create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/lib/__tests__/site.test.ts

@@ -0,0 +1,238 @@
+/**
+ * @file site.test.ts
+ * @description Coverage for the site-alias -> workspace resolution (#6155
+ * spec D2/D5/D6, AC-5): `resolveSiteWorkspaceId()`'s two-and-only-two
+ * resolution rule and `assertSiteAliasResolves()`'s startup refusal.
+ *
+ * Mocks the module-level `prisma` singleton via the repo's manual-mock
+ * convention (`apps/api/src/lib/__mocks__/prisma.ts`), the same shape
+ * `middleware/__tests__/default-tenant.test.ts` uses — this suite exercises
+ * the REAL `resolveSentinelWorkspaceRow` (`@working-theory/database/tenancy`,
+ * mapped straight to source by `jest.config.cjs`) against the mocked
+ * `prisma.workspace` delegate, not a re-implementation of it.
+ *
+ * `DATABASE_URL` is set globally by `src/__tests__/setup.ts`, so every case
+ * here runs past the D6 database-less carve-out and exercises the real
+ * resolution path. `CONTENT_ADAPTER` is pinned to `database` per-case below
+ * (#6228): the assertion's first arm now skips on any OTHER adapter, so a
+ * case that means to exercise the REAL resolution must say which adapter it
+ * is booting under rather than inherit whatever the ambient env holds.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../prisma.js");
+
+import { prisma } from "../prisma.js";
+
+import {
+  __resetSiteWorkspaceCacheForTests,
+  assertSiteAliasResolves,
+  currentSiteId,
+  resolveSiteWorkspaceId,
+} from "../site.js";
+
+const DEFAULT_ORG_ID = "org_00000000-0000-7000-8000-000000000001";
+const DEFAULT_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
+const PINNED_WORKSPACE_ID = "wksp_01930000-0000-7000-8000-000000000042";
+const NON_SENTINEL_ORG_ID = "org_01930000-0000-7bcd-8000-000000000002";
+
+const ORIGINAL_AILK_SITE_ID = process.env.AILK_SITE_ID;
+const ORIGINAL_CONTENT_ADAPTER = process.env.CONTENT_ADAPTER;
+
+beforeEach(() => {
+  // #6228 arm 0 — every case in this suite is about the alias->workspace
+  // resolution itself, which only the database adapter reaches.
+  process.env.CONTENT_ADAPTER = "database";
+});
+
+afterEach(() => {
+  if (ORIGINAL_CONTENT_ADAPTER === undefined) {
+    delete process.env.CONTENT_ADAPTER;
+  } else {
+    process.env.CONTENT_ADAPTER = ORIGINAL_CONTENT_ADAPTER;
+  }
+  __resetSiteWorkspaceCacheForTests();
+  jest.clearAllMocks();
+  if (ORIGINAL_AILK_SITE_ID === undefined) {
+    delete process.env.AILK_SITE_ID;
+  } else {
+    process.env.AILK_SITE_ID = ORIGINAL_AILK_SITE_ID;
+  }
+});
+
+describe("resolveSiteWorkspaceId / assertSiteAliasResolves (#6155 D2/D5/D6)", () => {
+  it("case 1 — resolves a pinned alias to the matching workspace, and the assertion returns without throwing", async () => {
+    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
+      id: PINNED_WORKSPACE_ID,
+      organizationId: NON_SENTINEL_ORG_ID,
+    });
+
+    const resolved = await resolveSiteWorkspaceId();
+
+    expect(resolved).toBe(PINNED_WORKSPACE_ID);
+    expect(prisma.workspace.findUnique).toHaveBeenCalledWith({
+      where: { id: PINNED_WORKSPACE_ID },
+    });
+    await expect(assertSiteAliasResolves()).resolves.toBeUndefined();
+  });
+
+  it("case 2 — the unset alias (the scaffold default) resolves to the seeded sentinel workspace (D2 rule 2)", async () => {
+    delete process.env.AILK_SITE_ID;
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
+      id: DEFAULT_WORKSPACE_ID,
+      organizationId: DEFAULT_ORG_ID,
+    });
+
+    const resolved = await resolveSiteWorkspaceId();
+
+    expect(resolved).toBe(DEFAULT_WORKSPACE_ID);
+    expect(prisma.workspace.findUnique).toHaveBeenCalledWith({
+      where: { id: DEFAULT_WORKSPACE_ID },
+    });
+    // resolveSentinelWorkspaceRow carries no workspace.count() gate (D2).
+    expect(prisma.workspace.count).not.toHaveBeenCalled();
+  });
+
+  it("case 3 — a pinned alias naming no workspace does not resolve, and the assertion rejects naming both the alias and AILK_SITE_ID", async () => {
+    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const resolved = await resolveSiteWorkspaceId();
+    expect(resolved).toBeNull();
+
+    await expect(assertSiteAliasResolves()).rejects.toThrow(
+      new RegExp(PINNED_WORKSPACE_ID.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")),
+    );
+    await expect(assertSiteAliasResolves()).rejects.toThrow(/AILK_SITE_ID/);
+  });
+
+  it("case 4 — memoized: a second resolveSiteWorkspaceId() call issues zero further Prisma queries", async () => {
+    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
+      id: PINNED_WORKSPACE_ID,
+      organizationId: NON_SENTINEL_ORG_ID,
+    });
+
+    const first = await resolveSiteWorkspaceId();
+    const second = await resolveSiteWorkspaceId();
+
+    expect(first).toBe(PINNED_WORKSPACE_ID);
+    expect(second).toBe(PINNED_WORKSPACE_ID);
+    expect(prisma.workspace.findUnique).toHaveBeenCalledTimes(1);
+  });
+
+  it("case 5 — the unset alias resolves to the sentinel on a MULTI-workspace deployment (the D2 rule-2 regression case)", async () => {
+    // The exact case resolveDefaultWorkspaceRow's workspace.count() gate
+    // would have refused — three workspaces exist, one of them the seeded
+    // sentinel, and AILK_SITE_ID is unpinned. resolveSentinelWorkspaceRow
+    // carries no count() gate, so this must still resolve.
+    delete process.env.AILK_SITE_ID;
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
+      id: DEFAULT_WORKSPACE_ID,
+      organizationId: DEFAULT_ORG_ID,
+    });
+
+    const resolved = await resolveSiteWorkspaceId();
+
+    expect(resolved).toBe(DEFAULT_WORKSPACE_ID);
+    expect(prisma.workspace.count).not.toHaveBeenCalled();
+    await expect(assertSiteAliasResolves()).resolves.toBeUndefined();
+  });
+
+  it("case 6 — the unset alias does not resolve when the sentinel workspace is absent — the misconfiguration AC-5 asks to fail loudly", async () => {
+    delete process.env.AILK_SITE_ID;
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const resolved = await resolveSiteWorkspaceId();
+    expect(resolved).toBeNull();
+
+    await expect(assertSiteAliasResolves()).rejects.toThrow(/AILK_SITE_ID/);
+  });
+
+  it("case 7 — a genuine thrown resolution error PROPAGATES and crashes the boot — it is NOT swallowed as a database-less carve-out", async () => {
+    // The code-review finding this case pins (#6155): the D6 carve-out is a
+    // presence check made BEFORE any query, never a catch around one that
+    // already ran. A reachable database that errors mid-query (a real
+    // connection failure, a permissions error) is exactly the
+    // misconfiguration class AC-5 exists to surface, so it must reject —
+    // not resolve silently the way the "cannot be attempted" cases do.
+    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
+    const connectionError = new Error("P1001: Can't reach database server");
+    (prisma.workspace.findUnique as jest.Mock).mockRejectedValue(
+      connectionError,
+    );
+
+    await expect(resolveSiteWorkspaceId()).rejects.toThrow(connectionError);
+    await expect(assertSiteAliasResolves()).rejects.toThrow(connectionError);
+  });
+
+  it("case 8 — prisma.workspace.findUnique missing entirely (a prisma double that never touches tenancy) is the ONLY case that skips without throwing", async () => {
+    // The exact shape that surfaced the D6 carve-out: a shared/global prisma
+    // test double (lib/__mocks__/prisma-client.js, and the many hand-rolled
+    // hoisted factories elsewhere) that declares no workspace delegate at
+    // all — the resolution could not even be ATTEMPTED. Distinguishes this
+    // from case 7's genuine mid-query failure: here findUnique is not a
+    // function at all, never called, never thrown from.
+    delete process.env.AILK_SITE_ID;
+    const original = prisma.workspace.findUnique;
+    // eslint-disable-next-line no-restricted-syntax -- deliberately simulating a prisma double that declares no `workspace.findUnique` delegate at all (the shape assertSiteAliasResolves()'s presence check exists to catch), restored in the finally block below.
+    (prisma.workspace as unknown as Record<string, unknown>).findUnique =
+      undefined;
+
+    try {
+      await expect(assertSiteAliasResolves()).resolves.toBeUndefined();
+    } finally {
+      prisma.workspace.findUnique = original;
+    }
+  });
+
+  it("currentSiteId() stays synchronous and byte-identical for the env-set case (NFR1)", () => {
+    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
+    expect(currentSiteId()).toBe(PINNED_WORKSPACE_ID);
+  });
+
+  it("currentSiteId() stays synchronous and byte-identical for the env-unset case (NFR1)", () => {
+    delete process.env.AILK_SITE_ID;
+    expect(currentSiteId()).toBe("default");
+  });
+});
+
+describe("assertSiteAliasResolves — the #6228 content-adapter carve-out (arm 0)", () => {
+  it("skips the assertion on a non-database adapter, even with DATABASE_URL set and unreachable", async () => {
+    // The scaffold-boot shape: create-ailk's verify-scaffold.mjs sets a
+    // PLACEHOLDER DATABASE_URL (validateConfig checks presence only, Prisma
+    // connects lazily), so arm 1 does not fire. Before #6228 the generated
+    // MDX site crashed at boot on `Can't reach database server`.
+    process.env.CONTENT_ADAPTER = "mdx";
+    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
+    (prisma.workspace.findUnique as jest.Mock).mockRejectedValue(
+      new Error("Can't reach database server at 127.0.0.1:5432"),
+    );
+
+    await expect(assertSiteAliasResolves()).resolves.toBeUndefined();
+    // The arm is a PRESENCE check made BEFORE any query — not a catch around
+    // one that already ran (the #6155 code-review finding this file's
+    // docblock records).
+    expect(prisma.workspace.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("skips on the projection adapter too — the arm is `not database`, not `is mdx`", async () => {
+    process.env.CONTENT_ADAPTER = "projection";
+    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
+
+    await expect(assertSiteAliasResolves()).resolves.toBeUndefined();
+    expect(prisma.workspace.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("still throws under the database adapter when the alias names no workspace", async () => {
+    // AC-2: the arm narrows WHICH boots are asserted, never WHAT the
+    // assertion decides once it runs.
+    process.env.CONTENT_ADAPTER = "database";
+    process.env.AILK_SITE_ID = PINNED_WORKSPACE_ID;
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await expect(assertSiteAliasResolves()).rejects.toThrow(/AILK_SITE_ID/);
+    expect(prisma.workspace.findUnique).toHaveBeenCalled();
+  });
+});

package/templates/apps/api/src/lib/__tests__/stripe.test.ts

@@ -0,0 +1,75 @@
+// oss: false
+/**
+ * apps/api stripe shim — surface-drift smoke tests.
+ *
+ * Ensures apps/api/src/lib/stripe.ts re-exports exactly what
+ * @working-theory/stripe-client exports, with no surface drift.
+ */
+
+jest.mock("@working-theory/stripe-client", () => ({
+  getStripeClient: jest.fn(),
+  assertSandboxKey: jest.fn(),
+  verifyWebhookSignature: jest.fn(),
+  createCheckoutSession: jest.fn(),
+  STRIPE_API_VERSION: "2023-10-16",
+  WEBHOOK_TOLERANCE_SECONDS: 300,
+  StripeConfigError: class StripeConfigError extends Error {},
+  StripeWebhookSignatureError: class StripeWebhookSignatureError extends Error {},
+  UnknownProductCodeError: class UnknownProductCodeError extends Error {},
+}));
+
+// Import the shim (not the wrapper directly)
+import * as stripeShim from "../stripe.js";
+import * as stripeClient from "@working-theory/stripe-client";
+
+describe("apps/api/src/lib/stripe — surface re-exports", () => {
+  it("exports getStripeClient as a function", () => {
+    expect(typeof stripeShim.getStripeClient).toBe("function");
+  });
+
+  it("exports assertSandboxKey as a function", () => {
+    expect(typeof stripeShim.assertSandboxKey).toBe("function");
+  });
+
+  it("exports verifyWebhookSignature as a function", () => {
+    expect(typeof stripeShim.verifyWebhookSignature).toBe("function");
+  });
+
+  it("exports createCheckoutSession as a function", () => {
+    expect(typeof stripeShim.createCheckoutSession).toBe("function");
+  });
+
+  it("exports STRIPE_API_VERSION", () => {
+    expect(stripeShim.STRIPE_API_VERSION).toBe("2023-10-16");
+  });
+
+  it("exports WEBHOOK_TOLERANCE_SECONDS", () => {
+    expect(stripeShim.WEBHOOK_TOLERANCE_SECONDS).toBe(300);
+  });
+
+  it("exports StripeConfigError as a constructor producing Error instances", () => {
+    expect(typeof stripeShim.StripeConfigError).toBe("function");
+    expect(new stripeShim.StripeConfigError()).toBeInstanceOf(Error);
+  });
+
+  it("exports StripeWebhookSignatureError as a constructor producing Error instances", () => {
+    expect(typeof stripeShim.StripeWebhookSignatureError).toBe("function");
+    expect(new stripeShim.StripeWebhookSignatureError()).toBeInstanceOf(Error);
+  });
+
+  it("exports UnknownProductCodeError as a constructor producing Error instances", () => {
+    expect(typeof stripeShim.UnknownProductCodeError).toBe("function");
+    expect(new stripeShim.UnknownProductCodeError()).toBeInstanceOf(Error);
+  });
+
+  it("shim functions are the same references as @working-theory/stripe-client exports", () => {
+    expect(stripeShim.getStripeClient).toBe(stripeClient.getStripeClient);
+    expect(stripeShim.assertSandboxKey).toBe(stripeClient.assertSandboxKey);
+    expect(stripeShim.verifyWebhookSignature).toBe(
+      stripeClient.verifyWebhookSignature,
+    );
+    expect(stripeShim.createCheckoutSession).toBe(
+      stripeClient.createCheckoutSession,
+    );
+  });
+});

package/templates/apps/api/src/lib/auth-email-budget.ts

@@ -0,0 +1,160 @@
+/**
+ * Per-recipient hourly send budget for the auth transactional-email relay
+ * (#5962 § D8c).
+ *
+ * WHY IT IS PER RECIPIENT AND NOT PER SITE. The first draft of #5962's spec
+ * carried a second, site-wide cap. It was removed, and its removal is the
+ * point of this module's shape: Better Auth writes the `Verification` row
+ * BEFORE it invokes `sendResetPassword`, so every attacker request both feeds
+ * a site-wide counter and refreshes its window — roughly one request per 72
+ * seconds would hold a site permanently at its cap and silence reset mail for
+ * EVERY user, indefinitely. A site-wide cap an attacker can hold open is a
+ * denial of the control it implements. `siteVolumeAlert()` below replaces it
+ * with an operator SIGNAL that never refuses a send.
+ *
+ * The per-recipient budget IS a lockout weapon, narrowly: an attacker who
+ * requests three resets for one address in an hour denies that person a reset
+ * for the rest of it. Accepted for the reason
+ * `services/project-listing-resume-email.ts` gives and this module can
+ * honestly claim — the window is an hour rather than forever, it clears
+ * itself, and it is bounded to ONE victim rather than to the whole site.
+ *
+ * SINGLE-REPLICA CAVEAT, stated rather than hidden: the store is an in-process
+ * Map, so on an N-instance deployment the effective ceiling is N × the cap.
+ * Identical to the caveat `middleware/rate-limit.ts` documents for itself. The
+ * durable alternative needs a table `database/auth/schema.prisma` does not
+ * have, and #5962 adds no migration (Q16).
+ *
+ * PII: the key is `sha256(lowercased recipient + ":" + kind)`. This module is
+ * memory an operator can dump, and a plaintext address in it would be a
+ * recipient list.
+ */
+
+import { createHash } from "node:crypto";
+
+import { getClock } from "@working-theory/common";
+
+/** The three fixed message kinds the relay will send. */
+export type AuthEmailKind =
+  | "password-reset"
+  | "email-verification"
+  | "password-changed";
+
+/** Sends allowed per (recipient, kind) per hour. */
+export const RECIPIENT_HOURLY_MAX = 3;
+
+/**
+ * Sends per hour, site-wide, past which ONE operator warning is logged. Never
+ * a refusal — see the module comment.
+ */
+export const SITE_HOURLY_ALERT_THRESHOLD = 50;
+
+const WINDOW_MS = 60 * 60 * 1000;
+
+/**
+ * Cap on distinct entries, independent of the time-based window. The key is
+ * derived from a caller-supplied address, so a caller minting a fresh address
+ * per request would otherwise grow the map without bound for the lifetime of
+ * one isolate. Same reasoning, same shape, as `rate-limit.ts`'s MAX_BUCKETS.
+ */
+export const MAX_BUCKETS = 10_000;
+
+type Bucket = { count: number; windowStartMs: number };
+
+const buckets = new Map<string, Bucket>();
+
+let siteWindowStartMs = 0;
+let siteCount = 0;
+let siteAlertedThisWindow = false;
+
+export interface BudgetOptions {
+  /** Explicit clock reading. Defaults to `getClock().now()`. Tests inject it. */
+  nowMs?: number;
+  /** Entry cap. Exposed for tests only — no production caller overrides it. */
+  maxBuckets?: number;
+}
+
+function bucketKey(recipient: string, kind: AuthEmailKind): string {
+  const normalized = recipient.trim().toLowerCase();
+  return createHash("sha256").update(`${normalized}:${kind}`).digest("hex");
+}
+
+/**
+ * Counts one send against `(recipient, kind)` and reports whether it may
+ * proceed.
+ *
+ * `false` means SUPPRESS THE SEND — it never means "tell the caller". The
+ * relay answers 202 either way, because an observable suppression is the same
+ * account-enumeration oracle the rest of this flow is built to close.
+ */
+export function consumeRecipientBudget(
+  recipient: string,
+  kind: AuthEmailKind,
+  options: BudgetOptions = {},
+): boolean {
+  const now = options.nowMs ?? getClock().now();
+  const maxBuckets = options.maxBuckets ?? MAX_BUCKETS;
+  const key = bucketKey(recipient, kind);
+
+  let bucket = buckets.get(key);
+
+  if (!bucket || now - bucket.windowStartMs >= WINDOW_MS) {
+    // A genuinely new identity at capacity evicts the single oldest-inserted
+    // entry (`Map` iteration order is insertion order) before inserting
+    // itself — O(1) amortized, and no behaviour change under the cap.
+    if (!buckets.has(key) && buckets.size >= maxBuckets) {
+      const oldestKey = buckets.keys().next().value;
+      if (oldestKey !== undefined) buckets.delete(oldestKey);
+    }
+    bucket = { count: 0, windowStartMs: now };
+    buckets.set(key, bucket);
+  }
+
+  if (bucket.count >= RECIPIENT_HOURLY_MAX) return false;
+
+  bucket.count += 1;
+  return true;
+}
+
+/**
+ * Counts one send site-wide and reports whether THIS call is the one that
+ * should emit the hourly operator warning.
+ *
+ * It is a signal, not a gate: nothing in this module consults its return value
+ * to deny a send, and nothing may be added that does.
+ */
+export function siteVolumeAlert(options: BudgetOptions = {}): boolean {
+  const now = options.nowMs ?? getClock().now();
+
+  if (now - siteWindowStartMs >= WINDOW_MS) {
+    siteWindowStartMs = now;
+    siteCount = 0;
+    siteAlertedThisWindow = false;
+  }
+
+  siteCount += 1;
+
+  if (siteCount >= SITE_HOURLY_ALERT_THRESHOLD && !siteAlertedThisWindow) {
+    siteAlertedThisWindow = true;
+    return true;
+  }
+  return false;
+}
+
+/** Test-only reset. Not intended for production use. */
+export function __resetAuthEmailBudget(): void {
+  buckets.clear();
+  siteWindowStartMs = 0;
+  siteCount = 0;
+  siteAlertedThisWindow = false;
+}
+
+/** Test-only accessor for the distinct-bucket count. */
+export function __authEmailBucketCount(): number {
+  return buckets.size;
+}
+
+/** Test-only accessor proving the stored keys carry no plaintext address. */
+export function __authEmailBudgetKeys(): string[] {
+  return [...buckets.keys()];
+}

package/templates/apps/api/src/lib/content-adapter.ts

@@ -1,12 +1,13 @@
 /**
  * Shared content adapter singleton for apps/api.
  *
- * The MDX adapter is the v1 default. Set `CONTENT_ADAPTER=projection` to opt
- * into the build-time projection adapter backed by a compiled manifest.
+ * Adapter selection is NOT decided here — it is `resolveContentAdapter()`'s job
+ * (#5804, roadmap D3: one resolver, one env var). This module supplies the
+ * app's own inputs (content root, default locale, manifest path, the projection
+ * factory) and memoises the result for the process.
  *
- * Adapter selection:
- *   - (unset or any value other than "projection") → MDX adapter
- *   - "projection" → projection adapter (requires compiled manifest)
+ * `CONTENT_ADAPTER` selects: `mdx` (default) | `projection` | `database`.
+ * `CONTENT_BACKEND` is read for one more release by the resolver's shim.
  *
  * Content-root resolution order:
  *   1. `CONTENT_ROOT` env var (explicit override — recommended for production)
@@ -15,13 +16,27 @@
  *
  * Manifest-path resolution (projection only):
  *   1. `MANIFEST_PATH` env var (explicit override)
- *   2. `<content-root>/.compiled/manifest.json` (default)
+ *   2. `<content-root>/.compiled/manifest.json` (the resolver's default)
+ *
+ * `workspaceId` is supplied by the CALLER, never read here (#5852). A public
+ * read resolves its workspace through `services/public-site-resolver.ts` and
+ * passes the result in; a caller that passes none still raises the resolver's
+ * "workspaceId required" error under `CONTENT_ADAPTER=database`, rather than
+ * silently reading some other workspace's pages. There is no local ADAPTER memo
+ * slot: `resolveContentAdapter()` already memoises on the full key
+ * (kind + workspaceId + root + locale + manifest), and a second cache keyed on
+ * less than that is how one workspace's adapter reaches the next request. This
+ * module's own INPUTS — the content root and the default locale, both
+ * workspace-independent and both fixed for the process — stay memoised, so a
+ * public read costs no more filesystem work than it did before the seam widened.
  */
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 
 import {
-  createMdxAdapter,
+  resetResolvedContentAdapter,
+  resolveContentAdapter,
+  type ArtifactPrismaClient,
   type ContentAdapter,
   type MdxContentAdapter,
 } from "@working-theory/content-adapters";
@@ -30,7 +45,17 @@ import { loadManifestFromDisk } from "@working-theory/content-projection/node";
 
 import { readDefaultLocale } from "./locales.js";
 
-let cachedAdapter: ContentAdapter | undefined;
+/** Process-fixed inputs, resolved once: neither depends on the workspace. */
+let memoisedContentRoot: string | undefined;
+let memoisedDefaultLocale: string | undefined;
+
+/** Caller-supplied inputs; everything else is this module's own (#5852 D5). */
+export interface GetContentAdapterOptions {
+  /** The resolved tenant. Required by `CONTENT_ADAPTER=database`, ignored otherwise. */
+  workspaceId?: string | undefined;
+  /** apps/api's client. The database adapter never constructs one. */
+  prisma?: ArtifactPrismaClient | undefined;
+}
 
 /**
  * Resolve the content root. Honours `CONTENT_ROOT` env first, then probes the
@@ -50,37 +75,38 @@ export function getContentRoot(): string {
 }
 
 /**
- * Returns the process-wide content adapter, lazily constructed on first use.
- * Safe to call repeatedly. Adapter type is determined by `CONTENT_ADAPTER` env.
+ * Returns the content adapter for the given tenant, memoised by the resolver.
+ * Safe to call repeatedly. Adapter type is determined by `CONTENT_ADAPTER` env,
+ * read by the resolver.
  */
-export function getContentAdapter(): ContentAdapter {
-  if (!cachedAdapter) {
-    cachedAdapter = buildAdapter();
-  }
-  return cachedAdapter;
-}
-
-function buildAdapter(): ContentAdapter {
-  const contentRoot = getContentRoot();
-
-  if (process.env.CONTENT_ADAPTER === "projection") {
-    const manifestPath =
-      process.env.MANIFEST_PATH ??
-      resolve(contentRoot, ".compiled", "manifest.json");
-
-    const manifest = loadManifestFromDisk(manifestPath);
-    return createProjectionAdapter({ manifest });
-  }
+export function getContentAdapter(
+  options: GetContentAdapterOptions = {},
+): ContentAdapter {
+  memoisedContentRoot ??= getContentRoot();
+  memoisedDefaultLocale ??= readDefaultLocale();
 
-  return createMdxAdapter({ contentRoot, defaultLocale: readDefaultLocale() });
+  return resolveContentAdapter({
+    workspaceId: options.workspaceId,
+    prisma: options.prisma,
+    contentRoot: memoisedContentRoot,
+    defaultLocale: memoisedDefaultLocale,
+    manifestPath: process.env.MANIFEST_PATH,
+    // The projection adapter lives in a package that depends on
+    // content-adapters, so the resolver cannot import it without closing a
+    // cycle. apps/api depends on both, and injects it.
+    createProjectionAdapter: (manifestPath) =>
+      createProjectionAdapter({ manifest: loadManifestFromDisk(manifestPath) }),
+  });
 }
 
 /**
- * Test/utility helper — drop the cached adapter so the next call rebuilds
+ * Test/utility helper — drop the memoised adapter so the next call rebuilds
  * with current env. Not used in production.
  */
 export function resetContentAdapter(): void {
-  cachedAdapter = undefined;
+  memoisedContentRoot = undefined;
+  memoisedDefaultLocale = undefined;
+  resetResolvedContentAdapter();
 }
 
 export type { MdxContentAdapter };

package/templates/apps/api/src/lib/deliverable-asset-store.ts

@@ -0,0 +1,76 @@
+// oss: false
+/**
+ * The magnet-deliverable Asset store's data-access boundary (#6310 D16).
+ *
+ * `deliverable-fulfillment.ts` resolves `deliverables.assets[].assetKey`
+ * against the workspace-scoped `Asset` model before falling back to the
+ * legacy `DeliverableAsset` store (D1/D2), and the download route
+ * (`routes/deliverables/index.ts`) serves an `asset_`-class grant's bytes
+ * from the same model (D6). Neither caller may run a raw `prisma.asset`
+ * query directly — that access is banned by the tenant-scope
+ * `forbidden_pattern` in architecture.yaml — and neither is `lib/asset-store.ts`
+ * a fit: it is `workspace`/`multi-tenant`-owned (`MODULE_SLICES`), so a
+ * `signal-collectors` file (the route) cannot import it, and
+ * `deliverable-fulfillment.ts` ships in every scaffold regardless of module
+ * selection. This file is its own named boundary instead — modelled
+ * line-for-line on `lib/asset-store.ts` — exporting exactly two scoped
+ * reads and nothing else:
+ *
+ *   - `findDeliverableAssetIdByKey(workspaceId, key)` — the mint-time
+ *     resolution (D2): does an `Asset` exist at this workspace's `key`?
+ *   - `readDeliverableAsset(assetId, workspaceId)` — the serve-time read
+ *     (D6): the bytes, scoped by the `workspaceId` the grant carries
+ *     (D15), so a rewritten or mis-set grant can never serve another
+ *     workspace's bytes.
+ *
+ * No write, no `findMany`, no list, no unscoped read — both functions take
+ * a `workspaceId` the caller resolved server-side, never a client-supplied
+ * value, so neither can enumerate or cross a tenant boundary (NFR3).
+ */
+import { prisma } from "./prisma.js";
+
+/** What the mint-time resolution needs, and nothing more. */
+export async function findDeliverableAssetIdByKey(
+  workspaceId: string,
+  key: string,
+): Promise<string | null> {
+  const row = await prisma.asset.findFirst({
+    where: { workspaceId, key },
+    select: { id: true },
+  });
+  return row?.id ?? null;
+}
+
+/** What the serve path needs, and deliberately nothing more (no key, no workspace). */
+export type DeliverableAssetBytes = {
+  filename: string;
+  contentType: string;
+  bytes: Buffer;
+};
+
+/**
+ * Resolve one asset's bytes by id, scoped by `workspaceId` (D15). A foreign-
+ * workspace id — or any other miss — returns `null`; the caller turns that
+ * into the same uniform 404 an unknown grant gets (D6/FR5).
+ */
+export async function readDeliverableAsset(
+  assetId: string,
+  workspaceId: string | null,
+): Promise<DeliverableAssetBytes | null> {
+  if (workspaceId === null) return null;
+
+  const row = await prisma.asset.findFirst({
+    where: { id: assetId, workspaceId },
+    select: { filename: true, contentType: true, bytes: true },
+  });
+  if (!row) return null;
+
+  return {
+    ...row,
+    // Prisma maps a `Bytes` column to `Uint8Array`, and Fastify treats only
+    // a `Buffer` as a raw payload — this wraps rather than copies
+    // (`Buffer.from(buffer, byteOffset, length)` is a view), mirroring
+    // `asset-store.ts`'s own identical wrap.
+    bytes: Buffer.from(row.bytes.buffer, row.bytes.byteOffset, row.bytes.byteLength),
+  };
+}