create-ailk 0.7.0 → 0.9.0

package/templates/apps/api/src/routes/webhooks/stripe.ts

@@ -34,16 +34,20 @@
  * Billing upsert (customer.created / checkout.session.completed):
  *   Billing-entity routing (org-scoped billing, #3601, spec D2): a checkout
  *   carrying metadata.organizationId links the Organization (multi-tenant
- *   module); absent → the existing User path (single-tenant), byte-for-byte.
+ *   module); absent → the User path (single-tenant).
  *
  *   Organization path (metadata.organizationId present):
  *     1. Typed composite match already pointing at this org → idempotent no-op
  *     2. Else link the target Organization (by id) billing fields
  *
- *   User path (no organizationId — unchanged):
+ *   User path (no organizationId):
  *     1. Typed composite match: (billingProvider="stripe", billingCustomerId=customer)
- *     2. Email fallback: User.findUnique({ where: { email } }) → update billing fields
- *     3. No match → 200 + warn log; no User row created (pre-signup state)
+ *     2. Verified user signal: metadata.ailk_user_id →
+ *        User.findUnique({ where: { id } }) → bind only when the row's
+ *        billingCustomerId is empty; otherwise log billing_identity_conflict
+ *        and write nothing (#6113). No signal → log billing_identity_unverified,
+ *        write nothing (#6852) — the payer-typed Checkout email never binds.
+ *     3. Signal names no User → warn billing_identity_unknown_user; no row created
  *
  * Recommender purchase stamp (checkout.session.completed / .expired, #4838):
  *   A session carrying metadata.flowCheckoutId (the FlowCheckout buyer row
@@ -275,7 +279,7 @@ export const stripeWebhookHandler = async (
       // Billing-entity routing (spec D2): a multi-tenant checkout stamps the
       // target Organization id in metadata.organizationId (an individual → their
       // sentinel default org). Present → link the Organization; absent → the
-      // existing User path, byte-for-byte (single-tenant, degrade-clean).
+      // User path (single-tenant, degrade-clean).
       const organizationId = customer.metadata?.["organizationId"] ?? null;
       if (organizationId) {
         await upsertOrgBillingIdentity(request, {
@@ -286,7 +290,8 @@ export const stripeWebhookHandler = async (
       } else {
         await upsertBillingIdentity(request, {
           customerId: customer.id,
-          email: customer.email ?? null,
+          userId: signalOf(customer.metadata),
+          eventType: event.type,
           eventIdPrefix,
         });
       }
@@ -306,7 +311,7 @@ export const stripeWebhookHandler = async (
       };
 
       // Billing-entity routing (spec D2): metadata.organizationId → Organization
-      // path; absent → the existing User path, unchanged (single-tenant).
+      // path; absent → the User path (single-tenant).
       const organizationId = session.metadata?.["organizationId"] ?? null;
       let billingTask: Promise<void> = Promise.resolve();
       if (session.customer) {
@@ -318,7 +323,8 @@ export const stripeWebhookHandler = async (
             })
           : upsertBillingIdentity(request, {
               customerId: session.customer,
-              email: session.customer_details?.email ?? null,
+              userId: signalOf(session.metadata),
+              eventType: event.type,
               eventIdPrefix,
             });
       }
@@ -704,14 +710,44 @@ async function stampRequestPaidByInvoice(
   }
 }
 
+/**
+ * The verified user signal (#6852): `metadata.ailk_user_id` on the Checkout
+ * session or the Stripe customer, when it is a non-empty string. Never
+ * `client_reference_id` (a Payment Link accepts it from the payer's URL) and
+ * never the payer-typed email.
+ */
+function signalOf(
+  metadata: Record<string, string> | null | undefined,
+): string | null {
+  const value: unknown = metadata?.["ailk_user_id"];
+  return typeof value === "string" && value !== "" ? value : null;
+}
+
 /**
  * Link User.billingProvider + User.billingCustomerId for a Stripe customer.
  *
  * Lookup priority:
  *   1. Typed composite match: (billingProvider="stripe", billingCustomerId=customerId)
  *      → already linked; no-op (idempotent)
- *   2. Email fallback: User.findUnique({ where: { email } }) → update billing fields
- *   3. No match → warn; do NOT create a User row (pre-signup state preserved for Phase B #852)
+ *   2. Verified user signal (#6852): `metadata.ailk_user_id` →
+ *      User.findUnique({ where: { id } }) → bind only when the row's
+ *      billingCustomerId is empty; otherwise log billing_identity_conflict and
+ *      write nothing (#6113). The write is guarded on `billingCustomerId: null`;
+ *      a P2025 means a concurrent event bound the row first — the same customer
+ *      is a no-op, any other is a conflict.
+ *      No signal → log billing_identity_unverified and write nothing. The payer
+ *      types the Checkout email and Stripe never verifies it, so an email
+ *      never makes a binding, first or otherwise.
+ *      Trust boundary: Checkout-session and customer `metadata` can be written
+ *      only by a principal the seller authorised on their Stripe account (our
+ *      server's key, a write-capable restricted key, a connected app, the
+ *      dashboard, a Payment Link's own metadata) — never by the payer. A
+ *      producer sets the key only from an authenticated server session, never
+ *      from request input.
+ *   3. Signal names no User → warn billing_identity_unknown_user; do NOT
+ *      create a User row (pre-signup state preserved for Phase B #852)
+ *
+ * No line logs the email, the Stripe customer id, or an unresolved signal.
  *
  * DB failures are caught and logged — a broken DB link should not cause Stripe to retry
  * the event (which would fire analytics + billing again on eventual success).
@@ -720,9 +756,15 @@ async function upsertBillingIdentity(
   request: FastifyRequest,
   {
     customerId,
-    email,
+    userId,
+    eventType,
     eventIdPrefix,
-  }: { customerId: string; email: string | null; eventIdPrefix: string },
+  }: {
+    customerId: string;
+    userId: string | null;
+    eventType: string;
+    eventIdPrefix: string;
+  },
 ): Promise<void> {
   try {
     const existingByBilling = await prisma.user.findFirst({
@@ -740,30 +782,80 @@ async function upsertBillingIdentity(
       return;
     }
 
-    if (email) {
-      const existingByEmail = await prisma.user.findUnique({
-        where: { email },
-      });
+    if (!userId) {
+      // A customer Checkout creates never carries session metadata, so a
+      // no-signal customer.created is every ordinary purchase — info, not warn.
+      const fields = {
+        eventIdPrefix,
+        eventType,
+        outcome: "billing_identity_unverified",
+      };
+      const msg =
+        "stripe webhook: no verified user signal — billing identity not bound";
+      if (eventType === "customer.created") request.log.info(fields, msg);
+      else request.log.warn(fields, msg);
+      return;
+    }
 
-      if (existingByEmail) {
-        await prisma.user.update({
-          where: { id: existingByEmail.id },
-          data: {
-            billingProvider: "stripe",
-            billingCustomerId: customerId,
-          },
-        });
-        request.log.info(
-          { eventIdPrefix },
-          "billing identity linked via email fallback",
-        );
-        return;
-      }
+    const row = await prisma.user.findUnique({
+      where: { id: userId },
+      select: { id: true, billingProvider: true, billingCustomerId: true },
+    });
+
+    if (!row) {
+      request.log.warn(
+        { eventIdPrefix, eventType, outcome: "billing_identity_unknown_user" },
+        "stripe webhook: user signal names no User — pre-signup state preserved",
+      );
+      return;
     }
 
-    request.log.warn(
+    const isSameBinding = (r: {
+      billingProvider: string | null;
+      billingCustomerId: string | null;
+    }) => r.billingProvider === "stripe" && r.billingCustomerId === customerId;
+    const logAlreadyLinked = () =>
+      request.log.info(
+        { eventIdPrefix, outcome: "billing_identity_already_linked" },
+        "billing identity already linked — idempotent no-op",
+      );
+    const logConflict = () =>
+      request.log.warn(
+        {
+          eventIdPrefix,
+          outcome: "billing_identity_conflict",
+          userId: row.id,
+        },
+        "stripe webhook: user already bound to a different billing customer — not re-pointed",
+      );
+
+    if (row.billingCustomerId !== null) {
+      if (isSameBinding(row)) logAlreadyLinked();
+      else logConflict();
+      return;
+    }
+
+    try {
+      await prisma.user.update({
+        where: { id: row.id, billingCustomerId: null },
+        data: {
+          billingProvider: "stripe",
+          billingCustomerId: customerId,
+        },
+      });
+    } catch (err) {
+      if ((err as { code?: unknown }).code !== "P2025") throw err;
+      const now = await prisma.user.findUnique({
+        where: { id: row.id },
+        select: { billingProvider: true, billingCustomerId: true },
+      });
+      if (now && isSameBinding(now)) logAlreadyLinked();
+      else logConflict();
+      return;
+    }
+    request.log.info(
       { eventIdPrefix },
-      "stripe webhook: no User match for billing identity — pre-signup state preserved",
+      "billing identity linked via verified user signal",
     );
   } catch (err) {
     request.log.error(

package/templates/apps/api/src/server.ts

@@ -12,6 +12,7 @@
 import cors from "@fastify/cors";
 import rateLimit from "@fastify/rate-limit";
 import { idRegex } from "@working-theory/ids";
+import { logger } from "@working-theory/observability";
 import Fastify from "fastify";
 import type {
   FastifyPluginAsync,
@@ -58,6 +59,7 @@ import {
 import { searchContentRoute } from "./routes/content/search.js";
 import {
   leadCallbackRoute,
+  leadCaptureStatusRoute,
   leadSubmitRoute,
   leadSubscribeRoute,
 } from "./routes/leads/index.js";
@@ -506,6 +508,31 @@ async function assertCommerceSandboxKey(key: string): Promise<void> {
   assertSandboxKeyFn(key);
 }
 
+/**
+ * #6889 (SEC-02 of the #6876 security review) — make the checkout route's
+ * posture observable. POST /v1/checkout/sessions admits a caller without
+ * X-Internal-Auth when OSS_API_INTERNAL_SECRET is unset. With FRONTEND_URL
+ * unset, the route's same-origin redirect lock (#6877) answers 500
+ * config-error to that caller, and the CORS and cookie-CSRF origin checks pin
+ * to the `http://localhost:3000` config default. Both stay optional (OSS
+ * standalone compat), so this only ever WARNS — once per unset variable, and
+ * only in production. FRONTEND_URL is read from the raw environment because
+ * `config.FRONTEND_URL` carries that localhost default.
+ */
+function warnOnUnsetProductionProtections(): void {
+  if (config.NODE_ENV !== "production") return;
+  if (!process.env["FRONTEND_URL"]) {
+    logger.warn(
+      "[startup] FRONTEND_URL not set in production — CORS/cookie origin checks are pinned to http://localhost:3000, and checkout answers 500 config-error to any caller admitted without X-Internal-Auth",
+    );
+  }
+  if (!process.env["OSS_API_INTERNAL_SECRET"]) {
+    logger.warn(
+      "[startup] OSS_API_INTERNAL_SECRET not set in production — the checkout route admits callers without X-Internal-Auth",
+    );
+  }
+}
+
 /**
  * Build Fastify server instance (for serverless or standalone)
  * @returns Configured Fastify instance ready for requests
@@ -514,6 +541,8 @@ export async function build() {
   // Startup-time validation: fail fast if LEAD_CAPTURE_FILE points at a missing directory.
   await validateLeadCaptureDir();
 
+  warnOnUnsetProductionProtections();
+
   // #6155 D6 — the site-alias workspace assertion (ownership brief § Layer
   // 2, AC-5): resolves + asserts once at startup that AILK_SITE_ID (or its
   // "default" fallback) names a real workspace, throwing when it does not —
@@ -1145,6 +1174,12 @@ export async function build() {
     await authEmailScope.register(transactionalEmailRoute);
   });
 
+  // Lead-capture status (#6730 D4) — a cheap read the web page makes before
+  // choosing the form or the contact email. Top level, NOT in `leadsScope`:
+  // the web server's single egress IP already spends that scope's strict
+  // 10/min on form submissions. The global unauth ceiling above applies.
+  await server.register(leadCaptureStatusRoute);
+
   // Leads routes — rate-limit middleware scoped to this sub-router. Own
   // default (10/min, pre-#4730) rather than inheriting the wider
   // flows-sized default (#5111, DEF-004 — #4730's shared-default bump was

package/templates/apps/api/src/services/__tests__/lead-routing.test.ts

@@ -553,3 +553,197 @@ describe("#6257 — the duplicate-subscriber lookup carries workspaceId", () =>
     });
   });
 });
+
+// ─── #6730 D1/D2 — success only for a durable row or an accepted email ───────
+
+describe("#6730 — routeLead delivery modes", () => {
+  const ENV_KEYS = [
+    "DATABASE_URL",
+    "NODE_ENV",
+    "RESEND_API_KEY",
+    "AILK_LEAD_NOTIFICATION_TO",
+    "AILK_LEAD_NOTIFICATION_FROM",
+    "AILK_INBOX_FALLBACK_DIR",
+    "LEAD_CAPTURE_FILE",
+  ] as const;
+  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+  let tmpDir: string;
+  const listFiles = () => fs.readdir(tmpDir);
+
+  const EMAIL_ENV = {
+    RESEND_API_KEY: "re_test",
+    AILK_LEAD_NOTIFICATION_TO: "owner@example.com",
+    AILK_LEAD_NOTIFICATION_FROM: "noreply@example.com",
+  };
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    saved = {};
+    for (const k of ENV_KEYS) saved[k] = process.env[k];
+    for (const k of ENV_KEYS) delete process.env[k];
+    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "ailk-delivery-test-"));
+    process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: "lead_db_1" });
+    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "msg-1" });
+  });
+
+  afterEach(async () => {
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+    await fs.rm(tmpDir, { recursive: true, force: true });
+  });
+
+  describe("email delivery (the three email vars, no DATABASE_URL, production)", () => {
+    beforeEach(() => {
+      Object.assign(process.env, EMAIL_ENV, { NODE_ENV: "production" });
+    });
+
+    it("an accepted email → ok:true persisted:email with an email- id; no Prisma, no file fallback", async () => {
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: true }
+      >;
+
+      expect(result).toMatchObject({
+        ok: true,
+        persisted: "email",
+        email: { ok: true, messageId: "msg-1" },
+      });
+      expect(result.id).toMatch(/^email-/);
+      expect(result.id).toMatch(/^[a-z0-9_-]{8,64}$/i);
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+      expect(await listFiles()).toEqual([]);
+      expect(mockSendLeadNotification).toHaveBeenCalledTimes(1);
+    });
+
+    it("a refused email → ok:false delivery_failed (never reported as sent)", async () => {
+      mockSendLeadNotification.mockResolvedValue({
+        ok: false,
+        error: { kind: "provider_error", message: "rejected" },
+      });
+
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: false }
+      >;
+
+      expect(result.ok).toBe(false);
+      expect(result.error.kind).toBe("delivery_failed");
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+      expect(await listFiles()).toEqual([]);
+    });
+
+    it("a skipped email (provider reports the key missing) → delivery_failed", async () => {
+      mockSendLeadNotification.mockResolvedValue({
+        ok: false,
+        error: { kind: "config_missing", message: "RESEND_API_KEY not set" },
+      });
+
+      const result = await routeLead(leadInput, sourceMeta);
+      expect(result).toMatchObject({ ok: false, error: { kind: "delivery_failed" } });
+    });
+
+    it("a callback is delivered by email too — carrying the name and number to call", async () => {
+      const result = await routeLead(
+        { ...callbackInput, preferredTime: "mornings" },
+        sourceMeta,
+      );
+      expect(result).toMatchObject({ ok: true, persisted: "email" });
+      expect(prisma.callback.create).not.toHaveBeenCalled();
+      const arg = mockSendLeadNotification.mock.calls[0][0];
+      expect(arg.lead.payload).toMatchObject({
+        name: "Alice",
+        phone: "+15551234567",
+        preferredTime: "mornings",
+        notes: "urgent",
+      });
+      // No visitor address to reply to — never an empty Reply-To.
+      expect(arg.replyToOverride).toBe("owner@example.com");
+    });
+
+    it("a newsletter subscribe is refused with config_missing — a signup needs a database", async () => {
+      const result = await routeLead(subscribeInput, sourceMeta);
+      expect(result).toMatchObject({ ok: false, error: { kind: "config_missing" } });
+      expect(prisma.subscriber.create).not.toHaveBeenCalled();
+      expect(mockSendLeadNotification).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("production with neither a database nor the email vars", () => {
+    beforeEach(() => {
+      process.env.NODE_ENV = "production";
+    });
+
+    it("refuses with config_missing before any write", async () => {
+      const result = await routeLead(leadInput, sourceMeta);
+
+      expect(result).toMatchObject({ ok: false, error: { kind: "config_missing" } });
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+      expect(mockSendLeadNotification).not.toHaveBeenCalled();
+      expect(await listFiles()).toEqual([]);
+    });
+  });
+
+  describe("inbox delivery in production with the database failing (not a constraint)", () => {
+    beforeEach(() => {
+      process.env.DATABASE_URL = "postgres://test";
+      process.env.NODE_ENV = "production";
+      (prisma.lead.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+    });
+
+    it("no email vars → persist_failed, and the non-durable file fallback is not attempted", async () => {
+      const result = await routeLead(leadInput, sourceMeta);
+
+      expect(result).toMatchObject({ ok: false, error: { kind: "persist_failed" } });
+      expect(await listFiles()).toEqual([]);
+    });
+
+    it("email vars set and the send accepted → persisted:email", async () => {
+      Object.assign(process.env, EMAIL_ENV);
+
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: true }
+      >;
+
+      expect(result).toMatchObject({ ok: true, persisted: "email" });
+      expect(result.id).toMatch(/^email-/);
+      expect(await listFiles()).toEqual([]);
+    });
+
+    it("a newsletter signup is never emailed — persist_failed", async () => {
+      Object.assign(process.env, EMAIL_ENV);
+      (prisma.subscriber.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+
+      const result = await routeLead(subscribeInput, sourceMeta);
+
+      expect(result).toMatchObject({ ok: false, error: { kind: "persist_failed" } });
+      expect(mockSendLeadNotification).not.toHaveBeenCalled();
+    });
+
+    it("email vars set but the send refused → persist_failed", async () => {
+      Object.assign(process.env, EMAIL_ENV);
+      mockSendLeadNotification.mockResolvedValue({
+        ok: false,
+        error: { kind: "provider_error", message: "rejected" },
+      });
+
+      const result = await routeLead(leadInput, sourceMeta);
+      expect(result).toMatchObject({ ok: false, error: { kind: "persist_failed" } });
+    });
+  });
+
+  describe("inbox delivery outside production keeps today's file fallback", () => {
+    it("DB down in test → persisted:file", async () => {
+      process.env.DATABASE_URL = "postgres://test";
+      process.env.NODE_ENV = "test";
+      (prisma.lead.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+
+      const result = await routeLead(leadInput, sourceMeta);
+      expect(result).toMatchObject({ ok: true, persisted: "file" });
+      expect((await listFiles()).length).toBeGreaterThan(0);
+    });
+  });
+});

package/templates/apps/api/src/services/__tests__/leads-inbox.test.ts

@@ -327,3 +327,127 @@ describe("listOwnedLeads", () => {
     expect(second.value.nextCursor).toBeNull();
   });
 });
+
+// ─── #6730 D7 — the single-tenant inbox, pinned to the operator ──────────────
+
+describe("listOwnedLeads — single-tenant build (#6730 D7)", () => {
+  const { DEFAULT_ORG_ID, DEFAULT_WORKSPACE_ID } = jest.requireActual(
+    "@working-theory/database/tenancy",
+  ) as { DEFAULT_ORG_ID: string; DEFAULT_WORKSPACE_ID: string };
+  const OPERATOR_EMAIL = "owner@example.com";
+  const prior = {
+    modules: process.env.AILK_ENABLED_MODULES,
+    pin: process.env.AILK_OPERATOR_EMAIL,
+  };
+
+  /** One workspace — the seeded default — and a caller whose verified email is `email`. */
+  function oneWorkspaceDeployment(opts: {
+    email: string;
+    verified?: boolean;
+    workspaceCount?: number;
+    role?: string;
+  }) {
+    (prisma.workspace.count as jest.Mock).mockResolvedValue(opts.workspaceCount ?? 1);
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
+      id: DEFAULT_WORKSPACE_ID,
+      organizationId: DEFAULT_ORG_ID,
+    });
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
+      id: USER_ID,
+      email: opts.email,
+      emailVerified: opts.verified ?? true,
+    });
+    (prisma.membership.create as jest.Mock).mockResolvedValue({});
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
+      role: opts.role ?? "owner",
+    });
+  }
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    delete process.env.AILK_ENABLED_MODULES;
+    process.env.AILK_OPERATOR_EMAIL = OPERATOR_EMAIL;
+    seedLeadTable([
+      lead({ id: "lead_own", siteId: DEFAULT_WORKSPACE_ID }),
+      lead({ id: "lead_elsewhere", siteId: OTHER_SITE_ID }),
+    ]);
+  });
+
+  afterAll(() => {
+    for (const [key, value] of [
+      ["AILK_ENABLED_MODULES", prior.modules],
+      ["AILK_OPERATOR_EMAIL", prior.pin],
+    ] as const) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  });
+
+  it("the pinned, verified owner sees the default workspace's leads — and only those", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.value.items.map((r) => r.id)).toEqual(["lead_own"]);
+  });
+
+  it("the pin unset → empty", async () => {
+    delete process.env.AILK_OPERATOR_EMAIL;
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+    expect(prisma.lead.findMany).not.toHaveBeenCalled();
+  });
+
+  it("a different verified email → empty", async () => {
+    oneWorkspaceDeployment({ email: "stranger@example.com" });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+    expect(prisma.lead.findMany).not.toHaveBeenCalled();
+  });
+
+  it("the pinned email, unverified → empty", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, verified: false });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+  });
+
+  it("a second workspace → empty (not unambiguously one-workspace)", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, workspaceCount: 2 });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+  });
+
+  it("a `member` role → empty — the role floor still holds", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, role: "member" });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+  });
+
+  it("with multi-tenant on, resolveOwnerWorkspaces is the path — the default-tenant resolver is not called", async () => {
+    process.env.AILK_ENABLED_MODULES = "multi-tenant";
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL });
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue([]);
+    const ownerWorkspaces = jest.requireActual("../owner-workspaces.js");
+    const spy = jest.spyOn(ownerWorkspaces, "resolveOwnerWorkspaces");
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(spy).toHaveBeenCalledWith(USER_ID);
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+    spy.mockRestore();
+  });
+});