create-ailk 0.20.0 → 0.22.0

package/templates/tools/jest/pin-timezone.cjs

@@ -0,0 +1,34 @@
+"use strict";
+/* global process */
+
+/**
+ * Shared Jest `globalSetup` — pins every jest run in the workspace to one
+ * timezone (#8657).
+ *
+ * Jest otherwise inherits the developer's `TZ`, so a test that renders a date
+ * in local time (`formatDate`, `toLocaleDateString`, `getDate()`) passes in CI,
+ * which runs in UTC, and fails on a laptop that does not: the #8578 shape,
+ * where UTC-midnight consent fixtures rendered the previous day on an MDT
+ * machine and failed 11 release-check rows.
+ *
+ * WHY `globalSetup` AND NOT `setupFiles`: a setup file runs inside the test
+ * sandbox, whose `process.env` is jest's copy of the real one, so assigning
+ * `TZ` there never reaches the process clock. `globalSetup` runs in jest's
+ * parent process before any worker is spawned: the workers inherit the pinned
+ * `TZ`, and Node re-reads an assigned `process.env.TZ` at once, so an in-band
+ * run (`--runInBand`, a single test file) is pinned in place too.
+ *
+ * Every committed `jest.config.cjs` loads this file; the guard is
+ * `tests/architecture/jest-timezone-pin.test.ts`, and the value is documented
+ * in CONVENTIONS.md § Testing. A test that needs another zone formats with an
+ * explicit `timeZone` option rather than changing `TZ`. The create-ailk
+ * scaffold ships this file at the same path (`SNAPSHOT_FILES` in
+ * packages/create-ailk/scripts/build-templates.mjs), so its copied configs
+ * load it unchanged.
+ */
+const PINNED_TZ = "UTC";
+
+module.exports = async function pinTimezone() {
+  process.env.TZ = PINNED_TZ;
+};
+module.exports.PINNED_TZ = PINNED_TZ;

package/versions.json

@@ -1,53 +1,53 @@
 {
-  "@working-theory/admin-ui": "0.41.0",
-  "@working-theory/aeo": "0.41.0",
-  "@working-theory/agent-context": "0.41.0",
+  "@working-theory/admin-ui": "0.43.0",
+  "@working-theory/aeo": "0.43.0",
+  "@working-theory/agent-context": "0.43.0",
   "@working-theory/agent-contract": "0.1.0",
   "@working-theory/agent-memory": "0.0.0",
   "@working-theory/ai": "0.1.0",
-  "@working-theory/analytics": "0.41.0",
-  "@working-theory/api-client": "0.41.0",
+  "@working-theory/analytics": "0.43.0",
+  "@working-theory/api-client": "0.43.0",
   "@working-theory/cda-filesystem": "0.0.0",
-  "@working-theory/cli": "0.41.0",
-  "@working-theory/common": "0.41.0",
+  "@working-theory/cli": "0.43.0",
+  "@working-theory/common": "0.43.0",
   "@working-theory/consent": "0.1.0",
-  "@working-theory/content-adapters": "0.41.0",
-  "@working-theory/content-projection": "0.41.0",
-  "@working-theory/email": "0.41.0",
+  "@working-theory/content-adapters": "0.43.0",
+  "@working-theory/content-projection": "0.43.0",
+  "@working-theory/email": "0.43.0",
   "@working-theory/env": "0.0.0",
-  "@working-theory/eslint-config": "0.41.0",
-  "@working-theory/fumadocs-schema": "0.41.0",
+  "@working-theory/eslint-config": "0.43.0",
+  "@working-theory/fumadocs-schema": "0.43.0",
   "@working-theory/ids": "0.14.0",
-  "@working-theory/jsonld": "0.41.0",
-  "@working-theory/license": "0.41.0",
-  "@working-theory/metadata": "0.41.0",
-  "@working-theory/observability": "0.41.0",
-  "@working-theory/page-renderer": "0.41.0",
+  "@working-theory/jsonld": "0.43.0",
+  "@working-theory/license": "0.43.0",
+  "@working-theory/metadata": "0.43.0",
+  "@working-theory/observability": "0.43.0",
+  "@working-theory/page-renderer": "0.43.0",
   "@working-theory/plugin-mcp": "0.1.3",
-  "@working-theory/schema": "0.41.0",
-  "@working-theory/schema-pack-registry": "0.41.0",
-  "@working-theory/schema-validator": "0.41.0",
-  "@working-theory/sections-registry": "0.41.0",
-  "@working-theory/site-config": "0.41.0",
-  "@working-theory/spoke-checkout": "0.5.2",
-  "@working-theory/stripe-client": "0.41.0",
-  "@working-theory/templates": "0.41.0",
-  "@working-theory/theme": "0.41.0",
-  "@working-theory/ui": "0.41.0",
-  "@working-theory/validation": "0.41.0",
-  "@working-theory/web-i18n": "0.41.0",
+  "@working-theory/schema": "0.43.0",
+  "@working-theory/schema-pack-registry": "0.43.0",
+  "@working-theory/schema-validator": "0.43.0",
+  "@working-theory/sections-registry": "0.43.0",
+  "@working-theory/site-config": "0.43.0",
+  "@working-theory/spoke-checkout": "0.6.0",
+  "@working-theory/stripe-client": "0.43.0",
+  "@working-theory/templates": "0.43.0",
+  "@working-theory/theme": "0.43.0",
+  "@working-theory/ui": "0.43.0",
+  "@working-theory/validation": "0.43.0",
+  "@working-theory/web-i18n": "0.43.0",
   "@working-theory/billing-client": "0.0.0",
   "@working-theory/branding": "0.0.0",
   "@working-theory/license-client": "0.0.0",
   "@working-theory/license-manifest": "0.0.0",
   "@working-theory/partner-session": "0.0.0",
   "@working-theory/preview-protocol": "0.0.0",
-  "@working-theory/ui-commerce": "0.23.19",
-  "@working-theory/ui-docs-blog": "0.23.19",
-  "@working-theory/ui-scheduling": "0.23.19",
-  "@working-theory/ui-signal-collectors": "0.25.8",
+  "@working-theory/ui-commerce": "0.23.21",
+  "@working-theory/ui-docs-blog": "0.23.21",
+  "@working-theory/ui-scheduling": "0.24.1",
+  "@working-theory/ui-signal-collectors": "0.26.0",
   "@working-theory/web": "0.0.0",
   "@working-theory/api": "1.0.0",
   "@working-theory/mcp": "0.0.0",
-  "@working-theory/database": "0.41.0"
+  "@working-theory/database": "0.43.0"
 }

package/templates/apps/web/app/[locale]/(auth)/sign-up/sign-up.actions.ts

@@ -1,125 +0,0 @@
-"use server";
-
-/**
- * sign-up.actions.ts — mints the sign-up card's carried-agreement cookie
- * (#8438 D13, spec
- * docs/specs/8438-consent-registry-and-ledger-step-spec.md C6).
- *
- * `apps/web` never touches the database (the ledger writer is `apps/api`),
- * and Better Auth creates the user from THIS app before any Person exists to
- * record a grant against. So the card remembers which agreements the person
- * ticked, in a short-lived, signed, email-bound cookie — the account home's
- * first signed-in visit (`(authed)/account/actions.ts`'s
- * `acceptCarriedAgreementsAction`) consumes it, one write per agreement,
- * then deletes it either way (single-use).
- *
- * The CONSUME side lives in the account area, not here, deliberately:
- * `(auth)/**` is one of the sign-in seeds a sign-in-less spoke drops
- * (`SPOKE_REMOVAL_SEEDS`, `packages/create-ailk/src/topology.ts` D4), so a
- * file OUTSIDE `(auth)` (the account home's `agreements-prompt.tsx`) must
- * never import FROM here — doing so once failed the scaffolder's own
- * dangling-import check (`spokeExclusions`) for exactly this reason. This
- * file is reached only from `sign-up-card.tsx`, its own directory sibling,
- * so it carries no such obligation. The two files duplicate the small
- * cookie codec (encode here, decode there) rather than share a module,
- * precisely so each side's dependencies stay native to where it lives.
- *
- * Cookie value: `<id>@<version>,…|<issuedAtMs>|<sha256(lowercased email)>|
- * <HMAC-SHA256 over the rest>`, keyed by `BETTER_AUTH_SECRET` — the same
- * dev fallback `apps/web/auth.ts`'s own `resolveSecret()` publishes when it
- * is unset; production refuses to mint without one. That secret is read
- * directly HERE rather than importing `resolveSecret` from `auth.ts`: that
- * module statically imports the `better-auth` ESM package, which every
- * broad page-level test suite that renders `/sign-up` would then have to
- * add to its `../../../../auth` mock. `__Host-` prefixed, httpOnly,
- * `Secure`, one hour, `SameSite=Lax` — the `__Host-` prefix needs `Secure`,
- * so development over plain `http://localhost` uses the unprefixed name
- * instead (SEC-8438-5).
- */
-
-import { createHash, createHmac } from "node:crypto";
-
-import { consentPurposeById, SITE_CONSENT_CONFIG_DEFAULTS } from "@working-theory/validation";
-import { cookies } from "next/headers";
-
-const SECURE_COOKIE_NAME = "__Host-ailk-signup-agreements";
-const DEV_COOKIE_NAME = "ailk-signup-agreements";
-const MAX_AGE_SECONDS = 60 * 60;
-
-/** The string `auth.ts`'s own `resolveSecret()` publishes — see file header. */
-const DEV_FALLBACK_SECRET =
-  "ailk-dev-fallback-secret-published-in-this-repo-never-use-in-production";
-
-/** Mirrors `auth.ts`'s `resolveSecret()` exactly, without importing it. */
-function signUpAgreementsSecret(): string {
-  const configured = process.env.BETTER_AUTH_SECRET;
-  if (configured) return configured;
-  const isBuildPhase = process.env.NEXT_PHASE === "phase-production-build";
-  if (process.env.NODE_ENV === "production" && !isBuildPhase) {
-    throw new Error(
-      "BETTER_AUTH_SECRET is required in production: it signs the carried sign-up-agreement cookie.",
-    );
-  }
-  return DEV_FALLBACK_SECRET;
-}
-
-function cookieName(): string {
-  return process.env.NODE_ENV === "production" ? SECURE_COOKIE_NAME : DEV_COOKIE_NAME;
-}
-
-function emailHash(email: string): string {
-  return createHash("sha256").update(email.trim().toLowerCase()).digest("hex");
-}
-
-function sign(payload: string): string {
-  return createHmac("sha256", signUpAgreementsSecret()).update(payload).digest("hex");
-}
-
-interface CarriedPurpose {
-  id: string;
-  version: number;
-}
-
-function encodeCarriedAgreements(
-  purposes: CarriedPurpose[],
-  email: string,
-  issuedAtMs: number,
-): string {
-  const purposesPart = purposes.map((p) => `${p.id}@${p.version}`).join(",");
-  const payload = `${purposesPart}|${issuedAtMs}|${emailHash(email)}`;
-  return `${payload}|${sign(payload)}`;
-}
-
-/**
- * Mints the carried-agreement cookie from the ticked `signUp` agreements,
- * read back from the registry for their CURRENT version — never trusting a
- * version the client might assert. Purposes the registry no longer marks
- * `signUp` are dropped. Never throws: a failed mint just means the account
- * home's first visit asks explicitly instead (D13's "Otherwise" card).
- */
-export async function rememberSignUpAgreementsAction(
-  email: string,
-  purposeIds: string[],
-): Promise<void> {
-  try {
-    const config = SITE_CONSENT_CONFIG_DEFAULTS;
-    const purposes: CarriedPurpose[] = [];
-    for (const id of purposeIds) {
-      const purpose = consentPurposeById(config, id);
-      if (purpose?.signUp) purposes.push({ id: purpose.id, version: purpose.policyVersion });
-    }
-    if (purposes.length === 0) return;
-
-    const value = encodeCarriedAgreements(purposes, email, Date.now());
-    const cookieStore = await cookies();
-    cookieStore.set(cookieName(), value, {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === "production",
-      sameSite: "lax",
-      path: "/",
-      maxAge: MAX_AGE_SECONDS,
-    });
-  } catch {
-    // Convenience only — see file header.
-  }
-}