- name: nuxt-mutation-tenant-scope
  where: "server/api/orders/[id]/cancel.post.ts"
  ensure: >-
    The API cancellation must use tenantId from the required user session in its database mutation.