create-ailk 0.5.0 → 0.6.1

package/site-templates/simple-service/content/en/ServicesList/services.mdx

@@ -0,0 +1,72 @@
+---
+type: "ServicesList"
+slug: "services"
+title: "Services"
+description: "The three jobs {your company} does, each with its own price. Placeholder copy — replace before you launch."
+sections:
+  [
+    {
+      "id": "hero",
+      "type": "hero",
+      "data":
+        {
+          "variant": "centered",
+          "eyebrow": "Services",
+          "headline": "Three jobs, three prices",
+          "subheadline": "{One line on how to choose between them. Name the question a reader is actually asking.}",
+        },
+    },
+    {
+      "id": "jobs",
+      "type": "items",
+      "data":
+        {
+          "headline": "What we do",
+          "columns": 3,
+          "items":
+            [
+              {
+                "title": "{Lawn maintenance}",
+                "description": "{One line on the recurring visit — what it includes and how often it runs.}",
+                "link":
+                  {
+                    "label": "Read more",
+                    "href": "/services/lawn-maintenance",
+                  },
+              },
+              {
+                "title": "{Seasonal cleanup}",
+                "description": "{One line on the spring and autumn clear-down.}",
+                "link":
+                  {
+                    "label": "Read more",
+                    "href": "/services/seasonal-cleanup",
+                  },
+              },
+              {
+                "title": "{Landscape design}",
+                "description": "{One line on the design-and-plant job, and what a customer ends up with.}",
+                "link":
+                  {
+                    "label": "Read more",
+                    "href": "/services/landscape-design",
+                  },
+              },
+            ],
+        },
+    },
+    {
+      "id": "closing",
+      "type": "cta",
+      "data":
+        {
+          "variant": "minimal",
+          "headline": "Not sure which one?",
+          "description": "{One line inviting the reader to book the visit instead of guessing.}",
+          "primaryCta": { "label": "Book a visit →", "href": "/meet" },
+        },
+    },
+  ]
+---
+
+Placeholder copy. The three detail pages under `content/en/Service/` carry the long form and the price; this page is the chooser.

package/site-templates/simple-service/provenance.json

@@ -0,0 +1,4 @@
+{
+  "template": "simple-service",
+  "requires": ["marketing", "scheduling", "commerce"]
+}

package/templates/.env.example

@@ -23,13 +23,20 @@ STEALTH=true
 # hide the Blog link. Set BLOG_ENABLED=true and redeploy to launch the blog.
 # BLOG_ENABLED=true
 
-# ── Content backend ──────────────────────────────────────────────────────────
-# Default: mdx — reads from /content/*.mdx at the repo root.
-# Set to "pro-cms" to use the paid Pro CMS adapter (separate package, not
-# bundled with the OSS template).
-CONTENT_BACKEND=mdx
+# ── Content adapter ──────────────────────────────────────────────────────────
+# Which content adapter every consumer resolves: mdx (default, reads
+# /content/*.mdx at the repo root) | projection (compiled manifest) | database
+# (the Artifact store — needs a workspaceId).
+CONTENT_ADAPTER=mdx
+# CONTENT_BACKEND is deprecated — read for one release, then removed.
 # Override the content directory (default: <repo-root>/content). Useful for tests.
 # AILK_CONTENT_ROOT=
+# Publish revalidation (#5851) — where apps/api POSTs on publish/unpublish so
+# the site purges the affected tag, and the HMAC-SHA256 key it signs the body
+# with. Required only under CONTENT_ADAPTER=database; with the URL unset the
+# webhook is a logged no-op.
+# CONTENT_REVALIDATE_URL=https://example.com/api/revalidate
+# CONTENT_REVALIDATE_SECRET=
 
 # ── Database (optional in standalone mode) ───────────────────────────────────
 # DATABASE_URL=postgres://user:pass@host:5432/db
@@ -51,8 +58,9 @@ CONTENT_BACKEND=mdx
 # BETTER_AUTH_SECRET=
 
 # ── Single-tenant operator pin (apps/api) ────────────────────────────────────
-# REQUIRED on a build WITHOUT the multi-tenant module if you want the
-# submissions review dashboard. OPTIONAL with the module.
+# REQUIRED on a build WITHOUT the multi-tenant module — for the submissions
+# review dashboard AND for the `workspace` module's settings surface.
+# OPTIONAL with the multi-tenant module.
 #
 # On a single-tenant deployment (the default Workspace exists and is the ONLY
 # Workspace) the FIRST authenticated user to resolve a tenant context is
@@ -68,6 +76,15 @@ CONTENT_BACKEND=mdx
 # whoever authenticates first — on a site with public sign-ups that is not
 # necessarily you. The pinned account's email must also be VERIFIED.
 #
+# The same MANDATORY-and-fail-closed rule covers a `--modules workspace`
+# deployment (#5371, #5515 item 1). The Pro workspace module registers
+# /v1/workspaces/:workspaceId/{theme,identity,seo,general,members} behind the
+# same guard, so on a workspace-only build the module's Admin pages (/admin)
+# answer 403 to everyone until this is set — and, because the guard refuses
+# BEFORE resolving, the first account to load the settings page cannot bind
+# ITSELF as the sole owner off a plain GET. Set this before you hand the site
+# to its owner.
+#
 # If your own dashboard returns 403, this variable is the first thing to
 # check. With the multi-tenant module present, resolution comes from the
 # session's active workspace and this stays optional, exactly as before.
@@ -123,6 +140,45 @@ CONTENT_BACKEND=mdx
 # default.
 # RESEND_AUDIENCE_ID=
 #
+# Request-and-confirm (#5970) — the callback request a site owner confirms by
+# an emailed link, which mints a Stripe Payment Link for the customer to pay
+# on. Off by default: with the flag unset the callback route behaves exactly as
+# it always has.
+#
+# Set to "true" to turn it on. Anything else (including absent) is off, and TO,
+# FROM and AILK_PUBLIC_API_URL must ALSO resolve or the path stays off — a flag
+# with no recipient would write a credential nobody is sent.
+#
+# SINGLE-TENANT ONLY. On a build carrying the multi-tenant module this flag is
+# ignored and the callback route behaves exactly as it does with the feature
+# off. Every value here is process-wide, as is STRIPE_SECRET_KEY, so on a
+# multi-tenant deployment one tenant's customer would pay into the
+# deployment's own Stripe account. Lighting it up there means resolving these
+# per site, which is a separate piece of work.
+# AILK_REQUEST_CONFIRM_ENABLED=
+#
+# Where the confirm link is sent — the site owner's own address. Optional:
+# falls back to AILK_LEAD_NOTIFICATION_TO when unset. This message SUPERSEDES
+# the generic lead notification for a callback, so the owner still receives
+# exactly one email; it just carries more (the request's details, plus the
+# link).
+# AILK_REQUEST_CONFIRM_TO=
+#
+# The verified sender for both the owner's confirm email and the customer's
+# payment-link email. Optional — falls back to AILK_LEAD_NOTIFICATION_FROM.
+# AILK_REQUEST_CONFIRM_FROM=
+#
+# The confirm form's default currency, lowercase ISO-4217. Optional; defaults
+# to usd.
+# AILK_REQUEST_CONFIRM_CURRENCY=
+#
+# The most the confirm form will price a job at, in MINOR units (cents).
+# Optional; defaults to 1000000 — ten thousand dollars at two decimal places.
+# High enough not to obstruct a real job, low enough that a typo with three
+# extra zeroes is refused rather than charged. A value that does not parse as a
+# positive integer falls back to the default rather than becoming unbounded.
+# AILK_REQUEST_CONFIRM_MAX_MINOR=
+#
 # The public base URL this API is reachable at, e.g. https://api.example.com
 # (no trailing slash). This is the API's OWN origin — distinct from
 # FRONTEND_URL (the site the browser loads) and from `_site.mdx`'s `baseUrl`
@@ -137,6 +193,11 @@ CONTENT_BACKEND=mdx
 #   2. The OpenAPI `servers` block (#5306). Unset degrades to a single
 #      document-relative server (`/`), which an agent resolves against the
 #      origin it fetched the spec from — correct, just less explicit.
+#   3. The request-and-confirm link (#5970):
+#      `${AILK_PUBLIC_API_URL}/v1/requests/:id/confirm?token=…`. The confirm
+#      route is on this API, so this is the right base and no second
+#      base-URL variable exists. Unset means the confirm email is skipped
+#      (logged, with the row still written and the 201 unchanged).
 # AILK_PUBLIC_API_URL=
 #
 # The apps/api origin @working-theory/api-client calls from
@@ -313,6 +374,10 @@ CONTENT_BACKEND=mdx
 # booking page. Full notes in apps/api/.env.example.
 # CAL_API_KEY=cal_live_xxx
 # CAL_API_BASE_URL=https://api.cal.com
+# HMAC-SHA256 key POST /v1/webhooks/calcom verifies the x-cal-signature-256
+# header against (#6085). Unset makes the receiver answer 503 and accept
+# nothing — the same fail-closed posture an unset STRIPE_WEBHOOK_SECRET has.
+# CAL_WEBHOOK_SECRET=
 # SCHEDULING_PUBLIC_BASE_URL=https://cal.com
 # SCHEDULING_PROVIDER=cal
 #

package/templates/CLAUDE.md

@@ -40,7 +40,7 @@ Where to find the rule, surface, or fact you need.
 
 | For…                                           | Look at                                                        |
 | ---------------------------------------------- | -------------------------------------------------------------- |
-| Per-issue workflow (pick → branch → TDD → PR)  | `.claude/rules/loop-contract.md`                               |
+| Per-issue workflow (pick → branch → TDD → PR)  | § Workflow, below                                              |
 | Architecture boundaries (the why + escalation) | `.claude/rules/architecture.md`                                |
 | Diff hygiene when editing existing files       | `.claude/rules/preserve-existing-style.md`                     |
 | Skills available to invoke                     | `.claude/skills/README.md`                                     |
@@ -56,8 +56,7 @@ when you find it. Future-you will thank present-you.
 
 ## Workflow
 
-The single-developer flow is described fully in
-`.claude/rules/loop-contract.md`. The short version:
+The single-developer flow, in full:
 
 1. Pick or open an issue with a `## Acceptance Criteria` section.
 2. Branch from your default branch (typically `main`).

package/templates/DESIGN.md

@@ -0,0 +1,155 @@
+---
+name: AI Launch Kit base scaffold
+description: The foundation every AI Launch Kit site starts from — pure white, black ink, black hairline rules, system type, generous pacing.
+colors:
+  bg: "#ffffff"
+  fg: "#000000"
+  surface: "#ffffff"
+  surface-secondary: "#ffffff"
+  border: "#000000"
+  text-muted: "#333333"
+  brand: "#000000"
+  fg-on-brand: "#ffffff"
+  accent: "#000000"
+  bg-dark: "#000000"
+  fg-dark: "#ffffff"
+  border-dark: "#ffffff"
+  brand-dark: "#ffffff"
+typography:
+  display:
+    fontFamily: "system-ui, -apple-system, Segoe UI, Roboto, Helvetica Neue, sans-serif"
+    fontSize: "6rem"
+    fontWeight: 400
+    lineHeight: 1
+    letterSpacing: "-0.05em"
+  heading-section:
+    fontFamily: "system-ui, -apple-system, Segoe UI, Roboto, Helvetica Neue, sans-serif"
+    fontSize: "2.25rem"
+    fontWeight: 400
+    lineHeight: 1.25
+    letterSpacing: "-0.05em"
+  heading-item:
+    fontSize: "1.25rem"
+    fontWeight: 600
+    lineHeight: 1.375
+  body:
+    fontFamily: "system-ui, -apple-system, Segoe UI, Roboto, Helvetica Neue, sans-serif"
+    fontSize: "1.125rem"
+    fontWeight: 400
+    lineHeight: 1.5
+  eyebrow:
+    fontSize: "0.875rem"
+    fontWeight: 600
+    lineHeight: 1.4
+    letterSpacing: "0.05em"
+rounded:
+  button: "0.25rem"
+  card: "0.75rem"
+spacing:
+  section: "4rem"
+  card: "1.5rem"
+  grid: "1.5rem"
+  container: "1280px"
+---
+
+<!--
+  Source template: _base (the AI Launch Kit base scaffold)
+  Version: create-ailk {{CREATE_AILK_VERSION}}
+
+  This file describes the visual system this scaffold ships with. The impeccable
+  design skill reads it at the start of every design session, so an agent
+  building a new page stays on-system.
+
+  A site template (installed with `--template <name>`) replaces this file with
+  its own DESIGN.md — same path, with a header naming the template it came
+  from. Edit whichever one your site has; the header tells you which.
+
+  The tokens above describe what the scaffold RENDERS today. Colours come from
+  content/_site.mdx (`theme.colors`); type, radius and spacing are platform
+  defaults a site cannot override yet — see "Where this is heading" below.
+-->
+
+# AI Launch Kit base scaffold
+
+## Overview
+
+The foundation reads like a well-made wireframe: nothing on the page but the words, black on white, with rules where other sites use shadows and colour. It is the look of a site whose owner has not chosen a brand yet and does not pretend otherwise — every placeholder reads as a placeholder, and the structure of the argument is what the visitor sees. A brand is applied on top of it; it is not one.
+
+Every page is composed from the AI Launch Kit component library (`@working-theory/ui`). Nothing is hand-built: a page is a list of registered sections, each with a bounded set of variants. Each section is one full-width band with a lot of air around it.
+
+## Colors
+
+### Primary
+
+**Black** (`brand` `#000000`) fills the primary button; its label is white. The secondary button is white with a black hairline and black label.
+
+### Neutral
+
+Pure white ground (`bg` `#ffffff`), pure black ink for headings (`fg` `#000000`), and near-black `#333333` for body copy — well above AA on white. **Borders are black** (`#000000`): card outlines, the rule under the navigation, the rules between sections and the rule above the footer are all 1px black lines. Cards are white, not tinted (`surface-secondary` is white too). There is no accent colour — `accent` is black.
+
+Dark mode inverts: black ground, white ink, white rules, white primary button with black label.
+
+### Named Rules
+
+- **Rules, not fills.** A container is drawn with a black hairline on the white ground. Grey fills are reserved for image placeholders.
+
+## Typography
+
+System sans throughout; no web font.
+
+### Hierarchy
+
+| Role            | Size     | Weight | Notes                                                                       |
+| --------------- | -------- | ------ | --------------------------------------------------------------------------- |
+| Hero headline   | 6rem     | 400    | Tracking -0.05em, line-height 1                                             |
+| Section heading | 2.25rem  | 400    | Tracking -0.05em — light and tight, not bold                                |
+| Item heading    | 1.25rem  | 600    | Card, feature and step titles                                               |
+| Body            | 1.125rem | 400    | `#333333`, line-height 1.5                                                  |
+| Section label   | 0.875rem | 600    | Uppercase, +0.05em tracking today — the small label above a section heading |
+
+Measured from the rendered scaffold (1440px wide), not transcribed from tokens.
+
+The small label above a section heading is **kept** as part of this foundation's voice (operator-disposed 2026-09-22) and is headed toward the treatment below.
+
+## Layout
+
+Content sits in a 1280px container. Sections stack at the platform's 4rem rhythm today; a few sections choose a compact (2.5rem) or spacious (6rem) step internally. Card grids gap at 1.5rem. Breakpoints: 320 / 768 / 1024 / 1440.
+
+## Shapes
+
+Two radii today: buttons at 0.25rem, cards and outlined boxes at 0.75rem. Headed toward square corners — see below.
+
+## Components
+
+### Buttons
+
+Primary: black fill, white label, 0.25rem corners. Secondary: transparent with a black 1px outline and black label. Both are the library `Button`.
+
+### Cards / Containers
+
+White panels with a black 1px outline, 0.75rem corners, `card` (1.5rem) padding. The one exception today: the "how it works" steps render as dark filled cards (see below).
+
+### Navigation
+
+Wordmark or logo left, page links, then an outlined and a filled button at the far right. A black hairline separates it from the page. An optional announcement banner sits above it.
+
+## Where this is heading
+
+The foundation's pinned direction is the pacing of a classic wireframe marketing kit — `standardissue.webflow.io` is the reference for rhythm, type scale, spacing density and section pacing only; no image, copy or code is taken from it. Six parts of that direction cannot be expressed through a site's theme today, so they wait on a platform change rather than being hand-coded. Until they land, this file describes the rendered site above, not these targets.
+
+| Target                                            | Reference value                                                                                                                  | Blocked by                                                                                               |
+| ------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| Square corners on buttons, cards and inputs       | radius 0                                                                                                                         | A site's `theme:` block accepts colours only — no radius                                                 |
+| Bold, tighter headings                            | hero ~3.6rem and section headings ~2.9rem, both at weight 700 with tracking about -0.02em (today 6rem and 2.25rem at weight 400) | No per-site type-role override                                                                           |
+| Generous section pacing                           | about 10rem between sections, not 4rem                                                                                           | No per-site section-spacing override; `spacious` (6rem) is not author-selectable                         |
+| Section label in sentence case, bold, no tracking | "Core Features", not "CORE FEATURES"                                                                                             | The eyebrow role bakes in uppercase and tracking                                                         |
+| Whitespace between sections, not rules            | no rule between bands                                                                                                            | Section dividers share the one `border` colour with card outlines, so black outlines make black dividers |
+| Outlined steps in "how it works"                  | three plain outlined columns                                                                                                     | The steps section renders dark filled cards; no outlined variant                                         |
+
+## Do's and Don'ts
+
+- **Do** keep every page built from registered sections. If a section you need does not exist, request it rather than writing one-off markup.
+- **Do** change colours in `content/_site.mdx` `theme.colors`; they reach every section.
+- **Don't** add a colour accent. The foundation's one idea is black on white; a brand pass adds colour deliberately, through the theme.
+- **Don't** replace a black rule with a shadow or a grey fill.
+- **Don't** hard-code the "heading toward" values above into a page. They arrive through the platform, or not at all.

package/templates/README.md

@@ -29,7 +29,7 @@ pnpm preflight   # architecture + types + lint + build
 pnpm build       # production build
 ```
 
-> Requires Node.js 20+ and `pnpm`. No vendor API keys are required for first boot — Stripe, Anthropic, and email-provider integrations are opt-in.
+> Requires Node.js 20+ and `pnpm` — that is the whole prerequisite list. No database is needed to run or build this site (see [When you need a database](#when-you-need-a-database)), and no vendor API keys are required for first boot — Stripe, Anthropic, and email-provider integrations are opt-in. `pnpm install` generates the Prisma client for you; there is no generator step to remember.
 
 ## Content
 
@@ -63,16 +63,50 @@ Apply `myTheme` via the provider you use to wrap children. The full extension su
 
 Copy `.env.example` to `.env` and fill in only what you need. Most variables are optional. A complete reference:
 
-| Variable                           | Purpose                                                                                                                   |
-| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
-| `AILK_LICENSE_KEY`                 | Optional. JWT issued by ailaunchkit.ai; verified locally to unlock Pro features. Get one at <https://ailaunchkit.ai/pro>. |
-| `NEXT_PUBLIC_STREAMING_AI_ENABLED` | Optional. Set to `true` to enable the opt-in streaming AI assist UI. Off by default.                                      |
-| `ANTHROPIC_API_KEY`                | Required only when `NEXT_PUBLIC_STREAMING_AI_ENABLED=true`. Used by the AI assist surface only.                           |
-| `AILK_LOCAL_LEAD_CAPTURE`          | Optional. When `true`, leads from the contact form are written to a local file instead of an API.                         |
-| `AILK_LEADS_API_URL`               | Optional. Override the upstream that receives lead-capture submissions.                                                   |
+| Variable                           | Purpose                                                                                                                       |
+| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
+| `AILK_LICENSE_KEY`                 | Optional. JWT issued by ailaunchkit.ai; verified locally to unlock Pro features. Get one at <https://ailaunchkit.ai/pricing>. |
+| `NEXT_PUBLIC_STREAMING_AI_ENABLED` | Optional. Set to `true` to enable the opt-in streaming AI assist UI. Off by default.                                          |
+| `ANTHROPIC_API_KEY`                | Required only when `NEXT_PUBLIC_STREAMING_AI_ENABLED=true`. Used by the AI assist surface only.                               |
+| `AILK_LOCAL_LEAD_CAPTURE`          | Optional. When `true`, leads from the contact form are written to a local file instead of an API.                             |
+| `AILK_LEADS_API_URL`               | Optional. Override the upstream that receives lead-capture submissions.                                                       |
 
 See [`.env.example`](./.env.example) for the full template with comments. Per-app overrides (e.g. `apps/api/.env`) are honored alongside the root `.env`.
 
+## When you need a database
+
+**A free marketing site needs no database at all.** `pnpm install`, `pnpm dev` and `pnpm build` all run green on an empty machine with no Postgres, no `DATABASE_URL` and no `.env` — the pages render from `content/*.mdx`, and the Prisma client is generated for you by `database`'s `postinstall` so the workspace type-checks and builds either way.
+
+You need Postgres once you turn on one of these four:
+
+| Surface                                | What it stores                                                                                                    |
+| -------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| **Auth** (sign-in, sessions, accounts) | users, sessions, accounts                                                                                         |
+| **Flows** — `/save` and `/checkout`    | a visitor's in-progress flow state, so they can resume or pay later                                               |
+| **Lead capture in DB mode**            | submitted leads. The default file mode (`AILK_LOCAL_LEAD_CAPTURE=true`) writes to disk instead and needs nothing. |
+| **`CONTENT_ADAPTER=database`**         | pages authored in the Artifact store rather than in `content/*.mdx`                                               |
+
+### One command to get one
+
+```bash
+docker run --name ailk-postgres -e POSTGRES_PASSWORD=postgres -p 5432:5432 -d postgres:17
+```
+
+Point the app at it in `.env` (both variables, same URL for local work — the second is the direct connection `prisma migrate` uses):
+
+```bash
+DATABASE_URL=postgresql://postgres:postgres@localhost:5432/postgres
+DATABASE_URL_NON_POOLED=postgresql://postgres:postgres@localhost:5432/postgres
+```
+
+Then create the tables:
+
+```bash
+pnpm db:migrate:deploy
+```
+
+That is the whole setup. `pnpm db:studio` opens a browser UI over the data, and `pnpm db:seed` loads the sample rows. Turning the database off again is just unsetting the two variables — the marketing pages never read it.
+
 ## AI assist (optional)
 
 The site ships with an opt-in streaming AI assist. It is **off by default**. To turn it on, set `NEXT_PUBLIC_STREAMING_AI_ENABLED=true` in `.env` and provide an `ANTHROPIC_API_KEY`. The assist runs server-side so the API key never reaches the browser. With both unset, the chat UI is hidden and no AI traffic flows.

package/templates/apps/api/.ailk/inbox/2026-09-20T14-57-31.552Z-fallback-1789916251590-037e9005.json

@@ -0,0 +1,8 @@
+{
+  "id": "fallback-1789916251590-037e9005",
+  "siteId": "site_1",
+  "source": "callback",
+  "email": "",
+  "payload": {},
+  "createdAt": "2026-09-20T14:57:31.552Z"
+}

package/templates/apps/api/.ailk/inbox/2026-09-20T14-57-33.840Z-fallback-1789916253842-b52659e9.json

@@ -0,0 +1,12 @@
+{
+  "id": "fallback-1789916253842-b52659e9",
+  "siteId": "wksp_00000000-0000-7000-8000-000000000001",
+  "source": "flow:get-a-quote",
+  "email": "abandoner@example.com",
+  "payload": {
+    "email": "abandoner@example.com",
+    "flowSlug": "get-a-quote",
+    "locale": "en"
+  },
+  "createdAt": "2026-09-20T14:57:33.840Z"
+}

package/templates/apps/api/.ailk/inbox/2026-09-20T14-57-33.844Z-fallback-1789916253845-6b266f8c.json

@@ -0,0 +1,12 @@
+{
+  "id": "fallback-1789916253845-6b266f8c",
+  "siteId": "default",
+  "source": "flow:get-a-quote",
+  "email": "abandoner@example.com",
+  "payload": {
+    "email": "abandoner@example.com",
+    "flowSlug": "get-a-quote",
+    "locale": "en"
+  },
+  "createdAt": "2026-09-20T14:57:33.844Z"
+}

package/templates/apps/api/.env.example

@@ -57,6 +57,19 @@ STRIPE_WEBHOOK_SECRET=whsec_xxx
 # Provider selector. Only "cal" is implemented today; the self-hosted engine
 # (#4288) lands as a second value here with no change to the section.
 # SCHEDULING_PROVIDER=cal
+#
+# The booking webhook receiver (#6085) — a SEPARATE credential from the
+# three above: it verifies POST /v1/webhooks/calcom's x-cal-signature-256
+# header, it does not call the provider. Unset makes the receiver answer 503
+# and accept nothing (the same fail-closed posture STRIPE_WEBHOOK_SECRET
+# unset already has) — every booking is then silently lost, so this must be
+# set for the receiver to do anything.
+# CAL_WEBHOOK_SECRET=
+# GET /v1/schedule/appointments only returns rows where this deployment's
+# AILK_SITE_ID (declared below, under "Project listings — site addressing")
+# equals the caller's own workspace id: the receiver writes under
+# AILK_SITE_ID, the read scopes to the tenant's workspace, and a mismatch
+# fails EMPTY, never wide.
 
 # =============================================================================
 # Paid modules (D-44, #5368)

package/templates/apps/api/CLAUDE.md

@@ -40,14 +40,24 @@ Routes are versioned under `/v1/*`:
 - `/v1/leads` (GET, `?cursor=&limit=`) — the leads INBOX read (#5678): the caller's OWN sites' leads, newest first, cursor-paginated (`limit` defaults to 50, max 200; `(createdAt desc, id desc)`; `cursor` is the previous page's last row id, and one that does not resolve within the caller's scope is a 400, never a silent page 1 — the API keeps that contract, and the web inbox deliberately softens it on its own side by re-reading page one when a URL-supplied cursor 400s, which is a rendering choice and not a change to this response). Five fields per row and nothing more — `id`, `name` (lifted from `payload.name` when the site's form captured one), `email`, `source`, `createdAt`; `payload`'s other keys, `siteId`, `promotedUserId` and `promotedAt` are never selected (`src/services/leads-inbox.ts` is the only read path). Registered in `authScope` only (auth, no tenant guard) and — alone in that scope — **unconditionally**, with no `isModuleEnabled()` gate: lead capture is a never-gate surface at every level, so reading a lead back cannot be gated either. Identity is `request.userId`; there is no site, org or workspace parameter, so the scope cannot be widened from the wire. It is resolved from the caller's own memberships by `src/services/owner-workspaces.ts`'s `resolveOwnerWorkspaces` — the ONE site→workspace resolution in this app, shared with `lead-promotion.ts` rather than written a second time — and every read filters `siteId ∈ workspaceIds`. Role floor `owner|admin` (contact PII), the same floor and the same reason as `/v1/waitlist-experiments/*`; the scope is the UNION of every workspace the caller owns or administers, not one active tenant, because this route registers outside the tenant scope. **Two deployment preconditions decide whether it returns anything, and both fail EMPTY rather than wide:** a build with no `multi-tenant` module resolves no workspaces (a deliberate scope limit since #5677, not an absence of anything to resolve), and the `siteId` the leads were WRITTEN under must equal a workspace id. That `siteId` has TWO sources, and `currentSiteId()` is not the one on the primary path: the three POST capture routes read it from the REQUEST BODY (`routes/leads/index.ts`), which the capture sections declare in content and default to `"default"` (`ContactForm`/`Newsletter`/`StepFlow`, `ext.siteId ?? "default"`), while the recommender's capture path (`routes/flows/recommender.ts`) is the one that uses `currentSiteId()` (`lib/site.ts`, `AILK_SITE_ID ?? "default"`). A workspace id is `wksp_<uuidv7>`, so `siteId ∈ workspaceIds` matches only when the content-declared value — and, for recommender leads, `AILK_SITE_ID` — is set to it (the same convention `waitlist-dashboard.ts` already relies on). The rendered `name` is lifted from `payload.name` and truncated at 200 characters: the write side bounds `payload` at 64 keys and no per-value length, and `POST /v1/leads/submit` is anonymous with no ownership check on `siteId`. No MCP twin — identity-bound (#3591 exception, the same shape as `/v1/workspaces/*` and `/v1/billing/*`).
 - `/v1/flows/:slug` (GET), `/v1/flows/:slug/steps` (POST) — serve a flow config + submit a step's answers; server-side per-step partial-state persistence (#3956). Module: `signal-collectors` (D-48, #5366) — registers only when the module is enabled; MCP twins `get_flow`/`submit_flow_step` carry the same `module` tag (D7).
 - `/v1/flows/:slug/aggregate` (GET) — anonymous, site-scoped per-question response counts across all completed respondents for the results reveal (#4771): respondents are completed `FlowSession` rows (not `Lead` rows — a recommending-mode respondent has no Lead until the email moment), question metadata + the chart flag come from the `WaitlistExperiment` register, and only `resultsReveal`-flagged `single`/`multi` questions are returned (`src/services/flow-aggregate.ts`). No individual answer, email, name, session id, or score in the response; no auth. Module: `signal-collectors`. No MCP twin — recorded exception (an agent walking a flow already gets everything it needs from `submit_flow_step`'s own response; "how everyone else answered" changes none of it).
-- `/v1/deliverables/:grantId` (GET) — the capability-token download route for gated PDFs and reports, including client deliverables (#3961 D5); the token itself is the sole gate, no auth preHandler applies (`src/routes/deliverables/index.ts`). Module: `signal-collectors` (D-48, #5366). No MCP twin — identity-bound capability-link download (#3591 exception, the same shape as `/v1/waitlist-signups/me`).
+- `/v1/deliverables/:grantId` (GET) — the capability-token download route for gated PDFs and reports, including client deliverables (#3961 D5); the token itself is the sole gate, no auth preHandler applies (`src/routes/deliverables/index.ts`). Module: `signal-collectors` (D-48, #5366). No MCP twin — identity-bound capability-link download (#3591 exception, the same shape as `/v1/waitlist-signups/me`). **Three grant classes since #6310**, keyed on `grant.assetId`'s ADR-0031 prefix: `playbook:` (unchanged, the FEAT-074 U4b virtual asset); `asset_` — a workspace `Asset`, resolved through the named boundary `src/lib/deliverable-asset-store.ts`, scoped by `grant.workspaceId` (a serve-time tenancy re-check restored for this class — D15) — served `attachment` with an extension pinned to the stored content type, `nosniff`, a non-raster `Content-Security-Policy` (for EVERY content type, including raster — never `inline`), and `Cache-Control: private, no-store` so a deleted asset stops downloading immediately; `dasset_` — the LEGACY `DeliverableAsset` store (unchanged, tried only when a magnet's `assetKey` does not resolve against `Asset`). Every miss on the `asset_` class — a NULL `workspaceId`, no row, a foreign-workspace row — folds into the SAME uniform 404 as every other class; there is deliberately no redirect to the public `GET /v1/assets/:assetId` (that route's year-long `immutable` cache would defeat deletion as a revocation lever, and would collapse every lead's capability onto one workspace-canonical id — spec #6310 §9 SEC-001/SEC-002).
 - `/v1/flows/:slug/save` (POST), `/v1/flows/:slug/checkout` (POST) — the recommender's email moment (#4841): `save` creates the FlowSession + Lead (+ the T+0 DeliverableGrant) for the permalink's answers; `checkout` does the same, records the `FlowCheckout` buyer row at a SERVER-recomputed `price()` (the body carries no amount — `flowCheckoutInputSchema` is strict), and opens a Stripe TEST-mode Checkout Session whose metadata carries the permalink + offer key (`src/routes/flows/recommender.ts`, `src/services/recommender-capture.ts`, `packages/stripe-client`'s `createQuotedCheckoutSession`). Anonymous, rate-limited; a non-`sk_test_` key is refused before any side effect. No MCP twin — recorded exception: an agent walking a flow has no email to give and no card to pay with; the anonymous MCP surface is identity-blind.
+- `/v1/workspaces/:workspaceId/magnets` (GET, POST), `/v1/workspaces/:workspaceId/magnets/:id` (GET, PATCH), `/v1/workspaces/:workspaceId/magnets/:id/signups` (GET), `/v1/workspaces/:workspaceId/magnets/:id/subscribers` (GET), `/v1/workspaces/:workspaceId/magnets/:id/messages` (GET) — the tenant-scoped magnet Admin authoring surface over the flow engine's `FlowDefinition` rows (#6157 S5c, `src/routes/magnets/index.ts`): list (cursor-paginated, fixed 50-row page), create, get, update, and the three per-magnet captured-lead reads (#6246 S6h). Reads and writes only through `tenantDb(tenant).flows` — never `prisma.flowDefinition`, `currentSiteId()`, or `upsertFlowDefinition` (the PUBLIC/seed path below, which the admin path never calls). No DELETE — the reversible alternative is `status: "draft"` (#6156), which stops a NEW walk from starting while an in-flight walk finishes on its pinned snapshot. `slug` lives only inside `config.slug` and is immutable through this surface after create (`400 slug_immutable` on a mismatched PATCH). The two operator-writable config URLs (`abandonEmail.resumeUrl`, `followUps[].cta.href`) pass an exact-origin gate against `FRONTEND_URL` before any write, the same discipline the recommender's checkout redirect already applies (#4912). Role floor `owner|admin` on all seven routes — a magnet's `config` carries `scoring` thresholds, `offers`/`rateTable` and `deliverables` asset keys, so no route exposes it at member level. Both writes declare a route-level `bodyLimit` (256 KiB) and each records one `recordAgentAction` audit row. Module: `multi-tenant || signal-collectors`, the same gate the review-surface dashboard (`/v1/waitlist-experiments/*`, `/v1/project-listings/*`) already registers under. No MCP twin on any of the seven — identity-bound tenant routes (#3591 exception, same shape as the sibling `/v1/workspaces/*` routes); the public `/v1/flows/*` routes and their two MCP tools are unchanged, pinned by `src/routes/flows/__tests__/parity.test.ts`. **The three new list routes (#6246 S6h)** join every magnet through `Lead.source = 'flow:' + <the resolved magnet's slug>` — the literal string `flow-engine.ts`'s `completeSubmission` stamps on every flow-engine `Lead` row regardless of kind, including `newsletter`/`waitlist` (`Subscriber` is written only by the separate, pre-flow-engine `subscribe_newsletter` path, unrelated to a magnet) — via ONE new `tenantDb(tenant).leads.listBySource(source, { limit })` accessor, an exact-source-equality sibling of #6204's allowlist-scoped `listUnhandledMessages`, served by a new `(workspaceId, source)` composite index on `Lead`. `/signups` expects `kind: "waitlist"`, `/subscribers` expects `"newsletter"`, `/messages` expects `"contact"`; a magnet id absent from the caller's workspace OR resolved to the WRONG kind for the called route is `404 not_found`, indistinguishably (mirrors the existing GET's absent-or-foreign fold). `/signups` and `/subscribers` serve four keys (`id`, `name`, `email`, `createdAt`); `/messages` serves those four plus `handledAt`. Bounded `?limit=` (default 50, max 200), newest-first — mirrors `workspaces/messages.ts`'s own query schema. Applications (Listicle) is deliberately OUT of this surface — `ProjectListing` carries no reverse link to the listicle-kind `FlowDefinition` that captured it, so "scoped to that magnet" cannot be honored without a schema change (split to #6314).
 - `/v1/content/{types,:type,:type/:slug}` — public content reads
 - `/v1/auth/tokens`, `/v1/user/{profile,data/:key}` — local auth + user data
 - `/v1/checkout/sessions` — start a Stripe checkout
 - `/v1/workspaces/:workspaceId/{theme,identity,seo}` (GET/PUT) — per-workspace site config (multi-tenant module)
+- `/v1/workspaces/:workspaceId/meetings` (GET/PUT) — the operator's enabled-slug gate for meeting types (#6183 S9b, `src/routes/workspaces/meetings.ts`). Beside the three siblings above in URL shape and tenant-isolation posture, but registered in its OWN scope, gated on `isModuleEnabled("scheduling")` ALONE — not the `workspace`/`multi-tenant` scope its siblings share, because its GET reaches `services/scheduling/` (see below), which a scaffold without that module does not carry (`tools/lint-slice-registration.ts`, #5701). Both verbs are role-floored `owner|admin` (the same floor `general.ts` puts on a rename): PUT because this blob decides which pages the public site serves, and GET because — since it does NOT just return the stored blob — it echoes the deployment's whole provider catalog, including the rows the operator chose not to publish (security review, 2026-09-19). GET is the one segment in this file's family that does NOT just return the stored blob: it ALSO lists the scheduling provider's own bookable event types (`listEventTypes`, #6182), joined with `enabled: boolean`; an unconfigured/unreachable provider answers the same `SchedulingErrorKind` outcome `/v1/schedule/*` uses, distinct from an empty list. No MCP twin — identity-bound tenant route (#3591 exception).
+- `/v1/workspaces/:workspaceId/general` (GET/PUT) — the workspace's own display name, the Pro `workspace` module's general-settings surface (#5371). Registered under `isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")` alongside the site-config routes above, behind the same tenant guard; the scope is always `request.tenant.workspaceId`, never the path param (the guard 403s a mismatch before any handler runs). PUT takes a strict `{ name }` body (1–200 chars, trimmed) and both verbs answer the same `{ name }` shape. Role floor on PUT `owner|admin` (#5515 item 2) — renaming is an org-level settings write; GET stays open to every member. No MCP twin — identity-bound tenant route (#3591 exception, same shape as `/v1/billing/*`).
+- `/v1/workspaces/:workspaceId/messages` (GET, `?limit=`), `/v1/workspaces/:workspaceId/messages/:leadId` (GET, PATCH) — the Inbox message API (#6216 S7e, `src/routes/workspaces/messages.ts`): the workspace's unhandled messages newest first, the item read (resolves a message handled or not, serving `handledAt`), and the one-way idempotent handled stamp over #6204's `markMessageHandled`. Registered under `isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")`, the same scope as the two routes above. A message is a `Lead` whose `source` is in #6204's closed `MESSAGE_LEAD_SOURCE_LIST` allowlist — checked only in `tenantDb(tenant).leads`, never in this file; a non-message lead is a 404 on the item read and the PATCH and absent from the list, the SAME 404 body as an absent id, another workspace's id, or an unbackfilled `workspaceId`. **One served row across all three routes** — `id`, `name`, `email`, `source`, `createdAt`, `handledAt` — and nothing else: no `payload`, no message body (operator ruling, 2026-09-19; `leads-inbox.ts`'s PII boundary is unchanged, not widened). PATCH takes `{ "handled": true }` only, `.strict()`; there is no un-handle path (#6204 D4), so `{ "handled": false }` is a 400. The stamp records the actor via `tenant.userId` in `Lead.handledBy` — written, not served. Role floor `owner|admin` (`LEAD_INBOX_ROLES`, the SAME constant `services/inbox-messages.ts`'s sibling functions already enforce), checked before any read or write — **and on a single-workspace deployment RUNNING the `multi-tenant` module with `AILK_OPERATOR_EMAIL` unset, that role is self-servable first-come** (the SAME `bindOperatorMembership` TOFU bind the `AILK_OPERATOR_EMAIL` paragraph below names, reached there via `multi-tenant`'s own null-binding fallback to `resolveDefaultTenant` — NOT via the base `workspace`-only guard, which REQUIRES the pin and fails closed when it is unset, so TOFU is unreachable on a bare `workspace`-only build: these are the first routes to serve anonymous visitors' contact PII through that grant). No MCP twin — identity-bound tenant routes (#3591 exception, the same shape as `/v1/waitlist-experiments/*` and `/v1/project-listings/index.ts`): MCP carries no caller identity today, so a twin could only invent an MCP auth story or serve whatever workspace the environment points at; the deferred ambition is #6222.
+- `/v1/workspaces/:workspaceId/members` (GET) — the org's member roster (`userId`, `name`, `email`, `role`), the Pro `workspace` module's Team tab (#5371). Read-only by design: granting a Membership is the invite flow, which is its own spec with a mandatory security review (§2.3), so no POST/PUT/DELETE is routed at this path. Scoped to `request.tenant.organizationId` — Membership is org-level — server-resolved from the validated session. Role floor `owner|admin` (#5515 item 2), the same floor and the same reason as `/v1/waitlist-experiments/*` and `/v1/leads`: the roster carries every member's email, so membership alone is not authorization. No MCP twin — identity-bound tenant route (#3591 exception).
+- `/v1/workspaces/:workspaceId/content` (GET, POST), `/v1/workspaces/:workspaceId/content/:type/:slug` (GET, PATCH), `/v1/workspaces/:workspaceId/content/:type/:slug/{publish,unpublish}` (POST) — the tenant-guarded content editor's write surface (#5853, `src/routes/workspaces/content.ts`): list, create, read/save the draft tip (under `If-Match`), and publish/unpublish, all over `Artifact`/`ArtifactVersion`. `:type` is validated against the page-type registry (`z.enum(SCHEMA_ORG_TYPES)`) rather than accepted as a free string on every addressed operation — an unregistered type is a 400 before any lookup, since it is echoed back and passed to `notifyRevalidate` as the site's cache tag. Role floor: publish and unpublish are `owner|admin` only (#5922, operator decision 2026-09-17) — publishing to, or pulling down from, a live public site is the highest-consequence action in the family, so it carries the same floor as this file's rename and roster routes above; list, create, read and save stay member-level. **The GET list is a UNION of page artifacts and DOCUMENT assets** (#6093, D1/D9 — "one store, two views"): every row carries `tags: string[]` (never null, read from the draft tip's stored content for a page, from `Asset.tags` for a file) and a DERIVED `kind: "page" | "post" | "file"` (`BlogPosting` alone maps to `"post"`; an asset row is always `"file"`) — an optional `?tag=<slug>` filters the union AFTER it is built, so a file is returned under either its own tag or a shared one. The asset half of the union (`DOCUMENT_CONTENT_TYPES`, i.e. `application/pdf`) is skipped entirely when `locale`/`type` is supplied or `status` names anything but `"published"`, since a file row can never satisfy those. A foreign `:workspaceId` costs zero artifact **and** zero asset queries. No MCP twin — identity-bound tenant routes (#3591 exception, same shape as the sibling `/v1/workspaces/*` routes).
+- `/v1/workspaces/:workspaceId/assets` (GET, POST), `/v1/workspaces/:workspaceId/assets/:assetId` (PATCH, DELETE), `/v1/assets/:assetId` (GET, public/anonymous) — the workspace asset store (#5854 upload/read; #6093 list/PATCH/DELETE, `src/routes/assets/{index,upload,read,manage}.ts`). Upload accepts an allowlisted union of three named classes (`src/routes/assets/index.ts`): five RASTER images (`image/png`, `image/jpeg`, `image/gif`, `image/webp`, `image/avif`), one VECTOR image (`image/svg+xml`, admitted under the operator's 2026-09-18 `allow-svg-assets` ruling — issue #6093 comment `5731573595` — superseding #5854's original SVG exclusion) and one DOCUMENT type (`application/pdf`), all under the existing 20 MB cap; `?tags=<slug>[,<slug>…]` stores tags on the row. The public read serves a RASTER type `inline` exactly as before; every OTHER admitted type (SVG, PDF) is served `attachment`, with the filename's extension pinned to the stored content type (closing extension spoofing) and a five-directive `Content-Security-Policy` (`default-src 'none'; sandbox; frame-ancestors 'none'; form-action 'none'; base-uri 'none'`) that makes the bytes never a document on this origin — this is what makes admitting SVG safe with NO server-side sanitizer. `GET …/assets` (member-level — the same floor the union content list above already carries for the very same rows, D9) lists a workspace's assets, metadata only, never `bytes`, with an optional `?tag=<slug>` filter; this is what narrows the store's prior "nothing lists assets" premise to its precise form — no ANONYMOUS and no CROSS-TENANT enumeration, both still true. `PATCH …/assets/:assetId` updates `title`/`description`/`tags` (`owner|admin`; `null` clears a text field to SQL `NULL`, `""` stores empty; the asset's `id` and public URL are untouched). `DELETE …/assets/:assetId` (`owner|admin`) removes the row and the bytes at the ORIGIN only — already-cached copies elsewhere are not recallable under the year-long `immutable` promise, and no reference check protects a page that still embeds the URL; absent and foreign ids both take the same 404. Every tenant route here is identity-bound; no MCP twin (#3591 exception). The public read has no MCP twin either — it serves bytes to an `<img>`/download, the same boundary `upload.ts` records for its own sibling.
 - `/v1/billing` (GET), `/v1/billing/portal-session` (POST) — org-scoped billing read + Stripe customer-portal session creation
 - `/v1/schedule/availability` (GET), `/v1/schedule/event-meta` (GET), `/v1/schedule/book` (POST) — anonymous scheduling proxy behind the provider seam (`src/services/scheduling/`); Cal.com v2 today, a self-hosted engine later, same three calls. `event-meta` is the meta-only read (title · duration · description · price) so rendering an event's facts never fetches an availability window (#4633). `CAL_API_KEY` is read server-side only. MCP twins: `list_availability` / `get_event_meta` / `create_booking` (#4416, #4633)
+- `/v1/schedule/meeting-types` (GET) — the enabled-meeting-slugs public read (#6183 S9b, `src/routes/schedule/meeting-types.ts`): the session-less read the public `/meet` surface needs to honour the operator's enabled-slug gate (`/v1/workspaces/:workspaceId/meetings`, above), since a public page holds no session. Resolves its workspace via `resolvePublicWorkspace()` (the same fail-closed predicate the public content read uses — no client-suppliable workspace, ever) and reads through a new named public-read boundary, `src/lib/public-meetings-config.ts` (modelled on `lib/asset-store.ts`): one `findUnique` by the resolved `workspaceId`, no write, no list. `{ slugs: string[] | null }` — `null` means "no stored list" (an unconfigured deployment, or the non-database adapter); the caller (`apps/web`'s `enabledMeetingSlugs()`) applies the `SCHEDULING_CAL_LINK`-derived singleton fallback for that state, since that env var is `apps/web`'s, not this app's. Reads no client input. No MCP twin — deferred to a named follow-up rather than silently skipped (the route's own header, §10 Q3 of the spec).
+- `POST /v1/webhooks/calcom` — the scheduling booking-event receiver (#6085, brief H7): verifies the provider's HMAC-SHA256 signature (`x-cal-signature-256`) over the raw body, then normalizes one of six `BOOKING_*` trigger events into an `Appointment` row (`src/services/scheduling/appointments.ts`). `CAL_WEBHOOK_SECRET` is read server-side only (`config/index.ts`); an unset secret answers `503`, never a silent accept. Registered on the same `webhooksScope` as `/v1/webhooks/stripe` (its raw-body content-type parser is what a signed receiver needs), module-conditional (`scheduling`, `src/routes/webhooks/index.ts`). No commerce-claim read: a booking event is not a money event (D-67 puts the payment on the provider's own side). No MCP twin — an inbound receiver for one named provider, not an endpoint an agent could reasonably call, the same footing `POST /v1/webhooks/stripe` already takes.
+- `/v1/schedule/appointments` (GET, `?limit=&cursor=&window=`) — the SITE's own appointments (#6085), tenant-guarded and role-floored `owner|admin` (the rows carry attendee contact PII, the same floor `/v1/leads` and `/v1/waitlist-experiments/*` carry). Registered in its OWN tenant scope, gated on `isModuleEnabled("scheduling")` alone, behind `tenantPreHandlerForBuild()` — NOT the anonymous schedule scope above (a prospect booking a call has no account). Scope is ALWAYS `request.tenant.workspaceId`, NEVER `currentSiteId()` (the receiver's own write scope) — and deliberately carries NO platform-operator escape hatch, unlike `/v1/waitlist-experiments/*`: an appointment book is a seller's customer list. `window` defaults to `upcoming`; `cursor` is the previous page's last row id, and one that does not resolve within the caller's scope is a `400`, never a silent page 1 (the `/v1/waitlist-experiments/*/signups` cursor discipline). Eight fields per row and nothing more — `id`, `startTime`, `endTime`, `title`, `attendeeName`, `attendeeEmail`, `status`, `paid`; `siteId`, `providerBookingUid`, `provider`, the three watermark columns, `paymentInitiatedAt`, `noShow`, `cancelledAt`, `createdAt` and `updatedAt` are never selected (`src/services/scheduling/appointments.ts`'s `listAppointments` is the only read path). No MCP twin — identity-bound tenant route (#3591 exception, the same shape as `/v1/waitlist-experiments/*`).
 - `/v1/aeo/score` (POST), `/v1/aeo/score/example` (GET) — anonymous instant AEO score for a respondent-supplied URL, and the bundled pre-launch example, both fed by the SSRF-guarded crawler at `@working-theory/aeo/fetch` and the pure scorer at `@working-theory/aeo` (`src/services/aeo-score.ts`, #4666). No MCP twin — recorded exception, brief D7 (exposing an arbitrary-URL crawler to anonymous agents is a security-posture decision; `apps/mcp/src/tools/audit.ts` deliberately stays same-origin-locked instead).
 - `/v1/waitlist-experiments` (GET), `/v1/waitlist-experiments/:experimentId` (GET), `/v1/waitlist-experiments/:experimentId/signups` (GET), `/v1/waitlist-experiments/:experimentId/signups/:leadId` (GET) — the operator-dashboard read API for Parallel Waitlist Validation (#4665 D7, B0): tenant-scoped list + rollup, per-waitlist comparison, paginated signups, and a signup drill-down over A1's `WaitlistExperiment` / `WaitlistScore` / `Lead` rows (`src/services/waitlist-dashboard.ts`, #4671). Role floor `owner|admin` (signup PII); the platform-operator scope (`isSentinel(organizationId) && role === "owner"`, ALSO requiring `AILK_OPERATOR_EMAIL` to be set — fail-closed, PR #4687) sees every site, an ordinary owner/admin sees only its own `siteId`. No MCP twin — identity-bound tenant routes (#3591 exception, same shape as `/v1/billing/*`).
 - `/v1/waitlist-signups/me` (GET, `?experimentKey=<slug>`) — the respondent read (#4731): a signed-in, **email-verified** user's OWN newest signup for one experiment (`experimentKey`, `waitlistKey`, `completedAt`, `tier`, `score`, `aeoScore`, `answers.q3` — seven fields, nothing more; `src/services/waitlist-signups.ts` is the only read path). Registered in `authScope` only (auth, no tenant guard — a respondent has no workspace). Identity is `request.userId`; the email is the `User`'s, never a parameter; `emailVerified !== true` → 403 `email_unverified` before any `Lead` read; no match → 404 `signup_not_found`; every read scoped to `currentSiteId()`. Module: `signal-collectors` (D-48, #5366). No MCP twin — identity-bound (#3591 exception).
@@ -56,6 +66,8 @@ Routes are versioned under `/v1/*`:
 - `/v1/project-listings/{start,submit}` (POST), `/v1/project-listings/:id` (PATCH, draft), `/v1/project-listings/public` (GET) — the anonymous founder's-application lifecycle (#4998, reshaped by #5036): draft start/patch/submit plus the public shelves read, identity-blind and rate-limited alongside the leads routes. Module: `signal-collectors`. No MCP twin — anonymous form-lifecycle routes, not agent-facing.
 - `/v1/slack/actions` (POST) — the project-listing operator decision (Slack Approve/Reject, #4999): verifies the Slack signature, applies the decision via `src/services/project-listing-decision.ts`. Module: `signal-collectors`. No MCP twin — a Slack-signed webhook, not agent-facing.
 
+**`AILK_OPERATOR_EMAIL` is REQUIRED for a `workspace`-module deployment** (#5515 item 1), exactly as it already is for the review dashboard. On a build with the `workspace` module and WITHOUT `multi-tenant`, `server.ts`'s `tenantPreHandlerForBuild()` selects the base guard (`src/middleware/default-tenant.ts` → `resolveDefaultTenantForOperator`), which fails CLOSED when the pin is unset: every `/v1/workspaces/*` route answers 403 to everyone — so the module's Admin pages (`apps/web/app/[locale]/(authed)/admin*`, renamed from `workspace` by #5637) render their shared `ForbiddenState` — and — the reason this matters — the TOFU operator bind (`services/default-tenant.ts#bindOperatorMembership`, #3631) is never reached, so the first account to load the settings page cannot seat ITSELF as the sole owner off a plain GET. With `multi-tenant` present the pin stays optional and resolution comes from the session's active workspace, unchanged. `.env.example` § Single-tenant operator pin carries the operator-facing copy; `src/middleware/__tests__/default-tenant.test.ts` § "#5515 item 1" is the objective record.
+
 The workspace site-config routes are **identity-bound tenant routes** (guarded by the tenant preHandler; the write scope is the caller's active workspace, never a body-supplied id). Like the sibling `/v1/workspaces/*` routes they have **no anonymous MCP twin** — the OSS MCP surface is identity-blind (`apps/mcp/CLAUDE.md`), so the "1:1 MCP tool" rule above does not apply to them; the tenant-scoped authed MCP surface is tracked in #3591. The `/v1/billing/*` and `/v1/waitlist-experiments/*` routes are the same shape — identity-bound tenant routes, admin/settings-facing rather than agent-facing, no MCP twin.
 
 AEO Layer 1 scoring runs both ways: locally as a CLI command (`ailk audit`, filesystem content-root input) AND behind the anonymous `/v1/aeo/score` HTTP endpoint above (external-URL input, #4666) — the CLI's content-root audit and the route's crawler-fed score are two different input paths over the same underlying scorer, not a contradiction.
@@ -144,7 +156,19 @@ sweep's own DB constraint (never a caller-side lock).
 - Don't put session state in `apps/api`. It's stateless.
 - Don't bundle `apps/api` (esbuild, rollup, webpack). Slice specifiers cannot survive it — see `## Deploy path`.
 
-Last updated: 2026-09-16 — doc-sync: added `GET /v1/leads` (#5678), the owner-scoped leads inbox read, to Endpoint conventions, recording its unconditional registration, its five-field row, its `resolveOwnerWorkspaces` scoping and its no-MCP-twin parity decision — verified against `apps/api/src/routes/leads/list.ts`, `apps/api/src/services/leads-inbox.ts`, `apps/api/src/services/owner-workspaces.ts` and `apps/api/src/server.ts`.
+Last updated: 2026-09-21 — doc-sync: re-pointed magnet deliverables at the workspace-scoped `Asset` store (#6310) — extended the `/v1/deliverables/:grantId` row with the new `asset_` grant class (the named boundary it reads through, its serve-time tenancy re-check, its hardened attachment+CSP+no-store serve for every content type, and its uniform-404 fold), recording the rejected redirect-to-`/v1/assets/:assetId` mechanism and why — verified against `apps/api/src/routes/deliverables/index.ts`, `apps/api/src/lib/deliverable-asset-store.ts` and `apps/api/src/services/deliverable-fulfillment.ts`.
+
+Prior: 2026-09-19 — doc-sync: added the three per-magnet captured-lead list routes (#6246 S6h) — `GET /v1/workspaces/:workspaceId/magnets/:id/{signups,subscribers,messages}` — to the magnets bullet, recording the `Lead.source = 'flow:' + slug` join, the new `tenantDb(tenant).leads.listBySource` accessor, the new `(workspaceId, source)` index, the wrong-kind/absent-magnet shared 404, the four/five-key wire shapes, the bounded `?limit=`, and the no-MCP-twin decision — verified against `apps/api/src/routes/magnets/index.ts`, `apps/api/src/lib/tenant-db.ts` and `database/inbox/schema.prisma`.
+
+Prior: 2026-09-19 — doc-sync: added the Inbox message API (#6216 S7e) — `GET /v1/workspaces/:workspaceId/messages` and `GET`/`PATCH /v1/workspaces/:workspaceId/messages/:leadId` — to Endpoint conventions, recording the six-key served row, the message-source allowlist confinement, the shared 404 for four causes, the one-way idempotent PATCH, the `owner|admin` role floor and its TOFU precondition, and the no-MCP-twin decision — verified against `apps/api/src/routes/workspaces/messages.ts`, `apps/api/src/services/inbox-messages.ts`, `apps/api/src/lib/tenant-db.ts` and `apps/api/src/server.ts`.
+
+Prior: 2026-09-19 — doc-sync: added the tenant-scoped magnet Admin authoring surface (#6157 S5c) — `GET`/`POST /v1/workspaces/:workspaceId/magnets` and `GET`/`PATCH /v1/workspaces/:workspaceId/magnets/:id` — to Endpoint conventions, recording its `tenantDb`-only data path, its `owner|admin` role floor, the `multi-tenant || signal-collectors` gate, the config-URL origin gate and the no-MCP-twin parity decision — verified against `apps/api/src/routes/magnets/index.ts`, `apps/api/src/lib/tenant-db.ts` and `apps/api/src/server.ts`.
+
+Prior: 2026-09-19 — doc-sync: the enabled-meeting-slugs gate (#6183 S9b) — added the `/v1/workspaces/:workspaceId/meetings` bullet (its own scope, gated on `scheduling` alone, the D24 `listEventTypes` join) and the `/v1/schedule/meeting-types` bullet (the public read, its own boundary file) — verified against `apps/api/src/routes/workspaces/meetings.ts`, `apps/api/src/routes/schedule/meeting-types.ts`, `apps/api/src/lib/public-meetings-config.ts` and `apps/api/src/server.ts`.
+
+Prior: 2026-09-18 — doc-sync: the Docs list gains tags and a closed kind, and the asset store admits documents and gains list, metadata update and delete (#6093) — completed the `/v1/workspaces/:workspaceId/content` bullet with the page/asset union (`tags`, derived `kind`, `?tag=` filter), and added the `/v1/workspaces/:workspaceId/assets` + `/v1/assets/:assetId` family bullet (list/PATCH/DELETE, the widened upload allowlist admitting `image/svg+xml` and `application/pdf`, and the public read's raster-inline/non-raster-attachment+CSP serve split) — verified against `apps/api/src/routes/workspaces/content.ts`, `apps/api/src/routes/assets/{index,upload,read,manage}.ts` and `apps/api/src/lib/tenant-db.ts`.
+
+Prior: 2026-09-16 — doc-sync: added `GET /v1/leads` (#5678), the owner-scoped leads inbox read, to Endpoint conventions, recording its unconditional registration, its five-field row, its `resolveOwnerWorkspaces` scoping and its no-MCP-twin parity decision — verified against `apps/api/src/routes/leads/list.ts`, `apps/api/src/services/leads-inbox.ts`, `apps/api/src/services/owner-workspaces.ts` and `apps/api/src/server.ts`.
 
 Prior: 2026-09-14 — doc-sync: signal-collectors module extraction (D-48, #5366) — added the `module: signal-collectors` note to the flows/waitlist-signups-me/project-listings-me endpoints, added the previously-undocumented `/v1/deliverables/:grantId`, `/v1/project-listings/{start,submit,:id,public}` and `/v1/slack/actions` rows — verified against `apps/api/src/server.ts` and each route's own header.