siteId: resolvedSiteId } : null);
-      }
-      return Promise.resolve(storedConfig === null ? null : { data: storedConfig });
-    },
-  );
-
-  (prisma.$transaction as jest.Mock).mockImplementation(
-    async (fn: (tx: typeof prisma) => Promise<unknown>) => fn(prisma),
-  );
-
-  (prisma.projectListing.create as jest.Mock).mockImplementation(({ data }: { data: Row }) => {
-    const row: Row = {
-      id: `prjl_00000000-0000-7000-8000-00000000000${nextId++}`,
-      name: null,
-      leadId: null,
-      // Through `Date.now()` rather than a bare `new Date()` so a test that
-      // moves the clock moves the rows with it (the once-per-window log).
-      createdAt: new Date(Date.now()),
-      updatedAt: new Date(Date.now()),
-      ...data,
-    };
-    rows.push(row);
-    return Promise.resolve(row);
-  });
-
-  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
-    ({ where }: { where: Record<string, unknown> }) =>
-      Promise.resolve(rows.find((row) => matches(row, where)) ?? null),
-  );
-
-  (prisma.projectListing.findMany as jest.Mock).mockImplementation(() => Promise.resolve([]));
-
-  // Both send caps' read: the per-recipient bound (#5411 security review,
-  // finding 1) and the per-site budget (#5414) are the same delegate with
-  // different `where` clauses.
-  (prisma.projectListing.count as jest.Mock).mockImplementation(
-    ({ where }: { where: Record<string, unknown> }) =>
-      Promise.resolve(rows.filter((row) => matches(row, where)).length),
-  );
-
-  (prisma.consentGrant.createMany as jest.Mock).mockImplementation(({ data }: { data: Row[] }) =>
-    Promise.resolve({ count: data.length }),
-  );
-}
-
-// ─── Helpers ────────────────────────────────────────────────────────────────
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  await app.register(startProjectListingRoute);
-  await app.ready();
-  return app;
-}
-
-/**
- * Let the fire-and-forget chain run. The send does several awaited reads before
- * it reaches the email — the row, the config, and one count per bound — so a
- * single microtask tick is not enough; `setImmediate` fires only after the
- * microtask queue has fully drained.
- */
-const settle = () => new Promise((resolve) => setImmediate(resolve));
-
-async function startDraft(app: FastifyInstance): Promise<{ id: string; resumeToken: string }> {
-  const res = await app.inject({
-    method: "POST",
-    url: "/v1/project-listings",
-    payload: START_PAYLOAD,
-  });
-  expect(res.statusCode).toBe(201);
-  return (res.json() as { ok: true; data: { id: string; resumeToken: string } }).data;
-}
-
-/** The single `sendListingResumeEmail` argument of the most recent call. */
-function emailed(index = 0): {
-  to: string;
-  resumeLink: string;
-  settings: Record<string, string>;
-  variables: Record<string, string>;
-} {
-  return mockSendResumeEmail.mock.calls[index]![0];
-}
-
-describe("the resume email's send (#5406)", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    mockSendResumeEmail.mockResolvedValue({ ok: true, messageId: "msg-resume" });
-    installStore();
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  // ── Opt-in ───────────────────────────────────────────────────────────────
-
-  it("sends NOTHING when the site has no SiteListingConfig row at all", async () => {
-    await startDraft(app);
-    await settle();
-    expect(mockSendResumeEmail).not.toHaveBeenCalled();
-  });
-
-  it("sends NOTHING when the config carries no resumeEmail block", async () => {
-    storedConfig = { maxWindowDays: 30 };
-    await startDraft(app);
-    await settle();
-    expect(mockSendResumeEmail).not.toHaveBeenCalled();
-  });
-
-  it("sends NOTHING when resumeEmail carries no fromAddress", async () => {
-    // The opt-in switch. A site with wording but no verified sender must not
-    // start mailing — and a site already sending its own must not get two.
-    storedConfig = { resumeEmail: { subject: "Come back", baseUrl: BASE_URL } };
-    await startDraft(app);
-    await settle();
-    expect(mockSendResumeEmail).not.toHaveBeenCalled();
-    expect(mockLoggerInfo).toHaveBeenCalledWith(
-      expect.objectContaining({ reason: "no_from_address" }),
-      "listing-resume-email-skipped",
-    );
-  });
-
-  it("sends NOTHING when resumeEmail carries no baseUrl", async () => {
-    // The platform does not know where a site mounted its application, so
-    // there is no link to build and no default worth guessing.
-    storedConfig = { resumeEmail: { fromAddress: "hello@samhenry.org" } };
-    await startDraft(app);
-    await settle();
-    expect(mockSendResumeEmail).not.toHaveBeenCalled();
-    expect(mockLoggerInfo).toHaveBeenCalledWith(
-      expect.objectContaining({ reason: "no_base_url" }),
-      "listing-resume-email-skipped",
-    );
-  });
-
-  // ── The send ─────────────────────────────────────────────────────────────
-
-  it("sends to the founder with the site's own settings once configured", async () => {
-    storedConfig = {
-      siteName: "Sam Henry",
-      resumeEmail: {
-        ...RESUME_EMAIL_ON,
-        senderName: "Sam Henry",
-        replyTo: "sam@samhenry.org",
-        subject: "Verify to continue, {firstName}",
-        outro: "Reply if you get stuck.",
-      },
-    };
-    await startDraft(app);
-    await settle();
-
-    expect(mockSendResumeEmail).toHaveBeenCalledTimes(1);
-    expect(emailed().to).toBe(FOUNDER_EMAIL);
-    expect(emailed().settings).toEqual({
-      fromAddress: "hello@samhenry.org",
-      senderName: "Sam Henry",
-      replyTo: "sam@samhenry.org",
-      subject: "Verify to continue, {firstName}",
-      outro: "Reply if you get stuck.",
-    });
-    // `baseUrl` is the API's to consume, not the email package's.
-    expect(emailed().settings).not.toHaveProperty("baseUrl");
-  });
-
-  it("builds the link as baseUrl + ?draft=<id>&token=<resumeToken>&verify=<nonce>", async () => {
-    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
-    const { id, resumeToken } = await startDraft(app);
-    await settle();
-
-    // The exact shape `ListingApplicationFlow`'s `resume` prop reads.
-    const url = new URL(emailed().resumeLink);
-    expect(`${url.origin}${url.pathname}`).toBe(BASE_URL);
-    expect(url.searchParams.get("draft")).toBe(id);
-    expect(url.searchParams.get("token")).toBe(resumeToken);
-    // #5407 — and the verification nonce, which is what makes
-    // `email_verified_at` mean something the resume token could not prove.
-    expect(url.searchParams.get("verify")).toEqual(expect.any(String));
-  });
-
-  // #5407 — this message is the ONLY carrier of the verification nonce, and
-  // the property is what the whole fix rests on: a caller who has everything
-  // `start` returned still cannot verify.
-  it("carries a nonce that appears NOWHERE in `start`'s own response", async () => {
-    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: START_PAYLOAD,
-    });
-    await settle();
-
-    const nonce = new URL(emailed().resumeLink).searchParams.get("verify")!;
-    expect(nonce).toEqual(expect.any(String));
-    expect(res.body).not.toContain(nonce);
-    // Nor is it any of the values the response DOES carry.
-    const data = (res.json() as { data: Record<string, string> }).data;
-    expect(Object.values(data)).not.toContain(nonce);
-  });
-
-  it("gives each draft its OWN nonce", async () => {
-    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
-    await startDraft(app);
-    await settle();
-    await startDraft(app);
-    await settle();
-
-    const first = new URL(emailed(0).resumeLink).searchParams.get("verify");
-    const second = new URL(emailed(1).resumeLink).searchParams.get("verify");
-    expect(first).not.toBe(second);
-  });
-
-  it("appends to a baseUrl that already carries a query string", async () => {
-    storedConfig = { resumeEmail: { ...RESUME_EMAIL_ON, baseUrl: `${BASE_URL}?locale=en` } };
-    const { id } = await startDraft(app);
-    await settle();
-
-    const url = new URL(emailed().resumeLink);
-    expect(url.searchParams.get("locale")).toBe("en");
-    expect(url.searchParams.get("draft")).toBe(id);
-  });
-
-  it("passes {siteName} from the config, and leaves {firstName}/{projectName} unset", async () => {
-    storedConfig = { siteName: "Sam Henry", resumeEmail: RESUME_EMAIL_ON };
-    await startDraft(app);
-    await settle();
-
-    // `name` is null on a step-one draft, and THIS payload sends one display
-    // line rather than the two name parts — `founderName` is deliberately not
-    // split to guess a first name, so `{firstName}` stays unset. Both render
-    // as empty text in the email package.
-    expect(emailed().variables).toEqual({ siteName: "Sam Henry" });
-  });
-
-  // #5407 — the column the note above was waiting for. `{firstName}` is
-  // populated from `founderFirstName` and only where the founder actually
-  // gave one; nothing derives it from `founderName`.
-  it("passes {firstName} when the founder gave one, and never guesses it", async () => {
-    storedConfig = { siteName: "Sam Henry", resumeEmail: RESUME_EMAIL_ON };
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: {
-        siteKey: SITE_KEY,
-        founderFirstName: "Ada",
-        founderLastName: "Lovelace",
-        founderEmail: FOUNDER_EMAIL,
-        consent: true,
-      },
-    });
-    expect(res.statusCode).toBe(201);
-    await settle();
-
-    expect(emailed().variables).toEqual({ siteName: "Sam Henry", firstName: "Ada" });
-  });
-
-  it("passes no {siteName} when the site has not named itself", async () => {
-    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
-    await startDraft(app);
-    await settle();
-    expect(emailed().variables).toEqual({});
-  });
-
-  // ── The 201 is independent of the email ──────────────────────────────────
-
-  it("answers 201 with the token even when Resend FAILS", async () => {
-    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
-    mockSendResumeEmail.mockResolvedValue({
-      ok: false,
-      error: { kind: "send_failed", message: "Resend API error" },
-    });
-
-    const { id, resumeToken } = await startDraft(app);
-    expect(id).toMatch(/^prjl_/);
-    expect(resumeToken.length).toBeGreaterThan(0);
-
-    await settle();
-    // Logged as a KIND, never as the failure's own contents.
-    expect(mockLoggerWarn).toHaveBeenCalledWith(
-      expect.objectContaining({ errorKind: "send_failed" }),
-      "listing resume email send failed",
-    );
-  });
-
-  it("answers 201 even when the email THROWS", async () => {
-    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
-    mockSendResumeEmail.mockRejectedValue(new Error("boom"));
-
-    const { id } = await startDraft(app);
-    expect(id).toMatch(/^prjl_/);
-
-    await settle();
-    expect(mockLoggerWarn).toHaveBeenCalledWith(
-      expect.objectContaining({ errName: "Error" }),
-      "listing resume email rejected unexpectedly",
-    );
-  });
-
-  it("does NOT wait on the email — the 201 lands while the send is still pending", async () => {
-    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
-    // A send that never settles. If the route awaited it, `inject` would hang
-    // and this test would time out rather than assert.
-    mockSendResumeEmail.mockReturnValue(new Promise(() => {}));
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: START_PAYLOAD,
-    });
-    expect(res.statusCode).toBe(201);
-  });
-
-  // ── Per-recipient bound (PR #5411 security review, finding 1) ────────────
-
-  describe("bounds outbound mail per recipient", () => {
-    // `start` is ANONYMOUS and its IP limiter is evadable (`trustProxy`), so
-    // without this a loop over one victim's address is a mail bomb sent from
-    // the site's own verified domain. The cap is what makes an anonymous
-    // outbound send affordable at all.
-    beforeEach(() => {
-      storedConfig = { resumeEmail: RESUME_EMAIL_ON };
-    });
-
-    it("sends the first three, then suppresses the fourth for the same address", async () => {
-      for (let i = 0; i < 3; i++) {
-        await startDraft(app);
-        await settle();
-      }
-      expect(mockSendResumeEmail).toHaveBeenCalledTimes(3);
-
-      await startDraft(app);
-      await settle();
-      expect(mockSendResumeEmail).toHaveBeenCalledTimes(3);
-      expect(mockLoggerWarn).toHaveBeenCalledWith(
-        expect.objectContaining({ reason: "recipient_rate_limited" }),
-        "listing-resume-email-skipped",
-      );
-    });
-
-    it("suppresses the EMAIL only — the draft is still created and the 201 still carries the token", async () => {
-      // Lesson 14's rule: a quota on an unverified identifier is a lockout
-      // weapon. What this one can deny is the email, never the application —
-      // the founder in front of the form has their token from the 201.
-      for (let i = 0; i < 4; i++) {
-        await startDraft(app);
-        await settle();
-      }
-      expect(rows).toHaveLength(4);
-      const { id, resumeToken } = await startDraft(app);
-      expect(id).toMatch(/^prjl_/);
-      expect(resumeToken.length).toBeGreaterThan(0);
-    });
-
-    it("counts per (site, address) — a different address has its own budget", async () => {
-      for (let i = 0; i < 4; i++) {
-        await startDraft(app);
-        await settle();
-      }
-      mockSendResumeEmail.mockClear();
-
-      await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: { ...START_PAYLOAD, founderEmail: "grace@example.com" },
-      });
-      await settle();
-      expect(mockSendResumeEmail).toHaveBeenCalledTimes(1);
-    });
-
-    it("does not count drafts older than the window", async () => {
-      // Rolling, so a lockout clears itself rather than being permanent.
-      for (let i = 0; i < 4; i++) {
-        await startDraft(app);
-        await settle();
-      }
-      const twoHoursAgo = new Date(Date.now() - 2 * 60 * 60 * 1000);
-      for (const row of rows) row["createdAt"] = twoHoursAgo;
-      mockSendResumeEmail.mockClear();
-
-      await startDraft(app);
-      await settle();
-      expect(mockSendResumeEmail).toHaveBeenCalledTimes(1);
-    });
-  });
-
-  // ── Per-site budget (#5414) ─────────────────────────────────────────────
-
-  describe("bounds outbound mail per SITE", () => {
-    // The residual #5406 stated rather than hid: the per-recipient bound stops
-    // a loop aimed at ONE victim and does nothing about a loop over a thousand
-    // strangers, each of whom receives one message from the site's own
-    // verified sending domain. That is the pattern a mailbox provider reads as
-    // a list blast, and the cost — a flagged domain, a suspendable Resend
-    // account — lands on the site rather than on the caller.
-    let capSite = 0;
-    beforeEach(() => {
-      resolvedSiteId = `site-cap-${++capSite}`;
-      // #6335 — this describe files each test against a FRESH site, so the
-      // existence statement follows `resolvedSiteId` rather than pinning
-      // `SITE_ID`. Still keyed on the requested id: every other one
-      // resolves to nothing.
-      mockWorkspaceExists(prisma, resolvedSiteId);
-      storedConfig = { resumeEmail: { ...RESUME_EMAIL_ON, maxSendsPerHour: 3 } };
-    });
-
-    /** The `site_rate_limited` warn lines emitted so far. */
-    function capWarnings(): unknown[][] {
-      return mockLoggerWarn.mock.calls.filter(
-        ([fields]: [Record<string, unknown>]) => fields["reason"] === "site_rate_limited",
-      );
-    }
-
-    /** Start a draft from an address nobody has used, so only the SITE budget binds. */
-    async function startFromFreshAddress(n: number): Promise<void> {
-      await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: { ...START_PAYLOAD, founderEmail: `founder-${n}@example.com` },
-      });
-      await settle();
-    }
-
-    it("sends to every stranger UNDER the cap", async () => {
-      for (let i = 0; i < 3; i++) await startFromFreshAddress(i);
-      expect(mockSendResumeEmail).toHaveBeenCalledTimes(3);
-    });
-
-    it("suppresses the send once the site is AT its cap, however many addresses are used", async () => {
-      for (let i = 0; i < 6; i++) await startFromFreshAddress(i);
-      // Three sent, three suppressed — the per-recipient bound never fired,
-      // since every address here is distinct and used once.
-      expect(mockSendResumeEmail).toHaveBeenCalledTimes(3);
-      expect(mockLoggerWarn).toHaveBeenCalledWith(
-        expect.objectContaining({ reason: "site_rate_limited" }),
-        "listing-resume-email-skipped",
-      );
-    });
-
-    it("keeps start's 201 and still creates the draft at the cap", async () => {
-      for (let i = 0; i < 6; i++) await startFromFreshAddress(i);
-      mockSendResumeEmail.mockClear();
-
-      // The founder in front of the form loses the EMAIL and nothing else:
-      // their draft exists and their resume token is in the response body.
-      const res = await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: { ...START_PAYLOAD, founderEmail: "over-the-cap@example.com" },
-      });
-      expect(res.statusCode).toBe(201);
-      const { id, resumeToken } = (
-        res.json() as { data: { id: string; resumeToken: string } }
-      ).data;
-      expect(id).toMatch(/^prjl_/);
-      expect(resumeToken.length).toBeGreaterThan(0);
-      await settle();
-      expect(mockSendResumeEmail).not.toHaveBeenCalled();
-      expect(rows.some((row) => row["id"] === id)).toBe(true);
-    });
-
-    it("recovers when the window rolls past the earlier drafts", async () => {
-      for (let i = 0; i < 6; i++) await startFromFreshAddress(i);
-      expect(mockSendResumeEmail).toHaveBeenCalledTimes(3);
-
-      const twoHoursAgo = new Date(Date.now() - 2 * 60 * 60 * 1000);
-      for (const row of rows) row["createdAt"] = twoHoursAgo;
-      mockSendResumeEmail.mockClear();
-
-      await startFromFreshAddress(99);
-      expect(mockSendResumeEmail).toHaveBeenCalledTimes(1);
-    });
-
-    it("counts each SITE independently — one site's flood does not silence another", async () => {
-      // Tenant isolation, on the budget itself: the count is keyed on the
-      // siteId read off the DRAFT ROW, so a site that has sent nothing sends.
-      for (let i = 0; i < 6; i++) await startFromFreshAddress(i);
-      mockSendResumeEmail.mockClear();
-
-      const counts = (prisma.projectListing.count as jest.Mock).mock.calls.map(
-        ([arg]: [{ where: Record<string, unknown> }]) => arg.where["siteId"],
-      );
-      expect(counts.length).toBeGreaterThan(0);
-      for (const siteId of counts) expect(siteId).toBe(resolvedSiteId);
-
-      // A second site, its own config row, its own empty budget.
-      const OTHER_SITE = "site-2";
-      // #6335 — named explicitly, beside this test's own site: the draft is
-      // filed against OTHER_SITE, so its workspace must resolve too.
-      mockWorkspaceExists(prisma, resolvedSiteId, OTHER_SITE);
-      (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
-        ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
-          if (where.publicKey !== undefined) {
-            return Promise.resolve({ siteId: OTHER_SITE });
-          }
-          return Promise.resolve({
-            data: { resumeEmail: { ...RESUME_EMAIL_ON, maxSendsPerHour: 3 } },
-          });
-        },
-      );
-
-      await startFromFreshAddress(100);
-      expect(mockSendResumeEmail).toHaveBeenCalledTimes(1);
-      expect(rows.at(-1)!["siteId"]).toBe(OTHER_SITE);
-    });
-
-    it("still applies the per-recipient bound under a generous site cap", async () => {
-      // The two bounds are independent. A site with plenty of site-wide budget
-      // must still not mail ONE address more than three times in an hour.
-      storedConfig = { resumeEmail: { ...RESUME_EMAIL_ON, maxSendsPerHour: 1000 } };
-      for (let i = 0; i < 5; i++) {
-        await startDraft(app);
-        await settle();
-      }
-      expect(mockSendResumeEmail).toHaveBeenCalledTimes(3);
-      expect(mockLoggerWarn).toHaveBeenCalledWith(
-        expect.objectContaining({ reason: "recipient_rate_limited" }),
-        "listing-resume-email-skipped",
-      );
-    });
-
-    it("logs the site cap ONCE per window, with the siteId and the count only", async () => {
-      for (let i = 0; i < 8; i++) await startFromFreshAddress(i);
-
-      const capLogs = capWarnings();
-      // Five sends were suppressed; a line per suppressed send would hand an
-      // attacker a log-flooding primitive on top of everything else.
-      expect(capLogs).toHaveLength(1);
-      expect(capLogs[0]).toEqual([
-        { siteId: resolvedSiteId, count: 4, reason: "site_rate_limited" },
-        "listing-resume-email-skipped",
-      ]);
-    });
-
-    it("logs AGAIN in the next window — the throttle is a window, not a latch", async () => {
-      // The dedupe remembers per site in module state. If it never expired, a
-      // site attacked on Monday would trip its cap silently for the rest of
-      // the deployment's life, which is the failure mode a throttle is most
-      // likely to have and least likely to be noticed having.
-      const realNow = Date.now.bind(Date);
-      try {
-        for (let i = 0; i < 5; i++) await startFromFreshAddress(i);
-        expect(capWarnings()).toHaveLength(1);
-
-        // Two hours on. The earlier drafts fall out of the window with the
-        // clock, so the budget refills and has to be spent again.
-        jest.spyOn(Date, "now").mockImplementation(() => realNow() + 2 * 60 * 60 * 1000);
-        for (let i = 10; i < 15; i++) await startFromFreshAddress(i);
-        expect(capWarnings()).toHaveLength(2);
-      } finally {
-        jest.spyOn(Date, "now").mockRestore();
-      }
-    });
-
-    it("logs no address, no name, no token and no draft id when the cap is hit", async () => {
-      const tokens: string[] = [];
-      for (let i = 0; i < 6; i++) {
-        const res = await app.inject({
-          method: "POST",
-          url: "/v1/project-listings",
-          payload: { ...START_PAYLOAD, founderEmail: `founder-${i}@example.com` },
-        });
-        tokens.push((res.json() as { data: { resumeToken: string } }).data.resumeToken);
-        await settle();
-      }
-
-      const capLogs = JSON.stringify(capWarnings());
-      expect(capLogs).not.toContain("founder-");
-      expect(capLogs).not.toContain(FOUNDER_NAME);
-      for (const token of tokens) expect(capLogs).not.toContain(token);
-      for (const row of rows) expect(capLogs).not.toContain(row["id"] as string);
-      expect(capLogs).not.toContain(BASE_URL);
-    });
-
-    it("falls back to the PLATFORM cap when the site wrote an invalid one", async () => {
-      // `.catch(undefined)` on the member: a bad cap costs the CAP, never the
-      // addressing beside it. Twenty is the platform default, so a site that
-      // typed `0` sends its fourth email rather than none.
-      storedConfig = {
-        maxWindowDays: 7,
-        resumeEmail: { ...RESUME_EMAIL_ON, maxSendsPerHour: 0 },
-      };
-      for (let i = 0; i < 4; i++) await startFromFreshAddress(i);
-      expect(mockSendResumeEmail).toHaveBeenCalledTimes(4);
-      // And the operator is told their value is not in effect, by NAME only.
-      expect(mockLoggerWarn).toHaveBeenCalledWith(
-        { siteId: resolvedSiteId, field: "resumeEmail.maxSendsPerHour" },
-        expect.stringContaining("DROPPED"),
-      );
-    });
-
-    it("suppresses at the PLATFORM cap when the site configured none", async () => {
-      storedConfig = { resumeEmail: RESUME_EMAIL_ON };
-      for (let i = 0; i < 21; i++) await startFromFreshAddress(i);
-      expect(mockSendResumeEmail).toHaveBeenCalledTimes(20);
-    });
-  });
-
-  // ── Tenant isolation ─────────────────────────────────────────────────────
-
-  it("reads the config for the DRAFT'S OWN siteId, never one from the body", async () => {
-    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
-    await startDraft(app);
-    await settle();
-
-    const configReads = (prisma.siteListingConfig.findUnique as jest.Mock).mock.calls.filter(
-      ([arg]: [{ where: Record<string, unknown> }]) => arg.where["siteId"] !== undefined,
-    );
-    expect(configReads.length).toBeGreaterThan(0);
-    for (const [arg] of configReads) {
-      expect((arg as { where: Record<string, unknown> }).where["siteId"]).toBe(SITE_ID);
-    }
-    // And the row the send read its site off is the one just created.
-    expect(rows[0]!["siteId"]).toBe(SITE_ID);
-  });
-
-  // ── Runtime configuration ────────────────────────────────────────────────
-
-  it("sends TWICE with different config rows and no module reload", async () => {
-    // The issue's whole premise: an operator edits SiteListingConfig and the
-    // NEXT email changes. Nothing between the two starts re-imports a module,
-    // restarts the app, or resets a cache — only the stored row moves.
-    storedConfig = {
-      siteName: "First Site",
-      resumeEmail: { fromAddress: "one@a.example", baseUrl: "https://a.example/apply" },
-    };
-    await startDraft(app);
-    await settle();
-
-    storedConfig = {
-      siteName: "Second Site",
-      resumeEmail: {
-        fromAddress: "two@b.example",
-        baseUrl: "https://b.example/apply",
-        subject: "A whole new subject",
-      },
-    };
-    await startDraft(app);
-    await settle();
-
-    expect(mockSendResumeEmail).toHaveBeenCalledTimes(2);
-    expect(emailed(0).settings.fromAddress).toBe("one@a.example");
-    expect(emailed(0).variables.siteName).toBe("First Site");
-    expect(emailed(0).settings.subject).toBeUndefined();
-    expect(emailed(1).settings.fromAddress).toBe("two@b.example");
-    expect(emailed(1).variables.siteName).toBe("Second Site");
-    expect(emailed(1).settings.subject).toBe("A whole new subject");
-    expect(emailed(1).resumeLink.startsWith("https://b.example/apply")).toBe(true);
-  });
-
-  // ── PII ──────────────────────────────────────────────────────────────────
-
-  it("logs no founder email, no founder name, no resume token and no link", async () => {
-    storedConfig = { siteName: "Sam Henry", resumeEmail: RESUME_EMAIL_ON };
-    mockSendResumeEmail.mockResolvedValue({
-      ok: false,
-      error: { kind: "send_failed", message: "Resend API error" },
-    });
-
-    const { resumeToken } = await startDraft(app);
-    await settle();
-
-    const logged = JSON.stringify([
-      ...mockLoggerInfo.mock.calls,
-      ...mockLoggerWarn.mock.calls,
-      ...mockLoggerError.mock.calls,
-    ]);
-    expect(logged).not.toContain(FOUNDER_EMAIL);
-    expect(logged).not.toContain(FOUNDER_NAME);
-    expect(logged).not.toContain(resumeToken);
-    // The link CARRIES the token, so it is PII-equivalent on this surface.
-    expect(logged).not.toContain(BASE_URL);
-    // What IS logged: routing metadata only.
-    expect(mockLoggerWarn).toHaveBeenCalledWith(
-      { siteId: SITE_ID, listingId: rows[0]!["id"], errorKind: "send_failed" },
-      "listing resume email send failed",
-    );
-  });
-
-  // ── A dropped config block is observable (PR #5411 review, item 2) ───────
-
-  it("warns when a malformed resumeEmail block is DROPPED, naming the field only", async () => {
-    // `.catch(undefined)` keeps the site's window bounds when its email block
-    // is malformed — correct behaviour, but silent. This is what makes it
-    // findable: an operator who typos a key gets a line saying so.
-    storedConfig = {
-      maxWindowDays: 7,
-      resumeEmail: { fromAddress: "hello@samhenry.org", subjct: "typo" },
-    };
-    await startDraft(app);
-    await settle();
-
-    expect(mockSendResumeEmail).not.toHaveBeenCalled();
-    expect(mockLoggerWarn).toHaveBeenCalledWith(
-      { siteId: SITE_ID, field: "resumeEmail" },
-      expect.stringContaining("DROPPED"),
-    );
-    // Field name only — never the site's addresses or its copy.
-    const logged = JSON.stringify(mockLoggerWarn.mock.calls);
-    expect(logged).not.toContain("hello@samhenry.org");
-  });
-});
-
-// ── #6335 — the explicit workspace setup above is load-bearing ────────────
-//
-// Every case in this file states that this suite's site has a workspace.
-// This one takes that away, and proves the statement was doing work rather
-// than decorating the setup: `startProjectListingDraft` resolves the site it
-// is filing against (`resolveWorkspaceIdForSite`, services/project-listings.ts)
-// and refuses BEFORE any row is written. With the shared prisma mock's old
-// permissive default in place this case could not be written at all — every
-// id resolved, so the fail-closed path was unreachable from a route test.
-describe("#6335 — start fails closed when the site names no workspace", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    mockNoWorkspace(prisma);
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("answers 503 tenant_unresolved and creates no ProjectListing", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: START_PAYLOAD,
-    });
-
-    expect(res.statusCode).toBe(503);
-    expect((res.json() as { error: { code: string } }).error.code).toBe(
-      "tenant_unresolved",
-    );
-    expect(prisma.projectListing.create).not.toHaveBeenCalled();
-    expect(rows).toHaveLength(0);
-  });
-});