create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/content/index.ts

@@ -12,21 +12,57 @@
  *   DELETE /v1/content/:type/:slug       — delete; mandatory `If-Match`
  *
  * Rate-limit, CORS, and the OpenAPI spec are wired at server level.
+ *
+ * The three write handlers are content-write SLICE files, which the OSS strip
+ * removes (#5182). They are reached here the same way `server.ts` reaches
+ * them — behind `isModuleEnabled('content-write')` — but through a specifier
+ * this module does not spell as a literal, because `tsc` resolves a literal
+ * specifier whether or not the branch can run and would report TS2307 on the
+ * stripped tree. Registration is unchanged when the module is present, which
+ * is the default (`AILK_ENABLED_MODULES` unset means every module on).
  */
 import type { FastifyPluginAsync } from "fastify";
 
-import { createPageRoute } from "./create.js";
-import { deletePageRoute } from "./delete.js";
+import { isModuleEnabled } from "../../config/modules.js";
+
 import { getPageRoute } from "./get-page.js";
 import { listPagesRoute } from "./list-pages.js";
 import { listTypesRoute } from "./list-types.js";
-import { updatePageRoute } from "./update.js";
+
+/**
+ * Content-write slice entry points, as { specifier, exportName }.
+ *
+ * What defeats `tsc`'s resolution is the INDIRECTION, not the type: TypeScript
+ * resolves `import("...")` only when the argument is a string-literal
+ * EXPRESSION written at the call site. Reading the specifier from a variable
+ * makes it unresolvable regardless of whether that variable's type is `string`
+ * or a literal (verified both ways). `string` is used here for readability, not
+ * because a literal type would leak.
+ */
+const WRITE_ROUTES: ReadonlyArray<{ specifier: string; exportName: string }> = [
+  { specifier: "./create.js", exportName: "createPageRoute" },
+  { specifier: "./update.js", exportName: "updatePageRoute" },
+  { specifier: "./delete.js", exportName: "deletePageRoute" },
+];
 
 export const contentRoutes: FastifyPluginAsync = async (fastify) => {
   await fastify.register(listTypesRoute);
   await fastify.register(listPagesRoute);
   await fastify.register(getPageRoute);
-  await fastify.register(createPageRoute);
-  await fastify.register(updatePageRoute);
-  await fastify.register(deletePageRoute);
+
+  if (isModuleEnabled("content-write")) {
+    for (const { specifier, exportName } of WRITE_ROUTES) {
+      const mod = (await import(specifier)) as Record<
+        string,
+        FastifyPluginAsync | undefined
+      >;
+      const route = mod[exportName];
+      if (!route) {
+        throw new Error(
+          `content-write slice drift: '${specifier}' does not export '${exportName}'`,
+        );
+      }
+      await fastify.register(route);
+    }
+  }
 };

package/templates/apps/api/src/routes/content/update.ts

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * PATCH /v1/content/:type/:slug
  *

package/templates/apps/api/src/routes/deliverables/__tests__/index.test.ts

@@ -0,0 +1,393 @@
+/**
+ * @file index.test.ts
+ * Route-level inject tests for GET /v1/deliverables/:grantId (#3961 D5).
+ *
+ * Mirrors apps/api/src/routes/flows/__tests__/index.test.ts's shape: a bare
+ * Fastify instance with only the route under test registered, prisma
+ * mocked via __mocks__/prisma.ts.
+ */
+
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
+jest.mock("../../../lib/prisma.js");
+
+import { deliverableDownloadRoute } from "../index";
+import { prisma } from "../../../lib/prisma.js";
+import { compilePlaybook, loadVendoredPlayLibrary } from "../../../services/playbook-compile.js";
+
+const GRANT_ID = "dgrant_00000000-0000-7000-8000-0000000000g1";
+const SITE_ID = "site-abc";
+const ASSET_ID = "dasset_00000000-0000-7000-8000-0000000000a1";
+
+function grantRow(overrides: Partial<Record<string, unknown>> = {}) {
+  return {
+    id: GRANT_ID,
+    siteId: SITE_ID,
+    assetId: ASSET_ID,
+    leadId: "lead_00000000-0000-7000-8000-0000000000e1",
+    sessionId: "flsess_00000000-0000-7000-8000-0000000000c1",
+    createdAt: new Date(),
+    ...overrides,
+  };
+}
+
+function assetRow(overrides: Partial<Record<string, unknown>> = {}) {
+  return {
+    id: ASSET_ID,
+    siteId: SITE_ID,
+    key: "guide-default",
+    filename: "guide.pdf",
+    contentType: "application/pdf",
+    bytes: Buffer.from("PDF-BYTES"),
+    size: 9,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    ...overrides,
+  };
+}
+
+describe("GET /v1/deliverables/:grantId", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    process.env.DATABASE_URL = "postgres://stub";
+
+    const fastify = require("fastify")();
+    await fastify.register(deliverableDownloadRoute);
+    app = fastify;
+  });
+
+  afterEach(async () => {
+    await app.close();
+    delete process.env.DATABASE_URL;
+  });
+
+  // ── Happy path ───────────────────────────────────────────────────────────
+
+  it("returns 200 with the asset's bytes, content-type, and content-disposition filename", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
+      grantRow(),
+    );
+    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(
+      assetRow(),
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.headers["content-type"]).toBe("application/pdf");
+    expect(res.headers["content-disposition"]).toBe(
+      'attachment; filename="guide.pdf"',
+    );
+    expect(res.rawPayload.toString()).toBe("PDF-BYTES");
+  });
+
+  // ── AC1 — X-Content-Type-Options: nosniff (#4002, #3961 security-review) ──
+
+  it("sets X-Content-Type-Options: nosniff on a 200 download response", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
+      grantRow(),
+    );
+    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(
+      assetRow(),
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.headers["x-content-type-options"]).toBe("nosniff");
+  });
+
+  it("allows repeated downloads on the same grant (no consumption)", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
+      grantRow(),
+    );
+    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(
+      assetRow(),
+    );
+
+    const first = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+    const second = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+
+    expect(first.statusCode).toBe(200);
+    expect(second.statusCode).toBe(200);
+  });
+
+  // ── AC2 — uniform 404 (no enumeration oracle) ───────────────────────────
+
+  it("returns a uniform 404 for an unknown grant id", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/deliverables/dgrant_00000000-0000-7000-8000-999999999999",
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "not_found", message: expect.any(String) },
+    });
+    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("returns a uniform 404 for a malformed id (identical shape to unknown)", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/deliverables/not-a-real-grant-id",
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "not_found", message: expect.any(String) },
+    });
+  });
+
+  it("returns a uniform 404 (identical shape) when the grant exists but its asset row is missing", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
+      grantRow(),
+    );
+    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "not_found", message: expect.any(String) },
+    });
+  });
+
+  it("returns a uniform 404 when the asset's siteId does not match the grant's (defense in depth)", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
+      grantRow({ siteId: "site-abc" }),
+    );
+    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(
+      assetRow({ siteId: "site-other" }),
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "not_found", message: expect.any(String) },
+    });
+  });
+
+  // ── No route serves assets by key, id, or filename (structural) ─────────
+
+  it("has no route accepting a siteId/key/filename combination — only /:grantId", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/deliverables/by-key/guide-default",
+    });
+
+    expect(res.statusCode).toBe(404);
+  });
+
+  // ── Filename sanitization — no header injection from an operator-authored filename ──
+
+  it("sanitizes CR/LF out of the filename before it reaches Content-Disposition", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
+      grantRow(),
+    );
+    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(
+      assetRow({ filename: 'evil.pdf"\r\nX-Injected: true' }),
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+
+    expect(res.statusCode).toBe(200);
+    const disposition = res.headers["content-disposition"] as string;
+    expect(disposition).not.toContain("\r");
+    expect(disposition).not.toContain("\n");
+    expect(res.headers["x-injected"]).toBeUndefined();
+  });
+
+  it("falls back to a safe default filename when sanitization empties the name", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
+      grantRow(),
+    );
+    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(
+      assetRow({ filename: "\r\n\r\n" }),
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.headers["content-disposition"]).toContain("download");
+  });
+
+  // ── flows_not_configured-style guard ────────────────────────────────────
+
+  it("returns 503 when DATABASE_URL is unset (feature not configured; NOT attacker-distinguishing)", async () => {
+    delete process.env.DATABASE_URL;
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+
+    expect(res.statusCode).toBe(503);
+    expect(prisma.deliverableGrant.findUnique).not.toHaveBeenCalled();
+  });
+
+  // ── FEAT-074 U4b (#4718) D4 — the playbook: virtual asset (AC-1) ─────────
+
+  const LIBRARY = loadVendoredPlayLibrary();
+  const LEAD_ID = "lead_00000000-0000-7000-8000-0000000000e1";
+
+  function playbookGrantRow(overrides: Partial<Record<string, unknown>> = {}) {
+    return grantRow({
+      assetId: "playbook:targeting-maturity",
+      leadId: LEAD_ID,
+      ...overrides,
+    });
+  }
+
+  function playbookInstanceRow(level: number) {
+    const { source, markdown } = compilePlaybook({
+      score: { id: `wlscore_${level}`, tier: `level_${level}`, ruleTrace: [] },
+      plays: LIBRARY,
+      leadId: LEAD_ID,
+    });
+    return { level, source, markdown };
+  }
+
+  it("renders and serves a PDF for a playbook: grant, filename playbook-level-<N>.pdf", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
+      playbookGrantRow(),
+    );
+    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue(
+      playbookInstanceRow(5),
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.headers["content-type"]).toBe("application/pdf");
+    expect(res.headers["content-disposition"]).toBe(
+      'attachment; filename="playbook-level-5.pdf"',
+    );
+    expect(res.headers["x-content-type-options"]).toBe("nosniff");
+    expect(res.rawPayload.subarray(0, 4).toString("latin1")).toBe("%PDF");
+    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("labels the Gate (Level 0) filename playbook-gate.pdf, never playbook-level-0.pdf", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
+      playbookGrantRow(),
+    );
+    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue(
+      playbookInstanceRow(0),
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.headers["content-disposition"]).toBe(
+      'attachment; filename="playbook-gate.pdf"',
+    );
+  });
+
+  it("scopes the PlaybookInstance read by grant.siteId AND grant.leadId — never a request-supplied id (AC-1 tenancy)", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
+      playbookGrantRow(),
+    );
+    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue(
+      playbookInstanceRow(1),
+    );
+
+    await app.inject({ method: "GET", url: `/v1/deliverables/${GRANT_ID}` });
+
+    expect(prisma.playbookInstance.findFirst).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { siteId: SITE_ID, leadId: LEAD_ID, experimentKey: "targeting-maturity" },
+      }),
+    );
+  });
+
+  it("returns a uniform 404 when the lead has no PlaybookInstance (AC-1)", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
+      playbookGrantRow(),
+    );
+    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue(null);
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "not_found", message: expect.any(String) },
+    });
+  });
+
+  it("returns 500 render_failed (never a bare uncaught throw) when the stored source names a play the current library no longer declares", async () => {
+    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
+      playbookGrantRow(),
+    );
+    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue({
+      level: 0,
+      source: {
+        artifact_type: "playbook",
+        scope: "person",
+        scope_ref: LEAD_ID,
+        method: "targeting-maturity",
+        level: 0,
+        plays: ["tm-999.999"],
+        compiled_from: "wlscore_defect",
+      },
+      markdown: "",
+    });
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/deliverables/${GRANT_ID}`,
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "render_failed", message: expect.any(String) },
+    });
+  });
+});

package/templates/apps/api/src/routes/deliverables/index.ts

@@ -0,0 +1,200 @@
+/**
+ * Deliverables route group (#3961 D5; extended FEAT-074 U4b, #4718 D4).
+ *
+ * Routes:
+ *   GET /v1/deliverables/:grantId — stream the grant's asset bytes
+ *
+ * The capability-token download route — a lead-facing URL (an email-click
+ * download), not an agent-facing business-data endpoint. No MCP twin (the
+ * same no-twin class as the identity-bound `/v1/workspaces/*` and
+ * `/v1/billing/*` routes — apps/api/CLAUDE.md § Endpoint conventions). No
+ * siteId in the URL: the grant id alone resolves both the asset and its
+ * site (a stable-id ref, ADR 0009 invariant 1 posture — never a
+ * cross-namespace `@relation`).
+ *
+ * A `grant.assetId` prefixed `playbook:` (FEAT-074 U4b, #4718 D4) is the
+ * VIRTUAL asset a `deliverable-fulfillment.ts` playbook grant mints — it
+ * skips the `DeliverableAsset` lookup entirely, loads the lead's NEWEST
+ * `PlaybookInstance` for `(grant.siteId, grant.leadId, experimentKey)`, and
+ * renders it to a PDF on request (`renderPlaybookPdf`, D1 — never a stored
+ * blob). Every other `assetId` follows the unchanged operator-uploaded path
+ * below.
+ *
+ * Every miss — unknown id, malformed id, grant-without-asset, a `playbook:`
+ * grant with no matching `PlaybookInstance` — is a UNIFORM 404
+ * (`{ ok:false, error:{ code:'not_found' } }`): no route distinguishes
+ * "wrong token" from "no such asset," so nothing here is an enumeration
+ * oracle. Repeated downloads on one grant are allowed — a lead re-opening
+ * their email is the normal case, so the grant is never consumed on read.
+ *
+ * A render failure (`PlaybookRenderError` — the vendored library no longer
+ * declares a play the stored instance names, D1's "library defect, not a
+ * render branch" posture) is deliberately NOT folded into the uniform-404
+ * contract above — it is a genuine internal error, not a token/asset miss.
+ * Caught, logged with `{grantId, experimentKey}` (never PII) so an on-call
+ * engineer can diagnose a library-drift incident from logs alone, and
+ * reported as a `500` (mirrors `waitlist-experiments/respond.ts`'s
+ * contract-drift posture).
+ */
+import { logger } from "@working-theory/observability";
+import type { FastifyPluginAsync } from "fastify";
+
+import { resolveLocale } from "../../lib/locales.js";
+import { prisma } from "../../lib/prisma.js";
+import type { PlaybookSource } from "../../services/playbook-compile.js";
+import { PlaybookRenderError, renderPlaybookPdf } from "../../services/playbook-render.js";
+
+type DeliverableGrantRow = {
+  id: string;
+  siteId: string;
+  assetId: string;
+  leadId: string;
+};
+
+type DeliverableAssetRow = {
+  id: string;
+  siteId: string;
+  filename: string;
+  contentType: string;
+  bytes: Buffer;
+};
+
+type PlaybookInstanceRow = {
+  level: number;
+  source: unknown;
+  markdown: string;
+};
+
+const PLAYBOOK_ASSET_PREFIX = "playbook:";
+
+const NOT_FOUND = {
+  ok: false as const,
+  error: { code: "not_found", message: "Not found." },
+};
+
+const DELIVERABLES_NOT_CONFIGURED = {
+  ok: false as const,
+  error: {
+    code: "deliverables_not_configured",
+    message: "Deliverables are not configured.",
+  },
+};
+
+const RENDER_FAILED = {
+  ok: false as const,
+  error: { code: "render_failed", message: "Failed to render the document." },
+};
+
+/**
+ * Strip CR/LF (header injection — the same class of guard
+ * @working-theory/email's `hasCRLF` applies to header-bound strings) and
+ * collapse anything outside a safe charset to `_`. `filename` is
+ * operator-authored (the `deliverable:upload` CLI's `--filename`, or the
+ * uploaded file's own basename) — it MUST NOT reach the
+ * `Content-Disposition` header un-sanitized.
+ */
+function sanitizeFilename(filename: string): string {
+  const stripped = filename.replace(/[\r\n]/g, "");
+  const safe = stripped.replace(/[^a-zA-Z0-9._\- ]/g, "_");
+  return safe.length > 0 ? safe : "download";
+}
+
+/**
+ * `playbook-level-<N>.pdf`, `playbook-gate.pdf` for Level 0 (spec §2.1's
+ * never-say-Level-0 rule — a download filename is customer-visible; mirrors
+ * `renderPlaybookPdf`'s own Gate-vs-Level chrome-label split). Passed
+ * through `sanitizeFilename` like every other filename this route serves.
+ */
+function playbookFilename(level: number): string {
+  return level === 0 ? "playbook-gate.pdf" : `playbook-level-${level}.pdf`;
+}
+
+export const deliverableDownloadRoute: FastifyPluginAsync = async (fastify) => {
+  fastify.get<{ Params: { grantId: string }; Querystring: { locale?: string } }>(
+    "/v1/deliverables/:grantId",
+    async (request, reply) => {
+      if (!process.env.DATABASE_URL) {
+        // Constant across every grantId (not attacker-distinguishing) —
+        // this guard sits OUTSIDE the uniform-404 contract, which covers
+        // only per-token misses.
+        return reply.status(503).send(DELIVERABLES_NOT_CONFIGURED);
+      }
+
+      const { grantId } = request.params;
+
+      const grant = (await prisma.deliverableGrant.findUnique({
+        where: { id: grantId },
+      })) as DeliverableGrantRow | null;
+
+      if (!grant) {
+        return reply.status(404).send(NOT_FOUND);
+      }
+
+      // FEAT-074 U4b (#4718) D4 — the `playbook:` virtual asset: skip the
+      // DeliverableAsset lookup entirely, resolve the lead's NEWEST
+      // PlaybookInstance for (siteId, leadId, experimentKey), and render it
+      // on request. Tenancy: scoped by grant.siteId + grant.leadId ALONE —
+      // never a request-supplied id (spec §2.2 Tenancy).
+      if (grant.assetId.startsWith(PLAYBOOK_ASSET_PREFIX)) {
+        const experimentKey = grant.assetId.slice(PLAYBOOK_ASSET_PREFIX.length);
+
+        const instance = (await prisma.playbookInstance.findFirst({
+          where: { siteId: grant.siteId, leadId: grant.leadId, experimentKey },
+          orderBy: { createdAt: "desc" },
+          select: { level: true, source: true, markdown: true },
+        })) as PlaybookInstanceRow | null;
+
+        if (!instance) {
+          return reply.status(404).send(NOT_FOUND);
+        }
+
+        const locale = resolveLocale(request.query.locale);
+
+        let bytes: Uint8Array;
+        try {
+          bytes = await renderPlaybookPdf({
+            source: instance.source as PlaybookSource,
+            markdown: instance.markdown,
+            locale,
+          });
+        } catch (err) {
+          if (!(err instanceof PlaybookRenderError)) throw err;
+          logger.error(
+            { grantId, experimentKey, err: err.message },
+            "[deliverables] playbook render failed — the vendored library no longer declares a play this instance names",
+          );
+          return reply.status(500).send(RENDER_FAILED);
+        }
+
+        const filename = sanitizeFilename(playbookFilename(instance.level));
+
+        return reply
+          .header("Content-Type", "application/pdf")
+          .header("Content-Disposition", `attachment; filename="${filename}"`)
+          .header("X-Content-Type-Options", "nosniff")
+          .send(Buffer.from(bytes));
+      }
+
+      const asset = (await prisma.deliverableAsset.findUnique({
+        where: { id: grant.assetId },
+      })) as DeliverableAssetRow | null;
+
+      if (!asset || asset.siteId !== grant.siteId) {
+        return reply.status(404).send(NOT_FOUND);
+      }
+
+      const filename = sanitizeFilename(asset.filename);
+
+      return reply
+        .header("Content-Type", asset.contentType)
+        .header("Content-Disposition", `attachment; filename="${filename}"`)
+        // The operator-supplied contentType is echoed verbatim above; this
+        // origin also serves /v1/auth/* cookies, so nosniff stops a
+        // mis-typed or malicious contentType from being MIME-sniffed by
+        // the browser into an executable context (#4002, #3961
+        // security-review — Medium/Low, non-blocking on #3961's Pass).
+        .header("X-Content-Type-Options", "nosniff")
+        .send(asset.bytes);
+    },
+  );
+};