create-ailk 0.1.0

package/templates/apps/web/__tests__/i18n/middleware.test.ts

@@ -0,0 +1,119 @@
+/**
+ * @jest-environment node
+ */
+// i18n S2 — Middleware locale detection priority chain tests (#949)
+//
+// Tests that the composed next-intl + security-headers middleware preserves
+// security headers on every response, and that the middleware config exports
+// the expected matcher pattern excluding static assets.
+//
+// Note: next-intl middleware runs in the Next.js Edge runtime and relies on
+// Next.js internals (URL rewriting, response piping) that cannot be fully
+// exercised in a jest/node environment. We test:
+//   1. Security headers are preserved (S16 preservation guarantee)
+//   2. Matcher config excludes _next/static, _next/image, favicon.ico
+//   3. The module initialises without throwing (locales read correctly)
+//
+// Locale list is now read from NEXT_PUBLIC_ENABLED_LOCALES env var (baked at
+// build time by next.config.mjs). Tests control the env var directly rather
+// than mocking lib/locales (which no longer runs in the Edge middleware path).
+
+import { NextRequest, NextResponse } from "next/server";
+
+// Mock next-intl middleware so it returns a plain NextResponse (no Edge runtime needed).
+jest.mock("next-intl/middleware", () => {
+  return function createMiddleware() {
+    return function (_req: unknown) {
+      return NextResponse.next();
+    };
+  };
+});
+
+import { middleware, config } from "../../middleware";
+
+function makeRequest(
+  path: string,
+  headers: Record<string, string> = {},
+): NextRequest {
+  return new NextRequest(new URL(path, "http://localhost:3000"), {
+    headers: { host: "localhost:3000", ...headers },
+  });
+}
+
+describe("i18n middleware — security headers preserved (S16 contract)", () => {
+  it("applies Content-Security-Policy to every response", async () => {
+    const res = await middleware(makeRequest("/"));
+    expect(res.headers.get("Content-Security-Policy")).not.toBeNull();
+    expect(res.headers.get("Content-Security-Policy")).toContain(
+      "frame-ancestors 'none'",
+    );
+  });
+
+  it("applies Strict-Transport-Security", async () => {
+    const res = await middleware(makeRequest("/"));
+    expect(res.headers.get("Strict-Transport-Security")).toContain(
+      "max-age=63072000",
+    );
+  });
+
+  it("applies X-Content-Type-Options: nosniff", async () => {
+    const res = await middleware(makeRequest("/"));
+    expect(res.headers.get("X-Content-Type-Options")).toBe("nosniff");
+  });
+
+  it("applies X-Frame-Options: DENY", async () => {
+    const res = await middleware(makeRequest("/"));
+    expect(res.headers.get("X-Frame-Options")).toBe("DENY");
+  });
+
+  it("applies Referrer-Policy", async () => {
+    const res = await middleware(makeRequest("/"));
+    expect(res.headers.get("Referrer-Policy")).toBe(
+      "strict-origin-when-cross-origin",
+    );
+  });
+
+  it("applies Permissions-Policy", async () => {
+    const res = await middleware(makeRequest("/about"));
+    expect(res.headers.get("Permissions-Policy")).toBeTruthy();
+  });
+});
+
+describe("i18n middleware — locale config reads from NEXT_PUBLIC_ENABLED_LOCALES", () => {
+  it("middleware initialises without throwing when env var is unset (falls back to [en])", async () => {
+    // NEXT_PUBLIC_ENABLED_LOCALES is not set in test env — middleware falls back to ["en"].
+    const res = await middleware(makeRequest("/"));
+    expect(res).toBeDefined();
+    expect(res.headers.get("Content-Security-Policy")).not.toBeNull();
+  });
+
+  it("middleware does not throw for two-locale config", async () => {
+    // Middleware reads env at module load time. This test verifies the
+    // middleware still handles requests regardless of locale path.
+    const res = await middleware(makeRequest("/es/about"));
+    expect(res).toBeDefined();
+    expect(res.headers.get("Content-Security-Policy")).not.toBeNull();
+  });
+});
+
+describe("i18n middleware — matcher config", () => {
+  it("excludes _next/static from matcher", () => {
+    const matcher = Array.isArray(config.matcher)
+      ? config.matcher.join(",")
+      : config.matcher;
+    expect(matcher).toContain("_next");
+  });
+
+  it("excludes favicon.ico from matcher", () => {
+    const matcher = Array.isArray(config.matcher)
+      ? config.matcher.join(",")
+      : config.matcher;
+    expect(matcher).toContain("favicon.ico");
+  });
+
+  it("matcher is a string (single pattern) or array", () => {
+    expect(
+      typeof config.matcher === "string" || Array.isArray(config.matcher),
+    ).toBe(true);
+  });
+});

package/templates/apps/web/__tests__/i18n/routing.test.ts

@@ -0,0 +1,114 @@
+/**
+ * @jest-environment node
+ */
+// i18n S2 — Routing integration tests (#949)
+//
+// Tests the 5 AC routing cases from the spec §5.1 at the middleware level.
+// Full curl integration verification (live HTTP server) is in the PR checklist.
+//
+// What we test in unit scope:
+//   - Middleware does not throw for any of the 5 locale path shapes
+//   - Security headers are always applied (S16 preservation)
+//   - NEXT_PUBLIC_ENABLED_LOCALES controls the locale list (env var, baked at build)
+//   - Middleware config has the correct matcher (static assets excluded)
+
+import { NextRequest, NextResponse } from "next/server";
+
+// Stub next-intl so we can test middleware composition without Edge runtime.
+// next-intl's actual locale detection is tested by the library's own suite;
+// our job is to verify the composition (security headers applied, no throws).
+jest.mock("next-intl/middleware", () => {
+  return function createMiddleware() {
+    return function (_req: unknown) {
+      return NextResponse.next();
+    };
+  };
+});
+
+function makeRequest(
+  path: string,
+  headers: Record<string, string> = {},
+): NextRequest {
+  return new NextRequest(new URL(path, "http://localhost:3000"), {
+    headers: { host: "localhost:3000", ...headers },
+  });
+}
+
+// AC-1: curl http://localhost:3000/ returns 200 with English content + lang=en
+describe("AC-1: bare default-locale URL / → middleware OK", () => {
+  it("does not throw for bare / path", async () => {
+    const { middleware } = await import("../../middleware");
+    const res = await middleware(makeRequest("/"));
+    expect(res.status).not.toBe(500);
+  });
+
+  it("security headers present on /", async () => {
+    const { middleware } = await import("../../middleware");
+    const res = await middleware(makeRequest("/"));
+    expect(res.headers.get("Content-Security-Policy")).not.toBeNull();
+  });
+});
+
+// AC-2: curl http://localhost:3000/en/ returns 200 with English content + lang=en
+describe("AC-2: /en/ prefix → middleware OK", () => {
+  it("does not throw for /en/ path", async () => {
+    const { middleware } = await import("../../middleware");
+    const res = await middleware(makeRequest("/en/"));
+    expect(res.status).not.toBe(500);
+  });
+
+  it("security headers present on /en/", async () => {
+    const { middleware } = await import("../../middleware");
+    const res = await middleware(makeRequest("/en/"));
+    expect(res.headers.get("Strict-Transport-Security")).toBeTruthy();
+  });
+});
+
+// AC-3: curl -H "Accept-Language: es" http://localhost:3000/ → 200 English fallback
+describe("AC-3: Accept-Language: es on / → no error (English fallback)", () => {
+  it("does not throw with es accept-language when only en is enabled", async () => {
+    const { middleware } = await import("../../middleware");
+    const res = await middleware(
+      makeRequest("/", { "accept-language": "es,en;q=0.8" }),
+    );
+    expect(res.status).not.toBe(500);
+  });
+
+  it("security headers still applied with es accept-language", async () => {
+    const { middleware } = await import("../../middleware");
+    const res = await middleware(makeRequest("/", { "accept-language": "es" }));
+    expect(res.headers.get("Content-Security-Policy")).not.toBeNull();
+  });
+});
+
+// AC-4: /es/ with locales:[en,es] → 200 English fallback + lang=es
+// NEXT_PUBLIC_ENABLED_LOCALES is baked at build time; in tests we verify
+// middleware handles the path without throwing (actual locale routing is
+// tested via next-intl's own suite and the curl checklist).
+describe("AC-4: /es/ path → middleware handles without throwing", () => {
+  it("does not throw for /es/ path", async () => {
+    const { middleware } = await import("../../middleware");
+    const res = await middleware(makeRequest("/es/"));
+    expect(res.status).not.toBe(500);
+  });
+});
+
+// AC-5: /es/ with locales:[en] only → 404 from next-intl's router
+// In unit test scope, we verify the middleware doesn't throw — the actual 404
+// from the Next.js router (not middleware layer) is verified via curl checklist.
+describe("AC-5: /es/ with locales:[en] only → middleware does not throw", () => {
+  it("middleware processes /es/ request without throwing", async () => {
+    const { middleware } = await import("../../middleware");
+    // Middleware itself doesn't throw — Next.js router returns 404
+    const res = await middleware(makeRequest("/es/"));
+    expect(res).toBeDefined();
+  });
+
+  it("locale list falls back to [en] when NEXT_PUBLIC_ENABLED_LOCALES unset", () => {
+    // In test env, NEXT_PUBLIC_ENABLED_LOCALES is not set → middleware uses ["en"].
+    // This mirrors the next.config.mjs fallback behavior at build time.
+    const localeEnv = process.env.NEXT_PUBLIC_ENABLED_LOCALES;
+    const locales = (localeEnv ?? "en").split(",");
+    expect(locales).toEqual(["en"]);
+  });
+});

package/templates/apps/web/__tests__/i18n/translations.test.ts

@@ -0,0 +1,191 @@
+/**
+ * @jest-environment node
+ */
+// i18n S2 — Translation API tests (#949)
+//
+// Tests that:
+// 1. messages/en.json has the required namespace structure (consent + common)
+// 2. All leaf values are non-empty strings
+// 3. The i18n.ts module exports a function (getRequestConfig wrapper)
+// 4. The catalog loads correctly for the 'en' locale via the i18n loader
+// 5. Missing locale catalog falls back to English (no catalog for 'es')
+
+// next-intl/server relies on the Next.js request context and cannot be called
+// directly in jest. We test i18n.ts's internal loader logic by mocking the
+// server context and verifying the messages returned.
+
+// Mock next-intl/server so getRequestConfig is a passthrough that calls our fn.
+jest.mock("next-intl/server", () => ({
+  getRequestConfig: (fn: unknown) => fn,
+}));
+
+import messages from "../../messages/en.json";
+
+describe("message catalog — en.json structure", () => {
+  it("has top-level 'consent' namespace", () => {
+    expect(messages).toHaveProperty("consent");
+    expect(typeof messages.consent).toBe("object");
+  });
+
+  it("has top-level 'common' namespace", () => {
+    expect(messages).toHaveProperty("common");
+    expect(typeof messages.common).toBe("object");
+  });
+
+  it("consent namespace contains required keys for S3 ConsentBanner", () => {
+    const { consent } = messages;
+    expect(consent).toHaveProperty("title");
+    expect(consent).toHaveProperty("body");
+    expect(consent).toHaveProperty("acceptLabel");
+    expect(consent).toHaveProperty("rejectLabel");
+    expect(consent).toHaveProperty("policyLinkLabel");
+  });
+
+  it("common namespace contains siteTitle key", () => {
+    const { common } = messages;
+    expect(common).toHaveProperty("siteTitle");
+  });
+
+  it("all leaf values are non-empty strings", () => {
+    // Walk the object tree asserting every leaf is a non-empty string.
+    // JSON.parse produces unknown, so we use a typed entry helper.
+    const parsed: unknown = JSON.parse(JSON.stringify(messages));
+    function assertLeafStrings(obj: unknown, path = ""): void {
+      if (typeof obj !== "object" || obj === null) {
+        expect(typeof obj).toBe("string");
+        expect((obj as string).length).toBeGreaterThan(0);
+        return;
+      }
+      for (const [key, value] of Object.entries(
+        obj as Record<string, unknown>,
+      )) {
+        assertLeafStrings(value, path ? `${path}.${key}` : key);
+      }
+    }
+    assertLeafStrings(parsed);
+  });
+});
+
+describe("i18n.ts — getRequestConfig loader", () => {
+  it("module default export is a function (the getRequestConfig callback)", async () => {
+    const i18nModule = await import("../../i18n/request");
+    expect(typeof i18nModule.default).toBe("function");
+  });
+
+  it("loader returns messages object for 'en' locale", async () => {
+    const i18nModule = await import("../../i18n/request");
+    const loader = i18nModule.default as (args: {
+      requestLocale: Promise<string>;
+    }) => Promise<{ locale: string; messages: typeof messages }>;
+
+    const result = await loader({
+      requestLocale: Promise.resolve("en"),
+    });
+
+    expect(result).toHaveProperty("locale", "en");
+    expect(result).toHaveProperty("messages");
+    expect(result.messages).toHaveProperty("consent");
+    expect(result.messages).toHaveProperty("common");
+  });
+
+  it("loader falls back to English messages for unknown locale 'es'", async () => {
+    const i18nModule = await import("../../i18n/request");
+    const loader = i18nModule.default as (args: {
+      requestLocale: Promise<string>;
+    }) => Promise<{ locale: string; messages: Record<string, unknown> }>;
+
+    // 'es' has no messages/es.json — should return en.json contents
+    const result = await loader({
+      requestLocale: Promise.resolve("es"),
+    });
+
+    expect(result).toHaveProperty("locale", "es");
+    expect(result).toHaveProperty("messages");
+    expect(result.messages).toHaveProperty("consent");
+    expect(result.messages).toHaveProperty("common");
+  });
+});
+
+describe("TypeScript type safety — compile-time key checking", () => {
+  it("messages structure satisfies the declared IntlMessages shape at runtime", () => {
+    // The TypeScript contract is declared in types/messages.d.ts.
+    // A deliberately mis-typed key (e.g. t('consnt.title')) is caught by
+    // tsc --noEmit — verified manually per AC checklist.
+    // Here we assert the runtime structure is internally consistent.
+    type ExpectedMessages = {
+      consent: {
+        title: string;
+        body: string;
+        acceptLabel: string;
+        rejectLabel: string;
+        policyLinkLabel: string;
+      };
+      common: {
+        siteTitle: string;
+      };
+    };
+
+    const typed = messages as ExpectedMessages;
+    expect(typed.consent.title.length).toBeGreaterThan(0);
+    expect(typed.consent.acceptLabel.length).toBeGreaterThan(0);
+    expect(typed.consent.rejectLabel.length).toBeGreaterThan(0);
+    expect(typed.common.siteTitle.length).toBeGreaterThan(0);
+  });
+});
+
+describe("i18n/request.ts — outer catch fallback (lines 31-32)", () => {
+  // Tests the outer catch block of i18n/request.ts: when import('../messages/en.json')
+  // on line 27 (inner fallback) rejects, the outer catch on lines 30-32 fires
+  // and attempts its own import of en.json.
+  //
+  // We cover the branch by isolating i18n/request.ts under jest.isolateModules and
+  // injecting a module-registry mock that makes the second en.json import
+  // (line 27) throw, so execution falls into the outer catch (line 31).
+
+  it("outer catch returns English messages when inner fallback import throws", async () => {
+    let result: { locale: string; messages: Record<string, unknown> } | undefined;
+
+    // Track how many times en.json is imported so we can make the second one
+    // fail (simulating the line-27 inner fallback rejection) while the third
+    // (line-31 outer catch) succeeds.
+    let enImportCount = 0;
+
+    await jest.isolateModulesAsync(async () => {
+      // Mock next-intl/server in the isolated scope.
+      jest.mock("next-intl/server", () => ({
+        getRequestConfig: (fn: unknown) => fn,
+      }));
+
+      // Mock the messages directory so we can control what each import returns.
+      // eslint-disable-next-line no-restricted-syntax -- test-seam mock required; controls dynamic import resolution in i18n.ts outer-catch coverage; tracked in #507
+      jest.mock("../../messages/en.json", () => {
+          enImportCount++;
+          if (enImportCount === 1) {
+            // First call — from line 27 (inner fallback after locale miss) —
+            // throw to force execution into the outer catch on line 31.
+            throw new Error("simulated en.json load failure");
+          }
+          // Second call — from line 31 (outer catch) — return real content.
+          // i18n.ts does `fallback.default ?? fallback`, so put content at top level.
+          return { consent: { title: "t", body: "b", acceptLabel: "a", rejectLabel: "r", policyLinkLabel: "p" }, common: { siteTitle: "s" } };
+        },
+        { virtual: true },
+      );
+
+      const i18nMod = await import("../../i18n/request");
+      const loader = i18nMod.default as (args: {
+        requestLocale: Promise<string>;
+      }) => Promise<{ locale: string; messages: Record<string, unknown> }>;
+
+      // Use locale "es" (no catalog) → locale import → null → line 27 runs →
+      // throws (mocked) → outer catch fires → line 31 runs → returns stub.
+      result = await loader({
+        requestLocale: Promise.resolve("es"),
+      });
+    });
+
+    expect(result).toBeDefined();
+    expect(result!.messages).toHaveProperty("consent");
+    expect(result!.messages).toHaveProperty("common");
+  });
+});

package/templates/apps/web/__tests__/json-ld.test.ts

@@ -0,0 +1,98 @@
+/**
+ * Tests for pack-aware pageToJsonLd and getPackOnce.
+ *
+ * U3 contract:
+ *   - pageToJsonLd is async; calls getPackOnce() then buildJsonLdWithPack(page, pack).
+ *   - Empty-pack passthrough: output is byte-identical to the pre-U3 synchronous
+ *     buildJsonLd(page) call when the pack has no patches for the page type.
+ *   - With-pack: output reflects the pack's builder patch for the page type.
+ *   - getPackOnce memoizes getCurrentPack — called at most once per module load.
+ *
+ * @working-theory/schema-pack-registry is globally mocked in setup.ts (prevents the
+ * jose/license chain from loading in the JSDOM test environment). Individual
+ * tests configure `getCurrentPack` and `applyPack` return values as needed.
+ */
+
+import type { Pack } from "@working-theory/schema-pack-registry";
+import { getCurrentPack, applyPack } from "@working-theory/schema-pack-registry";
+import { buildJsonLd } from "@working-theory/schema";
+import { pageToJsonLd } from "@working-theory/page-renderer";
+import type { ContentPage } from "@working-theory/content-adapters";
+
+const mockGetCurrentPack = getCurrentPack as jest.MockedFunction<
+  typeof getCurrentPack
+>;
+const mockApplyPack = applyPack as jest.MockedFunction<typeof applyPack>;
+
+const emptyPack: Pack = {
+  version: "2026.01.01",
+  schemaApiVersion: 1,
+  publishedAt: "2026-01-01T00:00:00.000Z",
+  patches: {},
+  registryDeltas: [],
+  signature: "built-in",
+};
+
+const homePageContent: ContentPage = {
+  type: "HomePage",
+  slug: "home",
+  title: "Example",
+  description: "An example site.",
+};
+
+describe("pageToJsonLd — pack-aware async", () => {
+  beforeEach(() => {
+    mockGetCurrentPack.mockReset();
+    mockApplyPack.mockReset();
+    // Default: applyPack is a passthrough (no patches applied).
+    mockApplyPack.mockImplementation(
+      (_name: string, output: Record<string, unknown>) => ({
+        result: output,
+        fellBack: false,
+      }),
+    );
+  });
+
+  it("is async (returns a Promise)", async () => {
+    mockGetCurrentPack.mockResolvedValue(emptyPack);
+    const result = pageToJsonLd(homePageContent, "en");
+    expect(result).toBeInstanceOf(Promise);
+    await result;
+  });
+
+  it("empty-pack: output byte-identical to buildJsonLd(page) with matching locale", async () => {
+    mockGetCurrentPack.mockResolvedValue(emptyPack);
+    const result = await pageToJsonLd(homePageContent, "en");
+    const input = {
+      type: homePageContent.type,
+      slug: homePageContent.slug,
+      title: homePageContent.title,
+      description: homePageContent.description,
+      locale: "en",
+    } as Parameters<typeof buildJsonLd>[0];
+    const baseline = buildJsonLd(input);
+    expect(JSON.stringify(result)).toBe(JSON.stringify(baseline));
+  });
+
+  it("with-pack: applyPack is called and its result is returned", async () => {
+    mockGetCurrentPack.mockResolvedValue(emptyPack);
+    // Simulate applyPack injecting a custom field.
+    mockApplyPack.mockImplementation(
+      (_name: string, output: Record<string, unknown>) => ({
+        result: { ...output, customField: "pack-injected" },
+        fellBack: false,
+      }),
+    );
+    const result = await pageToJsonLd(homePageContent, "en");
+    expect(result).toHaveProperty("customField", "pack-injected");
+  });
+
+  it("getCurrentPack is memoized — called at most once per module load", async () => {
+    mockGetCurrentPack.mockResolvedValue(emptyPack);
+    await pageToJsonLd(homePageContent, "en");
+    const callCount = mockGetCurrentPack.mock.calls.length;
+    await pageToJsonLd(homePageContent, "en");
+    // Second call must not invoke getCurrentPack again — memoized.
+    expect(mockGetCurrentPack.mock.calls.length).toBe(callCount);
+  });
+});