create-ailk 0.7.0 → 0.8.0

package/templates/apps/api/src/services/__tests__/lead-routing.test.ts

@@ -553,3 +553,197 @@ describe("#6257 — the duplicate-subscriber lookup carries workspaceId", () =>
     });
   });
 });
+
+// ─── #6730 D1/D2 — success only for a durable row or an accepted email ───────
+
+describe("#6730 — routeLead delivery modes", () => {
+  const ENV_KEYS = [
+    "DATABASE_URL",
+    "NODE_ENV",
+    "RESEND_API_KEY",
+    "AILK_LEAD_NOTIFICATION_TO",
+    "AILK_LEAD_NOTIFICATION_FROM",
+    "AILK_INBOX_FALLBACK_DIR",
+    "LEAD_CAPTURE_FILE",
+  ] as const;
+  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+  let tmpDir: string;
+  const listFiles = () => fs.readdir(tmpDir);
+
+  const EMAIL_ENV = {
+    RESEND_API_KEY: "re_test",
+    AILK_LEAD_NOTIFICATION_TO: "owner@example.com",
+    AILK_LEAD_NOTIFICATION_FROM: "noreply@example.com",
+  };
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    saved = {};
+    for (const k of ENV_KEYS) saved[k] = process.env[k];
+    for (const k of ENV_KEYS) delete process.env[k];
+    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "ailk-delivery-test-"));
+    process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: "lead_db_1" });
+    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "msg-1" });
+  });
+
+  afterEach(async () => {
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+    await fs.rm(tmpDir, { recursive: true, force: true });
+  });
+
+  describe("email delivery (the three email vars, no DATABASE_URL, production)", () => {
+    beforeEach(() => {
+      Object.assign(process.env, EMAIL_ENV, { NODE_ENV: "production" });
+    });
+
+    it("an accepted email → ok:true persisted:email with an email- id; no Prisma, no file fallback", async () => {
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: true }
+      >;
+
+      expect(result).toMatchObject({
+        ok: true,
+        persisted: "email",
+        email: { ok: true, messageId: "msg-1" },
+      });
+      expect(result.id).toMatch(/^email-/);
+      expect(result.id).toMatch(/^[a-z0-9_-]{8,64}$/i);
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+      expect(await listFiles()).toEqual([]);
+      expect(mockSendLeadNotification).toHaveBeenCalledTimes(1);
+    });
+
+    it("a refused email → ok:false delivery_failed (never reported as sent)", async () => {
+      mockSendLeadNotification.mockResolvedValue({
+        ok: false,
+        error: { kind: "provider_error", message: "rejected" },
+      });
+
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: false }
+      >;
+
+      expect(result.ok).toBe(false);
+      expect(result.error.kind).toBe("delivery_failed");
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+      expect(await listFiles()).toEqual([]);
+    });
+
+    it("a skipped email (provider reports the key missing) → delivery_failed", async () => {
+      mockSendLeadNotification.mockResolvedValue({
+        ok: false,
+        error: { kind: "config_missing", message: "RESEND_API_KEY not set" },
+      });
+
+      const result = await routeLead(leadInput, sourceMeta);
+      expect(result).toMatchObject({ ok: false, error: { kind: "delivery_failed" } });
+    });
+
+    it("a callback is delivered by email too — carrying the name and number to call", async () => {
+      const result = await routeLead(
+        { ...callbackInput, preferredTime: "mornings" },
+        sourceMeta,
+      );
+      expect(result).toMatchObject({ ok: true, persisted: "email" });
+      expect(prisma.callback.create).not.toHaveBeenCalled();
+      const arg = mockSendLeadNotification.mock.calls[0][0];
+      expect(arg.lead.payload).toMatchObject({
+        name: "Alice",
+        phone: "+15551234567",
+        preferredTime: "mornings",
+        notes: "urgent",
+      });
+      // No visitor address to reply to — never an empty Reply-To.
+      expect(arg.replyToOverride).toBe("owner@example.com");
+    });
+
+    it("a newsletter subscribe is refused with config_missing — a signup needs a database", async () => {
+      const result = await routeLead(subscribeInput, sourceMeta);
+      expect(result).toMatchObject({ ok: false, error: { kind: "config_missing" } });
+      expect(prisma.subscriber.create).not.toHaveBeenCalled();
+      expect(mockSendLeadNotification).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("production with neither a database nor the email vars", () => {
+    beforeEach(() => {
+      process.env.NODE_ENV = "production";
+    });
+
+    it("refuses with config_missing before any write", async () => {
+      const result = await routeLead(leadInput, sourceMeta);
+
+      expect(result).toMatchObject({ ok: false, error: { kind: "config_missing" } });
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+      expect(mockSendLeadNotification).not.toHaveBeenCalled();
+      expect(await listFiles()).toEqual([]);
+    });
+  });
+
+  describe("inbox delivery in production with the database failing (not a constraint)", () => {
+    beforeEach(() => {
+      process.env.DATABASE_URL = "postgres://test";
+      process.env.NODE_ENV = "production";
+      (prisma.lead.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+    });
+
+    it("no email vars → persist_failed, and the non-durable file fallback is not attempted", async () => {
+      const result = await routeLead(leadInput, sourceMeta);
+
+      expect(result).toMatchObject({ ok: false, error: { kind: "persist_failed" } });
+      expect(await listFiles()).toEqual([]);
+    });
+
+    it("email vars set and the send accepted → persisted:email", async () => {
+      Object.assign(process.env, EMAIL_ENV);
+
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: true }
+      >;
+
+      expect(result).toMatchObject({ ok: true, persisted: "email" });
+      expect(result.id).toMatch(/^email-/);
+      expect(await listFiles()).toEqual([]);
+    });
+
+    it("a newsletter signup is never emailed — persist_failed", async () => {
+      Object.assign(process.env, EMAIL_ENV);
+      (prisma.subscriber.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+
+      const result = await routeLead(subscribeInput, sourceMeta);
+
+      expect(result).toMatchObject({ ok: false, error: { kind: "persist_failed" } });
+      expect(mockSendLeadNotification).not.toHaveBeenCalled();
+    });
+
+    it("email vars set but the send refused → persist_failed", async () => {
+      Object.assign(process.env, EMAIL_ENV);
+      mockSendLeadNotification.mockResolvedValue({
+        ok: false,
+        error: { kind: "provider_error", message: "rejected" },
+      });
+
+      const result = await routeLead(leadInput, sourceMeta);
+      expect(result).toMatchObject({ ok: false, error: { kind: "persist_failed" } });
+    });
+  });
+
+  describe("inbox delivery outside production keeps today's file fallback", () => {
+    it("DB down in test → persisted:file", async () => {
+      process.env.DATABASE_URL = "postgres://test";
+      process.env.NODE_ENV = "test";
+      (prisma.lead.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+
+      const result = await routeLead(leadInput, sourceMeta);
+      expect(result).toMatchObject({ ok: true, persisted: "file" });
+      expect((await listFiles()).length).toBeGreaterThan(0);
+    });
+  });
+});

package/templates/apps/api/src/services/__tests__/leads-inbox.test.ts

@@ -327,3 +327,127 @@ describe("listOwnedLeads", () => {
     expect(second.value.nextCursor).toBeNull();
   });
 });
+
+// ─── #6730 D7 — the single-tenant inbox, pinned to the operator ──────────────
+
+describe("listOwnedLeads — single-tenant build (#6730 D7)", () => {
+  const { DEFAULT_ORG_ID, DEFAULT_WORKSPACE_ID } = jest.requireActual(
+    "@working-theory/database/tenancy",
+  ) as { DEFAULT_ORG_ID: string; DEFAULT_WORKSPACE_ID: string };
+  const OPERATOR_EMAIL = "owner@example.com";
+  const prior = {
+    modules: process.env.AILK_ENABLED_MODULES,
+    pin: process.env.AILK_OPERATOR_EMAIL,
+  };
+
+  /** One workspace — the seeded default — and a caller whose verified email is `email`. */
+  function oneWorkspaceDeployment(opts: {
+    email: string;
+    verified?: boolean;
+    workspaceCount?: number;
+    role?: string;
+  }) {
+    (prisma.workspace.count as jest.Mock).mockResolvedValue(opts.workspaceCount ?? 1);
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
+      id: DEFAULT_WORKSPACE_ID,
+      organizationId: DEFAULT_ORG_ID,
+    });
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
+      id: USER_ID,
+      email: opts.email,
+      emailVerified: opts.verified ?? true,
+    });
+    (prisma.membership.create as jest.Mock).mockResolvedValue({});
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
+      role: opts.role ?? "owner",
+    });
+  }
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    delete process.env.AILK_ENABLED_MODULES;
+    process.env.AILK_OPERATOR_EMAIL = OPERATOR_EMAIL;
+    seedLeadTable([
+      lead({ id: "lead_own", siteId: DEFAULT_WORKSPACE_ID }),
+      lead({ id: "lead_elsewhere", siteId: OTHER_SITE_ID }),
+    ]);
+  });
+
+  afterAll(() => {
+    for (const [key, value] of [
+      ["AILK_ENABLED_MODULES", prior.modules],
+      ["AILK_OPERATOR_EMAIL", prior.pin],
+    ] as const) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  });
+
+  it("the pinned, verified owner sees the default workspace's leads — and only those", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.value.items.map((r) => r.id)).toEqual(["lead_own"]);
+  });
+
+  it("the pin unset → empty", async () => {
+    delete process.env.AILK_OPERATOR_EMAIL;
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+    expect(prisma.lead.findMany).not.toHaveBeenCalled();
+  });
+
+  it("a different verified email → empty", async () => {
+    oneWorkspaceDeployment({ email: "stranger@example.com" });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+    expect(prisma.lead.findMany).not.toHaveBeenCalled();
+  });
+
+  it("the pinned email, unverified → empty", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, verified: false });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+  });
+
+  it("a second workspace → empty (not unambiguously one-workspace)", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, workspaceCount: 2 });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+  });
+
+  it("a `member` role → empty — the role floor still holds", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, role: "member" });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+  });
+
+  it("with multi-tenant on, resolveOwnerWorkspaces is the path — the default-tenant resolver is not called", async () => {
+    process.env.AILK_ENABLED_MODULES = "multi-tenant";
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL });
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue([]);
+    const ownerWorkspaces = jest.requireActual("../owner-workspaces.js");
+    const spy = jest.spyOn(ownerWorkspaces, "resolveOwnerWorkspaces");
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(spy).toHaveBeenCalledWith(USER_ID);
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+    spy.mockRestore();
+  });
+});

package/templates/apps/api/src/services/lead-routing.ts

@@ -2,7 +2,12 @@
  * @file lead-routing.ts
  * @description Cross-namespace lead orchestration service (ADR 0009 D3).
  *
- * Pipeline: validate → enrich → persist (DB with file fallback) → email.
+ * Pipeline: validate → delivery guard → enrich → persist (DB with file
+ * fallback) → email. Where a lead may go is `resolveLeadDelivery()`
+ * (`lib/lead-delivery.ts`, #6730 D1): with no database but the email vars set,
+ * the owner email IS the delivery; in production with neither, nothing is
+ * accepted. A lead is reported sent only for a durable row or an email the
+ * provider accepted — never for the non-durable file fallback in production.
  * This is the first implementation of ADR 0009 D3's service-layer pattern.
  * Future cross-namespace orchestrators in apps/api/src/services/ should mirror
  * this shape: type-result returns, mocked-dep tests, non-transactional secondary
@@ -32,6 +37,7 @@ import { leadInputSchema } from "@working-theory/validation";
 
 import { writeLeadFallback } from "../lib/file-fallback.js";
 import { appendLeadRecord } from "../lib/lead-capture-store.js";
+import { acceptsKind, resolveLeadDelivery } from "../lib/lead-delivery.js";
 import { prisma } from "../lib/prisma.js";
 
 import { enrichLead } from "./enrichment-shim.js";
@@ -65,11 +71,14 @@ export type SourceMeta = {
   receivedAt: string; // ISO
 };
 
+/** Where the lead landed: a database row, the local file fallback, or the owner's inbox by email (#6730). */
+export type Persisted = "db" | "file" | "email";
+
 export type RouteLeadResult =
   | {
       ok: true;
       id: string;
-      persisted: "db" | "file";
+      persisted: Persisted;
       email:
         | { ok: true; messageId: string }
         | { ok: false; error: string }
@@ -78,7 +87,11 @@ export type RouteLeadResult =
   | {
       ok: false;
       error: {
-        kind: "invalid_input" | "persist_failed" | "config_missing";
+        kind:
+          | "invalid_input"
+          | "persist_failed"
+          | "config_missing"
+          | "delivery_failed";
         message: string;
       };
     };
@@ -272,7 +285,7 @@ type EmailResult =
 async function sendEmail(
   input: RouteLeadInput,
   id: string,
-  persisted: "db" | "file",
+  persisted: Persisted,
 ): Promise<EmailResult> {
   // Request-and-confirm SUPERSEDES this notification for a callback (#5970
   // D6). AC-1 requires the tenant to receive exactly one email, and the
@@ -316,7 +329,22 @@ async function sendEmail(
     siteId: input.siteId,
     source: input.kind === "callback" ? "callback" : input.source,
     email: input.kind === "callback" ? "" : input.email,
-    payload: input.kind === "subscribe" ? {} : input.payload,
+    // A callback's contact details are top-level fields, not payload keys
+    // (#6730): with no database the email is the only record of the
+    // request, so it must carry the name and number to call back.
+    payload:
+      input.kind === "subscribe"
+        ? {}
+        : input.kind === "callback"
+          ? {
+              ...input.payload,
+              name: input.name,
+              phone: input.phone,
+              ...(input.preferredTime !== undefined && {
+                preferredTime: input.preferredTime,
+              }),
+            }
+          : input.payload,
     createdAt: new Date().toISOString(),
   };
 
@@ -324,6 +352,9 @@ async function sendEmail(
     lead: leadForEmail,
     recipientEmail: to,
     fromAddress: from,
+    // A callback has no visitor address to reply to; an empty Reply-To is
+    // not a valid header, so reply to the owner instead.
+    ...(input.kind === "callback" && { replyToOverride: to }),
   });
 
   if (emailResult.ok) {
@@ -337,6 +368,47 @@ async function sendEmail(
   return { ok: false, error: `${kind}: ${message}` };
 }
 
+// ─── Email delivery (#6730 D2) ────────────────────────────────────────────────
+
+type EmailDelivery =
+  | { ok: true; id: string; email: { ok: true; messageId: string } }
+  | { ok: false; message: string };
+
+/**
+ * Deliver a lead as the owner email alone — success only when the provider
+ * accepted it. The id matches the file-fallback id format
+ * (`/^[a-z0-9_-]{8,64}$/i`).
+ */
+async function deliverByEmail(input: RouteLeadInput): Promise<EmailDelivery> {
+  const id = `email-${Date.now()}-${randomUUID().slice(0, 8)}`;
+  const result = await sendEmail(input, id, "email");
+  if ("ok" in result && result.ok) return { ok: true, id, email: result };
+  return {
+    ok: false,
+    message: "error" in result ? result.error : `email skipped: ${result.reason}`,
+  };
+}
+
+// ─── Lead-capture record ─────────────────────────────────────────────────────
+
+function captureRecordFor(input: RouteLeadInput, id: string, sourceMeta: SourceMeta) {
+  return {
+    id,
+    createdAt: sourceMeta.receivedAt,
+    source: input.kind === "callback" ? "callback" : input.source,
+    data:
+      input.kind === "callback"
+        ? { name: input.name, phone: input.phone, ...(input.payload ?? {}) }
+        : input.kind === "subscribe"
+          ? { email: input.email }
+          : { email: input.email, ...(input.payload ?? {}) },
+    metadata: {
+      ip: sourceMeta.ip,
+      userAgent: sourceMeta.userAgent,
+    },
+  };
+}
+
 // ─── Main export ──────────────────────────────────────────────────────────────
 
 export async function routeLead(
@@ -352,13 +424,13 @@ export async function routeLead(
     };
   }
 
-  // 2. Guard: if file capture is disabled AND no DB is configured, bail early.
-  // Both paths are unavailable — returning a clear error is better than a
-  // misleading 201 or a stack trace from Prisma on a missing DATABASE_URL.
-  if (
-    process.env.LEAD_CAPTURE_FILE_DISABLED === "true" &&
-    !process.env.DATABASE_URL
-  ) {
+  // 2. Guard: where can this lead go (#6730 D1)? A kind the configured
+  // delivery cannot take — anything in production with neither a database
+  // nor the email vars, a newsletter signup with no database — is refused
+  // before any write, so no visitor is told a message was sent when it
+  // reached nobody.
+  const delivery = resolveLeadDelivery();
+  if (!acceptsKind(delivery, input.kind)) {
     return {
       ok: false,
       error: {
@@ -374,9 +446,28 @@ export async function routeLead(
   // the real enrichment call with proper type alignment.
   await enrichLead(input as unknown as Parameters<typeof enrichLead>[0]);
 
+  // Email delivery — no database: the owner email is the delivery, so skip
+  // the DB and the (non-durable) file fallback entirely.
+  if (delivery === "email") {
+    const emailed = await deliverByEmail(input);
+    if (!emailed.ok) {
+      return {
+        ok: false,
+        error: { kind: "delivery_failed", message: emailed.message },
+      };
+    }
+    await appendLeadRecord(captureRecordFor(input, emailed.id, sourceMeta));
+    return {
+      ok: true,
+      id: emailed.id,
+      persisted: "email",
+      email: emailed.email,
+    };
+  }
+
   // 4. Persist primary (DB), fallback to file on error
   let id: string;
-  let persisted: "db" | "file";
+  let persisted: Persisted;
   let skipEmail = false;
   let skipReason: string | undefined;
 
@@ -424,7 +515,41 @@ export async function routeLead(
       };
     }
 
-    // 5. File fallback
+    // In production the file fallback is not durable (a serverless instance
+    // does not outlive the request), so reporting it as success would lose
+    // the lead silently. Deliver by email when that is configured; otherwise
+    // fail loudly (#6730 D2). A newsletter signup is never emailed — one
+    // owner email per address is not a list (`acceptsKind`).
+    if (process.env.NODE_ENV === "production") {
+      const dbMsg = dbErr instanceof Error ? dbErr.message : String(dbErr);
+      if (input.kind === "subscribe") {
+        return {
+          ok: false,
+          error: { kind: "persist_failed", message: `db: ${dbMsg}` },
+        };
+      }
+      const emailed = await deliverByEmail(input);
+      if (!emailed.ok) {
+        return {
+          ok: false,
+          error: {
+            kind: "persist_failed",
+            // Not the provider's text: it can echo an address, and this
+            // message is logged (spec D5).
+            message: `db: ${dbMsg}; email delivery failed`,
+          },
+        };
+      }
+      await appendLeadRecord(captureRecordFor(input, emailed.id, sourceMeta));
+      return {
+        ok: true,
+        id: emailed.id,
+        persisted: "email",
+        email: emailed.email,
+      };
+    }
+
+    // 5. File fallback (outside production only)
     // Include a UUID suffix so concurrent fallbacks produce unique IDs even
     // within the same millisecond. Format still matches /^[a-z0-9_-]{8,64}$/i.
     const fallbackLead = {
@@ -468,22 +593,7 @@ export async function routeLead(
   // 6. Write to lead-capture JSONL (always-on canonical AX surface).
   // Best-effort — a write failure does NOT roll back persistence or block email.
   // The file is the agent-readable surface; DB is the transactional record.
-  const captureRecord = {
-    id: id!,
-    createdAt: sourceMeta.receivedAt,
-    source: input.kind === "callback" ? "callback" : input.source,
-    data:
-      input.kind === "callback"
-        ? { name: input.name, phone: input.phone, ...(input.payload ?? {}) }
-        : input.kind === "subscribe"
-          ? { email: input.email }
-          : { email: input.email, ...(input.payload ?? {}) },
-    metadata: {
-      ip: sourceMeta.ip,
-      userAgent: sourceMeta.userAgent,
-    },
-  };
-  await appendLeadRecord(captureRecord);
+  await appendLeadRecord(captureRecordFor(input, id!, sourceMeta));
 
   // 7. Email notification (best-effort — never rolls back persistence)
   let emailResult: EmailResult;

package/templates/apps/api/src/services/leads-inbox.ts

@@ -25,10 +25,14 @@
  *
  * Two preconditions, neither of which this file can assert:
  *
- *   1. `resolveOwnerWorkspaces` must yield a workspace. On a build with no
- *      `multi-tenant` module it yields none — see its own header, and #5677,
- *      which made that a deliberate scope limit rather than a statement that
- *      there is nothing to resolve.
+ *   1. The caller's scope must resolve to a workspace. With the
+ *      `multi-tenant` module that is `resolveOwnerWorkspaces`. Without it
+ *      (#6730 D7) — Free and Pro — that resolver yields none by design (its
+ *      own header, #5677), so the scope is instead the default workspace,
+ *      granted ONLY through `resolveDefaultTenantForOperator`
+ *      (`default-tenant.ts`): `AILK_OPERATOR_EMAIL` set, the caller's
+ *      VERIFIED email equal to it, and the deployment unambiguously
+ *      one-workspace. Any other caller gets the empty page, never a wider one.
  *   2. The `siteId` the leads were WRITTEN under must equal a workspace id,
  *      and there are TWO independent sources of it — both must agree with the
  *      workspace, and neither is `currentSiteId()` on the primary path:
@@ -67,8 +71,10 @@
 import type { Prisma } from "@working-theory/database";
 import type { Id } from "@working-theory/ids";
 
+import { isModuleEnabled } from "../config/modules.js";
 import { prisma } from "../lib/prisma.js";
 
+import { resolveDefaultTenantForOperator } from "./default-tenant.js";
 import { resolveOwnerWorkspaces } from "./owner-workspaces.js";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
@@ -178,6 +184,40 @@ export function readName(payload: Prisma.JsonValue): string | null {
   return typeof name === "string" ? name.slice(0, MAX_NAME_LENGTH) : null;
 }
 
+// ─── Scope ────────────────────────────────────────────────────────────────────
+
+/**
+ * The workspace ids whose leads the caller may read. With `multi-tenant`,
+ * every workspace they own or administer (`resolveOwnerWorkspaces`,
+ * unchanged). Without it (#6730 D7), the default workspace — only for the
+ * pinned, verified operator on a one-workspace deployment; `null` from the
+ * resolver means no scope at all.
+ */
+async function resolveInboxSiteIds(
+  userId: Id<"user">,
+): Promise<{ ok: true; siteIds: string[] } | { ok: false; message: string }> {
+  if (!isModuleEnabled("multi-tenant")) {
+    try {
+      const tenant = await resolveDefaultTenantForOperator(userId);
+      return {
+        ok: true,
+        siteIds: tenant && LEAD_INBOX_ROLES.has(tenant.role) ? [tenant.workspaceId] : [],
+      };
+    } catch (err) {
+      return { ok: false, message: err instanceof Error ? err.message : String(err) };
+    }
+  }
+
+  const workspaces = await resolveOwnerWorkspaces(userId);
+  if (!workspaces.ok) return { ok: false, message: workspaces.error.message };
+  return {
+    ok: true,
+    siteIds: workspaces.value
+      .filter((workspace) => LEAD_INBOX_ROLES.has(workspace.role))
+      .map((workspace) => workspace.id),
+  };
+}
+
 // ─── Main export ──────────────────────────────────────────────────────────────
 
 /**
@@ -199,17 +239,14 @@ export async function listOwnedLeads(params: {
   cursor?: string | undefined;
   limit: number;
 }): Promise<ListLeadsResult> {
-  const workspaces = await resolveOwnerWorkspaces(params.userId);
-  if (!workspaces.ok) {
+  const scope = await resolveInboxSiteIds(params.userId);
+  if (!scope.ok) {
     return {
       ok: false,
-      error: { kind: "internal_error", message: workspaces.error.message },
+      error: { kind: "internal_error", message: scope.message },
     };
   }
-
-  const siteIds = workspaces.value
-    .filter((workspace) => LEAD_INBOX_ROLES.has(workspace.role))
-    .map((workspace) => workspace.id);
+  const siteIds = scope.siteIds;
 
   // No workspace the caller owns or administers means no lead can match, so
   // there is nothing to query. An empty page is the honest answer — the same