create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/server.ts

@@ -11,15 +11,23 @@
  */
 import cors from "@fastify/cors";
 import rateLimit from "@fastify/rate-limit";
+import { idRegex } from "@working-theory/ids";
 import Fastify from "fastify";
-import type { FastifyPluginAsync, FastifyPluginCallback } from "fastify";
+import type {
+  FastifyPluginAsync,
+  FastifyPluginCallback,
+  FastifyRequest,
+} from "fastify";
 
 import { config } from "./config/index.js";
 import { isModuleEnabled } from "./config/modules.js";
 import { registerErrorSerializer } from "./lib/error-serializer.js";
 import { validateLeadCaptureDir } from "./lib/lead-capture-store.js";
+import { requireCommerceClaim } from "./lib/require-commerce-claim.js";
+import { assertSiteAliasResolves } from "./lib/site.js";
 import { loadSlice } from "./lib/slice-load.js";
 import { authPreHandlerPlugin } from "./middleware/auth.js";
+import { defaultTenantPreHandlerPlugin } from "./middleware/default-tenant.js";
 import {
   rateLimitMiddleware,
   DEFAULT_PER_IP_PER_MINUTE_STRICT,
@@ -36,24 +44,87 @@ import {
 import type { RegisteredRoute } from "./openapi/surface-drift.js";
 import { exampleAeoRoute, scoreAeoRoute } from "./routes/aeo/index.js";
 import { tokenRoutes } from "./routes/auth/tokens.js";
+import { transactionalEmailRoute } from "./routes/auth/transactional-email.js";
 import { userRoutes } from "./routes/auth/user.js";
 import { getPageRoute } from "./routes/content/get-page.js";
 import { listPagesRoute } from "./routes/content/list-pages.js";
 import { listTypesRoute } from "./routes/content/list-types.js";
 import {
+  CONTENT_RATE_LIMIT_AUTH,
   CONTENT_RATE_LIMIT_UNAUTH,
   CONTENT_RATE_LIMIT_WINDOW,
 } from "./routes/content/rate-limit.js";
+import { searchContentRoute } from "./routes/content/search.js";
 import {
   leadCallbackRoute,
   leadSubmitRoute,
   leadSubscribeRoute,
 } from "./routes/leads/index.js";
+import { leadListRoute } from "./routes/leads/list.js";
+import { requestRoutes } from "./routes/requests/index.js";
 import {
   registerTestAuthRoute,
   shouldMountTestAuth,
 } from "./routes/test/auth/session.js";
 
+/**
+ * What a request looks like in a log line — Fastify's own default shape, minus
+ * the QUERY STRING (#5970 security review).
+ *
+ * Exported so the property can be asserted directly rather than inferred from
+ * a captured line, because the thing it protects is easy to regress silently:
+ * pino's stock `req` serializer logs `req.raw.url` verbatim, and a route may
+ * carry its credential there. `GET /v1/requests/:id/confirm?token=…` does,
+ * since a link in an email has nowhere else to put one, and that token is live
+ * for seven days and mints a chargeable Stripe artifact.
+ *
+ * Nothing that identifies a request is lost: a route parameter such as `:id`
+ * lives in the PATH and survives. Only the secret after `?` is dropped.
+ *
+ * #6084 D14 — `GET /v1/checkout/sessions/:id` puts its credential in the
+ * PATH, not the query string, so the strip above does not cover it: every
+ * request would otherwise write a live `cs_…` Checkout Session id into the
+ * log — contradicting D3 and `sessions.ts`'s own stated invariant that only
+ * the first 8 characters of a session id ever reach a log line. A path
+ * SEGMENT rule (never a substring replace) truncates any `cs_…`-shaped
+ * segment to its first 8 characters plus `…`, so it cannot corrupt an
+ * unrelated URL.
+ *
+ * #6216 D11/§ 9 A-3 — the SAME rule now carries a second arm for
+ * `lead_…`-shaped segments. Fastify's automatic "incoming request" line is
+ * emitted by its internal hook BEFORE any route hook can intervene, so
+ * every `GET`/`PATCH .../workspaces/:workspaceId/messages/:leadId` would
+ * otherwise write the lead id into the log beside `remoteAddress` —
+ * completing exactly the `leadId` ↔ `siteId`/`ip`/`user-agent` correlation
+ * `routes/leads/index.ts` and this file's own PII posture refuse. No
+ * route-level discipline can fix it; this is the only place that can.
+ */
+const SESSION_ID_LOG_SEGMENT = /^cs_[A-Za-z0-9_]+$/;
+const LEAD_ID_LOG_SEGMENT = idRegex("lead");
+
+function redactSensitiveIdSegments(url: string): string {
+  return url
+    .split("/")
+    .map((segment) =>
+      SESSION_ID_LOG_SEGMENT.test(segment) || LEAD_ID_LOG_SEGMENT.test(segment)
+        ? `${segment.slice(0, 8)}…`
+        : segment,
+    )
+    .join("/");
+}
+
+export function requestLogSerializer(request: FastifyRequest) {
+  const raw = request.url;
+  const queryAt = raw.indexOf("?");
+  const path = queryAt === -1 ? raw : raw.slice(0, queryAt);
+  return {
+    method: request.method,
+    url: redactSensitiveIdSegments(path),
+    host: request.hostname,
+    remoteAddress: request.ip,
+  };
+}
+
 /**
  * Paid-module SLICE entry points, keyed by the export each branch needs
  * (#5182).
@@ -132,11 +203,21 @@ const WORKSPACES_SESSIONS = "./routes/workspaces/sessions.js";
 const WORKSPACES_CONFIG = "./routes/workspaces/config.js";
 const WORKSPACES_GENERAL = "./routes/workspaces/general.js";
 const WORKSPACES_MEMBERS = "./routes/workspaces/members.js";
+// #6216 — a SIBLING specifier registered in the SAME workspace/multi-tenant
+// scope as WORKSPACES_GENERAL/WORKSPACES_MEMBERS below, not the
+// multi-tenant-only family WORKSPACES_MEETINGS/WORKSPACES_CONFIG sit in.
+const WORKSPACES_MESSAGES = "./routes/workspaces/messages.js";
+// #6183 S9b — a SEPARATE specifier from WORKSPACES_CONFIG: this route is
+// registered under isModuleEnabled("scheduling") alone, never the
+// workspace/multi-tenant scope config.js shares with general.js/members.js
+// (see config.ts's own header for why).
+const WORKSPACES_MEETINGS = "./routes/workspaces/meetings.js";
+const WORKSPACES_CONTENT = "./routes/workspaces/content.js";
+const ASSETS_UPLOAD = "./routes/assets/upload.js";
+const ASSETS_READ = "./routes/assets/read.js";
+const ASSETS_MANAGE = "./routes/assets/manage.js";
 const BILLING_INDEX = "./routes/billing/index.js";
 const WAITLIST_EXPERIMENTS_INDEX = "./routes/waitlist-experiments/index.js";
-const CONTENT_CREATE = "./routes/content/create.js";
-const CONTENT_UPDATE = "./routes/content/update.js";
-const CONTENT_DELETE = "./routes/content/delete.js";
 const SCHEDULE_INDEX = "./routes/schedule/index.js";
 const FLOWS_INDEX = "./routes/flows/index.js";
 const DELIVERABLES_INDEX = "./routes/deliverables/index.js";
@@ -146,7 +227,9 @@ const WAITLIST_SIGNUPS_INDEX = "./routes/waitlist-signups/index.js";
 const CHECKOUT_INDEX = "./routes/checkout/index.js";
 const WEBHOOKS_INDEX = "./routes/webhooks/index.js";
 const FLOW_CHECKOUTS_INDEX = "./routes/flow-checkouts/index.js";
+const SUBSCRIPTION_INDEX = "./routes/subscription/index.js";
 const RECOMMENDER_INDEX = "./routes/flows/recommender.js";
+const MAGNETS_INDEX = "./routes/magnets/index.js";
 
 /**
  * Paid-module SLICE entry points, keyed by the export each branch needs.
@@ -181,6 +264,33 @@ const SLICE_PLUGINS = {
     specifier: WORKSPACES_MEMBERS,
     load: () => import(WORKSPACES_MEMBERS),
   },
+  // #6216 — the Inbox message API, the SAME scope as the two above.
+  workspaceMessageRoutes: {
+    specifier: WORKSPACES_MESSAGES,
+    load: () => import(WORKSPACES_MESSAGES),
+  },
+  // #6183 S9b — registered in the scheduling scope, not the
+  // workspace/multi-tenant scope its siblings above share.
+  workspaceMeetingsRoutes: {
+    specifier: WORKSPACES_MEETINGS,
+    load: () => import(WORKSPACES_MEETINGS),
+  },
+  workspaceContentRoutes: {
+    specifier: WORKSPACES_CONTENT,
+    load: () => import(WORKSPACES_CONTENT),
+  },
+  workspaceAssetUploadRoute: {
+    specifier: ASSETS_UPLOAD,
+    load: () => import(ASSETS_UPLOAD),
+  },
+  publicAssetReadRoute: {
+    specifier: ASSETS_READ,
+    load: () => import(ASSETS_READ),
+  },
+  workspaceAssetManageRoutes: {
+    specifier: ASSETS_MANAGE,
+    load: () => import(ASSETS_MANAGE),
+  },
   billingRoutes: {
     specifier: BILLING_INDEX,
     load: () => import(BILLING_INDEX),
@@ -189,18 +299,6 @@ const SLICE_PLUGINS = {
     specifier: WAITLIST_EXPERIMENTS_INDEX,
     load: () => import(WAITLIST_EXPERIMENTS_INDEX),
   },
-  createPageRoute: {
-    specifier: CONTENT_CREATE,
-    load: () => import(CONTENT_CREATE),
-  },
-  updatePageRoute: {
-    specifier: CONTENT_UPDATE,
-    load: () => import(CONTENT_UPDATE),
-  },
-  deletePageRoute: {
-    specifier: CONTENT_DELETE,
-    load: () => import(CONTENT_DELETE),
-  },
   listAvailabilityRoute: {
     specifier: SCHEDULE_INDEX,
     load: () => import(SCHEDULE_INDEX),
@@ -213,6 +311,20 @@ const SLICE_PLUGINS = {
     specifier: SCHEDULE_INDEX,
     load: () => import(SCHEDULE_INDEX),
   },
+  // #6183 S9b D2/D12 — the enabled-meeting-slugs public read; same
+  // specifier as the three anonymous schedule routes above (§ D6's
+  // precedent, no new SLICE_PLUGINS specifier constant needed).
+  meetingTypesRoute: {
+    specifier: SCHEDULE_INDEX,
+    load: () => import(SCHEDULE_INDEX),
+  },
+  // #6085 — the tenant-guarded appointments read; same specifier as the
+  // three anonymous schedule routes above (§ D6, no new SLICE_PLUGINS
+  // specifier constant needed).
+  listAppointmentsRoute: {
+    specifier: SCHEDULE_INDEX,
+    load: () => import(SCHEDULE_INDEX),
+  },
   getFlowRoute: {
     specifier: FLOWS_INDEX,
     load: () => import(FLOWS_INDEX),
@@ -225,6 +337,12 @@ const SLICE_PLUGINS = {
     specifier: FLOWS_INDEX,
     load: () => import(FLOWS_INDEX),
   },
+  // #6157 — the tenant-scoped magnet Admin authoring surface. ONE plugin,
+  // ONE specifier (D2): all four routes register through this one entry.
+  magnetRoutes: {
+    specifier: MAGNETS_INDEX,
+    load: () => import(MAGNETS_INDEX),
+  },
   deliverableDownloadRoute: {
     specifier: DELIVERABLES_INDEX,
     load: () => import(DELIVERABLES_INDEX),
@@ -263,9 +381,13 @@ const SLICE_PLUGINS = {
     specifier: WAITLIST_SIGNUPS_INDEX,
     load: () => import(WAITLIST_SIGNUPS_INDEX),
   },
-  // Commerce (D-47, #5364) — checkout, the Stripe webhook receiver, flow
-  // checkouts and the recommender. Module-conditional (isModuleEnabled
-  // "commerce") like every other paid slice above.
+  // Commerce (D-47, #5364), re-cut by D-64 (#5796). `checkoutRoutes` and
+  // `webhooksRoutes` are the base-tree PRIMITIVES now: they register
+  // UNCONDITIONALLY and gate at call time on the `commerce` license claim
+  // (lib/require-commerce-claim.ts), so they are no longer slice-gated even
+  // though they still load through this table. `flowCheckoutRoutes` and the
+  // two recommender entries below stay module-conditional (isModuleEnabled
+  // "commerce") — they are commerce OVERLAY, not primitives.
   checkoutRoutes: {
     specifier: CHECKOUT_INDEX,
     load: () => import(CHECKOUT_INDEX),
@@ -278,6 +400,13 @@ const SLICE_PLUGINS = {
     specifier: FLOW_CHECKOUTS_INDEX,
     load: () => import(FLOW_CHECKOUTS_INDEX),
   },
+  // #6038 — the buyer-scoped subscription-status route pair (the
+  // update-your-card banner's read + portal handoff). Commerce OVERLAY,
+  // same posture as flowCheckoutRoutes immediately above.
+  subscriptionRoutes: {
+    specifier: SUBSCRIPTION_INDEX,
+    load: () => import(SUBSCRIPTION_INDEX),
+  },
   saveRecommendationRoute: {
     specifier: RECOMMENDER_INDEX,
     load: () => import(RECOMMENDER_INDEX),
@@ -334,6 +463,27 @@ async function tenantPreHandlerSlicePlugin(): Promise<FastifyPluginCallback> {
   return plugin;
 }
 
+/**
+ * The tenant guard THIS build runs (#5677). Exactly one of the two, never
+ * both: the multi-tenant module's `resolveActiveTenant` guard when the module
+ * is enabled, and the base-build default-workspace guard
+ * (`middleware/default-tenant.ts`) otherwise.
+ *
+ * Precedence, not parallelism. On a build WITH the module this returns the
+ * identical plugin every tenant scope registered before, so multi-tenant
+ * resolution and behavior are unchanged. On a build without it, the base guard
+ * resolves the seeded default Workspace (`database/tenancy.ts`) under the same
+ * default-deny posture — which is what makes the already-built review
+ * dashboard reachable at Pro instead of leaving its routes unregistered.
+ *
+ * The base guard is a STATIC import, not a slice load: it always ships.
+ */
+async function tenantPreHandlerForBuild(): Promise<FastifyPluginCallback> {
+  return isModuleEnabled("multi-tenant")
+    ? await tenantPreHandlerSlicePlugin()
+    : defaultTenantPreHandlerPlugin;
+}
+
 /**
  * The commerce boot-time sandbox guard — the one other slice entry that is
  * not a route plugin, mirroring `tenantPreHandlerSlicePlugin()` above (D3).
@@ -363,12 +513,22 @@ export async function build() {
   // Startup-time validation: fail fast if LEAD_CAPTURE_FILE points at a missing directory.
   await validateLeadCaptureDir();
 
+  // #6155 D6 — the site-alias workspace assertion (ownership brief § Layer
+  // 2, AC-5): resolves + asserts once at startup that AILK_SITE_ID (or its
+  // "default" fallback) names a real workspace, throwing when it does not —
+  // the same catch-log-exit(1) path index.ts already runs on this throws
+  // loud rather than serving empty lists. Carve-out: with no DATABASE_URL
+  // configured, it logs a warning and returns instead of throwing (a
+  // database-less dev boot).
+  await assertSiteAliasResolves();
+
   // Runtime sandbox-mode guard: reject live-mode Stripe keys before any
   // webhook or checkout call can exercise them. Idempotent — safe even if
-  // assertSandboxKey is called again inside a route handler. Module-
-  // conditional (commerce, D-47/D3): a build without commerce has no
-  // commerce request path to guard, and lib/stripe.ts is stripped with it.
-  if (isModuleEnabled("commerce") && config.STRIPE_SECRET_KEY) {
+  // assertSandboxKey is called again inside a route handler. UNCONDITIONAL
+  // since D-64 (#5796): the commerce primitives and lib/stripe.ts are base
+  // tree now, so the key's presence — not a module flag — is the whole
+  // question. A build with no STRIPE_SECRET_KEY has nothing to assert.
+  if (config.STRIPE_SECRET_KEY) {
     await assertCommerceSandboxKey(config.STRIPE_SECRET_KEY);
   }
 
@@ -395,7 +555,27 @@ export async function build() {
   // (server-action-forwarded traffic), which was previously broken for
   // every caller.
   const server = Fastify({
-    logger: true,
+    logger: {
+      // The request serializer drops the QUERY STRING (#5970 security review,
+      // finding 1). Fastify's default `req` serializer logs `req.raw.url`
+      // verbatim, so any route whose credential rides in the query string
+      // writes that credential into the API's own log on every single request
+      // — including the automatic "incoming request" line, which is emitted by
+      // Fastify's internal hook before any route-level hook can intervene.
+      //
+      // `GET /v1/requests/:id/confirm?token=…` is exactly such a route: the
+      // token IS the authorization, it is live for seven days, and holding it
+      // is enough to read a requester's name and phone and to mint a Payment
+      // Link on the site's own Stripe account. `Referrer-Policy: no-referrer`
+      // on that route exists to keep the token out of a THIRD PARTY's logs;
+      // this keeps it out of ours, which is the larger hole of the two.
+      //
+      // The shape is otherwise Fastify's own default, minus the query: a log
+      // consumer reading `method` + `url` + `remoteAddress` sees what it
+      // always saw. Nothing that identifies a REQUEST is lost — `:id` is in
+      // the path and survives; only the secret after `?` is dropped.
+      serializers: { req: requestLogSerializer },
+    },
     trustProxy: true,
   });
 
@@ -527,6 +707,18 @@ export async function build() {
       );
     }
 
+    // The leads INBOX read (#5678) — auth only, NOT tenant-guarded, for the
+    // same reason as the three reads below: the tenant scope is registered
+    // only when the multi-tenant module is present, and lead capture is a
+    // never-gate surface at EVERY level, so reading a lead back cannot be
+    // gated on a module either. Registered unconditionally — it is the one
+    // route in this scope with no `isModuleEnabled()` gate. Identity is
+    // `request.userId`; the scope is resolved from the caller's own
+    // memberships by `services/leads-inbox.ts` through
+    // `services/owner-workspaces.ts`'s `resolveOwnerWorkspaces`, never from a
+    // request parameter.
+    await authScope.register(leadListRoute);
+
     // Respondent signup read (#4731) — auth only, NOT tenant-guarded: a
     // respondent has no workspace membership and the tenant guard is
     // default-deny. Identity is request.userId; the service re-checks
@@ -546,6 +738,17 @@ export async function build() {
       await authScope.register(await sliceRoutePlugin("flowCheckoutRoutes"));
     }
 
+    // The update-your-card banner's read + portal handoff (#6038) — the
+    // same posture as flow-checkouts immediately above: auth only, NOT
+    // tenant-guarded (a subscriber has no workspace membership). Identity is
+    // request.userId; GET is cookie-or-bearer, POST refuses bearer callers
+    // (D3.1). Module-conditional (commerce, D8): the account page's
+    // subscription-status read already degrades to "no banner" with no code
+    // change when this is absent (SKIPPED_STATUSES covers 404 — spec §4.2).
+    if (isModuleEnabled("commerce")) {
+      await authScope.register(await sliceRoutePlugin("subscriptionRoutes"));
+    }
+
     // The founder's OWN listings read (#5295) — the same posture again: auth
     // only, NOT tenant-guarded, because a founder is not a workspace member
     // and the tenant guard is default-deny. Identity is request.userId; the
@@ -580,6 +783,35 @@ export async function build() {
         await tenantScope.register(await sliceRoutePlugin("sessionRoutes"));
         // Org-billing routes (#3701) — org-scoped read + Stripe customer-portal.
         await tenantScope.register(await sliceRoutePlugin("billingRoutes"));
+      });
+    }
+
+    // REVIEW-SURFACE routes — a sibling tenant scope, gated on EITHER module
+    // (#5677). The waitlist operator dashboard and the project-listings
+    // dashboard were registered inside the multi-tenant scope above, which was
+    // too narrow: `signal-collectors` (Pro) is the module that SELLS the
+    // instruments these routes read back — flows, deliverables, project
+    // listings, waitlist experiments — so a Pro customer could collect
+    // submissions and not read them. That was an accident of registration
+    // scope, not a pricing decision (#5677). Widening the gate is the
+    // correction.
+    //
+    // This is a REGISTRATION change, not a tenant-isolation change. The scope
+    // registers `tenantPreHandlerForBuild()`, which on a multi-tenant build is
+    // byte-for-byte the guard these two route plugins already ran behind, and
+    // on a build without the module is the base-build guard with the same
+    // default-deny posture over the seeded default Workspace. Each plugin
+    // registers exactly once — they live here and nowhere else, so the scopes
+    // cannot collide on a path — and every OTHER route in the scope above
+    // (workspaceSessionRoutes, sessionRoutes, billingRoutes) stays
+    // multi-tenant-only: those are Organization/Workspace administration, not
+    // a site's own submissions.
+    if (
+      isModuleEnabled("multi-tenant") ||
+      isModuleEnabled("signal-collectors")
+    ) {
+      await authScope.register(async (tenantScope) => {
+        await tenantScope.register(await tenantPreHandlerForBuild());
         // Waitlist operator-dashboard read API (#4665 D7, B0) — tenant-scoped
         // list/comparison/signups reads over A1's waitlist-experiment rows.
         await tenantScope.register(
@@ -593,6 +825,51 @@ export async function build() {
       });
     }
 
+    // The magnet Admin authoring surface (#6157 S5c) — its OWN sibling
+    // tenant scope (D3), not a line inside the review-surface scope above:
+    // its module-exclusion row stays its own, and the scope can be read,
+    // moved or gated without disturbing `waitlistExperimentRoutes` /
+    // `projectListingTenantRoutes`. Gated `multi-tenant || signal-collectors`
+    // (D4), VERBATIM the review-surface expression above — not narrowed to
+    // `(multi-tenant || signal-collectors) && <tenancy module>`, which would
+    // put the magnet surface out of reach of `marketing-site` (the Pro
+    // flagship template, which takes `signal-collectors` WITHOUT
+    // `multi-tenant`). The delivery is brought up to the gate instead
+    // (`packages/create-ailk/src/module-architecture.ts` D14/D15/D16), the
+    // same correction #5677 already made once for this exact scope.
+    if (
+      isModuleEnabled("multi-tenant") ||
+      isModuleEnabled("signal-collectors")
+    ) {
+      await authScope.register(async (tenantScope) => {
+        await tenantScope.register(await tenantPreHandlerForBuild());
+        await tenantScope.register(await sliceRoutePlugin("magnetRoutes"));
+      });
+    }
+
+    // The appointments read (#6085, brief H7) — a sibling tenant scope,
+    // gated on `scheduling` alone (§ D6). NOT the anonymous schedule scope
+    // below (`isModuleEnabled("scheduling")`'s OTHER site, § 1.9/§ D6): a
+    // prospect booking a call has no account, so that scope carries no
+    // auth preHandler, and mounting this read there would publish every
+    // attendee's name and email to the internet. `tenantPreHandlerForBuild()`
+    // is the SAME default-deny guard the review-surface scope above uses —
+    // on a build with no `multi-tenant` module it fails closed unless
+    // `AILK_OPERATOR_EMAIL` is pinned (`middleware/default-tenant.ts`).
+    //
+    // The meetings config route (#6183 S9b) shares this exact scope and
+    // gate, for the same reason: its GET reaches
+    // apps/api/src/services/scheduling/ (D24's listEventTypes join), which
+    // is undeliverable to a scaffold without this module — see
+    // routes/workspaces/meetings.ts's own header.
+    if (isModuleEnabled("scheduling")) {
+      await authScope.register(async (tenantScope) => {
+        await tenantScope.register(await tenantPreHandlerForBuild());
+        await tenantScope.register(await sliceRoutePlugin("listAppointmentsRoute"));
+        await tenantScope.register(await sliceRoutePlugin("workspaceMeetingsRoutes"));
+      });
+    }
+
     // Workspace SETTINGS routes — a sibling tenant scope, gated on EITHER
     // module (#5371 D2). The site-config routes were registered inside the
     // multi-tenant scope above, which was too narrow: nothing in their logic
@@ -603,18 +880,30 @@ export async function build() {
     // original mis-scoping twice.
     //
     // This is a REGISTRATION change, not a tenant-isolation change: the scope
-    // registers its own `tenantPreHandlerSlicePlugin()`, the same default-deny
-    // guard the scope above uses, with the same `resolveActiveTenant` behind
-    // it. Every other route in that scope (workspaceSessionRoutes,
-    // sessionRoutes, billingRoutes, waitlistExperimentRoutes, the
-    // project-listings tenant routes) stays multi-tenant-only.
+    // registers its own `tenantPreHandlerForBuild()`, the same default-deny
+    // guard the scopes above use. The remaining routes in the multi-tenant
+    // scope above (workspaceSessionRoutes, sessionRoutes, billingRoutes) stay
+    // multi-tenant-only.
+    //
+    // #5677's selector fixes ONE of this scope's two stripped-scaffold
+    // problems and not the other, so do not read it as making a
+    // `--modules workspace` scaffold work. It removes the guard's dependency
+    // on `./middleware/tenant.js` (a multi-tenant slice file, which threw
+    // ERR_MODULE_NOT_FOUND during construction). The three route plugins
+    // below are still reached through slice loads, and
+    // `routes/workspaces/config.ts` remains a multi-tenant `ownedFiles` entry
+    // — `general.ts` and `members.ts` are workspace-owned, `config.ts` is not
+    // — so that scaffold still has no `routes/workspaces/` directory and
+    // still throws here. Fixing it is the same one-line class of change #5677
+    // made for the review surface: co-own `config.ts` under `workspace` in
+    // MODULE_SLICES. Out of scope for #5677, which owns the review surface.
     //
     // A build with BOTH modules enabled registers each of the three route
     // plugins exactly once: they live here and nowhere else, so the two
     // scopes cannot collide on a path.
     if (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")) {
       await authScope.register(async (tenantScope) => {
-        await tenantScope.register(await tenantPreHandlerSlicePlugin());
+        await tenantScope.register(await tenantPreHandlerForBuild());
         await tenantScope.register(
           await sliceRoutePlugin("workspaceConfigRoutes"),
         );
@@ -626,28 +915,157 @@ export async function build() {
         await tenantScope.register(
           await sliceRoutePlugin("workspaceMembersRoutes"),
         );
+        // The Inbox message API (#6216 S7e) — the SAME scope, the SAME
+        // default-deny guard: list, item read, and the handled stamp.
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceMessageRoutes"),
+        );
+        // The asset store's MANAGE routes — list, PATCH, DELETE (#6093 D16).
+        // Registered HERE, in the plain tenant scope, and NOT inside the
+        // upload's own nested strict-rate-limit scope below: a JSON
+        // list/patch/delete has no 20 MB body to bound, and inheriting that
+        // per-IP ceiling would throttle the Admin's own list against its
+        // siblings.
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceAssetManageRoutes"),
+        );
+        // The workspace asset store's upload half (#5854). It belongs in THIS
+        // scope and not beside the public routes below, because the two
+        // refusals its AC names — no granted tenant, and a `:workspaceId` that
+        // is not the session's — are `tenantPreHandlerForBuild()`'s to make,
+        // before any handler runs and so before any write. Its raw-body parser
+        // and its `onRequest` size/type hook are declared INSIDE that plugin,
+        // so they encapsulate to it and reach neither the public read below nor
+        // any sibling here.
+        //
+        // Its own rate-limit scope, at the strict per-IP ceiling the leads and
+        // scheduling scopes use (#5854 security review round 1, MEDIUM). Auth
+        // and tenant are `preHandler`s, so an UNAUTHENTICATED caller still
+        // reaches the parser and can make the server buffer up to 20 MB before
+        // the 401. `rateLimitMiddleware` is an `onRequest` hook, so scoping it
+        // here is what bounds how often that can be done — the cap bounds one
+        // body, this bounds the rate. Nested so the ceiling applies to the
+        // upload alone and not to the config/general/members siblings above.
+        await tenantScope.register(async (assetUploadScope) => {
+          assetUploadScope.register(rateLimitMiddleware, {
+            perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+          });
+          await assetUploadScope.register(
+            await sliceRoutePlugin("workspaceAssetUploadRoute"),
+          );
+        });
+      });
+    }
+
+    // The editor's tenant-guarded content-write surface (#5853, roadmap D4).
+    // Its OWN sibling scope (D9) — not nested inside the workspace/multi-tenant
+    // scope above, so its module-exclusion row stays its own. The gate is
+    // `content-write` AND a tenancy module: the route file imports
+    // `lib/tenant-db.ts`, which only the `workspace` / `multi-tenant` slices
+    // deliver, so a scaffold enabling `content-write` without either would
+    // throw ERR_MODULE_NOT_FOUND at build() — the exact defect
+    // `tools/lint-slice-registration.ts` (required in CI) refuses. D9's
+    // "content-write alone" premise was falsified by that lint on PR #5921;
+    // the path itself is workspace-scoped (`/v1/workspaces/:workspaceId/…`),
+    // so requiring a tenancy module is coherent, not a narrowing.
+    // `tenantPreHandlerForBuild()` still selects the base-build
+    // default-workspace guard on a `workspace`-only build. The plugin is
+    // registered here and nowhere else, so no scope can collide on a path.
+    //
+    // The module flags are read ONCE, here, at build time (D10): on a build
+    // that excludes them the routes are never registered and Fastify's own 404
+    // answers — no auth, no tenant resolution, no handler-level
+    // `isModuleEnabled`.
+    if (
+      isModuleEnabled("content-write") &&
+      (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant"))
+    ) {
+      await authScope.register(async (tenantScope) => {
+        // D12: the authenticated ceiling (600/min), scope-local. The global
+        // limiter above is the unauth 60/min, which an autosaving editor would
+        // trip against its own user.
+        await tenantScope.register(rateLimit, {
+          max: CONTENT_RATE_LIMIT_AUTH,
+          timeWindow: CONTENT_RATE_LIMIT_WINDOW,
+        });
+        await tenantScope.register(await tenantPreHandlerForBuild());
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceContentRoutes"),
+        );
       });
     }
   });
 
   // Public routes — no auth required.
+  //
+  // The workspace asset store's READ half (#5854), under the SAME predicate as
+  // its upload above rather than unconditionally: with no upload path in the
+  // build it would be a permanent 404 advertised on both self-description
+  // surfaces. It cannot join the block above — that block is nested in
+  // `authScope`, and an `<img src>` carries no session.
+  if (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")) {
+    await server.register(await sliceRoutePlugin("publicAssetReadRoute"));
+  }
   await server.register(listTypesRoute);
+  // Before `listPagesRoute`: `search` must never be read as a `:type`.
+  await server.register(searchContentRoute);
   await server.register(listPagesRoute);
   await server.register(getPageRoute);
-  // Content-write routes (create/update/delete) — already Pro-tier gated at
-  // CALL time via requirePaidTier (apps/api/src/lib/require-paid-tier.ts);
-  // module-conditional at REGISTRATION too (S1, #5088) so an OSS build that
-  // excludes the content-write slice never wires the handler in at all. Not
-  // a MODULE_SLICES entry — see config/modules.ts.
-  if (isModuleEnabled("content-write")) {
-    await server.register(await sliceRoutePlugin("createPageRoute"));
-    await server.register(await sliceRoutePlugin("updatePageRoute"));
-    await server.register(await sliceRoutePlugin("deletePageRoute"));
-  }
-  // Module-conditional (commerce, D-47): checkout moved to its own module.
-  if (isModuleEnabled("commerce")) {
-    await server.register(await sliceRoutePlugin("checkoutRoutes"));
-  }
+  // Checkout launcher + reader — commerce PRIMITIVES (D-64, #5796; the GET
+  // added by #6084). Registered UNCONDITIONALLY and gated at CALL time on
+  // the JWT `commerce` claim, the same posture content-write has
+  // (requirePaidTier above), so adding commerce to a live site is a licence
+  // change and lands no files on its repo. Without the claim the gate
+  // answers the module-disabled 404 — byte-identical to the build that
+  // never registered the route. `checkoutRoutes` (`routes/checkout/index.ts`)
+  // registers BOTH `POST /v1/checkout/sessions` and
+  // `GET /v1/checkout/sessions/:id` — the GET in its own nested,
+  // rate-limited sub-scope (D16), so this preHandler applies to both while
+  // the GET's own limiter applies to it alone.
+  await server.register(async (checkoutScope) => {
+    checkoutScope.addHook("preHandler", requireCommerceClaim);
+    await checkoutScope.register(await sliceRoutePlugin("checkoutRoutes"));
+  });
+  // Request-and-confirm (#5970, D-67 / SUB-100) — the tenant's confirm form
+  // and the Payment Link it mints. A money path, so it sits INSIDE the
+  // commerce claim (DECISION-LOG D-63; D-67 assigns request-and-confirm to
+  // the Commerce rung rather than exempting it), and the gate is applied by
+  // COMPOSITION here — the checkout scope above, line for line. That is what
+  // lets the route files themselves read no licence claim at all (#5970 AC-4).
+  //
+  // Rate-limited at the leads scope's own strict value: the confirm link is
+  // unauthenticated (the token IS the credential), so it belongs on the same
+  // footing as the anonymous surface that mails it. Note the same caveat
+  // `server.ts` records elsewhere — `trustProxy` is on, so an IP limiter is
+  // evadable; the bound that actually holds is per ROW, one live credential
+  // per request, spent on use.
+  await server.register(async (requestsScope) => {
+    requestsScope.register(rateLimitMiddleware, {
+      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+    });
+    // `requireCommerceClaim` short-circuits with `reply.send`, so a wrapper is
+    // the only place the unclaimed case can be OBSERVED: the preHandler ends
+    // the request before any handler runs, and the gate itself logs only on
+    // `undetermined` (`lib/require-commerce-claim.ts`).
+    //
+    // Spec D3 names this line as one of two bounds on the residual it
+    // discloses — a site configured for request-and-confirm but carrying no
+    // `commerce` claim emails a tenant a confirm link that answers 404. The
+    // spec puts the log in the route, where it cannot be emitted; this is the
+    // registration, which is where it can (#5970 acceptance review, advisory
+    // 4). Without it the misconfiguration is visible only in the tenant's
+    // inbox, which is the one place the operator is not looking.
+    requestsScope.addHook("preHandler", async (request, reply) => {
+      await requireCommerceClaim(request, reply);
+      if (reply.sent) {
+        request.log.warn(
+          { outcome: "confirm_link_unclaimed", path: request.routeOptions.url },
+          "request-confirm: a confirm link was opened on a site without the commerce claim",
+        );
+      }
+    });
+    await requestsScope.register(requestRoutes);
+  });
   // Deliverable download — a capability-token URL (#3961 D5); the token
   // itself is the sole gate, so no auth preHandler applies. Module-conditional
   // (signal-collectors, D-48): gated PDFs and reports.
@@ -675,12 +1093,15 @@ export async function build() {
         done(null, body);
       },
     );
-    // Stripe webhook receiver — module-conditional (commerce, D-47). The
-    // scope wrapper and both raw-body parsers above stay unconditional: the
-    // Slack parser below needs them too (D2).
-    if (isModuleEnabled("commerce")) {
-      await webhooksScope.register(await sliceRoutePlugin("webhooksRoutes"));
-    }
+    // Stripe webhook receiver + customer mapping — commerce PRIMITIVES
+    // (D-64, #5796), registered UNCONDITIONALLY alongside checkout above.
+    // NO `requireCommerceClaim` preHandler here, deliberately: D3 puts
+    // signature verification BEFORE the claim check, so the handler itself
+    // consults `hasCommerceClaim()` once the signature is settled — a signed
+    // event on an unclaimed site is acked 200 and dropped rather than
+    // retried forever, while an unsigned body gets the module-disabled 404.
+    // See routes/webhooks/README.md § Commerce claim.
+    await webhooksScope.register(await sliceRoutePlugin("webhooksRoutes"));
     // Project-listing operator decision (Slack Approve/Reject) — the "hand an
     // operator a decision" half of D-48's grouping sentence. Module-conditional
     // (signal-collectors).
@@ -689,6 +1110,35 @@ export async function build() {
     }
   });
 
+  // Auth transactional-email relay (#5962 § D3) — its OWN scope, deliberately
+  // OUTSIDE `authScope`: the caller is `apps/web`'s Better Auth callbacks
+  // acting for an anonymous visitor who is by definition not signed in, so an
+  // auth preHandler in front of it would reject every legitimate call. The
+  // gate is the HMAC signature over the raw body plus the 300 s replay window,
+  // both verified inside the handler.
+  //
+  // Raw-body parser scoped to this sub-router only, for the same reason
+  // `webhooksScope` carries one: the signature must be checked over the EXACT
+  // bytes the caller signed, never a re-serialized parse.
+  //
+  // `DEFAULT_PER_IP_PER_MINUTE_STRICT` (10/min) — the constant `leadsScope`
+  // below already uses for its anonymous surface. It is defence in depth, not
+  // the control: an unsigned body never reaches a send, and per-victim volume
+  // is bounded by `lib/auth-email-budget.ts`.
+  await server.register(async (authEmailScope) => {
+    authEmailScope.register(rateLimitMiddleware, {
+      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+    });
+    authEmailScope.addContentTypeParser(
+      "application/json",
+      { parseAs: "buffer" },
+      (_req, body, done) => {
+        done(null, body);
+      },
+    );
+    await authEmailScope.register(transactionalEmailRoute);
+  });
+
   // Leads routes — rate-limit middleware scoped to this sub-router. Own
   // default (10/min, pre-#4730) rather than inheriting the wider
   // flows-sized default (#5111, DEF-004 — #4730's shared-default bump was
@@ -726,11 +1176,15 @@ export async function build() {
     // every recipient — the residual the first one left, and the one that
     // decides whether a flood can cost the site its sending domain.
     if (isModuleEnabled("signal-collectors")) {
-      await leadsScope.register(await sliceRoutePlugin("projectListingStartRoute"));
+      await leadsScope.register(
+        await sliceRoutePlugin("projectListingStartRoute"),
+      );
       await leadsScope.register(
         await sliceRoutePlugin("projectListingDraftPatchRoute"),
       );
-      await leadsScope.register(await sliceRoutePlugin("projectListingSubmitRoute"));
+      await leadsScope.register(
+        await sliceRoutePlugin("projectListingSubmitRoute"),
+      );
       // #5407 — the resume link's verification write. Anonymous, and gated
       // on the resume token AND the nonce that only the resume email
       // carries, so it belongs in the same rate-limited scope as the other
@@ -738,7 +1192,9 @@ export async function build() {
       await leadsScope.register(
         await sliceRoutePlugin("projectListingVerifyEmailRoute"),
       );
-      await leadsScope.register(await sliceRoutePlugin("projectListingPublicRoute"));
+      await leadsScope.register(
+        await sliceRoutePlugin("projectListingPublicRoute"),
+      );
     }
   });
 
@@ -756,13 +1212,17 @@ export async function build() {
     if (isModuleEnabled("signal-collectors")) {
       await flowsScope.register(await sliceRoutePlugin("getFlowRoute"));
       await flowsScope.register(await sliceRoutePlugin("submitFlowStepRoute"));
-      await flowsScope.register(await sliceRoutePlugin("getFlowAggregateRoute"));
+      await flowsScope.register(
+        await sliceRoutePlugin("getFlowAggregateRoute"),
+      );
     }
     // The recommender's email-moment routes (#4841) — same anonymous,
     // rate-limited posture as the three above. Module-conditional (commerce,
     // D-47): the recommender leaves Pro flows and moves to commerce whole.
     if (isModuleEnabled("commerce")) {
-      await flowsScope.register(await sliceRoutePlugin("saveRecommendationRoute"));
+      await flowsScope.register(
+        await sliceRoutePlugin("saveRecommendationRoute"),
+      );
       await flowsScope.register(
         await sliceRoutePlugin("checkoutRecommendationRoute"),
       );
@@ -803,6 +1263,12 @@ export async function build() {
       await scheduleScope.register(
         await sliceRoutePlugin("createBookingRoute"),
       );
+      // #6183 S9b D2/D12 — the enabled-meeting-slugs public read. Same scope
+      // as the three routes above: it inherits the module gate and the
+      // strict per-IP rate limit (§9 SEC-4).
+      await scheduleScope.register(
+        await sliceRoutePlugin("meetingTypesRoute"),
+      );
     });
   }