create-ailk 0.21.0 → 0.23.0

package/templates/apps/web/auth.ts

@@ -43,6 +43,11 @@ import {
   isSignUpOpen,
   resetSendConfigured,
 } from "./lib/auth-env";
+import {
+  signUpAgreementHooks,
+  signUpAgreementsPlugin,
+  withAuthTransactionCapture,
+} from "./lib/sign-up-agreements";
 
 /**
  * Reset-token lifetime (#5962 § D11). One hour — the library's own default,
@@ -438,9 +443,25 @@ export function createAuth(deps: CreateAuthDeps = {}) {
   };
 
   const instance = betterAuth({
-    database: prismaAdapter(prisma, {
+    /**
+     * `transaction: true` (#8765 D4): Better Auth opens one `$transaction` for
+     * exactly its three `runWithTransaction` sites — `/sign-up/email`,
+     * `createOAuthUser` and verification-token consumption — so a user, its
+     * account and its sign-up grants commit together or not at all. Every
+     * other write stays autocommit. The capture wrapper exposes that
+     * transaction's client to the sign-up hooks below; it changes nothing
+     * about the transaction itself (lib/sign-up-agreements.ts).
+     */
+    database: prismaAdapter(withAuthTransactionCapture(prisma), {
       provider: "postgresql",
+      transaction: true,
     }),
+    /**
+     * The sign-up grants (#8765 D4): the user hook decides whether the new
+     * user carries agreements, the account hook writes them on the captured
+     * transaction client. No other database hook is installed.
+     */
+    databaseHooks: signUpAgreementHooks(),
     secret: resolveSecret(),
     baseURL: process.env.BETTER_AUTH_URL,
     socialProviders: buildSocialProviders(),
@@ -653,13 +674,18 @@ export function createAuth(deps: CreateAuthDeps = {}) {
      * Sign-in only — the callback mails existing users and nobody else, and
      * `disableSignUp` refuses to create one even for a live token
      * (lib/auth-email.ts).
+     *
+     * `signUpAgreementsPlugin` always (#8765 D3): while sign-up is open,
+     * `/sign-up/email` without every sign-up agreement is refused before the
+     * handler looks the address up.
      */
     plugins: magicLinkActive
       ? [
           nextCookies(),
+          signUpAgreementsPlugin(),
           magicLink(makeMagicLinkOptions({ send: authEmailTransport })),
         ]
-      : [nextCookies()],
+      : [nextCookies(), signUpAgreementsPlugin()],
   });
   return instance;
 }

package/templates/apps/web/lib/__tests__/account-invite.test.ts

@@ -0,0 +1,63 @@
+/**
+ * account-invite.test.ts — #8757 D8 / AC-5: the /contact thank-you's account
+ * link, by the generated sign-in provider. A site signs in at its own
+ * locale-prefixed `/sign-in` and lands on its own `/account`; a hub-sign-in
+ * spoke starts at `/api/hub-session/sign-in`; a site with no sign-in gets no
+ * link, and neither does an email the hint schema refuses.
+ */
+
+let mockProvider: "site" | "hub" | "none" = "site";
+// eslint-disable-next-line no-restricted-syntax -- #507: SIGN_IN_PROVIDER is a generated per-build constant (#8757 D8), not a runtime input; no env or HTTP surface selects it.
+jest.mock("../topology.generated", () => ({
+  __esModule: true,
+  get SIGN_IN_PROVIDER() {
+    return mockProvider;
+  },
+}));
+
+import { accountInviteHref } from "../account-invite";
+
+afterEach(() => {
+  mockProvider = "site";
+});
+
+describe("accountInviteHref (#8757 D8)", () => {
+  it("site, the default locale: the bare /sign-in with next=/account and the email", () => {
+    expect(accountInviteHref("en", "a@b.example")).toBe(
+      "/sign-in?next=%2Faccount&email=a%40b.example",
+    );
+  });
+
+  it("site, another locale: both the sign-in path and next carry the prefix", () => {
+    expect(accountInviteHref("fr", "a@b.example")).toBe(
+      "/fr/sign-in?next=%2Ffr%2Faccount&email=a%40b.example",
+    );
+  });
+
+  it("site: a plus sign in the address is encoded, never read as a space", () => {
+    expect(accountInviteHref("en", "a+b@x.example")).toBe(
+      "/sign-in?next=%2Faccount&email=a%2Bb%40x.example",
+    );
+  });
+
+  it("hub: the spoke's hub-session start, unprefixed", () => {
+    mockProvider = "hub";
+    expect(accountInviteHref("fr", "a@b.example")).toBe(
+      "/api/hub-session/sign-in?next=%2Faccount&email=a%40b.example",
+    );
+  });
+
+  it("none: no link", () => {
+    mockProvider = "none";
+    expect(accountInviteHref("en", "a@b.example")).toBeNull();
+  });
+
+  it.each(["x\r\n@y.example", "a&next=/evil@b.example", "not-an-email", ""])(
+    "an email the hint schema refuses (%j) gives no link, on either provider",
+    (email) => {
+      expect(accountInviteHref("en", email)).toBeNull();
+      mockProvider = "hub";
+      expect(accountInviteHref("en", email)).toBeNull();
+    },
+  );
+});

package/templates/apps/web/lib/__tests__/auth-routes.test.ts

@@ -7,7 +7,7 @@
  * and the absent-header fail-safe — and the same for `isAccountPath()` (#7430).
  */
 
-import { AUTH_SEGMENTS, isAccountPath, isAuthPath } from "../auth-routes";
+import { AUTH_SEGMENTS, isAccountPath, isAuthPath, isBookingPath } from "../auth-routes";
 
 const LOCALES = ["en", "fr", "de"];
 
@@ -111,3 +111,29 @@ describe("isAccountPath (#7430, spec 7423 D4)", () => {
     expect(isAccountPath(null, LOCALES)).toBe(false);
   });
 });
+
+// #8843 D10 — the booking pages render without the marketing chrome.
+describe("isBookingPath (#8843)", () => {
+  it("matches /meet, a meeting page and /private, bare or locale-prefixed", () => {
+    for (const path of ["/meet", "/meet/", "/meet/intro", "/en/meet/intro", "/fr/meet", "/private", "/fr/private"]) {
+      expect(isBookingPath(path, LOCALES)).toBe(true);
+    }
+  });
+
+  it("does not match the confirmation page, which keeps the marketing chrome", () => {
+    expect(isBookingPath("/meet/confirmed", LOCALES)).toBe(false);
+    expect(isBookingPath("/fr/meet/confirmed", LOCALES)).toBe(false);
+  });
+
+  it("does not match a near miss or a marketing path", () => {
+    expect(isBookingPath("/meeting", LOCALES)).toBe(false);
+    expect(isBookingPath("/privacy", LOCALES)).toBe(false);
+    expect(isBookingPath("/blog/meet", LOCALES)).toBe(false);
+  });
+
+  it("fails to NOT-a-booking-path for an empty or absent pathname", () => {
+    expect(isBookingPath("", LOCALES)).toBe(false);
+    expect(isBookingPath(undefined, LOCALES)).toBe(false);
+    expect(isBookingPath(null, LOCALES)).toBe(false);
+  });
+});

package/templates/apps/web/lib/__tests__/consent-policies.test.ts

@@ -0,0 +1,23 @@
+/**
+ * The localized policy map (#8765 D9, AC-5): one map, the registry's keys,
+ * each path carrying the locale prefix off the default locale.
+ */
+import { consentPoliciesFor } from "../consent-policies";
+
+describe("consentPoliciesFor", () => {
+  it("is /contact's three destinations for the default locale", () => {
+    expect(consentPoliciesFor("en")).toEqual({
+      terms: "/terms",
+      privacy: "/privacy",
+      working_agreement: "/working-agreement",
+    });
+  });
+
+  it("prefixes every path for another locale", () => {
+    expect(consentPoliciesFor("fr")).toEqual({
+      terms: "/fr/terms",
+      privacy: "/fr/privacy",
+      working_agreement: "/fr/working-agreement",
+    });
+  });
+});

package/templates/apps/web/lib/__tests__/deck-page.test.ts

@@ -69,8 +69,9 @@ describe("deckCandidates (#8687 D3, AC-2)", () => {
     ]);
   });
 
-  it("/careers (gateable, no DECK_ROUTES entry) falls through to [slug]", () => {
+  it("/careers (sections mode since #8849) resolves the route row, then the [slug] fallback", () => {
     expect(deckCandidates("/careers", LOCALES)).toEqual([
+      { type: "CareersList", slug: "careers" },
       { type: "LandingPage", slug: "careers" },
       { type: "BlogList", slug: "careers" },
     ]);
@@ -197,10 +198,15 @@ describe("the registered inputsFor (#8687 D3, AC-2)", () => {
     const chrome = siteChrome as typeof siteChrome & {
       deckGrounds?: unknown;
       deckPresentation?: true;
+      deckAnchors?: "bare";
     };
     expect(result).toEqual({
       ...(chrome.deckGrounds !== undefined ? { deckGrounds: chrome.deckGrounds } : {}),
       deckPresentation: chrome.deckPresentation === true,
+      // #8773 — the design's slide naming rides along only when it presents and chose bare.
+      ...(chrome.deckPresentation === true && chrome.deckAnchors === "bare"
+        ? { deckAnchorStyle: "bare" }
+        : {}),
     });
   });
 

package/templates/apps/web/lib/__tests__/in-page-magnet.test.ts

@@ -0,0 +1,265 @@
+/**
+ * lib/in-page-magnet.ts — the in-page form shape (#8847 D6, D15; AC-2).
+ *
+ * Pure mapping and loader wrapping; the two hub reads are mocked at
+ * `@working-theory/api-client`, and the Server Action modules are stubbed so
+ * the bound action is asserted by identity.
+ */
+import { LeadCaptureForm } from "@working-theory/ui";
+import {
+  contactFormFlowConfig,
+  newsletterFlowConfig,
+  type FlowConfig,
+} from "@working-theory/validation";
+
+jest.mock("@working-theory/api-client", () => ({
+  flows: { get: jest.fn() },
+  leads: { captureStatus: jest.fn() },
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- test-seam mock: a "use server" boundary the module only binds
+jest.mock("../../app/[locale]/contact/contact.actions", () => ({
+  captureLeadAction: jest.fn(),
+}));
+// eslint-disable-next-line no-restricted-syntax -- test-seam mock: a "use server" boundary the module only binds
+jest.mock("../newsletter.actions", () => ({
+  subscribeNewsletterAction: jest.fn(),
+}));
+
+import { flows } from "@working-theory/api-client";
+
+import { captureLeadAction } from "../../app/[locale]/contact/contact.actions";
+import {
+  fillEndingName,
+  framedSources,
+  inPageView,
+  readServedMagnet,
+  renderInPageMagnet,
+  type InPageView,
+} from "../in-page-magnet";
+
+const mockFlowsGet = flows.get as jest.Mock;
+
+type FieldStep = Extract<FlowConfig["steps"][number], { type: "field" }>;
+
+/** A request-a-quote shaped contact magnet: name, email, need. */
+const QUOTE: FlowConfig = {
+  slug: "quote",
+  defaultLocale: "en",
+  steps: [
+    {
+      key: "quote",
+      type: "field",
+      copy: { title: { en: "Request a quote" }, body: { en: "Tell us the job." }, cta: { en: "Ask" } },
+      fields: [
+        { name: "name", inputType: "text", required: true, mapsTo: "name", copy: { label: { en: "Name" } } },
+        { name: "email", inputType: "email", required: true, mapsTo: "email", copy: { label: { en: "Email" } } },
+        { name: "need", inputType: "textarea", required: false, copy: { label: { en: "What do you need?" } } },
+      ],
+    },
+  ],
+};
+
+const TEXT = {
+  unavailableHeading: "Unavailable",
+  unavailableBody: "Write to {email}.",
+  unavailableNoEmail: "No email.",
+};
+
+describe("fillEndingName (#8841 D1's rule)", () => {
+  it("drops {name} with its comma when there is no name, and fills it when there is", () => {
+    expect(fillEndingName("Thanks, {name}.", "")).toBe("Thanks.");
+    expect(fillEndingName("Thanks, {name}.", "Ada")).toBe("Thanks, Ada.");
+  });
+});
+
+describe("inPageView — the form comes from the caller (C1)", () => {
+  it("a quote-shaped config asked for as contact maps its fields, title and body", () => {
+    const view = inPageView(QUOTE, "en", "contact")!;
+    expect(view.title).toBe("Request a quote");
+    expect(view.body).toBe("Tell us the job.");
+    expect(view.stepKey).toBe("quote");
+    expect("fields" in view.form && view.form.fields.map((f) => f.name)).toEqual(["name", "email", "need"]);
+  });
+
+  it("the newsletter config asked for as contact is null — it has no name field", () => {
+    expect(inPageView(newsletterFlowConfig, "en", "contact")).toBeNull();
+  });
+
+  it("the newsletter shape served at another slug maps when the caller asks for newsletter", () => {
+    const updates = { ...newsletterFlowConfig, slug: "updates" };
+    const view = inPageView(updates, "en", "newsletter")!;
+    expect(view.form).toMatchObject({
+      kind: "newsletter",
+      emailField: "email",
+      label: "Email",
+      placeholder: "you@example.com",
+      consent: { field: "terms", purposes: ["newsletter"], help: "No spam. Unsubscribe any time." },
+      submitLabel: "Subscribe",
+    });
+    expect(view.ending).toEqual({
+      kind: "screen",
+      headline: "Check your inbox",
+      body: "Your welcome email is on its way.",
+    });
+  });
+
+  it("a newsletter view is null with any other field to fill in, or a second step", () => {
+    const extra = JSON.parse(JSON.stringify(newsletterFlowConfig)) as FlowConfig;
+    (extra.steps[0] as FieldStep).fields.push({
+      name: "company",
+      inputType: "text",
+      copy: { label: { en: "Company" } },
+    });
+    expect(inPageView(extra, "en", "newsletter")).toBeNull();
+    const twoSteps = { ...newsletterFlowConfig, steps: [...newsletterFlowConfig.steps, ...QUOTE.steps] };
+    expect(inPageView(twoSteps, "en", "newsletter")).toBeNull();
+  });
+
+  it("the Contact form's ending is its config's; a config with none ends on the caller's line", () => {
+    expect(inPageView(contactFormFlowConfig, "en", "contact")!.ending).toEqual({
+      kind: "screen",
+      headline: "Message sent.",
+      body: "Thanks for getting in touch. I reply within one business day.",
+    });
+    expect(inPageView(QUOTE, "en", "contact", "Thank you!")!.ending).toEqual({
+      kind: "screen",
+      headline: "Thank you!",
+    });
+  });
+
+  it("an off-site redirect or button is dropped, never rendered (security review)", () => {
+    const offSite = {
+      ...QUOTE,
+      ending: { default: { kind: "redirect" as const, href: "https://evil.example/x" } },
+    } as FlowConfig;
+    expect(inPageView(offSite, "en", "contact", "Thanks")!.ending).toEqual({ kind: "screen", headline: "Thanks" });
+    const buttons = {
+      ...QUOTE,
+      ending: {
+        default: {
+          kind: "screen" as const,
+          headline: { en: "Done" },
+          ctas: [
+            { label: { en: "Evil" }, href: "//evil.example" },
+            { label: { en: "Home" }, href: "/" },
+          ],
+        },
+      },
+    } as FlowConfig;
+    expect(inPageView(buttons, "en", "contact")!.ending).toEqual({
+      kind: "screen",
+      headline: "Done",
+      ctas: [{ label: "Home", href: "/" }],
+    });
+  });
+
+  it("a redirect ending and a screen's buttons are localized", () => {
+    const redirect = { ...QUOTE, ending: { default: { kind: "redirect" as const, href: "/thanks" } } };
+    expect(inPageView(redirect, "fr", "contact")!.ending).toEqual({ kind: "redirect", href: "/fr/thanks" });
+  });
+});
+
+describe("framedSources (D6)", () => {
+  const source = { frontmatter: { type: "ContactPage", slug: "contact", title: "Old title" }, body: "" };
+  const view: Pick<InPageView, "title" | "body"> = { title: "Say hello", body: "Two days, tops." };
+
+  it("with no contact-form section both loaders' output is unchanged", async () => {
+    const sections = [{ id: "faq", type: "faq", data: { items: [] } }];
+    const framed = framedSources({
+      getMdxSource: jest.fn().mockResolvedValue(source),
+      getPageSections: jest.fn().mockResolvedValue(sections),
+      view,
+    });
+    expect(await framed.getMdxSource("ContactPage", "contact", "en")).toBe(source);
+    expect(await framed.getPageSections(source.frontmatter)).toBe(sections);
+  });
+
+  it("a leading contact-form section takes the view's title and body, and so does the frontmatter title", async () => {
+    const sections = [
+      { id: "contact", type: "contact-form", data: { variant: "column", headline: "Old", description: "Old line", fields: [] } },
+    ];
+    const framed = framedSources({
+      getMdxSource: jest.fn().mockResolvedValue(source),
+      getPageSections: jest.fn().mockResolvedValue(sections),
+      view,
+    });
+    expect((await framed.getMdxSource("ContactPage", "contact", "en"))!.frontmatter.title).toBe("Say hello");
+    expect((await framed.getPageSections(source.frontmatter))[0]!.data).toMatchObject({
+      headline: "Say hello",
+      description: "Two days, tops.",
+    });
+  });
+
+  it("a view with no body deletes the section's description", async () => {
+    const sections = [{ id: "c", type: "contact-form", data: { description: "Old line", fields: [] } }];
+    const framed = framedSources({
+      getMdxSource: jest.fn().mockResolvedValue(source),
+      getPageSections: jest.fn().mockResolvedValue(sections),
+      view: { title: "Say hello" },
+    });
+    expect((await framed.getPageSections(source.frontmatter))[0]!.data).not.toHaveProperty("description");
+  });
+});
+
+describe("renderInPageMagnet (D15)", () => {
+  it("a quote magnet asked for as contact binds captureLeadAction, stamped with its flow source", () => {
+    const view = inPageView(QUOTE, "en", "contact")!;
+    const element = renderInPageMagnet({
+      slug: "quote",
+      locale: "en",
+      view,
+      text: { ...TEXT } as never,
+      accepting: true,
+    });
+    expect(element.type).toBe(LeadCaptureForm);
+    expect(element.props).toMatchObject({
+      action: captureLeadAction,
+      // captureLeadAction keeps only CONTACT_LEAD_SOURCES, so this lands as contact-form.
+      source: "flow:quote",
+      look: "column",
+      ending: view.ending,
+    });
+  });
+
+  it("capture off is ContactFallback with the site's email", () => {
+    const element = renderInPageMagnet({
+      slug: "quote",
+      locale: "en",
+      view: inPageView(QUOTE, "en", "contact")!,
+      text: { ...TEXT } as never,
+      accepting: false,
+      fallbackEmail: "hi@x.co",
+    });
+    expect(element.props).toMatchObject({ email: "hi@x.co" });
+  });
+});
+
+describe("a config with no ending (review M1)", () => {
+  it("has no ending unless the caller gives a fallback line", () => {
+    expect(inPageView(QUOTE, "en", "contact")).not.toHaveProperty("ending");
+  });
+});
+
+describe("readServedMagnet", () => {
+  it("a hub that never answers is null after the deadline, not a hung page (review H2)", async () => {
+    jest.useFakeTimers();
+    try {
+      mockFlowsGet.mockReturnValueOnce(new Promise(() => undefined));
+      const read = readServedMagnet("stalled");
+      jest.advanceTimersByTime(2_000);
+      expect(await read).toBeNull();
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  it("is the served config, and null for a non-2xx or a throw", async () => {
+    mockFlowsGet.mockResolvedValueOnce({ ok: true, status: 200, body: QUOTE });
+    expect(await readServedMagnet("quote")).toBe(QUOTE);
+    mockFlowsGet.mockResolvedValueOnce({ ok: false, status: 404, body: {} });
+    expect(await readServedMagnet("absent")).toBeNull();
+    mockFlowsGet.mockRejectedValueOnce(new Error("hub down"));
+    expect(await readServedMagnet("down")).toBeNull();
+  });
+});

package/templates/apps/web/lib/__tests__/magnet-routes.test.ts

@@ -0,0 +1,57 @@
+/**
+ * #8840 D10, AC-4 — the magnet walk predicate the layout drops the chrome on.
+ */
+import { isMagnetWalkPath } from "../magnet-routes";
+
+const LOCALES = ["en", "fr"];
+
+describe("isMagnetWalkPath (#8840 D10)", () => {
+  it.each([
+    "/diagnostic/start",
+    "/fr/diagnostic/start",
+    "/flows/a/start",
+    "/careers/apply",
+    "/careers/writer/apply",
+    "/fr/careers/writer/apply",
+    "/diagnostic/start?step=2",
+  ])("is a walk: %s", (path) => {
+    expect(isMagnetWalkPath(path, LOCALES)).toBe(true);
+  });
+
+  it.each([
+    "/diagnostic",
+    "/careers",
+    "/careers/writer",
+    "/start-here",
+    "/fr",
+    "/",
+    "",
+    "/apply",
+    "/careers/a/b/apply",
+  ])("is not a walk: %j", (path) => {
+    expect(isMagnetWalkPath(path, LOCALES)).toBe(false);
+  });
+
+  it("answers false for an absent pathname", () => {
+    expect(isMagnetWalkPath(undefined, LOCALES)).toBe(false);
+    expect(isMagnetWalkPath(null, LOCALES)).toBe(false);
+  });
+
+  it("treats a prefix that is not an enabled locale as a first segment", () => {
+    expect(isMagnetWalkPath("/de/careers/apply", LOCALES)).toBe(false);
+    expect(isMagnetWalkPath("/de/start", LOCALES)).toBe(true);
+  });
+});
+
+describe("isMagnetWalkPath — the deliverable pages (#8848 D9, AC-4)", () => {
+  it.each(["/en/reports/q3", "/reports/q3", "/reports/q3/start", "/fr/reports/q3/start"])(
+    "is chrome-free: %s",
+    (path) => {
+      expect(isMagnetWalkPath(path, ["en", "fr"])).toBe(true);
+    },
+  );
+
+  it.each(["/reports", "/en/reports", "/en/reports/"])("keeps the index's chrome: %s", (path) => {
+    expect(isMagnetWalkPath(path, ["en", "fr"])).toBe(false);
+  });
+});