create-ailk 0.18.0 → 0.19.0

package/templates/apps/mcp/CLAUDE.md

@@ -44,7 +44,8 @@ Inherits root `CLAUDE.md`. This file adds MCP-specific rules.
   that proxy. It is a function, not `trustProxy: 1`, because Fastify 5.12 treats a numeric
   hop count as trusting nothing. The long-running entry trusts no proxy.
 - **Per address, per instance.** 60 requests a minute across reads and writes (the write rate
-  is parsed but not enforced); `capture_lead` 50 a day and `start_purchase` 20 a day.
+  is parsed but not enforced); `capture_lead` 50 a day, `start_purchase` 20 a day,
+  `create_booking` 20 a day and `submit_flow_step` 50 a day, each on its own budget.
   `subscribe_newsletter` and `request_callback` have no daily cap. Each warm instance counts
   on its own and a cold start resets the counts, so a caller reaching N instances gets up to
   N times each limit.
@@ -70,11 +71,13 @@ Every tool maps 1:1 to an `apps/api` endpoint. When you change a tool, change th
 
 ## The free anonymous tools (enabled at launch)
 
+**The HTTP write branch (6).** `WRITE_TOOLS` in `src/http-transport.ts` — `capture_lead`, `subscribe_newsletter`, `request_callback`, `start_purchase`, `create_booking`, `submit_flow_step` — takes the write-origin allow-list and the AbuseGuard (UA, honeypot, email format, per-IP daily cap); every other tool takes the read branch (UA only). A tool that sends caller-chosen data to the hub belongs in it: `__tests__/write-tool-guard.test.ts` fails when a catalog tool that sends a non-GET request through `@working-theory/api-client` is missing, and makes every new catalog tool pick a branch (#8071).
+
 **Read (9):** `list_pages`, `read_content`, `search_content`, `get_site_info`, `get_business_hours`, `get_locations`, `get_offerings`, `get_pricing`, `get_faq`
 **Conversion-write (3):** `capture_lead`, `subscribe_newsletter`, `request_callback`
 **Maintenance (2):** `audit`, `create_project`
-**Flow (2):** `get_flow`, `submit_flow_step` — module-gated (`module: "signal-collectors"`, D-48, #5366) and licence-feature-tagged (`feature: "flows-deliverables"`, #7136): identity-blind like every tool in this list, registered only when the signal-collectors module is present, and gated on the deployment's `flows-deliverables` licence feature under `MCP_FEATURE_GATE_MODE`, the same shape Booking below has
-**Booking (3):** `list_availability`, `get_event_meta`, `create_booking` — module-gated (`module: "scheduling"`) and licence-feature-tagged (`feature: "scheduling"`, #7136), gated on the deployment's `scheduling` licence feature under `MCP_FEATURE_GATE_MODE`
+**Flow (2):** `get_flow`, `submit_flow_step` — module-gated (`module: "signal-collectors"`, D-48, #5366) and licence-feature-tagged (`feature: "flows-deliverables"`, #7136): identity-blind like every tool in this list, registered only when the signal-collectors module is present, and gated on the deployment's `flows-deliverables` licence feature under `MCP_FEATURE_GATE_MODE`, the same shape Booking below has. `submit_flow_step` takes the HTTP write branch (its own daily cap, `MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP`, default 50 — #8071)
+**Booking (3):** `list_availability`, `get_event_meta`, `create_booking` — module-gated (`module: "scheduling"`) and licence-feature-tagged (`feature: "scheduling"`, #7136), gated on the deployment's `scheduling` licence feature under `MCP_FEATURE_GATE_MODE`. `create_booking` takes the HTTP write branch (its own daily cap, `MCP_ABUSE_CREATE_BOOKING_DAILY_CAP`, default 20, and an `attendee.email` format check — #8071)
 
 ### Why the parity test counts 20 and a keyless server registers 19
 
@@ -208,7 +211,9 @@ Example (lead routing):
 - Don't add a tool without the matching `apps/api` endpoint.
 - Don't put business logic in tool handlers — they're adapters.
 
-Last updated: 2026-10-10 — #8070 (amendment 2): the Vercel entry exports a handler, no `vercel.json`; § Two entrypoints, one boot — the Vercel entry `src/app.ts`, the shared `src/boot.ts`, `MCP_HTTP_STATELESS`, `mcpContentRoot()`, `create_project` withheld on a spoke, and what a spoke's MCP host enforces — verified against `apps/mcp/src/{app,boot,serverless-app,index,http-transport,server}.ts` and `lib/content-adapter.ts`.
+Last updated: 2026-10-10 — #8071: `create_booking` and `submit_flow_step` join the HTTP write branch — § The free anonymous tools names its six members, the Booking and Flow rows record it, and § What a spoke's MCP host on Vercel enforces lists the two new daily caps — verified against `apps/mcp/src/http-transport.ts` and `apps/mcp/src/abuse/index.ts`.
+
+Prior: 2026-10-10 — #8070 (amendment 2): the Vercel entry exports a handler, no `vercel.json`; § Two entrypoints, one boot — the Vercel entry `src/app.ts`, the shared `src/boot.ts`, `MCP_HTTP_STATELESS`, `mcpContentRoot()`, `create_project` withheld on a spoke, and what a spoke's MCP host enforces — verified against `apps/mcp/src/{app,boot,serverless-app,index,http-transport,server}.ts` and `lib/content-adapter.ts`.
 
 Prior: 2026-10-04 — #3591 PR-E (#7684): the identity-blind rule is scoped to the anonymous `/mcp`, and the new § The signed-in workspace surface records `/mcp/workspace` — POST-only and stateless, an agent key per request forwarded to each tool's apps/api twin, eleven `surface: "workspace"` catalog rows that are parity `twin`s and never in the discovery manifest — verified against `apps/mcp/src/http-transport.ts`, `apps/mcp/src/workspace-server.ts` and `packages/metadata/src/mcp-tool-catalog.ts`.
 

package/templates/apps/mcp/LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -137,8 +138,8 @@
 
    6. Trademarks. This License does not grant permission to use the trade
       names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
 
    7. Disclaimer of Warranty. Unless required by applicable law or
       agreed to in writing, Licensor provides the Work (and each
@@ -162,7 +163,7 @@
       other commercial damages or losses), even if such Contributor
       has been advised of the possibility of such damages.
 
-   9. Accepting Warranty or Support. While redistributing
+   9. Accepting Warranty or Additional Liability. While redistributing
       the Work or Derivative Works thereof, You may choose to offer,
       and charge a fee for, acceptance of support, warranty, indemnity,
       or other liability obligations and/or rights consistent with this
@@ -171,7 +172,7 @@
       of any other Contributor, and only if You agree to indemnify,
       defend, and hold each Contributor harmless for any liability
       incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or support.
+      of your accepting any such warranty or additional liability.
 
    END OF TERMS AND CONDITIONS
 
@@ -186,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2026 Tailwind AI
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/templates/apps/mcp/NOTICE

@@ -0,0 +1,2 @@
+AI Launch Kit
+Copyright 2026 SalesSmyth LLC

package/templates/apps/mcp/__tests__/abuse/guard.test.ts

@@ -0,0 +1,198 @@
+/**
+ * Guard-level tests for abuse/index.ts — the AbuseGuard as a whole, where
+ * daily-cap.test.ts and its siblings test one rule each (#8071).
+ *
+ * Pins:
+ * - AC-4: the four daily-capped tools (capture_lead, start_purchase,
+ *   create_booking, submit_flow_step) each spend their OWN tracker — spending
+ *   one tool's budget from an IP leaves the other three callable from it.
+ * - AC-5: a blank or non-numeric MCP_ABUSE_CREATE_BOOKING_DAILY_CAP /
+ *   MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP yields the default cap (20 / 50),
+ *   never an unlimited one: the call at default + 1 is refused.
+ * - D3: create_booking's attendee.email is format-checked, and a non-object
+ *   attendee is treated as a missing email rather than throwing.
+ */
+
+import type { FastifyRequest } from "fastify";
+
+import {
+  AbuseGuard,
+  AbuseReasonCode,
+  createAbuseGuardFromEnv,
+  DEFAULT_CREATE_BOOKING_DAILY_CAP,
+  DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP,
+} from "../../src/abuse/index.js";
+
+/** A stub carrying only the two members the guard reads. */
+function requestFrom(ip: string): FastifyRequest {
+  // @ts-expect-error: a full FastifyRequest cannot be built without a server.
+  return {
+    headers: { "user-agent": "Mozilla/5.0 (compatible; TestAgent/1.0)" },
+    ip,
+  };
+}
+
+const CAPPED_TOOLS = [
+  "capture_lead",
+  "start_purchase",
+  "create_booking",
+  "submit_flow_step",
+] as const;
+
+describe("AbuseGuard — each daily-capped tool spends its own tracker (AC-4)", () => {
+  it.each(CAPPED_TOOLS)(
+    "exhausting %s leaves the other three callable from the same IP",
+    (spent) => {
+      const guard = new AbuseGuard({
+        captureLeadDailyCapPerIp: 1,
+        startPurchaseDailyCapPerIp: 1,
+        createBookingDailyCapPerIp: 1,
+        submitFlowStepDailyCapPerIp: 1,
+        blockedUserAgents: "",
+      });
+      const request = requestFrom("198.51.100.4");
+
+      expect(guard.validate(spent, {}, request).allowed).toBe(true);
+      const refused = guard.validate(spent, {}, request);
+      expect(refused).toMatchObject({
+        allowed: false,
+        code: AbuseReasonCode.DAILY_CAP_REACHED,
+      });
+
+      for (const other of CAPPED_TOOLS.filter((t) => t !== spent)) {
+        expect(guard.validate(other, {}, request).allowed).toBe(true);
+      }
+    },
+  );
+});
+
+describe("createAbuseGuardFromEnv — a blank or non-numeric cap falls back to the default (AC-5)", () => {
+  const CASES = [
+    {
+      toolName: "create_booking",
+      envVar: "MCP_ABUSE_CREATE_BOOKING_DAILY_CAP",
+      defaultCap: DEFAULT_CREATE_BOOKING_DAILY_CAP,
+    },
+    {
+      toolName: "submit_flow_step",
+      envVar: "MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP",
+      defaultCap: DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP,
+    },
+  ] as const;
+
+  afterEach(() => {
+    for (const { envVar } of CASES) delete process.env[envVar];
+  });
+
+  it("the defaults are 20 bookings and 50 flow steps per IP per day", () => {
+    expect(DEFAULT_CREATE_BOOKING_DAILY_CAP).toBe(20);
+    expect(DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP).toBe(50);
+  });
+
+  describe.each(CASES)("$envVar", ({ toolName, envVar, defaultCap }) => {
+    it.each(["", "abc"])("set to %p refuses the call at default + 1", (raw) => {
+      process.env[envVar] = raw;
+      const guard = createAbuseGuardFromEnv();
+      const request = requestFrom("198.51.100.5");
+
+      for (let i = 0; i < defaultCap; i += 1) {
+        expect(guard.validate(toolName, {}, request).allowed).toBe(true);
+      }
+      expect(guard.validate(toolName, {}, request)).toMatchObject({
+        allowed: false,
+        code: AbuseReasonCode.DAILY_CAP_REACHED,
+      });
+    });
+
+    it("set to a positive integer uses that cap", () => {
+      process.env[envVar] = "3";
+      const guard = createAbuseGuardFromEnv();
+      const request = requestFrom("198.51.100.6");
+
+      for (let i = 0; i < 3; i += 1) {
+        expect(guard.validate(toolName, {}, request).allowed).toBe(true);
+      }
+      expect(guard.validate(toolName, {}, request).allowed).toBe(false);
+    });
+  });
+});
+
+describe("AbuseGuard — create_booking's attendee.email (D3)", () => {
+  const guard = () =>
+    new AbuseGuard({ captureLeadDailyCapPerIp: 50, blockedUserAgents: "" });
+
+  it("refuses a malformed attendee.email with INVALID_EMAIL", () => {
+    const result = guard().validate(
+      "create_booking",
+      { attendee: { name: "Ada", email: "not-an-email" } },
+      requestFrom("198.51.100.7"),
+    );
+
+    expect(result).toMatchObject({
+      allowed: false,
+      code: AbuseReasonCode.INVALID_EMAIL,
+    });
+  });
+
+  it("allows a well-formed attendee.email", () => {
+    const result = guard().validate(
+      "create_booking",
+      { attendee: { name: "Ada", email: "ada@example.com" } },
+      requestFrom("198.51.100.8"),
+    );
+
+    expect(result.allowed).toBe(true);
+  });
+
+  it("does not read a top-level email for create_booking", () => {
+    const result = guard().validate(
+      "create_booking",
+      { email: "not-an-email", attendee: { email: "ada@example.com" } },
+      requestFrom("198.51.100.9"),
+    );
+
+    expect(result.allowed).toBe(true);
+  });
+
+  it.each([undefined, null, "ada@example.com", ["not-an-email"], 7, {}])(
+    "treats attendee %p as a missing email — allowed, never a throw",
+    (attendee) => {
+      expect(() =>
+        guard().validate(
+          "create_booking",
+          { attendee },
+          requestFrom("198.51.100.10"),
+        ),
+      ).not.toThrow();
+      expect(
+        guard().validate(
+          "create_booking",
+          { attendee },
+          requestFrom("198.51.100.10"),
+        ).allowed,
+      ).toBe(true);
+    },
+  );
+
+  it("tolerates a non-object input", () => {
+    for (const input of [null, "x", 3]) {
+      expect(
+        guard().validate("create_booking", input, requestFrom("198.51.100.11"))
+          .allowed,
+      ).toBe(true);
+    }
+  });
+
+  it("still reads capture_lead's top-level email", () => {
+    const result = guard().validate(
+      "capture_lead",
+      { email: "not-an-email" },
+      requestFrom("198.51.100.12"),
+    );
+
+    expect(result).toMatchObject({
+      allowed: false,
+      code: AbuseReasonCode.INVALID_EMAIL,
+    });
+  });
+});

package/templates/apps/mcp/__tests__/audit-single-page.test.ts

@@ -231,10 +231,22 @@ describe("buildSinglePageAuditInput — sitewide identity (#6597 AC-7)", () => {
     expect(evidenceOf(report, "schema-coverage")?.pass).toBe(true);
   });
 
-  it("the monorepo home finds the identity: Identity (organization) ✓", async () => {
+  // The content root's own _site.mdx names the site's identity kind: the monorepo's is
+  // Organization, a person-service scaffold's is Person. Read it, don't hard-code it (#8419).
+  const siteKind = (): "Organization" | "Person" => {
+    const site = readFileSync(join(CONTENT_ROOT, "_site.mdx"), "utf-8");
+    const kind = /^siteIdentity:\s*\n(?:[ \t]+.*\n)*?[ \t]+kind:\s*["']?(\w+)["']?\s*$/m.exec(site)?.[1];
+    if (kind !== "Organization" && kind !== "Person") {
+      throw new Error(`content/_site.mdx siteIdentity.kind is not Organization or Person: ${String(kind)}`);
+    }
+    return kind;
+  };
+
+  it("the content root's home finds the identity its _site.mdx names", async () => {
+    const kind = siteKind();
     const report = await auditOf({ slug: "home" }, CONTENT_ROOT);
     expect(evidenceOf(report, "entity-markup")?.evidence).toContain(
-      "Identity (organization) ✓",
+      `Identity (${kind.toLowerCase()}) ✓`,
     );
   });
 
@@ -243,7 +255,7 @@ describe("buildSinglePageAuditInput — sitewide identity (#6597 AC-7)", () => {
     const nodes = input.jsonLdByPage["AboutPage/about"] as Array<Record<string, unknown>>;
     expect(nodes[0]!["@type"]).toBe("AboutPage");
     expect(nodes.map((n) => n["@type"])).toEqual(
-      expect.arrayContaining(["Organization", "WebSite"]),
+      expect.arrayContaining([siteKind(), "WebSite"]),
     );
   });
 

package/templates/apps/mcp/__tests__/boot.test.ts

@@ -10,13 +10,23 @@
  * - AC-3: a bad value throws naming the variable; a blank per-minute rate
  *   falls back to its default rather than disabling the limit.
  *
+ * And from spec docs/specs/8071-mcp-write-guard-spec.md:
+ * - AC-5: a blank or non-numeric MCP_ABUSE_CREATE_BOOKING_DAILY_CAP /
+ *   MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP yields the default cap through the
+ *   env reader both entries share, never an unlimited one.
+ *
  * Real sockets on port 0, the pattern of `http-transport.test.ts`.
  */
 
 import type { AddressInfo } from "node:net";
 
-import type { FastifyInstance } from "fastify";
+import type { FastifyInstance, FastifyRequest } from "fastify";
 
+import {
+  AbuseGuard,
+  DEFAULT_CREATE_BOOKING_DAILY_CAP,
+  DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP,
+} from "../src/abuse/index.js";
 import { httpTransportConfigFromEnv, readStatelessEnv } from "../src/boot.js";
 import { buildHttpTransportApp } from "../src/http-transport.js";
 
@@ -29,6 +39,8 @@ const VARS = [
   "MCP_CORS_WRITE_ALLOWED_ORIGINS",
   "MCP_ABUSE_CAPTURE_LEAD_DAILY_CAP",
   "MCP_ABUSE_START_PURCHASE_DAILY_CAP",
+  "MCP_ABUSE_CREATE_BOOKING_DAILY_CAP",
+  "MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP",
   "MCP_ABUSE_BLOCKED_USER_AGENTS",
 ] as const;
 
@@ -49,6 +61,15 @@ afterEach(() => {
   }
 });
 
+/** A stub carrying only the two members the guard reads. */
+function requestFrom(ip: string): FastifyRequest {
+  // @ts-expect-error: a full FastifyRequest cannot be built without a server.
+  return {
+    headers: { "user-agent": "Mozilla/5.0 (compatible; TestAgent/1.0)" },
+    ip,
+  };
+}
+
 const TOOLS_LIST = { jsonrpc: "2.0", id: 1, method: "tools/list", params: {} };
 
 async function listen(app: FastifyInstance): Promise<number> {
@@ -172,6 +193,8 @@ describe("httpTransportConfigFromEnv — today's reading of every other variable
       abuse: {
         captureLeadDailyCapPerIp: 50,
         startPurchaseDailyCapPerIp: 20,
+        createBookingDailyCapPerIp: 20,
+        submitFlowStepDailyCapPerIp: 50,
         blockedUserAgents: "",
       },
     });
@@ -186,6 +209,8 @@ describe("httpTransportConfigFromEnv — today's reading of every other variable
       "https://a.example, https://b.example";
     process.env["MCP_ABUSE_CAPTURE_LEAD_DAILY_CAP"] = "3";
     process.env["MCP_ABUSE_START_PURCHASE_DAILY_CAP"] = "2";
+    process.env["MCP_ABUSE_CREATE_BOOKING_DAILY_CAP"] = "4";
+    process.env["MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP"] = "5";
     process.env["MCP_ABUSE_BLOCKED_USER_AGENTS"] = "BadBot";
 
     expect(httpTransportConfigFromEnv()).toEqual({
@@ -196,8 +221,60 @@ describe("httpTransportConfigFromEnv — today's reading of every other variable
       abuse: {
         captureLeadDailyCapPerIp: 3,
         startPurchaseDailyCapPerIp: 2,
+        createBookingDailyCapPerIp: 4,
+        submitFlowStepDailyCapPerIp: 5,
         blockedUserAgents: "BadBot",
       },
     });
   });
 });
+
+// #8071 AC-5, through the wiring both entries use: the env value reaches the
+// AbuseGuard the HTTP transport builds from `config.abuse`
+// (http-transport.ts). A guard built straight from AbuseConfig cannot show
+// this — it defaults an absent cap on its own — so each case also pins the
+// value httpTransportConfigFromEnv() returns.
+describe("#8071 AC-5 — the booking and flow-step caps reach the guard both entries build", () => {
+  const CASES = [
+    {
+      toolName: "create_booking",
+      envVar: "MCP_ABUSE_CREATE_BOOKING_DAILY_CAP",
+      field: "createBookingDailyCapPerIp",
+      defaultCap: DEFAULT_CREATE_BOOKING_DAILY_CAP,
+    },
+    {
+      toolName: "submit_flow_step",
+      envVar: "MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP",
+      field: "submitFlowStepDailyCapPerIp",
+      defaultCap: DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP,
+    },
+  ] as const;
+
+  /** Calls `toolName` until refused; returns how many calls were allowed. */
+  function allowedCalls(toolName: string, limit: number): number {
+    const guard = new AbuseGuard(httpTransportConfigFromEnv().abuse);
+    const request = requestFrom("198.51.100.7");
+    let allowed = 0;
+    while (allowed <= limit && guard.validate(toolName, {}, request).allowed) {
+      allowed += 1;
+    }
+    return allowed;
+  }
+
+  describe.each(CASES)("$envVar", ({ toolName, envVar, field, defaultCap }) => {
+    it.each(["", "abc"])(
+      "set to %p yields the default cap, refusing the call at default + 1",
+      (raw) => {
+        process.env[envVar] = raw;
+        expect(httpTransportConfigFromEnv().abuse[field]).toBe(defaultCap);
+        expect(allowedCalls(toolName, defaultCap)).toBe(defaultCap);
+      },
+    );
+
+    it("set to a positive integer, the guard refuses the call past that cap", () => {
+      process.env[envVar] = "3";
+      expect(httpTransportConfigFromEnv().abuse[field]).toBe(3);
+      expect(allowedCalls(toolName, defaultCap)).toBe(3);
+    });
+  });
+});