create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/services/consent.ts

@@ -56,6 +56,15 @@ export interface ConsentWriteClient {
 
 interface ConsentGrantRow {
   siteId: string;
+  /**
+   * #6374 — the tenancy fence's isolation key, equal to `siteId` by
+   * construction. Non-optional on purpose: `consent_grants.workspace_id` is
+   * NOT NULL as of
+   * database/migrations/20260922120000_tenancy_fence, so a row builder that
+   * forgot it would fail at runtime; declaring it required here makes the
+   * type checker say so instead.
+   */
+  workspaceId: string;
   subjectType: string;
   subjectId: string;
   purposeId: string;
@@ -169,6 +178,12 @@ export async function recordConsent(
     const { statement, locale } = resolveConsentStatement(purpose, input.locale);
     rows.push({
       siteId: input.siteId,
+      // #6374 — the isolation key, equal to `siteId` by construction.
+      // `input.siteId` is the caller's already-resolved site id; the
+      // `consent_grants_workspace_site_agree` CHECK makes a disagreement
+      // unstorable, and `consent_grants_workspace_id_format` rejects a raw
+      // alias loudly. Never read from a request body (AC-6).
+      workspaceId: input.siteId,
       subjectType: input.subjectType,
       subjectId: input.subjectId,
       purposeId,
@@ -222,6 +237,9 @@ export async function recordLegacyConsent(
     data: [
       {
         siteId: input.siteId,
+        // #6374 — the isolation key, equal to `siteId` by construction; the
+        // same stamp the D10 path's row builder above applies.
+        workspaceId: input.siteId,
         subjectType: input.subjectType,
         subjectId: input.subjectId,
         purposeId: purpose.id,

package/templates/apps/api/src/services/default-tenant.ts

@@ -0,0 +1,300 @@
+/**
+ * Default-tenant resolution — the BASE-build half of the tenant guard (#5677).
+ *
+ * A single-tenant site is a ONE-WORKSPACE TENANT, not a special case. The
+ * default Organization / Workspace / operator Membership are already declared
+ * as fixed reserved-range sentinels in `database/tenancy.ts` and already
+ * seeded by `database/seed.ts`, so there is nothing to synthesize here — this
+ * file resolves the seeded default and nothing else.
+ *
+ * WHY IT LIVES IN THE BASE BUILD. `services/tenant-context.ts` and
+ * `middleware/tenant.ts` are multi-tenant SLICE files (`// oss: false`), so on
+ * a build without that module they are not present and the routes behind them
+ * were never REGISTERED — not denied (#5677). The default
+ * resolution and the `TenantContext` shape it yields are needed on every
+ * build, so they live here, in a file that always ships; the multi-tenant
+ * slice imports this one rather than carrying its own copy, which is what
+ * keeps the two paths from drifting.
+ *
+ * PRECEDENCE, NOT PARALLELISM. When the multi-tenant module is present,
+ * `resolveActiveTenant` (the slice) is the entry point and calls
+ * `resolveDefaultTenant` only on the branch it always called it on — the
+ * previously-unconditional-deny null-binding branch. Nothing about the
+ * multi-tenant path changes. Without the module, `middleware/default-tenant.ts`
+ * calls this directly. There is one resolution, reached two ways, never two
+ * resolutions.
+ *
+ * DEFAULT-DENY IS THE FLOOR. `resolveDefaultTenant` returns `null` — never a
+ * grant — the instant the deployment is not unambiguously single-tenant
+ * (a second Workspace exists, or the sole Workspace is not the well-known
+ * default), and `null` again for a caller holding no Membership on the default
+ * Organization. Both branches were written for the multi-tenant slice by the
+ * owner-pin fix (docs/specs/single-tenant-owner-pin-spec.md, #3631) and are
+ * moved here BYTE-FOR-BYTE, not rewritten.
+ *
+ * This file is a sanctioned exception to architecture.yaml's tenant-scope
+ * forbidden pattern, for the same reason `tenant-context.ts` is: it is a
+ * tenancy-model boundary, not a domain-data reader.
+ */
+import {
+  DEFAULT_ORG_ID,
+  OPERATOR_MEMBERSHIP_ID,
+  resolveDefaultWorkspaceRow as resolveDefaultWorkspaceRowShared,
+} from "@working-theory/database/tenancy";
+import type { Id } from "@working-theory/ids";
+
+import { prisma } from "../lib/prisma.js";
+
+import { findVerifiedEmail } from "./verified-email.js";
+
+export type MembershipRole = "owner" | "admin" | "member";
+
+/**
+ * The tenant scope every domain query is bound to. Ids carry the ADR-0031
+ * brand; values originating from Prisma reads are brand-asserted at the read
+ * edge (the DB CHECK constraints are the runtime guarantee).
+ */
+export interface TenantContext {
+  userId: Id<"user">;
+  organizationId: Id<"organization">;
+  workspaceId: Id<"workspace">;
+  role: MembershipRole;
+}
+
+export type TenantErrorKind = "forbidden" | "not_found" | "conflict";
+
+export type TenantResult<T> =
+  | { ok: true; value: T }
+  | { ok: false; error: { kind: TenantErrorKind; message: string } };
+
+export function isUniqueViolation(error: unknown): boolean {
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    "code" in error &&
+    (error as { code?: unknown }).code === "P2002"
+  );
+}
+
+/**
+ * TOFU-binds the operator Membership for a single-tenant deployment (spec
+ * D1–D4) — the replacement for the deleted user-agnostic `owner` grant. The
+ * Membership is created with a fixed, well-known id
+ * (`OPERATOR_MEMBERSHIP_ID`); the `Membership.id` primary-key uniqueness —
+ * not a read-then-write "is this the first user?" guard — enforces exactly
+ * one owner under a concurrent first-login race. The losing caller's
+ * `create` raises `P2002`, swallowed here: that caller is then unbound and
+ * denied by the `membership.findUnique` the caller of this function runs
+ * next.
+ *
+ * Idempotent + at-most-once: a caller who already holds the Membership (a
+ * repeat call, or the deployment's steady state after the first bind) hits
+ * the same `P2002` path and is a no-op. Reachable ONLY from
+ * `resolveDefaultTenant`, itself gated by the
+ * `count === 1 && default-workspace-exists` check — unreachable from any
+ * multi-tenant state (`count > 1`).
+ *
+ * When `AILK_OPERATOR_EMAIL` is set (spec D4 — trimmed + lowercased before
+ * comparison), the bind is attempted ONLY for the caller whose VERIFIED
+ * `User.email` matches it (#5701 AC-2 — the read goes through
+ * `findVerifiedEmail`, so an unverified address is refused here and not only
+ * at the base-build entry above); every other caller returns without writing
+ * and is denied downstream. An empty/whitespace-only `AILK_OPERATOR_EMAIL` normalizes to
+ * `""`, which is falsy — treated as unset (pure TOFU), so a blank pin can
+ * never "match" a blank `User.email`. When unset, the bind is pure TOFU —
+ * first caller wins.
+ */
+async function bindOperatorMembership(userId: Id<"user">): Promise<void> {
+  const pinnedEmail = process.env.AILK_OPERATOR_EMAIL?.trim().toLowerCase();
+  if (pinnedEmail) {
+    // The verified-email read is `services/verified-email.ts` (#5701 D4) — the
+    // same one `resolveDefaultTenantForOperator` uses. It returns the address
+    // only when `emailVerified === true`, so an address that merely CLAIMS to
+    // be the pin can no longer mint `OPERATOR_MEMBERSHIP_ID`. Both refusals
+    // (`user_not_found`, `email_unverified`) take the branch's existing early
+    // return — the caller is then unbound and denied by the
+    // `membership.findUnique` that follows.
+    const verified = await findVerifiedEmail(userId);
+    if (!verified.ok) {
+      return;
+    }
+    if (verified.value.email.trim().toLowerCase() !== pinnedEmail) {
+      return;
+    }
+  }
+  try {
+    await prisma.membership.create({
+      data: {
+        id: OPERATOR_MEMBERSHIP_ID,
+        organizationId: DEFAULT_ORG_ID,
+        userId,
+        role: "owner",
+      },
+    });
+  } catch (error) {
+    if (!isUniqueViolation(error)) {
+      throw error;
+    }
+    // Another caller already holds OPERATOR_MEMBERSHIP_ID (the TOFU race
+    // winner, or a prior deployment run) — swallow and fall through.
+  }
+}
+
+/**
+ * The BASE-BUILD entry point: `resolveDefaultTenant` narrowed to the caller
+ * whose `User.email` matches `AILK_OPERATOR_EMAIL`, denying everyone when the
+ * pin is unset (#5693 security review, High finding).
+ *
+ * WHY THE BASE PATH NEEDS THIS AND THE MULTI-TENANT PATH DOES NOT. Registering
+ * the review surface on a module-less build made two things reachable together
+ * that were previously unreachable there: this resolution's TOFU operator bind,
+ * and `services/waitlist-dashboard.ts`'s `isPlatformOperator`, which grants
+ * `{kind: "all"}` — every site's rows, unfiltered — to an `owner` of the
+ * sentinel default Organization whenever `AILK_OPERATOR_EMAIL` is merely SET.
+ * That predicate never compares the caller to the pin; the pin is an on/off
+ * switch for it.
+ *
+ * Unpinned TOFU plus that predicate is an escalation. The site's auth
+ * auto-provisions a `User` on first login, so on a deployment with the pin
+ * unset the FIRST authenticated caller to touch a review route — any public
+ * respondent, not necessarily the operator — wins `OPERATOR_MEMBERSHIP_ID`.
+ * The real operator is then denied (their `create` raises `P2002`, swallowed),
+ * finds an empty dashboard, and sets `AILK_OPERATOR_EMAIL` to fix it — which
+ * flips the squatter, not the operator, to `{kind: "all"}`.
+ *
+ * So the base path requires the pin and requires the caller to BE it. Both
+ * halves matter: requiring the pin stops an unpinned race from seating anyone,
+ * and re-checking the caller's email on every request denies a squatter who
+ * was already bound before this code shipped — a Membership row alone is no
+ * longer enough. `bindOperatorMembership` below performs its own email check,
+ * but only at bind time and only for the bind; this is the one that gates the
+ * grant.
+ *
+ * The multi-tenant module is unaffected: `resolveActiveTenant` keeps calling
+ * `resolveDefaultTenant` directly, on exactly the branch it always called it
+ * on. This wrapper is reached only from `middleware/default-tenant.ts`, which
+ * only ever runs on a build without that module.
+ *
+ * `docs/specs/single-tenant-owner-pin-spec.md` D5 already recommended pinning;
+ * on this path it is mandatory rather than advisory, and unset fails closed.
+ *
+ * ONE KNOWN IMPRECISION, deliberate. `User.email` is `@unique` in Postgres,
+ * which is byte-exact, while this comparison lowercases both sides — so two
+ * distinct rows (`Operator@x.com` and `operator@x.com`) could both satisfy one
+ * pin. It is not reachable today: `apps/web/auth.ts` configures social
+ * providers only, so the address is provider-asserted and normalized rather
+ * than caller-chosen. It becomes reachable the moment a credential provider is
+ * enabled, and the durable fix is case-insensitive email uniqueness in the
+ * schema (citext, or lowercase-at-write) so "matches the pin" and "is unique"
+ * agree. Matching case-sensitively here instead would be worse: it would lock
+ * out an operator who typed their own address with different capitalisation.
+ */
+export async function resolveDefaultTenantForOperator(
+  userId: Id<"user">,
+): Promise<TenantContext | null> {
+  const pinnedEmail = process.env.AILK_OPERATOR_EMAIL?.trim().toLowerCase();
+  if (!pinnedEmail) {
+    return null;
+  }
+  // The verified-email read is `services/verified-email.ts` (#5701 D4) — the
+  // one this and the four other email-keyed paths share. It returns the
+  // address only when `emailVerified === true`, which is what makes a match
+  // against the pin a proven claim rather than an asserted one.
+  const verified = await findVerifiedEmail(userId);
+  if (!verified.ok) {
+    return null;
+  }
+  if (verified.value.email.trim().toLowerCase() !== pinnedEmail) {
+    return null;
+  }
+  return resolveDefaultTenant(userId);
+}
+
+/**
+ * The DEPLOYMENT half of the default resolution, extracted so it exists once
+ * (#5852 D2). Returns the sole, well-known default Workspace row, or `null`
+ * the instant the deployment is not unambiguously one-workspace — a second
+ * Workspace exists, none does, or the sole one is not the seeded default.
+ *
+ * Carries no authentication: it answers "is this deployment one-workspace, and
+ * which workspace is it", nothing about the caller. `resolveDefaultTenant`
+ * adds the authentication half on top; `services/public-site-resolver.ts`
+ * (unauthenticated public reads) uses the deployment half alone. One
+ * predicate, reached two ways — never two predicates.
+ *
+ * The predicate itself is `@working-theory/database/tenancy`'s
+ * `resolveDefaultWorkspaceRow` (#5876 spec D2/D3) — this is now a thin
+ * pass-through of `apps/api`'s own `prisma` singleton, kept as a named local
+ * function (rather than re-exporting the shared one directly) so every
+ * existing caller — this file's own `resolveDefaultWorkspaceId` and
+ * `resolveDefaultTenant`, and `services/public-site-resolver.ts`'s dynamic
+ * import of the wrapper — is untouched. There is exactly one implementation
+ * of the one-workspace predicate in the repository (NFR-7); apps/mcp's own
+ * resolution (`apps/mcp/src/lib/public-workspace.ts`) delegates to the same
+ * shared export.
+ */
+async function resolveDefaultWorkspaceRow(): Promise<{
+  id: string;
+  organizationId: string;
+} | null> {
+  return resolveDefaultWorkspaceRowShared(prisma);
+}
+
+/**
+ * The one-workspace deployment predicate, as a workspace id (#5852 D2).
+ * `null` means the deployment is not unambiguously one-workspace, and every
+ * caller fails closed on it.
+ */
+export async function resolveDefaultWorkspaceId(): Promise<Id<"workspace"> | null> {
+  const workspace = await resolveDefaultWorkspaceRow();
+  return workspace ? (workspace.id as Id<"workspace">) : null;
+}
+
+/**
+ * Resolves the default single-tenant scope when the deployment is
+ * unambiguously single-tenant — the default Workspace (`DEFAULT_WORKSPACE_ID`)
+ * exists AND it is the ONLY Workspace (`workspace.count() === 1`), the exact
+ * mirror of the Phase-1 provision guard's `count === 0` check (spec D2).
+ * Returns `null` (never grants) the instant a second Workspace exists, or the
+ * sole Workspace is not the well-known default — the caller falls through to
+ * its own default-deny in that case.
+ *
+ * Converges on the SAME Membership-based authz the multi-tenant path uses
+ * (spec D1 — the fix): attempts to TOFU-bind the caller as operator
+ * (`bindOperatorMembership`, a no-op once an operator is already bound or
+ * the caller doesn't match the optional env pin), then runs the real
+ * `membership.findUnique` check. A caller holding no Membership on the
+ * default Org — including every caller after the first once TOFU has bound
+ * someone else — resolves `null` here, and the caller denies. There is no
+ * user-agnostic `owner` grant.
+ *
+ * Formerly `resolveSingleTenantDefault` in `services/tenant-context.ts`
+ * (#3631); moved here verbatim by #5677 so the base build can reach it.
+ */
+export async function resolveDefaultTenant(
+  userId: Id<"user">,
+): Promise<TenantContext | null> {
+  const workspace = await resolveDefaultWorkspaceRow();
+  if (!workspace) {
+    return null;
+  }
+  await bindOperatorMembership(userId);
+  const membership = await prisma.membership.findUnique({
+    where: {
+      organizationId_userId: {
+        organizationId: workspace.organizationId,
+        userId,
+      },
+    },
+    select: { role: true },
+  });
+  if (!membership) {
+    return null;
+  }
+  return {
+    userId,
+    organizationId: workspace.organizationId as Id<"organization">,
+    workspaceId: workspace.id as Id<"workspace">,
+    role: membership.role as MembershipRole,
+  };
+}

package/templates/apps/api/src/services/deliverable-fulfillment.ts

@@ -45,13 +45,30 @@
  * PII boundary: logs carry only `{ siteId, flowSlug, sessionId, outcome }` —
  * never email/asset-key/copy values (mirrors flow-engine.ts's + abandon-
  * email.ts's boundary).
+ *
+ * #6310 D1/D2/D4/D5/D15 — a non-`playbook:` `assetKey` now resolves against
+ * the workspace-scoped `Asset` store FIRST, via the named boundary
+ * `lib/deliverable-asset-store.ts` (never a raw `prisma.asset` call here —
+ * that access is banned by architecture.yaml's tenant-scope
+ * `forbidden_pattern`), falling back to the LEGACY `DeliverableAsset` store
+ * on a miss (D3 — existing rows keep delivering, unmigrated). The workspace
+ * is read from the magnet's own `FlowDefinition.workspaceId`, ONE
+ * `findUnique` issued only on this branch (never for a `playbook:` key, and
+ * never before the `no_entry` exit) — a `null`/absent value skips the
+ * `Asset` lookup entirely and falls straight to the legacy arm, never
+ * guessing a workspace (D5, mirroring #6155 D3's posture). The grant is
+ * minted with `workspaceId` ONLY on the `Asset` arm — the same value that
+ * authorized the resolution — restoring the download route's serve-time
+ * tenancy re-check for this new grant class (D15).
  */
 
 import { sendDeliverableEmail } from "@working-theory/email";
 import { logger } from "@working-theory/observability";
 import { flowConfigSchema, type FlowConfig } from "@working-theory/validation";
 
+import { findDeliverableAssetIdByKey } from "../lib/deliverable-asset-store.js";
 import { prisma } from "../lib/prisma.js";
+import { resolveWorkspaceIdForAlias } from "../lib/site.js";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -194,6 +211,15 @@ async function stampOutcome(
   now: Date,
 ): Promise<void> {
   try {
+    // fence: global-key — `DeliverableGrant.id`, the capability token itself
+    // (#3961 D5: the grant IS the token). Every caller reaches this line
+    // inside an already-scoped frame — `fulfillDeliverable` has just MINTED
+    // this id under the session's workspace, and `resendDeliverableGrant` has
+    // just read the row back by the same opaque id — so the id is the row's
+    // own primary key, not a tenant selector, and a `workspaceId` term here
+    // could only re-state what the mint already fenced. It would also stop
+    // stamping LEGACY grants, whose `workspaceId` is NULL by the #6254 § 10.1
+    // Q2 carve-out, turning a post-mint audit stamp into a silent no-op.
     await prisma.deliverableGrant.update({
       where: { id: grantId },
       data: { sendStatus: outcome, sendAt: now },
@@ -312,9 +338,17 @@ export async function fulfillDeliverable(
   const playbookKey = playbookExperimentKey(entry.assetKey);
 
   let assetId: string;
+  // #6310 D15 — written ONLY on the Asset arm; stays undefined (no column
+  // written) for a playbook: or legacy dasset_ grant.
+  let grantWorkspaceId: string | undefined;
+
   if (playbookKey !== undefined) {
+    // #6257 — `siteId` is the session's own, resolved by the route that
+    // opened it (#6254/#6374 AC-7), so `workspaceId` rides beside it: a lead
+    // id and an experiment key alone would select a row whose tenant the
+    // query never stated.
     const instance = await prisma.playbookInstance.findFirst({
-      where: { siteId, leadId, experimentKey: playbookKey },
+      where: { siteId, workspaceId: siteId, leadId, experimentKey: playbookKey },
       select: { id: true },
     });
     if (!instance) {
@@ -323,24 +357,75 @@ export async function fulfillDeliverable(
     }
     assetId = entry.assetKey;
   } else {
-    // A missing row (config references an un-uploaded key) → same
-    // skip-and-log posture (D3).
-    const asset = (await prisma.deliverableAsset.findUnique({
-      where: { siteId_key: { siteId, key: entry.assetKey } },
-    })) as DeliverableAssetRow | null;
-
-    if (!asset) {
-      logOutcome(logCtx, "asset_missing");
-      return;
+    // #6310 D4 — resolve the workspace from the magnet's own live
+    // FlowDefinition, ONE query, issued only on this branch. D5 — a null or
+    // absent workspaceId skips the Asset lookup entirely; it is never
+    // guessed.
+    const definition = (await prisma.flowDefinition.findUnique({
+      where: { siteId_slug: { siteId, slug: flowSlug } },
+      select: { workspaceId: true },
+    })) as { workspaceId: string | null } | null;
+    const workspaceId = definition?.workspaceId ?? null;
+
+    const resolvedAssetId =
+      workspaceId !== null
+        ? await findDeliverableAssetIdByKey(workspaceId, entry.assetKey)
+        : null;
+
+    if (resolvedAssetId !== null && workspaceId !== null) {
+      // #6310 D2 — Asset resolves first; D15 — the grant carries the SAME
+      // workspaceId that authorized this resolution.
+      assetId = resolvedAssetId;
+      grantWorkspaceId = workspaceId;
+    } else {
+      // #6310 D2/D3 — legacy fallback. A missing row (config references an
+      // un-uploaded key) → same skip-and-log posture as before.
+      // #6257 — the LEGACY store's read, scoped by the same resolved
+      // workspace id the `Asset` arm above already resolves through
+      // `lib/deliverable-asset-store.ts`. The compound `[siteId, key]` names
+      // one row; `workspaceId` is what makes the tenant the QUERY's statement.
+      const asset = (await prisma.deliverableAsset.findUnique({
+        where: { siteId_key: { siteId, key: entry.assetKey }, workspaceId: siteId },
+      })) as DeliverableAssetRow | null;
+
+      if (!asset) {
+        logOutcome(logCtx, "asset_missing");
+        return;
+      }
+      assetId = asset.id;
     }
-    assetId = asset.id;
   }
 
   // D5: the grant IS the token — minted before the send is attempted so a
   // later email-config gap or send failure never wastes it (a later
   // manual/operator resend can reuse the same grant id).
   const grant = (await prisma.deliverableGrant.create({
-    data: { siteId, assetId, leadId, sessionId },
+    data: {
+      siteId,
+      assetId,
+      leadId,
+      sessionId,
+      // #6374 D4 / AC-8 — the SECOND DeliverableGrant mint site. The column
+      // stays NULLABLE for LEGACY rows (NULL is the serve path's fail-closed
+      // sentinel, #6254 § 10.1 Q2) and the migration touches none of them —
+      // but a grant minted HERE always knows its workspace, so it is never
+      // left to fail closed.
+      //
+      // `grantWorkspaceId` is #6310 D15's value, resolved from the magnet's
+      // own FlowDefinition on the `asset_` arm; that read is scoped by
+      // `siteId`, and the keystone's `flow_definitions_workspace_site_agree`
+      // CHECK makes `workspaceId = siteId` on that row, so the two are the
+      // SAME value and the `??` is a fallback for the legacy `dasset_` and
+      // virtual `playbook:` arms rather than a choice between two scopes.
+      // The new `deliverable_grants_workspace_site_agree` CHECK would reject
+      // a disagreement loudly either way.
+      //
+      // This does NOT change which bytes the download route serves: that
+      // route branches on the `assetId` PREFIX, and consults
+      // `grant.workspaceId` only on the `asset_` arm, where this value is
+      // what it already was.
+      workspaceId: grantWorkspaceId ?? siteId,
+    },
     select: { id: true },
   })) as { id: string };
 
@@ -400,6 +485,13 @@ type FlowSessionConfigRow = {
 export async function resendDeliverableGrant(
   grantId: string,
 ): Promise<ResendGrantResult> {
+  // fence: global-key — `DeliverableGrant.id`, the capability token itself
+  // (#3961 D5). This is the resolver: the operator hands the
+  // `deliverable:resend` CLI one opaque grant id and nothing else, and the
+  // WORKSPACE is what this read produces (`grant.siteId`, carried into
+  // `sendAndStamp` below), so a tenant term here would have to come from the
+  // answer it is computing. Holding the id is the capability, exactly as it
+  // is for the download route this resend re-sends a link to.
   const grant = (await prisma.deliverableGrant.findUnique({
     where: { id: grantId },
     select: { id: true, siteId: true, leadId: true, sessionId: true },
@@ -514,9 +606,45 @@ type DeliverableGrantListRow = {
 export async function listSendlessGrants(
   opts: ListSendlessGrantsOptions,
 ): Promise<SendlessGrantRow[]> {
+  // #6257 — `opts.siteId` is the one value in this service that arrives as a
+  // RAW ALIAS: the `deliverable:resend` CLI passes `--site` through verbatim.
+  // It is resolved here, once, the way `dunning-policy.ts` resolves its own
+  // parameter — an alias that names no workspace lists nothing rather than
+  // falling back to the unscoped read it used to make.
+  const workspaceId = await resolveWorkspaceIdForAlias(opts.siteId);
+  if (workspaceId === null) {
+    logger.warn(
+      { siteId: opts.siteId, outcome: "site_unresolved" },
+      "[deliverable-fulfillment] --site names no workspace — listing nothing",
+    );
+    return [];
+  }
+
+  // #6257 — LEGACY grants are NOT in this list, and the narrowing is stated
+  // rather than left for an operator to discover. Two terms exclude them: the
+  // `workspaceId` filter below (their column is NULL by the #6254 § 10.1 Q2
+  // carve-out) and the resolved `siteId` (the keystone migration deliberately
+  // does NOT normalize `deliverable_grants.site_id` — migration.sql:1059 — so
+  // a legacy row on a `"default"`-aliased deployment still carries the alias).
+  //
+  // This is a genuine TIGHTENING beyond the serve path, not parity with it:
+  // `routes/deliverables/index.ts` consults `grant.workspaceId` only on the
+  // `asset_` arm, so a legacy `dasset_` or `playbook:` grant still downloads.
+  // The fence forces it — AC-2 forbids keying this read on the raw alias the
+  // CLI was given, and a legacy row carries no workspace key to resolve — so
+  // the list is narrower by construction and the recovery path for such a row
+  // is `deliverable:resend --grant <id>`, which is unaffected.
+  logger.info(
+    { siteId: workspaceId, outcome: "legacy_grants_excluded" },
+    "[deliverable-fulfillment] grants with no workspace key are NOT listed — resend one by id with --grant",
+  );
+
   const rows = (await prisma.deliverableGrant.findMany({
     where: {
-      siteId: opts.siteId,
+      siteId: workspaceId,
+      // #6257 — the fence term. See the note above for what it excludes and
+      // why that is a tightening rather than serve-path parity.
+      workspaceId,
       sendStatus: null,
       ...(opts.since !== undefined && { createdAt: { gte: opts.since } }),
     },