Forty-one tests guard the checkout before any human reviews the code

The site has forty-one unit tests across three files — products, checkout, and contact. Every test runs through Vitest with a Node environment and path aliases matching the tsconfig so imports like @/lib/products resolve the same way they do in production. The product tests validate the entire catalog at compile time. Every product must have a truthy id, name, description, and priceLabel. Every product must have at least one feature. Every id must be unique across the full array. Fixed-price products must have a positive pricePence. Contact products must have null pricePence. The isPurchasable function gets six tests — true for fixed with a positive price, false for contact, false for fixed with null, false for fixed with zero, true for every real fixed product in the catalog, false for every real contact product. The getProductsByService function gets a generated test per service — a loop over all five service keys asserting that every returned product matches the key and that the sum across all services equals the total product count. The checkout tests mock Stripe at the module level using vi.mock before the route is imported so the real Stripe SDK never loads. Eleven tests cover missing fields, invalid emails, honeypot submissions that return success without calling Stripe, non-existent product IDs, contact-only products that cannot be purchased, valid purchases that verify the PaymentIntent amount and metadata, idempotency keys passed through to the Stripe options object, message truncation to five hundred characters, whitespace trimming on names, and both idempotency and network errors. The contact tests mock Resend the same way and cover thirteen cases — missing name, missing email, invalid email, honeypot, invalid service type, valid contact without a service, valid contact with a service, all five valid service types in a loop, Resend errors, and missing API keys. Every test creates a real Request object with the right method, headers, and JSON body. No test touches a real third-party API. The coverage config targets src/lib and src/app/api so library code and API routes are measured but components and pages are not. Forty-one tests, three files, zero network calls.