create-ailk 0.2.0 → 0.4.0

package/templates/apps/web/app/[locale]/dev/purchase/purchase.actions.ts

@@ -1,58 +0,0 @@
-"use server";
-
-/**
- * purchaseAction — Server Action paired with ailkPurchase MCP tool.
- *
- * Validates input with purchaseInputSchema (shared schema per ADR 0013),
- * calls POST /api/checkout/sessions via @working-theory/api-client, and returns the
- * Stripe hosted-checkout URL on success or a validation error object.
- *
- * Canonical filename: purchase.actions.ts (*.actions.ts per ADR 0013 / U0 spec
- * parity-test regex `ACTION_FILE_RE = /\.actions\.ts$/`).
- */
-
-import { checkout } from "@working-theory/api-client";
-import { purchaseInputSchema } from "@working-theory/validation";
-import type { PurchaseInput, PurchaseOutput } from "@working-theory/validation";
-
-export type PurchaseActionResult =
-  | PurchaseOutput
-  | { errors: { path: (string | number)[]; message: string }[] };
-
-/**
- * Initiate a Stripe checkout session for the given price.
- *
- * On success: returns `{ url: string }` — redirect the user to this URL.
- * On validation failure: returns `{ errors: ZodIssue[] }`.
- * On API failure: throws (will surface as a Next.js server error boundary).
- */
-export async function purchaseAction(
-  input: PurchaseInput,
-): Promise<PurchaseActionResult> {
-  const parsed = purchaseInputSchema.safeParse(input);
-  if (!parsed.success) {
-    return {
-      errors: parsed.error.issues.map((issue) => ({
-        path: issue.path as (string | number)[],
-        message: issue.message,
-      })),
-    };
-  }
-
-  const { priceId, quantity, successUrl, cancelUrl } = parsed.data;
-
-  const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || "http://localhost:3000";
-
-  const result = await checkout.createSession({
-    productCode: priceId,
-    ...(quantity !== undefined && { quantity }),
-    successUrl: successUrl ?? `${baseUrl}/purchase/success`,
-    cancelUrl: cancelUrl ?? `${baseUrl}/purchase/cancel`,
-  });
-
-  if (!result.ok) {
-    throw new Error(`Checkout session creation failed (${result.status})`);
-  }
-
-  return { url: result.body.url };
-}

package/templates/apps/web/app/[locale]/docs/[[...slug]]/page.tsx

@@ -1,119 +0,0 @@
-// oss: false
-/**
- * /docs catch-all route. Renders placeholder docs from
- * `apps/web/content/en/docs/` via the Fumadocs docsSource loader.
- *
- * Mirrors the blog route structure — same injectable-source pattern for
- * testability. Index renders a list of all docs pages; slug routes render
- * the individual doc.
- *
- * Issue #1459: per-app content directory divergence (2026-05-25).
- */
-import type { Metadata } from "next";
-import { notFound } from "next/navigation";
-import { getTranslations } from "next-intl/server";
-import type { ReactElement } from "react";
-
-import { docsSource as defaultDocsSource } from "../../../../lib/source";
-
-/**
- * Frontmatter contract — must match `source.config.ts` `docs.schema`.
- */
-interface DocsFrontmatter {
-  title: string;
-  description: string;
-}
-
-/**
- * Minimal docs-source interface covering the subset consumed by this route.
- * Tests inject a stub without mocking lib/source at the module level.
- */
-interface DocsSource {
-  getPages: () => Array<{ url: string; data: unknown }>;
-  getPage: (slug: string[]) => { data: unknown } | undefined;
-}
-
-interface DocsRouteProps {
-  params: Promise<{ locale: string; slug?: string[] }>;
-  /**
-   * Docs source override for testing. Defaults to the real Fumadocs docsSource.
-   */
-  docsSource?: DocsSource;
-}
-
-export async function generateMetadata(
-  props: DocsRouteProps,
-): Promise<Metadata> {
-  const { slug } = await props.params;
-  const source = props.docsSource ?? defaultDocsSource;
-
-  if (slug && slug.length > 0) {
-    const page = source.getPage(slug);
-    if (page) {
-      const data = page.data as unknown as DocsFrontmatter;
-      return {
-        title: data.title,
-        description: data.description,
-      };
-    }
-  }
-
-  return {
-    title: "Docs",
-    description: "Documentation for AI Launch Kit.",
-  };
-}
-
-export default async function DocsRoute(
-  props: DocsRouteProps,
-): Promise<ReactElement> {
-  const { slug } = await props.params;
-  const t = await getTranslations("docs");
-  const source = props.docsSource ?? defaultDocsSource;
-
-  if (slug && slug.length > 0) {
-    const page = source.getPage(slug);
-    if (!page) notFound();
-
-    const data = page.data as unknown as DocsFrontmatter;
-
-    return (
-      <main>
-        <h1>{data.title}</h1>
-        <p>{data.description}</p>
-      </main>
-    );
-  }
-
-  const pages = source.getPages();
-
-  if (pages.length === 0) {
-    return (
-      <main>
-        <h1>{t("heading")}</h1>
-        <p>
-          {t("emptyState")} <code>{"apps/web/content/en/docs/"}</code>{" "}
-          {t("emptyStateTrailing")}
-        </p>
-      </main>
-    );
-  }
-
-  return (
-    <main>
-      <h1>{t("heading")}</h1>
-      <ul>
-        {pages.map((page) => {
-          const data = page.data as unknown as DocsFrontmatter;
-          return (
-            <li key={page.url}>
-              <a href={page.url}>{data.title}</a>
-              {" \u2014 "}
-              {data.description}
-            </li>
-          );
-        })}
-      </ul>
-    </main>
-  );
-}

package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/checkout.actions.test.ts

@@ -1,287 +0,0 @@
-/**
- * Tests for the recommender's two email-moment Server Actions (#4842 D7).
- *
- * AC-2 (the action half) — `startCheckoutAction(slug, input)` calls
- *   `flows.checkout` exactly once with the wire body (the input's fields +
- *   the two SERVER-BUILT return URLs — the app's own origin + the permalink;
- *   no money field of any name), calls `redirect(url)` on `ok`, and returns
- *   `{ ok: false, kind: "not_configured" }` on a 409 WITHOUT throwing.
- * Security (#4875 review) — a caller-supplied `successUrl` / `cancelUrl` is
- *   DROPPED, never forwarded; a payload that is not a permalink of THIS flow
- *   is refused before any api-client call.
- * D7 — the shared status → kind map (400 / 409 / 429 + retryAfterSeconds /
- *   other / thrown) on both actions; invalid slug or body → `invalid_input`
- *   without calling the api-client; the visitor IP is forwarded (#4730).
- *
- * Mock shape: `flow.actions.test.ts:18–29` (`@working-theory/api-client` +
- * `next/headers`), plus `next/navigation`'s `redirect` mocked to THROW
- * (`page.test.tsx`'s idiom) so the hand-off is observable as a rejection.
- */
-
-import { encodePermalink, PERMALINK_VERSION } from "@working-theory/validation";
-
-import type { StartCheckoutInput } from "../checkout.actions.js";
-import { saveRecommendationAction, startCheckoutAction } from "../checkout.actions.js";
-
-jest.mock("@working-theory/api-client", () => ({
-  flows: {
-    checkout: jest.fn(),
-    save: jest.fn(),
-  },
-}));
-
-jest.mock("next/headers", () => ({
-  __esModule: true,
-  headers: jest.fn().mockResolvedValue({ get: () => null }),
-}));
-
-const mockRedirect = jest.fn((url: string) => {
-  throw new Error(`NEXT_REDIRECT:${url}`);
-});
-jest.mock("next/navigation", () => ({
-  __esModule: true,
-  redirect: (url: string) => mockRedirect(url),
-}));
-
-import { flows } from "@working-theory/api-client";
-import { headers } from "next/headers";
-
-const mockCheckout = flows.checkout as jest.Mock;
-const mockSave = flows.save as jest.Mock;
-const mockHeaders = headers as jest.Mock;
-
-const SLUG = "ailk-recommender";
-const ANSWERS = { team_size: "agency", wants_seo: "yes" };
-const PAYLOAD = encodePermalink({ version: PERMALINK_VERSION, flowSlug: SLUG, answers: ANSWERS });
-// `resolveBaseUrl()` — the app's configured origin (`NEXT_PUBLIC_BASE_URL`,
-// else its documented fallback) — the SAME source layout.tsx / sitemap.xml use.
-const ORIGIN = process.env["NEXT_PUBLIC_BASE_URL"] ?? "https://ailk.example.com";
-const PERMALINK = `${ORIGIN}/en/flows/${SLUG}/results/${PAYLOAD}`;
-
-const CHECKOUT_INPUT: StartCheckoutInput = {
-  answers: ANSWERS,
-  email: "jane@example.com",
-  locale: "en",
-  offerKey: "pro",
-  seats: 2,
-  period: "annual" as const,
-  creditStop: { kind: "none" as const },
-  payload: PAYLOAD,
-};
-
-/** The wire body the action must hand `flows.checkout` for CHECKOUT_INPUT. */
-const CHECKOUT_BODY = {
-  answers: ANSWERS,
-  email: "jane@example.com",
-  locale: "en",
-  offerKey: "pro",
-  seats: 2,
-  period: "annual" as const,
-  creditStop: { kind: "none" as const },
-  successUrl: `${PERMALINK}?checkout=success`,
-  cancelUrl: `${PERMALINK}?checkout=cancelled`,
-};
-
-const SAVE_BODY = { answers: ANSWERS, email: "jane@example.com", locale: "en" };
-
-beforeEach(() => {
-  jest.spyOn(console, "error").mockImplementation(() => undefined);
-  // #4157 — resolveBaseUrl() reads NEXT_PUBLIC_BASE_URL fresh per call, then
-  // falls back to lib/site-brand.tsx's content/_site.mdx read. Running
-  // inside THIS monorepo checkout, that file is real (ailaunchkit.ai) — set
-  // the env var explicitly (same value ORIGIN above already falls back to)
-  // so the action's resolved origin matches this test's expectation
-  // independent of which real _site.mdx a given test run happens to see.
-  process.env["NEXT_PUBLIC_BASE_URL"] = ORIGIN;
-});
-
-afterEach(() => {
-  jest.clearAllMocks();
-  jest.restoreAllMocks();
-  mockHeaders.mockResolvedValue({ get: () => null });
-  delete process.env["NEXT_PUBLIC_BASE_URL"];
-});
-
-describe("startCheckoutAction — AC-2 (the action half)", () => {
-  it("calls flows.checkout once with the wire body (server-built return URLs, no money field) and redirect(url) on ok", async () => {
-    mockCheckout.mockResolvedValueOnce({
-      ok: true,
-      body: { url: "https://checkout.stripe.com/c/pay/cs_test_123", sessionId: "fs_1" },
-    });
-
-    await expect(startCheckoutAction(SLUG, CHECKOUT_INPUT)).rejects.toThrow(
-      "NEXT_REDIRECT:https://checkout.stripe.com/c/pay/cs_test_123",
-    );
-
-    expect(mockCheckout).toHaveBeenCalledTimes(1);
-    expect(mockCheckout).toHaveBeenCalledWith(SLUG, CHECKOUT_BODY);
-    const sent = mockCheckout.mock.calls[0]?.[1] as Record<string, unknown>;
-    for (const key of ["amount", "total", "unitAmount"]) {
-      expect(Object.keys(sent)).not.toContain(key);
-    }
-    expect(mockRedirect).toHaveBeenCalledTimes(1);
-    expect(mockRedirect).toHaveBeenCalledWith("https://checkout.stripe.com/c/pay/cs_test_123");
-  });
-
-  it("forwards sessionId when present and omits it when absent", async () => {
-    mockCheckout.mockResolvedValueOnce({ ok: false, status: 500, body: {} });
-    await startCheckoutAction(SLUG, { ...CHECKOUT_INPUT, sessionId: "fs_prev" });
-    expect(mockCheckout.mock.calls[0]?.[1]).toMatchObject({ sessionId: "fs_prev" });
-
-    mockCheckout.mockResolvedValueOnce({ ok: false, status: 500, body: {} });
-    await startCheckoutAction(SLUG, CHECKOUT_INPUT);
-    expect(mockCheckout.mock.calls[1]?.[1]).not.toHaveProperty("sessionId");
-  });
-
-  it("DROPS a caller-supplied successUrl / cancelUrl — the wire body carries the server-built ones", async () => {
-    mockCheckout.mockResolvedValueOnce({ ok: false, status: 409, body: {} });
-    const hostile = {
-      ...CHECKOUT_INPUT,
-      successUrl: "https://evil.example/steal",
-      cancelUrl: "https://evil.example/steal",
-    } as StartCheckoutInput;
-    await startCheckoutAction(SLUG, hostile);
-    expect(mockCheckout).toHaveBeenCalledTimes(1);
-    expect(mockCheckout.mock.calls[0]?.[1]).toMatchObject({
-      successUrl: CHECKOUT_BODY.successUrl,
-      cancelUrl: CHECKOUT_BODY.cancelUrl,
-    });
-  });
-
-  it("refuses a payload that is not a permalink of THIS flow, without calling the api-client", async () => {
-    const foreign = encodePermalink({
-      version: PERMALINK_VERSION,
-      flowSlug: "another-flow",
-      answers: ANSWERS,
-    });
-    await expect(
-      startCheckoutAction(SLUG, { ...CHECKOUT_INPUT, payload: foreign }),
-    ).resolves.toEqual({ ok: false, kind: "invalid_input" });
-    await expect(
-      startCheckoutAction(SLUG, { ...CHECKOUT_INPUT, payload: "not-a-permalink!!!" }),
-    ).resolves.toEqual({ ok: false, kind: "invalid_input" });
-    expect(mockCheckout).not.toHaveBeenCalled();
-  });
-
-  it("builds the return URLs with a SAFE locale — an unknown locale segment falls back to the default", async () => {
-    mockCheckout.mockResolvedValueOnce({ ok: false, status: 409, body: {} });
-    await startCheckoutAction(SLUG, { ...CHECKOUT_INPUT, locale: "zz" });
-    expect(mockCheckout.mock.calls[0]?.[1]).toMatchObject({
-      successUrl: `${ORIGIN}/en/flows/${SLUG}/results/${PAYLOAD}?checkout=success`,
-    });
-  });
-
-  it("returns { ok: false, kind: 'not_configured' } on a 409 without throwing", async () => {
-    mockCheckout.mockResolvedValueOnce({ ok: false, status: 409, body: {} });
-    await expect(startCheckoutAction(SLUG, CHECKOUT_INPUT)).resolves.toEqual({
-      ok: false,
-      kind: "not_configured",
-    });
-    expect(mockRedirect).not.toHaveBeenCalled();
-  });
-
-  it("maps 400 → invalid_input, 429 → rate_limited (+retryAfterSeconds), other → unavailable, thrown → network", async () => {
-    mockCheckout.mockResolvedValueOnce({ ok: false, status: 400, body: {} });
-    await expect(startCheckoutAction(SLUG, CHECKOUT_INPUT)).resolves.toEqual({
-      ok: false,
-      kind: "invalid_input",
-    });
-
-    mockCheckout.mockResolvedValueOnce({
-      ok: false,
-      status: 429,
-      body: { retryAfterSeconds: 42 },
-    });
-    await expect(startCheckoutAction(SLUG, CHECKOUT_INPUT)).resolves.toEqual({
-      ok: false,
-      kind: "rate_limited",
-      retryAfterSeconds: 42,
-    });
-
-    mockCheckout.mockResolvedValueOnce({ ok: false, status: 502, body: {} });
-    await expect(startCheckoutAction(SLUG, CHECKOUT_INPUT)).resolves.toEqual({
-      ok: false,
-      kind: "unavailable",
-    });
-
-    mockCheckout.mockRejectedValueOnce(new Error("boom"));
-    await expect(startCheckoutAction(SLUG, CHECKOUT_INPUT)).resolves.toEqual({
-      ok: false,
-      kind: "network",
-    });
-    expect(mockRedirect).not.toHaveBeenCalled();
-  });
-
-  it("logs only the error's NAME on a thrown api-client error — never the error object", async () => {
-    const spy = console.error as jest.Mock;
-    mockCheckout.mockRejectedValueOnce(new TypeError("fetch failed: jane@example.com"));
-    await startCheckoutAction(SLUG, CHECKOUT_INPUT);
-    expect(spy).toHaveBeenCalledTimes(1);
-    const args = spy.mock.calls[0] as unknown[];
-    expect(args).toHaveLength(1);
-    expect(args[0]).toContain("errName=TypeError");
-    expect(String(args[0])).not.toContain("jane@example.com");
-  });
-
-  it("refuses a money field, an invalid email, or a bad slug without calling the api-client", async () => {
-    // A money field is exactly what `.strict()` refuses — it never reaches
-    // the wire body because only the named fields are forwarded; assert the
-    // stricter property: the wire body has no such key at all.
-    mockCheckout.mockResolvedValueOnce({ ok: false, status: 409, body: {} });
-    const withAmount = { ...CHECKOUT_INPUT, amount: 24900 } as StartCheckoutInput;
-    await startCheckoutAction(SLUG, withAmount);
-    expect(Object.keys(mockCheckout.mock.calls[0]?.[1] as object)).not.toContain("amount");
-    mockCheckout.mockClear();
-
-    await expect(
-      startCheckoutAction(SLUG, { ...CHECKOUT_INPUT, email: "not-an-email" }),
-    ).resolves.toEqual({ ok: false, kind: "invalid_input" });
-    await expect(startCheckoutAction("Not A Slug!", CHECKOUT_INPUT)).resolves.toEqual({
-      ok: false,
-      kind: "invalid_input",
-    });
-    expect(mockCheckout).not.toHaveBeenCalled();
-  });
-
-  it("forwards the visitor's x-forwarded-for on the outbound call (#4730)", async () => {
-    mockHeaders.mockResolvedValueOnce({
-      get: (name: string) => (name === "x-forwarded-for" ? "203.0.113.7" : null),
-    });
-    mockCheckout.mockResolvedValueOnce({ ok: false, status: 409, body: {} });
-    await startCheckoutAction(SLUG, CHECKOUT_INPUT);
-    expect(mockCheckout).toHaveBeenCalledWith(SLUG, CHECKOUT_BODY, {
-      headers: { "x-forwarded-for": "203.0.113.7" },
-    });
-  });
-});
-
-describe("saveRecommendationAction — AC-4 (the action half)", () => {
-  it("calls flows.save once with { answers, email, locale } and returns the leadId", async () => {
-    mockSave.mockResolvedValueOnce({ ok: true, body: { leadId: "lead_1", sessionId: "fs_1" } });
-    await expect(saveRecommendationAction(SLUG, SAVE_BODY)).resolves.toEqual({
-      ok: true,
-      leadId: "lead_1",
-    });
-    expect(mockSave).toHaveBeenCalledTimes(1);
-    expect(mockSave).toHaveBeenCalledWith(SLUG, SAVE_BODY);
-    expect(mockCheckout).not.toHaveBeenCalled();
-  });
-
-  it("maps failures exactly as checkout does and never throws", async () => {
-    mockSave.mockResolvedValueOnce({ ok: false, status: 429, body: { retryAfterSeconds: 9 } });
-    await expect(saveRecommendationAction(SLUG, SAVE_BODY)).resolves.toEqual({
-      ok: false,
-      kind: "rate_limited",
-      retryAfterSeconds: 9,
-    });
-    mockSave.mockRejectedValueOnce(new Error("boom"));
-    await expect(saveRecommendationAction(SLUG, SAVE_BODY)).resolves.toEqual({
-      ok: false,
-      kind: "network",
-    });
-    await expect(
-      saveRecommendationAction(SLUG, { ...SAVE_BODY, email: "nope" }),
-    ).resolves.toEqual({ ok: false, kind: "invalid_input" });
-    expect(mockSave).toHaveBeenCalledTimes(2);
-  });
-});