create-ailk 0.1.0 → 0.1.1

package/templates/apps/api/src/services/project-listings.ts

@@ -0,0 +1,1124 @@
+/**
+ * @file project-listings.ts
+ * @description The founder's-application-row service (#4998, reshaped by
+ * #5036) — writes, reads, and transitions `ProjectListing` (ADR 0009 D3
+ * service-layer convention, mirroring `lead-routing.ts` and
+ * `waitlist-dashboard.ts`).
+ *
+ * The single anonymous create became THREE operations when the application
+ * became a ten-step form that saves as it goes (#5036 D1):
+ *
+ *   start   name + email + consent -> a `draft` row and a resume token
+ *   patch   merges a partial payload; asserts no completeness
+ *   submit  validates the WHOLE application, `draft` -> `requested`
+ *
+ * Validation therefore moved from write-time to submit-time, and that is why
+ * every application field is nullable on the row: a half-filled draft is a
+ * legitimate row, and only `submit` asserts it is finished.
+ *
+ * `submitProjectListingDraft` calls `routeLead` (kind `submit`, source
+ * `projects-apply`) for the Lead write — never a duplicate Lead-shaped insert.
+ * The Lead is written at SUBMIT rather than at start: the founder's contact
+ * details are already captured on the listing row itself at step one, so a
+ * Lead at step one adds no capture, and what it DOES add is an operator
+ * notification email per abandoned first step on an anonymous route (PR #5042
+ * security review, finding 4). Every tenant read/write
+ * is scoped by `siteId` (`request.tenant.workspaceId`) — there is no
+ * client-supplied site id on any tenant route. `waitlistCount` joins THROUGH
+ * `experimentId` (`WaitlistExperiment.id` -> `.key` -> `WaitlistScore.experimentKey`,
+ * scoped by `siteId`), 0 when a listing carries no `experimentKey`.
+ *
+ * PII boundary: this module never logs `founderEmail`, `founderName`, or
+ * `questions` — the same discipline `lead-routing.ts` documents. The resume
+ * token is never logged either, at any level: it is the ONLY credential on
+ * the anonymous draft surface.
+ */
+
+import { createHash, randomBytes } from "node:crypto";
+
+import type { Prisma, Role } from "@working-theory/database";
+import { logger } from "@working-theory/observability";
+import {
+  clampWindowDays,
+  buildProjectListingDraftPatchSchema,
+  buildProjectListingSubmitSchema,
+  PROJECT_LISTING_CONCURRENT_LIMIT,
+  PROJECT_LISTING_NON_TERMINAL_STATUSES,
+} from "@working-theory/validation";
+import type {
+  ProjectListing,
+  ProjectListingDraftPatchInput,
+  ProjectListingFaqs,
+  ProjectListingPublic,
+  ProjectListingQuestions,
+  ProjectListingStartInput,
+} from "@working-theory/validation";
+
+import { prisma } from "../lib/prisma.js";
+
+import { routeLead, type SourceMeta } from "./lead-routing.js";
+import { listingConfigFor } from "./listing-config.js";
+
+// ─── Role floor ─────────────────────────────────────────────────────────────
+
+/**
+ * The membership role this floor is expressed in (#5182).
+ *
+ * Previously `import type { MembershipRole } from "./tenant-context.js"` — a
+ * multi-tenant SLICE file the OSS strip removes, which makes a type-only import
+ * of it a TS2307 on the public tree exactly as a value import would be (spec
+ * D1). `Role` is the Prisma enum `Membership.role` is actually declared as
+ * (`database/auth/schema.prisma:25-33`), so it is the same three values from
+ * the non-slice home they originate in rather than a restatement — and this
+ * file already imports from `@working-theory/database` two lines up.
+ */
+
+/** Reads/writes require `owner` or `admin` — the same floor as the waitlist dashboard. */
+export const PROJECT_LISTING_ROLES: ReadonlySet<Role> = new Set<Role>([
+  "owner",
+  "admin",
+]);
+
+// ─── The computed lifecycle state ───────────────────────────────────────────
+
+type ProjectListingStatus = ProjectListing["status"];
+
+/**
+ * Resolve a row's LIFECYCLE status from its STORED status (#5033 D3).
+ *
+ * `closed` is the one state nothing writes. An `active` listing whose window
+ * end has passed reads `closed`, here, on every read, with no job having run.
+ * Storing it instead would need a scheduler whose failure leaves expired
+ * listings publicly open — a silent, wrong-way failure. This makes that
+ * unrepresentable.
+ *
+ * A FEATURED row is exempt (#5036 D6b). The operator's own products become
+ * listing rows carrying `featured: true`, and such a row is not a time-boxed
+ * validation experiment: it has no meaningful window and must not vanish from
+ * the shelf because a date passed. Its `windowEndsAt` may be null, and it
+ * reads `active` either way.
+ *
+ * A null window on a NON-featured `active` row is an ERROR, not a licence to
+ * stay open forever: every real listing is time-boxed by design, and the whole
+ * point of computing `closed` rather than storing it is that an expired
+ * listing cannot linger. It is logged and read `closed` — failing toward the
+ * closed shelf rather than toward a publicly-open listing nothing bounds.
+ * `draft`, `requested` and `rejected` rows legitimately carry no window and
+ * are not touched by any of this.
+ */
+export function computeListingStatus(
+  storedStatus: string,
+  windowEndsAt: Date | null,
+  now: Date,
+  featured: boolean,
+): ProjectListingStatus {
+  if (storedStatus !== "active") return storedStatus as ProjectListingStatus;
+  if (featured) return "active";
+  if (windowEndsAt === null) {
+    logger.error(
+      { kind: "active_listing_without_window" },
+      "[project-listings] a non-featured active listing carries no window end; reading it closed",
+    );
+    return "closed";
+  }
+  return windowEndsAt.getTime() <= now.getTime() ? "closed" : "active";
+}
+
+// ─── Slug derivation (#5033 D2) ─────────────────────────────────────────────
+
+/** The `name`-derived slug's length cap. */
+const SLUG_MAX_LENGTH = 48;
+
+/** The slug a name with no alphanumeric content falls back to before suffixing. */
+const SLUG_FALLBACK = "listing";
+
+/**
+ * Derive a slug from a listing `name`: lowercase, every non-alphanumeric run
+ * to a single hyphen, trimmed of leading/trailing hyphens, truncated to 48.
+ * A name carrying no alphanumerics at all (the payload allows it — `name` is
+ * only bounded by length) falls back to `listing`, which the site-scoped
+ * suffixing below then disambiguates like any other collision.
+ */
+export function deriveListingSlug(name: string): string {
+  const base = name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, SLUG_MAX_LENGTH)
+    .replace(/-+$/, "");
+  return base.length > 0 ? base : SLUG_FALLBACK;
+}
+
+/**
+ * The most same-prefix slugs one create will read before giving up.
+ *
+ * The collision read is a prefix scan, and `base` derives from a fully
+ * caller-controlled `name` on an ANONYMOUS route — a one-character name makes
+ * the prefix match most of the site's slugs, and every accepted application
+ * adds another row to that family. Unbounded, the cost of a create would grow
+ * with the number of listings an attacker had already filed. Bounded, a
+ * pathological family degrades to the same `slug_taken` 409 a genuine race
+ * already produces, rather than to an ever-slower table scan.
+ */
+const SLUG_COLLISION_SCAN_LIMIT = 200;
+
+/**
+ * The first free slug for `base` on this site. Uniqueness is already scoped
+ * `@@unique([siteId, slug])`, so the suffix is too: a second "Atlas" on this
+ * site becomes `atlas-2` even if `atlas` is taken on another.
+ *
+ * Two concurrent creates of the same name can still both resolve the same
+ * free slug and race to the insert; the loser hits the unique constraint and
+ * is reported as `slug_taken`, exactly as it was when the client supplied the
+ * slug itself.
+ */
+async function firstFreeSlug(siteId: string, base: string): Promise<string> {
+  const rows = await prisma.projectListing.findMany({
+    where: { siteId, slug: { startsWith: base } },
+    select: { slug: true },
+    take: SLUG_COLLISION_SCAN_LIMIT,
+  });
+  const taken = new Set(rows.map((r) => r.slug));
+  if (!taken.has(base)) return base;
+
+  // Bounded by `taken.size + 1` iterations — one of the first `n` candidates
+  // is necessarily free.
+  let suffix = 2;
+  while (taken.has(`${base}-${suffix}`)) suffix += 1;
+  return `${base}-${suffix}`;
+}
+
+// ─── Row shape ──────────────────────────────────────────────────────────────
+
+const PROJECT_LISTING_SELECT = {
+  id: true,
+  siteId: true,
+  leadId: true,
+  slug: true,
+  name: true,
+  oneLiner: true,
+  problem: true,
+  url: true,
+  product: true,
+  commitment: true,
+  teamComposition: true,
+  faqs: true,
+  anythingElse: true,
+  address: true,
+  questions: true,
+  founderName: true,
+  founderEmail: true,
+  founderCompany: true,
+  headline: true,
+  logoMarkUrl: true,
+  logoWordmarkUrl: true,
+  featured: true,
+  status: true,
+  consentAt: true,
+  decidedAt: true,
+  decidedBy: true,
+  issueUrl: true,
+  experimentKey: true,
+  windowEndsAt: true,
+  createdAt: true,
+  updatedAt: true,
+} as const satisfies Prisma.ProjectListingSelect;
+
+type ProjectListingRow = Prisma.ProjectListingGetPayload<{
+  select: typeof PROJECT_LISTING_SELECT;
+}>;
+
+/**
+ * `now` is passed rather than read inside so one read renders every row of a
+ * list against a single instant. `featuredEnabled` is the site's config
+ * switch (#5033 D6): where a site has not enabled a featured shelf, the flag
+ * never surfaces. The tenant dashboard passes `true` — an operator manages
+ * the flag and must see what they set.
+ */
+function toResponseRow(
+  row: ProjectListingRow,
+  waitlistCount: number,
+  now: Date,
+  featuredEnabled: boolean,
+): ProjectListing {
+  return {
+    id: row.id,
+    siteId: row.siteId,
+    leadId: row.leadId,
+    slug: row.slug,
+    name: row.name,
+    headline: row.headline,
+    oneLiner: row.oneLiner,
+    problem: row.problem,
+    url: row.url,
+    product: row.product as ProjectListing["product"],
+    commitment: row.commitment as ProjectListing["commitment"],
+    teamComposition: row.teamComposition as ProjectListing["teamComposition"],
+    faqs: row.faqs as unknown as ProjectListingFaqs | null,
+    anythingElse: row.anythingElse,
+    address: row.address,
+    founderName: row.founderName,
+    founderEmail: row.founderEmail,
+    founderCompany: row.founderCompany,
+    questions: row.questions as unknown as ProjectListingQuestions | null,
+    logoMarkUrl: row.logoMarkUrl,
+    logoWordmarkUrl: row.logoWordmarkUrl,
+    featured: featuredEnabled && row.featured,
+    // The row's OWN flag decides the closed exemption (#5036 D6b), not the
+    // site's `featuredEnabled` switch: that switch governs whether the flag
+    // SURFACES on a read, not whether the listing is time-boxed.
+    status: computeListingStatus(row.status, row.windowEndsAt, now, row.featured),
+    consentAt: row.consentAt.toISOString(),
+    decidedAt: row.decidedAt ? row.decidedAt.toISOString() : null,
+    decidedBy: row.decidedBy,
+    issueUrl: row.issueUrl,
+    experimentKey: row.experimentKey,
+    windowEndsAt: row.windowEndsAt ? row.windowEndsAt.toISOString() : null,
+    waitlistCount,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
+
+/**
+ * `waitlistCount` per row, keyed by `experimentKey`.
+ *
+ * Since #5036 D6d the listing stores the experiment's KEY rather than its id,
+ * and that key is the same string `WaitlistScore.experimentKey` holds — so the
+ * `WaitlistExperiment` read that existed purely to translate one into the
+ * other is gone. One `WaitlistScore.count` per DISTINCT key remains, bounded
+ * by the small number of distinct experiments a dashboard page carries rather
+ * than by row count (`waitlist-dashboard.ts`'s "one read across every returned
+ * row" discipline).
+ */
+async function attachWaitlistCounts(
+  siteId: string,
+  rows: readonly ProjectListingRow[],
+): Promise<Map<string, number>> {
+  const experimentKeys = [
+    ...new Set(rows.map((r) => r.experimentKey).filter((v): v is string => v != null)),
+  ];
+  if (experimentKeys.length === 0) return new Map();
+
+  const counts = new Map<string, number>();
+  await Promise.all(
+    experimentKeys.map(async (experimentKey) => {
+      const count = await prisma.waitlistScore.count({
+        where: { siteId, experimentKey },
+      });
+      counts.set(experimentKey, count);
+    }),
+  );
+  return counts;
+}
+
+function waitlistCountFor(row: ProjectListingRow, counts: Map<string, number>): number {
+  return row.experimentKey ? (counts.get(row.experimentKey) ?? 0) : 0;
+}
+
+// ─── The founder's key (#5036 D7) ──────────────────────────────────────────
+
+/**
+ * Normalize the email a founder is counted under.
+ *
+ * Trim and lowercase, so `Ada@Example.com ` and `ada@example.com` are one
+ * founder rather than two. Postgres text equality is case-sensitive, so
+ * without this the concurrent-listing limit is evaded by holding down shift.
+ *
+ * Deliberately NOT stripping plus-tags: `ada+two@example.com` still counts as
+ * a different founder. Plus-addressing is a legitimate, widely-used feature
+ * and treating it as evasion would refuse real applicants; closing that gap
+ * properly needs a verified email, which this anonymous surface does not have.
+ */
+function normalizeFounderEmail(email: string): string {
+  return email.trim().toLowerCase();
+}
+
+/**
+ * How long an unsubmitted draft occupies one of a founder's two slots
+ * (#5036 D7).
+ *
+ * Drafts MUST count, or the limit is evaded by never submitting. But
+ * `founderEmail` is unverified on an anonymous surface, so anyone can open a
+ * draft in a stranger's name — and a draft that counted forever would let two
+ * anonymous requests lock a named founder out of ever applying, with no
+ * operator remedy (there is no route that deletes a listing; PR #5042 security
+ * review, finding 1).
+ *
+ * Bounding the window keeps D7's intent — an application in progress holds a
+ * slot, so not submitting evades nothing — while making that lockout expire on
+ * its own. Fourteen days is far longer than a ten-step form takes and far
+ * shorter than "forever".
+ *
+ * This bounds the QUOTA impact, not retention: an abandoned draft still holds
+ * the founder's name, email and address in the table. A retention sweep is a
+ * separate unit and is not in this change.
+ */
+const DRAFT_HOLDS_A_SLOT_DAYS = 14;
+
+// ─── The resume token (#5036 D1) ───────────────────────────────────────────
+
+/**
+ * The token's entropy, in bytes. 256 bits — the same floor the repo's other
+ * capability tokens carry, and far beyond guessing at any request rate the
+ * `leadsScope` rate limiter permits.
+ */
+const RESUME_TOKEN_BYTES = 32;
+
+/**
+ * Mint an opaque resume token. Returned to the caller EXACTLY once, at
+ * `start`: only its digest is stored, so the server cannot hand it back a
+ * second time and an attacker who reads the table still cannot present one.
+ */
+function mintResumeToken(): string {
+  return randomBytes(RESUME_TOKEN_BYTES).toString("base64url");
+}
+
+/**
+ * What the column holds. A plain sha-256 with no salt and no stretching is
+ * correct here and a KDF would not be: the input is 256 bits of CSPRNG output,
+ * not a human-chosen secret, so there is no dictionary to precompute and
+ * nothing for a work factor to slow down.
+ */
+function hashResumeToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+/**
+ * Resolve the ONE draft a token grants access to (#5036 D1).
+ *
+ * Both the id and the token's digest are in the `where`, so a valid token
+ * presented against a different listing's id resolves to nothing: a token is
+ * bound to one listing and grants access to no other. `status: "draft"` is in
+ * there too — `submit` clears the digest, so a token that leaks after
+ * submission is inert twice over.
+ *
+ * The comparison is an equality test on a 256-bit digest inside Postgres.
+ * There is no application-level secret compare to make constant-time, and no
+ * practical timing signal in matching digests of that width.
+ */
+async function findDraftByToken(
+  id: string,
+  resumeToken: string,
+): Promise<ProjectListingRow | null> {
+  return prisma.projectListing.findFirst({
+    where: { id, status: "draft", resumeTokenHash: hashResumeToken(resumeToken) },
+    select: PROJECT_LISTING_SELECT,
+  });
+}
+
+// ─── start (POST, anonymous) ────────────────────────────────────────────────
+
+/**
+ * `start` has no failure mode of its own to report. It reads the site's config
+ * (which falls back to the platform defaults rather than erroring) and writes
+ * one row; a Prisma failure is a 500 through the framework, as everywhere else.
+ * The Lead write — the one step that used to give this operation a
+ * `persist_failed`/`config_missing` surface — moved to `submit`.
+ */
+export type StartProjectListingDraftResult = {
+  ok: true;
+  id: string;
+  resumeToken: string;
+};
+
+/**
+ * Create a `draft` from step one — the founder's name, email and consent.
+ *
+ * `siteId` is a PARAMETER, not a field of `input` (#5048 D2). The payload
+ * names the site by its public key and the route resolves it through
+ * `siteIdForPublicKey` before calling here, so no request body carries a
+ * tenant identifier and nothing a caller sends can choose which site an
+ * application is filed against.
+ *
+ * The site's own terms are read SERVER-SIDE and stamped now, so a listing is
+ * granted the terms that were in force when it applied; nothing in `input`
+ * can reach them. The applicant's *requested* window is clamped here, not
+ * rejected, because a founder who could post their own bound could post an
+ * unbounded one.
+ *
+ * No slug yet: it is derived from `name` at SUBMIT (#5033 D2), which is the
+ * first moment a name exists.
+ */
+export async function startProjectListingDraft(
+  siteId: string,
+  input: ProjectListingStartInput,
+): Promise<StartProjectListingDraftResult> {
+  const { founderName, requestedWindowDays } = input;
+  const founderEmail = normalizeFounderEmail(input.founderEmail);
+
+  const listingConfig = await listingConfigFor(siteId);
+  const windowDays = clampWindowDays(requestedWindowDays, listingConfig);
+
+  const resumeToken = mintResumeToken();
+  const row = await prisma.projectListing.create({
+    data: {
+      siteId,
+      founderName,
+      founderEmail,
+      status: "draft",
+      consentAt: new Date(),
+      resumeTokenHash: hashResumeToken(resumeToken),
+      windowDays,
+    },
+    select: { id: true },
+  });
+
+  return { ok: true, id: row.id, resumeToken };
+}
+
+// ─── patch (PATCH, anonymous, token-gated) ──────────────────────────────────
+
+export type PatchProjectListingDraftResult =
+  | { ok: true; value: ProjectListing }
+  | {
+      ok: false;
+      error:
+        | { kind: "not_found"; message: string }
+        | { kind: "invalid_input"; message: string };
+    };
+
+/**
+ * Translate a validated partial application into a Prisma update.
+ *
+ * Only the keys the caller actually sent are written: an absent key is
+ * `undefined`, which Prisma omits from the UPDATE, so patching one field
+ * cannot blank the nine the founder filled in on earlier steps.
+ */
+function draftUpdateData(
+  patch: ProjectListingDraftPatchInput,
+): Prisma.ProjectListingUpdateInput {
+  return {
+    ...(patch.name !== undefined && { name: patch.name }),
+    ...(patch.headline !== undefined && { headline: patch.headline }),
+    ...(patch.oneLiner !== undefined && { oneLiner: patch.oneLiner }),
+    ...(patch.problem !== undefined && { problem: patch.problem }),
+    ...(patch.url !== undefined && { url: patch.url }),
+    ...(patch.product !== undefined && { product: patch.product }),
+    ...(patch.commitment !== undefined && { commitment: patch.commitment }),
+    ...(patch.teamComposition !== undefined && { teamComposition: patch.teamComposition }),
+    ...(patch.faqs !== undefined && { faqs: patch.faqs as unknown as Prisma.InputJsonValue }),
+    ...(patch.anythingElse !== undefined && { anythingElse: patch.anythingElse }),
+    ...(patch.address !== undefined && { address: patch.address }),
+    ...(patch.founderCompany !== undefined && { founderCompany: patch.founderCompany }),
+    ...(patch.questions !== undefined && {
+      questions: patch.questions as unknown as Prisma.InputJsonValue,
+    }),
+  };
+}
+
+/**
+ * Merge a partial application into a draft and hand back the merged row.
+ *
+ * Enforces NO completeness — that is `submit`'s job alone, and the split is
+ * the whole point of the lifecycle. Returning the merged row is what makes a
+ * step's save verifiable by the client that wrote it.
+ */
+export async function patchProjectListingDraft(
+  id: string,
+  resumeToken: string,
+  body: unknown,
+): Promise<PatchProjectListingDraftResult> {
+  // The word caps are the SITE's (#5048 D6), so the body cannot be validated
+  // until the draft's site is known. This read resolves that and nothing
+  // else — it is not the write's guard, which stays the compare-and-swap
+  // below. A caller holding no valid token never gets past it, so a bad token
+  // still answers `not_found` before any body is inspected.
+  const owner = await prisma.projectListing.findFirst({
+    where: { id, status: "draft", resumeTokenHash: hashResumeToken(resumeToken) },
+    select: { siteId: true },
+  });
+  if (!owner) {
+    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
+  }
+
+  const listingConfig = await listingConfigFor(owner.siteId);
+  const parsed = buildProjectListingDraftPatchSchema(
+    listingConfig.wordCaps,
+    listingConfig.collectedFields,
+  ).safeParse(body);
+  if (!parsed.success) {
+    return {
+      ok: false,
+      error: {
+        kind: "invalid_input",
+        message: parsed.error.issues[0]?.message ?? "invalid input",
+      },
+    };
+  }
+  const patch: ProjectListingDraftPatchInput = parsed.data;
+
+  // A GUARDED `updateMany`, not a read-then-write: the token check and the
+  // write are one statement, so a concurrent `submit` cannot flip the row to
+  // `requested` in between and let this patch land on an application the
+  // operator is already reviewing (PR #5042 security review, finding 3). The
+  // same compare-and-swap shape `submit` and `decideListing` already use.
+  const updated = await prisma.projectListing.updateMany({
+    where: { id, status: "draft", resumeTokenHash: hashResumeToken(resumeToken) },
+    data: draftUpdateData(patch),
+  });
+  if (updated.count === 0) {
+    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
+  }
+
+  const row = await prisma.projectListing.findFirst({
+    where: { id },
+    select: PROJECT_LISTING_SELECT,
+  });
+  if (!row) {
+    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
+  }
+
+  return { ok: true, value: toResponseRow(row, 0, new Date(), true) };
+}
+
+// ─── submit (POST, anonymous, token-gated) ──────────────────────────────────
+
+export type SubmitProjectListingDraftResult =
+  | { ok: true; id: string; slug: string; listing: ProjectListing }
+  | {
+      ok: false;
+      error:
+        | { kind: "not_found"; message: string }
+        | { kind: "incomplete"; message: string; missingFields: string[] }
+        | { kind: "listing_limit_reached"; message: string }
+        | { kind: "slug_taken"; message: string };
+    };
+
+/**
+ * The application, assembled from the stored row for `submit` to validate.
+ *
+ * Narrowed to the site's COLLECTED fields (#5048 D5). The built submit schema
+ * is `.strict()` over exactly that set, so a stored value for a field the site
+ * does not collect would otherwise fail as an unrecognised key — which is the
+ * right shape for a REQUEST body and the wrong one for a row that may carry a
+ * value written before the site narrowed its step set.
+ */
+function applicationFromRow(
+  row: ProjectListingRow,
+  collectedFields: readonly string[],
+): Record<string, unknown> {
+  const collected = new Set(collectedFields);
+  const all: Record<string, unknown> = {
+    name: row.name,
+    headline: row.headline,
+    oneLiner: row.oneLiner,
+    problem: row.problem,
+    ...(row.url !== null && { url: row.url }),
+    product: row.product,
+    commitment: row.commitment,
+    teamComposition: row.teamComposition,
+    faqs: row.faqs,
+    ...(row.anythingElse !== null && { anythingElse: row.anythingElse }),
+    address: row.address,
+    ...(row.founderCompany !== null && { founderCompany: row.founderCompany }),
+    questions: row.questions,
+  };
+  return Object.fromEntries(
+    Object.entries(all).filter(([key]) => collected.has(key)),
+  );
+}
+
+/**
+ * Count the founder's OTHER non-terminal listings on this site (#5036 D7).
+ *
+ * Drafts count. A limit drafts escaped would be evaded by never submitting,
+ * which is exactly the state a ten-step form leaves a founder in by default.
+ *
+ * The stored-status filter is a first pass, not the answer: `closed` is
+ * computed, so an `active` row whose window has elapsed is terminal and must
+ * not count. `computeListingStatus` is the one place that knows this, and
+ * consulting it here is the same discipline the CSV sweep learned in #5033.
+ */
+async function countOtherNonTerminalListings(
+  siteId: string,
+  founderEmail: string,
+  exceptId: string,
+): Promise<number> {
+  const now = new Date();
+  const draftCutoff = new Date(now.getTime() - DRAFT_HOLDS_A_SLOT_DAYS * 24 * 60 * 60 * 1000);
+
+  const rows = await prisma.projectListing.findMany({
+    where: {
+      siteId,
+      founderEmail,
+      id: { not: exceptId },
+      OR: [
+        // Every non-terminal state except `draft`, which the clause below
+        // handles on its own terms. Derived from the shared constant rather
+        // than typed out, so a fifth non-terminal state is counted the day it
+        // is added.
+        {
+          status: {
+            in: PROJECT_LISTING_NON_TERMINAL_STATUSES.filter((s) => s !== "draft"),
+          },
+        },
+        // A draft holds a slot only while it is live — see
+        // `DRAFT_HOLDS_A_SLOT_DAYS`. It still counts, so not submitting evades
+        // nothing; it just stops counting once the application is plainly
+        // abandoned, which is what keeps an unverified email from locking a
+        // named founder out permanently.
+        { status: "draft", createdAt: { gt: draftCutoff } },
+      ],
+    },
+    select: { status: true, windowEndsAt: true, featured: true },
+  });
+  return rows.filter(
+    (r) => computeListingStatus(r.status, r.windowEndsAt, now, r.featured) !== "closed",
+  ).length;
+}
+
+/**
+ * Validate the whole application and move the row `draft` -> `requested`.
+ *
+ * Three things happen here and nowhere else: completeness is asserted (an
+ * incomplete draft comes back with the offending fields NAMED, so the form can
+ * send the founder to the step that owns each one); the concurrent-listing
+ * limit binds; and the slug is derived, which is the first moment a `name`
+ * exists to derive it from.
+ *
+ * The transition write is a GUARDED `updateMany` on `status: "draft"`, so two
+ * concurrent submits of the same draft cannot both succeed — the loser reads
+ * as `not_found`, the same answer a spent token gets. The token's digest is
+ * cleared in that same write: a token that leaks after submission grants
+ * nothing.
+ *
+ * The Lead write and the Slack post are both side effects of that committed
+ * transition and both fail soft, in that order — never before it, or a submit
+ * that lost the race would still have put an application in the operator's
+ * pipeline with no listing behind it.
+ */
+export async function submitProjectListingDraft(
+  id: string,
+  resumeToken: string,
+  sourceMeta: SourceMeta,
+): Promise<SubmitProjectListingDraftResult> {
+  const draft = await findDraftByToken(id, resumeToken);
+  if (!draft) {
+    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
+  }
+
+  // #5048 D5 — completeness derives from the site's CONFIGURED collected-field
+  // set, never from a fixed schema. Steps are individually optional, so a
+  // field whose step the site never rendered was never asked for; requiring it
+  // would refuse a valid application naming a question the founder never saw.
+  //
+  // The set comes from the site's own server-side `SiteListingConfig`. It is
+  // never read from the request: a caller that could post its own required-
+  // field set could post an empty one and submit a blank listing.
+  const listingConfig = await listingConfigFor(draft.siteId);
+  const submitSchema = buildProjectListingSubmitSchema(
+    listingConfig.wordCaps,
+    listingConfig.collectedFields,
+  );
+  const parsed = submitSchema.safeParse(
+    applicationFromRow(draft, listingConfig.collectedFields),
+  );
+  if (!parsed.success) {
+    const missingFields = [
+      ...new Set(parsed.error.issues.map((issue) => String(issue.path[0]))),
+    ].sort();
+    return {
+      ok: false,
+      error: {
+        kind: "incomplete",
+        message: `application is incomplete: ${missingFields.join(", ")}`,
+        missingFields,
+      },
+    };
+  }
+
+  const concurrent = await countOtherNonTerminalListings(
+    draft.siteId,
+    draft.founderEmail,
+    draft.id,
+  );
+  if (concurrent >= PROJECT_LISTING_CONCURRENT_LIMIT) {
+    return {
+      ok: false,
+      error: {
+        kind: "listing_limit_reached",
+        message: `a founder may hold at most ${PROJECT_LISTING_CONCURRENT_LIMIT} listings at once`,
+      },
+    };
+  }
+
+  // `name` may be absent from the picked schema if a site does not collect it
+  // (#5048 D5), so the slug derives from the ROW rather than from the parsed
+  // payload. A site that collects no name has none to derive from, and the
+  // founder's own name is the only other stable string on the row.
+  const base = deriveListingSlug(draft.name ?? draft.founderName);
+  const slug = await firstFreeSlug(draft.siteId, base);
+
+  const transition = async (candidate: string): Promise<number | "taken"> => {
+    try {
+      const updated = await prisma.projectListing.updateMany({
+        where: { id, status: "draft" },
+        data: { status: "requested", slug: candidate, resumeTokenHash: null },
+      });
+      return updated.count;
+    } catch (err) {
+      if (isUniqueViolation(err)) return "taken";
+      throw err;
+    }
+  };
+
+  let count = await transition(slug);
+  if (count === "taken") {
+    // `firstFreeSlug` samples at most 200 same-prefix rows, so a family larger
+    // than that can hand back a slug that is in fact taken — and a plain retry
+    // resamples and fails the same way, which would let a squatted prefix wall
+    // off every later applicant whose name derives to it (PR #5042 security
+    // review, finding 2). One random suffix ends that: an ugly slug beats an
+    // application that cannot be submitted at all.
+    count = await transition(`${base}-${randomBytes(3).toString("hex")}`);
+  }
+  if (count === "taken") {
+    return {
+      ok: false,
+      error: { kind: "slug_taken", message: "slug already in use for this site" },
+    };
+  }
+  if (count === 0) {
+    // A concurrent submit won the race and already spent this draft.
+    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
+  }
+
+  // The Lead write reuses routeLead — never a duplicate persistence path — and
+  // happens at SUBMIT rather than at start, so an anonymous stranger cannot
+  // cause an operator notification by opening a draft they never finish.
+  //
+  // It runs AFTER the transition, and fails soft. Before the transition it
+  // would write a Lead (and mail the operator) for every submit that then lost
+  // the race or hit a taken slug — an application in the operator's pipeline
+  // with no listing behind it, and two Leads for the one submit that did land.
+  // After it, the worst case is a `requested` listing whose `leadId` is null,
+  // which the model allows and the weekly CSV sweep already skips explicitly.
+  // The submit itself has landed either way, and that is what the founder
+  // asked for; reporting it as a failure would be the wrong answer.
+  const leadResult = await routeLead(
+    {
+      kind: "submit",
+      siteId: draft.siteId,
+      source: "projects-apply",
+      email: draft.founderEmail,
+      payload: {
+        name: parsed.data.name,
+        oneLiner: parsed.data.oneLiner,
+        problem: parsed.data.problem,
+        product: parsed.data.product,
+        founderName: draft.founderName,
+        questions: parsed.data.questions,
+      },
+    },
+    sourceMeta,
+  );
+  if (leadResult.ok) {
+    await prisma.projectListing.update({
+      where: { id },
+      data: { leadId: leadResult.id },
+    });
+  } else {
+    logger.error(
+      { listingId: id, kind: leadResult.error.kind },
+      "[project-listings] the Lead write failed after a submitted listing already landed",
+    );
+  }
+
+  const row = await prisma.projectListing.findFirst({
+    where: { id },
+    select: PROJECT_LISTING_SELECT,
+  });
+  if (!row) {
+    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
+  }
+
+  return {
+    ok: true,
+    id,
+    slug: row.slug!,
+    listing: toResponseRow(row, 0, new Date(), true),
+  };
+}
+
+function isUniqueViolation(err: unknown): boolean {
+  return (
+    err != null &&
+    typeof err === "object" &&
+    "code" in err &&
+    (err as { code: string }).code === "P2002"
+  );
+}
+
+// ─── List + get (tenant scope) ──────────────────────────────────────────────
+
+export async function listProjectListings(siteId: string): Promise<ProjectListing[]> {
+  const rows = await prisma.projectListing.findMany({
+    where: { siteId },
+    orderBy: { createdAt: "desc" },
+    select: PROJECT_LISTING_SELECT,
+  });
+  const counts = await attachWaitlistCounts(siteId, rows);
+  const now = new Date();
+  return rows.map((row) => toResponseRow(row, waitlistCountFor(row, counts), now, true));
+}
+
+export type GetProjectListingResult =
+  | { ok: true; value: ProjectListing }
+  | { ok: false; error: { kind: "not_found"; message: string } };
+
+export async function getProjectListing(siteId: string, id: string): Promise<GetProjectListingResult> {
+  const row = await prisma.projectListing.findFirst({
+    where: { id, siteId },
+    select: PROJECT_LISTING_SELECT,
+  });
+  if (!row) {
+    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
+  }
+  const counts = await attachWaitlistCounts(siteId, [row]);
+  return { ok: true, value: toResponseRow(row, waitlistCountFor(row, counts), new Date(), true) };
+}
+
+// ─── Patch (tenant scope; the featured flag) ───────────────────────────────
+
+export type SetListingFeaturedResult =
+  | { ok: true; value: ProjectListing }
+  | { ok: false; error: { kind: "not_found"; message: string } };
+
+/**
+ * Set the operator's `featured` flag (#5033 D6).
+ *
+ * This is the only non-status write the PATCH route makes. STATUS
+ * transitions do not come through here at all — since the lifecycle
+ * collapsed to five states with `closed` computed, `requested -> active |
+ * rejected` is the only transition there is, and `decideListing` owns it for
+ * both the PATCH route and the Slack button. The old transition table (which
+ * also carried `approved -> live` and `live -> closed`) has no states left to
+ * describe.
+ */
+export async function setListingFeatured(
+  siteId: string,
+  id: string,
+  featured: boolean,
+): Promise<SetListingFeaturedResult> {
+  const updated = await prisma.projectListing.updateMany({
+    where: { id, siteId },
+    data: { featured },
+  });
+  if (updated.count === 0) {
+    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
+  }
+
+  const row = await prisma.projectListing.findFirst({
+    where: { id, siteId },
+    select: PROJECT_LISTING_SELECT,
+  });
+  if (!row) {
+    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
+  }
+
+  const counts = await attachWaitlistCounts(siteId, [row]);
+  return { ok: true, value: toResponseRow(row, waitlistCountFor(row, counts), new Date(), true) };
+}
+
+// ─── Patch (tenant scope; the operator's copy edit) ─────────────────────────
+
+/**
+ * The five PUBLISHED copy fields an operator copy edit may rewrite.
+ *
+ * The set is deliberately narrow. `questions` is IN because its prompts and
+ * option labels render on the public page, which is precisely where abusive
+ * language would land. `name` is OUT because the slug is derived from it at
+ * submit and stored, so editing it would desync the public URL from the name.
+ * `url`, `product`, `commitment`, `teamComposition`, `address` and
+ * `founderCompany` are OUT because they are facts rather than copy — a wrong
+ * fact is a question to the founder or a reject, not an edit. `anythingElse`
+ * is OUT because it is a note to the reviewer and never renders.
+ *
+ * The request body is derived from the SAME package schema these keys name
+ * (`projectListingApplicationFieldsSchema`) at the route boundary, so every
+ * bound the application itself carries — the word caps, the fixed FAQ count,
+ * the question refinements — holds here for free.
+ */
+export type ProjectListingCopyEdit = Pick<
+  ProjectListingDraftPatchInput,
+  "headline" | "oneLiner" | "problem" | "faqs" | "questions"
+>;
+
+/**
+ * The WHERE terms that admit a copy edit: `requested`, or `active` as the row
+ * actually READS.
+ *
+ * `draft` is the applicant's own, held through the resume token, and stays
+ * theirs. `rejected` is terminal. `closed` is the awkward one, because nothing
+ * stores it: `computeListingStatus` derives it from a stored `active` whose
+ * window has elapsed, so scoping on the stored string alone would leave every
+ * closed listing editable. These three terms are that function's three
+ * accepting branches, transcribed — a featured row (window-exempt, #5036 D6b),
+ * or a window still in force. A non-featured row with a null or elapsed window
+ * matches none of them and is refused, exactly as it reads.
+ *
+ * `now` is a parameter so the one instant the caller renders the response
+ * against is the same instant the write is guarded by.
+ *
+ * This lives in the WHERE clause rather than in a read-then-write check, so a
+ * concurrent decision cannot slip the row out of the editable set between the
+ * check and the write — the same compare-and-swap discipline
+ * `patchProjectListingDraft` and `decideListing` use.
+ */
+function copyEditableWhere(now: Date): Prisma.ProjectListingWhereInput[] {
+  return [
+    { status: "requested" },
+    { status: "active", featured: true },
+    { status: "active", windowEndsAt: { gt: now } },
+  ];
+}
+
+export type PatchListingCopyResult =
+  | { ok: true; value: ProjectListing }
+  | { ok: false; error: { kind: "not_found"; message: string } };
+
+/**
+ * Rewrite a listing's published copy, preserving what the applicant submitted.
+ *
+ * The third review outcome beside approve and reject: a listing whose copy
+ * needs a trim was previously publishable only exactly as written, because the
+ * legal transitions out of `requested` are `active` and `rejected`, there is no
+ * route back to `draft`, and `patchProjectListingDraft` is scoped to the
+ * applicant's own resume token.
+ *
+ * `submittedCopy` is WRITE-ONCE, on the first edit only. The read below is what
+ * resolves the pre-edit copy; it is NOT the write's guard, which stays the
+ * status-scoped `updateMany` — the same compare-and-swap shape
+ * `patchProjectListingDraft` and `decideListing` use. Because that read is one
+ * consistent snapshot, a row it saw with a null `submittedCopy` also carries
+ * the copy as the applicant submitted it, so two concurrent first edits write
+ * the same snapshot value rather than racing to a different one. Nothing
+ * clears the column, so the submitted copy stays recoverable for the life of
+ * the row.
+ *
+ * DELIBERATELY silent on the notification surfaces, unlike a decision. No
+ * founder email is sent, and the application's Slack card is not re-rendered,
+ * so a card posted before an edit keeps showing the pre-edit copy. Both are the
+ * decision path's concerns (`sendListingDecisionEmail`, `postListingApplication`)
+ * and neither is touched here. Worth revisiting if operators start editing
+ * before deciding often enough that the card misleads.
+ *
+ * The three audit columns are WRITE-ONLY at present: nothing reads them back,
+ * because the tenant read's response contract is `.strict()` and surfacing them
+ * would mean widening it. "Recoverable" therefore means recoverable from the
+ * row, not through an API.
+ *
+ * PII boundary: as everywhere else in this module, nothing here is logged.
+ */
+export async function patchListingCopy(
+  siteId: string,
+  id: string,
+  copy: ProjectListingCopyEdit,
+  editedBy: string,
+): Promise<PatchListingCopyResult> {
+  const before = await prisma.projectListing.findFirst({
+    where: { id, siteId },
+    select: {
+      submittedCopy: true,
+      headline: true,
+      oneLiner: true,
+      problem: true,
+      faqs: true,
+      questions: true,
+    },
+  });
+  if (!before) {
+    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
+  }
+
+  const now = new Date();
+  const updated = await prisma.projectListing.updateMany({
+    where: { id, siteId, OR: copyEditableWhere(now) },
+    data: {
+      // Only the keys the operator actually sent are written; an absent key is
+      // `undefined`, which Prisma omits from the UPDATE, so trimming the
+      // headline cannot blank the FAQs.
+      ...(copy.headline !== undefined && { headline: copy.headline }),
+      ...(copy.oneLiner !== undefined && { oneLiner: copy.oneLiner }),
+      ...(copy.problem !== undefined && { problem: copy.problem }),
+      ...(copy.faqs !== undefined && { faqs: copy.faqs as unknown as Prisma.InputJsonValue }),
+      ...(copy.questions !== undefined && {
+        questions: copy.questions as unknown as Prisma.InputJsonValue,
+      }),
+      ...(before.submittedCopy === null && {
+        submittedCopy: {
+          headline: before.headline,
+          oneLiner: before.oneLiner,
+          problem: before.problem,
+          faqs: before.faqs,
+          questions: before.questions,
+        } as unknown as Prisma.InputJsonValue,
+      }),
+      copyEditedAt: now,
+      copyEditedBy: editedBy,
+    },
+  });
+  if (updated.count === 0) {
+    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
+  }
+
+  const row = await prisma.projectListing.findFirst({
+    where: { id, siteId },
+    select: PROJECT_LISTING_SELECT,
+  });
+  if (!row) {
+    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
+  }
+
+  const counts = await attachWaitlistCounts(siteId, [row]);
+  return { ok: true, value: toResponseRow(row, waitlistCountFor(row, counts), now, true) };
+}
+
+// ─── Public read (anonymous) ────────────────────────────────────────────────
+
+/**
+ * The page-render read (#4998 AC4, reshaped by #5033): every `active` row for
+ * the site, the THREE newest by `decidedAt` first, then the rest by
+ * `waitlistCount` desc, then `decidedAt` desc. `founderEmail` never leaves
+ * this function.
+ *
+ * Rows whose window has elapsed are returned and read `closed` — computed,
+ * per row, against one instant, with no job having run. They are not filtered
+ * out: a consumer partitions its shelves on the status it is handed, and a
+ * listing that quietly vanished at midnight would be a worse answer than one
+ * that says it is closed.
+ */
+export async function publicProjectListings(siteId: string): Promise<ProjectListingPublic[]> {
+  const listingConfig = await listingConfigFor(siteId);
+  const rows = await prisma.projectListing.findMany({
+    where: { siteId, status: "active" },
+    select: PROJECT_LISTING_SELECT,
+  });
+  const counts = await attachWaitlistCounts(siteId, rows);
+  const withCounts = rows.map((row) => ({ row, waitlistCount: waitlistCountFor(row, counts) }));
+
+  const decidedAtMs = (row: ProjectListingRow): number => row.decidedAt?.getTime() ?? -Infinity;
+
+  const newestFirst = [...withCounts].sort((a, b) => decidedAtMs(b.row) - decidedAtMs(a.row));
+  const top3 = newestFirst.slice(0, 3);
+  const top3Ids = new Set(top3.map((t) => t.row.id));
+
+  const rest = withCounts
+    .filter((t) => !top3Ids.has(t.row.id))
+    .sort((a, b) => {
+      if (b.waitlistCount !== a.waitlistCount) return b.waitlistCount - a.waitlistCount;
+      return decidedAtMs(b.row) - decidedAtMs(a.row);
+    });
+
+  const now = new Date();
+  return [...top3, ...rest].map(({ row, waitlistCount }) => {
+    const { founderEmail: _founderEmail, ...publicRow } = toResponseRow(
+      row,
+      waitlistCount,
+      now,
+      listingConfig.featuredEnabled,
+    );
+    return publicRow;
+  });
+}