create-ailk 0.19.1 → 0.20.0

package/templates/apps/web/app/[locale]/(authed)/account/artifacts/artifact-actions.ts

@@ -3,9 +3,12 @@
 /**
  * artifacts/artifact-actions.ts — the review write (#8234, spec
  * docs/specs/8234-member-artifacts-account-artifacts-and-spec.md D6; the
- * write is #8170's `POST /v1/member/artifacts/:pieceId/review`).
+ * write is #8170's `POST /v1/member/artifacts/:pieceId/review`) and a
+ * proposal's payment (#8516, spec
+ * docs/specs/8516-proposals-as-an-artifact-kind-spec.md D19; the write is
+ * `POST /v1/member/artifacts/:pieceId/payment`).
  *
- * One export: `submitArtifactReview`, the review form's action. It posts
+ * `submitArtifactReview`, the review form's action, posts
  * Approve or Request changes on a piece's latest version through
  * `member.reviewArtifact` with `forwardedCookieInit()`'s init as built — the
  * session cookie plus the request's `Origin` on a single site, the hub
@@ -15,22 +18,38 @@
  * `pieceId` and `version` are untrusted: they are shape-checked here, and the
  * API scopes them to the Person the credential resolves.
  *
+ * A proposal's payment (#8516 D19). An approval whose answered artifact owes
+ * a payment (`paymentDue`) goes straight on to it; `payForProposal`, the Pay
+ * now form's action, does the same from the artifact page. Both run the one
+ * private `startProposalPayment`: `member.payArtifact` with the same init,
+ * then `redirect()` — only to a URL `isStripeCheckoutUrl` admits, so the
+ * client is never sent anywhere but Stripe's hosted Checkout page. The
+ * amount is the API's, from the stored proposal; nothing posted here names
+ * one. Any other outcome is `payment_failed`, and the review stays recorded,
+ * so the page offers Pay now. `redirect()` throws `NEXT_REDIRECT` by design,
+ * so it is called outside any try/catch (`../actions.ts`'s idiom).
+ *
  * Not a `*.actions.ts` file and no `*Action`-suffixed export: apps/mcp's
  * parity test reads that suffix, and the member writes have no MCP twin by
  * decision (8170's header). The reads the pages share live in
  * `artifact-data.ts`, never here — every export of this module is a POST
- * endpoint. A log line carries `err.name` only — never the comment or an id.
+ * endpoint. A log line carries `err.name` only — never the comment, an id
+ * or a Checkout URL.
  */
 
 import { member } from "@working-theory/api-client";
 import {
+  isStripeCheckoutUrl,
   memberReviewBodySchema,
   memberReviewParamsSchema,
   type MemberReviewBody,
 } from "@working-theory/validation";
+import { redirect } from "next/navigation";
 
 import { forwardedCookieInit } from "../../../../../lib/server-api";
 
+import { paymentDue } from "./artifact-data";
+
 /** What the review form shows after a submit. */
 export type ArtifactReviewState =
   | { kind: "idle" }
@@ -42,7 +61,8 @@ export type ArtifactReviewState =
         | "closed"
         | "not_latest"
         | "rate_limited"
-        | "failed";
+        | "failed"
+        | "payment_failed";
     };
 
 export type ArtifactReviewReason = Extract<
@@ -50,6 +70,12 @@ export type ArtifactReviewReason = Extract<
   { kind: "error" }
 >["reason"];
 
+/** What the Pay now form shows after a submit that did not leave for Stripe. */
+export type ProposalPayState =
+  { kind: "idle" } | { kind: "error"; reason: "payment_failed" };
+
+const PAYMENT_FAILED = { kind: "error", reason: "payment_failed" } as const;
+
 function error(reason: ArtifactReviewReason): ArtifactReviewState {
   return { kind: "error", reason };
 }
@@ -119,5 +145,40 @@ export async function submitArtifactReview(
     return error("failed");
   }
   if (!res.ok) return error(refusalReason(res.status, res.body));
+  if (body.review === "approved" && paymentDue(res.body.artifact))
+    return startProposalPayment(pieceId);
   return { kind: "reviewed" };
 }
+
+/** Pay now: open the approved proposal's payment and go to it. */
+export async function payForProposal(
+  _prev: ProposalPayState,
+  formData: FormData,
+): Promise<ProposalPayState> {
+  const pieceId = field(formData, "pieceId");
+  if (!memberReviewParamsSchema.safeParse({ pieceId }).success)
+    return PAYMENT_FAILED;
+  return startProposalPayment(pieceId);
+}
+
+/**
+ * Ask the API for the proposal's Stripe Checkout page and redirect there.
+ * Never returns on success; anything short of a Stripe Checkout URL is
+ * `payment_failed`.
+ */
+async function startProposalPayment(
+  pieceId: string,
+): Promise<typeof PAYMENT_FAILED> {
+  let url: string | null = null;
+  try {
+    const res = await member.payArtifact(pieceId, await forwardedCookieInit());
+    if (res.ok && isStripeCheckoutUrl(res.body.url)) url = res.body.url;
+  } catch (err) {
+    console.error(
+      `[account] payment failed errName=${err instanceof Error ? err.name : "unknown"}`,
+    );
+  }
+  if (url === null) return PAYMENT_FAILED;
+  // Outside any try/catch on purpose — see the file header.
+  redirect(url);
+}

package/templates/apps/web/app/[locale]/(authed)/account/artifacts/artifact-data.ts

@@ -64,6 +64,23 @@ export function isReviewable(a: MemberArtifact): boolean {
   return a.approvedAt === null && a.versions[0]?.review === null;
 }
 
+/**
+ * True for a proposal (#8516 D19). An older hub serves no `kind` (D4: the
+ * key is optional), and such an artifact is a deliverable.
+ */
+export function isProposal(a: MemberArtifact): boolean {
+  return a.kind === "proposal";
+}
+
+/**
+ * True while an approved, priced proposal waits on the client's payment
+ * (#8516 D19). The API serves `due` only where a payment surface answers,
+ * so anything else — `null`, `paid` or an older hub's missing key — is not.
+ */
+export function paymentDue(a: MemberArtifact): boolean {
+  return a.payment?.status === "due";
+}
+
 /** The artifact page of one piece. */
 export function artifactHref(locale: string, pieceId: string): string {
   return localeHref(

package/templates/apps/web/app/[locale]/(authed)/account/artifacts/page.tsx

@@ -18,6 +18,10 @@
  * failed read renders today's error row with Retry and no frame (spec 7423
  * D12). Nothing here tests the topology: the same file serves a single site
  * and a hub-mode spoke.
+ *
+ * A proposal (#8516, spec docs/specs/8516-proposals-as-an-artifact-kind-spec.md
+ * D19) reads "Proposal · Version <n>" in its caption and Latest cell; a
+ * deliverable reads as before.
  */
 
 import {
@@ -36,6 +40,7 @@ import { ErrorRow } from "../error-row";
 import {
   artifactHref,
   artifactState,
+  isProposal,
   loadArtifacts,
   STATE_KEYS,
   type ArtifactState,
@@ -120,14 +125,18 @@ export default async function AccountArtifactsPage({
       timeZone: "UTC",
     }).format(new Date(latest.deliveredAt));
     const reviewWord = t(STATE_KEYS[state]);
+    const versionWord = t("artifacts.version", { version: latest.version });
+    const latestWord = isProposal(artifact)
+      ? `${t("artifacts.proposal.caption")} · ${versionWord}`
+      : versionWord;
     return {
       id: artifact.id,
       title: artifact.title,
       href: artifactHref(locale, artifact.id),
       facet: state,
-      caption: `${t("artifacts.version", { version: latest.version })} · ${reviewWord}`,
+      caption: `${latestWord} · ${reviewWord}`,
       cells: {
-        latest: t("artifacts.version", { version: latest.version }),
+        latest: latestWord,
         delivered,
         review: reviewWord,
       },

package/templates/apps/web/app/[locale]/(authed)/account/general/page.tsx

@@ -3,19 +3,20 @@
  * #8232 D2).
  *
  * RSC, outside the account layout's SignedInShell (#8430), in the member's
- * four-tab settings frame (D7) — standalone, the Admin's shape. Renders the shared
+ * settings frame (D7; five tabs since #8438 D14) — standalone, the Admin's
+ * shape. Renders the shared
  * `AccountSettings` composition (@working-theory/templates/account, spec
  * 8339 D4) — the same General form the Admin renders — through the client
  * adapter `GeneralSettings` (`profile-form.tsx`). Below the form:
  *
  *   - the contact details (`AccountContactDetails`, #8435 D13) — only on the
  *     member path, seeded from `member.contact` and saved by `saveContact`;
- *   - Request account deletion (`DeletionRequest`, #8232 D5);
  *   - any section a module contributes (`accountSettingsSections`);
  *   - `BillingAnchor`, which forwards a `#billing` fragment to Billing.
  *
- * Sign-in moved to Security and cookie settings to Notifications (#8339
- * C6) — General no longer renders either.
+ * Sign-in moved to Security, cookie settings moved to Notifications then to
+ * Privacy (#8339 C6), and Request account deletion moved to Privacy (#8438
+ * D16) — General no longer renders any of the three.
  *
  * Whether the profile and deletion go through the member API is
  * `loadProfileSource` (D3), never a topology test here.
@@ -28,7 +29,6 @@ import {
   AccountSettingsPane,
   type AccountContact,
 } from "@working-theory/templates/account";
-import { localeHref } from "@working-theory/ui";
 import { Separator, Text } from "@working-theory/ui/primitives";
 import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
@@ -41,7 +41,6 @@ import { memberSettingsFrame, SettingsSection, type Translate } from "../setting
 
 import { BillingAnchor } from "./billing-anchor";
 import { saveContact } from "./contact-actions";
-import { DeletionRequest } from "./deletion-request";
 import { GeneralSettings } from "./profile-form";
 import { loadProfileSource } from "./profile-source";
 
@@ -164,24 +163,6 @@ export default async function AccountGeneralPage({ params }: Props): Promise<Rea
           </div>
         </>
       ) : null}
-      <Separator />
-      <div data-testid="account-deletion">
-        <DeletionRequest
-          via={source.via}
-          supportHref={localeHref(locale, "/account/support")}
-          labels={{
-            lead: t("settings.privacy.deletionLead"),
-            action: t("settings.privacy.deletion"),
-            sentSite: t("settings.privacy.deletionSentSite"),
-            sentHub: t("settings.privacy.deletionSentHub"),
-            unverified: t("settings.privacy.deletionUnverified"),
-            unavailable: t("settings.privacy.deletionUnavailable"),
-            error: t("settings.privacy.deletionError"),
-            viaSupport: t("settings.privacy.deletionViaSupport"),
-            supportLink: t("settings.privacy.deletionSupportLink"),
-          }}
-        />
-      </div>
       {accountSettingsSections.map((section) => (
         <SettingsSection key={section.id} id={section.id} title={ctx.t(section.title)}>
           {section.render(ctx)}

package/templates/apps/web/app/[locale]/(authed)/account/notifications/page.tsx

@@ -1,23 +1,35 @@
 /**
  * /[locale]/account/notifications — User settings › Notifications (#8339
- * D8, NEW).
+ * D8; #8438 D15 — what we send you).
  *
  * RSC, outside the account layout's SignedInShell (#8430), in the member's
- * four-tab settings frame (D7) — standalone, the Admin's shape. Holds the former Privacy
- * section's cookie-settings link, moved here verbatim from General (#8339
- * C6) — for now; notification preferences are a later unit's scope.
+ * settings frame (D7) — standalone, the Admin's shape. Always renders
+ * (decision A, operator 2026-10-12): a `ConsentSwitchList` of the site
+ * registry's `area: "communications"` purposes (`consent` and
+ * `preference`), each read from `GET /v1/member/consents`'s OWN state and
+ * `effective` default (no row ⇒ on for a preference, off for a consent).
+ * With none declared, one `account-notifications-empty` line.
+ *
+ * The cookie-settings link moved to Privacy (#8438 D14, C6) — this tab no
+ * longer renders it.
  */
 
-import { AccountSettingsFrame, AccountSettingsPane } from "@working-theory/templates/account";
-import { localeHref } from "@working-theory/ui";
-import { Link } from "@working-theory/ui/primitives";
+import { member } from "@working-theory/api-client";
+import {
+  AccountSettingsFrame,
+  AccountSettingsPane,
+  ConsentSwitchList,
+  type ConsentSwitchRow,
+} from "@working-theory/templates/account";
 import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
 import { accountSession } from "../account-data";
+import { setConsentAction } from "../privacy/actions";
 import { memberSettingsFrame, type Translate } from "../settings-frame";
 
+
 interface Props {
   params: Promise<{ locale: string }>;
 }
@@ -25,7 +37,7 @@ interface Props {
 export async function generateMetadata({ params }: Props): Promise<Metadata> {
   const { locale } = await params;
   const t = await getTranslations({ locale, namespace: "account" });
-  return { title: t("settings.notifications.title"), description: t("settings.privacy.lead") };
+  return { title: t("settings.notifications.title"), description: t("settings.notifications.lead") };
 }
 
 export default async function AccountNotificationsPage({ params }: Props): Promise<ReactElement> {
@@ -35,23 +47,57 @@ export default async function AccountNotificationsPage({ params }: Props): Promi
   const frame = memberSettingsFrame(locale, t as unknown as Translate, "notifications");
   const name = session?.ctx.user.name || session?.ctx.user.email || "";
 
+  let rows: ConsentSwitchRow[] = [];
+  let unavailable = false;
+  if (session) {
+    try {
+      const res = await member.consents(session.ctx.init, { locale });
+      if (res.ok) {
+        rows = res.body.purposes
+          .filter((purpose) => purpose.area === "communications")
+          .map((purpose) => ({
+            id: purpose.id,
+            label: purpose.statement,
+            granted: purpose.effective,
+            ...(purpose.description ? { description: purpose.description } : {}),
+            ...(purpose.state
+              ? {
+                  dateLine: purpose.state.granted
+                    ? t("settings.privacy.given", { date: formatDate(purpose.state.at, locale) })
+                    : t("settings.privacy.withdrawn", { date: formatDate(purpose.state.at, locale) }),
+                }
+              : {}),
+          }));
+      } else {
+        unavailable = true;
+      }
+    } catch {
+      unavailable = true;
+    }
+  }
+
   return (
     <AccountSettingsFrame {...frame} name={name}>
       <AccountSettingsPane
         id="account-settings-notifications"
         title={t("settings.notifications.title")}
-        lead={t("settings.privacy.lead")}
+        lead={t("settings.notifications.lead")}
       >
-        <div>
-          <Link
-            href={localeHref(locale, "/privacy#cookie-settings")}
-            className="inline-flex min-h-6 items-center"
-            data-testid="account-cookie-settings"
-          >
-            {t("settings.privacy.cookies")}
-          </Link>
-        </div>
+        {unavailable ? (
+          <span data-testid="account-notifications-unavailable">{t("settings.privacy.unavailable")}</span>
+        ) : (
+          <ConsentSwitchList
+            rows={rows}
+            onChange={setConsentAction}
+            emptyLine={t("settings.notifications.empty")}
+            testIdPrefix="account-notifications"
+          />
+        )}
       </AccountSettingsPane>
     </AccountSettingsFrame>
   );
 }
+
+function formatDate(iso: string, locale: string): string {
+  return new Intl.DateTimeFormat(locale, { dateStyle: "medium" }).format(new Date(iso));
+}

package/templates/apps/web/app/[locale]/(authed)/account/onboarding/actions.ts

@@ -0,0 +1,120 @@
+"use server";
+
+/**
+ * account/onboarding/actions.ts — the onboarding page's read and write
+ * (#8515, spec docs/specs/8515-standard-client-onboarding-diagnostic-and-spec.md
+ * D12; the routes are D7's `GET` and D8's `POST /v1/member/onboarding`).
+ *
+ *   - `readOnboardingForm` — `member.onboarding`, the standard onboarding
+ *     magnet's questions, or `form: null` while it is not open to the
+ *     caller. A 404 (no member area on this build, or a hub that does not
+ *     admit the route) is that same "not open" state; any other refusal is
+ *     `error`, so the page shows its error row with Retry.
+ *   - `submitOnboarding` — `member.submitOnboarding` with the answers.
+ *
+ * Both send `forwardedCookieInit()`'s init as built — the session cookie
+ * plus the request's `Origin` on a single site, the hub credential on a
+ * hub-mode spoke — so nothing here tests the topology, and no identity is
+ * posted: the API takes the Person from the credential.
+ *
+ * The answers are the entries named `answer.<name>`; a repeated name becomes
+ * an array, and so does a name the form lists under `multi` (a multi
+ * question with one box checked still posts an array, which is what the API
+ * asks of it). A value is sent as typed; one left empty or all-space is
+ * omitted, because the API refuses `""`. The API checks every answer
+ * against the form it serves — nothing here is trusted.
+ *
+ * Not a `*.actions.ts` file and no `*Action`-suffixed export: apps/mcp's
+ * parity test reads that suffix, and the member routes have no MCP twin by
+ * decision (8515 C4). Logs carry the function, the status and the code only
+ * — never an answer or a credential.
+ */
+
+import { member } from "@working-theory/api-client";
+import type { MemberOnboardingFormResponse } from "@working-theory/validation";
+
+import { forwardedCookieInit } from "../../../../../lib/server-api";
+
+/** The refusal codes the form has its own words for; anything else is `failed`. */
+const KNOWN_CODES = [
+  "onboarding_off",
+  "answers_invalid",
+  "link_not_https",
+  "too_many_requests",
+] as const;
+
+export type OnboardingErrorCode = (typeof KNOWN_CODES)[number] | "failed";
+
+/** What the form shows after a submit. */
+export type OnboardingState =
+  | { kind: "idle" }
+  | { kind: "sent" }
+  | { kind: "error"; code: OnboardingErrorCode };
+
+export type OnboardingForm = NonNullable<MemberOnboardingFormResponse["form"]>;
+
+export type OnboardingRead = { kind: "ok"; form: OnboardingForm | null } | { kind: "error" };
+
+/** PII-safe error identity for logs (`err.name` only). */
+function errorName(err: unknown): string {
+  return err instanceof Error ? err.name : "unknown";
+}
+
+/** The `error.code` of a member refusal body, when it has one. */
+function errorCode(body: unknown): string | null {
+  const code = (body as { error?: { code?: unknown } } | null)?.error?.code;
+  return typeof code === "string" ? code : null;
+}
+
+function knownCode(status: number, code: string | null): OnboardingErrorCode {
+  const known = KNOWN_CODES.find((candidate) => candidate === code);
+  if (known) return known;
+  // The hub's per-person budget and the per-IP limiter answer `429 rate_limited`.
+  return status === 429 ? "too_many_requests" : "failed";
+}
+
+export async function readOnboardingForm(): Promise<OnboardingRead> {
+  try {
+    const res = await member.onboarding(await forwardedCookieInit());
+    if (res.ok) return { kind: "ok", form: res.body.form };
+    if (res.status === 404) return { kind: "ok", form: null };
+    console.error(
+      `[onboarding] readOnboardingForm status=${res.status} code=${errorCode(res.body) ?? "none"}`,
+    );
+  } catch (err) {
+    console.error(`[onboarding] readOnboardingForm errName=${errorName(err)}`);
+  }
+  return { kind: "error" };
+}
+
+/** `(prev, formData)` for `useActionState`. */
+export async function submitOnboarding(
+  _prev: OnboardingState,
+  formData: FormData,
+): Promise<OnboardingState> {
+  // Action input is untrusted: a hand-built call may post anything.
+  if (!(formData instanceof FormData)) return { kind: "error", code: "failed" };
+
+  const multi = new Set(formData.getAll("multi").filter((v) => typeof v === "string"));
+  const answers: Record<string, string | string[]> = {};
+  for (const key of new Set(formData.keys())) {
+    if (!key.startsWith("answer.")) continue;
+    const name = key.slice("answer.".length);
+    const values = formData
+      .getAll(key)
+      .filter((v): v is string => typeof v === "string" && v.trim() !== "");
+    if (values.length === 0) continue;
+    answers[name] = values.length > 1 || multi.has(name) ? values : values[0]!;
+  }
+
+  try {
+    const res = await member.submitOnboarding({ answers }, await forwardedCookieInit());
+    if (res.ok) return { kind: "sent" };
+    const code = knownCode(res.status, errorCode(res.body));
+    console.error(`[onboarding] submitOnboarding status=${res.status} code=${code}`);
+    return { kind: "error", code };
+  } catch (err) {
+    console.error(`[onboarding] submitOnboarding errName=${errorName(err)}`);
+    return { kind: "error", code: "failed" };
+  }
+}