create-ailk 0.22.0 → 0.23.0

package/templates/apps/web/lib/__tests__/checkout.test.ts

@@ -1,243 +0,0 @@
-/**
- * @jest-environment node
- */
-
-/**
- * The standard spoke checkout (#8748 D6; spec
- * docs/specs/8748-a-standard-spoke-checkout-route-spec.md AC-2, AC-3, AC-4).
- *
- * `./checkout-config` — the site's own data — is mocked with a fixture in
- * every case, so this suite passes against any shape of the site's file,
- * including a pre-#8748 one that also carries `siteBaseUrl` and `fulfil`.
- * The hub's `leads.submit` is the one external boundary mocked: the
- * fulfilment must post one lead marked with the site, under the session id as
- * its Idempotency-Key, with a body that stays byte-identical between attempts
- * so the hub can replay it.
- */
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-const mockSubmit = jest.fn();
-jest.mock("@working-theory/api-client", () => ({
-  __esModule: true,
-  leads: { submit: (...args: unknown[]) => mockSubmit(...args) },
-}));
-
-const OFFERINGS = {
-  starter: { kind: "fixed", lookupKey: "acme_starter", cancelPath: "/" },
-};
-const mockSite: { value: Record<string, unknown> } = {
-  value: { site: "acme", offerings: OFFERINGS },
-};
-// eslint-disable-next-line no-restricted-syntax -- #507: the site's checkout-config.ts is the site's own data, not this suite's subject; a fixture stands in for it so the suite holds against any shape a site's file has (#8748 AC-2).
-jest.mock("../checkout-config", () => ({
-  __esModule: true,
-  get checkoutConfig() {
-    return mockSite.value;
-  },
-}));
-
-const mockTopology: { value: "hub" | "spoke" } = { value: "spoke" };
-// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426), not a runtime input; the seam IS the boundary between a hub and a spoke build, and no env or HTTP surface selects it.
-jest.mock("../topology.generated", () => ({
-  __esModule: true,
-  get TOPOLOGY() {
-    return mockTopology.value;
-  },
-}));
-
-type CheckoutModule = typeof import("../checkout");
-
-/** `lib/checkout.ts`, loaded fresh against the current site fixture. */
-function load(site: Record<string, unknown> = { site: "acme", offerings: OFFERINGS }): CheckoutModule {
-  mockSite.value = site;
-  let loaded!: CheckoutModule;
-  jest.isolateModules(() => {
-    loaded = require("../checkout") as CheckoutModule;
-  });
-  return loaded;
-}
-
-/** A test-mode completion as the package hands it to `fulfil`. */
-const COMPLETION = {
-  idempotencyKey: "cs_test_1",
-  sessionId: "cs_test_1",
-  offering: "starter",
-  kind: "fixed" as const,
-  mode: "test" as const,
-  livemode: false,
-  paymentStatus: "paid" as const,
-  amountTotal: 4900,
-  currency: "usd",
-  email: "b@example.com",
-  customerId: "cus_test_1",
-  termsOfService: null,
-  termsStamp: null,
-  metadata: { site: "acme", offering: "starter", kind: "fixed" },
-};
-
-/**
- * `renderConfig`'s body for COMPLETION, key order included (NFR5), plus the
- * session's terms consent as its last key (#8778).
- */
-const EXPECTED_BODY =
-  '{"siteId":"acme","source":"web","email":"b@example.com","payload":{"site":"acme","page":"checkout","offering":"starter","checkoutKind":"fixed","mode":"test","amountTotal":4900,"currency":"usd","stripeCustomerId":"cus_test_1","checkoutSession":"cs_test_1","termsAccepted":null}}';
-
-const SOURCE = readFileSync(join(__dirname, "..", "checkout.ts"), "utf8");
-const ENV = process.env;
-
-beforeEach(() => {
-  mockSubmit.mockReset();
-  mockSubmit.mockResolvedValue({ ok: true, status: 201 });
-  process.env = { ...ENV, AILK_SPOKE_KEY: "spoke-key-fixture" };
-  mockTopology.value = "spoke";
-});
-
-afterAll(() => {
-  process.env = ENV;
-});
-
-describe("spokeCheckoutConfig (#8748 AC-2, AC-4)", () => {
-  it("exports exactly spokeCheckoutConfig, checkoutServed and checkoutNotServed", () => {
-    expect(Object.keys(load()).sort()).toEqual([
-      "checkoutNotServed",
-      "checkoutServed",
-      "spokeCheckoutConfig",
-    ]);
-  });
-
-  it("has exactly site, offerings, siteBaseUrl and fulfil, the offerings being the site's own object", () => {
-    const { spokeCheckoutConfig } = load();
-    expect(Object.keys(spokeCheckoutConfig).sort()).toEqual([
-      "fulfil",
-      "offerings",
-      "site",
-      "siteBaseUrl",
-    ]);
-    expect(spokeCheckoutConfig.site).toBe("acme");
-    expect(spokeCheckoutConfig.offerings).toBe(OFFERINGS);
-  });
-
-  it("takes only site and offerings from a site file that also carries env, siteBaseUrl and fulfil (SEC-8748-B)", async () => {
-    const siteFulfil = jest.fn();
-    const { spokeCheckoutConfig } = load({
-      site: "acme",
-      offerings: OFFERINGS,
-      env: { STRIPE_MODE: "live" },
-      siteBaseUrl: "https://elsewhere.example",
-      fulfil: siteFulfil,
-    });
-    expect(Object.keys(spokeCheckoutConfig).sort()).toEqual([
-      "fulfil",
-      "offerings",
-      "site",
-      "siteBaseUrl",
-    ]);
-    expect("env" in spokeCheckoutConfig).toBe(false);
-    expect(spokeCheckoutConfig.siteBaseUrl).not.toBe("https://elsewhere.example");
-    expect(spokeCheckoutConfig.fulfil).not.toBe(siteFulfil);
-    await spokeCheckoutConfig.fulfil(COMPLETION);
-    expect(siteFulfil).not.toHaveBeenCalled();
-    expect(mockSubmit).toHaveBeenCalledTimes(1);
-  });
-
-  it("reads no Stripe setting and imports no Stripe client (AC-4)", () => {
-    expect(SOURCE).not.toContain("STRIPE_");
-    expect(SOURCE).not.toContain("stripe-client");
-  });
-});
-
-describe("checkoutServed / checkoutNotServed (#8748 D11)", () => {
-  it("serves on a spoke only", () => {
-    const { checkoutServed } = load();
-    mockTopology.value = "spoke";
-    expect(checkoutServed()).toBe(true);
-    mockTopology.value = "hub";
-    expect(checkoutServed()).toBe(false);
-  });
-
-  it("answers 404 with no-store", () => {
-    const res = load().checkoutNotServed();
-    expect(res.status).toBe(404);
-    expect(res.headers.get("cache-control")).toBe("no-store");
-  });
-});
-
-describe("the fulfilment (#8748 AC-3)", () => {
-  it("posts one lead marked with the site, under the session id as its Idempotency-Key", async () => {
-    await load().spokeCheckoutConfig.fulfil(COMPLETION);
-    expect(mockSubmit).toHaveBeenCalledTimes(1);
-    const [body, init] = mockSubmit.mock.calls[0] as [unknown, unknown];
-    expect(body).toEqual({
-      siteId: "acme",
-      source: "web",
-      email: "b@example.com",
-      payload: {
-        site: "acme",
-        page: "checkout",
-        offering: "starter",
-        checkoutKind: "fixed",
-        mode: "test",
-        amountTotal: 4900,
-        currency: "usd",
-        stripeCustomerId: "cus_test_1",
-        checkoutSession: "cs_test_1",
-        termsAccepted: null,
-      },
-    });
-    expect(init).toEqual({ headers: { "Idempotency-Key": "cs_test_1" } });
-    expect(JSON.stringify(body)).toBe(EXPECTED_BODY);
-  });
-
-  it("carries the stamp of the terms the buyer accepted as payload.termsAccepted (#8778)", async () => {
-    await load().spokeCheckoutConfig.fulfil({
-      ...COMPLETION,
-      termsOfService: "accepted",
-      termsStamp: "account_terms@2",
-    });
-    const [body] = mockSubmit.mock.calls[0] as [{ payload: Record<string, unknown> }];
-    expect(body.payload["termsAccepted"]).toBe("account_terms@2");
-  });
-
-  it.each([
-    ["a box not accepted", { termsOfService: null, termsStamp: "account_terms@2" }],
-    ["an accepted box with no stamp", { termsOfService: "accepted" as const, termsStamp: null }],
-  ])("sends termsAccepted: null for %s (#8778)", async (_label, terms) => {
-    await load().spokeCheckoutConfig.fulfil({ ...COMPLETION, ...terms });
-    const [body] = mockSubmit.mock.calls[0] as [{ payload: Record<string, unknown> }];
-    expect(body.payload).toHaveProperty("termsAccepted", null);
-  });
-
-  it("sends the same bytes under the same key on a replay", async () => {
-    const { spokeCheckoutConfig } = load();
-    await spokeCheckoutConfig.fulfil(COMPLETION);
-    await spokeCheckoutConfig.fulfil(COMPLETION);
-    expect(mockSubmit).toHaveBeenCalledTimes(2);
-    const [first, second] = mockSubmit.mock.calls as [
-      [unknown, unknown],
-      [unknown, unknown],
-    ];
-    expect(JSON.stringify(second[0])).toBe(JSON.stringify(first[0]));
-    expect(second[1]).toEqual(first[1]);
-  });
-
-  it("makes no call for a completion without an email", async () => {
-    await load().spokeCheckoutConfig.fulfil({ ...COMPLETION, email: null });
-    expect(mockSubmit).not.toHaveBeenCalled();
-  });
-
-  it("rejects with no call when AILK_SPOKE_KEY is unset", async () => {
-    delete process.env["AILK_SPOKE_KEY"];
-    await expect(load().spokeCheckoutConfig.fulfil(COMPLETION)).rejects.toThrow(
-      "AILK_SPOKE_KEY is not set",
-    );
-    expect(mockSubmit).not.toHaveBeenCalled();
-  });
-
-  it("rejects when the hub answers { ok: false }", async () => {
-    mockSubmit.mockResolvedValue({ ok: false, status: 422 });
-    await expect(load().spokeCheckoutConfig.fulfil(COMPLETION)).rejects.toThrow(
-      "hub lead write answered 422",
-    );
-  });
-});

package/templates/apps/web/lib/__tests__/meeting-slugs.test.ts

@@ -1,120 +0,0 @@
-// oss: false
-/**
- * Tests for enabledMeetingSlugs (#6183 S9b D5) — the D4-resolving read both
- * /meet pages share — and its spoke branch (#7872 D4).
- *
- * The topology seam is mocked: its hub render imports `../auth`, which this
- * suite has no reason to load (`app/openapi.json/__tests__/route.test.ts`'s
- * pattern).
- */
-const mockMeetingTypes = jest.fn();
-jest.mock("@working-theory/api-client", () => ({
-  __esModule: true,
-  schedule: { meetingTypes: (...args: unknown[]) => mockMeetingTypes(...args) },
-}));
-
-const mockTopology: { value: "hub" | "spoke" } = { value: "hub" };
-// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426 D5), not a runtime input; the seam IS the boundary between a hub and a spoke build, and there is no env or HTTP surface that selects it.
-jest.mock("../topology.generated", () => ({
-  get TOPOLOGY() {
-    return mockTopology.value;
-  },
-}));
-
-import { enabledMeetingSlugs } from "../meeting-slugs";
-
-describe("enabledMeetingSlugs", () => {
-  const originalEnv = process.env["SCHEDULING_CAL_LINK"];
-
-  beforeEach(() => {
-    mockMeetingTypes.mockReset();
-    mockTopology.value = "hub";
-  });
-
-  afterEach(() => {
-    if (originalEnv === undefined) delete process.env["SCHEDULING_CAL_LINK"];
-    else process.env["SCHEDULING_CAL_LINK"] = originalEnv;
-  });
-
-  it("passes a real, populated array through unchanged", async () => {
-    mockMeetingTypes.mockResolvedValue({
-      ok: true,
-      body: { slugs: ["intro", "demo"] },
-    });
-
-    await expect(enabledMeetingSlugs()).resolves.toEqual(["intro", "demo"]);
-  });
-
-  it("passes a real, intentionally empty array through unchanged (D4 row 2 — never the fallback)", async () => {
-    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
-    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: [] } });
-
-    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
-  });
-
-  it("null + SCHEDULING_CAL_LINK set → the derived singleton (D4 row 1)", async () => {
-    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
-    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
-
-    await expect(enabledMeetingSlugs()).resolves.toEqual(["intro-call"]);
-  });
-
-  it("null + SCHEDULING_CAL_LINK unset → [] (no shipped page to protect)", async () => {
-    delete process.env["SCHEDULING_CAL_LINK"];
-    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
-
-    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
-  });
-
-  it("a non-ok API result → [], fail closed — an outage must not open the gate", async () => {
-    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
-    mockMeetingTypes.mockResolvedValue({ ok: false, status: 500, body: null });
-
-    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
-  });
-
-  it("null + a MALFORMED SCHEDULING_CAL_LINK slug → [], never a corrupt fallback (D14 parity, security review 2026-09-19)", async () => {
-    // A comma in the derived slug would corrupt the batched event-meta
-    // `calLinks` join downstream (it splits on comma), misattributing the
-    // rest of the list to a foreign owner — MeetingSlugSchema rejects it.
-    process.env["SCHEDULING_CAL_LINK"] = "acme/intro,evil";
-    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
-
-    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
-  });
-});
-
-describe("enabledMeetingSlugs on a spoke (#7872 D4)", () => {
-  const originalEnv = process.env["SCHEDULING_CAL_LINK"];
-
-  beforeEach(() => {
-    mockMeetingTypes.mockReset();
-    mockTopology.value = "spoke";
-  });
-
-  afterEach(() => {
-    mockTopology.value = "hub";
-    if (originalEnv === undefined) delete process.env["SCHEDULING_CAL_LINK"];
-    else process.env["SCHEDULING_CAL_LINK"] = originalEnv;
-  });
-
-  it("null + SCHEDULING_CAL_LINK set → [], never the fallback: the hub books only a stored slug", async () => {
-    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
-    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
-
-    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
-  });
-
-  it("passes the workspace's stored list through unchanged", async () => {
-    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: ["intro"] } });
-
-    await expect(enabledMeetingSlugs()).resolves.toEqual(["intro"]);
-  });
-
-  it("a non-ok API result → [], fail closed", async () => {
-    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
-    mockMeetingTypes.mockResolvedValue({ ok: false, status: 401, body: null });
-
-    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
-  });
-});

package/templates/apps/web/lib/checkout.ts

@@ -1,93 +0,0 @@
-// checkout.ts — the standard spoke checkout (#8748).
-//
-// The standard every selling spoke shares, kept current by `create-ailk
-// update`: do not edit it. This site's checkout is data in
-// lib/checkout-config.ts, the one file to edit. Only the buy route and the
-// Stripe webhook route import this file, and it never imports the checkout
-// package: every guarantee lives there and arrives by a package bump.
-//
-// spokeCheckoutConfig  What the two routes build their handlers from. It reads
-//                      only `site` and `offerings` from the site's file, so no
-//                      other key a site declares reaches the package.
-// fulfil               Runs for each paid session, at least once. It posts one
-//                      lead to the hub with the session id as its
-//                      Idempotency-Key, so a repeat writes nothing new. The hub
-//                      dedupes only an identical body: change the payload's
-//                      shape only when no webhook is failing. `termsAccepted`
-//                      is the stamp of the terms the buyer ticked in Stripe's
-//                      box, else null: the hub records the buyer's checkout
-//                      consent grant from it (#8778).
-import { leads } from "@working-theory/api-client";
-
-import { resolveBaseUrl } from "../src/lib/routes";
-
-import { checkoutConfig } from "./checkout-config";
-import { TOPOLOGY } from "./topology.generated";
-
-/** What the fulfilment reads from a completed checkout. */
-interface CompletedCheckout {
-  idempotencyKey: string;
-  sessionId: string;
-  offering: string;
-  kind: "fixed" | "quoted";
-  mode: "test" | "live";
-  amountTotal: number | null;
-  currency: string | null;
-  email: string | null;
-  customerId: string | null;
-  termsOfService: "accepted" | null;
-  termsStamp: string | null;
-}
-
-async function fulfil(checkout: CompletedCheckout): Promise<void> {
-  if (checkout.email === null) return;
-  // No spoke key: the hub cannot place the lead in this site's workspace.
-  // Fail, so Stripe retries and the dashboard shows a failed webhook.
-  if (!process.env.AILK_SPOKE_KEY)
-    throw new Error("AILK_SPOKE_KEY is not set");
-  const result = await leads.submit(
-    {
-      siteId: checkoutConfig.site,
-      source: "web",
-      email: checkout.email,
-      payload: {
-        site: checkoutConfig.site,
-        page: "checkout",
-        offering: checkout.offering,
-        checkoutKind: checkout.kind,
-        mode: checkout.mode,
-        amountTotal: checkout.amountTotal,
-        currency: checkout.currency,
-        stripeCustomerId: checkout.customerId,
-        checkoutSession: checkout.sessionId,
-        termsAccepted:
-          checkout.termsOfService === "accepted" ? checkout.termsStamp : null,
-      },
-    },
-    { headers: { "Idempotency-Key": checkout.idempotencyKey } },
-  );
-  // A replay under the same key answers 201 with the first lead; any
-  // failure (422 idempotency_key_reused included) makes Stripe retry.
-  if (!result.ok) throw new Error(`hub lead write answered ${result.status}`);
-}
-
-/** The config both routes pass to the checkout package, built key by key. */
-export const spokeCheckoutConfig = {
-  site: checkoutConfig.site,
-  offerings: checkoutConfig.offerings,
-  siteBaseUrl: resolveBaseUrl(),
-  fulfil,
-};
-
-/** Whether this build serves the checkout: a spoke only (#8748 D11). */
-export function checkoutServed(): boolean {
-  return TOPOLOGY === "spoke";
-}
-
-/** What either route answers on a build that does not serve the checkout. */
-export function checkoutNotServed(): Response {
-  return new Response(null, {
-    status: 404,
-    headers: { "Cache-Control": "no-store" },
-  });
-}

package/templates/apps/web/lib/meeting-slugs.ts

@@ -1,63 +0,0 @@
-// oss: false
-/**
- * enabledMeetingSlugs — the enabled-meeting-slugs read both `/meet` pages
- * share (#6183 S9b D5).
- *
- * Resolves `GET /v1/schedule/meeting-types`'s three D4 outcomes into ONE
- * array both pages consume identically:
- *
- *   - an array is returned as-is (a real, operator-written enabled list —
- *     D4 rows 2 and 3, INCLUDING an intentionally empty `[]`);
- *   - `null` becomes the D4 row-1 singleton derived from
- *     `SCHEDULING_CAL_LINK` — the ONE slug an unconfigured deployment has
- *     ever advertised — or `[]` when that env var is unset;
- *   - any non-`ok` API result becomes `[]`, fail closed: an API outage
- *     must not open the gate.
- *
- * A duplicated inline call in both pages is how the two would drift, and
- * it is also how one of them would forget the fail-closed arm — this is
- * the ONE place that reasoning lives (D5).
- *
- * ON A SPOKE (#7872 D4), `null` means `[]`: the `SCHEDULING_CAL_LINK`
- * fallback is not consulted. The hub books a spoke's slug only when that
- * spoke's workspace has stored it (`spokeMayBook`), so a fallback slug would
- * advertise a meeting whose every booking fails with `event_not_found`. The
- * other arms are the same on both topologies.
- */
-import { schedule } from "@working-theory/api-client";
-import { MeetingSlugSchema } from "@working-theory/site-config/schema";
-
-import { TOPOLOGY } from "./topology.generated";
-
-/**
- * The D4 row-1 fallback: the slug half of the env-configured booker's own
- * calLink (`"<owner>/<slug>"`), or `[]` when the env var is unset. This is
- * deliberately the ONLY reader of `SCHEDULING_CAL_LINK`'s SECOND segment —
- * `meet/[slug]/page.tsx`'s own `composedCalLink` reads the FIRST segment
- * (the owner) for an unrelated purpose and is not touched by this file.
- *
- * Re-validated against `MeetingSlugSchema` (D14 parity with the operator-
- * written path — `meeting-types.ts`'s own per-entry `safeParse` filter):
- * `SCHEDULING_CAL_LINK` is operator-set env config, not a schema-validated
- * write, so a malformed value (a stray comma, an empty second segment) could
- * otherwise yield a slug that corrupts the batched `event-meta` `calLinks`
- * join downstream — which splits on comma and would misattribute the rest
- * of the list to a foreign owner (security review, 2026-09-19).
- */
-function derivedFallbackSlugs(): string[] {
-  const configured = process.env["SCHEDULING_CAL_LINK"];
-  if (!configured) return [];
-  const slug = configured.split("/")[1];
-  if (!slug) return [];
-  const parsed = MeetingSlugSchema.safeParse(slug);
-  return parsed.success ? [parsed.data] : [];
-}
-
-/** The enabled meeting-type slug set for this deployment, D4-resolved. */
-export async function enabledMeetingSlugs(): Promise<string[]> {
-  const res = await schedule.meetingTypes();
-  if (!res.ok) return [];
-  const { slugs } = res.body;
-  if (slugs) return slugs;
-  return TOPOLOGY === "spoke" ? [] : derivedFallbackSlugs();
-}