@alumbwe/anvil 1.0.20 → 1.0.21

package/vendor/@anvil/common/src/__tests__/anvil-public-data-use-copy.test.ts

@@ -0,0 +1,258 @@
+import { describe, expect, test } from 'bun:test'
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+import {
+  ANVIL_AI_TRAINING_NOTICE,
+  ANVIL_DATA_USE_GENERATED_MARKDOWN_BLOCK,
+  ANVIL_DATA_USE_GENERATED_MDX_BLOCK,
+  ANVIL_POLICY_ROLLOUT,
+  ANVIL_PUBLIC_DATA_USE_COPY,
+  renderAnvilDataUseFaqMarkdown,
+  renderAnvilDataUseFaqMdx,
+} from '../constants/anvil-data-use'
+
+const REPO_ROOT = resolve(import.meta.dir, '../../..')
+
+function readRepoFile(path: string): string {
+  return readFileSync(resolve(REPO_ROOT, path), 'utf8')
+}
+
+function listPublicTextFiles(path: string): string[] {
+  const absolutePath = resolve(REPO_ROOT, path)
+  if (!statSync(absolutePath).isDirectory()) return [path]
+
+  return readdirSync(absolutePath).flatMap((entry) => {
+    const child = `${path}/${entry}`
+    const childPath = resolve(REPO_ROOT, child)
+
+    if (statSync(childPath).isDirectory()) return listPublicTextFiles(child)
+    return /\.(?:md|mdx|ts|tsx)$/.test(entry) ? [child] : []
+  })
+}
+
+function generatedBlock(
+  source: string,
+  markers: { start: string; end: string },
+): string {
+  const start = source.indexOf(markers.start)
+  const end = source.indexOf(markers.end, start)
+
+  expect(start).toBeGreaterThanOrEqual(0)
+  expect(end).toBeGreaterThan(start)
+
+  return source.slice(start, end + markers.end.length)
+}
+
+describe('public Anvil data-use copy', () => {
+  test('the July 23 policy rollout metadata and notice stay aligned', () => {
+    expect(ANVIL_POLICY_ROLLOUT).toEqual({
+      version: '2026-07-23',
+      effectiveDate: 'July 23, 2026',
+      lastUpdated: '07/23/2026',
+      noticeEndsAt: '2026-08-23T00:00:00-07:00',
+      notice: {
+        title:
+          'We’ve updated our Terms and Privacy Policy, effective July 23, 2026.',
+        summary:
+          'Prompts may be used to personalize ads, AI training applies only to labeled models or features, and usage restrictions were updated.',
+      },
+    })
+  })
+
+  test.each(['README.md', 'anvil/cli/release/README.md'])(
+    '%s matches the generated Markdown FAQ',
+    (path) => {
+      expect(
+        generatedBlock(
+          readRepoFile(path),
+          ANVIL_DATA_USE_GENERATED_MARKDOWN_BLOCK,
+        ),
+      ).toBe(renderAnvilDataUseFaqMarkdown())
+    },
+  )
+
+  test.each([
+    'web/src/content/advanced/privacy.mdx',
+    'web/src/content/help/faq.mdx',
+  ])('%s matches the generated MDX FAQ', (path) => {
+    expect(
+      generatedBlock(readRepoFile(path), ANVIL_DATA_USE_GENERATED_MDX_BLOCK),
+    ).toBe(renderAnvilDataUseFaqMdx())
+  })
+
+  test('the standalone landing prototype matches canonical FAQ copy', () => {
+    const source = readRepoFile('landing-lab/src/components/sections/Faq.tsx')
+
+    expect(source).toContain(ANVIL_PUBLIC_DATA_USE_COPY.trainingQuestion)
+    expect(source).toContain(ANVIL_PUBLIC_DATA_USE_COPY.trainingAnswer)
+    expect(source).toContain(ANVIL_PUBLIC_DATA_USE_COPY.storageQuestion)
+    expect(source).toContain(ANVIL_PUBLIC_DATA_USE_COPY.storageAnswer)
+  })
+
+  test.each([
+    'anvil/web/src/lib/home-faqs.ts',
+    'anvil/web/src/components/landing/sections/Faq.tsx',
+    'anvil/web/src/components/landing/cloud/CloudLanding.tsx',
+    'anvil/web/src/vly/components/pages/WebLandingSections.tsx',
+    'anvil/web/src/lib/blog/posts/anvil-launch.ts',
+    'anvil/web/src/lib/blog/posts/free-cloud-coding-agent.ts',
+    'anvil/web/src/lib/blog/posts/anvil-web-launch.ts',
+    'anvil/web/src/lib/blog/posts/vly-becomes-anvil-web.ts',
+    'anvil/web/src/lib/blog/posts/free-antigravity-cli-coding-agent-alternative-anvil.ts',
+    'anvil/web/src/lib/blog/posts/free-alternative-to-devin.ts',
+    'anvil/web/src/lib/blog/posts/free-codex-cli-openai-coding-agent-alternative-anvil.ts',
+    'anvil/web/src/lib/blog/posts/free-claude-code-cli-coding-agent-alternative-anvil.ts',
+    'web/src/app/docs/[category]/[slug]/page.tsx',
+  ])('%s imports canonical data-use copy', (path) => {
+    expect(readRepoFile(path)).toContain('ANVIL_PUBLIC_DATA_USE_COPY')
+  })
+
+  test.each([
+    'anvil/web/src/app/privacy-policy/page.tsx',
+    'anvil/web/src/app/terms-of-service/page.tsx',
+    'anvil/web/src/components/policy-update-notice.tsx',
+  ])('%s imports canonical policy metadata', (path) => {
+    expect(readRepoFile(path)).toContain('ANVIL_POLICY_ROLLOUT')
+  })
+
+  test('the policy update banner uses the canonical rollout copy', () => {
+    const source = readRepoFile(
+      'anvil/web/src/components/policy-update-notice.tsx',
+    )
+
+    expect(source).toContain('ANVIL_POLICY_ROLLOUT.notice.title')
+    expect(source).toContain('ANVIL_POLICY_ROLLOUT.notice.summary')
+    expect(source).toContain('Review updates')
+    expect(source).toContain('ANVIL_POLICY_ROLLOUT.noticeEndsAt')
+    expect(source).toContain("'/login'")
+    expect(source).toContain("pathname.startsWith('/web/invite/')")
+    expect(source).not.toContain("'upcoming'")
+  })
+
+  test.each([
+    'anvil/web/src/components/login/login-card.tsx',
+    'anvil/web/src/app/get-started/get-started-onboarding.tsx',
+    'anvil/web/src/components/creators/auth/creators-auth-page.tsx',
+    'anvil/web/src/app/web/affiliate/page.tsx',
+    'anvil/web/src/app/web/invite/[token]/page.tsx',
+  ])('%s shows the shared policy agreement notice', (path) => {
+    expect(readRepoFile(path)).toContain('PolicyAgreementNotice')
+  })
+
+  test('the shared login notice uses the requested acceptance language', () => {
+    const source = readRepoFile(
+      'anvil/web/src/components/policy-agreement-notice.tsx',
+    )
+
+    expect(source).toContain('By continuing, you agree to the')
+    expect(source).toContain('Terms')
+  })
+
+  test.each([
+    'anvil/web/src/app/privacy-policy/page.tsx',
+    'anvil/web/src/app/terms-of-service/page.tsx',
+  ])('%s is updated for the July 23 rollout', (path) => {
+    expect(readRepoFile(path)).toContain('ANVIL_POLICY_ROLLOUT.lastUpdated')
+  })
+
+  test('the Privacy Policy keeps explicit training and advertising boundaries', () => {
+    const source = readRepoFile('anvil/web/src/app/privacy-policy/page.tsx')
+
+    expect(ANVIL_AI_TRAINING_NOTICE).toContain('AI training')
+    expect(source).toContain('ANVIL_AI_TRAINING_NOTICE')
+    expect(source).toContain('legally recognized opt-out preference')
+    expect(source).toContain('service providers acting on our')
+    expect(source).not.toContain('submitted on or after')
+    expect(source).not.toContain('submitted before')
+    expect(ANVIL_PUBLIC_DATA_USE_COPY.storageAnswer).not.toContain(
+      'Starting ',
+    )
+    expect(source).toMatch(
+      /may not\s+use that information for their own independent purposes/,
+    )
+    expect(source).toContain('fine-tuning')
+    expect(source).toContain('legitimate business')
+    expect(source).not.toContain('CALIFORNIA_DISCLOSURES')
+    expect(source).not.toContain('detect and remove credentials')
+    expect(source).not.toContain('designed not to include raw prompts')
+    expect(source).not.toContain(
+      'Raw prompts and messages used for advertising',
+    )
+    expect(source).not.toContain('longer-term advertising profile')
+
+    for (const vendor of [
+      'Fireworks AI',
+      'OpenAI',
+      'OpenRouter',
+      'Anthropic',
+      'Convex',
+      'PostHog',
+      'Axiom',
+      'Reddit',
+    ]) {
+      expect(source).not.toContain(vendor)
+    }
+  })
+
+  test('the Terms retain the requested consumer safeguards', () => {
+    const source = readRepoFile(
+      'anvil/web/src/app/terms-of-service/page.tsx',
+    )
+
+    expect(source).toContain('AI Output and Actions')
+    expect(source).toContain('third-party claims')
+    expect(source).toContain('GREATER OF $100')
+    expect(source).toContain('San Francisco County')
+    expect(source).toContain('advance notice when required by law')
+    expect(source).toMatch(
+      /provide,\s+maintain,\s+develop,\s+evaluate,\s+improve/,
+    )
+    expect(source).toMatch(/Anvil, Inc\.\s+has/)
+    expect(source).not.toContain('damage or falsify Company rating')
+  })
+
+  test('retired privacy claims do not reappear on public surfaces', () => {
+    const publicPaths = [
+      'README.md',
+      'anvil/cli/release/README.md',
+      'anvil/web/src/lib/home-faqs.ts',
+      'anvil/web/src/components/landing',
+      'anvil/web/src/vly/components/pages',
+      'anvil/web/src/lib/blog/posts',
+      'anvil/web/scripts/generate-cli-blog-posts.ts',
+      'landing-lab/src',
+      'web/src/content',
+      'web/src/app/docs/[category]/[slug]/page.tsx',
+    ].flatMap(listPublicTextFiles)
+
+    const retiredClaims = [
+      /we (?:do not|don't) store your codebase/i,
+      /only collect minimal logs/i,
+      /we (?:do not|don't) share your (?:data|repo|code) with third parties that would train/i,
+      /we do not train on your data/i,
+      /no training on your code/i,
+      /your code is never used for training/i,
+      /logs[^.]*not shared with third parties/i,
+      /only use information from your current session context/i,
+      /privacy mode[^.]*won't store/i,
+      /(?:code|codebase|repo(?:sitory)?) (?:never|doesn['’]t|does not) leave (?:your|the) (?:machine|laptop)/i,
+      /your code stays local/i,
+      /no upload required/i,
+      /stored locally \(and nowhere else\)/i,
+      /no telemetry attached to your code/i,
+      /tracking pixel anywhere near your repo/i,
+      /the server is stateless/i,
+      /local-first[^.]*privacy/i,
+    ]
+
+    for (const path of publicPaths) {
+      const source = readRepoFile(path)
+      for (const retiredClaim of retiredClaims) {
+        if (retiredClaim.test(source)) {
+          throw new Error(`${path} contains retired claim ${retiredClaim}`)
+        }
+      }
+    }
+  })
+})

package/vendor/@anvil/common/src/__tests__/anvil-referral-tiers.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'bun:test'
+
+import {
+  MIN_GITHUB_ACCOUNT_AGE_MONTHS,
+  isGithubAccountOldEnoughForReferral,
+} from '../constants/anvil-referral-tiers'
+
+const NOW = Date.parse('2026-06-12T00:00:00Z')
+
+function monthsAgo(months: number): number {
+  const date = new Date(NOW)
+  date.setUTCMonth(date.getUTCMonth() - months)
+  return date.getTime()
+}
+
+// The tier ladder (tiered daily message limits + watermark removal) was
+// removed 2026-07-30: the limits were enforced nowhere and the deploy
+// watermark is globally disabled, so the referral reward consolidated to
+// daily GLM 5.2 sessions (full tier, uncapped) and the limited-tier daily
+// session bonus. What remains here is the qualification machinery.
+
+describe('isGithubAccountOldEnoughForReferral', () => {
+  it('accepts accounts at or beyond the age threshold', () => {
+    expect(
+      isGithubAccountOldEnoughForReferral(
+        monthsAgo(MIN_GITHUB_ACCOUNT_AGE_MONTHS),
+        NOW,
+      ),
+    ).toBe(true)
+    expect(isGithubAccountOldEnoughForReferral(monthsAgo(36), NOW)).toBe(true)
+  })
+
+  it('rejects accounts younger than the threshold', () => {
+    expect(
+      isGithubAccountOldEnoughForReferral(
+        monthsAgo(MIN_GITHUB_ACCOUNT_AGE_MONTHS - 1),
+        NOW,
+      ),
+    ).toBe(false)
+    expect(isGithubAccountOldEnoughForReferral(NOW, NOW)).toBe(false)
+  })
+
+  it('rejects missing or invalid creation dates', () => {
+    expect(isGithubAccountOldEnoughForReferral(null, NOW)).toBe(false)
+    expect(isGithubAccountOldEnoughForReferral(undefined, NOW)).toBe(false)
+    expect(isGithubAccountOldEnoughForReferral(Number.NaN, NOW)).toBe(false)
+  })
+})

package/vendor/@anvil/common/src/__tests__/anvil-spend-ceilings.test.ts

@@ -0,0 +1,282 @@
+import { describe, expect, it } from 'bun:test'
+
+import {
+  ANVIL_BUDGET_NOTICE,
+  ANVIL_CAPACITY_NOTICE,
+  ANVIL_ELEVATED_DAILY_SPEND_USD,
+  ANVIL_REGION_DAILY_SPEND_USD,
+  ANVIL_RESTRICTED_DAILY_SPEND_USD,
+  ANVIL_RESTRICTED_NOTICE,
+  anvilSpendNoticeFor,
+  resolveAnvilHardSpendCeiling,
+  resolveAnvilSpendCeiling,
+} from '../constants/anvil-spend-ceilings'
+
+describe('region ceilings', () => {
+  it('replaces the old flat $50 with a per-region figure', () => {
+    expect(resolveAnvilSpendCeiling({ accessTier: 'full' }).usd).toBe(15)
+    expect(resolveAnvilSpendCeiling({ accessTier: 'limited' }).usd).toBe(5)
+  })
+
+  it('keeps the limited region below the full one', () => {
+    // A limited-region account cannot reach a premium model, so the same
+    // dollars buy far more requests there. An identical cap would not be an
+    // identical constraint.
+    expect(ANVIL_REGION_DAILY_SPEND_USD.limited).toBeLessThan(
+      ANVIL_REGION_DAILY_SPEND_USD.full,
+    )
+  })
+})
+
+describe('restricted cohorts', () => {
+  it('holds a restricted country at the restricted ceiling', () => {
+    const result = resolveAnvilSpendCeiling({
+      accessTier: 'full',
+      countryCode: 'CN',
+    })
+    expect(result.usd).toBe(ANVIL_RESTRICTED_DAILY_SPEND_USD)
+    expect(result.reason).toBe('restricted_country')
+  })
+
+  it('matches the country case-insensitively', () => {
+    expect(
+      resolveAnvilSpendCeiling({ accessTier: 'full', countryCode: 'cn' })
+        .reason,
+    ).toBe('restricted_country')
+  })
+
+  it('leaves other countries on the region ceiling', () => {
+    const result = resolveAnvilSpendCeiling({
+      accessTier: 'full',
+      countryCode: 'US',
+    })
+    expect(result.usd).toBe(15)
+    expect(result.reason).toBe('region')
+  })
+
+  it('applies to an anonymizing egress', () => {
+    const result = resolveAnvilSpendCeiling({
+      accessTier: 'limited',
+      privacyEgress: true,
+    })
+    expect(result.usd).toBe(ANVIL_RESTRICTED_DAILY_SPEND_USD)
+    expect(result.reason).toBe('privacy_egress')
+  })
+
+  it('applies to a flagged email domain and to a third-party client', () => {
+    expect(
+      resolveAnvilSpendCeiling({
+        accessTier: 'full',
+        flaggedEmailDomain: true,
+      }).reason,
+    ).toBe('flagged_email_domain')
+    expect(
+      resolveAnvilSpendCeiling({
+        accessTier: 'full',
+        thirdPartyClient: true,
+      }).reason,
+    ).toBe('third_party_client')
+  })
+
+  it('is half a dollar, and below every region ceiling', () => {
+    expect(ANVIL_RESTRICTED_DAILY_SPEND_USD).toBe(0.5)
+    expect(ANVIL_RESTRICTED_DAILY_SPEND_USD).toBeLessThan(
+      ANVIL_REGION_DAILY_SPEND_USD.limited,
+    )
+  })
+
+  it('never blocks outright — the restricted ceiling is above zero', () => {
+    // A zero ceiling is a block, and a block tells the operator which signal
+    // caught them, at which point they rotate it. Keeping them served at a
+    // dollar keeps them visible to the sweeps that produce ban-grade evidence.
+    expect(ANVIL_RESTRICTED_DAILY_SPEND_USD).toBeGreaterThan(0)
+  })
+})
+
+describe('composition', () => {
+  it('takes the minimum, so order of rules cannot change the outcome', () => {
+    const result = resolveAnvilSpendCeiling({
+      accessTier: 'limited',
+      countryCode: 'SG',
+      privacyEgress: true,
+      flaggedEmailDomain: true,
+      thirdPartyClient: true,
+      trustLevelCeilingUsd: 3,
+    })
+    expect(result.usd).toBe(ANVIL_RESTRICTED_DAILY_SPEND_USD)
+    expect(result.applied.length).toBe(6)
+  })
+
+  it('can only lower, never raise', () => {
+    // The property that makes this safe to ship while the trust rollout is
+    // still observing: nothing here can hand anyone a bigger budget.
+    const base = resolveAnvilSpendCeiling({ accessTier: 'full' }).usd
+    for (const trustLevelCeilingUsd of [1, 8, 50, 90]) {
+      expect(
+        resolveAnvilSpendCeiling({
+          accessTier: 'full',
+          trustLevelCeilingUsd,
+        }).usd,
+      ).toBeLessThanOrEqual(base)
+    }
+  })
+
+  it('ignores a trust ceiling that is not being enforced', () => {
+    expect(
+      resolveAnvilSpendCeiling({
+        accessTier: 'full',
+        trustLevelCeilingUsd: null,
+      }).usd,
+    ).toBe(15)
+  })
+
+  it('resolves a tie to the least accusatory reason', () => {
+    // When the region and a restricted cohort agree on the number, "region" is
+    // equally true and does not imply we think something about the account.
+    const result = resolveAnvilSpendCeiling({
+      accessTier: 'limited',
+      flaggedEmailDomain: true,
+      overrides: { regionUsd: { limited: 1 }, restrictedUsd: 1 },
+    })
+    expect(result.usd).toBe(1)
+    expect(result.reason).toBe('region')
+  })
+})
+
+describe('overrides', () => {
+  it('lets every ceiling be raised without a deploy', () => {
+    const result = resolveAnvilSpendCeiling({
+      accessTier: 'limited',
+      countryCode: 'CN',
+      overrides: {
+        regionUsd: { limited: 40 },
+        restrictedUsd: 25,
+        restrictedCountries: [],
+        elevatedCountries: [],
+      },
+    })
+    expect(result.usd).toBe(40)
+    expect(result.reason).toBe('region')
+  })
+
+  it('disables the country rule on an empty list', () => {
+    expect(
+      resolveAnvilSpendCeiling({
+        accessTier: 'full',
+        countryCode: 'CN',
+        overrides: { restrictedCountries: [] },
+      }).reason,
+    ).toBe('region')
+  })
+})
+
+describe('elevated countries', () => {
+  it('holds an elevated country between the region and restricted ceilings', () => {
+    const result = resolveAnvilSpendCeiling({
+      accessTier: 'full',
+      countryCode: 'SG',
+    })
+    expect(result.usd).toBe(ANVIL_ELEVATED_DAILY_SPEND_USD)
+    expect(result.reason).toBe('elevated_country')
+    expect(result.usd).toBeGreaterThan(ANVIL_RESTRICTED_DAILY_SPEND_USD)
+    expect(result.usd).toBeLessThan(ANVIL_REGION_DAILY_SPEND_USD.full)
+  })
+
+  it('does not cut a LIVE session — no hard cap, like the region ceilings', () => {
+    // The whole point of $5 rather than $0.50 is that it is a budget, not a
+    // suspicion. Applying the 2x hard cut here would interrupt an ordinary
+    // Singaporean developer mid-thought, which is the error this tier exists
+    // to stop making.
+    const ceiling = resolveAnvilSpendCeiling({
+      accessTier: 'full',
+      countryCode: 'SG',
+    })
+    expect(resolveAnvilHardSpendCeiling(ceiling)).toBeNull()
+  })
+
+  it('still loses to a restricted cohort the account is also in', () => {
+    // Composition by minimum has to keep working: an SG account on a VPN is
+    // priced by the VPN, not by the softer geography.
+    const result = resolveAnvilSpendCeiling({
+      accessTier: 'full',
+      countryCode: 'SG',
+      privacyEgress: true,
+    })
+    expect(result.usd).toBe(ANVIL_RESTRICTED_DAILY_SPEND_USD)
+    expect(result.reason).toBe('privacy_egress')
+  })
+
+  it('resolves a tie with the region ceiling to `region`', () => {
+    // A limited-tier account in an elevated country sees $5 from both rules.
+    // The tie must land on the reason that implies nothing about the account.
+    const result = resolveAnvilSpendCeiling({
+      accessTier: 'limited',
+      countryCode: 'SG',
+    })
+    expect(result.usd).toBe(5)
+    expect(result.reason).toBe('region')
+  })
+})
+
+describe('unverified egress', () => {
+  it('prices an unresolved escalation at the restricted ceiling', () => {
+    // A provider outage must not be the cheapest way to buy a bigger budget.
+    const result = resolveAnvilSpendCeiling({
+      accessTier: 'full',
+      unverifiedEgress: true,
+    })
+    expect(result.usd).toBe(ANVIL_RESTRICTED_DAILY_SPEND_USD)
+    expect(result.reason).toBe('unverified_egress')
+  })
+
+  it('applies the hard multiplier, like the other restricted cohorts', () => {
+    const ceiling = resolveAnvilSpendCeiling({
+      accessTier: 'full',
+      unverifiedEgress: true,
+    })
+    expect(resolveAnvilHardSpendCeiling(ceiling, 2)).toBe(1)
+  })
+})
+
+describe('refusal copy', () => {
+  it('gives a plain allowance no abuse framing', () => {
+    for (const reason of ['region', 'elevated_country', 'trust_level']) {
+      const copy = anvilSpendNoticeFor(reason)
+      expect(copy).toBe(ANVIL_BUDGET_NOTICE)
+      expect(copy).not.toContain('abuse')
+      // The words that turn a cap into a verdict on the person, and the ones
+      // support tickets come back quoting.
+      expect(copy.toLowerCase()).not.toContain('limited')
+      expect(copy.toLowerCase()).not.toContain('restricted')
+      expect(copy.toLowerCase()).not.toContain('blocked')
+    }
+  })
+
+  it('keeps naming the cause SET for the restricted cohorts', () => {
+    for (const reason of [
+      'privacy_egress',
+      'restricted_country',
+      'flagged_email_domain',
+      'unverified_egress',
+    ]) {
+      expect(anvilSpendNoticeFor(reason)).toBe(ANVIL_RESTRICTED_NOTICE)
+    }
+  })
+
+  it('keeps third_party_client cause-blind so the detector stays unnamed', () => {
+    expect(anvilSpendNoticeFor('third_party_client')).toBe(
+      ANVIL_CAPACITY_NOTICE,
+    )
+  })
+
+  it('publishes no dollar figure in any refusal', () => {
+    // A published cap is a published pacing instruction.
+    for (const copy of [
+      ANVIL_BUDGET_NOTICE,
+      ANVIL_CAPACITY_NOTICE,
+      ANVIL_RESTRICTED_NOTICE,
+    ]) {
+      expect(copy).not.toMatch(/\$|\d/)
+    }
+  })
+})