create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/services/owner-workspaces.ts

@@ -0,0 +1,132 @@
+/**
+ * @file owner-workspaces.ts
+ * @description The ONE site→workspace resolution in `apps/api`.
+ *
+ * A `Lead` is keyed on `siteId` and a `Workspace` on `id`, but the two are the
+ * SAME value space named per namespace — `database/config/schema.prisma` says
+ * as much of `ProjectListing`, "the one keyed on `siteId` rather than
+ * `workspaceId`". So ownership is the direct membership test
+ * `siteId ∈ workspaceIds`, never a join through a mapping table, and every
+ * caller that needs it resolves it here rather than writing a second path: a
+ * divergent isolation path across two PII surfaces is exactly the thing that
+ * turns into rework when the multi-tenant product arrives.
+ *
+ * Callers: `lead-promotion.ts` (lead → user promotion, #3586) and
+ * `leads-inbox.ts` (the owner's leads read, #5678).
+ *
+ * ## Why this is its own file rather than a `lead-promotion.ts` export
+ *
+ * `paidModuleTemplateExclusions()` (`packages/create-ailk/src/module-architecture.ts`)
+ * walks the import graph from each paid module's `ownedFiles` to a fixed point
+ * and drops every file that reaches one, so that a keyless scaffold carries no
+ * paid source. `lead-promotion.ts` is inside that closure and always has been,
+ * which means anything importing it is dropped too. Putting this function
+ * there and importing it from the leads read would have carried the closure
+ * through `leads-inbox.ts` and `routes/leads/list.ts` into `server.ts`, and a
+ * scaffold with no server entry point does not build — the same base-breaking
+ * cascade `module-architecture.ts` records twice in its own comments, measured
+ * here before this file existed. Keeping the resolution in a module that
+ * reaches nothing excluded is what lets both callers share it.
+ *
+ * Nothing in this file may name `tenant-context.js` in an import form,
+ * including inside a comment: the closure's scanner is a regular expression
+ * over the file's text and does not know which lines are code.
+ */
+
+import type { Id } from "@working-theory/ids";
+
+import { isModuleEnabled } from "../config/modules.js";
+import { loadSlice } from "../lib/slice-load.js";
+
+/**
+ * The tenant-context module is a multi-tenant SLICE the OSS strip removes
+ * (#5182), and `listTenancy` is a VALUE — a runtime call, not an erasable type
+ * — so a static import, or a specifier written literally at the call site,
+ * would be TS2307 on the public tree: `tsc` resolves a string-literal
+ * specifier whether or not the branch containing it can ever run.
+ *
+ * The remedy is the one `server.ts` and `lead-promotion.ts` already use: gate
+ * the call on `isModuleEnabled('multi-tenant')` and read the specifier from
+ * this constant, so it is not a literal at the call site. What defeats
+ * resolution is the INDIRECTION, not the type of the value. The constant form
+ * matters too — `@vercel/nft` constant-propagates a module-level binding into
+ * the dynamic call and emits the file, which a table lookup would hide from it
+ * (#5304 D3).
+ *
+ * `apps/api` is a `tsc`-only surface with no bundler, which is the
+ * precondition that makes this sound here.
+ */
+const TENANT_CONTEXT_SPECIFIER = "./tenant-context.js";
+
+/** The one export this file needs from the multi-tenant slice. */
+interface TenantContextSlice {
+  listTenancy: (params: {
+    userId: Id<"user">;
+    sessionTenant: undefined;
+  }) => Promise<
+    | {
+        ok: true;
+        value: {
+          organizations: Array<{
+            role: string;
+            workspaces: Array<{ id: string }>;
+          }>;
+        };
+      }
+    | { ok: false; error: { message: string } }
+  >;
+}
+
+/**
+ * One workspace the caller belongs to, carrying the role they hold in its
+ * organization. `role` is the organization-level `Membership.role`
+ * (`owner | admin | member`) the tenancy assembler already returns — typed as a
+ * plain string here rather than `MembershipRole`, because that type lives in
+ * the stripped slice this file may not name.
+ */
+export type OwnerWorkspace = { id: string; role: string };
+
+export type ResolveOwnerWorkspacesResult =
+  | { ok: true; value: OwnerWorkspace[] }
+  | { ok: false; error: { message: string } };
+
+/**
+ * Resolve the caller's OWN workspaces.
+ *
+ * Delegates to the sole cross-namespace tenancy assembler — this file never
+ * issues a raw membership or workspace model query of its own, which
+ * `architecture.yaml`'s tenant-scope forbidden pattern reserves to the
+ * tenant-context and tenant-db modules.
+ *
+ * Module-conditional, and #5677 changed what that MEANS rather than what it
+ * does. `services/default-tenant.ts` now resolves the seeded default
+ * Workspace on every build, so a module-less deployment does have a
+ * resolvable workspace — the empty result below is a deliberate scope limit,
+ * not a statement that there is nothing to resolve. Wiring this resolver to
+ * that default is a behavior change for BOTH callers at once (promotion would
+ * begin stamping `promotedUserId` on single-tenant leads, which
+ * `/v1/flow-checkouts/me` and `/v1/waitlist-signups/me` join through), and it
+ * needs the deployment to pin `AILK_SITE_ID` to `DEFAULT_WORKSPACE_ID` —
+ * `siteId` comes from `lib/site.ts` while `workspaceId` is the sentinel, and
+ * `siteId ∈ workspaceIds` only matches when those agree.
+ */
+export async function resolveOwnerWorkspaces(
+  userId: Id<"user">,
+): Promise<ResolveOwnerWorkspacesResult> {
+  if (!isModuleEnabled("multi-tenant")) return { ok: true, value: [] };
+
+  const specifier: string = TENANT_CONTEXT_SPECIFIER;
+  const { listTenancy } = (await loadSlice(
+    specifier,
+    () => import(specifier),
+  )) as TenantContextSlice;
+  const tenancy = await listTenancy({ userId, sessionTenant: undefined });
+  if (!tenancy.ok) return { ok: false, error: tenancy.error };
+
+  return {
+    ok: true,
+    value: tenancy.value.organizations.flatMap((org) =>
+      org.workspaces.map((workspace) => ({ id: workspace.id, role: org.role })),
+    ),
+  };
+}

package/templates/apps/api/src/services/project-listings.ts

@@ -44,6 +44,10 @@
 import { createHash, randomBytes } from "node:crypto";
 
 import type { Prisma, Role } from "@working-theory/database";
+import {
+  DEFAULT_WORKSPACE_SLUG,
+  resolveSentinelWorkspaceRow,
+} from "@working-theory/database/tenancy";
 import { logger } from "@working-theory/observability";
 import {
   clampWindowDays,
@@ -217,6 +221,7 @@ const PROJECT_LISTING_SELECT = {
   name: true,
   oneLiner: true,
   problem: true,
+  solution: true,
   url: true,
   product: true,
   commitment: true,
@@ -362,6 +367,7 @@ function toResponseRow(
     headline: row.headline,
     oneLiner: row.oneLiner,
     problem: row.problem,
+    solution: row.solution,
     url: row.url,
     product: row.product as ProjectListing["product"],
     commitment: row.commitment as ProjectListing["commitment"],
@@ -428,8 +434,21 @@ async function attachWaitlistCounts(
   const counts = new Map<string, number>();
   await Promise.all(
     experimentKeys.map(async (experimentKey) => {
+      // fence: workspaceId === the scope id this query already filters siteId by
+      // (workspace_site_agree CHECK, 20260922120000_tenancy_fence). Filtering the
+      // CONSTRAINED column makes the scope correct by construction; the format
+      // CHECK makes a raw alias match nothing rather than by accident.
+      //
+      // What that id IS depends on the caller, and only two of the six are
+      // route-resolved: `listProjectListings` and `getProjectListing` receive
+      // `tenant.workspaceId`, so for them this is an isolation control.
+      // `listMyProjectListings` and the two `publicProjectListings` call sites
+      // pass a ProjectListing row's OWN `siteId`, so for them it is a
+      // CONSISTENCY control — the count agrees with the row it is reported
+      // against — exactly as `project-listing-decision.ts#waitlistCountFor`
+      // spells out (#6258 § 1.6 / § 5 D8, security review L-2).
       const count = await prisma.waitlistScore.count({
-        where: { siteId, experimentKey },
+        where: { siteId, workspaceId: siteId, experimentKey },
       });
       counts.set(experimentKey, count);
     }),
@@ -602,7 +621,113 @@ export type StartProjectListingDraftResult =
        */
       verifyNonce: string;
     }
-  | { ok: false; error: { kind: "invalid_input"; message: string } };
+  | { ok: false; error: { kind: "invalid_input"; message: string } }
+  // #6203 — the resolved `siteId` names no workspace this database holds.
+  // Distinct from `invalid_input` (a body problem): this is a server-side
+  // tenancy misconfiguration, and the route answers 503, never 400.
+  | { ok: false; error: { kind: "tenant_unresolved"; message: string } };
+
+/**
+ * Resolves an ALREADY-RESOLVED `siteId` (never a caller-supplied string — see
+ * `startProjectListingDraft`'s own header) to its workspace id (#6203).
+ *
+ * Mirrors `apps/api/src/lib/site.ts`'s `resolveSiteWorkspaceId()` — the SAME
+ * two-branch alias mapping the #6203 migration's own backfill `CASE`
+ * encodes: the literal alias `"default"` resolves to the seeded sentinel
+ * workspace IFF that row exists and hangs off the sentinel Organization;
+ * any other alias resolves only by exact `workspaces.id` equality. Kept
+ * LOCAL and PARAMETERIZED rather than reusing `resolveSiteWorkspaceId()`
+ * directly: that function is hardwired to `currentSiteId()`
+ * (`AILK_SITE_ID`), while a `ProjectListing`'s `siteId` can legitimately
+ * name a DIFFERENT site under a multi-key deployment
+ * (`listing-config.ts#siteIdForPublicKey`'s `SiteListingConfig.publicKey`
+ * path) — the workspace stamped here must correspond to the SAME site the
+ * row's own `siteId` already names, not the deployment's default. NOT
+ * memoized (unlike `resolveSiteWorkspaceId()`): a different `siteId` per
+ * call means the sentinel-only cache that function keeps would be wrong
+ * here.
+ */
+async function resolveWorkspaceIdForSite(siteId: string): Promise<string | null> {
+  if (siteId === DEFAULT_WORKSPACE_SLUG) {
+    const row = await resolveSentinelWorkspaceRow(prisma);
+    return row?.id ?? null;
+  }
+  const row = await prisma.workspace.findUnique({ where: { id: siteId } });
+  return row ? siteId : null;
+}
+
+/**
+ * #6314 — resolve the capturing listicle magnet, SERVER-SIDE, from the slug
+ * the body named.
+ *
+ * All four terms in ONE query, and only `slug` came from the caller:
+ * `siteId` and `workspaceId` are the value `startProjectListingDraft` has
+ * already resolved from the site's PUBLIC KEY (`siteIdForPublicKey`, then
+ * `resolveWorkspaceIdForSite`), never from the body. `@@unique([siteId,
+ * slug])` makes the match at most one row.
+ *
+ * `kind: "listicle"` is LOAD-BEARING, not cosmetic: without it a visitor
+ * could name a contact or newsletter magnet's slug — both are public path
+ * segments — and file an application against it.
+ *
+ * NO `status` term, deliberately. A magnet can be flipped `live -> draft`
+ * while a visitor is mid-application, and dropping attribution on that flip
+ * would silently punish the operator's own edit. The cost is bounded: a draft
+ * magnet's slug is the operator's own, the resulting row lands only in that
+ * operator's own workspace, and the Applications wire row carries `status`
+ * so a never-submitted row stays legible as one.
+ *
+ * Returns `unresolved` for a slug that names nothing, names another
+ * workspace's magnet, or names a magnet of the wrong kind — those three are
+ * deliberately indistinguishable, and all three write NULL.
+ *
+ * `failed` is a FOURTH outcome and is NOT one of them: the lookup itself threw.
+ * It also writes NULL, so the wire is unchanged, but the caller must not
+ * describe it as "no such magnet" — during a database incident that would send
+ * an operator hunting a magnet-configuration problem that does not exist. This
+ * function has already logged the accurate line by the time it returns `failed`.
+ */
+type CapturingFlowResolution =
+  | { kind: "resolved"; id: string }
+  | { kind: "unresolved" }
+  | { kind: "failed" };
+
+async function resolveCapturingFlowId(
+  workspaceId: string,
+  slug: string,
+): Promise<CapturingFlowResolution> {
+  try {
+    const row = await prisma.flowDefinition.findFirst({
+      where: {
+        slug,
+        // Both scope terms, both from the value resolved above. They are equal
+        // by the `flow_definitions_workspace_site_agree` CHECK the fence added;
+        // carrying both is what makes the scope explicit at the query rather
+        // than implied by a constraint a future migration could move.
+        siteId: workspaceId,
+        workspaceId,
+        kind: "listicle",
+      },
+      select: { id: true },
+    });
+    return row === null ? { kind: "unresolved" } : { kind: "resolved", id: row.id };
+  } catch (err) {
+    // The lookup is OPTIONAL attribution on a never-gate anonymous route: an
+    // unavailable read (statement timeout, connection blip) must degrade
+    // exactly like a slug that names nothing — NULL, and the application is
+    // kept — rather than turn into a 500 that loses a real founder's
+    // submission. Both outcomes are NULL on the row, so this line is the only
+    // thing that tells an operator "lookup failed" from "no such magnet".
+    // PII-SAFE, same idiom as the unresolved-slug line below: routing
+    // metadata plus the caught error; never the founder's identity, the
+    // resume token or the verify nonce (none is in scope here).
+    logger.warn(
+      { workspaceId, capturedByFlowSlug: slug, err },
+      "[project-listings] capturedByFlowSlug lookup failed; application stored unattributed",
+    );
+    return { kind: "failed" };
+  }
+}
 
 /**
  * Create a `draft` from step one — the founder's name, email and consent.
@@ -621,11 +746,27 @@ export type StartProjectListingDraftResult =
  *
  * No slug yet: it is derived from `name` at SUBMIT (#5033 D2), which is the
  * first moment a name exists.
+ *
+ * WORKSPACE STAMP (#6203). The row's `workspaceId` is resolved from `siteId`
+ * itself (`resolveWorkspaceIdForSite` above) — never a client-supplied
+ * value, and never a fixed deployment default. An unresolved result rejects
+ * the write before any row is created (spec AC-4).
  */
 export async function startProjectListingDraft(
   siteId: string,
   input: ProjectListingStartInput,
 ): Promise<StartProjectListingDraftResult> {
+  const workspaceId = await resolveWorkspaceIdForSite(siteId);
+  if (workspaceId === null) {
+    return {
+      ok: false,
+      error: {
+        kind: "tenant_unresolved",
+        message: "This site is not configured to accept applications.",
+      },
+    };
+  }
+
   const { requestedWindowDays } = input;
   // #5407 — the NOT NULL display column. `composeFounderName` builds it from
   // the PARTS wherever both are written (even beside a `founderName` the body
@@ -684,10 +825,30 @@ export async function startProjectListingDraft(
   // wording, which nobody was shown.
   const consents = input.consents;
   const locale = input.locale ?? "en";
+  // #6314 — the capturing magnet, resolved SERVER-SIDE from the slug the body
+  // named. Only runs when the key is present, so an existing caller costs
+  // nothing; when it is, it is one probe of `@@unique([siteId, slug])`.
+  const capture =
+    input.capturedByFlowSlug === undefined
+      ? undefined
+      : await resolveCapturingFlowId(workspaceId, input.capturedByFlowSlug);
+  const capturedByFlowId = capture?.kind === "resolved" ? capture.id : null;
   const row = await prisma.$transaction(async (tx) => {
     const created = await tx.projectListing.create({
       data: {
-        siteId,
+        // #6254 AC-3/AC-6/AC-10 — the RESOLVED workspace id, not the raw
+        // `siteId` parameter: `project_listings` now requires
+        // `workspace_id = site_id`
+        // (database/migrations/20260922120000_tenancy_fence), and this
+        // column is the isolation key every downstream reader (including
+        // `submitProjectListingDraft`'s `routeLead` call) reads back as
+        // `draft.siteId`. `siteId` (the public-facing param, possibly the
+        // raw `"default"` alias) is still used above to look up
+        // `listingConfigFor`/`consentConfigForSite` — those are independent,
+        // unfenced reads keyed on the site concept, not this row.
+        siteId: workspaceId,
+        // #6203 — the isolation key, resolved above from this SAME siteId.
+        workspaceId,
         founderName,
         // #5407 — the parts as sent, beside the composed line. Absent where a
         // caller sent only a display line, which is the shape every row
@@ -705,6 +866,11 @@ export async function startProjectListingDraft(
         resumeTokenHash: hashResumeToken(resumeToken),
         emailVerifyNonceHash: hashVerifyNonce(verifyNonce),
         windowDays,
+        // #6314 — WRITE-ONCE, and only here. `draftUpdateData` never learns
+        // this key, so no patch body and no submit can re-attribute a draft
+        // to a different magnet after the fact — not by its holder, and not
+        // by anyone who obtains its resume token.
+        ...(capturedByFlowId !== null && { capturedByFlowId }),
       },
       select: { id: true },
     });
@@ -717,6 +883,33 @@ export async function startProjectListingDraft(
     return created;
   });
 
+  // #6314 — an unresolved slug is the operator's ONLY signal, precisely
+  // because the response deliberately carries none (a distinguishable error
+  // would be a cross-workspace magnet-slug oracle on an anonymous route).
+  // Without this line, a mis-wired or stale consuming site yields a
+  // permanently empty Applications list an operator cannot tell from "no
+  // applications yet".
+  //
+  // PII-SAFE, in this route family's existing idiom: routing metadata only.
+  // Never `founderEmail`, `founderName`, the resume token or the verify
+  // nonce — the last two never leave this function except inside the email.
+  // ONLY the `unresolved` outcome, never `failed`. Both store NULL and both
+  // return the same 201, but only one of them establishes "no listicle magnet
+  // of that slug in this site". Asserting it on the throw path would put a
+  // false magnet-configuration signal into the log during a database incident,
+  // which is exactly when an operator is grepping for a cause. `failed` has its
+  // own, accurate line, emitted inside `resolveCapturingFlowId`.
+  if (capture?.kind === "unresolved") {
+    logger.warn(
+      {
+        siteId,
+        listingId: row.id,
+        capturedByFlowSlug: input.capturedByFlowSlug,
+      },
+      "[project-listings] capturedByFlowSlug resolved to no listicle magnet in this site; application stored unattributed",
+    );
+  }
+
   return { ok: true, id: row.id, resumeToken, verifyNonce };
 }
 
@@ -891,6 +1084,7 @@ function draftUpdateData(
     ...(patch.headline !== undefined && { headline: patch.headline }),
     ...(patch.oneLiner !== undefined && { oneLiner: patch.oneLiner }),
     ...(patch.problem !== undefined && { problem: patch.problem }),
+    ...(patch.solution !== undefined && { solution: patch.solution }),
     ...(patch.url !== undefined && { url: patch.url }),
     ...(patch.product !== undefined && { product: patch.product }),
     ...(patch.commitment !== undefined && { commitment: patch.commitment }),
@@ -1067,15 +1261,16 @@ function applicationFromRow(
     address: row.address,
     ...(row.founderCompany !== null && { founderCompany: row.founderCompany }),
     questions: row.questions,
-    // #5285 — the three fields that became writable. Each is optional in the
-    // application schema, so a row that never carried one simply omits it and
-    // `submit` is unaffected. `requestedWindowDays` reads back the CLAMPED
+    // #5285/#5096 — the four fields that became writable. Each is optional in
+    // the application schema, so a row that never carried one simply omits it
+    // and `submit` is unaffected. `requestedWindowDays` reads back the CLAMPED
     // `windowDays` the row actually holds, not what was asked for: the
     // request is not stored anywhere, and re-asserting it would be asserting
     // a number nothing ever agreed to.
     ...(row.logoMarkUrl !== null && { logoMarkUrl: row.logoMarkUrl }),
     ...(row.logoWordmarkUrl !== null && { logoWordmarkUrl: row.logoWordmarkUrl }),
     ...(row.windowDays !== null && { requestedWindowDays: row.windowDays }),
+    ...(row.solution !== null && { solution: row.solution }),
   };
   return Object.fromEntries(
     Object.entries(all).filter(([key]) => collected.has(key)),

package/templates/apps/api/src/services/public-site-resolver.ts

@@ -0,0 +1,106 @@
+/**
+ * Public-read site resolution — which workspace an UNAUTHENTICATED content
+ * read serves (#5852, roadmap D4 read half).
+ *
+ * THE GUARD MODEL IS FAIL-CLOSED. The only branch that yields a workspace is an
+ * unambiguously one-workspace deployment, answered by the same predicate the
+ * authenticated path uses (`services/default-tenant.ts#resolveDefaultWorkspaceId`)
+ * — one predicate, reached two ways, never two predicates. Zero workspaces, two
+ * or more, or a sole workspace that is not the seeded default all resolve to
+ * `unresolved`, and the caller answers 404 before any content query runs.
+ *
+ * IT READS NO HOST. Every deployment this resolver serves today is
+ * one-workspace, so a host lookup would be dead code — and there is nothing to
+ * look up: `WorkspaceSiteIdentity` carries no host column (the value lives
+ * inside the unindexed `data.url`), and `request.hostname` resolves from
+ * `X-Forwarded-Host` under this server's `trustProxy: true` (`server.ts`),
+ * which is caller-suppliable and therefore not a tenancy input. The
+ * multi-tenant host branch is #3635's, and must resolve against a server-side
+ * binding rather than a forwarded header.
+ *
+ * THE CLIENT NEVER SUPPLIES A WORKSPACE. No path parameter, query string,
+ * header or body field is read here, on any read. That is roadmap D4's own
+ * STOP boundary, not a default.
+ *
+ * IT IS A NO-OP OFF THE DATABASE ADAPTER. Unless `CONTENT_ADAPTER=database`,
+ * the function returns `not-required` having issued no query and loaded no
+ * database module — which is what keeps the MDX default path byte-identical
+ * and keeps the no-`DATABASE_URL` scaffold starting.
+ */
+import {
+  resolvedAdapterKind,
+  type ArtifactPrismaClient,
+  type ContentAdapter,
+} from "@working-theory/content-adapters";
+import type { FastifyRequest } from "fastify";
+
+import { getContentAdapter } from "../lib/content-adapter.js";
+
+/**
+ * The three answers a public read can get. `reason` exists for `request.log`
+ * only: the route decides its response from `kind` alone, so no resolution
+ * detail reaches an unauthenticated caller (#5852 D7, D8).
+ */
+export type PublicSiteResolution =
+  | { kind: "not-required" }
+  | { kind: "resolved"; workspaceId: string }
+  | { kind: "unresolved"; reason: "ambiguous" | "host-unmatched" };
+
+/**
+ * Resolves the workspace a public content read serves, or refuses to.
+ *
+ * The `request` argument is the site identifier's eventual source (#3635) and
+ * is deliberately unused today — see the no-host note in this file's header.
+ */
+export async function resolvePublicWorkspace(
+  _request: FastifyRequest,
+): Promise<PublicSiteResolution> {
+  if (resolvedAdapterKind() !== "database") {
+    return { kind: "not-required" };
+  }
+
+  // Deferred — see the module-load note in this file's header (#5852 D6).
+  const { resolveDefaultWorkspaceId } = await import("./default-tenant.js");
+  const workspaceId = await resolveDefaultWorkspaceId();
+  if (workspaceId === null) {
+    return { kind: "unresolved", reason: "ambiguous" };
+  }
+  return { kind: "resolved", workspaceId };
+}
+
+/**
+ * The adapter a public content read should use, or `null` when it must refuse.
+ *
+ * This is the ONE place the three-armed resolution collapses into a decision,
+ * so a second public read route cannot grow a second copy of it: `resolved`
+ * and `not-required` both yield an adapter, `unresolved` yields `null`. The
+ * caller answers `null` with its OWN existing not-found body — which is what
+ * keeps a refusal byte-identical to a missing page on `get-page`, and keeps
+ * each route's 404 shape its own (#5852 D8). The reason is logged here and
+ * never leaves the server.
+ */
+export async function resolvePublicContentAdapter(
+  request: FastifyRequest,
+): Promise<ContentAdapter | null> {
+  const site = await resolvePublicWorkspace(request);
+  if (site.kind === "unresolved") {
+    request.log.warn(
+      { reason: site.reason },
+      "[Content] no site resolved for public read",
+    );
+    return null;
+  }
+  if (site.kind === "not-required") {
+    return getContentAdapter();
+  }
+
+  // The database path, and the only caller that needs apps/api's client. The
+  // import is deferred for the reason the header gives (#5852 D6), and the
+  // generated client is structurally wider than the narrow read surface the
+  // adapter declares — the cast names that, and nothing else.
+  const { prisma } = await import("../lib/prisma.js");
+  return getContentAdapter({
+    workspaceId: site.workspaceId,
+    prisma: prisma as unknown as ArtifactPrismaClient,
+  });
+}