create-ailk 0.5.0 → 0.6.1

package/templates/apps/api/src/lib/__mocks__/prisma.ts

@@ -27,7 +27,14 @@
  *   idempotency reader) + callback.findMany (booked-call suppression) +
  *   waitlistScore.findMany (tier lookup) — used by the #4732
  *   waitlist-followup sweep service tests
- *   tenancy models (workspace, membership) — used by tenant-context service tests (#3627)
+ *   tenancy models (workspace, membership) — used by tenant-context service tests (#3627).
+ *   workspace.findUnique carries NO default (#6335) — see its own comment
+ *   below. A suite whose route resolves a workspace states the shape it
+ *   expects through `mockWorkspaceExists()` / `mockNoWorkspace()`, exported
+ *   at the foot of this file
+ *   artifact models (artifact, artifactVersion) — the database content
+ *   adapter's read surface, used by the public-site-resolver + content route
+ *   tests (#5852)
  *   membership.findMany + lead.findMany/updateMany — used by lead-promotion
  *   service tests (#3586); lead-promotion.ts never queries membership/workspace
  *   directly (it resolves workspaces via tenant-context.ts's listTenancy), so
@@ -49,6 +56,10 @@
  * #3739 M2 — was `findMany` + a JS accumulation loop). Same not-yet-
  * generated-client situation; `usage-aggregation.ts` casts `prisma` to its
  * own structural delegate type, and this mock's runtime shape matches it.
+ *
+ * userData.create/updateMany (auth) + siteSetting.findUnique (config) — the
+ * dunning record's compare-and-swap write and the per-tenant grace-policy
+ * read (#6034), used by dunning-policy.test.ts and stripe-dunning.test.ts.
  */
 
 export const prisma = {
@@ -68,6 +79,13 @@ export const prisma = {
     findUnique: jest.fn(),
     upsert: jest.fn(),
     deleteMany: jest.fn(),
+    // `create` / `updateMany` — the dunning record's compare-and-swap write
+    // (#6034 § D6): the webhook reads `{value, updatedAt}` then either
+    // `create`s a fresh row or `updateMany`s guarded on BOTH observed
+    // columns, so a concurrent writer makes the predicate miss (`count: 0`)
+    // rather than silently losing a revocation.
+    create: jest.fn(),
+    updateMany: jest.fn(),
   },
   // ── Tenancy namespace (Organization, Workspace, Membership) ──────────────
   organization: {
@@ -84,6 +102,29 @@ export const prisma = {
     updateMany: jest.fn(),
   },
   workspace: {
+    // #6335 — NO default implementation, deliberately. Until this issue the
+    // delegate carried a PERMISSIVE one (#6203): it resolved ANY requested
+    // id as an existing workspace with a sentinel-shaped organizationId, so
+    // every tenancy resolver in a route test saw "this workspace exists" no
+    // matter what the test had set up. That is DEF-014 — a fixture that
+    // fabricates the condition under test: a route that should have failed
+    // closed passed, and every isolation-shaped test written against this
+    // mock inherited a fake success.
+    //
+    // A bare `jest.fn()` resolves `undefined`, which every resolver in
+    // `apps/api/src/lib/site.ts` reads as "no such workspace" and rejects —
+    // so a suite that needs a workspace to resolve must SAY SO, keyed on the
+    // id it actually expects to be asked for:
+    //
+    //   mockWorkspaceExists(prisma, SITE_ID)  // only SITE_ID resolves
+    //   mockSentinelWorkspaceExists(prisma)   // the "default" alias path
+    //   mockNoWorkspace(prisma)               // nothing resolves
+    //
+    // Keying on the requested id is the load-bearing part.
+    // `resolveWorkspaceIdForAlias` returns the ALIAS on mere truthiness of
+    // the row (`site.ts`) — it never reads the row's own id — so a mock that
+    // resolves unconditionally is permissive by accident even when it hands
+    // back a specific-looking row.
     findUnique: jest.fn(),
     count: jest.fn(),
   },
@@ -92,6 +133,18 @@ export const prisma = {
     findMany: jest.fn(),
     create: jest.fn(),
   },
+  // ── Artifact store (the database content adapter's read surface, #5852) ──
+  // Only the two readers `ArtifactPrismaClient` declares for reads
+  // (packages/content-adapters/src/database/adapter.ts): the public content
+  // routes never write, so no `create`/`updateMany`/`deleteMany` is faked here.
+  artifact: {
+    findFirst: jest.fn(),
+    findMany: jest.fn(),
+  },
+  artifactVersion: {
+    findFirst: jest.fn(),
+    findMany: jest.fn(),
+  },
   // ── Config namespace (per-workspace site config — #3641/#3634) ───────────
   workspaceTheme: {
     findUnique: jest.fn(),
@@ -127,9 +180,16 @@ export const prisma = {
   // `findMany` — the #4732 follow-up sweep's booked-call suppression check
   // (D2: a site's Callback rows fetched once per sweep run, filtered in
   // application code for `payload.email` matches).
+  // findFirst / update / updateMany joined for the #5970 request-and-confirm
+  // lifecycle: the credential mint and the confirmation claim are both guarded
+  // `updateMany`s, the GET resolves through `findFirst`, and the Stripe
+  // artifact id lands via `update`.
   callback: {
     create: jest.fn(),
+    findFirst: jest.fn(),
     findMany: jest.fn(),
+    update: jest.fn(),
+    updateMany: jest.fn(),
   },
   // ── Inbox namespace (FlowDefinition, FlowSession — #3956) ────────────────
   // findMany on both models — used by the abandon-email sweep (#3962 D4),
@@ -137,6 +197,10 @@ export const prisma = {
   // policy) and every candidate FlowSession per definition.
   flowDefinition: {
     findUnique: jest.fn(),
+    // #6314 — `startProjectListingDraft` resolves the capturing listicle
+    // magnet through `findFirst` (slug + siteId + workspaceId + kind), so the
+    // delegate needs it here as well as `findUnique`.
+    findFirst: jest.fn(),
     findMany: jest.fn(),
     upsert: jest.fn(),
   },
@@ -156,13 +220,21 @@ export const prisma = {
   },
   // `update` — the send-outcome stamp (#3998 D1). `findMany` — the
   // deliverable:resend CLI's list mode (#3998 D4), selecting on
-  // `sendStatus: null`.
+  // `sendStatus: null`. `workspaceId` (#6310 D15) rides `create`'s existing
+  // `data` shape — no new delegate method.
   deliverableGrant: {
     create: jest.fn(),
     findUnique: jest.fn(),
     update: jest.fn(),
     findMany: jest.fn(),
   },
+  // ── Content namespace (Asset — #5854/#6093, extended #6310 D16) ──────────
+  // `findFirst` — the ONLY method `lib/asset-store.ts`'s public read and
+  // `lib/deliverable-asset-store.ts`'s two scoped reads need. No write, no
+  // `findMany`, no `findUnique` — neither boundary enumerates or mutates.
+  asset: {
+    findFirst: jest.fn(),
+  },
   // ── Inbox namespace (FlowCheckout — #4837 D4) ─────────────────────────────
   // `create` — recordCheckout's one write; `update` — attachStripeSession;
   // `updateMany` — the webhook's guarded status stamp (#4838); `findUnique` /
@@ -182,6 +254,19 @@ export const prisma = {
   siteListingConfig: {
     findUnique: jest.fn(),
   },
+  // ── Config namespace (SiteSetting — #6034 § D4) ──────────────────────────
+  // `findUnique` — the ONLY read path (`dunningPolicyFor`). #6374 D3 changed
+  // its KEY SHAPE, not its arity: `site_settings` is now unique on
+  // (workspace_id, key), so the call is
+  // `findUnique({ where: { workspaceId_key: { workspaceId, key } } })` and
+  // the `key` string still carries the site alias it always did. The
+  // delegate itself is unchanged — a `jest.fn()` does not care about the
+  // selector shape — but the comment is, so a reader programming this mock
+  // writes the compound selector rather than the removed bare `key`. No
+  // route in this repo writes SiteSetting; no write delegate is mocked.
+  siteSetting: {
+    findUnique: jest.fn(),
+  },
   // ── Inbox namespace (ProjectListing — #4998, reshaped #5033) ─────────────
   // `create` — the POST route's row write (after routeLead's Lead write).
   // `findFirst` — the tenant-scoped get/patch reads (scoped by siteId + id, a
@@ -257,6 +342,19 @@ export const prisma = {
     createMany: jest.fn(),
     findMany: jest.fn(),
   },
+  // ── Inbox namespace (Appointment — #6085, brief H7) ──────────────────────
+  // `updateMany` — the § D7(a) guarded write, one per family (lifecycle /
+  // payment / no-show); `findFirst` — the disambiguating read on a zero-match
+  // updateMany (row absent vs. present-with-newer-watermark); `create` — the
+  // create-eligible arm, wrapped in the caller's own `isUniqueViolation`
+  // retry. `findMany` — the tenant-scoped GET /v1/schedule/appointments read
+  // (apps/api/src/routes/schedule/appointments.ts).
+  appointment: {
+    create: jest.fn(),
+    findFirst: jest.fn(),
+    findMany: jest.fn(),
+    updateMany: jest.fn(),
+  },
   // ── Content namespace (UsageEvent, UsagePeriod — FEAT-047 P1.S1/#3709) ──
   usageEvent: {
     create: jest.fn(),
@@ -290,3 +388,141 @@ export const prisma = {
   $connect: jest.fn(),
   $disconnect: jest.fn(),
 };
+
+
+// ── #6335 — the explicit workspace fixtures ──────────────────────────────
+//
+// These replace the permissive `workspace.findUnique` default. They take the
+// prisma double they are to program as their FIRST argument, rather than
+// reaching for the `prisma` const above: a test importing this file directly
+// gets its own module instance (Jest keeps manual mocks in a registry of
+// their own, separate from the one a plain `require` of this path fills), so
+// a helper that closed over the local `prisma` would program an object no
+// route ever reads. Passing the double the suite already imports from
+// `../lib/prisma.js` is what makes these work from any suite.
+
+/**
+ * The structural shape the helpers below need — deliberately NOT
+ * `typeof prisma`, so a suite can pass the `prisma` it imported from
+ * `lib/prisma.js` (typed as the real client) with no cast at the call site.
+ */
+type WorkspaceMockHost = { workspace: { findUnique: unknown } };
+
+/**
+ * The sentinel Organization id the seeded default workspace hangs off
+ * (`database/tenancy.ts`'s reserved-range predicate, ADR-0031 rule 7).
+ * `resolveSentinelWorkspaceRow` rejects a default-workspace row whose
+ * `organizationId` falls outside that range, so the `"default"` alias path
+ * resolves only when the mocked row carries this value.
+ */
+export const SENTINEL_ORGANIZATION_ID =
+  "org_00000000-0000-7000-8000-000000000001";
+
+/** The seeded sentinel workspace id — `DEFAULT_WORKSPACE_ID` in `database/tenancy.ts`. */
+export const SENTINEL_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
+
+/**
+ * The organization an ORDINARY workspace hangs off, and deliberately NOT a
+ * sentinel one: its uuid carries non-zero timestamp bits, so
+ * `isSentinel()` (`packages/ids`, `^00000000-0000-7000-8000-…`) is false
+ * for it.
+ *
+ * Stamping the sentinel org on every mocked workspace would be its own
+ * DEF-014: `organizationId` is read off this exact row as an AUTHORIZATION
+ * input — `tenant-context.ts` denies a stale session when it disagrees with
+ * the session's active org, and `isPlatformOperator`
+ * (`waitlist-operator-reads.ts`) is `isSentinel(organizationId) && role ===
+ * "owner"`, which grants cross-SITE read scope over every site's signup
+ * PII. A helper that made every workspace sentinel-org would hand a future
+ * ordinary-tenant fixture a platform-operator identity, and would make
+ * "two workspaces in different organizations" inexpressible — so the
+ * stale-session deny branch could never be driven through it.
+ */
+export const ORDINARY_ORGANIZATION_ID =
+  "org_01920000-0000-7000-8000-0000000000aa";
+
+/** One workspace row a suite says exists: an id, or an id bound to a named org. */
+export type MockWorkspaceRow =
+  | string
+  | { readonly id: string; readonly organizationId: string };
+
+function workspaceFindUnique(client: WorkspaceMockHost): jest.Mock {
+  const delegate = client.workspace?.findUnique;
+  if (typeof delegate !== "function" || !("mockImplementation" in delegate)) {
+    throw new Error(
+      "[#6335] prisma.workspace.findUnique is not a jest mock — the suite " +
+        "must jest.mock() its prisma module before calling this helper.",
+    );
+  }
+  return delegate as unknown as jest.Mock;
+}
+
+/**
+ * States, for one test or one suite, EXACTLY which workspace ids exist
+ * (#6335). Every other id — a foreign one, a spoofed one, an unset one —
+ * resolves `null`, so a route that resolves a tenancy scope fails closed
+ * unless the test named the id under test.
+ *
+ * Keyed on the REQUESTED id, and that is the load-bearing part:
+ * `resolveWorkspaceIdForAlias` (`apps/api/src/lib/site.ts`) returns the
+ * ALIAS on mere truthiness of the row it gets back and never reads that
+ * row's own id, so a blanket `mockResolvedValue({ … })` resolves whatever
+ * it is handed — permissive by another name, and the rejection cases each
+ * suite now carries could not tell the two apart.
+ *
+ * Call it from a suite's `beforeEach`, AFTER any `jest.clearAllMocks()`.
+ */
+export function mockWorkspaceExists(
+  client: WorkspaceMockHost,
+  ...rows: readonly MockWorkspaceRow[]
+): void {
+  const existing = new Map<string, string>();
+  for (const row of rows) {
+    if (typeof row === "string") {
+      // The sentinel workspace is the ONE row that hangs off the sentinel
+      // organization; everything else gets an ordinary one. See
+      // ORDINARY_ORGANIZATION_ID for why this distinction is load-bearing.
+      existing.set(
+        row,
+        row === SENTINEL_WORKSPACE_ID
+          ? SENTINEL_ORGANIZATION_ID
+          : ORDINARY_ORGANIZATION_ID,
+      );
+    } else {
+      existing.set(row.id, row.organizationId);
+    }
+  }
+  workspaceFindUnique(client).mockImplementation(
+    ({ where }: { where: { id: string } }) =>
+      Promise.resolve(
+        existing.has(where.id)
+          ? { id: where.id, organizationId: existing.get(where.id) }
+          : null,
+      ),
+  );
+}
+
+/**
+ * The `"default"` site alias's resolution path (#6335): `currentSiteId()`
+ * returns `"default"`, `resolveWorkspaceIdForAlias` hands that to
+ * `resolveSentinelWorkspaceRow`, and only the well-known sentinel workspace
+ * — hanging off the sentinel Organization — satisfies it. Any further ids
+ * passed resolve beside it.
+ */
+export function mockSentinelWorkspaceExists(
+  client: WorkspaceMockHost,
+  ...alsoExisting: readonly MockWorkspaceRow[]
+): void {
+  mockWorkspaceExists(client, SENTINEL_WORKSPACE_ID, ...alsoExisting);
+}
+
+/**
+ * The REJECTION path (#6335): no workspace resolves, whatever is asked for.
+ * Every suite that depends on an explicit `mockWorkspaceExists` carries at
+ * least one test using this, so that explicit setup is proven load-bearing
+ * rather than decorative — a route that quietly stopped resolving a tenancy
+ * scope would otherwise pass both ways.
+ */
+export function mockNoWorkspace(client: WorkspaceMockHost): void {
+  workspaceFindUnique(client).mockResolvedValue(null);
+}

package/templates/apps/api/src/lib/__tests__/auth-email-budget.test.ts

@@ -0,0 +1,143 @@
+/**
+ * @file auth-email-budget.test.ts — the per-recipient hourly send budget (#5962 § D8c).
+ *
+ * Written before the implementation. The five properties that matter:
+ *   - the bucket counts per (recipient, kind) and caps at three per hour;
+ *   - the window rolls, so an hour later the recipient is clear again;
+ *   - the store is bounded (MAX_BUCKETS eviction), because the key is a
+ *     caller-supplied address and an attacker can mint unlimited distinct ones;
+ *   - a recipient is keyed by a HASH, never by the plaintext address — this
+ *     module is memory an operator can dump;
+ *   - the site threshold is an operator SIGNAL, never a refusal. A site-wide
+ *     cap an attacker can hold open is an indefinitely-holdable lockout
+ *     (§ D8c, Q6), so nothing here may deny a send because of it.
+ *
+ * Time is injected rather than faked: the module reads `getClock().now()` by
+ * default and accepts an explicit `nowMs`, which is the seam this suite uses.
+ */
+
+import {
+  consumeRecipientBudget,
+  siteVolumeAlert,
+  RECIPIENT_HOURLY_MAX,
+  SITE_HOURLY_ALERT_THRESHOLD,
+  __resetAuthEmailBudget,
+  __authEmailBucketCount,
+  __authEmailBudgetKeys,
+} from "../auth-email-budget.js";
+
+const T0 = 1_700_000_000_000;
+const ONE_HOUR_MS = 60 * 60 * 1000;
+
+beforeEach(() => {
+  __resetAuthEmailBudget();
+});
+
+describe("consumeRecipientBudget()", () => {
+  it("allows the first RECIPIENT_HOURLY_MAX sends and refuses the next", () => {
+    for (let i = 0; i < RECIPIENT_HOURLY_MAX; i++) {
+      expect(
+        consumeRecipientBudget("user@example.com", "password-reset", {
+          nowMs: T0,
+        }),
+      ).toBe(true);
+    }
+    expect(
+      consumeRecipientBudget("user@example.com", "password-reset", {
+        nowMs: T0,
+      }),
+    ).toBe(false);
+  });
+
+  it("counts per (recipient, kind) — a reset flood cannot exhaust the notice", () => {
+    for (let i = 0; i < RECIPIENT_HOURLY_MAX; i++) {
+      consumeRecipientBudget("user@example.com", "password-reset", {
+        nowMs: T0,
+      });
+    }
+    expect(
+      consumeRecipientBudget("user@example.com", "password-changed", {
+        nowMs: T0,
+      }),
+    ).toBe(true);
+  });
+
+  it("is case- and whitespace-insensitive on the recipient", () => {
+    for (let i = 0; i < RECIPIENT_HOURLY_MAX; i++) {
+      consumeRecipientBudget("User@Example.com", "password-reset", {
+        nowMs: T0,
+      });
+    }
+    expect(
+      consumeRecipientBudget(" user@example.com ", "password-reset", {
+        nowMs: T0,
+      }),
+    ).toBe(false);
+  });
+
+  it("clears itself when the hour rolls", () => {
+    for (let i = 0; i < RECIPIENT_HOURLY_MAX; i++) {
+      consumeRecipientBudget("user@example.com", "password-reset", {
+        nowMs: T0,
+      });
+    }
+    expect(
+      consumeRecipientBudget("user@example.com", "password-reset", {
+        nowMs: T0,
+      }),
+    ).toBe(false);
+    expect(
+      consumeRecipientBudget("user@example.com", "password-reset", {
+        nowMs: T0 + ONE_HOUR_MS + 1,
+      }),
+    ).toBe(true);
+  });
+
+  it("bounds the store — a fresh identity at capacity evicts the oldest", () => {
+    const cap = 50;
+    for (let i = 0; i < cap + 10; i++) {
+      consumeRecipientBudget(`user${i}@example.com`, "password-reset", {
+        nowMs: T0,
+        maxBuckets: cap,
+      });
+    }
+    expect(__authEmailBucketCount()).toBeLessThanOrEqual(cap);
+  });
+
+  it("never stores the plaintext recipient", () => {
+    consumeRecipientBudget("secret-person@example.com", "password-reset", {
+      nowMs: T0,
+    });
+    expect(__authEmailBudgetKeys().join("|")).not.toContain("secret-person");
+    expect(__authEmailBudgetKeys().join("|")).not.toContain("@example.com");
+  });
+});
+
+describe("siteVolumeAlert()", () => {
+  it("does not fire below the threshold", () => {
+    for (let i = 0; i < SITE_HOURLY_ALERT_THRESHOLD - 1; i++) {
+      expect(siteVolumeAlert({ nowMs: T0 })).toBe(false);
+    }
+  });
+
+  it("fires ONCE per hour past the threshold, and never refuses a send", () => {
+    let fired = 0;
+    for (let i = 0; i < SITE_HOURLY_ALERT_THRESHOLD + 25; i++) {
+      if (siteVolumeAlert({ nowMs: T0 })) fired++;
+    }
+    expect(fired).toBe(1);
+
+    // The signal is not a gate: a recipient under their own budget still sends.
+    expect(
+      consumeRecipientBudget("fresh@example.com", "password-reset", {
+        nowMs: T0,
+      }),
+    ).toBe(true);
+
+    let firedNextHour = 0;
+    for (let i = 0; i < SITE_HOURLY_ALERT_THRESHOLD + 1; i++) {
+      if (siteVolumeAlert({ nowMs: T0 + ONE_HOUR_MS + 1 })) firedNextHour++;
+    }
+    expect(firedNextHour).toBe(1);
+  });
+});

package/templates/apps/api/src/lib/__tests__/content-adapter.test.ts

@@ -5,11 +5,15 @@
  *   (a) CONTENT_ADAPTER unset → MDX adapter (existing behavior preserved)
  *   (b) CONTENT_ADAPTER=projection + valid manifest → projection adapter, read parity vs MDX
  *   (c) CONTENT_ADAPTER=projection + missing manifest → clear actionable error at construction
+ *   (d) CONTENT_ADAPTER=database with no workspaceId → the resolver's named error
+ *   (e) CONTENT_ADAPTER=database with a workspaceId → an adapter, not a throw (#5852)
  */
 import { join, resolve } from "node:path";
 import { mkdirSync, writeFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 
+import { DEFAULT_WORKSPACE_ID } from "@working-theory/database/tenancy";
+
 import {
   getContentAdapter,
   getContentRoot,
@@ -151,6 +155,25 @@ describe("getContentAdapter() factory", () => {
       expect(() => getContentAdapter()).toThrow("pnpm content:compile");
     });
   });
+
+  describe("(d) CONTENT_ADAPTER=database → the resolver's workspaceId error", () => {
+    test("throws naming workspaceId, because apps/api does not resolve a tenant yet (#5323)", () => {
+      process.env.CONTENT_ADAPTER = "database";
+
+      expect(() => getContentAdapter()).toThrow(/workspaceId/);
+      expect(() => getContentAdapter()).toThrow(/CONTENT_ADAPTER=database/);
+    });
+  });
+
+  describe("(e) CONTENT_ADAPTER=database + a workspaceId → an adapter (#5852)", () => {
+    test("builds the database adapter instead of throwing, once the caller resolves a tenant", () => {
+      process.env.CONTENT_ADAPTER = "database";
+
+      const adapter = getContentAdapter({ workspaceId: DEFAULT_WORKSPACE_ID });
+      expect(adapter).toBeDefined();
+      expect(typeof adapter.getPageBySlug).toBe("function");
+    });
+  });
 });
 
 describe("getContentRoot()", () => {

package/templates/apps/api/src/lib/__tests__/deliverable-asset-store.test.ts

@@ -0,0 +1,125 @@
+/**
+ * @file deliverable-asset-store.test.ts
+ * @description Unit tests for the deliverable-asset-store boundary (#6310
+ * D16) — the two scoped `Asset` reads a magnet deliverable resolution and
+ * its serve path need, modelled on `lib/asset-store.ts`'s own test shape.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
+jest.mock("../prisma.js");
+
+import { prisma } from "../prisma.js";
+import {
+  findDeliverableAssetIdByKey,
+  readDeliverableAsset,
+} from "../deliverable-asset-store";
+
+const WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
+const OTHER_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000002";
+const ASSET_ID = "asset_00000000-0000-7000-8000-0000000000a1";
+
+describe("findDeliverableAssetIdByKey", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("queries with exactly { workspaceId, key }", async () => {
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: ASSET_ID });
+
+    const result = await findDeliverableAssetIdByKey(WORKSPACE_ID, "q3-report.pdf");
+
+    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
+      where: { workspaceId: WORKSPACE_ID, key: "q3-report.pdf" },
+      select: { id: true },
+    });
+    expect(result).toBe(ASSET_ID);
+  });
+
+  it("does not return a same-key row scoped to a different workspace", async () => {
+    // The mock proves the CALL is scoped correctly; a real DB enforces the
+    // rest. This asserts the where-clause never widens to a foreign
+    // workspace even when one exists.
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+
+    const result = await findDeliverableAssetIdByKey(
+      OTHER_WORKSPACE_ID,
+      "q3-report.pdf",
+    );
+
+    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
+      where: { workspaceId: OTHER_WORKSPACE_ID, key: "q3-report.pdf" },
+      select: { id: true },
+    });
+    expect(result).toBeNull();
+  });
+
+  it("returns null on a miss", async () => {
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+
+    const result = await findDeliverableAssetIdByKey(WORKSPACE_ID, "no-such-key");
+
+    expect(result).toBeNull();
+  });
+});
+
+describe("readDeliverableAsset", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("queries with exactly { id, workspaceId } and selects filename/contentType/bytes", async () => {
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({
+      filename: "q3-report.pdf",
+      contentType: "application/pdf",
+      bytes: Buffer.from("PDF-BYTES"),
+    });
+
+    const result = await readDeliverableAsset(ASSET_ID, WORKSPACE_ID);
+
+    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
+      where: { id: ASSET_ID, workspaceId: WORKSPACE_ID },
+      select: { filename: true, contentType: true, bytes: true },
+    });
+    expect(result).toEqual({
+      filename: "q3-report.pdf",
+      contentType: "application/pdf",
+      bytes: expect.any(Buffer),
+    });
+  });
+
+  it("returns null for a foreign-workspace id (the scoped read excludes it)", async () => {
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+
+    const result = await readDeliverableAsset(ASSET_ID, OTHER_WORKSPACE_ID);
+
+    expect(result).toBeNull();
+  });
+
+  it("wraps the returned bytes as a Buffer view, not a copy", async () => {
+    const raw = new Uint8Array([1, 2, 3, 4]);
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({
+      filename: "f.pdf",
+      contentType: "application/pdf",
+      bytes: raw,
+    });
+
+    const result = await readDeliverableAsset(ASSET_ID, WORKSPACE_ID);
+
+    expect(Buffer.isBuffer(result?.bytes)).toBe(true);
+    expect(result?.bytes.byteOffset).toBe(raw.byteOffset);
+    expect(result?.bytes.buffer).toBe(raw.buffer);
+  });
+});
+
+describe("module boundary contract (§1.14 / D16)", () => {
+  it("exports no write, no findMany and no unscoped read", () => {
+    // The boundary's entire contract is "two named functions, nothing else
+    // reads prisma.asset" — asserted at the module surface so a future edit
+    // adding a third export or a raw prisma re-export fails this test.
+    // eslint-disable-next-line @typescript-eslint/no-var-requires -- asserting the module's own export surface
+    const mod = require("../deliverable-asset-store");
+    expect(Object.keys(mod).sort()).toEqual(
+      ["findDeliverableAssetIdByKey", "readDeliverableAsset"].sort(),
+    );
+  });
+});

package/templates/apps/api/src/lib/__tests__/error-serializer.test.ts

@@ -97,4 +97,24 @@ describe("error-serializer", () => {
     expect(body["message"]).toBeUndefined();
     expect(body["statusCode"]).toBeUndefined();
   });
+
+  // #6019 AC-2 — `pathWithoutQuery` (#5970 security review, finding 1): a
+  // route may carry its credential in the query string
+  // (`/v1/requests/:id/confirm?token=…` does), and this handler logs `path`
+  // on EVERY 5xx. A future refactor restoring the raw `request.url` must turn
+  // this red.
+  it("scrubs a query-string credential from the logged path on a 5xx", async () => {
+    await server.inject({
+      method: "GET",
+      url: "/boom?token=SUPERSECRETTOKEN",
+    });
+
+    const logged = logLines.find(
+      (line) => line["msg"] === "internal server error",
+    );
+    expect(logged?.["path"]).toBe("/boom");
+    const text = JSON.stringify(logLines);
+    expect(text).not.toContain("SUPERSECRETTOKEN");
+    expect(text).not.toContain("token=");
+  });
 });