create-ailk 0.1.0 → 0.2.0

package/templates/database/seed-test.ts

@@ -25,23 +25,30 @@
  */
 import "dotenv/config";
 
+import { PrismaPg } from "@prisma/adapter-pg";
+
 import { PrismaClient } from "./generated/client/client.js";
 
+// Fixed, well-known ids from the ADR-0031 reserved sentinel range (zero
+// timestamp + version 7 + variant 8 + counter) — valid-shaped ids the
+// users_id_format CHECK admits, stable so the e2e harness can put them in
+// AILK_TEST_AUTH_USER_ALLOWLIST, and impossible to collide with a generated
+// v7 id.
 const TEST_USERS = [
   {
-    id: "test-e2e-user",
+    id: "user_00000000-0000-7000-8000-0000000000e1",
     email: "test:e2e-user@ailaunchkit.test",
     name: "E2E Test User",
     role: "user",
   },
   {
-    id: "test-e2e-admin",
+    id: "user_00000000-0000-7000-8000-0000000000e2",
     email: "test:e2e-admin@ailaunchkit.test",
     name: "E2E Test Admin",
     role: "admin",
   },
   {
-    id: "test-e2e-owner",
+    id: "user_00000000-0000-7000-8000-0000000000e3",
     email: "test:e2e-owner@ailaunchkit.test",
     name: "E2E Test Owner",
     role: "owner",
@@ -57,7 +64,10 @@ async function main(): Promise<void> {
     process.exit(1);
   }
 
-  const prisma = new PrismaClient();
+  // Prisma 7 requires an explicit driver adapter (mirrors seed.ts) —
+  // `new PrismaClient()` with no adapter throws at construction.
+  const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL });
+  const prisma = new PrismaClient({ adapter });
   try {
     for (const user of TEST_USERS) {
       await prisma.user.upsert({

package/templates/database/seed.ts

@@ -0,0 +1,148 @@
+/**
+ * Default-workspace provision seed (roadmap
+ * docs/roadmaps/site-config-workspace-tenancy-roadmap.md Phase 1, #3622).
+ *
+ * Single-tenant AILK has no Workspace at all today. This seed deterministically
+ * provisions exactly one default Organization + Workspace (well-known ids/slugs)
+ * so every deployment has a resolvable Workspace scope — a foundation for the
+ * Phase 2 session wiring (`activeWorkspaceId` resolution) and the Phase 3
+ * site-config re-anchor. See docs/specs/default-workspace-provision-spec.md.
+ *
+ * Race-safe: `upsert` on the unique keys (Organization.slug,
+ * Workspace.organizationId_slug) means a concurrent re-invocation converges
+ * rather than duplicating.
+ *
+ * Production-safe: NO `*_ENABLED`-style env guard (unlike seed-test.ts) —
+ * default-workspace provisioning is safe to run in production. The
+ * `count === 0` guard (not an unconditional upsert) is what keeps this a no-op
+ * once ANY Workspace exists — covering both single-tenant re-run idempotency
+ * and a multi-tenant deployment that already has real Workspaces.
+ *
+ * Run via:
+ *   pnpm --filter @working-theory/database db:seed
+ */
+import "dotenv/config";
+
+import { basename } from "node:path";
+
+import type { PrismaClient } from "./generated/client/client.js";
+import {
+  DEFAULT_ORG_ID,
+  DEFAULT_ORG_SLUG,
+  DEFAULT_WORKSPACE_ID,
+  DEFAULT_WORKSPACE_SLUG,
+  OPERATOR_MEMBERSHIP_ID,
+} from "./tenancy.js";
+
+// Re-exported so existing consumers (e.g. __tests__/seed.test.ts) keep
+// importing the well-known ids from this module — `database/tenancy.ts` is
+// the one declaration (spec D3); this file re-exports rather than declaring
+// a second copy.
+export {
+  DEFAULT_ORG_ID,
+  DEFAULT_ORG_SLUG,
+  DEFAULT_WORKSPACE_ID,
+  DEFAULT_WORKSPACE_SLUG,
+  OPERATOR_MEMBERSHIP_ID,
+};
+
+/**
+ * The DI surface `provisionDefaultWorkspace` needs — just the two Prisma
+ * delegates it touches. A `Pick` off the real `PrismaClient` type (not a
+ * hand-rolled shape), so a real client satisfies it by construction and the
+ * DB-free unit test can pass a lightweight stub with no live Postgres.
+ */
+export type DefaultWorkspacePrismaClient = Pick<
+  PrismaClient,
+  "organization" | "workspace"
+>;
+
+/**
+ * Provisions one default Organization + Workspace when no Workspace exists
+ * yet; no-op (no create/upsert calls) once any Workspace is present — covering
+ * both single-tenant re-run idempotency and a multi-tenant deployment that
+ * already has real Workspaces.
+ */
+export async function provisionDefaultWorkspace(
+  prisma: DefaultWorkspacePrismaClient,
+): Promise<{ created: boolean }> {
+  const existingWorkspaceCount = await prisma.workspace.count();
+  if (existingWorkspaceCount > 0) {
+    return { created: false };
+  }
+
+  await prisma.organization.upsert({
+    where: { slug: DEFAULT_ORG_SLUG },
+    create: {
+      id: DEFAULT_ORG_ID,
+      name: "Default Organization",
+      slug: DEFAULT_ORG_SLUG,
+    },
+    update: {},
+  });
+
+  await prisma.workspace.upsert({
+    where: {
+      organizationId_slug: {
+        organizationId: DEFAULT_ORG_ID,
+        slug: DEFAULT_WORKSPACE_SLUG,
+      },
+    },
+    create: {
+      id: DEFAULT_WORKSPACE_ID,
+      organizationId: DEFAULT_ORG_ID,
+      name: "Default Workspace",
+      slug: DEFAULT_WORKSPACE_SLUG,
+    },
+    update: {},
+  });
+
+  return { created: true };
+}
+
+async function main(): Promise<void> {
+  // Dynamic imports: the generated client + adapter are constructed only when
+  // this module actually runs as the seed entrypoint — never at import time
+  // (spec §5.2 Quality Constraints), matching the DI note on seed-test.ts's
+  // sibling and the lazy-require pattern in apps-paid/workspace/auth.ts.
+  const [{ PrismaClient: RealPrismaClient }, { PrismaPg }] = await Promise.all([
+    import("./generated/client/client.js"),
+    import("@prisma/adapter-pg"),
+  ]);
+  // Prisma 7 requires an explicit driver adapter (mirrors
+  // apps/api/src/lib/prisma.ts) — `new PrismaClient()` with no adapter throws.
+  const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL });
+  const prisma = new RealPrismaClient({ adapter });
+  try {
+    const { created } = await provisionDefaultWorkspace(prisma);
+    if (created) {
+      console.log(
+        `[seed] provisioned default workspace (org=${DEFAULT_ORG_ID}, workspace=${DEFAULT_WORKSPACE_ID})`,
+      );
+    } else {
+      console.log(
+        "[seed] no-op — a Workspace already exists (re-run or multi-tenant)",
+      );
+    }
+  } finally {
+    await prisma.$disconnect();
+  }
+}
+
+// Only run main() when this module is executed directly (`tsx seed.ts`), not
+// when imported by the unit test — keeps the testable core free of any
+// module-level client construction (spec §5.2 Quality Constraints).
+//
+// Compares argv[1]'s basename rather than `import.meta.url` or
+// `require.main`: this package is `"type": "module"`, so neither `require`
+// nor `__filename` exists at real runtime (tsx does not shim them under true
+// ESM), and `import.meta` is a TS compile-time restriction under ts-jest's
+// CommonJS-targeted transform (jest.config.cjs) that would break
+// `__tests__/seed.test.ts` importing this module regardless of whether the
+// guard ever evaluates true.
+if (basename(process.argv[1] ?? "") === "seed.ts") {
+  main().catch((err) => {
+    console.error("[seed] failed:", err);
+    process.exit(1);
+  });
+}

package/templates/database/tenancy.ts

@@ -0,0 +1,45 @@
+/**
+ * Default tenancy identity constants — the SINGLE source of truth (spec D3).
+ *
+ * The well-known default Organization + Workspace ids/slugs that the
+ * single-tenant provision seed (Phase 1, #3622 — `database/seed.ts`) creates,
+ * and that the session-resolution guard (Phase 2, #3627 —
+ * `apps/api/src/services/tenant-context.ts`) binds on to resolve a default
+ * scope for a single-tenant deployment. Exported publicly via the
+ * `@working-theory/database/tenancy` subpath (see `package.json` `exports`)
+ * so `apps/api` can import them across the package boundary without a second,
+ * drift-prone declaration of the tenant-isolation identity.
+ *
+ * See docs/specs/single-tenant-session-workspace-spec.md §3 D3.
+ */
+
+// The three constants below are SENTINEL ids from the reserved range of the
+// prefixed-UUIDv7 scheme (ADR-0031 rule 7): zero timestamp bits + version 7 +
+// variant 8 + a small counter suffix. They are valid-shaped v7 ids (the
+// database CHECK constraints admit them), can never collide with a generated
+// id (a real v7's timestamp bits are the current epoch-ms, never zero), and
+// are recognizable via `isSentinel(id)` from `@working-theory/ids` — key on
+// that predicate, never a hardcoded literal. They carry the branded `Id<E>`
+// types so consumers get compile-time entity safety (ADR-0031 rule 5).
+
+import type { Id } from "@working-theory/ids";
+
+/** Well-known default Organization identity — a fixed reserved-range sentinel. */
+export const DEFAULT_ORG_ID =
+  "org_00000000-0000-7000-8000-000000000001" as Id<"organization">;
+export const DEFAULT_ORG_SLUG = "default";
+
+/** Well-known default Workspace identity — a fixed reserved-range sentinel. */
+export const DEFAULT_WORKSPACE_ID =
+  "wksp_00000000-0000-7000-8000-000000000001" as Id<"workspace">;
+export const DEFAULT_WORKSPACE_SLUG = "default";
+
+/**
+ * Well-known Membership id the single-tenant owner-pin binds the operator
+ * to (docs/specs/single-tenant-owner-pin-spec.md D2). A fixed sentinel id
+ * makes the TOFU operator-binding insert race-safe: the `Membership.id`
+ * primary-key uniqueness — not application-level "is this the first
+ * user?" logic — enforces exactly one owner under concurrent first-logins.
+ */
+export const OPERATOR_MEMBERSHIP_ID =
+  "member_00000000-0000-7000-8000-000000000001" as Id<"membership">;

package/templates/database/tsconfig.flows.json

@@ -0,0 +1,15 @@
+{
+  "extends": "../tsconfig.base.json",
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "./dist",
+    "rootDir": ".",
+    "declaration": true,
+    "noEmit": false,
+    "skipLibCheck": true,
+    "types": ["node"]
+  },
+  "include": ["flows/**/*.ts"],
+  "exclude": ["node_modules", "dist", "**/*.test.ts", "**/__tests__/**"]
+}

package/templates/database/tsconfig.json

@@ -5,5 +5,11 @@
     "rootDir": ".",
     "types": ["node"]
   },
-  "include": ["prisma.config.ts", "seed-test.ts"]
+  "include": [
+    "prisma.config.ts",
+    "seed.ts",
+    "seed-test.ts",
+    "tenancy.ts",
+    "flows/**/*.ts"
+  ]
 }

package/templates/database/tsconfig.tenancy.json

@@ -0,0 +1,14 @@
+{
+  "extends": "../tsconfig.base.json",
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "./dist",
+    "rootDir": ".",
+    "declaration": true,
+    "noEmit": false,
+    "skipLibCheck": true,
+    "types": ["node"]
+  },
+  "include": ["tenancy.ts"]
+}

package/templates/package.json

@@ -4,64 +4,28 @@
   "description": "AI Launch Kit starter site.",
   "license": "UNLICENSED",
   "scripts": {
-    "lint": "NODE_OPTIONS=--max-old-space-size=12288 eslint . --cache",
-    "lint:ci": "tsx scripts/lint-sharded.ts",
-    "lint:frontend": "NODE_OPTIONS=--max-old-space-size=12288 eslint packages/ui packages/theme --cache",
-    "lint:fix": "NODE_OPTIONS=--max-old-space-size=12288 eslint . --cache --fix",
-    "type-check": "pnpm --filter @working-theory/database run db:generate && pnpm --filter @working-theory/web exec fumadocs-mdx && tsc -b && pnpm --filter \"@working-theory/dashboard-web\" run type-check && pnpm --filter \"@working-theory/storybook-gate\" run type-check",
-    "verify:ui-clean": "pnpm --filter @working-theory/theme run build && pnpm --filter @working-theory/ui exec tsc -b --force",
-    "architecture": "tsx tools/lint-architecture.ts",
-    "audit:coverage": "tsx tools/audit-coverage.ts",
-    "lint:coverage-thresholds": "tsx tools/lint-coverage-thresholds.ts",
-    "env:check": "tsx tools/validate-env.ts",
-    "schema:check": "tsx tools/validate-schemas.ts",
-    "spec-ac:check": "tsx tools/lint-spec-ac.ts",
-    "lint:rtl": "tsx tools/lint-rtl/check.ts",
-    "lint:styling-conformance": "tsx tools/lint-styling-conformance/check.ts",
-    "lint:required-checks": "tsx tools/lint-required-checks.ts",
-    "collisions:check": "bash tools/check-collisions.sh",
-    "component:inventory": "tsx scripts/component/component-inventory.ts",
-    "component:manifest": "tsx scripts/component/gen-sweep-manifest.ts",
-    "component:page-manifest": "tsx scripts/component/gen-page-manifest.ts docs/internal/pages/page-manifest.md",
-    "pages:check": "tsx scripts/component/gen-page-manifest.ts docs/internal/pages/page-manifest.md --check",
-    "check-page-types": "tsx scripts/component/check-page-type-alignment.ts",
-    "check-content-renders": "tsx tools/lint-check-content-renders.ts",
-    "check-mdx-vocabulary": "tsx tools/lint-mdx-component-vocabulary.ts",
-    "theme:check": "tsx scripts/check-design-system-sync.ts",
-    "content:compile": "TSX_TSCONFIG_PATH=tools/tsconfig.json tsx tools/content-compile/index.ts",
-    "codegen": "tsx tools/codegen/run.ts",
-    "preflight": "bash scripts/preflight.sh",
-    "preflight:frontend": "PREFLIGHT_SCOPE=frontend bash scripts/preflight.sh",
+    "dev": "pnpm --parallel -r dev",
+    "build": "pnpm -r build",
+    "start": "pnpm --filter @working-theory/web start",
+    "test": "pnpm -r test",
+    "test:watch": "pnpm -r test:watch",
+    "lint": "pnpm -r --if-present lint",
+    "type-check": "pnpm -r --if-present type-check",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "test": "pnpm -r test && jest --config jest.config.cjs",
-    "test:ci": "tsx scripts/test-sharded.ts",
-    "test:architecture": "jest --config jest.config.cjs tests/architecture",
-    "test:watch": "pnpm -r test:watch",
-    "build": "pnpm -r build",
-    "dev": "pnpm --parallel -r dev",
-    "db:generate": "pnpm --filter @working-theory/database exec prisma generate",
-    "db:migrate": "pnpm --filter @working-theory/database exec prisma migrate dev",
-    "db:migrate:deploy": "pnpm --filter @working-theory/database exec prisma migrate deploy",
-    "db:seed": "pnpm --filter @working-theory/database run seed",
-    "db:studio": "pnpm --filter @working-theory/database exec prisma studio",
-    "prepare": "husky",
-    "aeo": "pnpm --filter @working-theory/aeo run",
-    "changeset": "changeset",
-    "changeset:version": "changeset version && pnpm install --lockfile-only",
-    "changeset:publish": "changeset publish",
-    "storybook:build": "pnpm --filter @working-theory/theme run build && pnpm --filter @working-theory/ui run build && pnpm --filter @working-theory/ui exec storybook build -o ../../storybook-static",
-    "visual:test": "playwright test --config tests/visual/playwright.config.ts",
-    "visual:test:live-app": "playwright test --config tests/visual/playwright-live-app.config.ts"
+    "db:generate": "pnpm --filter @working-theory/database run db:generate",
+    "db:migrate": "pnpm --filter @working-theory/database run db:migrate",
+    "db:migrate:deploy": "pnpm --filter @working-theory/database run db:migrate:deploy",
+    "db:seed": "pnpm --filter @working-theory/database run db:seed",
+    "db:studio": "pnpm --filter @working-theory/database run db:studio"
   },
   "devDependencies": {
     "@changesets/changelog-github": "^0.7.0",
-    "@playwright/test": "^1.61.1",
-    "http-server": "^14.1.1",
-    "wait-on": "^8.0.1",
     "@changesets/cli": "^2.27.0",
     "@eslint/js": "^10.0.1",
     "@lhci/cli": "^0.15.1",
+    "@mdx-js/mdx": "^3.1.1",
+    "@playwright/test": "^1.61.1",
     "@stryker-mutator/core": "^8.7.1",
     "@stryker-mutator/jest-runner": "^8.7.1",
     "@types/jest": "^30.0.0",
@@ -70,6 +34,7 @@
     "@typescript-eslint/parser": "^8.62.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
+    "axe-core": "^4.10.0",
     "eslint": "^10.6.0",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-import-x": "^4.17.1",
@@ -78,20 +43,24 @@
     "eslint-plugin-promise": "^7.2.1",
     "expect-type": "^1.4.0",
     "globals": "^17.7.0",
-    "ts-declaration-location": "^1.0.7",
+    "gray-matter": "^4.0.3",
+    "http-server": "^14.1.1",
     "husky": "^9.1.7",
     "jest": "^30.4.2",
     "jiti": "^2.4.2",
     "lint-staged": "^15.3.0",
     "prettier": "^3.9.4",
+    "ts-declaration-location": "^1.0.7",
     "ts-jest": "^29.4.11",
     "tsx": "^4.22.4",
+    "turbo": "^2.10.4",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.62.1",
+    "wait-on": "^8.0.1",
     "yaml": "^2.9.0",
     "zod": "^4.2.1",
     "zod-to-ts": "^2.1.0",
-    "@working-theory/cli": "^0.1.2"
+    "@working-theory/cli": "^0.20.0"
   },
   "lint-staged": {
     "*.{ts,tsx}": [
@@ -104,22 +73,28 @@
       "bash -c 'pnpm architecture'"
     ]
   },
-  "packageManager": "pnpm@9.15.0",
+  "packageManager": "pnpm@10.34.5+sha512.a4ee05f2f73658255bd6a89859c065a45c28a57daefae2c893a168ee2b73168c37b91e83e57ea67654ad03f03031746430e8bce38e362e042605fb8abc80192e",
   "engines": {
     "node": ">=20.19.0"
   },
   "pnpm": {
+    "onlyBuiltDependencies": [
+      "prisma"
+    ],
     "auditConfig": {
       "ignoreGhsas": [
         "GHSA-gv7w-rqvm-qjhr"
       ]
     },
     "overrides": {
-      "tar": "^7.5.15",
+      "tar": "^7.5.21",
       "protobufjs": "^8.4.1",
       "@grpc/grpc-js": "^1.14.4",
       "hono": ">=4.12.25",
-      "undici": "^7.28.0"
+      "undici": "^7.28.0",
+      "js-yaml@3": "^3.15.0",
+      "js-yaml@4": "^4.3.0",
+      "brace-expansion@2": "^2.1.2"
     }
   }
 }

package/templates/pnpm-workspace.yaml

@@ -1,6 +1,3 @@
 packages:
   - "apps/*"
-  - "apps-paid/*"
-  - "packages/*"
-  - "packages-paid/*"
   - "database"

package/templates/project.yaml

@@ -3,7 +3,7 @@ schema_version: 1
 # project.yaml — per-repo configuration consumed by Claude Code skills and
 # global rules. Replace REPLACE_ME values with your repo's actual identity.
 #
-# See https://github.com/tailwind-ai/ai-launch-kit/blob/main/project.yaml
+# See https://github.com/working-theory-labs/ai-launch-kit/blob/main/project.yaml
 # for AI Launch Kit's own canonical example.
 
 identity:

package/templates/tsconfig.json

@@ -4,42 +4,6 @@
     { "path": "./apps/api" },
     { "path": "./apps/mcp" },
     { "path": "./apps/web" },
-    { "path": "./database/tsconfig.build.json" },
-    { "path": "./apps-paid/billing" },
-    { "path": "./apps-paid/license-issuer" },
-    { "path": "./apps-paid/marketing-api" },
-    { "path": "./apps-paid/marketing-mcp" },
-    { "path": "./packages/aeo" },
-    { "path": "./packages/agent-context" },
-    { "path": "./packages/analytics" },
-    { "path": "./packages/api-client" },
-    { "path": "./packages/common" },
-    { "path": "./packages/license" },
-    { "path": "./packages/cda-filesystem" },
-    { "path": "./packages/cli" },
-    { "path": "./packages/content-adapters" },
-    { "path": "./packages/content-projection" },
-    { "path": "./packages/email" },
-    { "path": "./packages/env" },
-    { "path": "./packages/fumadocs-schema" },
-    { "path": "./packages/metadata" },
-    { "path": "./packages/observability" },
-    { "path": "./packages/schema" },
-    { "path": "./packages/schema-validator" },
-    { "path": "./packages/schema-pack-registry" },
-    { "path": "./packages/sections-registry" },
-    { "path": "./packages/site-config" },
-    { "path": "./packages/stripe-client" },
-    { "path": "./packages/theme" },
-    { "path": "./packages/ui" },
-    { "path": "./packages/validation" },
-    { "path": "./packages/web-i18n" },
-    { "path": "./packages-paid/billing-client" },
-    { "path": "./packages-paid/branding" },
-    { "path": "./packages-paid/license-client" },
-    { "path": "./packages-paid/license-manifest" },
-    { "path": "./packages-paid/marketing-api-client" },
-    { "path": "./packages-paid/partner-session" },
-    { "path": "./packages-paid/preview-protocol" }
+    { "path": "./database/tsconfig.build.json" }
   ]
 }

package/templates/apps/web/__tests__/auth/adversarial/cookie-attributes.test.ts

@@ -1,94 +0,0 @@
-/**
- * @file cookie-attributes.test.ts (S13 adversarial)
- *
- * Verifies that `apps/web/auth.ts` does NOT weaken Better Auth's secure-cookie
- * defaults. Better Auth's `nextCookies()` plugin emits session cookies with
- * `HttpOnly`, `Secure` (in non-dev environments), `SameSite=Lax`, and
- * `Path=/`. The configuration in `auth.ts` must not override any of those.
- *
- * Strategy: mock `better-auth` so its real ESM-only module never loads in the
- * Jest CJS preset. The mock's `betterAuth(options)` returns `{ options }` so
- * the test can inspect the raw config object the AILK code passed in. The
- * assertions guard the AILK-owned surface, not Better Auth's emission
- * (that's the library's contract).
- */
-
-jest.mock("better-auth", () => ({
-  betterAuth: (options: unknown) => ({ options }),
-}));
-
-jest.mock("better-auth/adapters/prisma", () => ({
-  prismaAdapter: () => ({ id: "mock-prisma-adapter" }),
-}));
-
-jest.mock("better-auth/next-js", () => ({
-  nextCookies: () => ({ id: "next-cookies" }),
-}));
-
-import { createAuth } from "../../../auth";
-
-// Stub PrismaClient — avoids a real DB connection at module-load time.
-// Injected via createAuth({ prisma }) instead of jest.mock("../../../lib/prisma-for-auth").
-// Pattern mirrors apps-paid/dashboard-web/auth.ts DI.
-const stubPrisma = {} as NonNullable<NonNullable<Parameters<typeof createAuth>[0]>["prisma"]>;
-const auth = createAuth({ prisma: stubPrisma });
-
-type CookieAttrs = {
-  httpOnly?: boolean;
-  secure?: boolean;
-  sameSite?: "lax" | "strict" | "none";
-  path?: string;
-};
-
-type AdvancedCookies = {
-  session_token?: { attributes?: CookieAttrs };
-  session_data?: { attributes?: CookieAttrs };
-};
-
-type AuthOptions = {
-  advanced?: {
-    useSecureCookies?: boolean;
-    cookies?: AdvancedCookies;
-    defaultCookieAttributes?: CookieAttrs;
-  };
-  plugins?: Array<{ id?: string }>;
-  session?: { expiresIn?: number; updateAge?: number };
-};
-
-// eslint-disable-next-line no-restricted-syntax -- the mocked betterAuth returns { options: <unknown> }; the real type carries no public options shape, so a double assertion is the narrow path to inspect the AILK-owned config object.
-const options = (auth as unknown as { options: AuthOptions }).options;
-
-describe("S13 adversarial — cookie attributes (config surface)", () => {
-  it("does NOT disable useSecureCookies (Better Auth secure default preserved)", () => {
-    expect(options.advanced?.useSecureCookies).not.toBe(false);
-  });
-
-  it("does NOT override session_token cookie to drop HttpOnly", () => {
-    const sessionAttrs = options.advanced?.cookies?.session_token?.attributes;
-    expect(sessionAttrs?.httpOnly).not.toBe(false);
-  });
-
-  it("does NOT override session_token cookie to drop Secure", () => {
-    const sessionAttrs = options.advanced?.cookies?.session_token?.attributes;
-    expect(sessionAttrs?.secure).not.toBe(false);
-  });
-
-  it("does NOT relax sameSite to 'none' (CSRF protection preserved)", () => {
-    expect(
-      options.advanced?.cookies?.session_token?.attributes?.sameSite,
-    ).not.toBe("none");
-    expect(options.advanced?.defaultCookieAttributes?.sameSite).not.toBe(
-      "none",
-    );
-  });
-
-  it("includes the nextCookies() plugin so Next.js sets cookies via Response", () => {
-    const pluginIds = (options.plugins ?? []).map((p) => p.id);
-    expect(pluginIds).toContain("next-cookies");
-  });
-
-  it("persists sessions in the database (admin-revocable model)", () => {
-    expect(options.session).toBeDefined();
-    expect(options.session?.expiresIn).toBeGreaterThan(0);
-  });
-});

package/templates/apps/web/__tests__/auth/adversarial/oauth-state-parameter.test.ts

@@ -1,75 +0,0 @@
-/**
- * @file oauth-state-parameter.test.ts (S13 adversarial)
- *
- * OAuth `state` parameter protection. Better Auth's social-signin flow
- * generates an opaque `state` value on every OAuth handshake; the callback
- * route validates it. The AILK-owned surface that could disable this is
- * `auth.options` — there is no documented Better Auth knob to turn state
- * generation off, but a future migration to a custom plugin (e.g.
- * `genericOAuth`) could weaken it. This file pins the AILK config so a
- * regression that introduces a state-disabling override is caught.
- *
- * Strategy: mock `better-auth` so the real ESM-only module never loads;
- * inspect the options object the AILK code constructed.
- */
-
-jest.mock("better-auth", () => ({
-  betterAuth: (options: unknown) => ({ options }),
-}));
-
-jest.mock("better-auth/adapters/prisma", () => ({
-  prismaAdapter: () => ({ id: "mock-prisma-adapter" }),
-}));
-
-jest.mock("better-auth/next-js", () => ({
-  nextCookies: () => ({ id: "next-cookies" }),
-}));
-
-import { createAuth } from "../../../auth";
-
-// Stub PrismaClient — avoids a real DB connection at module-load time.
-// Injected via createAuth({ prisma }) instead of jest.mock("../../../lib/prisma-for-auth").
-// Pattern mirrors apps-paid/dashboard-web/auth.ts DI.
-const stubPrisma = {} as NonNullable<NonNullable<Parameters<typeof createAuth>[0]>["prisma"]>;
-const auth = createAuth({ prisma: stubPrisma });
-
-type SocialProviderOpts = {
-  skipStateCheck?: boolean;
-  disableState?: boolean;
-};
-
-type AuthOptions = {
-  plugins?: Array<{ id?: string }>;
-  socialProviders?: Record<string, SocialProviderOpts>;
-};
-
-// eslint-disable-next-line no-restricted-syntax -- the mocked betterAuth returns { options: <unknown> }; the real type carries no public options shape, so a double assertion is the narrow path to inspect the AILK-owned config object.
-const options = (auth as unknown as { options: AuthOptions }).options;
-
-describe("S13 adversarial — OAuth state parameter", () => {
-  it("auth config does NOT register a generic-oauth plugin (which would need explicit state config review)", () => {
-    const plugins = options.plugins ?? [];
-    const generic = plugins.find((p) => p.id === "generic-oauth");
-    expect(generic).toBeUndefined();
-  });
-
-  it("active social providers do NOT carry a skipStateCheck override", () => {
-    const providers = options.socialProviders ?? {};
-    for (const [, opts] of Object.entries(providers)) {
-      // No Better Auth option named skipStateCheck/disableState exists today.
-      // The assertion guards against a custom wrapper that adds one.
-      expect(opts.skipStateCheck).toBeFalsy();
-      expect(opts.disableState).toBeFalsy();
-    }
-  });
-
-  it("social provider entries are syntactically valid (each has an id-shaped key)", () => {
-    const providers = options.socialProviders ?? {};
-    // When env vars are unset (OSS standalone default) the map is empty.
-    // Test passes vacuously. When wired, each provider has a non-empty key
-    // which Better Auth uses to route state into the right cookie namespace.
-    for (const name of Object.keys(providers)) {
-      expect(name.length).toBeGreaterThan(0);
-    }
-  });
-});