create-ailk 0.22.0 → 0.24.0

package/templates/apps/api/src/services/__tests__/checkout-plan.test.ts

@@ -0,0 +1,313 @@
+/**
+ * @file checkout-plan.test.ts
+ * @description The hub's checkout plan rule end to end (#8793, spec
+ * docs/specs/8793-the-hub-s-checkout-plan-spec.md D1–D3; AC-3, AC-4, AC-5):
+ * a spoke's marked checkout lead never writes a Person's plan — it holds it —
+ * and the held plan is released only when `resolveMemberPersonId` first links
+ * the Person to the signed-in user whose VERIFIED email is the Person's own.
+ * A checkout that types another Person's email cannot change that Person's
+ * plan, and the lead, the purchase message, the purchase email and the
+ * consent grant are written exactly as before.
+ *
+ * Runs `routeLead` and `resolveMemberPersonId` with the real `person.ts`
+ * over `createInMemoryPrisma()`, which enforces the Person's
+ * `(workspaceId, email)` and `(workspaceId, userId)` keys.
+ *
+ * External dependency boundaries mocked:
+ *   - apps/api/src/lib/prisma — the in-memory, where-clause-honouring double.
+ *     Its `lead.count` is arranged per test: the purchase email's cap reads
+ *     with `mode: "insensitive"`, a filter the double does not model.
+ *   - @working-theory/email — the operator notification and purchase email.
+ *   - ../plan-offerings.js — the workspace's content-adapter read.
+ *   - consent.recordCheckoutConsent — spied; the ledger's own transaction is
+ *     `consent.test.ts`'s, and here only its call is the claim.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); the in-memory double is the repo-standard where-honouring test double for it.
+jest.mock("../../lib/prisma.js", () =>
+  jest
+    .requireActual<typeof import("../../__tests__/factories/in-memory-prisma")>(
+      "../../__tests__/factories/in-memory-prisma",
+    )
+    .createInMemoryPrisma(),
+);
+
+const mockSendLeadNotification = jest.fn();
+const mockSendPurchaseConfirmationEmail = jest.fn();
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: (...args: unknown[]) =>
+    mockSendLeadNotification(...args),
+  sendPurchaseConfirmationEmail: (...args: unknown[]) =>
+    mockSendPurchaseConfirmationEmail(...args),
+}));
+
+const mockListPlanOfferings = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- plan-offerings.ts is the workspace's content-adapter read (the database adapter, an external boundary), the same seam lead-routing.test.ts mocks.
+jest.mock("../plan-offerings.js", () => ({
+  listPlanOfferings: (...args: unknown[]) => mockListPlanOfferings(...args),
+}));
+
+import { logger } from "@working-theory/observability";
+
+import { prisma } from "../../lib/prisma.js";
+import * as consent from "../consent";
+import { routeLead } from "../lead-routing";
+import { resolveMemberPersonId } from "../person";
+
+type Row = Record<string, unknown>;
+// The in-memory double's own surface (`__db`, `__calls`) is not on the
+// PrismaClient type the import carries, so it is named here once.
+// eslint-disable-next-line no-restricted-syntax -- justified above
+const store = prisma as unknown as {
+  __db: Record<string, Row[]>;
+  lead: Record<string, jest.Mock>;
+};
+
+const WS = "wksp_00000000-0000-7000-8000-000000008793";
+const KEY = "cs_live_h8793Hold"; // gitleaks:allow -- a synthetic Checkout Session id shape (#8793 AC-3), not a credential
+const KEY_2 = "cs_live_h8793Hold2"; // gitleaks:allow -- a second synthetic Checkout Session id shape (#8793 AC-4), not a credential
+const VICTIM = "victim@x.io";
+const U = "user_00000000-0000-7000-8000-000000008793";
+const ENV_KEYS = [
+  "DATABASE_URL",
+  "NODE_ENV",
+  "AILK_LEAD_NOTIFICATION_TO",
+  "AILK_LEAD_NOTIFICATION_FROM",
+  "AILK_DELIVERABLE_EMAIL_FROM",
+] as const;
+
+const sourceMeta = {
+  ip: "127.0.0.1",
+  userAgent: "jest",
+  receivedAt: new Date().toISOString(),
+  viaSpoke: true,
+};
+
+const people = () => (store.__db["person"] ??= []);
+const users = () => (store.__db["user"] ??= []);
+const leads = () => (store.__db["lead"] ??= []);
+const interactions = () => (store.__db["interaction"] ??= []);
+const victim = () => people().find((p) => p["email"] === VICTIM);
+
+function checkout(email: string, offering: string, extra: Row = {}) {
+  return {
+    kind: "submit" as const,
+    siteId: WS,
+    source: "web",
+    email,
+    payload: {
+      site: "wendi",
+      page: "checkout",
+      offering,
+      amountTotal: 900,
+      currency: "usd",
+      ...extra,
+    } as Record<string, unknown>,
+  };
+}
+
+/** A Person of `WS`, optionally linked to a verified user. */
+function seedVictim(row: { userId?: string; planOffering?: string | null }): void {
+  people().push({
+    id: "person_00000000-0000-7000-8000-000000008793",
+    workspaceId: WS,
+    email: VICTIM,
+    name: null,
+    userId: null,
+    billingProvider: null,
+    billingCustomerId: null,
+    planOffering: null,
+    contactConfirmedAt: null,
+    contactConfirmedBy: null,
+    createdAt: new Date(Date.UTC(2026, 0, 1)),
+    ...row,
+  });
+}
+
+const verifiedUser = (id: string, email: string) =>
+  users().push({ id, email, emailVerified: true });
+
+let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+let info: jest.SpyInstance;
+let recordGrant: jest.SpyInstance;
+
+const planLines = () =>
+  info.mock.calls
+    .map(([fields]) => fields as Row)
+    .filter((fields) => fields?.["event"] === "checkout-plan");
+
+/** Let the fired (void) purchase email run to its end. */
+const settle = async () => {
+  for (let i = 0; i < 5; i += 1)
+    await new Promise((resolve) => setImmediate(resolve));
+};
+
+beforeEach(() => {
+  for (const key of Object.keys(store.__db)) delete store.__db[key];
+  saved = {};
+  for (const k of ENV_KEYS) saved[k] = process.env[k];
+  process.env.DATABASE_URL = "postgres://stub";
+  delete process.env.NODE_ENV;
+  process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+  process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+  process.env.AILK_DELIVERABLE_EMAIL_FROM = "orders@example.com";
+  mockSendLeadNotification.mockReset().mockResolvedValue({ ok: true, messageId: "m" });
+  mockSendPurchaseConfirmationEmail
+    .mockReset()
+    .mockResolvedValue({ ok: true, messageId: "m2" });
+  mockListPlanOfferings.mockReset().mockResolvedValue([]);
+  store.lead["count"]!.mockReset().mockResolvedValue(1);
+  info = jest.spyOn(logger, "info").mockImplementation(() => undefined as never);
+  recordGrant = jest
+    .spyOn(consent, "recordCheckoutConsent")
+    .mockResolvedValue("recorded");
+});
+
+afterEach(() => {
+  for (const k of ENV_KEYS) {
+    if (saved[k] === undefined) delete process.env[k];
+    else process.env[k] = saved[k];
+  }
+  info.mockRestore();
+  recordGrant.mockRestore();
+});
+
+describe("a checkout that types another Person's email cannot change that Person's plan (#8793 AC-3)", () => {
+  it("a linked victim's set plan stays, and the checkout's line is held", async () => {
+    verifiedUser(U, VICTIM);
+    seedVictim({ userId: U, planOffering: "premium" });
+    await routeLead(checkout("VICTIM@x.io", "wendi_basic"), sourceMeta, {
+      idempotencyKey: KEY,
+    });
+    expect(victim()!["planOffering"]).toBe("premium");
+    expect(planLines()).toEqual([
+      { event: "checkout-plan", outcome: "held", siteId: WS },
+    ]);
+  });
+
+  it("a linked victim's blank plan stays blank, through the victim's next member read", async () => {
+    verifiedUser(U, VICTIM);
+    seedVictim({ userId: U });
+    await routeLead(checkout("VICTIM@x.io", "wendi_basic"), sourceMeta, {
+      idempotencyKey: KEY,
+    });
+    expect(victim()!["planOffering"]).toBeNull();
+    expect(await resolveMemberPersonId(WS, U, VICTIM)).toBe(victim()!["id"]);
+    expect(victim()!["planOffering"]).toBeNull();
+  });
+
+  it("a stranger's later purchase cannot decide an unlinked victim's held plan", async () => {
+    seedVictim({});
+    leads().push({
+      id: "lead_00000000-0000-7000-8000-000000000001",
+      workspaceId: WS,
+      siteId: WS,
+      personId: victim()!["id"],
+      email: VICTIM,
+      source: "web",
+      spokeCheckout: true,
+      payload: { site: "wendi", page: "checkout", offering: "wendi_premium" },
+      createdAt: new Date(Date.UTC(2026, 0, 2)),
+    });
+    await routeLead(checkout("VICTIM@x.io", "wendi_basic"), sourceMeta, {
+      idempotencyKey: KEY,
+    });
+    verifiedUser(U, VICTIM);
+    const log = { warn: jest.fn() };
+    expect(await resolveMemberPersonId(WS, U, VICTIM, log)).toBe(victim()!["id"]);
+    expect(victim()!["planOffering"]).toBeNull();
+    // The release ran and refused: the purchases disagree.
+    expect(log.warn).toHaveBeenCalledWith(
+      { event: "checkout-plan-release", outcome: "ambiguous" },
+      expect.any(String),
+    );
+  });
+
+  it("an unlinked victim's operator-set plan stays through the first link", async () => {
+    seedVictim({ planOffering: "premium" });
+    await routeLead(checkout("VICTIM@x.io", "wendi_basic"), sourceMeta, {
+      idempotencyKey: KEY,
+    });
+    verifiedUser(U, VICTIM);
+    expect(await resolveMemberPersonId(WS, U, VICTIM)).toBe(victim()!["id"]);
+    expect(victim()!["planOffering"]).toBe("premium");
+  });
+});
+
+describe("a real buyer still gets the plan at their verified first link (#8793 AC-4)", () => {
+  const BUYER = "new@x.io";
+  const buyer = () => people().find((p) => p["email"] === BUYER)!;
+  // A Person the capture created carries no `planOffering` key in the double
+  // (Postgres reads the unwritten column back as `null`).
+  const buyerPlan = () => buyer()["planOffering"] ?? null;
+
+  it("the checkout holds, and the buyer's first member read releases it", async () => {
+    await routeLead(checkout(BUYER, "wendi_retainer"), sourceMeta, {
+      idempotencyKey: KEY,
+    });
+    expect(buyerPlan()).toBeNull();
+    expect(planLines()).toEqual([
+      { event: "checkout-plan", outcome: "held", siteId: WS },
+    ]);
+    verifiedUser(U, BUYER);
+    expect(await resolveMemberPersonId(WS, U, BUYER)).toBe(buyer()["id"]);
+    expect(buyerPlan()).toBe("retainer");
+  });
+
+  it("a second purchase of the same offering under a new key still releases it", async () => {
+    await routeLead(checkout(BUYER, "wendi_retainer"), sourceMeta, {
+      idempotencyKey: KEY,
+    });
+    await routeLead(checkout(BUYER, "wendi_retainer"), sourceMeta, {
+      idempotencyKey: KEY_2,
+    });
+    expect(leads()).toHaveLength(2);
+    verifiedUser(U, BUYER);
+    expect(await resolveMemberPersonId(WS, U, BUYER)).toBe(buyer()["id"]);
+    expect(buyerPlan()).toBe("retainer");
+  });
+});
+
+describe("the lead, the purchase message, the purchase email and the consent grant are unchanged (#8793 AC-5)", () => {
+  it.each([
+    ["linked with a plan", { userId: U, planOffering: "premium" }],
+    ["linked with no plan", { userId: U }],
+    ["unlinked", {}],
+  ] as const)("victim %s", async (_label, victimRow) => {
+    verifiedUser(U, VICTIM);
+    seedVictim(victimRow);
+    const terms = consent.currentAccountTermsStamp()!;
+    const result = await routeLead(
+      checkout("VICTIM@x.io", "wendi_basic", { termsAccepted: terms.stamp }),
+      sourceMeta,
+      { idempotencyKey: KEY },
+    );
+    await settle();
+    const personId = victim()!["id"];
+    expect(result).toEqual({
+      ok: true,
+      id: leads()[0]!["id"],
+      personId,
+      persisted: "db",
+      email: expect.anything(),
+    });
+    expect(leads()).toHaveLength(1);
+    expect(leads()[0]).toMatchObject({ spokeCheckout: true, personId });
+    expect(interactions()).toHaveLength(1);
+    expect(interactions()[0]).toMatchObject({
+      personId,
+      channel: "member",
+      direction: "outbound",
+      subject: "Your purchase",
+      createdBy: "system:checkout",
+    });
+    expect(mockSendPurchaseConfirmationEmail).toHaveBeenCalledTimes(1);
+    expect(recordGrant).toHaveBeenCalledTimes(1);
+    expect(recordGrant).toHaveBeenCalledWith({
+      workspaceId: WS,
+      personId,
+      sessionId: KEY,
+      policyVersion: terms.policyVersion,
+    });
+  });
+});

package/templates/apps/api/src/services/__tests__/deliverable-fulfillment.test.ts

@@ -144,6 +144,16 @@ describe("fulfillDeliverable", () => {
     );
   });
 
+  it("selects only the id on the legacy DeliverableAsset lookup, never the bytes blob (#9248)", async () => {
+    await fulfillDeliverable(baseInput({ segment: "small" }));
+
+    // `DeliverableAsset.bytes` is the file itself; this read exists only to
+    // learn the row's id, so the query must name that one column.
+    const [[args]] = (prisma.deliverableAsset.findUnique as jest.Mock).mock
+      .calls as [[{ select?: Record<string, unknown> }]];
+    expect(args.select).toEqual({ id: true });
+  });
+
   it("resolves the OTHER segment's entry when segment differs (two-segment divergence, AC1)", async () => {
     (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue({
       id: "dasset_00000000-0000-7000-8000-0000000000a2",
@@ -471,6 +481,55 @@ describe("fulfillDeliverable", () => {
     );
   });
 
+  // ── #8848 D3 — the minted grant id, and a deliverable flow's Asset-only store ──
+
+  it("resolves { grantId } equal to the created row's id on a successful mint", async () => {
+    await expect(fulfillDeliverable(baseInput())).resolves.toEqual({ grantId: GRANT_ID });
+  });
+
+  it("resolves undefined on the asset_missing path", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({ workspaceId: WORKSPACE_ID });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await expect(fulfillDeliverable(baseInput())).resolves.toBeUndefined();
+  });
+
+  it("a gated file snapshot whose key names only a legacy DeliverableAsset mints no grant (SEC-8848-B)", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({ workspaceId: WORKSPACE_ID });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+    const configSnapshot = {
+      ...baseConfigSnapshot(),
+      deliverables: { ...deliverablesBlock(), assets: [{ assetKey: "listing-acme-2026-10-12" }] },
+      deliverable: { kind: "file", gated: true, title: en("Q3"), geometry: "letter", pages: 3 },
+    };
+
+    await expect(
+      fulfillDeliverable(baseInput({ segment: undefined, configSnapshot })),
+    ).resolves.toBeUndefined();
+
+    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
+    expect(prisma.deliverableGrant.create).not.toHaveBeenCalled();
+    expect(mockLoggerInfo).toHaveBeenCalledWith(
+      expect.objectContaining({ outcome: "asset_missing" }),
+      expect.any(String),
+    );
+  });
+
+  it("the same legacy-only key on a flow with no deliverable block still mints (NFR1)", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({ workspaceId: WORKSPACE_ID });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+    const configSnapshot = {
+      ...baseConfigSnapshot(),
+      deliverables: { ...deliverablesBlock(), assets: [{ assetKey: "listing-acme-2026-10-12" }] },
+    };
+
+    await expect(
+      fulfillDeliverable(baseInput({ segment: undefined, configSnapshot })),
+    ).resolves.toEqual({ grantId: GRANT_ID });
+    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalled();
+  });
+
   it("never reaches a key that exists only in ANOTHER workspace (NFR3) — the lookup is scoped to this flow's own workspaceId alone", async () => {
     (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
       workspaceId: WORKSPACE_ID,
@@ -692,7 +751,7 @@ describe("fulfillDeliverable", () => {
       error: { kind: "send_failed", message: "Resend down" },
     });
 
-    await expect(fulfillDeliverable(baseInput())).resolves.toBeUndefined();
+    await expect(fulfillDeliverable(baseInput())).resolves.toEqual({ grantId: GRANT_ID });
     expect(mockLoggerInfo).toHaveBeenCalled();
     // AC4: send_failed is a post-mint outcome — it stamps too.
     expect(prisma.deliverableGrant.update).toHaveBeenCalledWith({
@@ -708,7 +767,7 @@ describe("fulfillDeliverable", () => {
       new Error("connection reset"),
     );
 
-    await expect(fulfillDeliverable(baseInput())).resolves.toBeUndefined();
+    await expect(fulfillDeliverable(baseInput())).resolves.toEqual({ grantId: GRANT_ID });
     expect(mockSendDeliverableEmail).toHaveBeenCalled();
     expect(mockLoggerWarn).toHaveBeenCalledWith(
       expect.objectContaining({ grantId: GRANT_ID, outcome: "sent" }),

package/templates/apps/api/src/services/__tests__/keyless-workspace-predicate.test.ts

@@ -0,0 +1,234 @@
+/**
+ * @file keyless-workspace-predicate.test.ts
+ *
+ * One keyless-workspace predicate (#9145). `resolvePublicWorkspace` (content,
+ * pricing, schedule, the consent cookie) and `resolveCallerWorkspace` (the
+ * `/v1/flows` routes and the open deliverable) answer a keyless caller through
+ * the SAME rule — `services/default-tenant.ts#resolveDefaultWorkspaceId`: one
+ * workspace that is the seeded default resolves to it, anything else is
+ * unresolved. The `AILK_SITE_ID` alias is never consulted for a keyless
+ * caller, so a multi-workspace deployment that is not a hub answers every
+ * anonymous route the same way instead of 503 on `/pricing` and the alias
+ * workspace on `/flows/*`.
+ *
+ * The spoke-key arm and every refusal are unchanged; the hub cases here pin
+ * that a keyless call on a hub is refused by both resolvers alike.
+ *
+ * External dependency boundaries mocked:
+ *   - @working-theory/database (via the prisma singleton; __mocks__/prisma.ts)
+ */
+import { createHash } from "node:crypto";
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../lib/prisma.js");
+
+import { DEFAULT_WORKSPACE_ID } from "@working-theory/database/tenancy";
+import type { FastifyRequest } from "fastify";
+
+import * as configModule from "../../config/index.js";
+import type { HubSpokeKeyMode } from "../../config/index.js";
+import { __resetSiteWorkspaceCacheForTests } from "../../lib/site.js";
+import {
+  mockSentinelWorkspaceExists,
+  mockWorkspaceExists,
+} from "../../lib/__mocks__/prisma.js";
+import { prisma } from "../../lib/prisma.js";
+import {
+  __resetHubStatusForTests,
+  resolveCallerWorkspace,
+  resolvePublicWorkspace,
+} from "../public-site-resolver.js";
+
+const db = jest.mocked(prisma);
+
+const W1 = "wksp_01920000-0000-7000-8000-0000000000b1";
+const W2 = "wksp_01920000-0000-7000-8000-0000000000b2";
+const S1 = "spoke_01920000-0000-7000-8000-0000000000c1";
+const KEY_S1 = `ailk_spk_S1${"x".repeat(41)}`;
+
+const digest = (key: string) => createHash("sha256").update(key).digest("hex");
+
+/** A request double carrying only what the resolver may read. */
+function requestWith(headers: Record<string, string> = {}): FastifyRequest {
+  // eslint-disable-next-line no-restricted-syntax -- a FastifyRequest double carrying only the two members the resolver reads (headers, log)
+  return {
+    headers,
+    log: { warn: jest.fn(), info: jest.fn(), error: jest.fn() },
+  } as unknown as FastifyRequest;
+}
+
+function setMode(mode: HubSpokeKeyMode): void {
+  jest.replaceProperty(configModule, "config", {
+    ...configModule.config,
+    AILK_HUB_REQUIRE_SPOKE_KEY: mode,
+  });
+}
+
+/** A deployment with no spoke registered: not a hub (#7633 D1). */
+function notAHub(): void {
+  db.spoke.findFirst.mockResolvedValue(null);
+}
+
+/** A hub: its registry holds `S1` → `W1`. */
+function aHub(): void {
+  db.spoke.findFirst.mockResolvedValue({ id: S1 } as never);
+  db.spoke.findUnique.mockImplementation((async ({
+    where,
+  }: {
+    where: { credentialHash: string };
+  }) =>
+    where.credentialHash === digest(KEY_S1)
+      ? { id: S1, workspaceId: W1, revokedAt: null }
+      : null) as never);
+}
+
+/** Exactly one workspace, the seeded default on the sentinel Organization. */
+function oneWorkspaceDeployment(): void {
+  db.workspace.count.mockResolvedValue(1);
+  mockSentinelWorkspaceExists(db);
+}
+
+/** Three workspaces — the seeded default beside `W1` and `W2`. */
+function multiWorkspaceDeployment(): void {
+  db.workspace.count.mockResolvedValue(3);
+  mockSentinelWorkspaceExists(db, W1, W2);
+}
+
+const saved = {
+  adapter: process.env.CONTENT_ADAPTER,
+  databaseUrl: process.env.DATABASE_URL,
+  siteId: process.env.AILK_SITE_ID,
+};
+
+function restore(name: string, value: string | undefined): void {
+  if (value === undefined) delete process.env[name];
+  else process.env[name] = value;
+}
+
+beforeEach(() => {
+  jest.resetAllMocks();
+  process.env.DATABASE_URL = "postgres://stub";
+  process.env.CONTENT_ADAPTER = "database";
+  delete process.env.AILK_SITE_ID;
+  setMode("auto");
+  __resetHubStatusForTests();
+  __resetSiteWorkspaceCacheForTests();
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  restore("CONTENT_ADAPTER", saved.adapter);
+  restore("DATABASE_URL", saved.databaseUrl);
+  restore("AILK_SITE_ID", saved.siteId);
+});
+
+describe("a one-workspace deployment that is not a hub (#9145)", () => {
+  beforeEach(() => {
+    notAHub();
+    oneWorkspaceDeployment();
+  });
+
+  it("serves the same workspace through both resolvers", async () => {
+    const pub = await resolvePublicWorkspace(requestWith());
+    const caller = await resolveCallerWorkspace(requestWith());
+
+    expect(pub).toEqual({ kind: "resolved", workspaceId: DEFAULT_WORKSPACE_ID });
+    expect(caller).toEqual({
+      kind: "resolved",
+      workspaceId: DEFAULT_WORKSPACE_ID,
+      viaSpoke: false,
+    });
+  });
+
+  it("resolveCallerWorkspace answers the predicate on any content adapter — flows are database rows", async () => {
+    process.env.CONTENT_ADAPTER = "mdx";
+
+    await expect(resolveCallerWorkspace(requestWith())).resolves.toEqual({
+      kind: "resolved",
+      workspaceId: DEFAULT_WORKSPACE_ID,
+      viaSpoke: false,
+    });
+  });
+});
+
+describe("a multi-workspace deployment that is not a hub (#9145)", () => {
+  beforeEach(() => {
+    notAHub();
+    multiWorkspaceDeployment();
+  });
+
+  it("answers unresolved through both resolvers, though the default alias resolves", async () => {
+    const pub = await resolvePublicWorkspace(requestWith());
+    const caller = await resolveCallerWorkspace(requestWith());
+
+    expect(pub).toEqual({ kind: "unresolved", reason: "ambiguous" });
+    expect(caller).toEqual({ kind: "unresolved", reason: "ambiguous" });
+  });
+
+  it("answers unresolved through both, though AILK_SITE_ID names a real workspace", async () => {
+    process.env.AILK_SITE_ID = W1;
+
+    await expect(resolvePublicWorkspace(requestWith())).resolves.toEqual({
+      kind: "unresolved",
+      reason: "ambiguous",
+    });
+    await expect(resolveCallerWorkspace(requestWith())).resolves.toEqual({
+      kind: "unresolved",
+      reason: "ambiguous",
+    });
+  });
+});
+
+describe("a sole workspace that is not the seeded default (#9145)", () => {
+  it("answers unresolved through both, though AILK_SITE_ID names it", async () => {
+    notAHub();
+    process.env.AILK_SITE_ID = W1;
+    db.workspace.count.mockResolvedValue(1);
+    mockWorkspaceExists(db, W1);
+
+    await expect(resolvePublicWorkspace(requestWith())).resolves.toEqual({
+      kind: "unresolved",
+      reason: "ambiguous",
+    });
+    await expect(resolveCallerWorkspace(requestWith())).resolves.toEqual({
+      kind: "unresolved",
+      reason: "ambiguous",
+    });
+  });
+});
+
+describe("a hub (#9145 — the refusals are unchanged)", () => {
+  it("AILK_HUB_REQUIRE_SPOKE_KEY on refuses a keyless call through both, on a one-workspace deployment", async () => {
+    setMode("on");
+    notAHub();
+    oneWorkspaceDeployment();
+
+    await expect(resolvePublicWorkspace(requestWith())).resolves.toEqual({
+      kind: "unresolved",
+      reason: "spoke-refused",
+    });
+    await expect(resolveCallerWorkspace(requestWith())).resolves.toEqual({
+      kind: "unresolved",
+      reason: "spoke-refused",
+    });
+    expect(db.workspace.count).not.toHaveBeenCalled();
+  });
+
+  it("a registered spoke still resolves to its own workspace through both", async () => {
+    aHub();
+    multiWorkspaceDeployment();
+    const headers = { "x-ailk-spoke-key": KEY_S1 };
+
+    await expect(resolvePublicWorkspace(requestWith(headers))).resolves.toEqual({
+      kind: "resolved",
+      workspaceId: W1,
+    });
+    await expect(resolveCallerWorkspace(requestWith(headers))).resolves.toEqual({
+      kind: "resolved",
+      workspaceId: W1,
+      viaSpoke: true,
+      spokeId: S1,
+    });
+    expect(db.workspace.count).not.toHaveBeenCalled();
+  });
+});