create-ailk 0.1.1 → 0.3.0

package/templates/apps/api/src/services/__tests__/consent-migration.test.ts

@@ -0,0 +1,65 @@
+/**
+ * @file consent-migration.test.ts
+ * @description Drift guard between the consent_grants migration's BACKFILL
+ * and the consent service (#5275, spec §5.1 last bullet + §5.3 second
+ * boundary): every pre-existing listing gets one grant marked
+ * wording-UNRECOVERABLE — the exact `UNRECOVERABLE_CONSENT_STATEMENT`
+ * literal, so a later reader can match it — stamped at the listing's own
+ * consent_at, and project_listings itself is never touched.
+ */
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+import { SITE_CONSENT_CONFIG_DEFAULTS } from "@working-theory/validation";
+
+import { UNRECOVERABLE_CONSENT_STATEMENT } from "../consent";
+
+const MIGRATION = join(
+  resolve(__dirname, "..", "..", "..", "..", ".."),
+  "database",
+  "migrations",
+  "20260911180000_consent_grants",
+  "migration.sql",
+);
+
+describe("consent_grants migration backfill (#5275 D11)", () => {
+  const sql = readFileSync(MIGRATION, "utf-8");
+
+  it("creates the table with its two indexes", () => {
+    expect(sql).toContain('CREATE TABLE "consent_grants"');
+    expect(sql).toContain('("site_id", "subject_type", "subject_id")');
+    expect(sql).toContain('("site_id", "purpose_id")');
+  });
+
+  it("inserts one row per pre-existing project_listings row", () => {
+    expect(sql).toContain('INSERT INTO "consent_grants"');
+    expect(sql).toMatch(/FROM "project_listings"/);
+    expect(sql).toContain("'project_listing'");
+    expect(sql).toContain("'service_terms'");
+  });
+
+  it("marks every backfilled row with the exact unrecoverable sentinel and a COMPUTED hash", () => {
+    expect(sql).toContain(`'${UNRECOVERABLE_CONSENT_STATEMENT}'`);
+    expect(sql).toContain(
+      `encode(sha256(convert_to('${UNRECOVERABLE_CONSENT_STATEMENT}', 'UTF8')), 'hex')`,
+    );
+    expect(sql).toContain("'und'");
+  });
+
+  it("sources created_at from the listing's own consent_at", () => {
+    const insert = sql.slice(sql.indexOf('INSERT INTO "consent_grants"'));
+    expect(insert).toContain('"consent_at"');
+    expect(insert).toContain('"created_at"');
+  });
+
+  it("never UPDATEs or ALTERs project_listings — consent_at stays as it was", () => {
+    expect(sql).not.toMatch(/UPDATE\s+"project_listings"/i);
+    expect(sql).not.toMatch(/ALTER\s+TABLE\s+"project_listings"/i);
+  });
+
+  it("never stamps today's default wording onto a grant nobody read", () => {
+    expect(sql).not.toContain("You agree to being contacted");
+    const defaultStatement = SITE_CONSENT_CONFIG_DEFAULTS.purposes[0]!.label["en"]!;
+    expect(sql).not.toContain(defaultStatement);
+  });
+});

package/templates/apps/api/src/services/__tests__/consent.test.ts

@@ -0,0 +1,282 @@
+/**
+ * @file consent.test.ts
+ * @description Unit tests for the consent-grant writer (#5275 Part B) —
+ * `recordConsent`, `recordLegacyConsent`, `consentStatementHash`,
+ * `consentConfigForSite`.
+ *
+ * External dependency boundaries mocked:
+ *   - @working-theory/database (via moduleNameMapper -> prisma-client.js mock; prisma singleton via __mocks__/prisma.ts)
+ *
+ * The evidence rule under test: a row carries the statement the registry
+ * RESOLVED (the same function the renderer used), in the locale it was
+ * actually served, or the unrecoverable sentinel — never anything a request
+ * body said and never today's wording for a grant nobody read.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../lib/prisma.js");
+
+import { createHash } from "node:crypto";
+
+import {
+  DEFAULT_CONSENT_PURPOSE_ID,
+  resolveConsentStatement,
+  SITE_CONSENT_CONFIG_DEFAULTS,
+  siteConsentConfigSchema,
+} from "@working-theory/validation";
+
+import { prisma } from "../../lib/prisma.js";
+
+import {
+  consentConfigForSite,
+  consentStatementHash,
+  recordConsent,
+  recordLegacyConsent,
+  UNRECOVERABLE_CONSENT_LOCALE,
+  UNRECOVERABLE_CONSENT_STATEMENT,
+  requiredConsentUnmet,
+} from "../consent";
+
+const SITE_ID = "site-1";
+const SUBJECT = { subjectType: "project_listing", subjectId: "prjl_00000000-0000-7000-8000-000000000001" };
+
+/** Two purposes, one of them bilingual — the fixture every locale case reads from. */
+const CONFIG = siteConsentConfigSchema.parse({
+  policies: { terms: "/terms", privacy: "/privacy" },
+  purposes: [
+    {
+      id: "service_terms",
+      required: true,
+      label: {
+        en: "You agree to our [Terms](terms).",
+        fr: "Vous acceptez nos [Conditions](terms).",
+      },
+    },
+    {
+      id: "marketing_email",
+      required: false,
+      label: { en: "Send me occasional product news." },
+    },
+  ],
+});
+
+type Row = Record<string, unknown>;
+
+function writtenRows(call = 0): Row[] {
+  const arg = (prisma.consentGrant.createMany as jest.Mock).mock.calls[call]![0] as { data: Row[] };
+  return arg.data;
+}
+
+describe("recordConsent (#5275)", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
+      ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
+    );
+  });
+
+  it("one granted + one declined purpose → ONE createMany with two rows, one granted:true and one granted:false (D8)", async () => {
+    const written = await recordConsent({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      locale: "en",
+      config: CONFIG,
+      consents: { service_terms: true, marketing_email: false },
+    });
+
+    expect(written).toBe(2);
+    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(1);
+    const rows = writtenRows();
+    expect(rows).toHaveLength(2);
+    expect(rows.find((r) => r["purposeId"] === "service_terms")).toMatchObject({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      granted: true,
+    });
+    expect(rows.find((r) => r["purposeId"] === "marketing_email")).toMatchObject({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      granted: false,
+    });
+  });
+
+  it("each row carries the RESOLVED statement text and the locale it was actually served in (D7)", async () => {
+    // `fr-CA` is asked for; the bilingual purpose serves `fr` (language-subtag
+    // fallback), the English-only purpose serves `en` (default-locale
+    // fallback). The row records the locale READ, not the one requested.
+    await recordConsent({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      locale: "fr-CA",
+      config: CONFIG,
+      consents: { service_terms: true, marketing_email: true },
+    });
+
+    const rows = writtenRows();
+    const terms = rows.find((r) => r["purposeId"] === "service_terms")!;
+    const marketing = rows.find((r) => r["purposeId"] === "marketing_email")!;
+
+    const expectedTerms = resolveConsentStatement(CONFIG.purposes[0]!, "fr-CA");
+    expect(expectedTerms.locale).toBe("fr");
+    expect(terms["statement"]).toBe("Vous acceptez nos [Conditions](terms).");
+    expect(terms["statement"]).toBe(expectedTerms.statement);
+    expect(terms["locale"]).toBe("fr");
+    expect(terms["statementHash"]).toBe(consentStatementHash(expectedTerms.statement));
+
+    expect(marketing["statement"]).toBe("Send me occasional product news.");
+    expect(marketing["locale"]).toBe("en");
+    expect(marketing["locale"]).not.toBe("fr-CA");
+  });
+
+  it("a second recordConsent for the same subject + purpose APPENDS — createMany again, never update/upsert (D9)", async () => {
+    const input = {
+      siteId: SITE_ID,
+      ...SUBJECT,
+      locale: "en",
+      config: CONFIG,
+      consents: { marketing_email: true },
+    };
+    await recordConsent(input);
+    await recordConsent({ ...input, consents: { marketing_email: false } });
+
+    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(2);
+    expect(writtenRows(0)[0]).toMatchObject({ purposeId: "marketing_email", granted: true });
+    expect(writtenRows(1)[0]).toMatchObject({ purposeId: "marketing_email", granted: false });
+    // The mock delegate deliberately exposes no mutating method: the writer
+    // has nothing to update or upsert WITH, so append is structural.
+    const delegate = prisma.consentGrant as Record<string, unknown>;
+    expect(delegate["update"]).toBeUndefined();
+    expect(delegate["upsert"]).toBeUndefined();
+    expect(delegate["updateMany"]).toBeUndefined();
+  });
+
+  it("an unknown purpose id writes NOTHING for it — no statement was rendered (evidence rule)", async () => {
+    const written = await recordConsent({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      locale: "en",
+      config: CONFIG,
+      consents: { service_terms: true, not_a_purpose: true },
+    });
+
+    expect(written).toBe(1);
+    const rows = writtenRows();
+    expect(rows).toHaveLength(1);
+    expect(rows[0]!["purposeId"]).toBe("service_terms");
+  });
+
+  it("only unknown purpose ids → no createMany at all, returns 0", async () => {
+    const written = await recordConsent({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      locale: "en",
+      config: CONFIG,
+      consents: { not_a_purpose: true },
+    });
+    expect(written).toBe(0);
+    expect(prisma.consentGrant.createMany).not.toHaveBeenCalled();
+  });
+
+  it("never writes the unrecoverable sentinel when a statement was resolved", async () => {
+    await recordConsent({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      locale: "en",
+      config: SITE_CONSENT_CONFIG_DEFAULTS,
+      consents: { [DEFAULT_CONSENT_PURPOSE_ID]: true },
+    });
+    const [row] = writtenRows();
+    expect(row!["statement"]).not.toBe(UNRECOVERABLE_CONSENT_STATEMENT);
+    expect(row!["locale"]).not.toBe(UNRECOVERABLE_CONSENT_LOCALE);
+  });
+});
+
+describe("recordLegacyConsent (#5275 D11)", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
+      ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
+    );
+  });
+
+  it("writes exactly one row: sentinel statement, locale 'und', purpose service_terms under the default config", async () => {
+    const written = await recordLegacyConsent({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      config: SITE_CONSENT_CONFIG_DEFAULTS,
+    });
+
+    expect(written).toBe(1);
+    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(1);
+    const rows = writtenRows();
+    expect(rows).toHaveLength(1);
+    expect(rows[0]).toEqual({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      purposeId: DEFAULT_CONSENT_PURPOSE_ID,
+      granted: true,
+      locale: UNRECOVERABLE_CONSENT_LOCALE,
+      statement: UNRECOVERABLE_CONSENT_STATEMENT,
+      statementHash: consentStatementHash(UNRECOVERABLE_CONSENT_STATEMENT),
+    });
+    expect(rows[0]!["purposeId"]).toBe("service_terms");
+    expect(rows[0]!["locale"]).toBe("und");
+    // Never today's wording for a grant nobody read.
+    expect(rows[0]!["statement"]).not.toContain("You agree to being contacted");
+  });
+
+  it("targets the first REQUIRED purpose, not merely the first purpose", async () => {
+    const config = siteConsentConfigSchema.parse({
+      purposes: [
+        { id: "marketing_email", required: false, label: { en: "News." } },
+        { id: "service_terms", required: true, label: { en: "Terms." } },
+      ],
+    });
+    await recordLegacyConsent({ siteId: SITE_ID, ...SUBJECT, config });
+    expect(writtenRows()[0]!["purposeId"]).toBe("service_terms");
+  });
+
+  it("falls back to the first purpose when none is required", async () => {
+    const config = siteConsentConfigSchema.parse({
+      purposes: [{ id: "marketing_email", required: false, label: { en: "News." } }],
+    });
+    await recordLegacyConsent({ siteId: SITE_ID, ...SUBJECT, config });
+    expect(writtenRows()[0]!["purposeId"]).toBe("marketing_email");
+  });
+});
+
+describe("consentStatementHash", () => {
+  it("is sha256 hex", () => {
+    expect(consentStatementHash("abc")).toBe(
+      "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
+    );
+    expect(consentStatementHash(UNRECOVERABLE_CONSENT_STATEMENT)).toBe(
+      createHash("sha256").update(UNRECOVERABLE_CONSENT_STATEMENT).digest("hex"),
+    );
+    expect(consentStatementHash(UNRECOVERABLE_CONSENT_STATEMENT)).toMatch(/^[0-9a-f]{64}$/);
+  });
+});
+
+describe("consentConfigForSite", () => {
+  it("resolves every site to the platform defaults until a config row exists", async () => {
+    await expect(consentConfigForSite(SITE_ID)).resolves.toBe(SITE_CONSENT_CONFIG_DEFAULTS);
+  });
+});
+
+describe("requiredConsentUnmet (#5275, security review Medium 1)", () => {
+  const config = {
+    policies: {},
+    purposes: [
+      { id: "service_terms", required: true, label: { en: "a" } },
+      { id: "marketing", required: false, label: { en: "b" } },
+    ],
+  };
+
+  it("names a required purpose that is declined OR absent, and passes when every required one is true", () => {
+    expect(requiredConsentUnmet(config, { service_terms: false })).toBe("service_terms");
+    expect(requiredConsentUnmet(config, {})).toBe("service_terms");
+    expect(requiredConsentUnmet(config, { marketing: true })).toBe("service_terms");
+    expect(requiredConsentUnmet(config, { service_terms: true })).toBeUndefined();
+    expect(requiredConsentUnmet(config, { service_terms: true, marketing: false })).toBeUndefined();
+  });
+});

package/templates/apps/api/src/services/consent.ts

@@ -0,0 +1,236 @@
+/**
+ * @file consent.ts
+ * @description The consent-grant writer (#5275 Part B) — `recordConsent`,
+ * the one function that turns a person's answers to a site's consent
+ * purposes into `ConsentGrant` rows, plus `recordLegacyConsent`, the D11
+ * path for a caller that could only say `consent: true`.
+ *
+ * SURFACE-AGNOSTIC BY DESIGN (D10). A grant's subject is a `subjectType` +
+ * `subjectId` pair of plain scalars with no relation into any other table
+ * (ADR 0009 invariant 1), so a new surface — the newsletter subscribe path
+ * is the named follow-up — adopts consent by adding ONE call here and NO
+ * migration. Nothing in this module knows what a project listing is.
+ *
+ * THE EVIDENCE RULE (spec §5.2): no row is ever written with statement text
+ * the system did not actually render to that person. Two consequences:
+ *
+ *   - `recordConsent` resolves each statement from the SAME registry and the
+ *     SAME `resolveConsentStatement` the renderer used (D7), so the recorded
+ *     wording and the rendered wording are one string by construction, and a
+ *     request body never carries wording at all. A purpose id the registry
+ *     does not know is skipped, not written: no statement was rendered for it.
+ *   - A grant whose wording cannot be proven — a legacy `consent: true` body,
+ *     or the migration backfill — carries `UNRECOVERABLE_CONSENT_STATEMENT`,
+ *     never today's default text. Stamping current wording onto a grant
+ *     nobody read would fabricate evidence (D11).
+ *
+ * APPEND-ONLY (D9): every write is a `createMany`; this module never
+ * updates or upserts, so a later withdrawal sits beside the earlier grant
+ * rather than replacing it. Declines are written as `granted: false` (D8).
+ */
+
+import { createHash } from "node:crypto";
+
+import { logger } from "@working-theory/observability";
+import {
+  consentPurposeById,
+  resolveConsentStatement,
+  SITE_CONSENT_CONFIG_DEFAULTS,
+  type SiteConsentConfig,
+} from "@working-theory/validation";
+
+import { prisma } from "../lib/prisma.js";
+
+/**
+ * The one delegate this module writes through — the shape of `prisma` AND of
+ * the `tx` client an interactive `$transaction` hands out, so a caller that
+ * creates the subject row can write the grant in the SAME transaction (the
+ * listing's `start` does): either the row and its evidence both land, or
+ * neither does.
+ */
+export interface ConsentWriteClient {
+  consentGrant: {
+    createMany(args: { data: ConsentGrantRow[] }): Promise<{ count: number }>;
+  };
+}
+
+interface ConsentGrantRow {
+  siteId: string;
+  subjectType: string;
+  subjectId: string;
+  purposeId: string;
+  granted: boolean;
+  locale: string;
+  statement: string;
+  statementHash: string;
+}
+
+/**
+ * The most keys a `consents` map may carry on an anonymous request. Any real
+ * registry is a handful of purposes; the cap bounds the per-request work an
+ * unbounded map could buy (security review, Low 3).
+ */
+export const MAX_CONSENT_KEYS = 64;
+
+/**
+ * The statement sentinel for a grant whose wording cannot be proven — a row
+ * carrying it records THAT a person consented (and when), not WHAT they read.
+ * Written on exactly two paths: `recordLegacyConsent` (a body carrying only
+ * the legacy `consent: true` literal, D11) and the consent_grants migration's
+ * backfill of pre-existing listings, which must carry this exact literal.
+ * It is never a substitute for real wording: a caller that rendered a
+ * statement records it through `recordConsent`.
+ */
+export const UNRECOVERABLE_CONSENT_STATEMENT =
+  "[unrecoverable: no statement was rendered by this system for this grant]";
+
+/** BCP-47 `und` — the locale of a statement nobody read. */
+export const UNRECOVERABLE_CONSENT_LOCALE = "und";
+
+/** sha256 hex of a statement — the `statementHash` that groups identical wordings. */
+export function consentStatementHash(statement: string): string {
+  return createHash("sha256").update(statement).digest("hex");
+}
+
+/**
+ * The site's consent registry.
+ *
+ * There is no per-site consent config ROW yet (spec §4 deliberately adds
+ * none), so every site resolves to `SITE_CONSENT_CONFIG_DEFAULTS`. This
+ * function is the single seam a `SiteConsentConfig` row wires into later
+ * (the `listingConfigFor` shape: read the blob, `consentConfigFor(blob)`).
+ * The RENDERER (`packages/ui`) resolves its statements from the same
+ * `SITE_CONSENT_CONFIG_DEFAULTS`, which is what keeps the recorded statement
+ * identical to the rendered one until a config row exists — at which point
+ * both sides must read the same row.
+ */
+export async function consentConfigForSite(
+  _siteId: string,
+): Promise<SiteConsentConfig> {
+  return SITE_CONSENT_CONFIG_DEFAULTS;
+}
+
+/**
+ * The id of the first REQUIRED registry purpose `consents` does not GRANT —
+ * declined (`false`) or simply absent — or `undefined` when every required
+ * purpose is `true`. Absence counts as unmet on purpose (security review,
+ * Medium 1): a body carrying `consents: {}` beside `consent: true` would
+ * otherwise create the subject with no grant row at all, which is a worse
+ * record than the legacy sentinel. A surface whose subject cannot exist
+ * without the required purposes (the listing: the row goes on to publish the
+ * founder's address) checks this before creating the subject.
+ */
+export function requiredConsentUnmet(
+  config: SiteConsentConfig,
+  consents: Record<string, boolean>,
+): string | undefined {
+  for (const purpose of config.purposes) {
+    if (purpose.required && consents[purpose.id] !== true) return purpose.id;
+  }
+  return undefined;
+}
+
+export interface RecordConsentInput {
+  siteId: string;
+  /** e.g. `project_listing`, `subscriber` — a plain scalar, no relation (D10). */
+  subjectType: string;
+  subjectId: string;
+  /** The locale the statements were RENDERED in; the served locale is what gets recorded. */
+  locale: string;
+  config: SiteConsentConfig;
+  /** purposeId → the person's answer. `false` is a stored decline (D8). */
+  consents: Record<string, boolean>;
+}
+
+/**
+ * Write one `ConsentGrant` row per answered purpose in one `createMany`.
+ * Returns the number of rows written. Append-only — never update/upsert.
+ * `db` defaults to the shared client; pass a `$transaction` client to land
+ * the grant atomically with the subject row it belongs to.
+ */
+export async function recordConsent(
+  input: RecordConsentInput,
+  db: ConsentWriteClient = prisma,
+): Promise<number> {
+  const rows: ConsentGrantRow[] = [];
+  const unknown: string[] = [];
+
+  for (const [purposeId, granted] of Object.entries(input.consents)) {
+    const purpose = consentPurposeById(input.config, purposeId);
+    if (!purpose) {
+      // Not in the registry ⇒ no statement was rendered for it ⇒ nothing to
+      // record (the evidence rule). Collected and logged ONCE per call below,
+      // because a client naming a purpose the site does not declare is a
+      // drift someone should see — and a map full of junk keys must not buy
+      // a log line each.
+      unknown.push(purposeId);
+      continue;
+    }
+    const { statement, locale } = resolveConsentStatement(purpose, input.locale);
+    rows.push({
+      siteId: input.siteId,
+      subjectType: input.subjectType,
+      subjectId: input.subjectId,
+      purposeId,
+      granted,
+      locale,
+      statement,
+      statementHash: consentStatementHash(statement),
+    });
+  }
+
+  if (unknown.length > 0) {
+    logger.warn(
+      {
+        siteId: input.siteId,
+        subjectType: input.subjectType,
+        unknownCount: unknown.length,
+        sample: unknown.slice(0, 5),
+      },
+      "[consent] skipping unknown purpose ids — not in the site's consent registry, no statement was rendered for them",
+    );
+  }
+
+  if (rows.length === 0) return 0;
+  const result = await db.consentGrant.createMany({ data: rows });
+  return result.count;
+}
+
+export interface RecordLegacyConsentInput {
+  siteId: string;
+  subjectType: string;
+  subjectId: string;
+  config: SiteConsentConfig;
+}
+
+/**
+ * The D11 path: a body that carried only the legacy `consent: true` literal.
+ * Writes ONE grant against the site's first `required` purpose (falling back
+ * to its first purpose), `granted: true`, with the statement marked
+ * unrecoverable — the caller affirmed, but this system rendered it no
+ * wording to affirm.
+ */
+export async function recordLegacyConsent(
+  input: RecordLegacyConsentInput,
+  db: ConsentWriteClient = prisma,
+): Promise<number> {
+  const purpose =
+    input.config.purposes.find((p) => p.required) ?? input.config.purposes[0];
+  if (!purpose) return 0;
+
+  const result = await db.consentGrant.createMany({
+    data: [
+      {
+        siteId: input.siteId,
+        subjectType: input.subjectType,
+        subjectId: input.subjectId,
+        purposeId: purpose.id,
+        granted: true,
+        locale: UNRECOVERABLE_CONSENT_LOCALE,
+        statement: UNRECOVERABLE_CONSENT_STATEMENT,
+        statementHash: consentStatementHash(UNRECOVERABLE_CONSENT_STATEMENT),
+      },
+    ],
+  });
+  return result.count;
+}

package/templates/apps/api/src/services/deliverable-fulfillment.ts

@@ -3,6 +3,16 @@
  * @description The deliverable-fulfillment service (#3961 D3/D4/D5/D7;
  * extended #3998 D1/D3/D5; extended FEAT-074 U4b, #4718 D4).
  *
+ * NOT marked `oss: false` and NOT in signal-collectors's `ownedFiles`
+ * (module-architecture.ts), despite D-48/D6 placing this file with
+ * signal-collectors — `services/recommender-capture.ts` imports it directly
+ * and is itself reached from `server.ts` by a plain, unconditional static
+ * import today (commerce/#5364 has not yet landed the gate around it).
+ * Marking or excluding this file broke both the OSS-strip and the create-ailk
+ * starter snapshot for EVERY module, not just signal-collectors (spec §5.4
+ * escalation boundary; see module-architecture.ts's comment on this file).
+ * Revert once #5364 lands.
+ *
  * `fulfillDeliverable` is the one entry point, called from flow-engine's
  * completion branch after `routeLead` succeeds and only when the session's
  * `configSnapshot` carries a `deliverables` block (D4 — the block is opt-in

package/templates/apps/api/src/services/listing-config.ts

@@ -1,4 +1,10 @@
 /**
+ * NOT marked `oss: false` (D-48/#5366 escalation — see
+ * `routes/project-listings/me.ts`'s header comment): imported by
+ * `routes/project-listings/{start,public}.ts`, each of which ships
+ * unconditionally because `routes/project-listings/index.ts`'s multi-tenant
+ * literal `import()` forces it. Registration stays gated.
+ *
  * @file listing-config.ts
  * @description The per-site project-listings config read (#5033) — one
  * function, `listingConfigFor`, that resolves a site's window bounds and
@@ -53,9 +59,61 @@ export async function listingConfigFor(siteId: string): Promise<SiteListingConfi
     );
     return SITE_LISTING_CONFIG_DEFAULTS;
   }
+  warnOnDroppedField(siteId, row.data, parsed.data);
   return parsed.data;
 }
 
+/**
+ * The two `.catch(undefined)` members of `siteListingConfigSchema` are silent
+ * by construction (#5406): a malformed `resumeEmail` or `siteName` is DROPPED
+ * rather than failing the whole blob, so the site keeps its own window bounds
+ * and collected fields instead of silently reverting to the platform's more
+ * permissive defaults.
+ *
+ * Silent is the right BEHAVIOUR and the wrong OBSERVABILITY. An operator who
+ * typos a subject key gets a site that quietly stops sending the resume email
+ * with nothing anywhere saying why. This closes that: when the stored blob has
+ * the key and the parsed config does not, the drop is logged.
+ *
+ * Field NAMES only, never values — `resumeEmail` carries the site's addresses
+ * and the founder-facing copy, and this module sits on the anonymous path.
+ */
+function warnOnDroppedField(
+  siteId: string,
+  stored: unknown,
+  parsed: SiteListingConfig,
+): void {
+  if (typeof stored !== "object" || stored === null) return;
+  const raw = stored as Record<string, unknown>;
+  for (const field of ["resumeEmail", "siteName"] as const) {
+    if (raw[field] !== undefined && parsed[field] === undefined) {
+      logger.warn(
+        { siteId, field },
+        "[listing-config] stored field failed its schema and was DROPPED — the rest of this site's config still applies, but this field is not in effect",
+      );
+    }
+  }
+
+  // `resumeEmail.maxSendsPerHour` carries its OWN `.catch(undefined)` (#5414),
+  // so a bad cap is dropped while the block around it survives — which the
+  // loop above, comparing whole members, cannot see. Checked only when the
+  // block itself parsed: a dropped block is already reported once above, and
+  // reporting it twice would make the narrower line the less trustworthy one.
+  const storedEmail = raw["resumeEmail"];
+  if (
+    typeof storedEmail === "object" &&
+    storedEmail !== null &&
+    (storedEmail as Record<string, unknown>)["maxSendsPerHour"] !== undefined &&
+    parsed.resumeEmail !== undefined &&
+    parsed.resumeEmail.maxSendsPerHour === undefined
+  ) {
+    logger.warn(
+      { siteId, field: "resumeEmail.maxSendsPerHour" },
+      "[listing-config] stored field failed its schema and was DROPPED — the rest of this site's config still applies, but this field is not in effect",
+    );
+  }
+}
+
 /**
  * Resolve a site from its PUBLIC SITE KEY (#5048 D2).
  *