create-ailk 0.5.0 → 0.6.1

package/templates/apps/api/src/services/leads-inbox.ts

@@ -109,8 +109,12 @@ export type ListLeadsResult =
  * `WAITLIST_DASHBOARD_ROLES` (`waitlist-dashboard.ts`); declared here rather
  * than imported because that file is a `signal-collectors` slice the strip
  * removes and this one ships at every level.
+ *
+ * Exported so `inbox-messages.ts` (#6204's tenant-scoped read/write, moved
+ * off this base file's own dependency edge — see that file's header) enforces
+ * the SAME floor rather than a copy.
  */
-const LEAD_INBOX_ROLES: ReadonlySet<string> = new Set(["owner", "admin"]);
+export const LEAD_INBOX_ROLES: ReadonlySet<string> = new Set(["owner", "admin"]);
 
 /**
  * The ONLY columns read out of the Lead table on this path.
@@ -162,8 +166,11 @@ const MAX_NAME_LENGTH = 200;
  * `payload` is JSON of a shape the site's own form decides, so reading one
  * key out of it is a boundary read: anything that is not a string is `null`,
  * and a string is truncated (see `MAX_NAME_LENGTH`).
+ *
+ * Exported so `inbox-messages.ts` reuses this exact narrowing — never a copy
+ * (see that file's header for why the shaping stays here).
  */
-function readName(payload: Prisma.JsonValue): string | null {
+export function readName(payload: Prisma.JsonValue): string | null {
   if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
     return null;
   }
@@ -261,3 +268,17 @@ export async function listOwnedLeads(params: {
     },
   };
 }
+
+// #6204's `listUnhandledMessages` / `markMessageHandled` — the tenant-scoped
+// "Needs-you" read/write pair over `tenantDb(tenant).leads` — moved OFF this
+// file to `./inbox-messages.js`. This file is a BASE-tier file every scaffold
+// ships (this header's own claim); `tenantDb` (`../lib/tenant-db.js`) is a
+// `multi-tenant`-slice file, and the paid-module exclusion closure
+// (`packages/create-ailk/src/lib/import-graph.ts`) is backward — a base file
+// that imports a paid seed is ITSELF added to the exclusion set, and so is
+// everything that imports IT. Importing `tenantDb` from here once already
+// pulled `server.ts`/`cli.ts`/`index.ts`/`vercel-handler.ts` out of a keyless
+// scaffold (caught by `__tests__/paid-module-exclusions.test.ts`, #5678's own
+// cascade recurring a third time). `readName()` and `LEAD_INBOX_ROLES` above
+// stay here (both exported) and `inbox-messages.ts` imports them — the row
+// shape and the role floor are the SAME constants, never a copy.

package/templates/apps/api/src/services/listing-config.ts

@@ -42,11 +42,18 @@ import {
 } from "@working-theory/validation";
 
 import { prisma } from "../lib/prisma.js";
-import { currentSiteId } from "../lib/site.js";
+import { resolveSiteWorkspaceId } from "../lib/site.js";
 
 export async function listingConfigFor(siteId: string): Promise<SiteListingConfig> {
+  // #6257 — every caller hands this function an ALREADY-RESOLVED workspace id
+  // (a `ProjectListing` row's own `siteId`, an authenticated tenant's
+  // `workspaceId`, or `siteIdForPublicKey`'s return below), so `workspaceId`
+  // rides beside the unique `siteId` selector rather than being resolved a
+  // second time. `site_listing_configs_workspace_site_agree` makes the pair
+  // redundant by construction — which is the point: the tenant scope is now
+  // something the QUERY states, not something the caller is trusted to have.
   const row = await prisma.siteListingConfig.findUnique({
-    where: { siteId },
+    where: { siteId, workspaceId: siteId },
     select: { data: true },
   });
   if (!row) return SITE_LISTING_CONFIG_DEFAULTS;
@@ -132,14 +139,18 @@ function warnOnDroppedField(
  *   1. A `SiteListingConfig` row whose `publicKey` matches. This is the
  *      multi-tenant path and the only one that can name a site other than the
  *      deployment's own.
- *   2. `AILK_LISTING_PUBLIC_KEY`, matched against the env, resolving to
- *      `currentSiteId()`. This is the SINGLE-TENANT path: the default
- *      `create-ailk` scaffold is one customer per deployment and has no
- *      config row, so requiring one would mean a site could not accept an
- *      application until an operator wrote a database row.
+ *   2. `AILK_LISTING_PUBLIC_KEY`, matched against the env, resolving to the
+ *      RESOLVED workspace id for `currentSiteId()` (#6254 AC-6/AC-10 —
+ *      `resolveSiteWorkspaceId()`, not the raw alias: `project_listings`
+ *      now rejects a `site_id` that disagrees with `workspace_id`,
+ *      database/migrations/20260922120000_tenancy_fence). This is the
+ *      SINGLE-TENANT path: the default `create-ailk` scaffold is one
+ *      customer per deployment and has no config row, so requiring one
+ *      would mean a site could not accept an application until an operator
+ *      wrote a database row.
  *
  * An unmatched key resolves to `null` and the route answers 400. It does NOT
- * fall through to `currentSiteId()`: a typo would otherwise silently file one
+ * fall through to the env path: a typo would otherwise silently file one
  * site's applications against another.
  *
  * The env comparison is a plain `===` on an opaque public identifier — there is
@@ -147,6 +158,13 @@ function warnOnDroppedField(
  * would imply a guarantee this value does not carry.
  */
 export async function siteIdForPublicKey(publicKey: string): Promise<string | null> {
+  // fence: global-key — `SiteListingConfig.publicKey`, a site's own public
+  // listing key, unique across every workspace. This is the query that
+  // RESOLVES the tenant: it is handed nothing but the key, and a workspace
+  // term here would have to come from the very answer it is computing. The
+  // key is not a credential (it ships in browser JavaScript by design, #5039)
+  // and holding it grants only the ability to open a draft; an unmatched key
+  // returns `null` and the route answers 400 rather than falling through.
   const row = await prisma.siteListingConfig.findUnique({
     where: { publicKey },
     select: { siteId: true },
@@ -154,7 +172,7 @@ export async function siteIdForPublicKey(publicKey: string): Promise<string | nu
   if (row) return row.siteId;
 
   const envKey = process.env["AILK_LISTING_PUBLIC_KEY"];
-  if (envKey && envKey === publicKey) return currentSiteId();
+  if (envKey && envKey === publicKey) return resolveSiteWorkspaceId();
 
   return null;
 }

package/templates/apps/api/src/services/project-listings.ts

@@ -44,6 +44,10 @@
 import { createHash, randomBytes } from "node:crypto";
 
 import type { Prisma, Role } from "@working-theory/database";
+import {
+  DEFAULT_WORKSPACE_SLUG,
+  resolveSentinelWorkspaceRow,
+} from "@working-theory/database/tenancy";
 import { logger } from "@working-theory/observability";
 import {
   clampWindowDays,
@@ -217,6 +221,7 @@ const PROJECT_LISTING_SELECT = {
   name: true,
   oneLiner: true,
   problem: true,
+  solution: true,
   url: true,
   product: true,
   commitment: true,
@@ -362,6 +367,7 @@ function toResponseRow(
     headline: row.headline,
     oneLiner: row.oneLiner,
     problem: row.problem,
+    solution: row.solution,
     url: row.url,
     product: row.product as ProjectListing["product"],
     commitment: row.commitment as ProjectListing["commitment"],
@@ -428,8 +434,21 @@ async function attachWaitlistCounts(
   const counts = new Map<string, number>();
   await Promise.all(
     experimentKeys.map(async (experimentKey) => {
+      // fence: workspaceId === the scope id this query already filters siteId by
+      // (workspace_site_agree CHECK, 20260922120000_tenancy_fence). Filtering the
+      // CONSTRAINED column makes the scope correct by construction; the format
+      // CHECK makes a raw alias match nothing rather than by accident.
+      //
+      // What that id IS depends on the caller, and only two of the six are
+      // route-resolved: `listProjectListings` and `getProjectListing` receive
+      // `tenant.workspaceId`, so for them this is an isolation control.
+      // `listMyProjectListings` and the two `publicProjectListings` call sites
+      // pass a ProjectListing row's OWN `siteId`, so for them it is a
+      // CONSISTENCY control — the count agrees with the row it is reported
+      // against — exactly as `project-listing-decision.ts#waitlistCountFor`
+      // spells out (#6258 § 1.6 / § 5 D8, security review L-2).
       const count = await prisma.waitlistScore.count({
-        where: { siteId, experimentKey },
+        where: { siteId, workspaceId: siteId, experimentKey },
       });
       counts.set(experimentKey, count);
     }),
@@ -602,7 +621,113 @@ export type StartProjectListingDraftResult =
        */
       verifyNonce: string;
     }
-  | { ok: false; error: { kind: "invalid_input"; message: string } };
+  | { ok: false; error: { kind: "invalid_input"; message: string } }
+  // #6203 — the resolved `siteId` names no workspace this database holds.
+  // Distinct from `invalid_input` (a body problem): this is a server-side
+  // tenancy misconfiguration, and the route answers 503, never 400.
+  | { ok: false; error: { kind: "tenant_unresolved"; message: string } };
+
+/**
+ * Resolves an ALREADY-RESOLVED `siteId` (never a caller-supplied string — see
+ * `startProjectListingDraft`'s own header) to its workspace id (#6203).
+ *
+ * Mirrors `apps/api/src/lib/site.ts`'s `resolveSiteWorkspaceId()` — the SAME
+ * two-branch alias mapping the #6203 migration's own backfill `CASE`
+ * encodes: the literal alias `"default"` resolves to the seeded sentinel
+ * workspace IFF that row exists and hangs off the sentinel Organization;
+ * any other alias resolves only by exact `workspaces.id` equality. Kept
+ * LOCAL and PARAMETERIZED rather than reusing `resolveSiteWorkspaceId()`
+ * directly: that function is hardwired to `currentSiteId()`
+ * (`AILK_SITE_ID`), while a `ProjectListing`'s `siteId` can legitimately
+ * name a DIFFERENT site under a multi-key deployment
+ * (`listing-config.ts#siteIdForPublicKey`'s `SiteListingConfig.publicKey`
+ * path) — the workspace stamped here must correspond to the SAME site the
+ * row's own `siteId` already names, not the deployment's default. NOT
+ * memoized (unlike `resolveSiteWorkspaceId()`): a different `siteId` per
+ * call means the sentinel-only cache that function keeps would be wrong
+ * here.
+ */
+async function resolveWorkspaceIdForSite(siteId: string): Promise<string | null> {
+  if (siteId === DEFAULT_WORKSPACE_SLUG) {
+    const row = await resolveSentinelWorkspaceRow(prisma);
+    return row?.id ?? null;
+  }
+  const row = await prisma.workspace.findUnique({ where: { id: siteId } });
+  return row ? siteId : null;
+}
+
+/**
+ * #6314 — resolve the capturing listicle magnet, SERVER-SIDE, from the slug
+ * the body named.
+ *
+ * All four terms in ONE query, and only `slug` came from the caller:
+ * `siteId` and `workspaceId` are the value `startProjectListingDraft` has
+ * already resolved from the site's PUBLIC KEY (`siteIdForPublicKey`, then
+ * `resolveWorkspaceIdForSite`), never from the body. `@@unique([siteId,
+ * slug])` makes the match at most one row.
+ *
+ * `kind: "listicle"` is LOAD-BEARING, not cosmetic: without it a visitor
+ * could name a contact or newsletter magnet's slug — both are public path
+ * segments — and file an application against it.
+ *
+ * NO `status` term, deliberately. A magnet can be flipped `live -> draft`
+ * while a visitor is mid-application, and dropping attribution on that flip
+ * would silently punish the operator's own edit. The cost is bounded: a draft
+ * magnet's slug is the operator's own, the resulting row lands only in that
+ * operator's own workspace, and the Applications wire row carries `status`
+ * so a never-submitted row stays legible as one.
+ *
+ * Returns `unresolved` for a slug that names nothing, names another
+ * workspace's magnet, or names a magnet of the wrong kind — those three are
+ * deliberately indistinguishable, and all three write NULL.
+ *
+ * `failed` is a FOURTH outcome and is NOT one of them: the lookup itself threw.
+ * It also writes NULL, so the wire is unchanged, but the caller must not
+ * describe it as "no such magnet" — during a database incident that would send
+ * an operator hunting a magnet-configuration problem that does not exist. This
+ * function has already logged the accurate line by the time it returns `failed`.
+ */
+type CapturingFlowResolution =
+  | { kind: "resolved"; id: string }
+  | { kind: "unresolved" }
+  | { kind: "failed" };
+
+async function resolveCapturingFlowId(
+  workspaceId: string,
+  slug: string,
+): Promise<CapturingFlowResolution> {
+  try {
+    const row = await prisma.flowDefinition.findFirst({
+      where: {
+        slug,
+        // Both scope terms, both from the value resolved above. They are equal
+        // by the `flow_definitions_workspace_site_agree` CHECK the fence added;
+        // carrying both is what makes the scope explicit at the query rather
+        // than implied by a constraint a future migration could move.
+        siteId: workspaceId,
+        workspaceId,
+        kind: "listicle",
+      },
+      select: { id: true },
+    });
+    return row === null ? { kind: "unresolved" } : { kind: "resolved", id: row.id };
+  } catch (err) {
+    // The lookup is OPTIONAL attribution on a never-gate anonymous route: an
+    // unavailable read (statement timeout, connection blip) must degrade
+    // exactly like a slug that names nothing — NULL, and the application is
+    // kept — rather than turn into a 500 that loses a real founder's
+    // submission. Both outcomes are NULL on the row, so this line is the only
+    // thing that tells an operator "lookup failed" from "no such magnet".
+    // PII-SAFE, same idiom as the unresolved-slug line below: routing
+    // metadata plus the caught error; never the founder's identity, the
+    // resume token or the verify nonce (none is in scope here).
+    logger.warn(
+      { workspaceId, capturedByFlowSlug: slug, err },
+      "[project-listings] capturedByFlowSlug lookup failed; application stored unattributed",
+    );
+    return { kind: "failed" };
+  }
+}
 
 /**
  * Create a `draft` from step one — the founder's name, email and consent.
@@ -621,11 +746,27 @@ export type StartProjectListingDraftResult =
  *
  * No slug yet: it is derived from `name` at SUBMIT (#5033 D2), which is the
  * first moment a name exists.
+ *
+ * WORKSPACE STAMP (#6203). The row's `workspaceId` is resolved from `siteId`
+ * itself (`resolveWorkspaceIdForSite` above) — never a client-supplied
+ * value, and never a fixed deployment default. An unresolved result rejects
+ * the write before any row is created (spec AC-4).
  */
 export async function startProjectListingDraft(
   siteId: string,
   input: ProjectListingStartInput,
 ): Promise<StartProjectListingDraftResult> {
+  const workspaceId = await resolveWorkspaceIdForSite(siteId);
+  if (workspaceId === null) {
+    return {
+      ok: false,
+      error: {
+        kind: "tenant_unresolved",
+        message: "This site is not configured to accept applications.",
+      },
+    };
+  }
+
   const { requestedWindowDays } = input;
   // #5407 — the NOT NULL display column. `composeFounderName` builds it from
   // the PARTS wherever both are written (even beside a `founderName` the body
@@ -684,10 +825,30 @@ export async function startProjectListingDraft(
   // wording, which nobody was shown.
   const consents = input.consents;
   const locale = input.locale ?? "en";
+  // #6314 — the capturing magnet, resolved SERVER-SIDE from the slug the body
+  // named. Only runs when the key is present, so an existing caller costs
+  // nothing; when it is, it is one probe of `@@unique([siteId, slug])`.
+  const capture =
+    input.capturedByFlowSlug === undefined
+      ? undefined
+      : await resolveCapturingFlowId(workspaceId, input.capturedByFlowSlug);
+  const capturedByFlowId = capture?.kind === "resolved" ? capture.id : null;
   const row = await prisma.$transaction(async (tx) => {
     const created = await tx.projectListing.create({
       data: {
-        siteId,
+        // #6254 AC-3/AC-6/AC-10 — the RESOLVED workspace id, not the raw
+        // `siteId` parameter: `project_listings` now requires
+        // `workspace_id = site_id`
+        // (database/migrations/20260922120000_tenancy_fence), and this
+        // column is the isolation key every downstream reader (including
+        // `submitProjectListingDraft`'s `routeLead` call) reads back as
+        // `draft.siteId`. `siteId` (the public-facing param, possibly the
+        // raw `"default"` alias) is still used above to look up
+        // `listingConfigFor`/`consentConfigForSite` — those are independent,
+        // unfenced reads keyed on the site concept, not this row.
+        siteId: workspaceId,
+        // #6203 — the isolation key, resolved above from this SAME siteId.
+        workspaceId,
         founderName,
         // #5407 — the parts as sent, beside the composed line. Absent where a
         // caller sent only a display line, which is the shape every row
@@ -705,6 +866,11 @@ export async function startProjectListingDraft(
         resumeTokenHash: hashResumeToken(resumeToken),
         emailVerifyNonceHash: hashVerifyNonce(verifyNonce),
         windowDays,
+        // #6314 — WRITE-ONCE, and only here. `draftUpdateData` never learns
+        // this key, so no patch body and no submit can re-attribute a draft
+        // to a different magnet after the fact — not by its holder, and not
+        // by anyone who obtains its resume token.
+        ...(capturedByFlowId !== null && { capturedByFlowId }),
       },
       select: { id: true },
     });
@@ -717,6 +883,33 @@ export async function startProjectListingDraft(
     return created;
   });
 
+  // #6314 — an unresolved slug is the operator's ONLY signal, precisely
+  // because the response deliberately carries none (a distinguishable error
+  // would be a cross-workspace magnet-slug oracle on an anonymous route).
+  // Without this line, a mis-wired or stale consuming site yields a
+  // permanently empty Applications list an operator cannot tell from "no
+  // applications yet".
+  //
+  // PII-SAFE, in this route family's existing idiom: routing metadata only.
+  // Never `founderEmail`, `founderName`, the resume token or the verify
+  // nonce — the last two never leave this function except inside the email.
+  // ONLY the `unresolved` outcome, never `failed`. Both store NULL and both
+  // return the same 201, but only one of them establishes "no listicle magnet
+  // of that slug in this site". Asserting it on the throw path would put a
+  // false magnet-configuration signal into the log during a database incident,
+  // which is exactly when an operator is grepping for a cause. `failed` has its
+  // own, accurate line, emitted inside `resolveCapturingFlowId`.
+  if (capture?.kind === "unresolved") {
+    logger.warn(
+      {
+        siteId,
+        listingId: row.id,
+        capturedByFlowSlug: input.capturedByFlowSlug,
+      },
+      "[project-listings] capturedByFlowSlug resolved to no listicle magnet in this site; application stored unattributed",
+    );
+  }
+
   return { ok: true, id: row.id, resumeToken, verifyNonce };
 }
 
@@ -891,6 +1084,7 @@ function draftUpdateData(
     ...(patch.headline !== undefined && { headline: patch.headline }),
     ...(patch.oneLiner !== undefined && { oneLiner: patch.oneLiner }),
     ...(patch.problem !== undefined && { problem: patch.problem }),
+    ...(patch.solution !== undefined && { solution: patch.solution }),
     ...(patch.url !== undefined && { url: patch.url }),
     ...(patch.product !== undefined && { product: patch.product }),
     ...(patch.commitment !== undefined && { commitment: patch.commitment }),
@@ -1067,15 +1261,16 @@ function applicationFromRow(
     address: row.address,
     ...(row.founderCompany !== null && { founderCompany: row.founderCompany }),
     questions: row.questions,
-    // #5285 — the three fields that became writable. Each is optional in the
-    // application schema, so a row that never carried one simply omits it and
-    // `submit` is unaffected. `requestedWindowDays` reads back the CLAMPED
+    // #5285/#5096 — the four fields that became writable. Each is optional in
+    // the application schema, so a row that never carried one simply omits it
+    // and `submit` is unaffected. `requestedWindowDays` reads back the CLAMPED
     // `windowDays` the row actually holds, not what was asked for: the
     // request is not stored anywhere, and re-asserting it would be asserting
     // a number nothing ever agreed to.
     ...(row.logoMarkUrl !== null && { logoMarkUrl: row.logoMarkUrl }),
     ...(row.logoWordmarkUrl !== null && { logoWordmarkUrl: row.logoWordmarkUrl }),
     ...(row.windowDays !== null && { requestedWindowDays: row.windowDays }),
+    ...(row.solution !== null && { solution: row.solution }),
   };
   return Object.fromEntries(
     Object.entries(all).filter(([key]) => collected.has(key)),

package/templates/apps/api/src/services/public-site-resolver.ts

@@ -0,0 +1,106 @@
+/**
+ * Public-read site resolution — which workspace an UNAUTHENTICATED content
+ * read serves (#5852, roadmap D4 read half).
+ *
+ * THE GUARD MODEL IS FAIL-CLOSED. The only branch that yields a workspace is an
+ * unambiguously one-workspace deployment, answered by the same predicate the
+ * authenticated path uses (`services/default-tenant.ts#resolveDefaultWorkspaceId`)
+ * — one predicate, reached two ways, never two predicates. Zero workspaces, two
+ * or more, or a sole workspace that is not the seeded default all resolve to
+ * `unresolved`, and the caller answers 404 before any content query runs.
+ *
+ * IT READS NO HOST. Every deployment this resolver serves today is
+ * one-workspace, so a host lookup would be dead code — and there is nothing to
+ * look up: `WorkspaceSiteIdentity` carries no host column (the value lives
+ * inside the unindexed `data.url`), and `request.hostname` resolves from
+ * `X-Forwarded-Host` under this server's `trustProxy: true` (`server.ts`),
+ * which is caller-suppliable and therefore not a tenancy input. The
+ * multi-tenant host branch is #3635's, and must resolve against a server-side
+ * binding rather than a forwarded header.
+ *
+ * THE CLIENT NEVER SUPPLIES A WORKSPACE. No path parameter, query string,
+ * header or body field is read here, on any read. That is roadmap D4's own
+ * STOP boundary, not a default.
+ *
+ * IT IS A NO-OP OFF THE DATABASE ADAPTER. Unless `CONTENT_ADAPTER=database`,
+ * the function returns `not-required` having issued no query and loaded no
+ * database module — which is what keeps the MDX default path byte-identical
+ * and keeps the no-`DATABASE_URL` scaffold starting.
+ */
+import {
+  resolvedAdapterKind,
+  type ArtifactPrismaClient,
+  type ContentAdapter,
+} from "@working-theory/content-adapters";
+import type { FastifyRequest } from "fastify";
+
+import { getContentAdapter } from "../lib/content-adapter.js";
+
+/**
+ * The three answers a public read can get. `reason` exists for `request.log`
+ * only: the route decides its response from `kind` alone, so no resolution
+ * detail reaches an unauthenticated caller (#5852 D7, D8).
+ */
+export type PublicSiteResolution =
+  | { kind: "not-required" }
+  | { kind: "resolved"; workspaceId: string }
+  | { kind: "unresolved"; reason: "ambiguous" | "host-unmatched" };
+
+/**
+ * Resolves the workspace a public content read serves, or refuses to.
+ *
+ * The `request` argument is the site identifier's eventual source (#3635) and
+ * is deliberately unused today — see the no-host note in this file's header.
+ */
+export async function resolvePublicWorkspace(
+  _request: FastifyRequest,
+): Promise<PublicSiteResolution> {
+  if (resolvedAdapterKind() !== "database") {
+    return { kind: "not-required" };
+  }
+
+  // Deferred — see the module-load note in this file's header (#5852 D6).
+  const { resolveDefaultWorkspaceId } = await import("./default-tenant.js");
+  const workspaceId = await resolveDefaultWorkspaceId();
+  if (workspaceId === null) {
+    return { kind: "unresolved", reason: "ambiguous" };
+  }
+  return { kind: "resolved", workspaceId };
+}
+
+/**
+ * The adapter a public content read should use, or `null` when it must refuse.
+ *
+ * This is the ONE place the three-armed resolution collapses into a decision,
+ * so a second public read route cannot grow a second copy of it: `resolved`
+ * and `not-required` both yield an adapter, `unresolved` yields `null`. The
+ * caller answers `null` with its OWN existing not-found body — which is what
+ * keeps a refusal byte-identical to a missing page on `get-page`, and keeps
+ * each route's 404 shape its own (#5852 D8). The reason is logged here and
+ * never leaves the server.
+ */
+export async function resolvePublicContentAdapter(
+  request: FastifyRequest,
+): Promise<ContentAdapter | null> {
+  const site = await resolvePublicWorkspace(request);
+  if (site.kind === "unresolved") {
+    request.log.warn(
+      { reason: site.reason },
+      "[Content] no site resolved for public read",
+    );
+    return null;
+  }
+  if (site.kind === "not-required") {
+    return getContentAdapter();
+  }
+
+  // The database path, and the only caller that needs apps/api's client. The
+  // import is deferred for the reason the header gives (#5852 D6), and the
+  // generated client is structurally wider than the narrow read surface the
+  // adapter declares — the cast names that, and nothing else.
+  const { prisma } = await import("../lib/prisma.js");
+  return getContentAdapter({
+    workspaceId: site.workspaceId,
+    prisma: prisma as unknown as ArtifactPrismaClient,
+  });
+}