[dirtybits]

Summary

Add missing test coverage for web/lib/listingContract.ts — the helper that decides whether a skill is served as paid or free and which checkout flow applies.

The paid/free decision (normalizeUsdcMicros) and the flow resolver (getSkillPaymentFlow) sit directly on the money path: they determine whether a download is gated or freely served, so a regression here would silently flip paid content to free (or vice versa). On main, only two "paid" branches of getSkillPaymentFlow were tested and normalizeUsdcMicros, the legacy-sol branch, and requiresPurchase had no coverage at all.

What's now covered

• normalizeUsdcMicros — the digit-string gate that produces a canonical price string or null:
  • accepts positive integer amounts (numeric strings, numbers, bigint-shaped values) and trims surrounding whitespace
  • rejects null/undefined/empty, and zero amounts ("0", "000", " 0 ", 0)
  • rejects negatives ("-5", " -5 ", "-0"), fractional ("1.5", "1.0", "100.00"), scientific notation ("1e3", "1E3")
  • rejects malformed/mixed input ("1_000", "abc", "12abc", "0x10") and boolean values that can arrive via JSON request bodies
  • keeps very large digit strings valid (micro-unit amounts can exceed Number.MAX_SAFE_INTEGER-ish magnitudes)
• getSkillPaymentFlow — newly adds the "paid-looking-but-invalid" fallbacks: a linked listing with a zero/invalid price (fractions, negatives) falls through to free rather than being gated as paid; the legacy-sol branch is only legacy-sol when allowLegacySol is true and the lamports amount is positive (zero and disallowed cases return free); unpriced skills return free.
• requiresPurchase — free is not purchase-required; every other flow is.

Why this is safe / reviewable

• Test-only change: one file, web/__tests__/lib/listingContract.test.ts. No production code, no schema, no protocol/money behavior changed — coverage pins the existing (correct) behavior so future changes can't regress the paid/free gate.
• Verified the behavior I locked in is the existing runtime behavior (I probed the real code before writing assertions). The only deliberate test-only detail: booleans are passed via as unknown as number casts because the declared parameter type excludes them, but runtime JSON bodies can carry them and the gate must reject them.

What I verified

• npx vitest run __tests__/lib/listingContract.test.ts → 14 tests passed.
• npm run typecheck --workspace @agentvouch/web → clean.
• npm run format:check → "All matched files use Prettier code style".
• npm run lint --workspace @agentvouch/web → clean.
• npm run test --workspace @agentvouch/web → 152 files / 1322 tests passed.
• npm run test (full repo, includes CLI workspace) → 13 files / 77 tests passed.

Web build skipped on purpose — this is a test-only change with no production code touched. Per the repo convention the web build is the real build/typecheck gate, but no build input changed here.

What I did NOT verify

• No live wallet/browser smoke (no money actually moves in this change, and it's purely test coverage).
• No forge test (no contracts/ changes) and no Anchor IDL sync (no program/interface changes).