create-ailk 0.11.5 → 0.12.1

package/templates/apps/api/src/routes/project-listings/__tests__/site-answers.test.ts

@@ -64,6 +64,7 @@ import {
 import { prisma } from "../../../lib/prisma.js";
 import { listProjectListings } from "../../../services/project-listings.js";
 import { patchProjectListingDraftRoute } from "../patch-draft.js";
+import { projectListingDirectoryRoute } from "../index.js";
 import { publicProjectListingsRoute } from "../public.js";
 import { startProjectListingRoute } from "../start.js";
 import { submitProjectListingRoute } from "../submit.js";
@@ -816,3 +817,206 @@ describe("#6335 — start fails closed when the site names no workspace", () =>
     expect(rows).toHaveLength(0);
   });
 });
+
+// ─── #7521 — a listicle's own Application fields ────────────────────────────
+//
+// A draft a LIVE listicle captured (#6314's `capturedByFlowId`) may answer
+// that listicle's eligible Application fields — `text`/`textarea`/`url`/
+// `select` with no `mapsTo` — with the same per-control checks the site's own
+// questions get. The accepted entry's directory profile publishes them, minus
+// the owner's `privateFields` and any id the site itself declares.
+describe("a captured draft answers its listicle's Application fields (#7521 AC-2)", () => {
+  setupLeadFileEnv("project-listing-listicle-answers");
+  let app: FastifyInstance;
+  let flows: Row[];
+
+  const en = (value: string) => ({ en: value });
+  function listicle(overrides: Row = {}, listing?: Record<string, unknown>): Row {
+    return {
+      id: "flow_partners",
+      siteId: SITE_ID,
+      workspaceId: SITE_ID,
+      slug: "partners-apply",
+      kind: "listicle",
+      status: "live",
+      landingPage: "/partners",
+      createdAt: new Date("2026-09-01T00:00:00.000Z"),
+      config: {
+        slug: "partners-apply",
+        defaultLocale: "en",
+        steps: [
+          {
+            key: "application",
+            type: "field",
+            copy: { title: en("Apply") },
+            fields: [
+              { name: "full_name", inputType: "text", mapsTo: "name", copy: { label: en("Name") } },
+              { name: "email", inputType: "email", mapsTo: "email", copy: { label: en("Email") } },
+              { name: "phone", inputType: "tel", mapsTo: "phone", copy: { label: en("Phone") } },
+              { name: "website", inputType: "url", copy: { label: en("Website") } },
+              {
+                name: "stage",
+                inputType: "select",
+                options: [
+                  { value: "idea", label: en("Idea") },
+                  { value: "live", label: en("Live") },
+                ],
+                copy: { label: en("Stage") },
+              },
+              { name: "about", inputType: "textarea", copy: { label: en("About") } },
+            ],
+          },
+        ],
+        ...(listing !== undefined && { listing }),
+      },
+      ...overrides,
+    };
+  }
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    flows = [listicle()];
+    (prisma.flowDefinition.findFirst as jest.Mock).mockImplementation(
+      ({ where }: { where: Record<string, unknown> }) =>
+        Promise.resolve(flows.find((f) => matches(f, where)) ?? null),
+    );
+    (prisma.flowDefinition.findMany as jest.Mock).mockImplementation(
+      ({ where }: { where: Record<string, unknown> }) =>
+        Promise.resolve(flows.filter((f) => matches(f, where))),
+    );
+    (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(0);
+    app = Fastify();
+    await app.register(startProjectListingRoute);
+    await app.register(patchProjectListingDraftRoute);
+    await app.register(publicProjectListingsRoute);
+    await app.register(projectListingDirectoryRoute);
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  async function startCaptured(): Promise<{ id: string; resumeToken: string }> {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: { ...START_PAYLOAD, capturedByFlowSlug: "partners-apply" },
+    });
+    expect(res.statusCode).toBe(201);
+    expect(rows[0]!["capturedByFlowId"]).toBe("flow_partners");
+    return (res.json() as { data: { id: string; resumeToken: string } }).data;
+  }
+
+  /** Accept the one row, so it reaches the directory. */
+  function accept(): void {
+    Object.assign(rows[0]!, {
+      slug: "acme",
+      name: "Acme",
+      status: "active",
+      decidedAt: new Date(),
+      windowEndsAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
+    });
+  }
+
+  async function profile(): Promise<Array<Record<string, string>>> {
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/project-listings/directory?siteKey=${SITE_KEY}&landingPage=/partners`,
+    });
+    expect(res.statusCode).toBe(200);
+    const data = (res.json() as { data: { entries: Array<{ profile: Array<Record<string, string>> }> } }).data;
+    return data.entries[0]!.profile;
+  }
+
+  it("saves answers to the listicle's eligible fields on a captured draft", async () => {
+    const draft = await startCaptured();
+
+    const res = await patch(app, draft, { siteAnswers: { website: "https://x.test", stage: "live" } });
+
+    expect(res.statusCode).toBe(200);
+    expect(rows[0]!["siteAnswers"]).toEqual({ website: "https://x.test", stage: "live" });
+  });
+
+  it("refuses a contact field and a non-http link, writing nothing", async () => {
+    const draft = await startCaptured();
+
+    const email = await patch(app, draft, { siteAnswers: { email: "a@b.test" } });
+    const script = await patch(app, draft, { siteAnswers: { website: "javascript:alert(1)" } });
+
+    expect(email.statusCode).toBe(400);
+    expect(script.statusCode).toBe(400);
+    expect(rows[0]!["siteAnswers"]).toBeNull();
+  });
+
+  it("refuses the same answers on an uncaptured draft", async () => {
+    const draft = await startDraft(app);
+
+    const res = await patch(app, draft, { siteAnswers: { website: "https://x.test" } });
+
+    expect(res.statusCode).toBe(400);
+    expect(rows[0]!["siteAnswers"]).toBeNull();
+  });
+
+  it("refuses answers on a draft a DRAFT-status listicle captured", async () => {
+    const draft = await startCaptured();
+    flows[0]!["status"] = "draft";
+
+    const res = await patch(app, draft, { siteAnswers: { website: "https://x.test" } });
+
+    expect(res.statusCode).toBe(400);
+    expect(rows[0]!["siteAnswers"]).toBeNull();
+  });
+
+  it("refuses a 501-character url answer", async () => {
+    const draft = await startCaptured();
+
+    const res = await patch(app, draft, {
+      siteAnswers: { website: `https://x.test/${"a".repeat(486)}` },
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect(rows[0]!["siteAnswers"]).toBeNull();
+  });
+
+  it("a site-declared operator-only `about` keeps its visibility: off /public and off the profile", async () => {
+    configData = {
+      siteAnswers: { questions: [{ id: "about", control: "textarea", visibility: "operator-only" }] },
+    };
+    const draft = await startCaptured();
+
+    const res = await patch(app, draft, {
+      siteAnswers: { website: "https://x.test", about: "for the operator" },
+    });
+    expect(res.statusCode).toBe(200);
+    accept();
+
+    expect((await profile()).map((row) => row["name"])).toEqual(["website"]);
+    const publicRead = await app.inject({
+      method: "GET",
+      url: `/v1/project-listings/public?siteKey=${SITE_KEY}`,
+    });
+    expect(publicRead.body).not.toContain("for the operator");
+  });
+
+  it("listing.privateFields keeps `stage` off the profile while the answer stays stored", async () => {
+    flows = [listicle({}, { privateFields: ["stage"] })];
+    const draft = await startCaptured();
+    await patch(app, draft, { siteAnswers: { website: "https://x.test", stage: "live" } });
+    accept();
+
+    expect((await profile()).map((row) => row["name"])).toEqual(["website"]);
+    expect(rows[0]!["siteAnswers"]).toEqual({ website: "https://x.test", stage: "live" });
+  });
+
+  it("a `javascript:` value stored while the field was `text` comes back as kind text", async () => {
+    await startCaptured();
+    accept();
+    rows[0]!["siteAnswers"] = { website: "javascript:x" };
+
+    expect(await profile()).toEqual([
+      { name: "website", label: "Website", value: "javascript:x", kind: "text" },
+    ]);
+  });
+});

package/templates/apps/api/src/routes/project-listings/index.ts

@@ -9,6 +9,7 @@
  *   POST  /v1/project-listings/drafts/:id/verify-email — anonymous, token- AND
  *                                                     nonce-gated (#5407)
  *   GET   /v1/project-listings/public               — anonymous page-render read (leadsScope)
+ *   GET   /v1/project-listings/directory            — anonymous landing-page directory (own scope, #7521)
  *   GET   /v1/project-listings/me                   — the founder's OWN listings (authScope)
  *   GET   /v1/project-listings                      — tenant-scoped dashboard list
  *   GET   /v1/project-listings/:id                  — tenant-scoped single read
@@ -33,7 +34,10 @@
  * own identity-blind posture (an applying founder has no account, and the
  * resume token is a per-draft capability rather than an identity); the
  * tenant-scoped set is an identity-bound dashboard surface, the same #3591
- * exception the sibling `/v1/waitlist-experiments/*` routes record.
+ * exception the sibling `/v1/waitlist-experiments/*` routes record. The
+ * directory read (#7521) takes the same no-twin posture as `/public`: agents
+ * read a directory from its page's JSON-LD, and a `list_directory` tool is a
+ * follow-up.
  */
 import type { FastifyPluginAsync } from "fastify";
 
@@ -41,7 +45,10 @@ import { loadSlice } from "../../lib/slice-load.js";
 
 import { projectListingMeRoute as meRoute } from "./me.js";
 import { patchProjectListingDraftRoute } from "./patch-draft.js";
-import { publicProjectListingsRoute } from "./public.js";
+import {
+  projectListingDirectoryRoute as directoryRoute,
+  publicProjectListingsRoute,
+} from "./public.js";
 import { startProjectListingRoute } from "./start.js";
 import { submitProjectListingRoute } from "./submit.js";
 import { verifyProjectListingDraftEmailRoute } from "./verify-email.js";
@@ -50,6 +57,11 @@ export const projectListingStartRoute = startProjectListingRoute;
 export const projectListingDraftPatchRoute = patchProjectListingDraftRoute;
 export const projectListingSubmitRoute = submitProjectListingRoute;
 export const projectListingPublicRoute = publicProjectListingsRoute;
+/**
+ * The landing-page directory read (#7521). Static, like `/public`; `server.ts`
+ * registers it in its own rate-limited scope, not `leadsScope`.
+ */
+export const projectListingDirectoryRoute = directoryRoute;
 /**
  * The resume link's verification write (#5407). Static, not a slice: it is
  * part of the free anonymous surface, exactly like the three routes above.

package/templates/apps/api/src/routes/project-listings/public.ts

@@ -15,8 +15,20 @@
  * `SiteListingConfig` enables it. `founderEmail` never leaves this route —
  * `projectListingPublicSchema` (`.omit({founderEmail})`) is what the response
  * is re-parsed against before send.
+ *
+ * GET /v1/project-listings/directory?siteKey=&landingPage=&locale= (#7521 D3)
+ *
+ * The generic directory read beside it: the live listicle naming
+ * `landingPage`, its schema.org entry type and its accepted entries, each
+ * with a public profile of the listicle's own Application answers — or
+ * `data: null` when no live listicle names the page, which is almost every
+ * page (a 404 per page view would be noise). Its own plugin, so `server.ts`
+ * registers it in its own rate-limited scope rather than `leadsScope`: the
+ * web server renders it from one egress address (SEC-7521-D1).
  */
 import {
+  listingDirectoryQuerySchema,
+  listingDirectoryResponseSchema,
   projectListingPublicListResponseSchema,
   publicSiteKeySchema,
 } from "@working-theory/validation";
@@ -24,7 +36,10 @@ import type { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
 
 import { siteIdForPublicKey } from "../../services/listing-config.js";
-import { publicProjectListings } from "../../services/project-listings.js";
+import {
+  listingDirectoryFor,
+  publicProjectListings,
+} from "../../services/project-listings.js";
 
 import { sendValidated } from "./respond.js";
 
@@ -55,3 +70,29 @@ export const publicProjectListingsRoute: FastifyPluginAsync = async (fastify) =>
     return sendValidated(reply, projectListingPublicListResponseSchema, data, "public");
   });
 };
+
+export const projectListingDirectoryRoute: FastifyPluginAsync = async (fastify) => {
+  fastify.get("/v1/project-listings/directory", async (request, reply) => {
+    const parsedQuery = listingDirectoryQuerySchema.safeParse(request.query);
+    if (!parsedQuery.success) {
+      return reply.status(400).send({
+        ok: false,
+        error: { code: "validation_failed", message: "Invalid directory query" },
+      });
+    }
+
+    // The same one-key resolution `/public` makes: a `SiteListingConfig` row
+    // under multi-tenant, the env key under single-tenant (#5048 D2).
+    const { siteKey, landingPage, locale } = parsedQuery.data;
+    const siteId = await siteIdForPublicKey(siteKey);
+    if (siteId === null) {
+      return reply.status(400).send({
+        ok: false,
+        error: { code: "unknown_site_key", message: "Unknown site key" },
+      });
+    }
+
+    const data = await listingDirectoryFor(siteId, landingPage, locale);
+    return sendValidated(reply, listingDirectoryResponseSchema, data, "directory");
+  });
+};

package/templates/apps/api/src/routes/project-listings/submit.ts

@@ -119,6 +119,9 @@ export const submitProjectListingRoute: FastifyPluginAsync = async (fastify) =>
       product: result.listing.product,
       founderName: result.listing.founderName,
       founderCompany: result.listing.founderCompany,
+      // #7522 D5 — the actions block names the listing's workspace; `siteId`
+      // IS the workspace id (the `project_listings_workspace_site_agree` CHECK).
+      workspaceId: result.listing.siteId,
     });
 
     const body = projectListingSubmitResponseSchema.parse({ id: result.id, slug: result.slug });

package/templates/apps/api/src/routes/webhooks/index.ts

@@ -11,6 +11,13 @@
  *                               reached through an indirect dynamic import
  *                               so a keyless scaffold never resolves
  *                               `calcom.ts`, which it does not have.
+ *   POST /v1/webhooks/calcom/:connectionToken — the same receiver for ONE
+ *                               workspace's own scheduling connection
+ *                               (#7533 D6): the token names the connection,
+ *                               whose own secret verifies the delivery and
+ *                               whose workspace receives the Appointment.
+ *                               Same module gate, same `loadSlice` call,
+ *                               its own rate-limit bucket.
  *
  * Rate limit: each receiver carries its OWN 100 req/min/IP bucket, from the
  * ONE plugin-level `rateLimit` registration below (a second plugin-level
@@ -66,6 +73,10 @@ export const webhooksRoutes: FastifyPluginAsync = async (fastify) => {
   if (isModuleEnabled("scheduling")) {
     const mod = (await loadSlice(CALCOM_HANDLER, () => import(CALCOM_HANDLER))) as {
       calcomWebhookHandler?: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+      calcomConnectionWebhookHandler?: (
+        request: FastifyRequest,
+        reply: FastifyReply,
+      ) => Promise<void>;
     };
     const handler = mod.calcomWebhookHandler;
     if (!handler) {
@@ -73,6 +84,12 @@ export const webhooksRoutes: FastifyPluginAsync = async (fastify) => {
         `AILK slice drift: '${CALCOM_HANDLER}' does not export 'calcomWebhookHandler'`,
       );
     }
+    const connectionHandler = mod.calcomConnectionWebhookHandler;
+    if (!connectionHandler) {
+      throw new Error(
+        `AILK slice drift: '${CALCOM_HANDLER}' does not export 'calcomConnectionWebhookHandler'`,
+      );
+    }
     fastify.post(
       "/v1/webhooks/calcom",
       {
@@ -85,5 +102,17 @@ export const webhooksRoutes: FastifyPluginAsync = async (fastify) => {
       },
       handler,
     );
+    fastify.post(
+      "/v1/webhooks/calcom/:connectionToken",
+      {
+        config: {
+          rateLimit: {
+            max: CALCOM_WEBHOOK_RATE_LIMIT_PER_MIN,
+            timeWindow: "1 minute",
+          },
+        },
+      },
+      connectionHandler,
+    );
   }
 };

package/templates/apps/api/src/server.ts

@@ -212,6 +212,10 @@ const WORKSPACES_MEMBERS = "./routes/workspaces/members.js";
 // scope as WORKSPACES_GENERAL/WORKSPACES_MEMBERS below, not the
 // multi-tenant-only family WORKSPACES_MEETINGS/WORKSPACES_CONFIG sit in.
 const WORKSPACES_MESSAGES = "./routes/workspaces/messages.js";
+// #7535 — the Inbox submissions and subscribers reads, siblings of
+// WORKSPACES_MESSAGES in the same workspace/multi-tenant scope.
+const WORKSPACES_SUBMISSIONS = "./routes/workspaces/submissions.js";
+const WORKSPACES_SUBSCRIBERS = "./routes/workspaces/subscribers.js";
 // #6183 S9b — a SEPARATE specifier from WORKSPACES_CONFIG: this route is
 // registered under isModuleEnabled("scheduling") alone, never the
 // workspace/multi-tenant scope config.js shares with general.js/members.js
@@ -274,6 +278,15 @@ const SLICE_PLUGINS = {
     specifier: WORKSPACES_MESSAGES,
     load: () => import(WORKSPACES_MESSAGES),
   },
+  // #7535 — the Inbox submissions and subscribers reads, the SAME scope.
+  workspaceSubmissionRoutes: {
+    specifier: WORKSPACES_SUBMISSIONS,
+    load: () => import(WORKSPACES_SUBMISSIONS),
+  },
+  workspaceSubscriberRoutes: {
+    specifier: WORKSPACES_SUBSCRIBERS,
+    load: () => import(WORKSPACES_SUBSCRIBERS),
+  },
   // #6183 S9b — registered in the scheduling scope, not the
   // workspace/multi-tenant scope its siblings above share.
   workspaceMeetingsRoutes: {
@@ -374,6 +387,11 @@ const SLICE_PLUGINS = {
     specifier: PROJECT_LISTINGS_INDEX,
     load: () => import(PROJECT_LISTINGS_INDEX),
   },
+  // #7521 — the landing-page directory read; its own rate-limited scope below.
+  projectListingDirectoryRoute: {
+    specifier: PROJECT_LISTINGS_INDEX,
+    load: () => import(PROJECT_LISTINGS_INDEX),
+  },
   projectListingMeRoute: {
     specifier: PROJECT_LISTINGS_INDEX,
     load: () => import(PROJECT_LISTINGS_INDEX),
@@ -987,6 +1005,15 @@ export async function build() {
         await tenantScope.register(
           await sliceRoutePlugin("workspaceMessageRoutes"),
         );
+        // The Inbox submissions and subscribers reads (#7535) — the SAME
+        // scope and guard: every flow completion and waitlist signup (list,
+        // item read, handled stamp), and the read-only newsletter signups.
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceSubmissionRoutes"),
+        );
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceSubscriberRoutes"),
+        );
         // The asset store's MANAGE routes — list, PATCH, DELETE (#6093 D16).
         // Registered HERE, in the plain tenant scope, and NOT inside the
         // upload's own nested strict-rate-limit scope below: a JSON
@@ -1279,6 +1306,27 @@ export async function build() {
     }
   });
 
+  // The listicle directory read (#7521 D3) — anonymous, keyed by the public
+  // site key, and rendered by the web server on every page view of a landing
+  // page. Its OWN scope, NOT `leadsScope`: that scope's 10/min per IP would be
+  // spent by the web server's SSR reads from one egress address, and the
+  // directory would vanish past ~10 views a minute (SEC-7521-D1). 120/min,
+  // overridable by AILK_RATE_LIMIT_DIRECTORY_PER_MINUTE (#7394's named-scope
+  // rule); the web side memoises each landing page for 30 s per process.
+  // Module-conditional (signal-collectors, D-48), so a build without the
+  // module has no `/directory` and the web extension's read gets a 404.
+  await server.register(async (directoryScope) => {
+    directoryScope.register(rateLimitMiddleware, {
+      perIpPerMinute: 120,
+      scope: "directory",
+    });
+    if (isModuleEnabled("signal-collectors")) {
+      await directoryScope.register(
+        await sliceRoutePlugin("projectListingDirectoryRoute"),
+      );
+    }
+  });
+
   // Flows routes — anonymous surface; rate-limit middleware scoped to this
   // sub-router, matching the leads scope above (#3956 D4 Clarifications:
   // "follows whatever the existing anonymous /v1/leads/* routes do today").

package/templates/apps/api/src/services/__tests__/default-tenant.test.ts

@@ -0,0 +1,147 @@
+/**
+ * @file default-tenant.test.ts
+ *
+ * The one pin-match predicate both tenant guards share (#7523,
+ * docs/specs/7523-a-multi-tenant-session-with-spec.md D2): `isPinnedOperator`
+ * is true only when `AILK_OPERATOR_EMAIL` is set (trimmed, lowercased, a blank
+ * pin counting as unset) AND the caller's VERIFIED `User.email` equals it.
+ * `resolveDefaultTenantForOperator` delegates to it, so for every input the
+ * predicate refuses, the base-build entry point returns `null` before
+ * `resolveDefaultTenant` runs a single deployment or Membership read (AC-4).
+ *
+ * Mocks the module-level `prisma` singleton via the repo's manual-mock
+ * convention (`apps/api/src/lib/__mocks__/prisma.ts`).
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../lib/prisma.js");
+
+import type { Id } from "@working-theory/ids";
+
+import { prisma } from "../../lib/prisma.js";
+import {
+  isPinnedOperator,
+  resolveDefaultTenantForOperator,
+} from "../default-tenant";
+
+const DEFAULT_ORG_ID = "org_00000000-0000-7000-8000-000000000001";
+const DEFAULT_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
+
+const CALLER = "user_00000000-0000-7000-8000-0000000000c1" as Id<"user">;
+
+const ORIGINAL_ENV = process.env;
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  process.env = { ...ORIGINAL_ENV };
+  delete process.env.AILK_OPERATOR_EMAIL;
+});
+
+afterAll(() => {
+  process.env = ORIGINAL_ENV;
+});
+
+function mockUser(row: { email: string; emailVerified: boolean } | null): void {
+  (prisma.user.findUnique as jest.Mock).mockResolvedValue(
+    row === null ? null : { id: CALLER, ...row },
+  );
+}
+
+/**
+ * Every input `isPinnedOperator` refuses. `reads` is whether the refusal needs
+ * the caller's `User` row — an unset or blank pin is refused before any read.
+ */
+const REFUSALS: Array<{
+  label: string;
+  pin: string | undefined;
+  user: { email: string; emailVerified: boolean } | null;
+  reads: boolean;
+}> = [
+  {
+    label: "the pin is unset",
+    pin: undefined,
+    user: { email: "op@x.io", emailVerified: true },
+    reads: false,
+  },
+  {
+    label: "the pin is blank",
+    pin: "   ",
+    user: { email: "", emailVerified: true },
+    reads: false,
+  },
+  { label: "the caller has no User row", pin: "op@x.io", user: null, reads: true },
+  {
+    label: "the caller's address is the pin but unverified",
+    pin: "op@x.io",
+    user: { email: "op@x.io", emailVerified: false },
+    reads: true,
+  },
+  {
+    label: "the caller's verified address differs from the pin",
+    pin: "op@x.io",
+    user: { email: "attacker@evil.com", emailVerified: true },
+    reads: true,
+  },
+];
+
+describe("isPinnedOperator (#7523 D2)", () => {
+  for (const { label, pin, user, reads } of REFUSALS) {
+    it(`false when ${label}`, async () => {
+      if (pin !== undefined) process.env.AILK_OPERATOR_EMAIL = pin;
+      mockUser(user);
+
+      await expect(isPinnedOperator(CALLER)).resolves.toBe(false);
+      expect(prisma.user.findUnique).toHaveBeenCalledTimes(reads ? 1 : 0);
+    });
+  }
+
+  it("true when the caller's VERIFIED address equals the pin, case and surrounding whitespace normalised on both sides", async () => {
+    process.env.AILK_OPERATOR_EMAIL = "  Op@X.io  ";
+    mockUser({ email: " OP@x.IO ", emailVerified: true });
+
+    await expect(isPinnedOperator(CALLER)).resolves.toBe(true);
+    // The read is `findVerifiedEmail`'s — it names `emailVerified` beside
+    // `email`, so the match is against a proven address.
+    expect(prisma.user.findUnique).toHaveBeenCalledWith({
+      where: { id: CALLER },
+      select: { id: true, email: true, emailVerified: true },
+    });
+  });
+});
+
+describe("resolveDefaultTenantForOperator delegates to isPinnedOperator (#7523 AC-4)", () => {
+  for (const { label, pin, user } of REFUSALS) {
+    it(`null when ${label}, with no deployment read, no Membership read and no write`, async () => {
+      if (pin !== undefined) process.env.AILK_OPERATOR_EMAIL = pin;
+      mockUser(user);
+
+      await expect(resolveDefaultTenantForOperator(CALLER)).resolves.toBeNull();
+      expect(prisma.workspace.count).not.toHaveBeenCalled();
+      expect(prisma.workspace.findUnique).not.toHaveBeenCalled();
+      expect(prisma.membership.findUnique).not.toHaveBeenCalled();
+      expect(prisma.membership.create).not.toHaveBeenCalled();
+    });
+  }
+
+  it("the pinned, verified operator reaches resolveDefaultTenant and resolves the default tenant as before", async () => {
+    process.env.AILK_OPERATOR_EMAIL = "op@x.io";
+    mockUser({ email: "op@x.io", emailVerified: true });
+    (prisma.workspace.count as jest.Mock).mockResolvedValue(1);
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
+      id: DEFAULT_WORKSPACE_ID,
+      organizationId: DEFAULT_ORG_ID,
+    });
+    (prisma.membership.create as jest.Mock).mockResolvedValue({});
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
+      role: "owner",
+    });
+
+    await expect(resolveDefaultTenantForOperator(CALLER)).resolves.toEqual({
+      userId: CALLER,
+      organizationId: DEFAULT_ORG_ID,
+      workspaceId: DEFAULT_WORKSPACE_ID,
+      role: "owner",
+    });
+    expect(prisma.membership.findUnique).toHaveBeenCalledTimes(1);
+  });
+});