create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/services/__tests__/leads-inbox.test.ts

@@ -0,0 +1,329 @@
+/**
+ * @file leads-inbox.test.ts
+ * @description Unit tests for the leads-inbox read service (#5678).
+ *
+ * The load-bearing case is ISOLATION: this endpoint returns contact PII, so
+ * the claim "a caller cannot read another site's leads" is tested, not argued.
+ *
+ * External dependency boundary mocked:
+ *   - apps/api/src/lib/prisma — the repo-standard `__mocks__/prisma.ts` manual
+ *     mock (`jest.mock("../../lib/prisma.js")`).
+ *
+ * `prisma.lead.findMany` / `findFirst` are given a REALISTIC filtering
+ * implementation over an in-memory fixture "table" rather than a static
+ * `mockResolvedValue`, mirroring `lead-promotion.test.ts`. That is what makes
+ * the isolation test real: a bug that widened the `siteId` match set would
+ * surface the other site's lead in the returned page, not merely in an
+ * argument-shape assertion.
+ *
+ * `tenant-context.ts`'s `listTenancy` runs REAL — a pure read over the mocked
+ * `prisma.membership.findMany` — so these tests also exercise the
+ * "resolve through `lead-promotion.ts`'s `resolveOwnerWorkspaces`" contract
+ * rather than re-stubbing it.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../lib/prisma.js");
+
+import type { Id } from "@working-theory/ids";
+
+import { prisma } from "../../lib/prisma.js";
+import { listOwnedLeads } from "../leads-inbox";
+
+// ─── Fixtures ─────────────────────────────────────────────────────────────────
+
+const USER_ID = "user_00000000-0000-7000-8000-0000000000a1" as Id<"user">;
+const OWN_ORG_ID = "org_00000000-0000-7000-8000-0000000000b1";
+/** The caller's own workspace — and therefore the `siteId` of their own leads. */
+const OWN_SITE_ID = "wksp_00000000-0000-7000-8000-0000000000c1";
+/** A DIFFERENT organization's workspace. The caller holds no membership in it. */
+const OTHER_SITE_ID = "wksp_00000000-0000-7000-8000-0000000000c2";
+
+type FakeLeadRow = {
+  id: string;
+  siteId: string;
+  email: string;
+  source: string;
+  payload: unknown;
+  createdAt: Date;
+};
+
+/** Shapes `prisma.membership.findMany`'s return — what `listTenancy` reads. */
+function membershipsWithRole(role: string) {
+  return [
+    {
+      role,
+      organization: {
+        id: OWN_ORG_ID,
+        name: "Acme",
+        slug: "acme",
+        workspaces: [{ id: OWN_SITE_ID, name: "Acme HQ", slug: "acme-hq" }],
+      },
+    },
+  ];
+}
+
+function lead(overrides: Partial<FakeLeadRow> & { id: string }): FakeLeadRow {
+  return {
+    siteId: OWN_SITE_ID,
+    email: "contact@example.com",
+    source: "web",
+    payload: { name: "Ada Lovelace", message: "please call me", phone: "555" },
+    createdAt: new Date("2026-09-15T12:00:00.000Z"),
+    ...overrides,
+  };
+}
+
+/**
+ * Wires `prisma.lead.findFirst` / `findMany` to a realistic in-memory "table"
+ * filtered by the `where` the service passes — so a row outside `siteId.in` is
+ * genuinely never returned, exactly as a real WHERE clause would exclude it.
+ */
+function seedLeadTable(rows: FakeLeadRow[]) {
+  const table = rows.map((r) => ({ ...r }));
+
+  type Where = {
+    siteId: { in: string[] };
+    id?: string;
+    OR?: Array<{
+      createdAt?: Date | { lt: Date };
+      id?: { lt: string };
+    }>;
+  };
+
+  const inScope = (row: FakeLeadRow, where: Where) =>
+    where.siteId.in.includes(row.siteId) &&
+    (where.id === undefined || row.id === where.id);
+
+  const afterCursor = (row: FakeLeadRow, where: Where) => {
+    if (!where.OR) return true;
+    return where.OR.some((clause) => {
+      if (clause.createdAt instanceof Date) {
+        return (
+          row.createdAt.getTime() === clause.createdAt.getTime() &&
+          clause.id !== undefined &&
+          row.id < clause.id.lt
+        );
+      }
+      const lt = (clause.createdAt as { lt: Date }).lt;
+      return row.createdAt.getTime() < lt.getTime();
+    });
+  };
+
+  (prisma.lead.findFirst as jest.Mock).mockImplementation(
+    async (args: { where: Where }) =>
+      table.find((row) => inScope(row, args.where)) ?? null,
+  );
+
+  (prisma.lead.findMany as jest.Mock).mockImplementation(
+    async (args: { where: Where; take: number }) =>
+      table
+        .filter((row) => inScope(row, args.where) && afterCursor(row, args.where))
+        .sort((a, b) =>
+          b.createdAt.getTime() - a.createdAt.getTime() || (a.id < b.id ? 1 : -1),
+        )
+        .slice(0, args.take),
+  );
+
+  return table;
+}
+
+describe("listOwnedLeads", () => {
+  // The workspace resolution is module-conditional (isModuleEnabled
+  // 'multi-tenant' — see lead-promotion.ts), so every test that expects rows
+  // needs the module explicitly enabled: AILK_ENABLED_MODULES unset means no
+  // paid modules (D-44, #5368).
+  const priorEnabledModules = process.env.AILK_ENABLED_MODULES;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.AILK_ENABLED_MODULES = "multi-tenant";
+  });
+
+  afterAll(() => {
+    if (priorEnabledModules === undefined) {
+      delete process.env.AILK_ENABLED_MODULES;
+    } else {
+      process.env.AILK_ENABLED_MODULES = priorEnabledModules;
+    }
+  });
+
+  // ── ISOLATION (load-bearing) ───────────────────────────────────────────────
+  it("never returns a lead whose siteId belongs to another site", async () => {
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      membershipsWithRole("owner"), // the caller belongs ONLY to OWN_ORG_ID
+    );
+    seedLeadTable([
+      lead({
+        id: "lead_own_1",
+        siteId: OWN_SITE_ID,
+        email: "mine@example.com",
+        createdAt: new Date("2026-09-15T12:00:00.000Z"),
+      }),
+      lead({
+        id: "lead_other_1",
+        siteId: OTHER_SITE_ID,
+        email: "theirs@example.com",
+        createdAt: new Date("2026-09-15T13:00:00.000Z"), // NEWER — would sort first
+      }),
+    ]);
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.value.items.map((row) => row.id)).toEqual(["lead_own_1"]);
+    expect(JSON.stringify(result.value)).not.toContain("theirs@example.com");
+    expect(JSON.stringify(result.value)).not.toContain(OTHER_SITE_ID);
+    // The scope reaches the DB as a filter, not a post-filter in JS.
+    expect(prisma.lead.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({ where: expect.objectContaining({ siteId: { in: [OWN_SITE_ID] } }) }),
+    );
+  });
+
+  it("returns an empty page when the caller belongs to no workspace at all", async () => {
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue([]);
+    seedLeadTable([lead({ id: "lead_other_1", siteId: OTHER_SITE_ID })]);
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+    // No workspace means no query at all — not a query with an empty `in`.
+    expect(prisma.lead.findMany).not.toHaveBeenCalled();
+  });
+
+  it("returns an empty page for a `member` — the role floor is owner|admin", async () => {
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      membershipsWithRole("member"),
+    );
+    seedLeadTable([lead({ id: "lead_own_1", siteId: OWN_SITE_ID })]);
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+    expect(prisma.lead.findMany).not.toHaveBeenCalled();
+  });
+
+  it("rejects a cursor that resolves outside the caller's scope", async () => {
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      membershipsWithRole("admin"),
+    );
+    seedLeadTable([
+      lead({ id: "lead_own_1", siteId: OWN_SITE_ID }),
+      lead({ id: "lead_other_1", siteId: OTHER_SITE_ID }),
+    ]);
+
+    const result = await listOwnedLeads({
+      userId: USER_ID,
+      cursor: "lead_other_1",
+      limit: 50,
+    });
+
+    expect(result).toEqual({
+      ok: false,
+      error: {
+        kind: "invalid_cursor",
+        message: "cursor does not resolve within this scope",
+      },
+    });
+    // The rejection is indistinguishable from "no such lead" — a foreign
+    // cursor is never a probe that confirms another site's row exists.
+    expect(prisma.lead.findMany).not.toHaveBeenCalled();
+  });
+
+  // ── Row shape (the PII floor) ──────────────────────────────────────────────
+  it("returns exactly the five rendered fields — never the rest of the record", async () => {
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      membershipsWithRole("owner"),
+    );
+    seedLeadTable([
+      lead({
+        id: "lead_own_1",
+        email: "ada@example.com",
+        source: "conversational-intake",
+        payload: { name: "Ada Lovelace", message: "please call me", phone: "555-0100" },
+      }),
+    ]);
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.value.items).toEqual([
+      {
+        id: "lead_own_1",
+        name: "Ada Lovelace",
+        email: "ada@example.com",
+        source: "conversational-intake",
+        createdAt: "2026-09-15T12:00:00.000Z",
+      },
+    ]);
+    // The rest of `payload` is never on the wire.
+    const serialized = JSON.stringify(result.value);
+    expect(serialized).not.toContain("please call me");
+    expect(serialized).not.toContain("555-0100");
+    expect(serialized).not.toContain("siteId");
+  });
+
+  it("truncates an unbounded name — one anonymous write cannot size the page", async () => {
+    // PR #5705 security review, finding 1: `boundedLeadPayload` bounds the
+    // payload at 64 KEYS and nothing else, and `POST /v1/leads/submit` is
+    // anonymous with no ownership check on `siteId`, so a stranger can plant a
+    // ~1 MB `name` in the owner's inbox. Ordering is `createdAt desc` and this
+    // unit ships no delete surface, so it would sit on page one for good.
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      membershipsWithRole("owner"),
+    );
+    seedLeadTable([
+      lead({ id: "lead_own_1", payload: { name: "A".repeat(900_000) } }),
+    ]);
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.value.items[0]?.name).toBe("A".repeat(200));
+    expect(JSON.stringify(result.value).length).toBeLessThan(1000);
+  });
+
+  it("reads `name` as null when the site's form captured none", async () => {
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      membershipsWithRole("owner"),
+    );
+    seedLeadTable([lead({ id: "lead_own_1", payload: { company: "Acme" } })]);
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.value.items[0]?.name).toBeNull();
+  });
+
+  // ── Pagination ─────────────────────────────────────────────────────────────
+  it("pages newest first and hands back the last row's id as nextCursor", async () => {
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      membershipsWithRole("owner"),
+    );
+    seedLeadTable([
+      lead({ id: "lead_a", createdAt: new Date("2026-09-15T10:00:00.000Z") }),
+      lead({ id: "lead_b", createdAt: new Date("2026-09-15T11:00:00.000Z") }),
+      lead({ id: "lead_c", createdAt: new Date("2026-09-15T12:00:00.000Z") }),
+    ]);
+
+    const first = await listOwnedLeads({ userId: USER_ID, limit: 2 });
+    expect(first.ok).toBe(true);
+    if (!first.ok) return;
+    expect(first.value.items.map((row) => row.id)).toEqual(["lead_c", "lead_b"]);
+    expect(first.value.nextCursor).toBe("lead_b");
+
+    const second = await listOwnedLeads({
+      userId: USER_ID,
+      cursor: first.value.nextCursor ?? undefined,
+      limit: 2,
+    });
+    expect(second.ok).toBe(true);
+    if (!second.ok) return;
+    expect(second.value.items.map((row) => row.id)).toEqual(["lead_a"]);
+    expect(second.value.nextCursor).toBeNull();
+  });
+});

package/templates/apps/api/src/services/__tests__/listing-config.test.ts

@@ -0,0 +1,166 @@
+/**
+ * @file listing-config.test.ts
+ * @description Unit tests for the per-site project-listings config reads
+ * (#5033) under the tenancy fence (#6257, Stage 2 unit C2).
+ *
+ * This suite is NEW. `listing-config.ts`'s only coverage lived under
+ * `apps/api/src/routes/**\/__tests__/`, which this unit must not touch — so
+ * the two reads it owns are pinned here instead, at the service boundary
+ * where the fence is applied.
+ *
+ * Both reads run on the ANONYMOUS path, with no authenticated tenant:
+ *
+ *   - `listingConfigFor(siteId)` is handed an ALREADY-RESOLVED workspace id
+ *     by every caller (a listing row's own `siteId`, a tenant's
+ *     `workspaceId`, or `siteIdForPublicKey`'s return), so its read is
+ *     scoped by it.
+ *   - `siteIdForPublicKey(publicKey)` is the query that RESOLVES the tenant.
+ *     It is the documented global-key exemption (its call site carries the
+ *     marker comment): it is keyed on a
+ *     site's public listing key, which names one row across all workspaces,
+ *     and a tenant term would be the very thing it exists to produce.
+ *
+ * External dependency boundaries mocked:
+ *   - @working-theory/database (via moduleNameMapper → prisma-client.js mock;
+ *     prisma singleton via __mocks__/prisma.ts)
+ *   - @working-theory/observability logger
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
+jest.mock("../../lib/prisma.js");
+
+const mockLoggerWarn = jest.fn();
+const mockLoggerError = jest.fn();
+jest.mock("@working-theory/observability", () => ({
+  logger: {
+    info: jest.fn(),
+    warn: (...args: unknown[]) => mockLoggerWarn(...args),
+    error: (...args: unknown[]) => mockLoggerError(...args),
+    debug: jest.fn(),
+  },
+}));
+
+import { SITE_LISTING_CONFIG_DEFAULTS } from "@working-theory/validation";
+
+import { prisma } from "../../lib/prisma.js";
+import { __resetSiteWorkspaceCacheForTests } from "../../lib/site.js";
+import { listingConfigFor, siteIdForPublicKey } from "../listing-config";
+
+const SITE_ID = "wksp_00000000-0000-7000-8000-0000000000a1";
+const OTHER_SITE_ID = "wksp_00000000-0000-7000-8000-0000000000ff";
+const PUBLIC_KEY = "pk_listing_abcdef";
+
+const priorPublicKey = process.env["AILK_LISTING_PUBLIC_KEY"];
+const priorSiteId = process.env["AILK_SITE_ID"];
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  __resetSiteWorkspaceCacheForTests();
+  delete process.env["AILK_LISTING_PUBLIC_KEY"];
+  delete process.env["AILK_SITE_ID"];
+});
+
+afterAll(() => {
+  if (priorPublicKey === undefined) delete process.env["AILK_LISTING_PUBLIC_KEY"];
+  else process.env["AILK_LISTING_PUBLIC_KEY"] = priorPublicKey;
+  if (priorSiteId === undefined) delete process.env["AILK_SITE_ID"];
+  else process.env["AILK_SITE_ID"] = priorSiteId;
+});
+
+// ─── listingConfigFor — the fenced read ────────────────────────────────────
+
+describe("listingConfigFor", () => {
+  it("scopes the config read by the workspace id it was handed (#6257 AC-1/AC-2)", async () => {
+    (prisma.siteListingConfig.findUnique as jest.Mock).mockResolvedValue({
+      data: { maxWindowDays: 60, defaultWindowDays: 21 },
+    });
+
+    await listingConfigFor(SITE_ID);
+
+    expect(prisma.siteListingConfig.findUnique).toHaveBeenCalledTimes(1);
+    const { where } = (prisma.siteListingConfig.findUnique as jest.Mock).mock.calls[0][0];
+    expect(where.workspaceId).toBe(SITE_ID);
+    expect(where.siteId).toBe(SITE_ID);
+  });
+
+  it("reads a DIFFERENT site under that site's own workspace id, never a remembered one", async () => {
+    (prisma.siteListingConfig.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await listingConfigFor(SITE_ID);
+    await listingConfigFor(OTHER_SITE_ID);
+
+    const calls = (prisma.siteListingConfig.findUnique as jest.Mock).mock.calls;
+    expect(calls[0][0].where.workspaceId).toBe(SITE_ID);
+    expect(calls[1][0].where.workspaceId).toBe(OTHER_SITE_ID);
+  });
+
+  it("a site with no row gets the platform defaults", async () => {
+    (prisma.siteListingConfig.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await expect(listingConfigFor(SITE_ID)).resolves.toEqual(
+      SITE_LISTING_CONFIG_DEFAULTS,
+    );
+  });
+
+  it("a stored blob that fails its schema gets the platform defaults, logged at ERROR", async () => {
+    (prisma.siteListingConfig.findUnique as jest.Mock).mockResolvedValue({
+      data: { maxWindowDays: "not-a-number" },
+    });
+
+    await expect(listingConfigFor(SITE_ID)).resolves.toEqual(
+      SITE_LISTING_CONFIG_DEFAULTS,
+    );
+    expect(mockLoggerError).toHaveBeenCalledWith(
+      expect.objectContaining({ siteId: SITE_ID }),
+      expect.stringContaining("PLATFORM defaults"),
+    );
+  });
+});
+
+// ─── siteIdForPublicKey — the documented global-key exemption ──────────────
+
+describe("siteIdForPublicKey", () => {
+  it("is keyed on the public listing key ALONE — the query that resolves the tenant carries no tenant term", async () => {
+    (prisma.siteListingConfig.findUnique as jest.Mock).mockResolvedValue({
+      siteId: SITE_ID,
+    });
+
+    await expect(siteIdForPublicKey(PUBLIC_KEY)).resolves.toBe(SITE_ID);
+
+    const { where } = (prisma.siteListingConfig.findUnique as jest.Mock).mock.calls[0][0];
+    expect(where).toEqual({ publicKey: PUBLIC_KEY });
+    expect(where.workspaceId).toBeUndefined();
+  });
+
+  it("an unmatched key resolves to null rather than falling through to the env path", async () => {
+    process.env["AILK_LISTING_PUBLIC_KEY"] = "pk_env_key";
+    (prisma.siteListingConfig.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await expect(siteIdForPublicKey("pk_typo")).resolves.toBeNull();
+  });
+
+  it("the env single-tenant path returns the RESOLVED workspace id, never the raw alias", async () => {
+    process.env["AILK_LISTING_PUBLIC_KEY"] = PUBLIC_KEY;
+    process.env["AILK_SITE_ID"] = SITE_ID;
+    (prisma.siteListingConfig.findUnique as jest.Mock).mockResolvedValue(null);
+    // Keyed on the REQUESTED id — a blanket resolve would make a fail-closed
+    // assertion impossible (#6374's own test convention).
+    (prisma.workspace.findUnique as jest.Mock).mockImplementation(
+      async ({ where }: { where: { id: string } }) =>
+        where.id === SITE_ID
+          ? { id: SITE_ID, organizationId: "org_00000000-0000-7000-8000-000000000001" }
+          : null,
+    );
+
+    await expect(siteIdForPublicKey(PUBLIC_KEY)).resolves.toBe(SITE_ID);
+  });
+
+  it("fails closed when the env alias names no workspace", async () => {
+    process.env["AILK_LISTING_PUBLIC_KEY"] = PUBLIC_KEY;
+    process.env["AILK_SITE_ID"] = "no-such-workspace";
+    (prisma.siteListingConfig.findUnique as jest.Mock).mockResolvedValue(null);
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await expect(siteIdForPublicKey(PUBLIC_KEY)).resolves.toBeNull();
+  });
+});

package/templates/apps/api/src/services/__tests__/project-listings.fence.test.ts

@@ -0,0 +1,154 @@
+// oss: false
+/**
+ * @file project-listings.fence.test.ts
+ *
+ * #6258 AC-6 — `attachWaitlistCounts` (`services/project-listings.ts:425-443`)
+ * is one of the nine fenced reads that gain a `workspaceId` term beside their
+ * existing `siteId` one. This suite is that read's per-`where` proof.
+ *
+ * Why a NEW file rather than an addition to an existing suite: this service's
+ * only coverage today lives under `apps/api/src/routes/project-listings/__tests__/`,
+ * a path under the advisory route floor this unit keeps its diff out of
+ * (spec § 8.3). The `where` lives in the service, so the service is where it
+ * is proven.
+ */
+import { listProjectListings } from "../project-listings.js";
+
+// Boundary mocks — `project-listings.ts`'s import chain reaches the Resend
+// client and the licence check; neither is exercised by the read under test.
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+  sendDeliverableEmail: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../lib/prisma.js", () => ({
+  prisma: {
+    projectListing: { findMany: jest.fn() },
+    waitlistScore: { count: jest.fn() },
+  },
+}));
+
+import { prisma } from "../../lib/prisma.js";
+
+const SITE = "wksp_00000000-0000-7000-8000-000000000001";
+const EXPERIMENT_A = "ailk-founder-diagnostic";
+const EXPERIMENT_B = "ailk-agency-waitlist";
+
+/**
+ * A listing row carrying `workspaceId` equal to its `siteId` — exactly what
+ * the `project_listings_workspace_site_agree` CHECK guarantees in the
+ * database (#6258 D11).
+ */
+function listingRow(id: string, experimentKey: string | null): Record<string, unknown> {
+  return {
+    id,
+    siteId: SITE,
+    workspaceId: SITE,
+    leadId: null,
+    slug: `slug-${id}`,
+    name: "Acme",
+    headline: null,
+    oneLiner: null,
+    problem: null,
+    solution: null,
+    url: null,
+    product: null,
+    commitment: null,
+    teamComposition: null,
+    faqs: null,
+    anythingElse: null,
+    address: null,
+    addressLine1: null,
+    addressLine2: null,
+    addressCity: null,
+    addressRegion: null,
+    addressPostalCode: null,
+    addressCountry: null,
+    questions: null,
+    siteAnswers: null,
+    windowDays: null,
+    founderName: null,
+    founderFirstName: null,
+    founderLastName: null,
+    founderEmail: null,
+    founderPhone: null,
+    founderCompany: null,
+    emailVerifiedAt: null,
+    logoMarkUrl: null,
+    logoWordmarkUrl: null,
+    featured: false,
+    status: "active",
+    consentAt: new Date("2026-09-01T00:00:00.000Z"),
+    decidedAt: null,
+    decidedBy: null,
+    issueUrl: null,
+    experimentKey,
+    windowEndsAt: new Date("2099-01-01T00:00:00.000Z"),
+    createdAt: new Date("2026-09-01T00:00:00.000Z"),
+    updatedAt: new Date("2026-09-01T00:00:00.000Z"),
+  };
+}
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(3);
+});
+
+describe("attachWaitlistCounts — the fenced count filters on workspaceId beside siteId (#6258 AC-6)", () => {
+  it("prisma.waitlistScore.count's where carries workspaceId === the resolved scope id, by value", async () => {
+    (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([
+      listingRow("plst_a", EXPERIMENT_A),
+    ]);
+
+    await listProjectListings(SITE);
+
+    expect((prisma.waitlistScore.count as jest.Mock).mock.calls[0]![0]!.where).toEqual({
+      siteId: SITE,
+      workspaceId: SITE,
+      experimentKey: EXPERIMENT_A,
+    });
+  });
+
+  it("every DISTINCT experimentKey gets the same two scope terms — one count per key, no more", async () => {
+    (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([
+      listingRow("plst_a", EXPERIMENT_A),
+      listingRow("plst_b", EXPERIMENT_B),
+      listingRow("plst_c", EXPERIMENT_A),
+    ]);
+
+    await listProjectListings(SITE);
+
+    expect(prisma.waitlistScore.count).toHaveBeenCalledTimes(2);
+    const wheres = (prisma.waitlistScore.count as jest.Mock).mock.calls.map(
+      (call) => call[0]!.where as Record<string, unknown>,
+    );
+    for (const where of wheres) {
+      expect(where.siteId).toBe(SITE);
+      expect(where.workspaceId).toBe(SITE);
+    }
+    expect(wheres.map((w) => w.experimentKey).sort()).toEqual(
+      [EXPERIMENT_A, EXPERIMENT_B].sort(),
+    );
+  });
+
+  it("no listing carries an experimentKey → no fenced read is issued at all", async () => {
+    (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([
+      listingRow("plst_a", null),
+    ]);
+
+    await listProjectListings(SITE);
+
+    expect(prisma.waitlistScore.count).not.toHaveBeenCalled();
+  });
+});