create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/__tests__/workspace-module-registration.test.ts

@@ -58,11 +58,20 @@ const SHARED_TENANT_ROUTES = [
   { method: 'GET' as const, url: `/v1/workspaces/${WS}/members` },
 ];
 
-/** Routes that must stay multi-tenant-only — the gate's other half. */
+/**
+ * Routes that must NOT register under `workspace` alone — the gate's other
+ * half. `/v1/waitlist-experiments` is on this list because the review surface
+ * is gated on `multi-tenant || signal-collectors` (#5677), neither of which is
+ * enabled in this file's `workspace`-only cases; it is no longer
+ * multi-tenant-EXCLUSIVE, and its own matrix is
+ * `review-surface-registration.test.ts`.
+ */
 const MULTI_TENANT_ONLY_ROUTES = [
   { method: 'GET' as const, url: '/v1/workspaces' },
   { method: 'GET' as const, url: '/v1/billing' },
   { method: 'GET' as const, url: '/v1/waitlist-experiments' },
+  { method: 'POST' as const, url: `/v1/workspaces/${WS}/activate` },
+  { method: 'GET' as const, url: `/v1/workspaces/${WS}/sessions` },
 ];
 
 async function withEnabledModules<T>(

package/templates/apps/api/src/config/index.ts

@@ -54,6 +54,41 @@ export interface Config {
   // origin, which stays correct for any agent that fetched the spec from this
   // API. See resolveServers() in src/openapi/spec.ts.
   AILK_PUBLIC_API_URL?: string;
+
+  // Request-and-confirm (#5970) — the callback → confirm → Payment Link path.
+  // All five optional and all read through services/request-confirm.ts, never
+  // from here directly; they are declared so the env contract is complete and
+  // one place lists them.
+  //
+  // AILK_REQUEST_CONFIRM_ENABLED is the switch: "true" turns the path on,
+  // anything else (including absent, the default) leaves the callback route
+  // behaving byte-for-byte as it did before the feature existed. TO and FROM
+  // fall back to the AILK_LEAD_NOTIFICATION_* pair; the link's base is the
+  // existing AILK_PUBLIC_API_URL above, since the confirm route is on this
+  // API. None of the five is a secret, so project.yaml's required_secrets
+  // gains nothing.
+  AILK_REQUEST_CONFIRM_ENABLED?: string;
+  AILK_REQUEST_CONFIRM_TO?: string;
+  AILK_REQUEST_CONFIRM_FROM?: string;
+  AILK_REQUEST_CONFIRM_CURRENCY?: string;
+  AILK_REQUEST_CONFIRM_MAX_MINOR?: string;
+
+  // Publish revalidation (#5851) — the signed webhook services/revalidation.ts
+  // POSTs at the site's /api/revalidate on publish/unpublish.
+  // CONTENT_REVALIDATE_SECRET is the HMAC-SHA256 signing key. Both optional;
+  // either absent means "revalidation off" — the service is a logged no-op and
+  // the publish that called it still completes.
+  CONTENT_REVALIDATE_URL?: string;
+  CONTENT_REVALIDATE_SECRET?: string;
+
+  // Scheduling webhook receiver (#6085, brief H7) — the HMAC-SHA256 key
+  // routes/webhooks/calcom.ts verifies POST /v1/webhooks/calcom's
+  // x-cal-signature-256 header against (§ D2, § D14). Read the same way
+  // STRIPE_WEBHOOK_SECRET is above — through `config`, never `process.env`
+  // at the call site. Unset makes the receiver answer 503 and accept
+  // nothing (§ D2 row 1) — the same fail-closed posture STRIPE_WEBHOOK_SECRET
+  // unset already has.
+  CAL_WEBHOOK_SECRET?: string;
 }
 
 function validateConfig(): Config {
@@ -104,6 +139,33 @@ function validateConfig(): Config {
     ...(process.env.AILK_PUBLIC_API_URL !== undefined && {
       AILK_PUBLIC_API_URL: process.env.AILK_PUBLIC_API_URL,
     }),
+
+    ...(process.env.AILK_REQUEST_CONFIRM_ENABLED !== undefined && {
+      AILK_REQUEST_CONFIRM_ENABLED: process.env.AILK_REQUEST_CONFIRM_ENABLED,
+    }),
+    ...(process.env.AILK_REQUEST_CONFIRM_TO !== undefined && {
+      AILK_REQUEST_CONFIRM_TO: process.env.AILK_REQUEST_CONFIRM_TO,
+    }),
+    ...(process.env.AILK_REQUEST_CONFIRM_FROM !== undefined && {
+      AILK_REQUEST_CONFIRM_FROM: process.env.AILK_REQUEST_CONFIRM_FROM,
+    }),
+    ...(process.env.AILK_REQUEST_CONFIRM_CURRENCY !== undefined && {
+      AILK_REQUEST_CONFIRM_CURRENCY: process.env.AILK_REQUEST_CONFIRM_CURRENCY,
+    }),
+    ...(process.env.AILK_REQUEST_CONFIRM_MAX_MINOR !== undefined && {
+      AILK_REQUEST_CONFIRM_MAX_MINOR: process.env.AILK_REQUEST_CONFIRM_MAX_MINOR,
+    }),
+
+    ...(process.env.CONTENT_REVALIDATE_URL !== undefined && {
+      CONTENT_REVALIDATE_URL: process.env.CONTENT_REVALIDATE_URL,
+    }),
+    ...(process.env.CONTENT_REVALIDATE_SECRET !== undefined && {
+      CONTENT_REVALIDATE_SECRET: process.env.CONTENT_REVALIDATE_SECRET,
+    }),
+
+    ...(process.env.CAL_WEBHOOK_SECRET !== undefined && {
+      CAL_WEBHOOK_SECRET: process.env.CAL_WEBHOOK_SECRET,
+    }),
   };
 }
 

package/templates/apps/api/src/config/modules.ts

@@ -12,9 +12,13 @@
  * Recognized module keys: `docs`, `multi-tenant`, `workspace`, `scheduling`,
  * `signal-collectors`, `commerce` (the `ModuleName` vocabulary
  * `packages/create-ailk/src/module-architecture.ts` already models via
- * `MODULE_SLICES`) plus `content-write` — the Pro
- * content-write surface (`create`/`update`/`delete` under
- * `apps/api/src/routes/content/`). `content-write` is intentionally NOT a
+ * `MODULE_SLICES`) plus `content-write` — the Pro content-write surface,
+ * which since #5853 means the tenant-guarded editor routes in
+ * `apps/api/src/routes/workspaces/content.ts` (the untenanted
+ * `create`/`update`/`delete` under `apps/api/src/routes/content/` that it used
+ * to name were retired by deletion). The flag's NAME, registration grain and
+ * default-off semantics are unchanged (D8) — only its documented meaning
+ * widened. `content-write` is intentionally NOT a
  * `MODULE_SLICES` entry: it is not (yet) a `create-ailk --modules`
  * selector — a customer never opts into it at scaffold time, it is a
  * license-tier line drawn inside the single `apps/api` app — so it stays a

package/templates/apps/api/src/lib/__mocks__/prisma.ts

@@ -27,7 +27,14 @@
  *   idempotency reader) + callback.findMany (booked-call suppression) +
  *   waitlistScore.findMany (tier lookup) — used by the #4732
  *   waitlist-followup sweep service tests
- *   tenancy models (workspace, membership) — used by tenant-context service tests (#3627)
+ *   tenancy models (workspace, membership) — used by tenant-context service tests (#3627).
+ *   workspace.findUnique carries NO default (#6335) — see its own comment
+ *   below. A suite whose route resolves a workspace states the shape it
+ *   expects through `mockWorkspaceExists()` / `mockNoWorkspace()`, exported
+ *   at the foot of this file
+ *   artifact models (artifact, artifactVersion) — the database content
+ *   adapter's read surface, used by the public-site-resolver + content route
+ *   tests (#5852)
  *   membership.findMany + lead.findMany/updateMany — used by lead-promotion
  *   service tests (#3586); lead-promotion.ts never queries membership/workspace
  *   directly (it resolves workspaces via tenant-context.ts's listTenancy), so
@@ -49,6 +56,10 @@
  * #3739 M2 — was `findMany` + a JS accumulation loop). Same not-yet-
  * generated-client situation; `usage-aggregation.ts` casts `prisma` to its
  * own structural delegate type, and this mock's runtime shape matches it.
+ *
+ * userData.create/updateMany (auth) + siteSetting.findUnique (config) — the
+ * dunning record's compare-and-swap write and the per-tenant grace-policy
+ * read (#6034), used by dunning-policy.test.ts and stripe-dunning.test.ts.
  */
 
 export const prisma = {
@@ -68,6 +79,13 @@ export const prisma = {
     findUnique: jest.fn(),
     upsert: jest.fn(),
     deleteMany: jest.fn(),
+    // `create` / `updateMany` — the dunning record's compare-and-swap write
+    // (#6034 § D6): the webhook reads `{value, updatedAt}` then either
+    // `create`s a fresh row or `updateMany`s guarded on BOTH observed
+    // columns, so a concurrent writer makes the predicate miss (`count: 0`)
+    // rather than silently losing a revocation.
+    create: jest.fn(),
+    updateMany: jest.fn(),
   },
   // ── Tenancy namespace (Organization, Workspace, Membership) ──────────────
   organization: {
@@ -84,6 +102,29 @@ export const prisma = {
     updateMany: jest.fn(),
   },
   workspace: {
+    // #6335 — NO default implementation, deliberately. Until this issue the
+    // delegate carried a PERMISSIVE one (#6203): it resolved ANY requested
+    // id as an existing workspace with a sentinel-shaped organizationId, so
+    // every tenancy resolver in a route test saw "this workspace exists" no
+    // matter what the test had set up. That is DEF-014 — a fixture that
+    // fabricates the condition under test: a route that should have failed
+    // closed passed, and every isolation-shaped test written against this
+    // mock inherited a fake success.
+    //
+    // A bare `jest.fn()` resolves `undefined`, which every resolver in
+    // `apps/api/src/lib/site.ts` reads as "no such workspace" and rejects —
+    // so a suite that needs a workspace to resolve must SAY SO, keyed on the
+    // id it actually expects to be asked for:
+    //
+    //   mockWorkspaceExists(prisma, SITE_ID)  // only SITE_ID resolves
+    //   mockSentinelWorkspaceExists(prisma)   // the "default" alias path
+    //   mockNoWorkspace(prisma)               // nothing resolves
+    //
+    // Keying on the requested id is the load-bearing part.
+    // `resolveWorkspaceIdForAlias` returns the ALIAS on mere truthiness of
+    // the row (`site.ts`) — it never reads the row's own id — so a mock that
+    // resolves unconditionally is permissive by accident even when it hands
+    // back a specific-looking row.
     findUnique: jest.fn(),
     count: jest.fn(),
   },
@@ -92,6 +133,18 @@ export const prisma = {
     findMany: jest.fn(),
     create: jest.fn(),
   },
+  // ── Artifact store (the database content adapter's read surface, #5852) ──
+  // Only the two readers `ArtifactPrismaClient` declares for reads
+  // (packages/content-adapters/src/database/adapter.ts): the public content
+  // routes never write, so no `create`/`updateMany`/`deleteMany` is faked here.
+  artifact: {
+    findFirst: jest.fn(),
+    findMany: jest.fn(),
+  },
+  artifactVersion: {
+    findFirst: jest.fn(),
+    findMany: jest.fn(),
+  },
   // ── Config namespace (per-workspace site config — #3641/#3634) ───────────
   workspaceTheme: {
     findUnique: jest.fn(),
@@ -114,6 +167,9 @@ export const prisma = {
     // `findUnique` — used by the deliverable-resend service (#3998) to
     // resolve a grant's stored lead email.
     findUnique: jest.fn(),
+    // `findFirst` — the leads-inbox cursor lookup (#5678), which resolves a
+    // supplied cursor WITHIN the caller's scope before paging from it.
+    findFirst: jest.fn(),
     findMany: jest.fn(),
     updateMany: jest.fn(),
   },
@@ -124,9 +180,16 @@ export const prisma = {
   // `findMany` — the #4732 follow-up sweep's booked-call suppression check
   // (D2: a site's Callback rows fetched once per sweep run, filtered in
   // application code for `payload.email` matches).
+  // findFirst / update / updateMany joined for the #5970 request-and-confirm
+  // lifecycle: the credential mint and the confirmation claim are both guarded
+  // `updateMany`s, the GET resolves through `findFirst`, and the Stripe
+  // artifact id lands via `update`.
   callback: {
     create: jest.fn(),
+    findFirst: jest.fn(),
     findMany: jest.fn(),
+    update: jest.fn(),
+    updateMany: jest.fn(),
   },
   // ── Inbox namespace (FlowDefinition, FlowSession — #3956) ────────────────
   // findMany on both models — used by the abandon-email sweep (#3962 D4),
@@ -134,6 +197,10 @@ export const prisma = {
   // policy) and every candidate FlowSession per definition.
   flowDefinition: {
     findUnique: jest.fn(),
+    // #6314 — `startProjectListingDraft` resolves the capturing listicle
+    // magnet through `findFirst` (slug + siteId + workspaceId + kind), so the
+    // delegate needs it here as well as `findUnique`.
+    findFirst: jest.fn(),
     findMany: jest.fn(),
     upsert: jest.fn(),
   },
@@ -153,13 +220,21 @@ export const prisma = {
   },
   // `update` — the send-outcome stamp (#3998 D1). `findMany` — the
   // deliverable:resend CLI's list mode (#3998 D4), selecting on
-  // `sendStatus: null`.
+  // `sendStatus: null`. `workspaceId` (#6310 D15) rides `create`'s existing
+  // `data` shape — no new delegate method.
   deliverableGrant: {
     create: jest.fn(),
     findUnique: jest.fn(),
     update: jest.fn(),
     findMany: jest.fn(),
   },
+  // ── Content namespace (Asset — #5854/#6093, extended #6310 D16) ──────────
+  // `findFirst` — the ONLY method `lib/asset-store.ts`'s public read and
+  // `lib/deliverable-asset-store.ts`'s two scoped reads need. No write, no
+  // `findMany`, no `findUnique` — neither boundary enumerates or mutates.
+  asset: {
+    findFirst: jest.fn(),
+  },
   // ── Inbox namespace (FlowCheckout — #4837 D4) ─────────────────────────────
   // `create` — recordCheckout's one write; `update` — attachStripeSession;
   // `updateMany` — the webhook's guarded status stamp (#4838); `findUnique` /
@@ -179,6 +254,19 @@ export const prisma = {
   siteListingConfig: {
     findUnique: jest.fn(),
   },
+  // ── Config namespace (SiteSetting — #6034 § D4) ──────────────────────────
+  // `findUnique` — the ONLY read path (`dunningPolicyFor`). #6374 D3 changed
+  // its KEY SHAPE, not its arity: `site_settings` is now unique on
+  // (workspace_id, key), so the call is
+  // `findUnique({ where: { workspaceId_key: { workspaceId, key } } })` and
+  // the `key` string still carries the site alias it always did. The
+  // delegate itself is unchanged — a `jest.fn()` does not care about the
+  // selector shape — but the comment is, so a reader programming this mock
+  // writes the compound selector rather than the removed bare `key`. No
+  // route in this repo writes SiteSetting; no write delegate is mocked.
+  siteSetting: {
+    findUnique: jest.fn(),
+  },
   // ── Inbox namespace (ProjectListing — #4998, reshaped #5033) ─────────────
   // `create` — the POST route's row write (after routeLead's Lead write).
   // `findFirst` — the tenant-scoped get/patch reads (scoped by siteId + id, a
@@ -254,6 +342,19 @@ export const prisma = {
     createMany: jest.fn(),
     findMany: jest.fn(),
   },
+  // ── Inbox namespace (Appointment — #6085, brief H7) ──────────────────────
+  // `updateMany` — the § D7(a) guarded write, one per family (lifecycle /
+  // payment / no-show); `findFirst` — the disambiguating read on a zero-match
+  // updateMany (row absent vs. present-with-newer-watermark); `create` — the
+  // create-eligible arm, wrapped in the caller's own `isUniqueViolation`
+  // retry. `findMany` — the tenant-scoped GET /v1/schedule/appointments read
+  // (apps/api/src/routes/schedule/appointments.ts).
+  appointment: {
+    create: jest.fn(),
+    findFirst: jest.fn(),
+    findMany: jest.fn(),
+    updateMany: jest.fn(),
+  },
   // ── Content namespace (UsageEvent, UsagePeriod — FEAT-047 P1.S1/#3709) ──
   usageEvent: {
     create: jest.fn(),
@@ -287,3 +388,141 @@ export const prisma = {
   $connect: jest.fn(),
   $disconnect: jest.fn(),
 };
+
+
+// ── #6335 — the explicit workspace fixtures ──────────────────────────────
+//
+// These replace the permissive `workspace.findUnique` default. They take the
+// prisma double they are to program as their FIRST argument, rather than
+// reaching for the `prisma` const above: a test importing this file directly
+// gets its own module instance (Jest keeps manual mocks in a registry of
+// their own, separate from the one a plain `require` of this path fills), so
+// a helper that closed over the local `prisma` would program an object no
+// route ever reads. Passing the double the suite already imports from
+// `../lib/prisma.js` is what makes these work from any suite.
+
+/**
+ * The structural shape the helpers below need — deliberately NOT
+ * `typeof prisma`, so a suite can pass the `prisma` it imported from
+ * `lib/prisma.js` (typed as the real client) with no cast at the call site.
+ */
+type WorkspaceMockHost = { workspace: { findUnique: unknown } };
+
+/**
+ * The sentinel Organization id the seeded default workspace hangs off
+ * (`database/tenancy.ts`'s reserved-range predicate, ADR-0031 rule 7).
+ * `resolveSentinelWorkspaceRow` rejects a default-workspace row whose
+ * `organizationId` falls outside that range, so the `"default"` alias path
+ * resolves only when the mocked row carries this value.
+ */
+export const SENTINEL_ORGANIZATION_ID =
+  "org_00000000-0000-7000-8000-000000000001";
+
+/** The seeded sentinel workspace id — `DEFAULT_WORKSPACE_ID` in `database/tenancy.ts`. */
+export const SENTINEL_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
+
+/**
+ * The organization an ORDINARY workspace hangs off, and deliberately NOT a
+ * sentinel one: its uuid carries non-zero timestamp bits, so
+ * `isSentinel()` (`packages/ids`, `^00000000-0000-7000-8000-…`) is false
+ * for it.
+ *
+ * Stamping the sentinel org on every mocked workspace would be its own
+ * DEF-014: `organizationId` is read off this exact row as an AUTHORIZATION
+ * input — `tenant-context.ts` denies a stale session when it disagrees with
+ * the session's active org, and `isPlatformOperator`
+ * (`waitlist-operator-reads.ts`) is `isSentinel(organizationId) && role ===
+ * "owner"`, which grants cross-SITE read scope over every site's signup
+ * PII. A helper that made every workspace sentinel-org would hand a future
+ * ordinary-tenant fixture a platform-operator identity, and would make
+ * "two workspaces in different organizations" inexpressible — so the
+ * stale-session deny branch could never be driven through it.
+ */
+export const ORDINARY_ORGANIZATION_ID =
+  "org_01920000-0000-7000-8000-0000000000aa";
+
+/** One workspace row a suite says exists: an id, or an id bound to a named org. */
+export type MockWorkspaceRow =
+  | string
+  | { readonly id: string; readonly organizationId: string };
+
+function workspaceFindUnique(client: WorkspaceMockHost): jest.Mock {
+  const delegate = client.workspace?.findUnique;
+  if (typeof delegate !== "function" || !("mockImplementation" in delegate)) {
+    throw new Error(
+      "[#6335] prisma.workspace.findUnique is not a jest mock — the suite " +
+        "must jest.mock() its prisma module before calling this helper.",
+    );
+  }
+  return delegate as unknown as jest.Mock;
+}
+
+/**
+ * States, for one test or one suite, EXACTLY which workspace ids exist
+ * (#6335). Every other id — a foreign one, a spoofed one, an unset one —
+ * resolves `null`, so a route that resolves a tenancy scope fails closed
+ * unless the test named the id under test.
+ *
+ * Keyed on the REQUESTED id, and that is the load-bearing part:
+ * `resolveWorkspaceIdForAlias` (`apps/api/src/lib/site.ts`) returns the
+ * ALIAS on mere truthiness of the row it gets back and never reads that
+ * row's own id, so a blanket `mockResolvedValue({ … })` resolves whatever
+ * it is handed — permissive by another name, and the rejection cases each
+ * suite now carries could not tell the two apart.
+ *
+ * Call it from a suite's `beforeEach`, AFTER any `jest.clearAllMocks()`.
+ */
+export function mockWorkspaceExists(
+  client: WorkspaceMockHost,
+  ...rows: readonly MockWorkspaceRow[]
+): void {
+  const existing = new Map<string, string>();
+  for (const row of rows) {
+    if (typeof row === "string") {
+      // The sentinel workspace is the ONE row that hangs off the sentinel
+      // organization; everything else gets an ordinary one. See
+      // ORDINARY_ORGANIZATION_ID for why this distinction is load-bearing.
+      existing.set(
+        row,
+        row === SENTINEL_WORKSPACE_ID
+          ? SENTINEL_ORGANIZATION_ID
+          : ORDINARY_ORGANIZATION_ID,
+      );
+    } else {
+      existing.set(row.id, row.organizationId);
+    }
+  }
+  workspaceFindUnique(client).mockImplementation(
+    ({ where }: { where: { id: string } }) =>
+      Promise.resolve(
+        existing.has(where.id)
+          ? { id: where.id, organizationId: existing.get(where.id) }
+          : null,
+      ),
+  );
+}
+
+/**
+ * The `"default"` site alias's resolution path (#6335): `currentSiteId()`
+ * returns `"default"`, `resolveWorkspaceIdForAlias` hands that to
+ * `resolveSentinelWorkspaceRow`, and only the well-known sentinel workspace
+ * — hanging off the sentinel Organization — satisfies it. Any further ids
+ * passed resolve beside it.
+ */
+export function mockSentinelWorkspaceExists(
+  client: WorkspaceMockHost,
+  ...alsoExisting: readonly MockWorkspaceRow[]
+): void {
+  mockWorkspaceExists(client, SENTINEL_WORKSPACE_ID, ...alsoExisting);
+}
+
+/**
+ * The REJECTION path (#6335): no workspace resolves, whatever is asked for.
+ * Every suite that depends on an explicit `mockWorkspaceExists` carries at
+ * least one test using this, so that explicit setup is proven load-bearing
+ * rather than decorative — a route that quietly stopped resolving a tenancy
+ * scope would otherwise pass both ways.
+ */
+export function mockNoWorkspace(client: WorkspaceMockHost): void {
+  workspaceFindUnique(client).mockResolvedValue(null);
+}

package/templates/apps/api/src/lib/__tests__/auth-email-budget.test.ts

@@ -0,0 +1,143 @@
+/**
+ * @file auth-email-budget.test.ts — the per-recipient hourly send budget (#5962 § D8c).
+ *
+ * Written before the implementation. The five properties that matter:
+ *   - the bucket counts per (recipient, kind) and caps at three per hour;
+ *   - the window rolls, so an hour later the recipient is clear again;
+ *   - the store is bounded (MAX_BUCKETS eviction), because the key is a
+ *     caller-supplied address and an attacker can mint unlimited distinct ones;
+ *   - a recipient is keyed by a HASH, never by the plaintext address — this
+ *     module is memory an operator can dump;
+ *   - the site threshold is an operator SIGNAL, never a refusal. A site-wide
+ *     cap an attacker can hold open is an indefinitely-holdable lockout
+ *     (§ D8c, Q6), so nothing here may deny a send because of it.
+ *
+ * Time is injected rather than faked: the module reads `getClock().now()` by
+ * default and accepts an explicit `nowMs`, which is the seam this suite uses.
+ */
+
+import {
+  consumeRecipientBudget,
+  siteVolumeAlert,
+  RECIPIENT_HOURLY_MAX,
+  SITE_HOURLY_ALERT_THRESHOLD,
+  __resetAuthEmailBudget,
+  __authEmailBucketCount,
+  __authEmailBudgetKeys,
+} from "../auth-email-budget.js";
+
+const T0 = 1_700_000_000_000;
+const ONE_HOUR_MS = 60 * 60 * 1000;
+
+beforeEach(() => {
+  __resetAuthEmailBudget();
+});
+
+describe("consumeRecipientBudget()", () => {
+  it("allows the first RECIPIENT_HOURLY_MAX sends and refuses the next", () => {
+    for (let i = 0; i < RECIPIENT_HOURLY_MAX; i++) {
+      expect(
+        consumeRecipientBudget("user@example.com", "password-reset", {
+          nowMs: T0,
+        }),
+      ).toBe(true);
+    }
+    expect(
+      consumeRecipientBudget("user@example.com", "password-reset", {
+        nowMs: T0,
+      }),
+    ).toBe(false);
+  });
+
+  it("counts per (recipient, kind) — a reset flood cannot exhaust the notice", () => {
+    for (let i = 0; i < RECIPIENT_HOURLY_MAX; i++) {
+      consumeRecipientBudget("user@example.com", "password-reset", {
+        nowMs: T0,
+      });
+    }
+    expect(
+      consumeRecipientBudget("user@example.com", "password-changed", {
+        nowMs: T0,
+      }),
+    ).toBe(true);
+  });
+
+  it("is case- and whitespace-insensitive on the recipient", () => {
+    for (let i = 0; i < RECIPIENT_HOURLY_MAX; i++) {
+      consumeRecipientBudget("User@Example.com", "password-reset", {
+        nowMs: T0,
+      });
+    }
+    expect(
+      consumeRecipientBudget(" user@example.com ", "password-reset", {
+        nowMs: T0,
+      }),
+    ).toBe(false);
+  });
+
+  it("clears itself when the hour rolls", () => {
+    for (let i = 0; i < RECIPIENT_HOURLY_MAX; i++) {
+      consumeRecipientBudget("user@example.com", "password-reset", {
+        nowMs: T0,
+      });
+    }
+    expect(
+      consumeRecipientBudget("user@example.com", "password-reset", {
+        nowMs: T0,
+      }),
+    ).toBe(false);
+    expect(
+      consumeRecipientBudget("user@example.com", "password-reset", {
+        nowMs: T0 + ONE_HOUR_MS + 1,
+      }),
+    ).toBe(true);
+  });
+
+  it("bounds the store — a fresh identity at capacity evicts the oldest", () => {
+    const cap = 50;
+    for (let i = 0; i < cap + 10; i++) {
+      consumeRecipientBudget(`user${i}@example.com`, "password-reset", {
+        nowMs: T0,
+        maxBuckets: cap,
+      });
+    }
+    expect(__authEmailBucketCount()).toBeLessThanOrEqual(cap);
+  });
+
+  it("never stores the plaintext recipient", () => {
+    consumeRecipientBudget("secret-person@example.com", "password-reset", {
+      nowMs: T0,
+    });
+    expect(__authEmailBudgetKeys().join("|")).not.toContain("secret-person");
+    expect(__authEmailBudgetKeys().join("|")).not.toContain("@example.com");
+  });
+});
+
+describe("siteVolumeAlert()", () => {
+  it("does not fire below the threshold", () => {
+    for (let i = 0; i < SITE_HOURLY_ALERT_THRESHOLD - 1; i++) {
+      expect(siteVolumeAlert({ nowMs: T0 })).toBe(false);
+    }
+  });
+
+  it("fires ONCE per hour past the threshold, and never refuses a send", () => {
+    let fired = 0;
+    for (let i = 0; i < SITE_HOURLY_ALERT_THRESHOLD + 25; i++) {
+      if (siteVolumeAlert({ nowMs: T0 })) fired++;
+    }
+    expect(fired).toBe(1);
+
+    // The signal is not a gate: a recipient under their own budget still sends.
+    expect(
+      consumeRecipientBudget("fresh@example.com", "password-reset", {
+        nowMs: T0,
+      }),
+    ).toBe(true);
+
+    let firedNextHour = 0;
+    for (let i = 0; i < SITE_HOURLY_ALERT_THRESHOLD + 1; i++) {
+      if (siteVolumeAlert({ nowMs: T0 + ONE_HOUR_MS + 1 })) firedNextHour++;
+    }
+    expect(firedNextHour).toBe(1);
+  });
+});

package/templates/apps/api/src/lib/__tests__/content-adapter.test.ts

@@ -5,11 +5,15 @@
  *   (a) CONTENT_ADAPTER unset → MDX adapter (existing behavior preserved)
  *   (b) CONTENT_ADAPTER=projection + valid manifest → projection adapter, read parity vs MDX
  *   (c) CONTENT_ADAPTER=projection + missing manifest → clear actionable error at construction
+ *   (d) CONTENT_ADAPTER=database with no workspaceId → the resolver's named error
+ *   (e) CONTENT_ADAPTER=database with a workspaceId → an adapter, not a throw (#5852)
  */
 import { join, resolve } from "node:path";
 import { mkdirSync, writeFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 
+import { DEFAULT_WORKSPACE_ID } from "@working-theory/database/tenancy";
+
 import {
   getContentAdapter,
   getContentRoot,
@@ -151,6 +155,25 @@ describe("getContentAdapter() factory", () => {
       expect(() => getContentAdapter()).toThrow("pnpm content:compile");
     });
   });
+
+  describe("(d) CONTENT_ADAPTER=database → the resolver's workspaceId error", () => {
+    test("throws naming workspaceId, because apps/api does not resolve a tenant yet (#5323)", () => {
+      process.env.CONTENT_ADAPTER = "database";
+
+      expect(() => getContentAdapter()).toThrow(/workspaceId/);
+      expect(() => getContentAdapter()).toThrow(/CONTENT_ADAPTER=database/);
+    });
+  });
+
+  describe("(e) CONTENT_ADAPTER=database + a workspaceId → an adapter (#5852)", () => {
+    test("builds the database adapter instead of throwing, once the caller resolves a tenant", () => {
+      process.env.CONTENT_ADAPTER = "database";
+
+      const adapter = getContentAdapter({ workspaceId: DEFAULT_WORKSPACE_ID });
+      expect(adapter).toBeDefined();
+      expect(typeof adapter.getPageBySlug).toBe("function");
+    });
+  });
 });
 
 describe("getContentRoot()", () => {