create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/__tests__/commerce-claim-registration.test.ts

@@ -0,0 +1,407 @@
+/**
+ * @file commerce-claim-registration.test.ts
+ * @description The commerce PRIMITIVES serve on the license claim, not the
+ * module flag (DECISION-LOG D-64, epic #5770, #5796).
+ *
+ * `POST /v1/checkout/sessions` (the checkout launcher) and
+ * `POST /v1/webhooks/stripe` (the webhook receiver + customer mapping) are
+ * registered unconditionally in `server.ts` — no `isModuleEnabled("commerce")`
+ * gate. Every case below therefore runs with **no module flag set at all**
+ * (`AILK_ENABLED_MODULES` deleted), so a pass cannot be explained by module
+ * registration; only the stubbed `checkLicense()` result varies.
+ *
+ * The four gate cases:
+ *
+ *   1. keyless (free, no features) → checkout answers the module-disabled 404
+ *   2. keyless                     → the webhook answers the module-disabled 404
+ *   3. commerce claim              → checkout serves (never 404)
+ *   4. commerce claim              → the webhook serves (never 404)
+ *
+ * Plus D3's webhook order: a **signed** event on an **unclaimed** build is
+ * acked 200 and dropped with a structured log line — the signature is settled
+ * before the claim is consulted, so Stripe stops retrying against a site that
+ * turned commerce off, while an unsigned body on that same build gets the
+ * module-disabled 404 (indistinguishable from a build without the module).
+ *
+ * "Serves" is measured as "not Fastify's own 404 and not the gate's 404" —
+ * the same signal `module-exclusion.test.ts` uses. A registered-and-claimed
+ * checkout route answers 400 (Zod validation, empty body), never 404.
+ *
+ * Mirrors `src/__tests__/server.test.ts`'s external-boundary mocks.
+ */
+
+jest.mock('@fastify/cors', () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock('@fastify/rate-limit', () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock('@working-theory/email', () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
+}));
+
+const mockCheckLicense = jest.fn();
+// `checkLicense` is stubbed (it reaches the network and the clock);
+// `readStoredJwtState` deliberately is NOT — the unreadable-storage case below
+// proves the 503 through the package's REAL filesystem read, pointed at a
+// fixture path via `AILK_LICENSE_STORAGE_PATH` (#5820). Stubbing it here would
+// assert only that the stub was called.
+jest.mock('@working-theory/license', () => ({
+  ...jest.requireActual('@working-theory/license'),
+  checkLicense: (...args: unknown[]) => mockCheckLicense(...args),
+}));
+
+const mockVerifyWebhookSignature = jest.fn();
+class MockStripeWebhookSignatureError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'StripeWebhookSignatureError';
+  }
+}
+// #6084 — GET /v1/checkout/sessions/:id's own retrieve, stubbed with a
+// payload-free default so a claimed request that never called mockReset
+// still answers 200 rather than throwing `undefined`.
+const mockRetrieveCheckoutSession = jest.fn();
+
+jest.mock('@working-theory/stripe-client', () => ({
+  verifyWebhookSignature: (...args: unknown[]) =>
+    mockVerifyWebhookSignature(...args),
+  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
+  assertSandboxKey: jest.fn(),
+  createCheckoutSession: jest.fn(),
+  retrieveCheckoutSession: (...args: unknown[]) =>
+    mockRetrieveCheckoutSession(...args),
+  getStripeClient: jest.fn(),
+  STRIPE_API_VERSION: '2024-06-20',
+  StripeConfigError: class StripeConfigError extends Error {},
+  UnknownProductCodeError: class UnknownProductCodeError extends Error {},
+  UnknownSessionError: class UnknownSessionError extends Error {},
+  WEBHOOK_TOLERANCE_SECONDS: 300,
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary; __mocks__/prisma.ts is the repo-standard double.
+jest.mock('../lib/prisma.js');
+
+import { promises as fs } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+
+import { __resetBuckets } from '../middleware/rate-limit.js';
+import { prisma } from '../lib/prisma.js';
+import { build } from '../server';
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics
+type App = any;
+
+// The reserved-range sentinel values from database/tenancy.ts (ADR-0031
+// rule 7) — re-declared here as literals so the test pins the WIRE values,
+// the same convention middleware/__tests__/default-tenant.test.ts uses.
+const DEFAULT_ORG_ID = 'org_00000000-0000-7000-8000-000000000001';
+const DEFAULT_WORKSPACE_ID = 'wksp_00000000-0000-7000-8000-000000000001';
+
+const FREE_LICENSE = {
+  tier: 'free' as const,
+  plan: null,
+  features: [] as string[],
+  expiresAt: null,
+  revoked: false,
+};
+
+const COMMERCE_LICENSE = {
+  tier: 'pro' as const,
+  plan: 'pro-monthly',
+  features: ['commerce'] as string[],
+  expiresAt: null,
+  revoked: false,
+};
+
+const CHECKOUT = { method: 'POST' as const, url: '/v1/checkout/sessions' };
+const WEBHOOK = { method: 'POST' as const, url: '/v1/webhooks/stripe' };
+// #6084 — the read half. `cs_test_...` shape-passes the route's own gate so
+// a claim-gate assertion never masquerades as a shape-gate 400.
+const CHECKOUT_SESSION_READ = {
+  method: 'GET' as const,
+  url: '/v1/checkout/sessions/cs_test_commerce_claim_fixture',
+};
+
+/** Build with NO module flag set — the whole point of the matrix. */
+async function buildKeylessModuleSet(): Promise<App> {
+  delete process.env.AILK_ENABLED_MODULES;
+  return build();
+}
+
+describe('Commerce primitives gate on the license claim, not the module flag (D-64, #5796)', () => {
+  let app: App;
+
+  beforeEach(() => {
+    // #6155 D6 — build() now awaits assertSiteAliasResolves(), which reads
+    // prisma.workspace for the unpinned "default" alias every case here
+    // resolves under (no case sets AILK_SITE_ID). None of this file's
+    // assertions are about tenancy, so this stubs the healthy default —
+    // the seeded sentinel workspace resolving cleanly — rather than
+    // widening the shared mock's own default for every OTHER consumer.
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
+      id: DEFAULT_WORKSPACE_ID,
+      organizationId: DEFAULT_ORG_ID,
+    });
+    mockCheckLicense.mockReset();
+    mockVerifyWebhookSignature.mockReset();
+    mockRetrieveCheckoutSession.mockReset();
+    mockRetrieveCheckoutSession.mockResolvedValue({
+      id: 'cs_test_commerce_claim_fixture',
+      status: 'complete',
+      paymentStatus: 'paid',
+      currency: 'usd',
+      amountTotal: 100,
+      lineItems: [],
+    });
+    // The GET's own rate limiter is MODULE-scoped (middleware/rate-limit.ts
+    // § "Module-scoped bucket store") and shared across every `it` in this
+    // file's single module instance.
+    __resetBuckets();
+    delete process.env.AILK_ENABLED_MODULES;
+    // A keyless deployment configures no licence at all — the state the gate
+    // reads as a positive "no". Tests that need the expired case set it.
+    delete process.env.AILK_LICENSE_KEY;
+    // Every case starts from a storage path that does NOT exist — the `absent`
+    // state. The unreadable case below creates a directory at its own path.
+    process.env.AILK_LICENSE_STORAGE_PATH = join(
+      tmpdir(),
+      `ailk-claim-absent-${process.pid}-${Date.now()}.jwt`,
+    );
+  });
+
+  afterEach(async () => {
+    if (app) {
+      await app.close();
+      app = undefined;
+    }
+    delete process.env.AILK_ENABLED_MODULES;
+    delete process.env.AILK_LICENSE_KEY;
+    delete process.env.AILK_LICENSE_STORAGE_PATH;
+  });
+
+  describe('keyless build (checkLicense stubbed free)', () => {
+    beforeEach(() => {
+      mockCheckLicense.mockResolvedValue(FREE_LICENSE);
+    });
+
+    it('answers the module-disabled response on POST /v1/checkout/sessions', async () => {
+      app = await buildKeylessModuleSet();
+      const res = await app.inject({
+        ...CHECKOUT,
+        payload: { productCode: 'x', successUrl: 'https://a', cancelUrl: 'https://b' },
+      });
+      expect(res.statusCode).toBe(404);
+      expect(res.json()).toEqual({ error: 'not_found', message: 'Not found' });
+    });
+
+    it('answers the module-disabled response on POST /v1/webhooks/stripe', async () => {
+      app = await buildKeylessModuleSet();
+      const res = await app.inject({ ...WEBHOOK, payload: {} });
+      expect(res.statusCode).toBe(404);
+      expect(res.json()).toEqual({ error: 'not_found', message: 'Not found' });
+    });
+
+    // #6084 AC-3/T-5 — the GET inherits the SAME scope preHandler as the
+    // POST above; this harness (a full server build with checkLicense
+    // stubbed) is the one that actually exercises the gate, unlike
+    // sessions.test.ts's/session.test.ts's own bare-registration harness
+    // (§9 SA-4).
+    it('answers the module-disabled response on GET /v1/checkout/sessions/:id', async () => {
+      app = await buildKeylessModuleSet();
+      const res = await app.inject(CHECKOUT_SESSION_READ);
+      expect(res.statusCode).toBe(404);
+      expect(res.json()).toEqual({ error: 'not_found', message: 'Not found' });
+      expect(mockRetrieveCheckoutSession).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('commerce-claimed build (checkLicense stubbed with the claim)', () => {
+    beforeEach(() => {
+      mockCheckLicense.mockResolvedValue(COMMERCE_LICENSE);
+    });
+
+    it('serves POST /v1/checkout/sessions with no module flag set', async () => {
+      app = await buildKeylessModuleSet();
+      expect(process.env.AILK_ENABLED_MODULES).toBeUndefined();
+      const res = await app.inject({ ...CHECKOUT, payload: {} });
+      expect(res.statusCode).not.toBe(404);
+      expect(res.statusCode).toBe(400); // Zod validation — the handler ran
+    });
+
+    it('serves POST /v1/webhooks/stripe with no module flag set', async () => {
+      app = await buildKeylessModuleSet();
+      expect(process.env.AILK_ENABLED_MODULES).toBeUndefined();
+      const res = await app.inject({ ...WEBHOOK, payload: {} });
+      expect(res.statusCode).not.toBe(404);
+      expect(res.statusCode).toBe(400); // signature-missing — the handler ran
+      expect(res.json()).toEqual({ error: 'signature-missing' });
+    });
+
+    // #6084 AC-3/T-5
+    it('serves GET /v1/checkout/sessions/:id with no module flag set', async () => {
+      app = await buildKeylessModuleSet();
+      expect(process.env.AILK_ENABLED_MODULES).toBeUndefined();
+      const res = await app.inject(CHECKOUT_SESSION_READ);
+      expect(res.statusCode).not.toBe(404);
+      expect(res.statusCode).toBe(200); // the handler ran
+      expect(mockRetrieveCheckoutSession).toHaveBeenCalledWith({
+        sessionId: 'cs_test_commerce_claim_fixture',
+      });
+    });
+  });
+
+  // Security review 2026-09-16, High, as disposed in round 2. The pre-review
+  // gate collapsed "no claim" and "could not read the licence" into one
+  // `false`, so a signed checkout.session.completed on a LIVE commerce site
+  // whose licence read merely failed was acked 200 and lost — Stripe records
+  // success and never redelivers, and the charge is never mapped.
+  //
+  // Round 2 widens `undetermined` past the throw: a REVOKED licence and a
+  // CONFIGURED-but-free (expired/unverifiable) one are both live commerce
+  // deployments mid-window, so neither may be dropped either.
+  describe('undetermined licence — the read established no "no", so nothing may be dropped', () => {
+    const SIGNED_EVENT = {
+      id: 'evt_undetermined_01',
+      type: 'checkout.session.completed',
+      data: { object: { id: 'cs_x', payment_status: 'paid' } },
+    };
+
+    it('holds a SIGNED event with a retryable 503 + Retry-After when the read throws', async () => {
+      mockCheckLicense.mockRejectedValue(new Error('licence read blew up'));
+      mockVerifyWebhookSignature.mockReturnValue(SIGNED_EVENT);
+      app = await buildKeylessModuleSet();
+
+      const res = await app.inject({
+        ...WEBHOOK,
+        headers: { 'stripe-signature': 't=1,v1=deadbeef' },
+        payload: { any: 'body' },
+      });
+
+      expect(res.statusCode).toBe(503);
+      expect(res.json()).toEqual({ error: 'license-undetermined' });
+      // Stripe reads Retry-After; without it the redelivery schedule is the
+      // default backoff rather than the window this gate intends.
+      expect(res.headers['retry-after']).toBe('300');
+    });
+
+    it('holds a SIGNED event when the licence is REVOKED — a revoked site is still live mid-window', async () => {
+      mockCheckLicense.mockResolvedValue({ ...COMMERCE_LICENSE, revoked: true });
+      mockVerifyWebhookSignature.mockReturnValue(SIGNED_EVENT);
+      app = await buildKeylessModuleSet();
+
+      const res = await app.inject({
+        ...WEBHOOK,
+        headers: { 'stripe-signature': 't=1,v1=deadbeef' },
+        payload: { any: 'body' },
+      });
+
+      expect(res.statusCode).toBe(503);
+      expect(res.headers['retry-after']).toBe('300');
+    });
+
+    it('holds a SIGNED event when a licence IS configured yet resolves free — the EXPIRED case', async () => {
+      // Presence is the whole test — the gate never parses this value, so it
+      // is deliberately not JWT-shaped (a realistic stub trips the secret
+      // scanner's entropy rule for no benefit).
+      process.env.AILK_LICENSE_KEY = 'fixture';
+      mockCheckLicense.mockResolvedValue(FREE_LICENSE);
+      mockVerifyWebhookSignature.mockReturnValue(SIGNED_EVENT);
+      app = await buildKeylessModuleSet();
+
+      const res = await app.inject({
+        ...WEBHOOK,
+        headers: { 'stripe-signature': 't=1,v1=deadbeef' },
+        payload: { any: 'body' },
+      });
+
+      expect(res.statusCode).toBe(503);
+      expect(res.headers['retry-after']).toBe('300');
+    });
+
+    // #5820: the read did not throw and nothing is configured in env — the
+    // storage file simply could not be READ. Before this fix `readStoredJwt()`
+    // collapsed that into the same `null` it returns for "no file", so the
+    // event was acked 200 and dropped and the charge was never mapped. Proven
+    // through the package's real filesystem read (a directory at the storage
+    // path), not a stub.
+    it('holds a SIGNED event when the storage file is UNREADABLE — a directory at the licence path', async () => {
+      const tempDir = await fs.mkdtemp(join(tmpdir(), 'ailk-claim-storage-'));
+      const unreadable = join(tempDir, '.ailk-license.jwt');
+      await fs.mkdir(unreadable);
+      process.env.AILK_LICENSE_STORAGE_PATH = unreadable;
+
+      mockCheckLicense.mockResolvedValue(FREE_LICENSE);
+      mockVerifyWebhookSignature.mockReturnValue(SIGNED_EVENT);
+      app = await buildKeylessModuleSet();
+
+      try {
+        const res = await app.inject({
+          ...WEBHOOK,
+          headers: { 'stripe-signature': 't=1,v1=deadbeef' },
+          payload: { any: 'body' },
+        });
+
+        expect(res.statusCode).toBe(503);
+        expect(res.json()).toEqual({ error: 'license-undetermined' });
+        expect(res.headers['retry-after']).toBe('300');
+      } finally {
+        await fs.rm(tempDir, { recursive: true, force: true });
+      }
+    });
+
+    // Round 2, D1: the CHECKOUT launcher does not hold. A checkout that cannot
+    // be started loses nothing, so both non-serving states answer the same
+    // module-disabled 404 and the route stays indistinguishable from a build
+    // without the module.
+    it('answers the module-disabled 404 on checkout — a checkout that cannot start loses nothing', async () => {
+      mockCheckLicense.mockRejectedValue(new Error('licence read blew up'));
+      app = await buildKeylessModuleSet();
+      const res = await app.inject({ ...CHECKOUT, payload: {} });
+      expect(res.statusCode).toBe(404);
+      expect(res.json()).toEqual({ error: 'not_found', message: 'Not found' });
+    });
+  });
+
+  describe('D3 — the Stripe signature is settled before the claim is consulted', () => {
+    it('acks a signed-but-unclaimed event 200 and drops it', async () => {
+      mockCheckLicense.mockResolvedValue(FREE_LICENSE);
+      mockVerifyWebhookSignature.mockReturnValue({
+        id: 'evt_unclaimed_0001',
+        type: 'customer.created',
+        data: { object: { id: 'cus_x', email: 'a@b.test' } },
+      });
+      app = await buildKeylessModuleSet();
+
+      const res = await app.inject({
+        ...WEBHOOK,
+        headers: { 'stripe-signature': 't=1,v1=deadbeef' },
+        payload: { any: 'body' },
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(res.json()).toEqual({ received: true });
+      // The signature was verified BEFORE the claim was consulted.
+      expect(mockVerifyWebhookSignature).toHaveBeenCalledTimes(1);
+    });
+
+    // "Rejected before the claim is read" in the only form AC 1 leaves open:
+    // on a CLAIMED build — where the claim cannot be what refuses it — an
+    // unsigned body is still refused 400 and never dispatched. The claim never
+    // admits an unverified body. (On an UNCLAIMED build the module-disabled
+    // 404 wins instead, which is AC 1 and round-1 D3, unchanged here.)
+    it('refuses an unsigned body on a CLAIMED build — the claim never admits an unverified body', async () => {
+      mockCheckLicense.mockResolvedValue(COMMERCE_LICENSE);
+      app = await buildKeylessModuleSet();
+
+      const res = await app.inject({ ...WEBHOOK, payload: { any: 'body' } });
+
+      expect(res.statusCode).toBe(400);
+      expect(res.json()).toEqual({ error: 'signature-missing' });
+      expect(mockVerifyWebhookSignature).not.toHaveBeenCalled();
+    });
+  });
+});

package/templates/apps/api/src/__tests__/module-exclusion.test.ts

@@ -59,14 +59,39 @@ async function withEnabledModules<T>(
 // caught by the "still registered" assertions below.
 const MODULE_ROUTES: Record<string, { method: 'GET' | 'POST'; url: string }[]> =
   {
+    // /v1/waitlist-experiments and /v1/project-listings are deliberately NOT
+    // listed here since #5677: the review surface registers under EITHER
+    // multi-tenant OR signal-collectors, so excluding multi-tenant alone
+    // leaves them registered by design — the same shape the workspace-settings
+    // routes have. Their matrix is `review-surface-registration.test.ts`,
+    // beside `workspace-module-registration.test.ts`.
     'multi-tenant': [
       { method: 'GET', url: '/v1/workspaces' },
       { method: 'GET', url: '/v1/billing' },
-      { method: 'GET', url: '/v1/waitlist-experiments' },
-      { method: 'GET', url: '/v1/project-listings' },
     ],
-    scheduling: [{ method: 'GET', url: '/v1/schedule/availability' }],
-    'content-write': [{ method: 'POST', url: '/v1/content/BlogPosting' }],
+    // #6085 (brief H7) adds two more representative routes for this SAME
+    // module key: the webhook receiver (unsigned → 400 if registered, never
+    // 404 without seed data) and the tenant-guarded appointments read
+    // (unauthenticated → 401 if registered, the same shape /v1/billing
+    // takes in the multi-tenant row above).
+    scheduling: [
+      { method: 'GET', url: '/v1/schedule/availability' },
+      { method: 'POST', url: '/v1/webhooks/calcom' },
+      { method: 'GET', url: '/v1/schedule/appointments' },
+    ],
+    // #5853 retired the untenanted /v1/content writes; content-write's
+    // representative route is now the tenant-guarded editor surface. A
+    // REGISTERED route answers 401 here (no session on the inject), an
+    // unregistered one answers Fastify's own 404 — so the "still registered
+    // => not 404" assertion below stays unambiguous, which this matrix's
+    // header requires. The retired URLs are asserted separately, and
+    // module-independently, by RETIRED_ROUTES below.
+    'content-write': [
+      {
+        method: 'POST',
+        url: '/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000aa/content',
+      },
+    ],
     // D-48 signal-collectors (#5366). Each route is chosen so a REGISTERED
     // handler never itself answers 404 without seed data (an unregistered
     // route is Fastify's own 404, so a route whose "not found" business
@@ -93,21 +118,66 @@ const MODULE_ROUTES: Record<string, { method: 'GET' | 'POST'; url: string }[]> =
       { method: 'GET', url: '/v1/waitlist-signups/me' },
       { method: 'POST', url: '/v1/slack/actions' },
     ],
-    // D-47 commerce (#5364): checkout, the Stripe webhook receiver, the
-    // flow-checkouts read and the recommender's two email-moment routes —
-    // one representative route per registration site server.ts gates on
+    // D-47 commerce (#5364), narrowed by D-64 (#5796): the flow-checkouts
+    // read and the recommender's two email-moment routes — commerce OVERLAY,
+    // still one representative route per registration site server.ts gates on
     // isModuleEnabled("commerce").
+    //
+    // /v1/checkout/sessions and /v1/webhooks/stripe are deliberately NOT
+    // listed here any more: they are the base-tree PRIMITIVES, registered
+    // unconditionally and gated on the `commerce` LICENCE CLAIM instead. They
+    // still 404 on every case in this file (no licence is configured in the
+    // test env, so the claim is absent), but they would 404 under the
+    // "every module enabled" case too, which is the opposite of what this
+    // matrix asserts. Their matrix is `commerce-claim-registration.test.ts`.
     commerce: [
-      { method: 'POST', url: '/v1/checkout/sessions' },
-      { method: 'POST', url: '/v1/webhooks/stripe' },
       { method: 'GET', url: '/v1/flow-checkouts/me' },
       { method: 'POST', url: '/v1/flows/x/checkout' },
       { method: 'POST', url: '/v1/flows/x/save' },
     ],
   };
 
+/**
+ * The untenanted content-write routes #5853 RETIRED by deletion.
+ *
+ * Unlike every row in MODULE_ROUTES these belong to no module: they must
+ * answer Fastify's own 404 on EVERY build, whatever AILK_ENABLED_MODULES
+ * says, which is AC-1's retirement half. They are asserted inside each case
+ * below rather than in one case of their own, because "on every build" is
+ * precisely the claim.
+ *
+ * MODULE_ROUTES' method union is 'GET' | 'POST', so this carries its own.
+ */
+const RETIRED_ROUTES: {
+  method: 'POST' | 'PATCH' | 'DELETE';
+  url: string;
+}[] = [
+  { method: 'POST', url: '/v1/content/BlogPosting' },
+  { method: 'PATCH', url: '/v1/content/BlogPosting/x' },
+  { method: 'DELETE', url: '/v1/content/BlogPosting/x' },
+];
+
+async function expectRetiredRoutesGone(app: App): Promise<void> {
+  for (const { method, url } of RETIRED_ROUTES) {
+    const res = await app.inject({ method, url });
+    expect(res.statusCode).toBe(404);
+  }
+}
+
 const ALL_MODULES = Object.keys(MODULE_ROUTES);
 
+// A module whose registration is ALSO gated on another module in this matrix.
+// content-write's scope is gated `content-write && (workspace || multi-tenant)`
+// (#5853): its route file imports lib/tenant-db.ts, which only the tenancy
+// slices deliver, so a build without a tenancy module must not register it.
+// `workspace` is not a row of this matrix, so within it the dependency is on
+// multi-tenant alone: excluding multi-tenant legitimately 404s content-write's
+// route too, and the "every OTHER module stays registered" sweep skips that
+// one pair. Every other pair is asserted as before.
+const MODULE_DEPENDENCIES: Record<string, readonly string[]> = {
+  'content-write': ['multi-tenant'],
+};
+
 describe('Module exclusion — registration vanishes with the module (S1, #5088)', () => {
   let app: App;
 
@@ -132,11 +202,14 @@ describe('Module exclusion — registration vanishes with the module (S1, #5088)
 
       for (const other of ALL_MODULES) {
         if (other === excluded) continue;
+        if ((MODULE_DEPENDENCIES[other] ?? []).includes(excluded)) continue;
         for (const { method, url } of MODULE_ROUTES[other]!) {
           const res = await app.inject({ method, url });
           expect(res.statusCode).not.toBe(404);
         }
       }
+
+      await expectRetiredRoutesGone(app);
     },
   );
 
@@ -156,6 +229,9 @@ describe('Module exclusion — registration vanishes with the module (S1, #5088)
       url: '/v1/content/types',
     });
     expect(contentTypes.statusCode).not.toBe(404);
+
+    // AC-1's retirement half: gone even with EVERY module enabled.
+    await expectRetiredRoutesGone(app);
   });
 
   it('excluding every paid module at once still serves the free surface', async () => {
@@ -174,6 +250,8 @@ describe('Module exclusion — registration vanishes with the module (S1, #5088)
         expect(res.statusCode).toBe(404);
       }
     }
+
+    await expectRetiredRoutesGone(app);
   });
 
   // D-44 / #5368: an unset AILK_ENABLED_MODULES is now the same as an
@@ -195,5 +273,7 @@ describe('Module exclusion — registration vanishes with the module (S1, #5088)
         expect(res.statusCode).toBe(404);
       }
     }
+
+    await expectRetiredRoutesGone(app);
   });
 });