create-ailk 0.18.0 → 0.19.0

package/templates/apps/mcp/__tests__/audit.test.ts

@@ -1,346 +0,0 @@
-/**
- * Tests for the audit MCP tool handler.
- *
- * Acceptance criteria verified here:
- * - auditInputSchema validates slug input (with regex enforcement)
- * - auditInputSchema validates url input
- * - auditInputSchema rejects invalid slugs (uppercase, slashes, dots)
- * - ailkAudit returns score + perRule + perPage + meta for a slug input
- * - ailkAudit returns an error result for a cross-domain URL
- * - Output validates against auditOutputSchema
- * - No console.* calls in handler (structural test)
- * - No fetch() call in tool file (structural test)
- *
- * Phase 3 U0 (#294): adds a sanity-check that purchaseInputSchema relocated
- * to @working-theory/validation (per ADR 0013) is reachable and parses the same input
- * shape the inline schema parsed pre-relocation.
- */
-
-import {
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { resolve, join } from "node:path";
-
-import { READINESS_SCAN_TYPES } from "@working-theory/aeo";
-
-import {
-  auditInputSchema,
-  auditOutputSchema,
-  purchaseInputSchema,
-} from "@working-theory/validation";
-
-import { buildSinglePageAuditInput } from "../src/lib/audit-single-page.js";
-import { readStripeTaxSignal } from "../src/lib/stripe-tax-signal.js";
-import { ailkAudit } from "../src/tools/audit.js";
-
-const REPO_ROOT = resolve(__dirname, "../../..");
-const CONTENT_ROOT = join(REPO_ROOT, "content");
-const TEST_BASE_URL = "https://example.ailk.test";
-
-function withBaseUrl(
-  url: string,
-  fn: () => Promise<unknown>,
-): Promise<unknown> {
-  const prev = process.env.AILK_BASE_URL;
-  process.env.AILK_BASE_URL = url;
-  return fn().finally(() => {
-    if (prev === undefined) delete process.env.AILK_BASE_URL;
-    else process.env.AILK_BASE_URL = prev;
-  });
-}
-
-// ── Input schema tests ────────────────────────────────────────────────────────
-
-describe("auditInputSchema", () => {
-  it("accepts a valid slug", () => {
-    const result = auditInputSchema.safeParse({
-      slug: "home",
-      type: "HomePage",
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("accepts slug without explicit type", () => {
-    const result = auditInputSchema.safeParse({ slug: "home" });
-    expect(result.success).toBe(true);
-  });
-
-  it("accepts a url string", () => {
-    const result = auditInputSchema.safeParse({
-      url: "https://example.com/page",
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("rejects slug with uppercase letters", () => {
-    const result = auditInputSchema.safeParse({ slug: "LaunchingAilk" });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects slug with forward slash (path traversal guard)", () => {
-    const result = auditInputSchema.safeParse({ slug: "some/path" });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects slug with dots (path traversal guard)", () => {
-    const result = auditInputSchema.safeParse({ slug: "../etc" });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects empty slug", () => {
-    const result = auditInputSchema.safeParse({ slug: "" });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects non-url string in url field", () => {
-    const result = auditInputSchema.safeParse({ url: "not-a-url" });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects empty object (neither slug nor url)", () => {
-    const result = auditInputSchema.safeParse({});
-    expect(result.success).toBe(false);
-  });
-});
-
-// ── Handler happy-path tests ──────────────────────────────────────────────────
-
-describe("ailkAudit handler — slug input", () => {
-  it("returns score, perRule, perPage, meta for a known HomePage slug", async () => {
-    const result = await ailkAudit(
-      { slug: "home", type: "HomePage" },
-      CONTENT_ROOT,
-    );
-    expect(typeof result.score).toBe("number");
-    expect(result.score).toBeGreaterThanOrEqual(0);
-    expect(result.score).toBeLessThanOrEqual(100);
-    expect(Array.isArray(result.perRule)).toBe(true);
-    expect(Array.isArray(result.perPage)).toBe(true);
-    expect(typeof result.meta).toBe("object");
-    expect(typeof result.meta.auditedAt).toBe("string");
-    expect(typeof result.meta.ruleSet).toBe("string");
-    expect(typeof result.meta.locale).toBe("string");
-  });
-
-  it("perRule entries have ruleId, name, weight, status fields", async () => {
-    const result = await ailkAudit(
-      { slug: "home", type: "HomePage" },
-      CONTENT_ROOT,
-    );
-    for (const rule of result.perRule) {
-      expect(typeof rule.ruleId).toBe("string");
-      expect(typeof rule.name).toBe("string");
-      expect(typeof rule.weight).toBe("number");
-      expect(rule.status === "pass" || rule.status === "fail").toBe(true);
-    }
-  });
-
-  it("perPage entries have slug and type fields", async () => {
-    const result = await ailkAudit(
-      { slug: "home", type: "HomePage" },
-      CONTENT_ROOT,
-    );
-    expect(result.perPage).toHaveLength(1);
-    expect(result.perPage[0].slug).toBe("home");
-    expect(result.perPage[0].type).toBe("HomePage");
-  });
-
-  it("output validates against auditOutputSchema", async () => {
-    const result = await ailkAudit(
-      { slug: "home", type: "HomePage" },
-      CONTENT_ROOT,
-    );
-    const parsed = auditOutputSchema.safeParse(result);
-    expect(parsed.success).toBe(true);
-  });
-});
-
-describe("ailkAudit handler — url input (same-origin)", () => {
-  it("returns audit result for a same-origin URL", async () => {
-    const result = (await withBaseUrl(TEST_BASE_URL, () =>
-      ailkAudit({ url: `${TEST_BASE_URL}/HomePage/home` }, CONTENT_ROOT),
-    )) as Awaited<ReturnType<typeof ailkAudit>>;
-    expect(typeof result.score).toBe("number");
-    expect(result.perPage[0].slug).toBe("home");
-  });
-});
-
-describe("ailkAudit handler — cross-domain URL", () => {
-  it("throws for a cross-domain URL (no fetch attempted)", async () => {
-    await expect(
-      withBaseUrl(TEST_BASE_URL, () =>
-        ailkAudit(
-          { url: "https://evil.example.com/HomePage/page" },
-          CONTENT_ROOT,
-        ),
-      ),
-    ).rejects.toThrow(/out of scope|use `ailk audit`/i);
-  });
-});
-
-// ── Structural guards ─────────────────────────────────────────────────────────
-
-describe("structural guards", () => {
-  it("apps/mcp/src/tools/audit.ts does not call console.*", () => {
-    const src = readFileSync(
-      resolve(__dirname, "../src/tools/audit.ts"),
-      "utf-8",
-    );
-    expect(src).not.toMatch(/\bconsole\.(log|warn|error|info|debug)\b/);
-  });
-
-  it("apps/mcp/src/tools/audit.ts does not call fetch()", () => {
-    const src = readFileSync(
-      resolve(__dirname, "../src/tools/audit.ts"),
-      "utf-8",
-    );
-    // Strip comments before checking — JSDoc may mention fetch() as a negative assertion.
-    const codeOnly = src
-      .replace(/\/\*[\s\S]*?\*\//g, "")
-      .replace(/\/\/[^\n]*/g, "");
-    expect(codeOnly).not.toMatch(/\bfetch\s*\(/);
-  });
-});
-
-// ── Schema relocation parity (Phase 3 U0 / ADR 0013) ──────────────────────────
-
-describe("purchaseInputSchema relocated to @working-theory/validation", () => {
-  it("parses the same shape the inline schema parsed pre-relocation", () => {
-    const result = purchaseInputSchema.safeParse({
-      productCode: "price_test_123",
-      quantity: 2,
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("rejects an empty productCode", () => {
-    const result = purchaseInputSchema.safeParse({ productCode: "" });
-    expect(result.success).toBe(false);
-  });
-});
-
-// ── #5949 — the agent-readiness rules on the MCP audit path ───────────────────
-
-const T1_ROOT = resolve(
-  __dirname,
-  "../../../packages/aeo/__tests__/fixtures/t1-site",
-);
-const T1_CONTENT_ROOT = join(T1_ROOT, "content");
-
-const READINESS_RULE_IDS = [
-  "policies-present",
-  "offer-on-priced-page",
-  "tax-code-when-stripe-tax",
-];
-
-describe("audit — readiness rules (#5949)", () => {
-  it("AC-1: the T1 fixture site passes all three through the MCP tool", async () => {
-    const result = await ailkAudit(
-      { slug: "widget", type: "Product" },
-      T1_CONTENT_ROOT,
-      T1_ROOT,
-    );
-    for (const id of READINESS_RULE_IDS) {
-      const row = result.perRule.find((r) => r.ruleId === id);
-      expect(row).toBeDefined();
-      expect(row!.status).toBe("pass");
-    }
-  });
-
-  it("the tool's rule set is 9 rows and still validates against auditOutputSchema", async () => {
-    const result = await ailkAudit(
-      { slug: "widget", type: "Product" },
-      T1_CONTENT_ROOT,
-      T1_ROOT,
-    );
-    expect(result.perRule).toHaveLength(9);
-    expect(auditOutputSchema.safeParse(result).success).toBe(true);
-  });
-
-  it("D5: the site scan is the five READINESS_SCAN_TYPES and no more", async () => {
-    const input = await buildSinglePageAuditInput(
-      { slug: "widget", type: "Product" },
-      T1_CONTENT_ROOT,
-      T1_ROOT,
-    );
-    const scanned = new Set(input.readiness!.sitePages.map((p) => p.type));
-    expect([...scanned].sort()).toEqual([...READINESS_SCAN_TYPES].sort());
-    // The fixture publishes a HomePage; it is deliberately outside the universe.
-    expect(scanned.has("HomePage")).toBe(false);
-    expect(input.readiness!.sitePages.find((p) => p.slug === "widget")).toEqual(
-      {
-        slug: "widget",
-        type: "Product",
-        price: 49,
-        taxCode: "txcd_99999999",
-      },
-    );
-  });
-
-  it("D5 fail-open-to-pass: a site the scan finds nothing in yields sitePages: [] and three passes", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "ailk-mcp-readiness-"));
-    try {
-      mkdirSync(join(dir, "content", "en", "HomePage"), { recursive: true });
-      writeFileSync(
-        join(dir, "content", "en", "HomePage", "index.mdx"),
-        [
-          "---",
-          'type: "HomePage"',
-          'slug: "index"',
-          'title: "Nothing for sale"',
-          'description: "A site the readiness scan finds no priced page in."',
-          "---",
-          "",
-          "Body.",
-        ].join("\n"),
-        "utf8",
-      );
-
-      const input = await buildSinglePageAuditInput(
-        { slug: "index", type: "HomePage" },
-        join(dir, "content"),
-        dir,
-      );
-      expect(input.readiness!.sitePages).toEqual([]);
-
-      const result = await ailkAudit(
-        { slug: "index", type: "HomePage" },
-        join(dir, "content"),
-        dir,
-      );
-      for (const id of READINESS_RULE_IDS) {
-        expect(result.perRule.find((r) => r.ruleId === id)!.status).toBe(
-          "pass",
-        );
-      }
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("the projectRoot seam defaults to cwd when omitted (existing call sites unchanged)", async () => {
-    const result = await ailkAudit(
-      { slug: "home", type: "HomePage" },
-      CONTENT_ROOT,
-    );
-    expect(result.perRule).toHaveLength(9);
-    expect(auditOutputSchema.safeParse(result).success).toBe(true);
-  });
-});
-
-describe("readStripeTaxSignal — wiring smoke test (#6012)", () => {
-  // Not a duplicate of packages/aeo's own loadCommerceConfig suite (which
-  // covers the reader's parse/extract arms in isolation, against synthetic
-  // tmpdirs): this proves the EXPORTED apps/mcp wrapper itself is wired
-  // correctly — the directory probe delegating to loadCommerceConfig — against
-  // a real fixture file, since #6012 deleted the rest of this describe block
-  // as duplicate coverage but nothing else here exercises readStripeTaxSignal.
-  it("reads the T1 fixture's own project.yaml — Stripe Tax on", () => {
-    expect(readStripeTaxSignal(T1_ROOT)).toBe(true);
-  });
-});

package/templates/apps/mcp/__tests__/parity.test.ts

@@ -1,325 +0,0 @@
-/**
- * MCP ↔ Server-Action parity test.
- *
- * Today: trivially passes (no Server Actions in apps/web, no MCP tools yet).
- * Phase 3: every Server Action in apps/web has a matching MCP tool.
- *
- * Convention (locked in spec §3):
- *   - Server Actions live at `apps/web/**\/*.actions.ts` and export a symbol
- *     named `^[a-z][a-zA-Z0-9]*Action$` (e.g. `captureLeadAction`).
- *   - MCP tools live at `apps/mcp/src/tools/<tool>.ts` and export a symbol
- *     named `^ailk[A-Z][a-zA-Z0-9]*$` (e.g. `ailkCaptureLead`).
- *   - Mapping: `<name>Action` ↔ `ailk<Name>` (PascalCase of the action prefix).
- *
- * The harness exposes `computeParityFailures(actions, tools)` as a pure helper
- * so the populated/empty/divergent cases can be exercised without filesystem.
- * The integration case enumerates the real filesystem and runs the same helper.
- */
-
-import { readdirSync, statSync, readFileSync, existsSync } from "node:fs";
-import { resolve, join } from "node:path";
-
-import { getMcpToolRegistrations } from "@working-theory/metadata";
-
-const REPO_ROOT = resolve(__dirname, "../../..");
-const WEB_ROOT = join(REPO_ROOT, "apps/web");
-const MCP_TOOLS_ROOT = join(REPO_ROOT, "apps/mcp/src/tools");
-
-const ACTION_FILE_RE = /\.actions\.ts$/;
-const ACTION_EXPORT_RE =
-  /export\s+(?:async\s+)?(?:function|const)\s+([a-z][a-zA-Z0-9]*Action)\b/g;
-const TOOL_EXPORT_RE =
-  /export\s+(?:async\s+)?(?:function|const)\s+(ailk[A-Z][a-zA-Z0-9]*)\b/g;
-
-function walk(dir: string, out: string[] = []): string[] {
-  if (!existsSync(dir)) return out;
-  for (const entry of readdirSync(dir)) {
-    if (entry === "node_modules" || entry === "dist" || entry === ".next")
-      continue;
-    const p = join(dir, entry);
-    const s = statSync(p);
-    if (s.isDirectory()) walk(p, out);
-    else out.push(p);
-  }
-  return out;
-}
-
-export function discoverServerActions(webRoot: string = WEB_ROOT): Set<string> {
-  const found = new Set<string>();
-  for (const file of walk(webRoot)) {
-    if (!ACTION_FILE_RE.test(file)) continue;
-    const content = readFileSync(file, "utf-8");
-    for (const m of content.matchAll(ACTION_EXPORT_RE)) {
-      found.add(m[1]);
-    }
-  }
-  return found;
-}
-
-export function discoverMcpTools(
-  toolsRoot: string = MCP_TOOLS_ROOT,
-): Set<string> {
-  const found = new Set<string>();
-  if (!existsSync(toolsRoot)) return found;
-  for (const file of walk(toolsRoot)) {
-    if (!file.endsWith(".ts")) continue;
-    const content = readFileSync(file, "utf-8");
-    for (const m of content.matchAll(TOOL_EXPORT_RE)) {
-      found.add(m[1]);
-    }
-  }
-  return found;
-}
-
-/**
- * Map an action symbol (e.g. `captureLeadAction`) to its expected MCP tool
- * symbol (`ailkCaptureLead`).
- */
-export function actionToToolName(action: string): string {
-  // Strip trailing "Action" and capitalize first char.
-  const base = action.replace(/Action$/, "");
-  if (base.length === 0) return "ailk";
-  return `ailk${base[0].toUpperCase()}${base.slice(1)}`;
-}
-
-/**
- * Map a catalog tool name (e.g. `get_agent_context`) to its handler symbol
- * (`ailkGetAgentContext`) — the ADR 0013 naming the harness discovers.
- */
-export function toolNameToHandler(toolName: string): string {
-  const pascal = toolName
-    .split("_")
-    .map((part) => `${part[0].toUpperCase()}${part.slice(1)}`)
-    .join("");
-  return `ailk${pascal}`;
-}
-
-/**
- * The signed-in `/mcp/workspace` handlers (#3591 D13–D16), derived from the
- * catalog's `surface: "workspace"` entries — never a hand-kept list or count.
- * They sit outside this Server-Action harness, not inside MCP_ONLY_TOOLS: each
- * has an apps/api twin route, proven by the API ↔ MCP parity guard
- * (`tests/parity/api-parity/kinds/site.ts`), and no web Server Action.
- */
-export function workspaceSurfaceHandlers(): Set<string> {
-  return new Set(
-    getMcpToolRegistrations({ surface: "workspace" }).map((reg) =>
-      toolNameToHandler(reg.name),
-    ),
-  );
-}
-
-/**
- * MCP-only tools — tools that have no Web Server Action equivalent because
- * they are pure-read content tools. Adding a Server Action wrapper would be
- * meaningless: these tools exist to serve agent consumers, not web UI flows.
- *
- * Each entry is the camelCase MCP handler name (e.g. ailkListPages).
- * Extend this list in subsequent issues (I3–I5) as more read-only tools land.
- *
- * Note: this allow-list uses the symbol name convention (`ailk<PascalVerb>`),
- * not the MCP tool name convention (`list_pages`). The parity harness operates
- * on symbol names discovered via regex from tool source files.
- */
-const MCP_ONLY_TOOLS = new Set([
-  "ailkListPages", // list_pages — pure read, no action equivalent (I2)
-  "ailkReadContent", // read_content — pure read, no action equivalent (I2)
-  "ailkSearchContent", // search_content — pure read, no action equivalent (I4)
-  "ailkGetSiteInfo", // get_site_info — pure read, no action equivalent (I4)
-  "ailkGetBusinessHours", // get_business_hours — pure read, no action equivalent (I4)
-  "ailkGetLocations", // get_locations — pure read, no action equivalent (I4)
-  "ailkGetOfferings", // get_offerings — pure read, no action equivalent (I4)
-  "ailkGetPricing", // get_pricing — pure read, no action equivalent (I4)
-  "ailkGetFaq", // get_faq — pure read, no action equivalent (I4)
-  "ailkAudit", // audit — AEO scoring tool, no web action equivalent (I5; ADR 0013)
-  "ailkRequestCallback", // request_callback — anonymous write via MCP; no Server Action (B7)
-  "ailkCreateProject", // create_project — agent-only project creator; no Server Action equivalent (#299)
-  "ailkGetFlow", // get_flow — agent-callable flow-engine read; no web Server Action (#3956 D7)
-  "ailkListAvailability", // list_availability — anonymous scheduling read via MCP; the booker section is a client island calling apps/api directly, not a Server Action (#4416)
-  "ailkGetEventMeta", // get_event_meta — meta-only scheduling read via MCP; a tile-rendering page is an RSC calling apps/api via api-client, not a Server Action (#4633)
-  "ailkCreateBooking", // create_booking — anonymous scheduling write via MCP; same posture as subscribe_newsletter/request_callback (#4416)
-  // ailkSubmitFlowStep REMOVED (#3957 D8) — submitFlowStepAction is its web
-  // Server Action twin (apps/web/app/[locale]/flows/[slug]/flow.actions.ts).
-]);
-
-/**
- * Server Actions that are intentionally WEB-ONLY — a RECORDED exception to the
- * API ↔ MCP parity contract, not a gap. The mirror of MCP_ONLY_TOOLS: an
- * action listed here is excluded from missing-tool reporting.
- *
- * Note: this allow-list uses the action's exported symbol name
- * (`<verb>Action`), exactly as discovered from `apps/web/**\/*.actions.ts`.
- */
-const WEB_ONLY_ACTIONS = new Set([
-  // The recommender's email moment (#4841 → POST /v1/flows/:slug/save and
-  // /checkout; consumed by the web Server Actions in #4842's
-  // apps/web/app/[locale]/flows/[slug]/checkout.actions.ts). No MCP twin —
-  // the recorded exception in apps/api/CLAUDE.md (the `/v1/flows/:slug/save`
-  // + `/checkout` row, #4841): "an agent walking a flow has no email to give
-  // and no card to pay with; the anonymous MCP surface is identity-blind."
-  "startCheckoutAction", // checkout.actions.ts — Pay → Stripe TEST-mode hosted Checkout (#4842 D7)
-  "saveRecommendationAction", // checkout.actions.ts — "Email me this plan" → flows.save (#4842 D7)
-]);
-
-/**
- * Pure parity computation. Given the set of action symbols and the set of
- * MCP tool symbols, return the missing-tool and orphan-tool sets.
- *
- * Tools in MCP_ONLY_TOOLS are excluded from orphan reporting — they are
- * intentionally MCP-only and have no Server Action counterpart. Actions in
- * WEB_ONLY_ACTIONS are excluded from missing-tool reporting — they are
- * intentionally web-only and have no MCP tool counterpart.
- */
-export function computeParityFailures(
-  actions: Set<string>,
-  tools: Set<string>,
-): { missingTools: string[]; orphanTools: string[] } {
-  const expected = new Set<string>();
-  for (const a of actions) {
-    if (WEB_ONLY_ACTIONS.has(a)) continue;
-    expected.add(actionToToolName(a));
-  }
-
-  const missingTools: string[] = [];
-  for (const e of expected) if (!tools.has(e)) missingTools.push(e);
-
-  const orphanTools: string[] = [];
-  for (const t of tools) {
-    if (!expected.has(t) && !MCP_ONLY_TOOLS.has(t)) orphanTools.push(t);
-  }
-
-  missingTools.sort();
-  orphanTools.sort();
-  return { missingTools, orphanTools };
-}
-
-// ── Tests ────────────────────────────────────────────────────────────────────
-
-describe("MCP ↔ Server-Action parity (helper)", () => {
-  it("trivially passes when both sides are empty", () => {
-    const r = computeParityFailures(new Set(), new Set());
-    expect(r.missingTools).toEqual([]);
-    expect(r.orphanTools).toEqual([]);
-  });
-
-  it("reports missing MCP tools when an action has no matching tool", () => {
-    const actions = new Set(["captureLeadAction"]);
-    const tools = new Set<string>();
-    const r = computeParityFailures(actions, tools);
-    expect(r.missingTools).toEqual(["ailkCaptureLead"]);
-    expect(r.orphanTools).toEqual([]);
-  });
-
-  it("reports orphan MCP tools when a tool has no matching action", () => {
-    const actions = new Set<string>();
-    const tools = new Set(["ailkPurchase"]);
-    const r = computeParityFailures(actions, tools);
-    expect(r.missingTools).toEqual([]);
-    expect(r.orphanTools).toEqual(["ailkPurchase"]);
-  });
-
-  it("passes when actions and tools are paired", () => {
-    const actions = new Set(["captureLeadAction", "purchaseAction"]);
-    const tools = new Set(["ailkCaptureLead", "ailkPurchase"]);
-    const r = computeParityFailures(actions, tools);
-    expect(r.missingTools).toEqual([]);
-    expect(r.orphanTools).toEqual([]);
-  });
-
-  it("skips WEB_ONLY_ACTIONS when computing missing tools (the recorded #4841 exception)", () => {
-    const actions = new Set([
-      "captureLeadAction",
-      "startCheckoutAction",
-      "saveRecommendationAction",
-    ]);
-    const tools = new Set(["ailkCaptureLead"]);
-    const r = computeParityFailures(actions, tools);
-    expect(r.missingTools).toEqual([]);
-    expect(r.orphanTools).toEqual([]);
-  });
-
-  it("maps action names to tool names by stripping Action and prefixing ailk", () => {
-    expect(actionToToolName("captureLeadAction")).toBe("ailkCaptureLead");
-    expect(actionToToolName("purchaseAction")).toBe("ailkPurchase");
-    expect(actionToToolName("auditAction")).toBe("ailkAudit");
-  });
-
-  it("maps catalog tool names to handler symbols by PascalCasing and prefixing ailk", () => {
-    expect(toolNameToHandler("get_agent_context")).toBe("ailkGetAgentContext");
-    expect(toolNameToHandler("mark_inbox_message_done")).toBe(
-      "ailkMarkInboxMessageDone",
-    );
-  });
-});
-
-describe("MCP ↔ Server-Action parity (filesystem)", () => {
-  it("post-#4842 state: five Server Actions (purchaseAction + captureLeadAction + submitFlowStepAction + the two web-only startCheckoutAction + saveRecommendationAction), twenty-three MCP tools, zero orphans", () => {
-    const actions = discoverServerActions();
-    const discovered = discoverMcpTools();
-    const workspaceHandlers = workspaceSurfaceHandlers();
-    // The anonymous-surface handlers — what this harness has always counted.
-    // The signed-in handlers are set aside and checked against the catalog
-    // below, so a handler the catalog does not name lands here and fails.
-    const tools = new Set(
-      [...discovered].filter((t) => !workspaceHandlers.has(t)),
-    );
-    const r = computeParityFailures(actions, tools);
-
-    // After D14a Stage 1 Unit C (#55) + #3956 (get_flow/submit_flow_step) +
-    // #3957 (submitFlowStepAction — the web Server Action twin of
-    // ailkSubmitFlowStep): twenty tools + three paired Server Actions.
-    // - ailkPurchase: paired with purchaseAction (apps/web/app/dev/purchase/).
-    // - ailkCaptureLead: paired with captureLeadAction (apps/web/app/contact/).
-    // - ailkSubscribeNewsletter: paired with subscribeNewsletterAction
-    //   (apps/web/app/[locale]/newsletter/newsletter.actions.ts, #6730 D9).
-    // - ailkSubmitFlowStep: paired with submitFlowStepAction
-    //   (apps/web/app/[locale]/flows/[slug]/flow.actions.ts, #3957).
-    // - startCheckoutAction, saveRecommendationAction: WEB-ONLY (#4842 D7,
-    //   apps/web/app/[locale]/flows/[slug]/checkout.actions.ts) — the HTTP
-    //   twins are POST /v1/flows/:slug/checkout and /save (#4841); no MCP
-    //   twin by the recorded apps/api/CLAUDE.md exception (an agent walking
-    //   a flow has no email to give and no card to pay with; the anonymous
-    //   MCP surface is identity-blind). In WEB_ONLY_ACTIONS.
-    // - ailkListPages, ailkReadContent: MCP-only (pure read; I2)
-    // - ailkSearchContent, ailkGetSiteInfo, ailkGetBusinessHours,
-    //   ailkGetLocations, ailkGetOfferings, ailkGetPricing, ailkGetFaq:
-    //   MCP-only (pure read; I4; in MCP_ONLY_TOOLS allow-list).
-    // - ailkAudit: MCP-only (AEO scoring; I5; in MCP_ONLY_TOOLS allow-list).
-    // - ailkRequestCallback: MCP-only anonymous-write tool (B7; in
-    //   MCP_ONLY_TOOLS allow-list).
-    // - ailkCreateProject: MCP-only agent project creator (#299; in MCP_ONLY_TOOLS).
-    // - ailkCreatePage, ailkUpdatePage, ailkDeletePage: RETIRED by #5853
-    //   (D7). Their HTTP twins — the untenanted /v1/content writes — were
-    //   deleted in the same PR, so keeping the tools would have left three
-    //   MCP tools with no HTTP equivalent, a direct breach of the parity rule
-    //   this file enforces. Their replacement is identity-BOUND
-    //   (/v1/workspaces/:workspaceId/content), which the identity-blind
-    //   anonymous MCP surface can never carry (D15); the authed MCP surface
-    //   is #3591.
-    // - ailkGetFlow: MCP-only agent-callable flow-engine read; HTTP twin is
-    //   apps/api, not a Server Action (#3956 D7) — the page fetch in
-    //   apps/web/app/[locale]/flows/[slug]/page.tsx is a direct api-client
-    //   call in an RSC, not a Server Action.
-    // - ailkListAvailability, ailkCreateBooking: MCP-only scheduling twins of
-    //   GET /v1/schedule/availability and POST /v1/schedule/book (#4416). The
-    //   `booker` section is a "use client" island that fetches those routes
-    //   directly (the ContactForm/StepFlow pattern) — no Server Action, so
-    //   the HTTP twin is apps/api.
-    // - ailkGetEventMeta: MCP-only meta-only scheduling read, twin of
-    //   GET /v1/schedule/event-meta (#4633) — same posture as the other
-    //   scheduling tools.
-    expect(actions.size).toBe(6);
-    expect(tools.size).toBe(20);
-    expect(r.missingTools).toEqual([]);
-    expect(r.orphanTools).toEqual([]);
-  });
-
-  it("every catalog workspace-surface tool has its handler under src/tools/, and no other signed-in handler exists (#3591 D16)", () => {
-    const discovered = discoverMcpTools();
-    const workspaceHandlers = workspaceSurfaceHandlers();
-    expect(workspaceHandlers.size).toBeGreaterThan(0);
-    expect(
-      [...discovered].filter((t) => workspaceHandlers.has(t)).sort(),
-    ).toEqual([...workspaceHandlers].sort());
-  });
-});