create-ailk 0.19.1 → 0.20.0

package/templates/apps/api/src/routes/webhooks/stripe.ts

@@ -39,6 +39,12 @@
  *   `outcome: "foreign_site"` and answers 200. An unstamped session is the
  *   hub's own (roadmap D4) and is handled as before. The hub stamps its own
  *   sessions through `siteStamp()`. See README.md § Site filter (#7868).
+ *   Since #8024 one gate before the switch does the same for every
+ *   `customer.*`, `customer.subscription.*` and `invoice.*` event, reading the
+ *   stamp from the Customer's or Subscription's own metadata — for an invoice,
+ *   its own metadata and then the subscription snapshot under
+ *   `parent.subscription_details` or (pre-`basil`) `subscription_details` —
+ *   and only when `data.object.object` is the family's own type.
  *
  * Billing upsert (customer.created / checkout.session.completed):
  *   Billing-entity routing (org-scoped billing, #3601, spec D2): a checkout
@@ -70,6 +76,20 @@
  *   `"no_payment_required"` (a 100%-off promo code, #4862) — anything else
  *   logs `outcome: "unpaid"` and leaves the row `created`.
  *
+ * Proposal paid stamp (checkout.session.completed, #8516 D13):
+ *   A session carrying the server-written `metadata.ailk_proposal` and
+ *   `ailk_workspace` (the client's proposal Checkout,
+ *   `services/proposal-payments.ts`) stamps that proposal's `paid_at` and
+ *   `paid_session_id` once, through the base-tree boundary
+ *   `lib/proposal-paid-store.ts` (this file names no `piece` delegate), and
+ *   writes one `people.proposal.paid` audit row as the Stripe system actor
+ *   keyed by the event id: `succeeded` when stamped, `failed`
+ *   (`already_paid`) when a different session already paid it, none on a
+ *   same-session replay, a `warn` when no such proposal exists, and `failed`
+ *   (`not_paid`) with no stamp for a session that is not paid. A session
+ *   without both keys makes no query. Runs BESIDE the other stamps; never
+ *   throws; logs an 8-character prefix and the outcome only.
+ *
  * Checkout Person (checkout.session.completed, #852 D6):
  *   Chained after that stamp, `recordFlowCheckoutPerson` finds or creates the
  *   Person of the checkout row THIS session completed (matched on its own
@@ -87,10 +107,12 @@
  */
 import { track } from "@working-theory/analytics/server";
 import type { Prisma } from "@working-theory/database";
+import { isId } from "@working-theory/ids";
 import type { FastifyReply, FastifyRequest } from "fastify";
 
 import { config } from "../../config/index.js";
 import { prisma } from "../../lib/prisma.js";
+import { stampProposalPaid as writeProposalPaid } from "../../lib/proposal-paid-store.js";
 import {
   resolveCommerceClaim,
   commerceDisabledResponse,
@@ -110,6 +132,7 @@ import {
   verifyWebhookSignature,
 } from "../../lib/stripe.js";
 import { hasSeen, markSeen } from "../../lib/webhook-idempotency.js";
+import { recordWorkspaceAuditAction } from "../../services/audit-log.js";
 import { isUniqueViolation } from "../../services/default-tenant.js";
 import {
   DUNNING_MAX_SUBSCRIPTIONS,
@@ -309,6 +332,20 @@ export const stripeWebhookHandler = async (
   }
   markSeen(event.id);
 
+  // #8024 — the billing families' site filter, after `markSeen` as #7868's
+  // in-arm check is, so a foreign redelivery is a duplicate. One gate rather
+  // than a check per arm: the `default` arm's types are filtered too.
+  const foreignStamp = siteStampSourcesOf(event).find(isForeignSiteStamp);
+  if (foreignStamp) {
+    logForeignSiteSkip(request, {
+      stamp: foreignStamp[SITE_STAMP_KEY],
+      eventType: event.type,
+      eventIdPrefix,
+    });
+    await reply.code(200).send({ received: true });
+    return;
+  }
+
   switch (event.type) {
     case "customer.created": {
       const customer = event.data.object as {
@@ -400,6 +437,7 @@ export const stripeWebhookHandler = async (
           }),
         ),
         stampRequestPaid(request, { session, eventIdPrefix }),
+        stampProposalPaid(request, { session, eventId: event.id, eventIdPrefix }),
       ]);
       break;
     }
@@ -497,11 +535,11 @@ type CheckoutSessionObject = {
 };
 
 /**
- * The one log line for a session another site stamped (#7868 D3). Carries the
- * foreign stamp (first 64 characters) and this site's own alias, so a spoke
- * event correctly skipped can be told from a hub event whose alias drifted —
- * site labels only: it takes the stamp, never the session, so no buyer field
- * or amount can reach it.
+ * The one log line for an event another site stamped (#7868 D3, #8024 D3).
+ * Carries the foreign stamp (first 64 characters) and this site's own alias,
+ * so a spoke event correctly skipped can be told from a hub event whose alias
+ * drifted — site labels only: it takes the stamp, never the object, so no
+ * buyer field, customer id or amount can reach it.
  */
 function logForeignSiteSkip(
   request: FastifyRequest,
@@ -523,10 +561,61 @@ function logForeignSiteSkip(
       stamp: stamp?.slice(0, 64),
       ownSite: currentSiteId(),
     },
-    "checkout session stamped for another site — skipped",
+    "stripe event stamped for another site — skipped",
   );
 }
 
+/** The object type whose metadata carries the site for each billing family (#8024 D2). */
+function stampedObjectTypeOf(eventType: string): "subscription" | "customer" | "invoice" | null {
+  if (eventType.startsWith("customer.subscription.")) return "subscription";
+  if (eventType.startsWith("customer.")) return "customer";
+  if (eventType.startsWith("invoice.")) return "invoice";
+  return null;
+}
+
+/** `value` when it is a non-null object, else `null` — every step of a stamp read is guarded (NF1). */
+function objectOrNull(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+/**
+ * The metadata objects that may carry an event's site stamp (#8024 D2), in the
+ * order they are checked: a Subscription's or a Customer's own metadata; an
+ * invoice's own metadata, then the subscription snapshot at the pinned API
+ * version (`parent.subscription_details.metadata`), then at a pre-`basil` one
+ * (`subscription_details.metadata`). Empty for every other event type, and
+ * when `data.object.object` is not the family's own type — a
+ * `customer.source.*` card, say. Reads the payload alone and never throws on
+ * any shape: an absent, `null` or non-object step yields no source, and
+ * `isForeignSiteStamp` treats a non-string stamp as unstamped.
+ */
+function siteStampSourcesOf(event: {
+  type: string;
+  data?: unknown;
+}): Record<string, string>[] {
+  const objectType = stampedObjectTypeOf(event.type);
+  const object = objectOrNull(objectOrNull(event.data)?.["object"]);
+  if (objectType === null || object?.["object"] !== objectType) return [];
+
+  const candidates =
+    objectType === "invoice"
+      ? [
+          object["metadata"],
+          objectOrNull(objectOrNull(object["parent"])?.["subscription_details"])?.[
+            "metadata"
+          ],
+          objectOrNull(object["subscription_details"])?.["metadata"],
+        ]
+      : [object["metadata"]];
+  // The cast only narrows the value type for `isForeignSiteStamp`, which
+  // reads the stamp as `unknown` and `typeof`-checks it.
+  return candidates
+    .map(objectOrNull)
+    .filter((source) => source !== null) as Record<string, string>[];
+}
+
 /**
  * Minimal projected shape of a Stripe Invoice object for the dunning arms
  * (#6034 FR-1). `subscription` and `customer` are EXPANDABLE Stripe fields —
@@ -803,6 +892,95 @@ async function stampRequestPaid(
   }
 }
 
+/**
+ * #8516 D13 — stamp a client's proposal paid from its own Checkout Session,
+ * and audit the outcome as Stripe. The two ids come only from the session's
+ * metadata, which this server wrote when it opened the session — a payer can
+ * never set it — and the stamp is scoped by both. Never throws.
+ */
+async function stampProposalPaid(
+  request: FastifyRequest,
+  {
+    session,
+    eventId,
+    eventIdPrefix,
+  }: { session: CheckoutSessionObject; eventId: string; eventIdPrefix: string },
+): Promise<void> {
+  const pieceId = session.metadata?.["ailk_proposal"];
+  const workspaceId = session.metadata?.["ailk_workspace"];
+  const sessionId = session.id;
+  if (
+    typeof pieceId !== "string" ||
+    typeof workspaceId !== "string" ||
+    typeof sessionId !== "string" ||
+    !isId("piece", pieceId) ||
+    !isId("workspace", workspaceId)
+  ) {
+    return;
+  }
+  const ref = pieceId.substring(6, 14);
+
+  const audit = async (outcome: { ok: true } | { ok: false; reason: string }) => {
+    const result = await recordWorkspaceAuditAction({
+      workspaceId,
+      actor: { type: "system", systemId: "stripe" },
+      domain: "people",
+      tool: "proposal.paid",
+      outcome: outcome.ok ? "succeeded" : "failed",
+      ...(!outcome.ok && { failureReason: outcome.reason }),
+      idempotencyKey: eventId,
+      targetType: "piece",
+      targetId: pieceId,
+    });
+    if (!result.ok) {
+      request.log.error(
+        { eventIdPrefix, ref, error: result.error.kind },
+        "proposal paid: audit write failed",
+      );
+    }
+  };
+
+  if (
+    session.payment_status !== "paid" &&
+    session.payment_status !== "no_payment_required"
+  ) {
+    request.log.warn(
+      { eventIdPrefix, ref, outcome: "not_paid" },
+      "proposal paid: completed session is not paid — not stamping",
+    );
+    await audit({ ok: false, reason: "not_paid" });
+    return;
+  }
+
+  try {
+    const outcome = await writeProposalPaid(workspaceId, pieceId, sessionId, new Date());
+    if (outcome === "stamped") {
+      request.log.info({ eventIdPrefix, ref, outcome }, "proposal stamped paid");
+      await audit({ ok: true });
+    } else if (outcome === "already_paid") {
+      request.log.warn(
+        { eventIdPrefix, ref, outcome },
+        "proposal paid: already paid by another session — a second charge",
+      );
+      await audit({ ok: false, reason: "already_paid" });
+    } else if (outcome === "not_found") {
+      request.log.warn({ eventIdPrefix, ref, outcome }, "proposal paid: no such proposal");
+    } else {
+      request.log.info({ eventIdPrefix, ref, outcome }, "proposal paid: replay");
+    }
+  } catch (err) {
+    request.log.error(
+      {
+        eventIdPrefix,
+        ref,
+        outcome: "stamp_failed",
+        errName: err instanceof Error ? err.name : "UnknownError",
+      },
+      "proposal paid stamp failed — continuing",
+    );
+  }
+}
+
 /**
  * The hosted-invoice twin of `stampRequestPaid` (#5970 D4/D8).
  *

package/templates/apps/api/src/server.ts

@@ -235,7 +235,8 @@ const WORKSPACES_SUBSCRIBERS = "./routes/workspaces/subscribers.js";
 // #852 D8 — the People reads (the workspace's clients), the SAME scope.
 const WORKSPACES_PEOPLE = "./routes/workspaces/people.js";
 // #7877 D9 — a client's pieces, plan and outbound messages, and the
-// workspace's piece stages: the operator's writes, the SAME scope.
+// workspace's piece stages: the writes owners, admins and (#8514) members
+// make, the SAME scope.
 const WORKSPACES_PIECES = "./routes/workspaces/pieces.js";
 const WORKSPACES_PLAN = "./routes/workspaces/plan.js";
 const WORKSPACES_MESSAGES_OUT = "./routes/workspaces/messages-out.js";
@@ -267,6 +268,9 @@ const MEMBER_BOOKINGS = "./routes/member/bookings.js";
 // other member routes. D8 — the Admin owner's consents to Working Theory,
 // under multi-tenant alone (the module that contributes the Admin app).
 const MEMBER_CONSENTS = "./routes/member/consents.js";
+// #8515 D13 — the client's onboarding read and write, under the tenancy
+// predicate beside the request-quote pair.
+const MEMBER_ONBOARDING = "./routes/member/onboarding.js";
 const CONSENT_PLATFORM = "./routes/consent/platform.js";
 // #3591 PR-B — the agent seat's management routes and an agent's own
 // context, siblings of WORKSPACES_MEMBERS in the same workspace/multi-tenant
@@ -348,7 +352,8 @@ const SLICE_PLUGINS = {
     specifier: WORKSPACES_PEOPLE,
     load: () => import(WORKSPACES_PEOPLE),
   },
-  // #7877 D9 — the member area's operator routes, the SAME scope.
+  // #7877 D9 — the member area's operator routes (owners, admins and, since
+  // #8514, members), the SAME scope.
   workspacePieceRoutes: {
     specifier: WORKSPACES_PIECES,
     load: () => import(WORKSPACES_PIECES),
@@ -410,6 +415,11 @@ const SLICE_PLUGINS = {
     specifier: MEMBER_REQUESTS,
     load: () => import(MEMBER_REQUESTS),
   },
+  // #8515 D13 — the onboarding read and write.
+  memberOnboardingRoutes: {
+    specifier: MEMBER_ONBOARDING,
+    load: () => import(MEMBER_ONBOARDING),
+  },
   memberArtifactReviewRoutes: {
     specifier: MEMBER_ARTIFACT_REVIEW,
     load: () => import(MEMBER_ARTIFACT_REVIEW),
@@ -1063,6 +1073,8 @@ export async function build() {
       await authScope.register(await sliceRoutePlugin("memberBillingRoutes"));
       // #8170 D11 — the member writes, under the same predicate.
       await authScope.register(await sliceRoutePlugin("memberRequestRoutes"));
+      // #8515 D13 — the onboarding pair, under the same predicate.
+      await authScope.register(await sliceRoutePlugin("memberOnboardingRoutes"));
       await authScope.register(await sliceRoutePlugin("memberArtifactReviewRoutes"));
       await authScope.register(await sliceRoutePlugin("memberProfileRoutes"));
       await authScope.register(await sliceRoutePlugin("memberDeletionRequestRoutes"));

package/templates/apps/api/src/services/__tests__/audit-log.test.ts

@@ -51,6 +51,7 @@ import {
   freshAuditIdempotencyKey,
   recordAgentWrite,
   recordAuditAction,
+  recordWorkspaceAuditAction,
   redactPersonalData,
   type AuditActor,
   type AuditRowDigestInput,
@@ -935,3 +936,93 @@ describe("recordAgentWrite given the request (#3591 PR-B)", () => {
     expect(mockLoggerError.mock.calls[0]![1]).toBe("[audit-log] agent write audit refused");
   });
 });
+
+// ─── #8516 D14 — recordWorkspaceAuditAction, a row without a tenant ────────────
+
+describe("#8516 AC-7 — recordWorkspaceAuditAction", () => {
+  const PIECE_ID = "piece_0190f3a2-7c1d-7e4a-9b2c-000000000004";
+  const ROW = {
+    domain: "people",
+    tool: "proposal.client_review",
+    outcome: "succeeded" as const,
+    idempotencyKey: "req_proposal_review",
+    targetType: "piece",
+    targetId: PIECE_ID,
+    summary: '{"by":"client","review":"approved","priced":true}',
+  };
+
+  it("writes the row recordAuditAction would for the same workspace and user actor", async () => {
+    const tenantWrite = stubDb();
+    const tenantResult = await recordAuditAction(
+      { ...ROW, tenant: TENANT, actor: userActor(USER_ID) },
+      tenantWrite.db,
+    );
+    const workspaceWrite = stubDb();
+    const workspaceResult = await recordWorkspaceAuditAction(
+      { ...ROW, workspaceId: WORKSPACE_ID, actor: { type: "user", userId: USER_ID as Id<"user"> } },
+      workspaceWrite.db,
+    );
+
+    expect(workspaceWrite.create).toHaveBeenCalledTimes(1);
+    expect(firstWrittenRow(workspaceWrite.create)).toEqual(firstWrittenRow(tenantWrite.create));
+    expect(workspaceResult).toEqual(tenantResult);
+    expect(workspaceResult).toMatchObject({ ok: true, outcome: "recorded" });
+  });
+
+  it("the system actor stores actor_type system and actor_id stripe", async () => {
+    const { db, create } = stubDb();
+    const result = await recordWorkspaceAuditAction(
+      {
+        workspaceId: WORKSPACE_ID,
+        actor: { type: "system", systemId: "stripe" },
+        domain: "people",
+        tool: "proposal.paid",
+        outcome: "failed",
+        failureReason: "already_paid",
+        idempotencyKey: "evt_test_proposal",
+        targetType: "piece",
+        targetId: PIECE_ID,
+      },
+      db,
+    );
+
+    expect(result).toMatchObject({ ok: true, outcome: "recorded" });
+    expect(create).toHaveBeenCalledTimes(1);
+    const row = firstWrittenRow(create);
+    expect(row).toMatchObject({
+      workspaceId: WORKSPACE_ID,
+      actorType: "system",
+      actorId: "stripe",
+      action: "people.proposal.paid",
+      targetType: "piece",
+      targetId: PIECE_ID,
+    });
+    expect(row.metadata).toEqual({
+      v: 2,
+      outcome: "failed",
+      tool: "proposal.paid",
+      idempotencyKey: "evt_test_proposal",
+      failureReason: "already_paid",
+    });
+    expect(row.metadata).not.toHaveProperty("onBehalfOf");
+    expect(zAuditLogId.safeParse(row.id).success).toBe(true);
+  });
+
+  it("an invalid workspaceId is invalid_input and writes nothing", async () => {
+    const { db, create } = stubDb();
+    const result = await recordWorkspaceAuditAction(
+      { ...ROW, workspaceId: "not-a-workspace", actor: { type: "system", systemId: "stripe" } },
+      db,
+    );
+
+    expect(result).toEqual({
+      ok: false,
+      error: {
+        kind: "invalid_input",
+        message: "workspaceId is not a valid workspace id",
+        persisted: false,
+      },
+    });
+    expect(create).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/api/src/services/audit-log.ts

@@ -99,8 +99,8 @@ import { isUniqueViolation, type TenantContext } from "./default-tenant.js";
 // ─── Types ──────────────────────────────────────────────────────────────────
 
 /** The full actor-kind vocabulary the model comments (not a DB CHECK). This
- * file writes `"user"` and `"agent"` (#3591 D8); `"system"` is kept so a
- * future writer for that actor shares one union. */
+ * file writes `"user"` and `"agent"` (#3591 D8), and `"system"` for Stripe's
+ * payment outcome (#8516 D14, `recordWorkspaceAuditAction`). */
 export type AuditActorType = "user" | "agent" | "system";
 
 /**
@@ -210,6 +210,12 @@ export interface RecordAuditActionInput {
   targetId?: string;
 }
 
+/** Every member of a row's input but who and where — shared by both writers. */
+type AuditRowInput = Omit<RecordAuditActionInput, "tenant" | "actor">;
+
+/** Every actor a row can name: a tenant caller's, or a tenant-less one's (D14). */
+type WriterActor = AuditActor | { type: "system"; systemId: "stripe" };
+
 export type RecordAuditActionResult =
   | { ok: true; outcome: "recorded" | "duplicate"; id: Id<"auditLog"> }
   | {
@@ -487,7 +493,7 @@ function classifyError(error: unknown): { code: string; name: string } {
 interface ValidatedFields {
   workspaceId: string;
   actorId: string;
-  actorType: "user" | "agent";
+  actorType: AuditActorType;
   onBehalfOf: string | undefined;
   tool: string;
   targetType: string | undefined;
@@ -547,15 +553,24 @@ function actorIdRefusal(id: string, field: string): string | undefined {
  * (never a silent rewrite of an identifier field) rather than as a
  * redaction, unlike `summary` / `failureReason`.
  */
-function validateInput(input: RecordAuditActionInput): ValidationResult {
-  if (!zWorkspaceId.safeParse(input.tenant.workspaceId).success) {
+function validateInput(
+  workspaceId: string,
+  workspaceField: string,
+  actor: WriterActor,
+  input: AuditRowInput,
+): ValidationResult {
+  if (!zWorkspaceId.safeParse(workspaceId).success) {
     return {
       ok: false,
-      message: "tenant.workspaceId is not a valid workspace id",
+      message: `${workspaceField} is not a valid workspace id`,
     };
   }
-  const { actor } = input;
-  const actorId = actor.type === "agent" ? actor.agentId : actor.userId;
+  const actorId =
+    actor.type === "agent"
+      ? actor.agentId
+      : actor.type === "system"
+        ? actor.systemId
+        : actor.userId;
   const actorRefusal = actorIdRefusal(actorId, "actorId");
   if (actorRefusal !== undefined) {
     return { ok: false, message: actorRefusal };
@@ -628,7 +643,7 @@ function validateInput(input: RecordAuditActionInput): ValidationResult {
   return {
     ok: true,
     value: {
-      workspaceId: input.tenant.workspaceId,
+      workspaceId,
       actorId,
       actorType: actor.type,
       onBehalfOf,
@@ -674,7 +689,54 @@ export async function recordAuditAction(
   input: RecordAuditActionInput,
   db: AuditWriteClient = prisma,
 ): Promise<RecordAuditActionResult> {
-  const validated = validateInput(input);
+  const { tenant, actor, ...row } = input;
+  return writeAuditRow(tenant.workspaceId, "tenant.workspaceId", actor, row, db);
+}
+
+/**
+ * Who acted on a tenant-less row (#8516 D14): a client — a signed-in person
+ * with no membership — or Stripe itself, reporting a payment outcome.
+ */
+export type WorkspaceAuditActor =
+  | { type: "user"; userId: Id<"user"> }
+  | { type: "system"; systemId: "stripe" };
+
+/** `recordWorkspaceAuditAction`'s input: a workspace id in place of a tenant. */
+export type RecordWorkspaceAuditActionInput = AuditRowInput & {
+  workspaceId: string;
+  actor: WorkspaceAuditActor;
+};
+
+/**
+ * One `audit_logs` row for a caller that holds no `TenantContext` (#8516
+ * D14): a client acting in the member area, or a Stripe webhook. Writes the
+ * row `recordAuditAction` would for the same workspace and user actor; the
+ * system actor stores `actor_type` `system` and `actor_id` `stripe`. Never
+ * throws; never blocks the caller's action.
+ *
+ * CALLER OBLIGATION — `workspaceId` MUST come from `resolveMember`'s
+ * resolved workspace, or from a Stripe-signed event's server-written
+ * metadata matched to a stored row — NEVER from request input. A client
+ * actor's row says so in its `tool` and summary (`by: "client"`), so it is
+ * never read as a staff member's action.
+ */
+export async function recordWorkspaceAuditAction(
+  input: RecordWorkspaceAuditActionInput,
+  db: AuditWriteClient = prisma,
+): Promise<RecordAuditActionResult> {
+  const { workspaceId, actor, ...row } = input;
+  return writeAuditRow(workspaceId, "workspaceId", actor, row, db);
+}
+
+/** The body of both writers: one validated, digested, idempotent insert. */
+async function writeAuditRow(
+  workspaceIdInput: string,
+  workspaceField: string,
+  actor: WriterActor,
+  input: AuditRowInput,
+  db: AuditWriteClient,
+): Promise<RecordAuditActionResult> {
+  const validated = validateInput(workspaceIdInput, workspaceField, actor, input);
   if (!validated.ok) {
     return {
       ok: false,

package/templates/apps/api/src/services/default-tenant.ts

@@ -74,6 +74,13 @@ export interface TenantContext {
    * `@working-theory/validation`'s `allows`.
    */
   grants?: readonly AgentGrantablePermission[];
+  /**
+   * Set ONLY by `agentTenant` (#8514 D4); a person's tenant never carries it.
+   * `@working-theory/validation`'s `roleAllows` / `allows` read it to withhold
+   * `AGENT_WITHHELD_PERMISSIONS` from an agent's role, and both tenant guards
+   * refuse an agent request whose tenant lacks it (fail closed).
+   */
+  agent?: true;
 }
 
 export type TenantErrorKind = "forbidden" | "not_found" | "conflict";
@@ -222,7 +229,9 @@ export async function resolveDefaultTenantForOperator(
  * An agent's tenant (#3591 D5, #7864): its person's tenant with the role
  * clamped to the agent's ceiling and, when any survive, the agent's grants
  * that its person's own role holds. `grants` is omitted when none survive,
- * so an agent with no effective grant is the same shape as before.
+ * so an agent with no effective grant is the same shape as before. It always
+ * carries `agent: true` (#8514 D4), which withholds the client-keeping rows a
+ * member holds by role.
  *
  * The one clamp both tenant guards apply — `resolveAgentTenant` (multi-tenant)
  * and `resolveDefaultTenantForAgent` (base build) — so the two builds cannot
@@ -238,8 +247,8 @@ export function agentTenant(
     (p) => agent.grants.includes(p) && can(personTenant.role, p),
   );
   return grants.length > 0
-    ? { ...personTenant, role, grants }
-    : { ...personTenant, role };
+    ? { ...personTenant, role, agent: true, grants }
+    : { ...personTenant, role, agent: true };
 }
 
 /**

package/templates/apps/api/src/services/hub-sign-in.ts

@@ -114,7 +114,8 @@ function refuse<T = never>(
 // keyed on an identity the request has already proved (the user the cookie
 // session resolved to; the client that passed secret AND spoke key), so an
 // invented key never gets one (SEC-7894-8). The shape of `middleware/auth.ts`'s
-// per-agent limiter. SINGLE-REPLICA, like every limiter in this app.
+// per-agent limiter. SINGLE-REPLICA, like the in-process limiters in this
+// app (the per-IP middleware shares a database store, #5040).
 
 interface Bucket {
   windowStartMs: number;

package/templates/apps/api/src/services/public-site-resolver.ts

@@ -352,14 +352,33 @@ export async function resolvePublicContentAdapter(
   if (site.kind === "not-required" || resolvedAdapterKind() !== "database") {
     return getContentAdapter();
   }
+  return workspaceContentAdapter(site.workspaceId);
+}
+
+/**
+ * The content adapter holding ONE workspace's own pages, or `null` when no
+ * content is that workspace's (#8514 D9, C13). On the database adapter it is
+ * that workspace's database adapter. Off it, the shared content is the
+ * deployment's one site — the default workspace's — so only that workspace
+ * gets it and every other workspace gets `null`, never the hub's pages
+ * (SEC-8514-I). The Admin's plan picker reads its offerings through it.
+ */
+export async function workspaceContentAdapter(
+  workspaceId: string,
+): Promise<ContentAdapter | null> {
+  if (resolvedAdapterKind() !== "database") {
+    // Deferred — see the module-load note in this file's header (#5852 D6).
+    const { resolveDefaultWorkspaceId } = await import("./default-tenant.js");
+    return (await resolveDefaultWorkspaceId()) === workspaceId ? getContentAdapter() : null;
+  }
 
-  // The database path, and the only caller that needs apps/api's client. The
+  // The database path, and the only one that needs apps/api's client. The
   // import is deferred for the reason the header gives (#5852 D6), and the
   // generated client is structurally wider than the narrow read surface the
   // adapter declares — the cast names that, and nothing else.
   const { prisma } = await import("../lib/prisma.js");
   return getContentAdapter({
-    workspaceId: site.workspaceId,
+    workspaceId,
     prisma: prisma as unknown as ArtifactPrismaClient,
   });
 }

package/templates/apps/api/vercel.json

@@ -1,6 +1,6 @@
 {
   "version": 2,
-  "ignoreCommand": "[ -n \"$VERCEL_GIT_PREVIOUS_SHA\" ] && cd ../.. && git diff --quiet \"$VERCEL_GIT_PREVIOUS_SHA\" HEAD -- apps/api packages database pnpm-lock.yaml || exit 1",
+  "ignoreCommand": "[ -n \"$VERCEL_GIT_PREVIOUS_SHA\" ] && cd ../.. && git diff --quiet \"$VERCEL_GIT_PREVIOUS_SHA\" HEAD -- apps/api packages database pnpm-lock.yaml package.json pnpm-workspace.yaml turbo.json 'tsconfig*.json' || exit 1",
   "buildCommand": "cd ../.. && pnpm run --filter @working-theory/api build:vercel",
   "installCommand": "cd ../.. && pnpm install --frozen-lockfile",
   "outputDirectory": "public",