create-ailk 0.11.4 → 0.12.0

package/templates/apps/api/src/services/deliverable-fulfillment.ts

@@ -236,6 +236,26 @@ async function stampOutcome(
   }
 }
 
+// ─── #7519 D6 — the sender address ──────────────────────────────────────────────
+
+/**
+ * The From address every email this service sends carries:
+ * `AILK_DELIVERABLE_EMAIL_FROM`, else `AILK_LEAD_NOTIFICATION_FROM`,
+ * `undefined` when neither is set — an empty value counts as unset (#7519 D6). One resolver for the send paths
+ * (`sendAndStamp`, `sendCompletionEmail`) and the Admin's read
+ * (`GET /v1/workspaces/:workspaceId/general` `emailFrom`), so the address
+ * the Admin shows can never differ from the address the engine sends from.
+ */
+export function deliverableSenderAddress(): string | undefined {
+  // `||`, not `??`: an env var set to "" names no sender, so it falls
+  // through to the next, and "" never reaches a From header or the Admin.
+  return (
+    process.env.AILK_DELIVERABLE_EMAIL_FROM ||
+    process.env.AILK_LEAD_NOTIFICATION_FROM ||
+    undefined
+  );
+}
+
 // ─── #3998 D5 — the shared post-mint tail ────────────────────────────────────────
 
 type SendAndStampInput = {
@@ -261,9 +281,7 @@ async function sendAndStamp(input: SendAndStampInput): Promise<PostMintOutcome>
     input;
   const logCtx = { siteId, flowSlug, sessionId };
 
-  const fromAddress =
-    process.env.AILK_DELIVERABLE_EMAIL_FROM ??
-    process.env.AILK_LEAD_NOTIFICATION_FROM;
+  const fromAddress = deliverableSenderAddress();
 
   if (!fromAddress) {
     await stampOutcome(grantId, "sender_unconfigured", new Date());
@@ -297,6 +315,74 @@ async function sendAndStamp(input: SendAndStampInput): Promise<PostMintOutcome>
   return outcome;
 }
 
+// ─── #7519 D5 — the completion email (a flow with no deliverable) ──────────────
+
+type CompletionEmailCopy = NonNullable<FlowConfig["completionEmail"]>;
+
+export type SendCompletionEmailInput = {
+  siteId: string;
+  flowSlug: string;
+  sessionId: string;
+  /** The lead's address — `undefined` when the flow asked for none. */
+  email: string | undefined;
+  locale: string;
+  defaultLocale: string;
+  copy: CompletionEmailCopy;
+};
+
+type CompletionOutcome =
+  | "sent"
+  | "send_failed"
+  | "sender_unconfigured"
+  | "no_recipient";
+
+const COMPLETION_OUTCOME_MESSAGE: Record<CompletionOutcome, string> = {
+  sent: "[deliverable-fulfillment] completion email sent",
+  send_failed: "[deliverable-fulfillment] completion email send failed",
+  sender_unconfigured:
+    "[deliverable-fulfillment] no from-address configured — completion email skipped",
+  no_recipient:
+    "[deliverable-fulfillment] no email answer — completion email skipped",
+};
+
+/**
+ * Sends a flow's `completionEmail` to the lead (#7519 D5) — the email a
+ * newsletter, contact, waitlist or diagnostic sends on completion, where
+ * there is no asset to deliver. The same sender, copy resolution and email
+ * function as the deliverable path, with no download link: it mints no
+ * grant and stamps nothing. Its outcome is logged with the
+ * `{ siteId, flowSlug, sessionId }` context the deliverable outcomes use.
+ * Never throws on its own business-logic misses; the caller's try/catch is
+ * the residual net for a genuine error.
+ */
+export async function sendCompletionEmail(
+  input: SendCompletionEmailInput,
+): Promise<CompletionOutcome> {
+  const { siteId, flowSlug, sessionId, email, locale, defaultLocale, copy } =
+    input;
+  const outcome = await sendCompletion();
+  logger.info(
+    { siteId, flowSlug, sessionId, outcome },
+    COMPLETION_OUTCOME_MESSAGE[outcome],
+  );
+  return outcome;
+
+  async function sendCompletion(): Promise<CompletionOutcome> {
+    if (!email) return "no_recipient";
+    const fromAddress = deliverableSenderAddress();
+    if (!fromAddress) return "sender_unconfigured";
+    const cta = copy.cta ? resolveCopy(copy.cta, locale, defaultLocale) : undefined;
+    const sendResult = await sendDeliverableEmail({
+      to: email,
+      fromAddress,
+      subject: resolveCopy(copy.subject, locale, defaultLocale),
+      body: resolveCopy(copy.body, locale, defaultLocale),
+      ...(cta !== undefined && { cta }),
+    });
+    return sendResult.ok ? "sent" : "send_failed";
+  }
+}
+
 // ─── fulfillDeliverable ─────────────────────────────────────────────────────────
 
 export async function fulfillDeliverable(

package/templates/apps/api/src/services/lead-routing.ts

@@ -69,6 +69,11 @@ export type SourceMeta = {
   ip: string;
   userAgent: string | undefined;
   receivedAt: string; // ISO
+  /**
+   * The lead came from a registered spoke of a hub (#7532 D4). Absent reads as
+   * `false`. Never persisted — `captureRecordFor` copies fields by name.
+   */
+  viaSpoke?: boolean;
 };
 
 /** Where the lead landed: a database row, the local file fallback, or the owner's inbox by email (#6730). */
@@ -286,6 +291,7 @@ async function sendEmail(
   input: RouteLeadInput,
   id: string,
   persisted: Persisted,
+  viaSpoke = false,
 ): Promise<EmailResult> {
   // Request-and-confirm SUPERSEDES this notification for a callback (#5970
   // D6). AC-1 requires the tenant to receive exactly one email, and the
@@ -309,8 +315,14 @@ async function sendEmail(
   // there is no row, so suppressing here would have produced ZERO operator
   // emails for every callback captured during the outage, on the one surface
   // whose whole purpose is that an outage must not lose a lead.
+  //
+  // `!viaSpoke` (#7532 D4, SEC-7532-2): request-and-confirm mints a Payment
+  // Link on the deployment's ONE Stripe account and mails the deployment's ONE
+  // address, so a spoke's callback never takes it — the route does not send
+  // the confirm link for a spoke, and this keeps the generic notification.
   if (
     input.kind === "callback" &&
+    !viaSpoke &&
     persisted === "db" &&
     requestConfirmSupersedesNotification()
   ) {
@@ -600,7 +612,7 @@ export async function routeLead(
   if (skipEmail) {
     emailResult = { skipped: true, reason: skipReason ?? "skipped" };
   } else {
-    emailResult = await sendEmail(input, id!, persisted!);
+    emailResult = await sendEmail(input, id!, persisted!, sourceMeta.viaSpoke);
   }
 
   return { ok: true, id: id!, persisted, email: emailResult };

package/templates/apps/api/src/services/project-listings.ts

@@ -56,12 +56,22 @@ import {
   composeAddressLine,
   composeFounderName,
   flowAddressValueSchema,
+  flowConfigSchema,
+  listicleSiteAnswerQuestions,
+  listingProfile,
   publicSiteAnswers,
+  withListicleQuestions,
+  LISTING_DIRECTORY_MAX_ENTRIES,
+  LISTING_ENTRY_TYPE_DEFAULT,
   PROJECT_LISTING_CONCURRENT_LIMIT,
   PROJECT_LISTING_NON_TERMINAL_STATUSES,
 } from "@working-theory/validation";
 import type {
   FlowAddressValue,
+  FlowConfig,
+  ListingDirectoryResponse,
+  ListingEntryPublic,
+  ListingSiteAnswersConfig,
   ProjectListing,
   ProjectListingDraftPatchInput,
   ProjectListingFaqs,
@@ -424,7 +434,7 @@ function toResponseRow(
  */
 async function attachWaitlistCounts(
   siteId: string,
-  rows: readonly ProjectListingRow[],
+  rows: readonly Pick<ProjectListingRow, "experimentKey">[],
 ): Promise<Map<string, number>> {
   const experimentKeys = [
     ...new Set(rows.map((r) => r.experimentKey).filter((v): v is string => v != null)),
@@ -456,7 +466,10 @@ async function attachWaitlistCounts(
   return counts;
 }
 
-function waitlistCountFor(row: ProjectListingRow, counts: Map<string, number>): number {
+function waitlistCountFor(
+  row: Pick<ProjectListingRow, "experimentKey">,
+  counts: Map<string, number>,
+): number {
   return row.experimentKey ? (counts.get(row.experimentKey) ?? 0) : 0;
 }
 
@@ -1133,6 +1146,43 @@ function draftUpdateData(
   };
 }
 
+/**
+ * The site-answer declarations a CAPTURED draft is checked against (#7521 D2):
+ * the site's own, plus the eligible Application fields of the LIVE listicle
+ * that captured it (`listicleSiteAnswerQuestions`). A draft listicle accepts
+ * no answers (SEC-7521-B1).
+ *
+ * Fails CLOSED: a missing listicle or a config that no longer parses logs at
+ * warn and answers the site's declarations alone, so an id nobody declared
+ * is still a 400.
+ */
+async function capturedDraftSiteAnswers(
+  siteId: string,
+  listingId: string,
+  capturedByFlowId: string,
+  siteDeclared: ListingSiteAnswersConfig,
+): Promise<ListingSiteAnswersConfig> {
+  const listicle = await prisma.flowDefinition.findFirst({
+    where: {
+      id: capturedByFlowId,
+      siteId,
+      workspaceId: siteId,
+      kind: "listicle",
+      status: "live",
+    },
+    select: { config: true },
+  });
+  const config = listicle ? flowConfigSchema.safeParse(listicle.config) : null;
+  if (!config?.success) {
+    logger.warn(
+      { siteId, listingId },
+      "[project-listings] a captured draft's listicle is not live or its config does not parse; accepting the site's own answers only",
+    );
+    return siteDeclared;
+  }
+  return withListicleQuestions(siteDeclared, listicleSiteAnswerQuestions(config.data));
+}
+
 /**
  * Merge a partial application into a draft and hand back the merged row.
  *
@@ -1158,17 +1208,29 @@ export async function patchProjectListingDraft(
     // DIFFERENT screen can still lose its answers to this one, exactly as it
     // can already lose a column. The store is one row's worth of one
     // founder's own form, not a shared document.
-    select: { siteId: true, siteAnswers: true },
+    //
+    // #7521 D2 — `capturedByFlowId` rides it too: a draft a listicle captured
+    // may answer that listicle's own Application fields.
+    select: { siteId: true, siteAnswers: true, capturedByFlowId: true },
   });
   if (!owner) {
     return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
   }
 
   const listingConfig = await listingConfigFor(owner.siteId);
+  const siteAnswers =
+    owner.capturedByFlowId === null
+      ? listingConfig.siteAnswers
+      : await capturedDraftSiteAnswers(
+          owner.siteId,
+          id,
+          owner.capturedByFlowId,
+          listingConfig.siteAnswers,
+        );
   const parsed = buildProjectListingDraftPatchSchema(
     listingConfig.wordCaps,
     listingConfig.collectedFields,
-    listingConfig.siteAnswers,
+    siteAnswers,
   ).safeParse(body);
   if (!parsed.success) {
     return {
@@ -1825,6 +1887,30 @@ export async function patchListingCopy(
 
 // ─── Public read (anonymous) ────────────────────────────────────────────────
 
+/**
+ * The public order (#5033): the THREE newest by `decidedAt` first, then the
+ * rest by `waitlistCount` desc, then `decidedAt` desc. One function, so the
+ * project read and the directory read (#7521 D3) cannot order differently.
+ */
+function orderPublicListings<T extends { row: { id: string; decidedAt: Date | null }; waitlistCount: number }>(
+  withCounts: readonly T[],
+): T[] {
+  const decidedAtMs = (row: T["row"]): number => row.decidedAt?.getTime() ?? -Infinity;
+
+  const newestFirst = [...withCounts].sort((a, b) => decidedAtMs(b.row) - decidedAtMs(a.row));
+  const top3 = newestFirst.slice(0, 3);
+  const top3Ids = new Set(top3.map((t) => t.row.id));
+
+  const rest = withCounts
+    .filter((t) => !top3Ids.has(t.row.id))
+    .sort((a, b) => {
+      if (b.waitlistCount !== a.waitlistCount) return b.waitlistCount - a.waitlistCount;
+      return decidedAtMs(b.row) - decidedAtMs(a.row);
+    });
+
+  return [...top3, ...rest];
+}
+
 /**
  * The page-render read (#4998 AC4, reshaped by #5033): every `active` row for
  * the site, the THREE newest by `decidedAt` first, then the rest by
@@ -1846,21 +1932,8 @@ export async function publicProjectListings(siteId: string): Promise<ProjectList
   const counts = await attachWaitlistCounts(siteId, rows);
   const withCounts = rows.map((row) => ({ row, waitlistCount: waitlistCountFor(row, counts) }));
 
-  const decidedAtMs = (row: ProjectListingRow): number => row.decidedAt?.getTime() ?? -Infinity;
-
-  const newestFirst = [...withCounts].sort((a, b) => decidedAtMs(b.row) - decidedAtMs(a.row));
-  const top3 = newestFirst.slice(0, 3);
-  const top3Ids = new Set(top3.map((t) => t.row.id));
-
-  const rest = withCounts
-    .filter((t) => !top3Ids.has(t.row.id))
-    .sort((a, b) => {
-      if (b.waitlistCount !== a.waitlistCount) return b.waitlistCount - a.waitlistCount;
-      return decidedAtMs(b.row) - decidedAtMs(a.row);
-    });
-
   const now = new Date();
-  return [...top3, ...rest].map(({ row, waitlistCount }) => {
+  return orderPublicListings(withCounts).map(({ row, waitlistCount }) => {
     // #5407 — `founderPhone` and `emailVerifiedAt` leave here with
     // `founderEmail`. `projectListingPublicSchema` omits all three and
     // `sendValidated` re-parses `.strict()`, so a key that stopped being
@@ -1890,3 +1963,121 @@ export async function publicProjectListings(siteId: string): Promise<ProjectList
     };
   });
 }
+
+// ─── Directory read (anonymous, #7521) ──────────────────────────────────────
+
+/** Only what the directory maps — no contact column is ever read here. */
+const DIRECTORY_LISTING_SELECT = {
+  id: true,
+  slug: true,
+  name: true,
+  headline: true,
+  oneLiner: true,
+  url: true,
+  logoMarkUrl: true,
+  founderCompany: true,
+  founderName: true,
+  siteAnswers: true,
+  featured: true,
+  status: true,
+  decidedAt: true,
+  windowEndsAt: true,
+  experimentKey: true,
+  capturedByFlowId: true,
+} as const satisfies Prisma.ProjectListingSelect;
+
+/**
+ * A landing page's directory (#7521 D3): the entry type of the live listicle
+ * that names `landingPage`, and that page's ACCEPTED entries — every `active`
+ * listing (an elapsed one reads `closed`, as on `/public`) captured by a live
+ * listicle naming it, at most the 200 most recently accepted, in the public
+ * order. `null` when no live listicle of this site names the page, which is
+ * almost every page.
+ *
+ * Each entry carries the generic directory shape, never the project-shaped
+ * row: name, summary, links, and a `profile` built at read time from the
+ * capturing listicle's CURRENT Application fields (`listingProfile`, D4).
+ * Contact columns never leave this function.
+ *
+ * Two live listicles naming one page both contribute entries; the
+ * earlier-created one supplies the entry type.
+ */
+export async function listingDirectoryFor(
+  siteId: string,
+  landingPage: string,
+  locale: string | undefined,
+): Promise<ListingDirectoryResponse> {
+  // fence: siteId and workspaceId both — the value `siteIdForPublicKey`
+  // resolved from the public key, never from the request.
+  const listicles = await prisma.flowDefinition.findMany({
+    where: { siteId, workspaceId: siteId, kind: "listicle", status: "live", landingPage },
+    orderBy: [{ createdAt: "asc" }, { id: "asc" }],
+    select: { id: true, config: true },
+  });
+  if (listicles.length === 0) return null;
+
+  const configs = new Map<string, FlowConfig | null>();
+  for (const listicle of listicles) {
+    const parsed = flowConfigSchema.safeParse(listicle.config);
+    if (!parsed.success) {
+      logger.warn(
+        { siteId, flowId: listicle.id },
+        "[project-listings] a live listicle's config does not parse; its entries publish with no profile",
+      );
+    }
+    configs.set(listicle.id, parsed.success ? parsed.data : null);
+  }
+  const entryType =
+    configs.get(listicles[0]!.id)?.listing?.entryType ?? LISTING_ENTRY_TYPE_DEFAULT;
+
+  const listingConfig = await listingConfigFor(siteId);
+  const rows = await prisma.projectListing.findMany({
+    where: {
+      siteId,
+      workspaceId: siteId,
+      status: "active",
+      capturedByFlowId: { in: listicles.map((l) => l.id) },
+      slug: { not: null },
+    },
+    // NULLS LAST: Postgres sorts NULL first on DESC, so an undecided row
+    // would otherwise take a slot in the window ahead of an accepted one.
+    orderBy: [{ decidedAt: { sort: "desc", nulls: "last" } }, { id: "asc" }],
+    take: LISTING_DIRECTORY_MAX_ENTRIES,
+    select: DIRECTORY_LISTING_SELECT,
+  });
+  const counts = await attachWaitlistCounts(siteId, rows);
+  const withCounts = rows.map((row) => ({ row, waitlistCount: waitlistCountFor(row, counts) }));
+
+  const now = new Date();
+  const entries = orderPublicListings(withCounts).map(
+    ({ row, waitlistCount }): ListingEntryPublic => {
+      const config = row.capturedByFlowId ? configs.get(row.capturedByFlowId) : null;
+      return {
+        id: row.id,
+        slug: row.slug!,
+        name: row.headline ?? row.name ?? row.founderCompany ?? row.founderName,
+        summary: row.oneLiner,
+        url: row.url,
+        logoMarkUrl: row.logoMarkUrl,
+        featured: listingConfig.featuredEnabled && row.featured,
+        status:
+          computeListingStatus(row.status, row.windowEndsAt, now, row.featured) === "closed"
+            ? "closed"
+            : "active",
+        windowEndsAt: row.windowEndsAt ? row.windowEndsAt.toISOString() : null,
+        decidedAt: row.decidedAt ? row.decidedAt.toISOString() : null,
+        waitlistCount,
+        profile: config
+          ? listingProfile(
+              config,
+              siteAnswersFromRow(row.siteAnswers),
+              locale ?? config.defaultLocale,
+              listingConfig.siteAnswers.questions,
+            )
+          : [],
+      };
+    },
+  );
+
+  return { landingPage, entryType, entries };
+}

package/templates/apps/api/src/services/public-site-resolver.ts

@@ -1,31 +1,48 @@
 /**
- * Public-read site resolution — which workspace an UNAUTHENTICATED content
- * read serves (#5852, roadmap D4 read half).
+ * Public-read site resolution — which workspace an UNAUTHENTICATED public
+ * request serves (#5852, roadmap D4 read half; spokes #7532).
  *
- * THE GUARD MODEL IS FAIL-CLOSED. The only branch that yields a workspace is an
- * unambiguously one-workspace deployment, answered by the same predicate the
- * authenticated path uses (`services/default-tenant.ts#resolveDefaultWorkspaceId`)
- * — one predicate, reached two ways, never two predicates. Zero workspaces, two
- * or more, or a sole workspace that is not the seeded default all resolve to
- * `unresolved`, and the caller answers 404 before any content query runs.
+ * THE GUARD MODEL IS FAIL-CLOSED. Two branches yield a workspace, and no
+ * other:
  *
- * IT READS NO HOST. Every deployment this resolver serves today is
- * one-workspace, so a host lookup would be dead code — and there is nothing to
- * look up: `WorkspaceSiteIdentity` carries no host column (the value lives
- * inside the unindexed `data.url`), and `request.hostname` resolves from
- * `X-Forwarded-Host` under this server's `trustProxy: true` (`server.ts`),
- * which is caller-suppliable and therefore not a tenancy input. The
- * multi-tenant host branch is #3635's, and must resolve against a server-side
- * binding rather than a forwarded header.
+ *   1. A REGISTERED SPOKE (#7532, `resolveCallerSite` below). A spoke is a
+ *      separately deployed site calling this hub server-to-server with its
+ *      hub-minted key in ONE header, `x-ailk-spoke-key`. The key is looked up
+ *      by its SHA-256 digest in the hub's registry (`lib/spoke-store.ts`);
+ *      the matching unrevoked row's workspace is the answer. A key that is
+ *      malformed, unknown or revoked resolves to NOTHING — never to the
+ *      alias, never to the default workspace.
+ *   2. An unambiguously one-workspace deployment, answered by the same
+ *      predicate the authenticated path uses
+ *      (`services/default-tenant.ts#resolveDefaultWorkspaceId`) — one
+ *      predicate, reached two ways, never two predicates. Zero workspaces,
+ *      two or more, or a sole workspace that is not the seeded default all
+ *      resolve to `unresolved`, and the caller answers 404 before any content
+ *      query runs. A header-less request takes this branch exactly as it did
+ *      before spokes existed — unless the hub sets
+ *      `AILK_HUB_REQUIRE_SPOKE_KEY`, which refuses it instead.
+ *
+ * IT READS NO HOST. `request.hostname` resolves from `X-Forwarded-Host` under
+ * this server's `trustProxy: true` (`server.ts`), which is caller-suppliable
+ * and therefore not a tenancy input; `Origin` is client-supplied outside a
+ * browser. The one header read here is the spoke key, and a key selects
+ * nothing by itself: only the server-side registry row it digests to does.
  *
  * THE CLIENT NEVER SUPPLIES A WORKSPACE. No path parameter, query string,
- * header or body field is read here, on any read. That is roadmap D4's own
- * STOP boundary, not a default.
+ * header or body field naming a workspace is read here, on any request. That
+ * is roadmap D4's own STOP boundary, not a default.
+ *
+ * NOTHING LOADS FOR A HEADER-LESS REQUEST. With no spoke key and strict mode
+ * off, the spoke branch reads nothing and imports nothing (#7532 NFR1); off
+ * the database adapter the function then returns `not-required` having
+ * issued no query and loaded no database module — which is what keeps the
+ * MDX default path byte-identical and keeps the no-`DATABASE_URL` scaffold
+ * starting. The registry module is imported on first use, and only when a
+ * key arrives and `DATABASE_URL` is set.
  *
- * IT IS A NO-OP OFF THE DATABASE ADAPTER. Unless `CONTENT_ADAPTER=database`,
- * the function returns `not-required` having issued no query and loaded no
- * database module — which is what keeps the MDX default path byte-identical
- * and keeps the no-`DATABASE_URL` scaffold starting.
+ * NO SECRET IS LOGGED. A refusal reaches `request.log.warn` as `{ reason }`
+ * (plus `spokeId` for a matched row) — never the key, its digest or its
+ * prefix — and never reaches the wire.
  */
 import {
   resolvedAdapterKind,
@@ -34,8 +51,97 @@ import {
 } from "@working-theory/content-adapters";
 import type { FastifyRequest } from "fastify";
 
+import { config } from "../config/index.js";
 import { getContentAdapter } from "../lib/content-adapter.js";
 
+/** The one request header a spoke names itself with (#7532 D2). */
+const SPOKE_KEY_HEADER = "x-ailk-spoke-key";
+
+/** The longest key the hub will hash; a minted key is 52 characters. */
+const SPOKE_KEY_MAX_LENGTH = 128;
+
+/**
+ * Visible ASCII only — the class the visitor-forward key already uses
+ * (`packages/api-client` `SAFE_HEADER_TOKEN`; `apps/api` cannot import that
+ * package, so this is its own constant). It also refuses the `"a, b"` string
+ * Node makes of a duplicated header, because of the space.
+ */
+const SAFE_SPOKE_KEY = /^[\x21-\x7e]+$/;
+
+/**
+ * Who is calling a spoke-aware public surface (#7532 D3).
+ *
+ *   anonymous — no spoke key, strict mode off: resolve exactly as before.
+ *   spoke     — a registered, unrevoked spoke; its workspace is the answer.
+ *   refused   — resolve to NOTHING. `reason` is for `request.log` only.
+ */
+export type CallerSite =
+  | { kind: "anonymous" }
+  | { kind: "spoke"; spokeId: string; workspaceId: string }
+  | {
+      kind: "refused";
+      reason:
+        | "key-required"
+        | "key-malformed"
+        | "no-database"
+        | "key-unknown"
+        | "key-revoked";
+    };
+
+function refuse(
+  request: FastifyRequest,
+  reason: Extract<CallerSite, { kind: "refused" }>["reason"],
+  spokeId?: string,
+): CallerSite {
+  request.log.warn(
+    spokeId === undefined ? { reason } : { reason, spokeId },
+    "[spoke] caller refused",
+  );
+  return { kind: "refused", reason };
+}
+
+/**
+ * Resolve the caller of a spoke-aware public surface. Reads ONE header, the
+ * spoke key, and nothing else off the request; see the file header.
+ */
+export async function resolveCallerSite(
+  request: FastifyRequest,
+): Promise<CallerSite> {
+  // Optional chain: a bare `{}` request (the resolver's own suite) is a
+  // header-less request.
+  const raw: unknown = request.headers?.[SPOKE_KEY_HEADER];
+
+  if (raw === undefined) {
+    return config.AILK_HUB_REQUIRE_SPOKE_KEY
+      ? refuse(request, "key-required")
+      : { kind: "anonymous" };
+  }
+
+  // A string[] is refused defensively; Node joins a duplicated custom header
+  // into one "a, b" string, which the visible-ASCII test refuses.
+  const key = typeof raw === "string" ? raw.trim() : "";
+  if (
+    key === "" ||
+    key.length > SPOKE_KEY_MAX_LENGTH ||
+    !SAFE_SPOKE_KEY.test(key)
+  ) {
+    return refuse(request, "key-malformed");
+  }
+
+  if (!process.env.DATABASE_URL) {
+    return refuse(request, "no-database");
+  }
+
+  // Deferred, like `lib/prisma.js` below: a header-less request never loads it.
+  const { findSpokeByKeyHash, hashSpokeKey } = await import(
+    "../lib/spoke-store.js"
+  );
+  const row = await findSpokeByKeyHash(hashSpokeKey(key));
+  if (!row) return refuse(request, "key-unknown");
+  if (row.revokedAt !== null) return refuse(request, "key-revoked", row.id);
+  return { kind: "spoke", spokeId: row.id, workspaceId: row.workspaceId };
+}
+
 /**
  * The three answers a public read can get. `reason` exists for `request.log`
  * only: the route decides its response from `kind` alone, so no resolution
@@ -44,17 +150,29 @@ import { getContentAdapter } from "../lib/content-adapter.js";
 export type PublicSiteResolution =
   | { kind: "not-required" }
   | { kind: "resolved"; workspaceId: string }
-  | { kind: "unresolved"; reason: "ambiguous" | "host-unmatched" };
+  | {
+      kind: "unresolved";
+      reason: "ambiguous" | "host-unmatched" | "spoke-refused";
+    };
 
 /**
- * Resolves the workspace a public content read serves, or refuses to.
+ * Resolves the workspace a public read serves, or refuses to.
  *
- * The `request` argument is the site identifier's eventual source (#3635) and
- * is deliberately unused today — see the no-host note in this file's header.
+ * A spoke resolves to its own workspace on any content adapter; a refused
+ * caller resolves to nothing; an anonymous caller takes the one-workspace
+ * path below, unchanged (#7532 D3).
  */
 export async function resolvePublicWorkspace(
-  _request: FastifyRequest,
+  request: FastifyRequest,
 ): Promise<PublicSiteResolution> {
+  const caller = await resolveCallerSite(request);
+  if (caller.kind === "refused") {
+    return { kind: "unresolved", reason: "spoke-refused" };
+  }
+  if (caller.kind === "spoke") {
+    return { kind: "resolved", workspaceId: caller.workspaceId };
+  }
+
   if (resolvedAdapterKind() !== "database") {
     return { kind: "not-required" };
   }
@@ -90,7 +208,10 @@ export async function resolvePublicContentAdapter(
     );
     return null;
   }
-  if (site.kind === "not-required") {
+  // A spoke on an MDX-adapter hub resolves a workspace (its meeting types are
+  // per-workspace), but MDX content is not: it keeps reading the shared
+  // source rather than being switched to the database one (#7532 D3).
+  if (site.kind === "not-required" || resolvedAdapterKind() !== "database") {
     return getContentAdapter();
   }
 

package/templates/apps/api/src/services/revalidation.ts

@@ -49,7 +49,14 @@ import { z } from "zod";
 import { config } from "../config/index.js";
 import { outboundFetch } from "../lib/outbound-http.js";
 
-const log = createLogger({ service: "revalidation" });
+// The environment is the api's own NODE_ENV, as the observability `logger`
+// singleton reads it. Omitted, createLogger assumes development and asks for a
+// pino-pretty transport a production install does not carry — a throw at load
+// that took the whole api down once content-write was enabled (#7502).
+const log = createLogger({
+  service: "revalidation",
+  environment: config.NODE_ENV,
+});
 
 const SIGNATURE_HEADER = "x-ailk-revalidate-signature";
 const EVENT_HEADER = "x-ailk-revalidate-event";