@alumbwe/anvil 1.0.42 → 1.0.49

package/vendor/@anvil/common/src/__tests__/anvil-public-data-use-copy.test.ts

@@ -1,258 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-import { readFileSync, readdirSync, statSync } from 'node:fs'
-import { resolve } from 'node:path'
-
-import {
-  ANVIL_AI_TRAINING_NOTICE,
-  ANVIL_DATA_USE_GENERATED_MARKDOWN_BLOCK,
-  ANVIL_DATA_USE_GENERATED_MDX_BLOCK,
-  ANVIL_POLICY_ROLLOUT,
-  ANVIL_PUBLIC_DATA_USE_COPY,
-  renderAnvilDataUseFaqMarkdown,
-  renderAnvilDataUseFaqMdx,
-} from '../constants/anvil-data-use'
-
-const REPO_ROOT = resolve(import.meta.dir, '../../..')
-
-function readRepoFile(path: string): string {
-  return readFileSync(resolve(REPO_ROOT, path), 'utf8')
-}
-
-function listPublicTextFiles(path: string): string[] {
-  const absolutePath = resolve(REPO_ROOT, path)
-  if (!statSync(absolutePath).isDirectory()) return [path]
-
-  return readdirSync(absolutePath).flatMap((entry) => {
-    const child = `${path}/${entry}`
-    const childPath = resolve(REPO_ROOT, child)
-
-    if (statSync(childPath).isDirectory()) return listPublicTextFiles(child)
-    return /\.(?:md|mdx|ts|tsx)$/.test(entry) ? [child] : []
-  })
-}
-
-function generatedBlock(
-  source: string,
-  markers: { start: string; end: string },
-): string {
-  const start = source.indexOf(markers.start)
-  const end = source.indexOf(markers.end, start)
-
-  expect(start).toBeGreaterThanOrEqual(0)
-  expect(end).toBeGreaterThan(start)
-
-  return source.slice(start, end + markers.end.length)
-}
-
-describe('public Anvil data-use copy', () => {
-  test('the July 23 policy rollout metadata and notice stay aligned', () => {
-    expect(ANVIL_POLICY_ROLLOUT).toEqual({
-      version: '2026-07-23',
-      effectiveDate: 'July 23, 2026',
-      lastUpdated: '07/23/2026',
-      noticeEndsAt: '2026-08-23T00:00:00-07:00',
-      notice: {
-        title:
-          'We’ve updated our Terms and Privacy Policy, effective July 23, 2026.',
-        summary:
-          'Prompts may be used to personalize ads, AI training applies only to labeled models or features, and usage restrictions were updated.',
-      },
-    })
-  })
-
-  test.each(['README.md', 'anvil/cli/release/README.md'])(
-    '%s matches the generated Markdown FAQ',
-    (path) => {
-      expect(
-        generatedBlock(
-          readRepoFile(path),
-          ANVIL_DATA_USE_GENERATED_MARKDOWN_BLOCK,
-        ),
-      ).toBe(renderAnvilDataUseFaqMarkdown())
-    },
-  )
-
-  test.each([
-    'web/src/content/advanced/privacy.mdx',
-    'web/src/content/help/faq.mdx',
-  ])('%s matches the generated MDX FAQ', (path) => {
-    expect(
-      generatedBlock(readRepoFile(path), ANVIL_DATA_USE_GENERATED_MDX_BLOCK),
-    ).toBe(renderAnvilDataUseFaqMdx())
-  })
-
-  test('the standalone landing prototype matches canonical FAQ copy', () => {
-    const source = readRepoFile('landing-lab/src/components/sections/Faq.tsx')
-
-    expect(source).toContain(ANVIL_PUBLIC_DATA_USE_COPY.trainingQuestion)
-    expect(source).toContain(ANVIL_PUBLIC_DATA_USE_COPY.trainingAnswer)
-    expect(source).toContain(ANVIL_PUBLIC_DATA_USE_COPY.storageQuestion)
-    expect(source).toContain(ANVIL_PUBLIC_DATA_USE_COPY.storageAnswer)
-  })
-
-  test.each([
-    'anvil/web/src/lib/home-faqs.ts',
-    'anvil/web/src/components/landing/sections/Faq.tsx',
-    'anvil/web/src/components/landing/cloud/CloudLanding.tsx',
-    'anvil/web/src/vly/components/pages/WebLandingSections.tsx',
-    'anvil/web/src/lib/blog/posts/anvil-launch.ts',
-    'anvil/web/src/lib/blog/posts/free-cloud-coding-agent.ts',
-    'anvil/web/src/lib/blog/posts/anvil-web-launch.ts',
-    'anvil/web/src/lib/blog/posts/vly-becomes-anvil-web.ts',
-    'anvil/web/src/lib/blog/posts/free-antigravity-cli-coding-agent-alternative-anvil.ts',
-    'anvil/web/src/lib/blog/posts/free-alternative-to-devin.ts',
-    'anvil/web/src/lib/blog/posts/free-codex-cli-openai-coding-agent-alternative-anvil.ts',
-    'anvil/web/src/lib/blog/posts/free-claude-code-cli-coding-agent-alternative-anvil.ts',
-    'web/src/app/docs/[category]/[slug]/page.tsx',
-  ])('%s imports canonical data-use copy', (path) => {
-    expect(readRepoFile(path)).toContain('ANVIL_PUBLIC_DATA_USE_COPY')
-  })
-
-  test.each([
-    'anvil/web/src/app/privacy-policy/page.tsx',
-    'anvil/web/src/app/terms-of-service/page.tsx',
-    'anvil/web/src/components/policy-update-notice.tsx',
-  ])('%s imports canonical policy metadata', (path) => {
-    expect(readRepoFile(path)).toContain('ANVIL_POLICY_ROLLOUT')
-  })
-
-  test('the policy update banner uses the canonical rollout copy', () => {
-    const source = readRepoFile(
-      'anvil/web/src/components/policy-update-notice.tsx',
-    )
-
-    expect(source).toContain('ANVIL_POLICY_ROLLOUT.notice.title')
-    expect(source).toContain('ANVIL_POLICY_ROLLOUT.notice.summary')
-    expect(source).toContain('Review updates')
-    expect(source).toContain('ANVIL_POLICY_ROLLOUT.noticeEndsAt')
-    expect(source).toContain("'/login'")
-    expect(source).toContain("pathname.startsWith('/web/invite/')")
-    expect(source).not.toContain("'upcoming'")
-  })
-
-  test.each([
-    'anvil/web/src/components/login/login-card.tsx',
-    'anvil/web/src/app/get-started/get-started-onboarding.tsx',
-    'anvil/web/src/components/creators/auth/creators-auth-page.tsx',
-    'anvil/web/src/app/web/affiliate/page.tsx',
-    'anvil/web/src/app/web/invite/[token]/page.tsx',
-  ])('%s shows the shared policy agreement notice', (path) => {
-    expect(readRepoFile(path)).toContain('PolicyAgreementNotice')
-  })
-
-  test('the shared login notice uses the requested acceptance language', () => {
-    const source = readRepoFile(
-      'anvil/web/src/components/policy-agreement-notice.tsx',
-    )
-
-    expect(source).toContain('By continuing, you agree to the')
-    expect(source).toContain('Terms')
-  })
-
-  test.each([
-    'anvil/web/src/app/privacy-policy/page.tsx',
-    'anvil/web/src/app/terms-of-service/page.tsx',
-  ])('%s is updated for the July 23 rollout', (path) => {
-    expect(readRepoFile(path)).toContain('ANVIL_POLICY_ROLLOUT.lastUpdated')
-  })
-
-  test('the Privacy Policy keeps explicit training and advertising boundaries', () => {
-    const source = readRepoFile('anvil/web/src/app/privacy-policy/page.tsx')
-
-    expect(ANVIL_AI_TRAINING_NOTICE).toContain('AI training')
-    expect(source).toContain('ANVIL_AI_TRAINING_NOTICE')
-    expect(source).toContain('legally recognized opt-out preference')
-    expect(source).toContain('service providers acting on our')
-    expect(source).not.toContain('submitted on or after')
-    expect(source).not.toContain('submitted before')
-    expect(ANVIL_PUBLIC_DATA_USE_COPY.storageAnswer).not.toContain(
-      'Starting ',
-    )
-    expect(source).toMatch(
-      /may not\s+use that information for their own independent purposes/,
-    )
-    expect(source).toContain('fine-tuning')
-    expect(source).toContain('legitimate business')
-    expect(source).not.toContain('CALIFORNIA_DISCLOSURES')
-    expect(source).not.toContain('detect and remove credentials')
-    expect(source).not.toContain('designed not to include raw prompts')
-    expect(source).not.toContain(
-      'Raw prompts and messages used for advertising',
-    )
-    expect(source).not.toContain('longer-term advertising profile')
-
-    for (const vendor of [
-      'Fireworks AI',
-      'OpenAI',
-      'OpenRouter',
-      'Anthropic',
-      'Convex',
-      'PostHog',
-      'Axiom',
-      'Reddit',
-    ]) {
-      expect(source).not.toContain(vendor)
-    }
-  })
-
-  test('the Terms retain the requested consumer safeguards', () => {
-    const source = readRepoFile(
-      'anvil/web/src/app/terms-of-service/page.tsx',
-    )
-
-    expect(source).toContain('AI Output and Actions')
-    expect(source).toContain('third-party claims')
-    expect(source).toContain('GREATER OF $100')
-    expect(source).toContain('San Francisco County')
-    expect(source).toContain('advance notice when required by law')
-    expect(source).toMatch(
-      /provide,\s+maintain,\s+develop,\s+evaluate,\s+improve/,
-    )
-    expect(source).toMatch(/Anvil, Inc\.\s+has/)
-    expect(source).not.toContain('damage or falsify Company rating')
-  })
-
-  test('retired privacy claims do not reappear on public surfaces', () => {
-    const publicPaths = [
-      'README.md',
-      'anvil/cli/release/README.md',
-      'anvil/web/src/lib/home-faqs.ts',
-      'anvil/web/src/components/landing',
-      'anvil/web/src/vly/components/pages',
-      'anvil/web/src/lib/blog/posts',
-      'anvil/web/scripts/generate-cli-blog-posts.ts',
-      'landing-lab/src',
-      'web/src/content',
-      'web/src/app/docs/[category]/[slug]/page.tsx',
-    ].flatMap(listPublicTextFiles)
-
-    const retiredClaims = [
-      /we (?:do not|don't) store your codebase/i,
-      /only collect minimal logs/i,
-      /we (?:do not|don't) share your (?:data|repo|code) with third parties that would train/i,
-      /we do not train on your data/i,
-      /no training on your code/i,
-      /your code is never used for training/i,
-      /logs[^.]*not shared with third parties/i,
-      /only use information from your current session context/i,
-      /privacy mode[^.]*won't store/i,
-      /(?:code|codebase|repo(?:sitory)?) (?:never|doesn['’]t|does not) leave (?:your|the) (?:machine|laptop)/i,
-      /your code stays local/i,
-      /no upload required/i,
-      /stored locally \(and nowhere else\)/i,
-      /no telemetry attached to your code/i,
-      /tracking pixel anywhere near your repo/i,
-      /the server is stateless/i,
-      /local-first[^.]*privacy/i,
-    ]
-
-    for (const path of publicPaths) {
-      const source = readRepoFile(path)
-      for (const retiredClaim of retiredClaims) {
-        if (retiredClaim.test(source)) {
-          throw new Error(`${path} contains retired claim ${retiredClaim}`)
-        }
-      }
-    }
-  })
-})

package/vendor/@anvil/common/src/__tests__/anvil-referral-tiers.test.ts

@@ -1,48 +0,0 @@
-import { describe, expect, it } from 'bun:test'
-
-import {
-  MIN_GITHUB_ACCOUNT_AGE_MONTHS,
-  isGithubAccountOldEnoughForReferral,
-} from '../constants/anvil-referral-tiers'
-
-const NOW = Date.parse('2026-06-12T00:00:00Z')
-
-function monthsAgo(months: number): number {
-  const date = new Date(NOW)
-  date.setUTCMonth(date.getUTCMonth() - months)
-  return date.getTime()
-}
-
-// The tier ladder (tiered daily message limits + watermark removal) was
-// removed 2026-07-30: the limits were enforced nowhere and the deploy
-// watermark is globally disabled, so the referral reward consolidated to
-// daily GLM 5.2 sessions (full tier, uncapped) and the limited-tier daily
-// session bonus. What remains here is the qualification machinery.
-
-describe('isGithubAccountOldEnoughForReferral', () => {
-  it('accepts accounts at or beyond the age threshold', () => {
-    expect(
-      isGithubAccountOldEnoughForReferral(
-        monthsAgo(MIN_GITHUB_ACCOUNT_AGE_MONTHS),
-        NOW,
-      ),
-    ).toBe(true)
-    expect(isGithubAccountOldEnoughForReferral(monthsAgo(36), NOW)).toBe(true)
-  })
-
-  it('rejects accounts younger than the threshold', () => {
-    expect(
-      isGithubAccountOldEnoughForReferral(
-        monthsAgo(MIN_GITHUB_ACCOUNT_AGE_MONTHS - 1),
-        NOW,
-      ),
-    ).toBe(false)
-    expect(isGithubAccountOldEnoughForReferral(NOW, NOW)).toBe(false)
-  })
-
-  it('rejects missing or invalid creation dates', () => {
-    expect(isGithubAccountOldEnoughForReferral(null, NOW)).toBe(false)
-    expect(isGithubAccountOldEnoughForReferral(undefined, NOW)).toBe(false)
-    expect(isGithubAccountOldEnoughForReferral(Number.NaN, NOW)).toBe(false)
-  })
-})

package/vendor/@anvil/common/src/__tests__/anvil-spend-ceilings.test.ts

@@ -1,282 +0,0 @@
-import { describe, expect, it } from 'bun:test'
-
-import {
-  ANVIL_BUDGET_NOTICE,
-  ANVIL_CAPACITY_NOTICE,
-  ANVIL_ELEVATED_DAILY_SPEND_USD,
-  ANVIL_REGION_DAILY_SPEND_USD,
-  ANVIL_RESTRICTED_DAILY_SPEND_USD,
-  ANVIL_RESTRICTED_NOTICE,
-  anvilSpendNoticeFor,
-  resolveAnvilHardSpendCeiling,
-  resolveAnvilSpendCeiling,
-} from '../constants/anvil-spend-ceilings'
-
-describe('region ceilings', () => {
-  it('replaces the old flat $50 with a per-region figure', () => {
-    expect(resolveAnvilSpendCeiling({ accessTier: 'full' }).usd).toBe(15)
-    expect(resolveAnvilSpendCeiling({ accessTier: 'limited' }).usd).toBe(5)
-  })
-
-  it('keeps the limited region below the full one', () => {
-    // A limited-region account cannot reach a premium model, so the same
-    // dollars buy far more requests there. An identical cap would not be an
-    // identical constraint.
-    expect(ANVIL_REGION_DAILY_SPEND_USD.limited).toBeLessThan(
-      ANVIL_REGION_DAILY_SPEND_USD.full,
-    )
-  })
-})
-
-describe('restricted cohorts', () => {
-  it('holds a restricted country at the restricted ceiling', () => {
-    const result = resolveAnvilSpendCeiling({
-      accessTier: 'full',
-      countryCode: 'CN',
-    })
-    expect(result.usd).toBe(ANVIL_RESTRICTED_DAILY_SPEND_USD)
-    expect(result.reason).toBe('restricted_country')
-  })
-
-  it('matches the country case-insensitively', () => {
-    expect(
-      resolveAnvilSpendCeiling({ accessTier: 'full', countryCode: 'cn' })
-        .reason,
-    ).toBe('restricted_country')
-  })
-
-  it('leaves other countries on the region ceiling', () => {
-    const result = resolveAnvilSpendCeiling({
-      accessTier: 'full',
-      countryCode: 'US',
-    })
-    expect(result.usd).toBe(15)
-    expect(result.reason).toBe('region')
-  })
-
-  it('applies to an anonymizing egress', () => {
-    const result = resolveAnvilSpendCeiling({
-      accessTier: 'limited',
-      privacyEgress: true,
-    })
-    expect(result.usd).toBe(ANVIL_RESTRICTED_DAILY_SPEND_USD)
-    expect(result.reason).toBe('privacy_egress')
-  })
-
-  it('applies to a flagged email domain and to a third-party client', () => {
-    expect(
-      resolveAnvilSpendCeiling({
-        accessTier: 'full',
-        flaggedEmailDomain: true,
-      }).reason,
-    ).toBe('flagged_email_domain')
-    expect(
-      resolveAnvilSpendCeiling({
-        accessTier: 'full',
-        thirdPartyClient: true,
-      }).reason,
-    ).toBe('third_party_client')
-  })
-
-  it('is half a dollar, and below every region ceiling', () => {
-    expect(ANVIL_RESTRICTED_DAILY_SPEND_USD).toBe(0.5)
-    expect(ANVIL_RESTRICTED_DAILY_SPEND_USD).toBeLessThan(
-      ANVIL_REGION_DAILY_SPEND_USD.limited,
-    )
-  })
-
-  it('never blocks outright — the restricted ceiling is above zero', () => {
-    // A zero ceiling is a block, and a block tells the operator which signal
-    // caught them, at which point they rotate it. Keeping them served at a
-    // dollar keeps them visible to the sweeps that produce ban-grade evidence.
-    expect(ANVIL_RESTRICTED_DAILY_SPEND_USD).toBeGreaterThan(0)
-  })
-})
-
-describe('composition', () => {
-  it('takes the minimum, so order of rules cannot change the outcome', () => {
-    const result = resolveAnvilSpendCeiling({
-      accessTier: 'limited',
-      countryCode: 'SG',
-      privacyEgress: true,
-      flaggedEmailDomain: true,
-      thirdPartyClient: true,
-      trustLevelCeilingUsd: 3,
-    })
-    expect(result.usd).toBe(ANVIL_RESTRICTED_DAILY_SPEND_USD)
-    expect(result.applied.length).toBe(6)
-  })
-
-  it('can only lower, never raise', () => {
-    // The property that makes this safe to ship while the trust rollout is
-    // still observing: nothing here can hand anyone a bigger budget.
-    const base = resolveAnvilSpendCeiling({ accessTier: 'full' }).usd
-    for (const trustLevelCeilingUsd of [1, 8, 50, 90]) {
-      expect(
-        resolveAnvilSpendCeiling({
-          accessTier: 'full',
-          trustLevelCeilingUsd,
-        }).usd,
-      ).toBeLessThanOrEqual(base)
-    }
-  })
-
-  it('ignores a trust ceiling that is not being enforced', () => {
-    expect(
-      resolveAnvilSpendCeiling({
-        accessTier: 'full',
-        trustLevelCeilingUsd: null,
-      }).usd,
-    ).toBe(15)
-  })
-
-  it('resolves a tie to the least accusatory reason', () => {
-    // When the region and a restricted cohort agree on the number, "region" is
-    // equally true and does not imply we think something about the account.
-    const result = resolveAnvilSpendCeiling({
-      accessTier: 'limited',
-      flaggedEmailDomain: true,
-      overrides: { regionUsd: { limited: 1 }, restrictedUsd: 1 },
-    })
-    expect(result.usd).toBe(1)
-    expect(result.reason).toBe('region')
-  })
-})
-
-describe('overrides', () => {
-  it('lets every ceiling be raised without a deploy', () => {
-    const result = resolveAnvilSpendCeiling({
-      accessTier: 'limited',
-      countryCode: 'CN',
-      overrides: {
-        regionUsd: { limited: 40 },
-        restrictedUsd: 25,
-        restrictedCountries: [],
-        elevatedCountries: [],
-      },
-    })
-    expect(result.usd).toBe(40)
-    expect(result.reason).toBe('region')
-  })
-
-  it('disables the country rule on an empty list', () => {
-    expect(
-      resolveAnvilSpendCeiling({
-        accessTier: 'full',
-        countryCode: 'CN',
-        overrides: { restrictedCountries: [] },
-      }).reason,
-    ).toBe('region')
-  })
-})
-
-describe('elevated countries', () => {
-  it('holds an elevated country between the region and restricted ceilings', () => {
-    const result = resolveAnvilSpendCeiling({
-      accessTier: 'full',
-      countryCode: 'SG',
-    })
-    expect(result.usd).toBe(ANVIL_ELEVATED_DAILY_SPEND_USD)
-    expect(result.reason).toBe('elevated_country')
-    expect(result.usd).toBeGreaterThan(ANVIL_RESTRICTED_DAILY_SPEND_USD)
-    expect(result.usd).toBeLessThan(ANVIL_REGION_DAILY_SPEND_USD.full)
-  })
-
-  it('does not cut a LIVE session — no hard cap, like the region ceilings', () => {
-    // The whole point of $5 rather than $0.50 is that it is a budget, not a
-    // suspicion. Applying the 2x hard cut here would interrupt an ordinary
-    // Singaporean developer mid-thought, which is the error this tier exists
-    // to stop making.
-    const ceiling = resolveAnvilSpendCeiling({
-      accessTier: 'full',
-      countryCode: 'SG',
-    })
-    expect(resolveAnvilHardSpendCeiling(ceiling)).toBeNull()
-  })
-
-  it('still loses to a restricted cohort the account is also in', () => {
-    // Composition by minimum has to keep working: an SG account on a VPN is
-    // priced by the VPN, not by the softer geography.
-    const result = resolveAnvilSpendCeiling({
-      accessTier: 'full',
-      countryCode: 'SG',
-      privacyEgress: true,
-    })
-    expect(result.usd).toBe(ANVIL_RESTRICTED_DAILY_SPEND_USD)
-    expect(result.reason).toBe('privacy_egress')
-  })
-
-  it('resolves a tie with the region ceiling to `region`', () => {
-    // A limited-tier account in an elevated country sees $5 from both rules.
-    // The tie must land on the reason that implies nothing about the account.
-    const result = resolveAnvilSpendCeiling({
-      accessTier: 'limited',
-      countryCode: 'SG',
-    })
-    expect(result.usd).toBe(5)
-    expect(result.reason).toBe('region')
-  })
-})
-
-describe('unverified egress', () => {
-  it('prices an unresolved escalation at the restricted ceiling', () => {
-    // A provider outage must not be the cheapest way to buy a bigger budget.
-    const result = resolveAnvilSpendCeiling({
-      accessTier: 'full',
-      unverifiedEgress: true,
-    })
-    expect(result.usd).toBe(ANVIL_RESTRICTED_DAILY_SPEND_USD)
-    expect(result.reason).toBe('unverified_egress')
-  })
-
-  it('applies the hard multiplier, like the other restricted cohorts', () => {
-    const ceiling = resolveAnvilSpendCeiling({
-      accessTier: 'full',
-      unverifiedEgress: true,
-    })
-    expect(resolveAnvilHardSpendCeiling(ceiling, 2)).toBe(1)
-  })
-})
-
-describe('refusal copy', () => {
-  it('gives a plain allowance no abuse framing', () => {
-    for (const reason of ['region', 'elevated_country', 'trust_level']) {
-      const copy = anvilSpendNoticeFor(reason)
-      expect(copy).toBe(ANVIL_BUDGET_NOTICE)
-      expect(copy).not.toContain('abuse')
-      // The words that turn a cap into a verdict on the person, and the ones
-      // support tickets come back quoting.
-      expect(copy.toLowerCase()).not.toContain('limited')
-      expect(copy.toLowerCase()).not.toContain('restricted')
-      expect(copy.toLowerCase()).not.toContain('blocked')
-    }
-  })
-
-  it('keeps naming the cause SET for the restricted cohorts', () => {
-    for (const reason of [
-      'privacy_egress',
-      'restricted_country',
-      'flagged_email_domain',
-      'unverified_egress',
-    ]) {
-      expect(anvilSpendNoticeFor(reason)).toBe(ANVIL_RESTRICTED_NOTICE)
-    }
-  })
-
-  it('keeps third_party_client cause-blind so the detector stays unnamed', () => {
-    expect(anvilSpendNoticeFor('third_party_client')).toBe(
-      ANVIL_CAPACITY_NOTICE,
-    )
-  })
-
-  it('publishes no dollar figure in any refusal', () => {
-    // A published cap is a published pacing instruction.
-    for (const copy of [
-      ANVIL_BUDGET_NOTICE,
-      ANVIL_CAPACITY_NOTICE,
-      ANVIL_RESTRICTED_NOTICE,
-    ]) {
-      expect(copy).not.toMatch(/\$|\d/)
-    }
-  })
-})