create-ailk 0.1.0 → 0.2.0

package/templates/apps/mcp/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Support. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or support.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Tailwind AI
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/templates/apps/mcp/__tests__/create_page.test.ts

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * Tests for the create_page MCP tool handler.
  *

package/templates/apps/mcp/__tests__/delete_page.test.ts

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * Tests for the delete_page MCP tool handler.
  *

package/templates/apps/mcp/__tests__/module-exclusion.test.ts

@@ -0,0 +1,105 @@
+/**
+ * Module-exclusion regression test (S1, #5088).
+ *
+ * Proves the mechanical claim card S1 exists to make true: when a paid
+ * module is excluded (`AILK_ENABLED_MODULES` omits it), none of the MCP
+ * tools that module contributes survive registration — the runtime half of
+ * "a tool and its apps/api route appear or vanish together" (API↔MCP
+ * parity). `packages/metadata/src/mcp-tool-catalog.ts`'s `module` field on
+ * each `TOOLS` entry is the map this test walks; it is not a second,
+ * hand-maintained list.
+ *
+ * Reverting the `shouldRegister` module filter in `../src/server.ts` (while
+ * leaving the `OSS_DISABLED_TOOLS` check alone) makes this test fail RED —
+ * see #5088 S1 verification notes.
+ */
+
+import { getMcpToolRegistrations } from "@working-theory/metadata";
+
+import { createMcpServer, listRegisteredTools } from "../src/server.js";
+
+const PAID_MODULES = ["scheduling", "content-write"] as const;
+
+function withEnabledModules<T>(enabled: string, fn: () => T): T {
+  const prior = process.env.AILK_ENABLED_MODULES;
+  process.env.AILK_ENABLED_MODULES = enabled;
+  try {
+    return fn();
+  } finally {
+    if (prior === undefined) {
+      delete process.env.AILK_ENABLED_MODULES;
+    } else {
+      process.env.AILK_ENABLED_MODULES = prior;
+    }
+  }
+}
+
+describe("MCP tool registration — module exclusion (S1, #5088)", () => {
+  afterEach(() => {
+    delete process.env.AILK_ENABLED_MODULES;
+  });
+
+  it("every module-tagged tool in the catalog names one of the modules this test covers", () => {
+    // Guards the test itself against drift: a future module tag added to
+    // the catalog without a matching entry here would silently go
+    // unverified.
+    const taggedModules = new Set(
+      getMcpToolRegistrations()
+        .map((reg) => reg.module)
+        .filter((m): m is string => Boolean(m)),
+    );
+    for (const m of taggedModules) {
+      expect(PAID_MODULES).toContain(m);
+    }
+  });
+
+  it.each(PAID_MODULES)(
+    "excluding '%s' registers none of its tools",
+    (excluded) => {
+      const enabledModules = PAID_MODULES.filter((m) => m !== excluded).join(
+        ",",
+      );
+      const excludedToolNames = getMcpToolRegistrations()
+        .filter((reg) => reg.module === excluded)
+        .map((reg) => reg.name);
+      // Sanity check the fixture: every module this test parametrizes over
+      // actually owns at least one catalog tool, or the assertion below
+      // would vacuously pass.
+      expect(excludedToolNames.length).toBeGreaterThan(0);
+
+      const registeredNames = withEnabledModules(enabledModules, () =>
+        listRegisteredTools().map((t) => t.name),
+      );
+      for (const name of excludedToolNames) {
+        expect(registeredNames).not.toContain(name);
+      }
+
+      const server = withEnabledModules(enabledModules, () =>
+        createMcpServer(),
+      );
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- mirrors apps/mcp/__tests__/catalog-drift.test.ts
+      const registered = (server as any)._registeredTools as Record<
+        string,
+        unknown
+      >;
+      for (const name of excludedToolNames) {
+        expect(name in registered).toBe(false);
+      }
+    },
+  );
+
+  it("with every module enabled, all module-tagged tools register (no over-exclusion)", () => {
+    const enabledModules = PAID_MODULES.join(",");
+    const registeredNames = new Set(
+      withEnabledModules(enabledModules, () =>
+        listRegisteredTools().map((t) => t.name),
+      ),
+    );
+    const taggedNames = getMcpToolRegistrations()
+      .filter((reg) => reg.module)
+      .map((reg) => reg.name);
+    for (const name of taggedNames) {
+      expect(registeredNames).toContain(name);
+    }
+  });
+});

package/templates/apps/mcp/__tests__/parity.test.ts

@@ -109,6 +109,31 @@ const MCP_ONLY_TOOLS = new Set([
   "ailkCreatePage", // create_page — agent-first Pro content write; HTTP twin is apps/api, not a Server Action (D14a #55)
   "ailkUpdatePage", // update_page — agent-first Pro content write; HTTP twin is apps/api, not a Server Action (D14a #55)
   "ailkDeletePage", // delete_page — agent-first Pro content write; HTTP twin is apps/api, not a Server Action (D14a #55)
+  "ailkGetFlow", // get_flow — agent-callable flow-engine read; no web Server Action (#3956 D7)
+  "ailkListAvailability", // list_availability — anonymous scheduling read via MCP; the booker section is a client island calling apps/api directly, not a Server Action (#4416)
+  "ailkGetEventMeta", // get_event_meta — meta-only scheduling read via MCP; a tile-rendering page is an RSC calling apps/api via api-client, not a Server Action (#4633)
+  "ailkCreateBooking", // create_booking — anonymous scheduling write via MCP; same posture as subscribe_newsletter/request_callback (#4416)
+  // ailkSubmitFlowStep REMOVED (#3957 D8) — submitFlowStepAction is its web
+  // Server Action twin (apps/web/app/[locale]/flows/[slug]/flow.actions.ts).
+]);
+
+/**
+ * Server Actions that are intentionally WEB-ONLY — a RECORDED exception to the
+ * API ↔ MCP parity contract, not a gap. The mirror of MCP_ONLY_TOOLS: an
+ * action listed here is excluded from missing-tool reporting.
+ *
+ * Note: this allow-list uses the action's exported symbol name
+ * (`<verb>Action`), exactly as discovered from `apps/web/**\/*.actions.ts`.
+ */
+const WEB_ONLY_ACTIONS = new Set([
+  // The recommender's email moment (#4841 → POST /v1/flows/:slug/save and
+  // /checkout; consumed by the web Server Actions in #4842's
+  // apps/web/app/[locale]/flows/[slug]/checkout.actions.ts). No MCP twin —
+  // the recorded exception in apps/api/CLAUDE.md (the `/v1/flows/:slug/save`
+  // + `/checkout` row, #4841): "an agent walking a flow has no email to give
+  // and no card to pay with; the anonymous MCP surface is identity-blind."
+  "startCheckoutAction", // checkout.actions.ts — Pay → Stripe TEST-mode hosted Checkout (#4842 D7)
+  "saveRecommendationAction", // checkout.actions.ts — "Email me this plan" → flows.save (#4842 D7)
 ]);
 
 /**
@@ -116,14 +141,19 @@ const MCP_ONLY_TOOLS = new Set([
  * MCP tool symbols, return the missing-tool and orphan-tool sets.
  *
  * Tools in MCP_ONLY_TOOLS are excluded from orphan reporting — they are
- * intentionally MCP-only and have no Server Action counterpart.
+ * intentionally MCP-only and have no Server Action counterpart. Actions in
+ * WEB_ONLY_ACTIONS are excluded from missing-tool reporting — they are
+ * intentionally web-only and have no MCP tool counterpart.
  */
 export function computeParityFailures(
   actions: Set<string>,
   tools: Set<string>,
 ): { missingTools: string[]; orphanTools: string[] } {
   const expected = new Set<string>();
-  for (const a of actions) expected.add(actionToToolName(a));
+  for (const a of actions) {
+    if (WEB_ONLY_ACTIONS.has(a)) continue;
+    expected.add(actionToToolName(a));
+  }
 
   const missingTools: string[] = [];
   for (const e of expected) if (!tools.has(e)) missingTools.push(e);
@@ -171,6 +201,18 @@ describe("MCP ↔ Server-Action parity (helper)", () => {
     expect(r.orphanTools).toEqual([]);
   });
 
+  it("skips WEB_ONLY_ACTIONS when computing missing tools (the recorded #4841 exception)", () => {
+    const actions = new Set([
+      "captureLeadAction",
+      "startCheckoutAction",
+      "saveRecommendationAction",
+    ]);
+    const tools = new Set(["ailkCaptureLead"]);
+    const r = computeParityFailures(actions, tools);
+    expect(r.missingTools).toEqual([]);
+    expect(r.orphanTools).toEqual([]);
+  });
+
   it("maps action names to tool names by stripping Action and prefixing ailk", () => {
     expect(actionToToolName("captureLeadAction")).toBe("ailkCaptureLead");
     expect(actionToToolName("purchaseAction")).toBe("ailkPurchase");
@@ -179,14 +221,24 @@ describe("MCP ↔ Server-Action parity (helper)", () => {
 });
 
 describe("MCP ↔ Server-Action parity (filesystem)", () => {
-  it("D14a Stage 1 Unit C state: two Server Actions (purchaseAction + captureLeadAction), eighteen MCP tools, zero orphans", () => {
+  it("post-#4842 state: five Server Actions (purchaseAction + captureLeadAction + submitFlowStepAction + the two web-only startCheckoutAction + saveRecommendationAction), twenty-three MCP tools, zero orphans", () => {
     const actions = discoverServerActions();
     const tools = discoverMcpTools();
     const r = computeParityFailures(actions, tools);
 
-    // After D14a Stage 1 Unit C (#55): eighteen tools + two paired Server Actions.
+    // After D14a Stage 1 Unit C (#55) + #3956 (get_flow/submit_flow_step) +
+    // #3957 (submitFlowStepAction — the web Server Action twin of
+    // ailkSubmitFlowStep): twenty tools + three paired Server Actions.
     // - ailkPurchase: paired with purchaseAction (apps/web/app/dev/purchase/).
     // - ailkCaptureLead: paired with captureLeadAction (apps/web/app/contact/).
+    // - ailkSubmitFlowStep: paired with submitFlowStepAction
+    //   (apps/web/app/[locale]/flows/[slug]/flow.actions.ts, #3957).
+    // - startCheckoutAction, saveRecommendationAction: WEB-ONLY (#4842 D7,
+    //   apps/web/app/[locale]/flows/[slug]/checkout.actions.ts) — the HTTP
+    //   twins are POST /v1/flows/:slug/checkout and /save (#4841); no MCP
+    //   twin by the recorded apps/api/CLAUDE.md exception (an agent walking
+    //   a flow has no email to give and no card to pay with; the anonymous
+    //   MCP surface is identity-blind). In WEB_ONLY_ACTIONS.
     // - ailkListPages, ailkReadContent: MCP-only (pure read; I2)
     // - ailkSearchContent, ailkGetSiteInfo, ailkGetBusinessHours,
     //   ailkGetLocations, ailkGetOfferings, ailkGetPricing, ailkGetFaq:
@@ -197,8 +249,20 @@ describe("MCP ↔ Server-Action parity (filesystem)", () => {
     // - ailkScaffold: MCP-only agent scaffolder (#299; in MCP_ONLY_TOOLS).
     // - ailkCreatePage, ailkUpdatePage, ailkDeletePage: MCP-only agent-first
     //   Pro content writes; HTTP twin is apps/api, not Server Actions (D14a #55).
-    expect(actions.size).toBe(2);
-    expect(tools.size).toBe(18);
+    // - ailkGetFlow: MCP-only agent-callable flow-engine read; HTTP twin is
+    //   apps/api, not a Server Action (#3956 D7) — the page fetch in
+    //   apps/web/app/[locale]/flows/[slug]/page.tsx is a direct api-client
+    //   call in an RSC, not a Server Action.
+    // - ailkListAvailability, ailkCreateBooking: MCP-only scheduling twins of
+    //   GET /v1/schedule/availability and POST /v1/schedule/book (#4416). The
+    //   `booker` section is a "use client" island that fetches those routes
+    //   directly (the ContactForm/StepFlow pattern) — no Server Action, so
+    //   the HTTP twin is apps/api, as with the create/update/delete_page trio.
+    // - ailkGetEventMeta: MCP-only meta-only scheduling read, twin of
+    //   GET /v1/schedule/event-meta (#4633) — same posture as the other
+    //   scheduling tools.
+    expect(actions.size).toBe(5);
+    expect(tools.size).toBe(23);
     expect(r.missingTools).toEqual([]);
     expect(r.orphanTools).toEqual([]);
   });

package/templates/apps/mcp/__tests__/request_callback.test.ts

@@ -53,7 +53,7 @@ describe("ailkRequestCallback — happy path", () => {
   it("forwards canonical body to api-client and returns ok:true with id and persisted", async () => {
     apiClient.leads.callback.mockResolvedValueOnce({
       ok: true,
-      body: { id: "cb_def456", persisted: "file" },
+      body: { id: "fallback-1700000000000-cb1", persisted: "file" },
     });
 
     const result = await ailkRequestCallback(VALID_INPUT);
@@ -66,7 +66,7 @@ describe("ailkRequestCallback — happy path", () => {
     });
     expect(result.ok).toBe(true);
     if (result.ok) {
-      expect(result.id).toBe("cb_def456");
+      expect(result.id).toBe("fallback-1700000000000-cb1");
       expect(result.persisted).toBe("file");
     }
   });
@@ -133,7 +133,7 @@ describe("ailkRequestCallback — siteId default", () => {
     delete process.env.AILK_SITE_ID;
     apiClient.leads.callback.mockResolvedValueOnce({
       ok: true,
-      body: { id: "cb_default", persisted: "file" },
+      body: { id: "fallback-1700000000000-cb2", persisted: "file" },
     });
 
     await ailkRequestCallback(VALID_INPUT);
@@ -152,7 +152,7 @@ describe("ailkRequestCallback — siteId override", () => {
     process.env.AILK_SITE_ID = "site-abc";
     apiClient.leads.callback.mockResolvedValueOnce({
       ok: true,
-      body: { id: "cb_override", persisted: "file" },
+      body: { id: "fallback-1700000000000-cb3", persisted: "file" },
     });
 
     await ailkRequestCallback(VALID_INPUT);