create-ailk 0.21.0 → 0.23.0

package/templates/apps/mcp/src/tools/get_pricing.ts

@@ -14,13 +14,35 @@
  * offering fields on its own frontmatter answer instead — a listing that
  * declares `price` + `priceCurrency` yields one tier named for the page. A
  * listing with neither an authored offer nor a price still returns `null`: no
- * price means no tier, never a fabricated zero.
+ * price means no tier, never a fabricated zero. `getPricingTiers`
+ * (`@working-theory/content-adapters`) documents the mapping.
+ *
+ * HTTP twin (#7178): `GET /v1/content/pricing` in `apps/api` takes the same
+ * arguments and answers through the same `getPricingTiers` — the shared seam
+ * the pair proves parity at. The tool still reads content locally, so it
+ * needs no API to answer.
+ *
+ * Offerings (#8933, spec D8): when the site sells through its connected
+ * Stripe catalog and `slug` is omitted or `pricing`, the tool answers the
+ * workspace's Offerings shown set instead — read over HTTP by
+ * `lib/shown-offerings.ts` (D6: only on a `claimed` host, at most
+ * `MCP_SHOWN_SET_BUDGET_MS`) and mapped by `pricingTiersFromShownSet`, the
+ * function the twin route answers through too, so each tier also carries
+ * `interval` and the full `lookupKey`. Names, descriptions and prices are
+ * seller-provided data returned as plain JSON values (T5). Any other slug, an
+ * unclaimed host, a workspace with no current set, a failed read or a mapping
+ * that throws answers the page content below, unchanged.
  *
  * Input:  { slug?: string, locale?: string }
- * Output: { tiers: Array<{ name, price, priceCurrency, description? }> } | null
+ * Output: { tiers: Array<{ name, price, priceCurrency, description?, interval?, lookupKey? }> } | null
  * Session/scope: none — read-only public content.
  */
 
+import {
+  getPricingTiers,
+  pricingTiersFromShownSet,
+  shownSetAnswersPricing,
+} from "@working-theory/content-adapters";
 import {
   getPricingInputSchema,
   getPricingOutputSchema,
@@ -33,12 +55,14 @@ import {
   mcpContentRoot,
 } from "../lib/content-adapter.js";
 import { resolveLocale } from "../lib/resolve-locale.js";
+import {
+  mcpCurrentShownSet,
+  reportMappingFailure,
+} from "../lib/shown-offerings.js";
 
 export { getPricingInputSchema, getPricingOutputSchema };
 export type { GetPricingInput, GetPricingOutput };
 
-const DEFAULT_SLUG = "pricing";
-
 /**
  * get_pricing handler.
  *
@@ -51,44 +75,20 @@ export async function ailkGetPricing(
 ): Promise<GetPricingOutput> {
   getPricingInputSchema.parse(input);
 
+  if (shownSetAnswersPricing(input.slug)) {
+    const shownSet = await mcpCurrentShownSet();
+    if (shownSet !== null) {
+      try {
+        return pricingTiersFromShownSet(shownSet);
+      } catch (err) {
+        reportMappingFailure(err);
+      }
+    }
+  }
+
   const root = contentRoot ?? mcpContentRoot();
   const locale = resolveLocale(input.locale);
   const adapter = getMcpContentAdapter({ contentRoot: root, locale });
 
-  const slug = input.slug ?? DEFAULT_SLUG;
-  const data = await adapter.extractStructuredData("Product", slug, locale);
-
-  const schema = (data ?? {}) as Record<string, unknown>;
-
-  // Support both a top-level `offers` array and a single offer object.
-  const offersRaw = schema["offers"];
-  const offersArr: Record<string, unknown>[] = Array.isArray(offersRaw)
-    ? (offersRaw as Record<string, unknown>[])
-    : offersRaw && typeof offersRaw === "object"
-      ? [offersRaw as Record<string, unknown>]
-      : [];
-
-  if (offersArr.length === 0) {
-    const page = await adapter.getPageBySlug("Product", slug, locale);
-    if (!page || page.price === undefined) return null;
-    return getPricingOutputSchema.parse({
-      tiers: [
-        {
-          name: page.title,
-          price: page.price,
-          priceCurrency: page.priceCurrency ?? "USD",
-          ...(page.summary !== undefined && { description: page.summary }),
-        },
-      ],
-    });
-  }
-
-  const tiers = offersArr.map((offer) => ({
-    name: (offer["name"] as string) ?? "",
-    price: (offer["price"] as string | number) ?? "",
-    priceCurrency: (offer["priceCurrency"] as string) ?? "USD",
-    description: offer["description"] as string | undefined,
-  }));
-
-  return getPricingOutputSchema.parse({ tiers });
+  return getPricingTiers(adapter, { slug: input.slug, locale });
 }

package/templates/apps/mcp/src/tools/purchase.ts

@@ -57,11 +57,24 @@
  * through `@working-theory/api-client` per the architecture invariants (apps
  * may not import each other; the shared HTTP surface lives in packages/).
  *
- * Spec: `docs/specs/5971-start-purchase-hosted-checkout-spec.md`.
+ * THE KEY — the full Offerings lookup_key (#8935). `productCode` is a price's
+ * full lookup_key (contract §3.7), the `lookupKey` `get_pricing` and
+ * `get_offerings` return. After the claim and the strict schema, the one
+ * §3.7 parser, `parseLookupKey`, refuses an ungrammatical key before any HTTP
+ * call, with the same not-found body every route 404 maps to (A3, A5). The
+ * workspace stays the server's (A1): the api-client attaches the
+ * deployment's own spoke key, and the route alone decides whether the key is
+ * shown and org-enabled. A spoke whose Organization has no Stripe connection
+ * gets the route's same 404, never a session on the hub's own env key, so
+ * this tool refuses it as the web buy route does (#9126).
+ *
+ * Spec: `docs/specs/5971-start-purchase-hosted-checkout-spec.md`,
+ * `docs/specs/8935-start-purchase-sells-a-named-spec.md`.
  */
 
 import { checkout } from "@working-theory/api-client";
 import {
+  parseLookupKey,
   purchaseMcpInputSchema,
   type PurchaseMcpInput,
   type PurchaseOutput,
@@ -83,6 +96,15 @@ function commerceDisabledBody(): ErrorBody {
   return notFoundError("Not found");
 }
 
+/**
+ * The one not-found body for an offering (#8935 D2, A5): an ungrammatical key
+ * refused before the call and every route 404 answer this same value, and
+ * neither echoes the caller's key.
+ */
+function offeringNotFoundBody(): ErrorBody {
+  return notFoundError("No offering matches that product code.");
+}
+
 /**
  * Export name `ailkPurchase` satisfies the parity-test naming convention
  * (ailk<PascalVerb>) so the harness can discover it.
@@ -127,6 +149,12 @@ export async function ailkPurchase(
 
   const { productCode, quantity } = parsed.data;
 
+  // #8935 D2 — a key outside the §3.7 grammar can never sell, so it is
+  // refused here, before the route spends a rate-limit token on it.
+  if (parseLookupKey(productCode) === null) {
+    return offeringNotFoundBody();
+  }
+
   // successUrl/cancelUrl are ALWAYS derived from baseUrl (#6001) — never
   // accepted from the caller. allowPromotionCodes is never forwarded: it is
   // not part of purchaseMcpInputSchema, so it can never be present here.
@@ -152,7 +180,7 @@ export async function ailkPurchase(
       // states and tests that invariant ("Error responses never echo user
       // input", apps/api/src/routes/checkout/sessions.ts), and parity means
       // the pair answers alike.
-      return notFoundError("No offering matches that product code.");
+      return offeringNotFoundBody();
     }
     return validationError(
       `checkout-unavailable: POST /v1/checkout/sessions returned ${result.status}`,

package/templates/apps/mcp/src/workspace-server.ts

@@ -83,6 +83,21 @@ const WORKSPACE_TOOL_ENTRIES: Record<
     specifier: "./tools/inbox_submissions.js",
     exportName: "ailkMarkInboxSubmissionDone",
   },
+  list_listing_applications: {
+    specifier: "./tools/inbox_applications.js",
+    exportName: "ailkListListingApplications",
+  },
+  get_listing_application: {
+    specifier: "./tools/inbox_applications.js",
+    exportName: "ailkGetListingApplication",
+  },
+  decide_listing_application: {
+    specifier: "./tools/inbox_applications.js",
+    exportName: "ailkDecideListingApplication",
+  },
+  // #9137 — the pre-rename names, deprecated aliases of the three above for
+  // one release: each export is the same function, so the same arguments and
+  // result.
   list_inbox_applications: {
     specifier: "./tools/inbox_applications.js",
     exportName: "ailkListInboxApplications",

package/templates/apps/web/.env.example

@@ -92,6 +92,20 @@ CONTENT_ADAPTER=mdx
 # origin the browser never sees.
 # NEXT_PUBLIC_AILK_API_URL=http://localhost:3002
 
+# =============================================================================
+# The /contact lead's site marker (server-side only) — #8747
+# =============================================================================
+# This site's slug. The /contact Server Action writes it into every lead as
+# payload.site (with payload.page = "contact"), so a hub serving several sites
+# — or one site routing leads to two workspaces — can tell where a lead came
+# from. Use the site's short name, lowercase letters, digits and hyphens (for
+# example "wendihenry"); apps/mcp's capture_lead reads the same variable. Unset
+# or blank leaves the lead with no site marker — nothing is invented, and a
+# visitor-sent "site" field is dropped. The marker is attribution only: the
+# lead route is public, so never gate access on it. The action sends no
+# siteId; the API names the workspace itself (by AILK_SPOKE_KEY on a hub).
+# AILK_LEAD_SITE=
+
 # =============================================================================
 # Listicle directory (#7521) — switched on by the site's listing key (#7872)
 # =============================================================================
@@ -247,37 +261,16 @@ CONTENT_ADAPTER=mdx
 # BETTER_STACK_HEARTBEAT_URL=
 
 # =============================================================================
-# Scheduling — the scheduling module's booking page (#4633)
+# Scheduling — the scheduling module's booking pages (#4633, #8843)
 # =============================================================================
-# Which event `/meet` books, as "<owner>/<event-slug>" — the path of the
-# provider's own public booking page. Read server-side in
-# app/[locale]/meet/page.tsx and handed to the `booker` section, which
-# sends it back to apps/api's /v1/schedule/* routes to name the event.
-#
-# Unset is a supported state: `/meet` 404s, exactly as if the scheduling
-# module were not installed.
-#
-# NOT a credential, and deliberately NOT a NEXT_PUBLIC_ variable — the API key
-# it pairs with (CAL_API_KEY) lives in apps/api and this app never reads it, so
-# keeping the whole scheduling config surface server-read is what makes that
-# boundary checkable rather than merely intended.
-# SCHEDULING_CAL_LINK=owner/event-slug
-#
-# The booker's /v1/schedule/* calls go through this site's same-origin relay
-# (see the relay block above, #7644), so the baseline CSP's
-# `connect-src 'self'` already covers them — no CSP extension is needed for
-# them, whatever NEXT_PUBLIC_AILK_API_URL is set to.
+# No variable here. /meet, /private and /meet/<slug> read every meeting fact
+# — which meetings are Live, public or private, their titles, lengths and
+# Cal.com links — from apps/api's GET /v1/schedule/meetings, which resolves
+# the workspace from this site (the site alias keyless, a spoke by its key)
+# and composes each Cal.com link from that workspace's own account. The
+# one-meeting "<owner>/<event-slug>" variable this block used to set is
+# retired, and nothing reads it.
 #
 # On a SPOKE (create-ailk --topology spoke, #7872) this site has no apps/api:
-# /meet lists the meeting types the hub stores for this spoke's workspace and
-# books through the hub at AILK_API_URL with AILK_SPOKE_KEY. Then:
-#   - the FIRST segment (the owner) must name the provider account the hub
-#     uses for this spoke's workspace (its scheduling connection). It composes
-#     each booker's calLink; it is not an access control — the hub checks a
-#     spoke booking's slug, never its owner.
-#   - the SECOND segment is ignored: a workspace with no stored meeting-type
-#     list shows no meetings, because the hub books only a slug it stores.
-#   - the booker's two calls count against the relay's per-visitor budget,
-#     which holds per visitor only behind an edge that overwrites
-#     x-forwarded-for and x-real-ip (Vercel does); elsewhere every visitor
-#     shares one budget.
+# the pages read the hub's meetings for this spoke's workspace at AILK_API_URL
+# with AILK_SPOKE_KEY, so a workspace with no stored meeting list shows none.