create-ailk 0.18.0 → 0.19.1

package/templates/apps/api/src/lib/__tests__/stripe-admission.test.ts

@@ -0,0 +1,217 @@
+// oss: false
+/**
+ * apps/api's live-key admission (#8450 D2, D3) over the REAL
+ * `@working-theory/stripe-client` — no mock, so the process-wide flag the
+ * package keeps is the one these cases arm or leave alone.
+ *
+ * Admission is one-way per module registry, so every case loads
+ * `lib/stripe.ts` inside its own `jest.isolateModules` with `process.env`
+ * set before the `require` and restored after.
+ *
+ * Every live-shaped key is composed at runtime from fragments, so this file
+ * never spells a live prefix (architecture.yaml's `(sk|pk|rk)_live_` pattern)
+ * and never names the SDK's admission call.
+ */
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+
+type Shim = typeof import("../stripe");
+
+const RESTRICTED_LIVE = ["rk", "live", ""].join("_");
+const SECRET_LIVE = ["sk", "live", ""].join("_");
+const PUBLISHABLE_LIVE = ["pk", "live", ""].join("_");
+// A distinctive tail: no refusal message may carry any of it.
+const TAIL = "FixtureOnlyQv7Zq9X";
+
+const restrictedLiveKey = RESTRICTED_LIVE + TAIL;
+const secretLiveKey = SECRET_LIVE + TAIL;
+const publishableLiveKey = PUBLISHABLE_LIVE + TAIL;
+const testKey = "sk_test_" + TAIL;
+
+const ENV_KEYS = ["STRIPE_SECRET_KEY", "STRIPE_MODE", "VERCEL_ENV", "VERCEL", "NODE_ENV"] as const;
+type EnvKey = (typeof ENV_KEYS)[number];
+
+/** Load a fresh `lib/stripe.ts` under `env`, run `fn`, then restore the four variables. */
+function withShim(env: Partial<Record<EnvKey, string>>, fn: (shim: Shim) => void): void {
+  const saved = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+  try {
+    for (const k of ENV_KEYS) {
+      if (env[k] === undefined) delete process.env[k];
+      else process.env[k] = env[k];
+    }
+    jest.isolateModules(() => {
+      fn(require("../stripe") as Shim);
+    });
+  } finally {
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+  }
+}
+
+/** The thrown error, asserted to be the shim's `StripeConfigError` and to carry no key material. */
+function refusal(shim: Shim, fn: () => unknown): Error {
+  let caught: unknown;
+  try {
+    fn();
+  } catch (err) {
+    caught = err;
+  }
+  expect(caught).toBeInstanceOf(shim.StripeConfigError);
+  const message = (caught as Error).message;
+  expect(message).not.toContain(TAIL);
+  expect(message).not.toContain(TAIL.slice(-4));
+  return caught as Error;
+}
+
+const LIVE_PRODUCTION = {
+  STRIPE_SECRET_KEY: restrictedLiveKey,
+  STRIPE_MODE: "live",
+  VERCEL_ENV: "production",
+} as const;
+
+describe("admitApiStripeKey — D2's table", () => {
+  it("takes no parameter, so nothing can arm it from a synthetic object", () => {
+    withShim({ STRIPE_SECRET_KEY: testKey }, (shim) => {
+      expect(shim.admitApiStripeKey.length).toBe(0);
+    });
+  });
+
+  it("admits a restricted live key beside STRIPE_MODE=live on a Vercel production build", () => {
+    withShim(LIVE_PRODUCTION, (shim) => {
+      expect(shim.stripeKeyMode()).toBe("test");
+      expect(shim.admitApiStripeKey()).toBe("live");
+      expect(shim.stripeKeyMode()).toBe("live");
+
+      // F2/F3 — the admitted class passes; the other two live classes do not.
+      expect(() => shim.assertAdmittedStripeKey(restrictedLiveKey)).not.toThrow();
+      refusal(shim, () => shim.assertAdmittedStripeKey(secretLiveKey));
+      refusal(shim, () => shim.assertAdmittedStripeKey(publishableLiveKey));
+      // A test key still passes after admission.
+      expect(() => shim.assertAdmittedStripeKey(testKey)).not.toThrow();
+
+      // The client the route then calls accepts the same key.
+      expect(shim.getStripeClient()).toBeDefined();
+    });
+  });
+
+  it("off Vercel, reads NODE_ENV=production as the production build", () => {
+    withShim(
+      { STRIPE_SECRET_KEY: restrictedLiveKey, STRIPE_MODE: "live", NODE_ENV: "production" },
+      (shim) => {
+        expect(shim.admitApiStripeKey()).toBe("live");
+        expect(shim.stripeKeyMode()).toBe("live");
+      },
+    );
+  });
+
+  it.each([
+    ["a Vercel preview build", { VERCEL_ENV: "preview", NODE_ENV: "production" }],
+    ["a non-production build off Vercel", { NODE_ENV: "test" }],
+    // vercel.json sets NODE_ENV=production everywhere, Preview included.
+    ["Vercel with VERCEL_ENV missing, even beside NODE_ENV=production", { VERCEL: "1", NODE_ENV: "production" }],
+  ])("refuses a restricted live key with STRIPE_MODE=live on %s", (_label, build) => {
+    withShim({ STRIPE_SECRET_KEY: restrictedLiveKey, STRIPE_MODE: "live", ...build }, (shim) => {
+      const err = refusal(shim, () => shim.admitApiStripeKey());
+      expect(err.message).toMatch(/production/);
+      expect(shim.stripeKeyMode()).toBe("test");
+      refusal(shim, () => shim.assertAdmittedStripeKey(restrictedLiveKey));
+      refusal(shim, () => shim.getStripeClient());
+    });
+  });
+
+  it.each([
+    ["an unrestricted live key", secretLiveKey],
+    ["a publishable live key", publishableLiveKey],
+    ["a test key", testKey],
+  ])("refuses STRIPE_MODE=live beside %s", (_label, key) => {
+    withShim({ STRIPE_SECRET_KEY: key, STRIPE_MODE: "live", VERCEL_ENV: "production" }, (shim) => {
+      const err = refusal(shim, () => shim.admitApiStripeKey());
+      expect(err.message).toMatch(/STRIPE_MODE=live/);
+      expect(shim.stripeKeyMode()).toBe("test");
+      refusal(shim, () => shim.assertAdmittedStripeKey(restrictedLiveKey));
+    });
+  });
+
+  it.each(["production", "LIVE", ""])("refuses STRIPE_MODE=%j, whatever the key", (mode) => {
+    withShim({ ...LIVE_PRODUCTION, STRIPE_MODE: mode }, (shim) => {
+      const err = refusal(shim, () => shim.admitApiStripeKey());
+      expect(err.message).toMatch(/STRIPE_MODE must be "test" or "live"/);
+      expect(shim.stripeKeyMode()).toBe("test");
+      refusal(shim, () => shim.assertAdmittedStripeKey(restrictedLiveKey));
+      refusal(shim, () => shim.getStripeClient());
+    });
+  });
+
+  it.each([undefined, "test"])("with STRIPE_MODE=%s, runs today's sandbox check on a test key", (mode) => {
+    withShim({ STRIPE_SECRET_KEY: testKey, STRIPE_MODE: mode }, (shim) => {
+      expect(shim.admitApiStripeKey()).toBe("test");
+      expect(shim.stripeKeyMode()).toBe("test");
+      expect(() => shim.assertAdmittedStripeKey(testKey)).not.toThrow();
+    });
+  });
+
+  it.each([undefined, "test"])(
+    "with STRIPE_MODE=%s, refuses a restricted live key with today's sandbox message, even on production",
+    (mode) => {
+      withShim({ ...LIVE_PRODUCTION, STRIPE_MODE: mode }, (shim) => {
+        const err = refusal(shim, () => shim.admitApiStripeKey());
+        expect(err.message).toMatch(/Stripe live mode is blocked — sandbox only/);
+        expect(shim.stripeKeyMode()).toBe("test");
+        refusal(shim, () => shim.assertAdmittedStripeKey(restrictedLiveKey));
+        refusal(shim, () => shim.getStripeClient());
+      });
+    },
+  );
+});
+
+describe("assertAdmittedStripeKey — without admission", () => {
+  it("is today's sandbox allow-list: every live class refused, a test key accepted", () => {
+    withShim({ STRIPE_SECRET_KEY: testKey }, (shim) => {
+      expect(() => shim.assertAdmittedStripeKey(testKey)).not.toThrow();
+      for (const key of [restrictedLiveKey, secretLiveKey, publishableLiveKey]) {
+        const err = refusal(shim, () => shim.assertAdmittedStripeKey(key));
+        expect(err.message).toMatch(/Stripe live mode is blocked — sandbox only/);
+      }
+    });
+  });
+});
+
+describe("admitApiStripeKey — call sites (#8450 § 9 SEC-5)", () => {
+  // The sweep is a MONOREPO invariant: it reads the whole git tree. A
+  // scaffolded site (`create-ailk` verify-scaffold, which copies apps/api into
+  // a site that is not a git repository) has no tree to sweep and cannot grow
+  // a new call site of its own, so the sweep is skipped there (#8479/#8478).
+  const repoRoot = path.resolve(__dirname, "../../../../..");
+  const inGitTree = (() => {
+    try {
+      execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
+        cwd: repoRoot,
+        stdio: "ignore",
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  })();
+  const itInRepo = inGitTree ? it : it.skip;
+
+  itInRepo("is named only by lib/stripe.ts, server.ts and #8450's own tests", () => {
+    const files = execFileSync("git", ["grep", "-l", "admitApiStripeKey", "--", ":!*.md"], {
+      cwd: repoRoot,
+      encoding: "utf8",
+    })
+      .split("\n")
+      .filter(Boolean)
+      .sort();
+    expect(files).toEqual([
+      "apps/api/src/lib/__tests__/stripe-admission.test.ts",
+      "apps/api/src/lib/__tests__/stripe.test.ts",
+      "apps/api/src/lib/stripe.ts",
+      "apps/api/src/routes/checkout/__tests__/live-key.test.ts",
+      "apps/api/src/routes/subscription/__tests__/portal-live-key.test.ts",
+      "apps/api/src/server.ts",
+    ]);
+  });
+});

package/templates/apps/api/src/lib/__tests__/stripe.test.ts

@@ -62,6 +62,13 @@ describe("apps/api/src/lib/stripe — surface re-exports", () => {
     expect(new stripeShim.UnknownProductCodeError()).toBeInstanceOf(Error);
   });
 
+  // #8450 D2, D3 — apps/api's own live-key admission and its request-time guard.
+  it("exports admitApiStripeKey, assertAdmittedStripeKey and stripeKeyMode as functions", () => {
+    expect(typeof stripeShim.admitApiStripeKey).toBe("function");
+    expect(typeof stripeShim.assertAdmittedStripeKey).toBe("function");
+    expect(typeof stripeShim.stripeKeyMode).toBe("function");
+  });
+
   it("shim functions are the same references as @working-theory/stripe-client exports", () => {
     expect(stripeShim.getStripeClient).toBe(stripeClient.getStripeClient);
     expect(stripeShim.assertSandboxKey).toBe(stripeClient.assertSandboxKey);

package/templates/apps/api/src/lib/consent-store.ts

@@ -0,0 +1,335 @@
+/**
+ * The consent ledger's read boundary (#8438, spec
+ * docs/specs/8438-consent-registry-and-ledger-step-spec.md D4).
+ *
+ * `consent_grants` is append-only and a Person's current state is the newest
+ * row per purpose, so every reader here asks the database for exactly that.
+ * Nothing is read through a window: `DISTINCT ON (purpose_id) … ORDER BY
+ * purpose_id, created_at DESC, id DESC` is one indexed pass over ALL the
+ * matching rows, so no number of other rows can push an answer out
+ * (SEC-8438-2).
+ *
+ * TWO READINGS of a Person's rows (SEC-8438-1). A Person is keyed on an email
+ * anyone can type into a form, so a row an anonymous writer attached to it
+ * proves nothing about what the person themself chose:
+ *
+ *   - OWN rows: `person_id = P` and a source only a verified caller or a
+ *     signed link sent to the person can write — `sign_up`,
+ *     `account_settings`, `email_unsubscribe` (`OWN_CONSENT_SOURCES`). The
+ *     member's screens, the sign-up prompt, and every future send read only
+ *     these.
+ *   - ANY-SOURCE rows: every row with `person_id = P`, plus the cookie rows
+ *     of every visitor linked to P. The operator's Person page reads these,
+ *     marked `unverified` when the source proves nothing.
+ *
+ * Every query takes an explicit `workspaceId`, and a join to a linked
+ * visitor's rows matches `workspace_id` on both tables (SEC-8438-11) — a
+ * visitor id is client-chosen and not namespaced, so another tenant's rows
+ * under the same id must never join.
+ *
+ * This file is the ONLY non-test reader of `consent_grants` and
+ * `consent_visitor_links` (`architecture.yaml` names it as a data-access
+ * boundary, the kind `member-store.ts` is). The writes are
+ * `services/consent.ts`. Logs carry nothing: no email, visitor id, token or
+ * statement.
+ */
+import type { Prisma } from "@working-theory/database";
+import {
+  consentPurposeKind,
+  type ConsentPurposeKind,
+  type ConsentSource,
+  type SiteConsentConfig,
+} from "@working-theory/validation";
+
+import { prisma } from "./prisma.js";
+
+/** What every reader needs of a client: raw reads only. */
+export type ConsentReadClient = Pick<Prisma.TransactionClient, "$queryRaw">;
+
+/**
+ * The sources only a verified caller or a signed link can write (D4,
+ * SEC-8438-1). The SQL below names the same three literals; the store's test
+ * asserts the two agree.
+ */
+export const OWN_CONSENT_SOURCES = [
+  "sign_up",
+  "account_settings",
+  "email_unsubscribe",
+] as const satisfies readonly ConsentSource[];
+
+/** The sources whose rows prove nothing the client confirmed themself. */
+const UNVERIFIED_SOURCES: ReadonlySet<ConsentSource> = new Set([
+  "magnet",
+  "api",
+  "cookie_banner",
+  "legacy",
+]);
+
+/** Whether a row from `source` is unconfirmed by the client (D4). */
+export function isUnverifiedSource(source: ConsentSource): boolean {
+  return UNVERIFIED_SOURCES.has(source);
+}
+
+/** A history page's size (D7). */
+export const CONSENT_HISTORY_PAGE_SIZE = 500;
+
+/** The most platform rows one user can have in view (D4). */
+const PLATFORM_ROWS_MAX = 100;
+
+/** The newest ledger row for one purpose, as the readers serve it. */
+export interface ConsentStateRow {
+  id: string;
+  purposeId: string;
+  granted: boolean;
+  at: Date;
+  source: ConsentSource;
+  sourceRef: string | null;
+  policyVersion: number | null;
+}
+
+export interface ConsentHistoryRow extends ConsentStateRow {
+  locale: string;
+  statement: string;
+  subjectType: string;
+}
+
+/** A registry purpose with the newest row read for it and what that means now. */
+export interface PurposeConsentState {
+  purposeId: string;
+  kind: ConsentPurposeKind;
+  row: ConsentStateRow | null;
+  /** Granted now: the row's answer, else on for a preference and off otherwise. */
+  effective: boolean;
+}
+
+/** The effective answer for a purpose given its newest row (D4). */
+export function effectiveConsent(
+  kind: ConsentPurposeKind,
+  row: { granted: boolean } | null,
+): boolean {
+  if (row !== null) return row.granted;
+  return kind === "preference";
+}
+
+/** Fold the newest row per purpose id into the registry's purposes. */
+export function foldRowsIntoPurposes(
+  config: SiteConsentConfig,
+  rows: readonly ConsentStateRow[],
+): PurposeConsentState[] {
+  const byPurpose = new Map(rows.map((row) => [row.purposeId, row]));
+  return config.purposes.map((purpose) => {
+    const kind = consentPurposeKind(purpose);
+    const row = byPurpose.get(purpose.id) ?? null;
+    return {
+      purposeId: purpose.id,
+      kind,
+      row,
+      effective: effectiveConsent(kind, row),
+    };
+  });
+}
+
+/**
+ * The newest OWN row per purpose id for a Person, unfolded (D4): one indexed
+ * `DISTINCT ON` pass over all own rows, never a window.
+ */
+export async function ownConsentRows(
+  workspaceId: string,
+  personId: string,
+  db: ConsentReadClient = prisma,
+): Promise<ConsentStateRow[]> {
+  return db.$queryRaw<ConsentStateRow[]>`
+    SELECT DISTINCT ON (g."purpose_id")
+      g."id", g."purpose_id" AS "purposeId", g."granted", g."created_at" AS "at",
+      g."source", g."source_ref" AS "sourceRef", g."policy_version" AS "policyVersion"
+    FROM "consent_grants" g
+    WHERE g."workspace_id" = ${workspaceId}
+      AND g."person_id" = ${personId}
+      AND g."source" IN ('sign_up', 'account_settings', 'email_unsubscribe')
+    ORDER BY g."purpose_id", g."created_at" DESC, g."id" DESC`;
+}
+
+/**
+ * The newest ANY-SOURCE row per purpose id for a Person: `person_id = P` or a
+ * cookie row of a visitor linked to P, in this workspace on both tables.
+ * Includes purposes the registry no longer declares — the operator still sees
+ * what was recorded.
+ */
+export async function anySourceConsentRows(
+  workspaceId: string,
+  personId: string,
+  db: ConsentReadClient = prisma,
+): Promise<ConsentStateRow[]> {
+  return db.$queryRaw<ConsentStateRow[]>`
+    SELECT DISTINCT ON (g."purpose_id")
+      g."id", g."purpose_id" AS "purposeId", g."granted", g."created_at" AS "at",
+      g."source", g."source_ref" AS "sourceRef", g."policy_version" AS "policyVersion"
+    FROM "consent_grants" g
+    WHERE g."workspace_id" = ${workspaceId}
+      AND (
+        g."person_id" = ${personId}
+        OR (g."subject_type" = 'visitor' AND g."subject_id" IN (
+          SELECT l."visitor_id" FROM "consent_visitor_links" l
+          WHERE l."workspace_id" = ${workspaceId} AND l."person_id" = ${personId}
+        ))
+      )
+    ORDER BY g."purpose_id", g."created_at" DESC, g."id" DESC`;
+}
+
+/**
+ * A Person's OWN reading, per registry purpose (D4). The member's screens and
+ * the sign-up prompt read only this.
+ */
+export async function ownConsentState(
+  workspaceId: string,
+  personId: string,
+  config: SiteConsentConfig,
+  db: ConsentReadClient = prisma,
+): Promise<PurposeConsentState[]> {
+  return foldRowsIntoPurposes(
+    config,
+    await ownConsentRows(workspaceId, personId, db),
+  );
+}
+
+/**
+ * A Person's ANY-SOURCE reading, per registry purpose. The operator's Person
+ * page and the unsubscribe dedupe read it; a row here is never a member's own
+ * answer (D4).
+ */
+export async function anySourceConsentState(
+  workspaceId: string,
+  personId: string,
+  config: SiteConsentConfig,
+  db: ConsentReadClient = prisma,
+): Promise<PurposeConsentState[]> {
+  return foldRowsIntoPurposes(
+    config,
+    await anySourceConsentRows(workspaceId, personId, db),
+  );
+}
+
+/** One page of a Person's any-source history, newest first. */
+export interface ConsentHistoryPage {
+  rows: ConsentHistoryRow[];
+  /** The id of the page's last row when another page follows, else `null`. */
+  nextCursor: string | null;
+}
+
+/**
+ * A Person's any-source history, 500 rows a page, newest first, keyed by
+ * `(created_at, id)`. Every page is complete: nothing is truncated (D7).
+ * Returns `"invalid_cursor"` for a cursor that is not one of this Person's
+ * rows — checked inside the Person's own scope, so a row id of another
+ * Person or workspace reads exactly like an unknown one.
+ */
+export async function personConsentHistory(
+  workspaceId: string,
+  personId: string,
+  cursor: string | undefined,
+  db: ConsentReadClient = prisma,
+): Promise<ConsentHistoryPage | "invalid_cursor"> {
+  if (cursor !== undefined) {
+    const found = await db.$queryRaw<Array<{ id: string }>>`
+      SELECT g."id" FROM "consent_grants" g
+      WHERE g."workspace_id" = ${workspaceId}
+        AND g."id" = ${cursor}
+        AND (
+          g."person_id" = ${personId}
+          OR (g."subject_type" = 'visitor' AND g."subject_id" IN (
+            SELECT l."visitor_id" FROM "consent_visitor_links" l
+            WHERE l."workspace_id" = ${workspaceId} AND l."person_id" = ${personId}
+          ))
+        )
+      LIMIT 1`;
+    if (found.length === 0) return "invalid_cursor";
+  }
+  const cursorId = cursor ?? null;
+  const rows = await db.$queryRaw<ConsentHistoryRow[]>`
+    SELECT g."id", g."purpose_id" AS "purposeId", g."granted", g."created_at" AS "at",
+      g."source", g."source_ref" AS "sourceRef", g."policy_version" AS "policyVersion",
+      g."locale", g."statement", g."subject_type" AS "subjectType"
+    FROM "consent_grants" g
+    WHERE g."workspace_id" = ${workspaceId}
+      AND (
+        g."person_id" = ${personId}
+        OR (g."subject_type" = 'visitor' AND g."subject_id" IN (
+          SELECT l."visitor_id" FROM "consent_visitor_links" l
+          WHERE l."workspace_id" = ${workspaceId} AND l."person_id" = ${personId}
+        ))
+      )
+      AND (${cursorId}::text IS NULL OR (g."created_at", g."id") < (
+        SELECT c."created_at", c."id" FROM "consent_grants" c WHERE c."id" = ${cursorId}::text
+      ))
+    ORDER BY g."created_at" DESC, g."id" DESC
+    LIMIT ${CONSENT_HISTORY_PAGE_SIZE + 1}`;
+  const page = rows.slice(0, CONSENT_HISTORY_PAGE_SIZE);
+  const last = page[page.length - 1];
+  return {
+    rows: page,
+    nextCursor:
+      rows.length > CONSENT_HISTORY_PAGE_SIZE && last ? last.id : null,
+  };
+}
+
+/**
+ * The newest row recording a visitor's choice for one purpose — the cookie
+ * writer's dedupe: each CHANGE of choice is logged, a replay adds nothing
+ * (D3, SEC-8438-2).
+ */
+export async function latestVisitorChoice(
+  workspaceId: string,
+  visitorId: string,
+  purposeId: string,
+  db: ConsentReadClient = prisma,
+): Promise<{ granted: boolean; policyVersion: number | null } | null> {
+  const rows = await db.$queryRaw<
+    Array<{ granted: boolean; policyVersion: number | null }>
+  >`
+    SELECT g."granted", g."policy_version" AS "policyVersion"
+    FROM "consent_grants" g
+    WHERE g."workspace_id" = ${workspaceId}
+      AND g."subject_type" = 'visitor'
+      AND g."subject_id" = ${visitorId}
+      AND g."purpose_id" = ${purposeId}
+    ORDER BY g."created_at" DESC, g."id" DESC
+    LIMIT 1`;
+  return rows[0] ?? null;
+}
+
+/**
+ * When the caller's own `User` row was created — the sign-up window's only
+ * input (SEC-8438-5: `via: "sign_up"` is honored for a user created within
+ * the last 24 hours). `null` when no such user exists.
+ */
+export async function userCreatedAt(
+  userId: string,
+  db: Pick<Prisma.TransactionClient, "user"> = prisma,
+): Promise<Date | null> {
+  const user = await db.user.findUnique({
+    where: { id: userId },
+    select: { createdAt: true },
+  });
+  return user?.createdAt ?? null;
+}
+
+/**
+ * The owner's rows for the Working Theory platform purposes (C8): subject
+ * `user` / `userId`, newest per purpose, at most 100.
+ */
+export async function userPlatformRows(
+  workspaceId: string,
+  userId: string,
+  db: ConsentReadClient = prisma,
+): Promise<ConsentStateRow[]> {
+  return db.$queryRaw<ConsentStateRow[]>`
+    SELECT DISTINCT ON (g."purpose_id")
+      g."id", g."purpose_id" AS "purposeId", g."granted", g."created_at" AS "at",
+      g."source", g."source_ref" AS "sourceRef", g."policy_version" AS "policyVersion"
+    FROM "consent_grants" g
+    WHERE g."workspace_id" = ${workspaceId}
+      AND g."subject_type" = 'user'
+      AND g."subject_id" = ${userId}
+    ORDER BY g."purpose_id", g."created_at" DESC, g."id" DESC
+    LIMIT ${PLATFORM_ROWS_MAX}`;
+}

package/templates/apps/api/src/lib/deliverable-asset-store.ts

@@ -24,8 +24,8 @@
  *     workspace's bytes.
  *
  * Neither ever resolves a client file (SEC-7877-A, #7877): an asset tagged
- * `private`, or one a member-area message attaches, is the same `null` a
- * miss is — so a magnet pointed at a client file's key mints nothing and a
+ * `private`, one a member-area message attaches, or one a delivered piece
+ * version names (#8171 D3), is the same `null` a miss is — so a magnet pointed at a client file's key mints nothing and a
  * grant minted before the file became one serves nothing.
  *
  * No write, no `findMany`, no list, no unscoped read — both functions take
@@ -36,14 +36,15 @@ import { PRIVATE_ASSET_TAG } from "@working-theory/validation";
 
 import { prisma } from "./prisma.js";
 
-/** A client file (SEC-7877-A) — `private`-tagged, or attached to a message. */
+/** A client file (SEC-7877-A) — `private`-tagged, attached to a message, or a version's file (#8171 D3). */
 async function isClientFile(
   assetId: string,
   workspaceId: string,
   tags: string[],
 ): Promise<boolean> {
   if (tags.includes(PRIVATE_ASSET_TAG)) return true;
-  return (await prisma.interaction.count({ where: { assetId, workspaceId } })) > 0;
+  if ((await prisma.interaction.count({ where: { assetId, workspaceId } })) > 0) return true;
+  return (await prisma.pieceVersion.count({ where: { assetId, workspaceId } })) > 0;
 }
 
 /** What the mint-time resolution needs, and nothing more. */