create-ailk 0.22.0 → 0.24.0

package/templates/apps/web/app/[locale]/downloads/page.tsx

@@ -1,37 +0,0 @@
-// Downloads list page. Reads DownloadsList MDX via renderPage and emits
-// a JSON-LD CollectionPage via the dispatcher. List-only — no detail route.
-import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
-import { renderPage, renderPageMetadata } from "@working-theory/page-renderer";
-import type { Metadata } from "next";
-import type { ReactElement } from "react";
-
-interface Props {
-  params: Promise<{ locale: string }>;
-  getMdxSource?: typeof defaultGetMdxSource;
-}
-
-export async function generateMetadata({
-  params,
-}: Pick<Props, "params">): Promise<Metadata> {
-  const { locale } = await params;
-  return renderPageMetadata({
-    type: "DownloadsList",
-    slug: "downloads",
-    locale,
-  });
-}
-
-export default async function Page({
-  params,
-  getMdxSource,
-}: Props): Promise<ReactElement> {
-  const { locale } = await params;
-  return renderPage({
-    type: "DownloadsList",
-    slug: "downloads",
-    locale,
-    translationsNamespace: "downloads",
-    bodyMode: "mdx-body",
-    ...(getMdxSource !== undefined && { getMdxSource }),
-  });
-}

package/templates/apps/web/app/[locale]/newsletter/__tests__/newsletter.actions.test.ts

@@ -1,139 +0,0 @@
-/**
- * subscribeNewsletterAction (#6730 D9) — the Server Action twin of the
- * `ailkSubscribeNewsletter` MCP tool.
- */
-
-import { subscribeNewsletterAction } from "../newsletter.actions.js";
-
-// `visitorForwardHeaders` stays real (#7394) so AC-9 compares the action's
-// `init` with the helper's own output.
-jest.mock("@working-theory/api-client", () => ({
-  leads: { subscribe: jest.fn() },
-  visitorForwardHeaders: jest.requireActual("@working-theory/api-client")
-    .visitorForwardHeaders,
-}));
-
-// next/headers' `headers()` is request-scoped in Next; outside it, it is
-// mocked here the way flow.actions.test.ts does (#7394 AC-9).
-jest.mock("next/headers", () => ({
-  __esModule: true,
-  headers: jest.fn().mockResolvedValue({ get: () => null }),
-}));
-
-import { leads, visitorForwardHeaders } from "@working-theory/api-client";
-import { headers } from "next/headers";
-const mockSubscribe = leads.subscribe as jest.Mock;
-const mockHeaders = headers as jest.Mock;
-
-function formWith(email: string): FormData {
-  const fd = new FormData();
-  fd.append("email", email);
-  fd.append("consent", "true");
-  return fd;
-}
-
-afterEach(() => {
-  jest.clearAllMocks();
-  mockHeaders.mockResolvedValue({ get: () => null });
-});
-
-describe("subscribeNewsletterAction", () => {
-  it("calls leads.subscribe with source newsletter and the address", async () => {
-    mockSubscribe.mockResolvedValueOnce({ ok: true, body: { id: "subscr_1", persisted: "db" } });
-
-    const result = await subscribeNewsletterAction(null, formWith("ada@example.com"));
-
-    expect(result).toEqual({ kind: "success" });
-    expect(mockSubscribe).toHaveBeenCalledWith(
-      expect.objectContaining({ source: "newsletter", email: "ada@example.com" }),
-    );
-  });
-
-  it("an invalid address → a field error, no API call", async () => {
-    const result = await subscribeNewsletterAction(null, formWith("not-an-email"));
-
-    expect(result).toMatchObject({ kind: "error", fieldErrors: { email: expect.any(String) } });
-    expect(mockSubscribe).not.toHaveBeenCalled();
-  });
-
-  it("503 lead_capture_not_configured → unavailable", async () => {
-    mockSubscribe.mockResolvedValueOnce({
-      ok: false,
-      status: 503,
-      body: { error: "lead_capture_not_configured" },
-    });
-
-    const result = await subscribeNewsletterAction(null, formWith("ada@example.com"));
-
-    expect(result).toEqual({ kind: "unavailable" });
-  });
-
-  it("any other failure → the generic error, never success", async () => {
-    mockSubscribe.mockResolvedValueOnce({ ok: false, status: 503, body: { error: "persist_failed" } });
-    expect(await subscribeNewsletterAction(null, formWith("a@b.co"))).toMatchObject({
-      kind: "error",
-    });
-
-    mockSubscribe.mockRejectedValueOnce(new Error("ECONNREFUSED"));
-    jest.spyOn(console, "error").mockImplementationOnce(() => undefined);
-    expect(await subscribeNewsletterAction(null, formWith("a@b.co"))).toMatchObject({
-      kind: "error",
-    });
-  });
-
-  it("a filled honeypot → success, and nothing is sent", async () => {
-    const fd = formWith("ada@example.com");
-    fd.append("ailk_hp", "spam");
-
-    expect(await subscribeNewsletterAction(null, fd)).toEqual({ kind: "success" });
-    expect(mockSubscribe).not.toHaveBeenCalled();
-  });
-});
-
-// #7394 AC-9 — a spoke forwards its visitor to the hub's leads rate limit.
-describe("subscribeNewsletterAction — visitor forwarding (#7394)", () => {
-  const FORWARD_KEY = "0123456789abcdef".repeat(4); // gitleaks:allow — test fixture, not a credential (#7394)
-  const ENV_KEYS = ["AILK_VISITOR_FORWARD_KEY", "AILK_API_URL"] as const;
-  const priorEnv = new Map(ENV_KEYS.map((name) => [name, process.env[name]]));
-
-  beforeEach(() => {
-    process.env.AILK_VISITOR_FORWARD_KEY = FORWARD_KEY;
-    process.env.AILK_API_URL = "https://hub.example";
-  });
-
-  afterAll(() => {
-    for (const [name, value] of priorEnv) {
-      if (value === undefined) delete process.env[name];
-      else process.env[name] = value;
-    }
-  });
-
-  it("passes the helper's two headers as init", async () => {
-    const incoming = {
-      get: (name: string) => (name === "x-forwarded-for" ? "203.0.113.5" : null),
-    };
-    mockHeaders.mockResolvedValue(incoming);
-    mockSubscribe.mockResolvedValueOnce({ ok: true, body: { id: "subscr_1", persisted: "db" } });
-
-    const result = await subscribeNewsletterAction(null, formWith("ada@example.com"));
-
-    expect(result).toEqual({ kind: "success" });
-    const expected = visitorForwardHeaders(incoming, FORWARD_KEY);
-    expect(expected).toEqual({
-      "x-ailk-visitor-ip": "203.0.113.5",
-      "x-ailk-visitor-forward-key": FORWARD_KEY,
-    });
-    expect(mockSubscribe).toHaveBeenCalledWith(expect.any(Object), { headers: expected });
-  });
-
-  it("calls leads.subscribe with one argument when headers() throws, and still succeeds", async () => {
-    mockHeaders.mockRejectedValue(new Error("outside a request scope"));
-    mockSubscribe.mockResolvedValueOnce({ ok: true, body: { id: "subscr_1", persisted: "db" } });
-
-    const result = await subscribeNewsletterAction(null, formWith("ada@example.com"));
-
-    expect(result).toEqual({ kind: "success" });
-    expect(mockSubscribe).toHaveBeenCalledTimes(1);
-    expect(mockSubscribe.mock.calls[0]).toHaveLength(1);
-  });
-});

package/templates/apps/web/app/[locale]/newsletter/newsletter.actions.ts

@@ -1,93 +0,0 @@
-"use server";
-
-/**
- * subscribeNewsletterAction — Server Action paired with the
- * `ailkSubscribeNewsletter` MCP tool (#6730 D9).
- *
- * `/newsletter` renders the shared `LeadCaptureForm` bound to this action
- * when the API accepts a subscription (a database is set up) and the page's
- * content declares no signup section of its own. Validates the address with
- * the tool's own input schema, calls `POST /v1/leads/subscribe` through
- * `@working-theory/api-client`, and maps the outcome the same way
- * `captureLeadAction` does: the API's 503 `lead_capture_not_configured` →
- * `unavailable`; any other non-2xx or thrown error → the generic `error`;
- * only a 2xx is `success`.
- *
- * Visitor forwarding (#7394): forwards the visitor exactly as
- * `captureLeadAction` does, through `visitorForwardHeaders` and the
- * server-only `AILK_VISITOR_FORWARD_KEY`; without them the call is made
- * with one argument, as before.
- */
-
-import { leads, visitorForwardHeaders } from "@working-theory/api-client";
-import { LEAD_CAPTURE_HONEYPOT, type LeadCaptureFormState } from "@working-theory/ui";
-import { subscribeNewsletterInputSchema } from "@working-theory/validation";
-import { cookies, headers } from "next/headers";
-
-import { consentVisitorHeader, readConsentVisitor } from "../../../lib/consent-visitor";
-
-const GENERIC_ERROR = "Something went wrong, please try again.";
-
-export async function subscribeNewsletterAction(
-  _prevState: LeadCaptureFormState,
-  formData: FormData,
-): Promise<LeadCaptureFormState> {
-  // Honeypot: a bot that fills the hidden field gets a person's answer, and
-  // nothing is sent.
-  const honeypot = formData.get(LEAD_CAPTURE_HONEYPOT);
-  if (typeof honeypot === "string" && honeypot !== "") return { kind: "success" };
-
-  const parsed = subscribeNewsletterInputSchema.safeParse({
-    email: formData.get("email"),
-  });
-  if (!parsed.success) {
-    return {
-      kind: "error",
-      fieldErrors: { email: parsed.error.issues[0]?.message ?? "Invalid email" },
-    };
-  }
-
-  const siteId = process.env.AILK_SITE_ID ?? "default";
-  const body = { siteId, source: "newsletter", email: parsed.data.email };
-  let init: { headers: Record<string, string> } | undefined;
-  try {
-    const forwarded = visitorForwardHeaders(
-      await headers(),
-      process.env.AILK_VISITOR_FORWARD_KEY,
-    );
-    if (forwarded) init = { headers: forwarded };
-  } catch {
-    // No request scope to read — subscribe without forwarding.
-  }
-
-  // #8438 D12 — the banner's visitor id, so a later subscribe links its
-  // cookie choices to the client record. Absent or invalid → no header.
-  try {
-    const visitorId = readConsentVisitor(await cookies());
-    if (visitorId) init = { headers: { ...(init?.headers ?? {}), ...consentVisitorHeader(visitorId) } };
-  } catch {
-    // No request scope to read — subscribe with no visitor-link header.
-  }
-
-  try {
-    const res = init
-      ? await leads.subscribe(body, init)
-      : await leads.subscribe(body);
-    if (!res.ok) {
-      const error =
-        typeof res.body === "object" && res.body !== null
-          ? (res.body as { error?: unknown }).error
-          : undefined;
-      if (res.status === 503 && error === "lead_capture_not_configured") {
-        return { kind: "unavailable" };
-      }
-      return { kind: "error", message: GENERIC_ERROR };
-    }
-    return { kind: "success" };
-  } catch (err) {
-    // The api-client never attaches the request payload to a thrown error,
-    // so logging `err` carries no subscriber address.
-    console.error("[subscribeNewsletterAction]", err);
-    return { kind: "error", message: GENERIC_ERROR };
-  }
-}

package/templates/apps/web/app/api/checkout/[offering]/route.ts

@@ -1,48 +0,0 @@
-// The buy route — the standard spoke checkout (#8748), kept current by
-// `create-ailk update`: do not edit it. Every guarantee lives in the
-// spoke-checkout package and arrives by a package bump. This site's offerings
-// are data in lib/checkout-config.ts, the one file to edit. It answers 404 on
-// any build that is not a spoke.
-//
-// A buyer who is signed in when checkout starts returns to /account; everyone
-// else returns to the thank-you page with Stripe's session id (#8757 D12). The
-// session is read through the site's generated seam: Better Auth on a site,
-// the sealed hub session on a hub-sign-in spoke, none without sign-in.
-import { createSpokeCheckout } from "@working-theory/spoke-checkout";
-
-import {
-  checkoutNotServed,
-  checkoutServed,
-  spokeCheckoutConfig,
-} from "../../../../lib/checkout";
-import { readSession } from "../../../../lib/topology.generated";
-
-export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-
-type BuyRoute = ReturnType<typeof createSpokeCheckout>["buy"];
-type BuyContext = Parameters<BuyRoute["GET"]>[1];
-
-let buy: BuyRoute | undefined;
-
-/** `/account` for a request with a session, else `null` (the thank-you page). */
-async function successPath(request: Request): Promise<string | null> {
-  return (await readSession(request.headers)) ? "/account" : null;
-}
-
-/** Built on the first served request and kept, so the package's rate limiters persist. */
-function buyRoute(): BuyRoute {
-  buy ??= createSpokeCheckout(spokeCheckoutConfig, { successPath }).buy;
-  return buy;
-}
-
-// platform-decisions-waiver: api-versioning — a browser buy link that redirects to Stripe Checkout, not a versioned API contract (spec 8748 §7)
-export async function GET(request: Request, ctx: BuyContext): Promise<Response> {
-  if (!checkoutServed()) return checkoutNotServed();
-  return buyRoute().GET(request, ctx);
-}
-
-export async function POST(request: Request, ctx: BuyContext): Promise<Response> {
-  if (!checkoutServed()) return checkoutNotServed();
-  return buyRoute().POST(request, ctx);
-}

package/templates/apps/web/app/api/checkout/__tests__/route.test.ts

@@ -1,120 +0,0 @@
-/**
- * @jest-environment node
- */
-
-/**
- * The standard buy route (#8748 D1, D11; spec
- * docs/specs/8748-a-standard-spoke-checkout-route-spec.md AC-2, AC-4).
- *
- * The checkout package is mocked: every guarantee is its own, proven by its
- * own suites. These cases prove the route is wiring only — built once from
- * `spokeCheckoutConfig`, serving the package's `buy` handlers on a spoke and
- * a 404 anywhere else — and that it declares no offering and no Stripe
- * client of its own.
- */
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-const mockBuyGet = jest.fn();
-const mockBuyPost = jest.fn();
-const mockCreateSpokeCheckout = jest.fn((_config: unknown) => ({
-  buy: { GET: mockBuyGet, POST: mockBuyPost },
-}));
-// `virtual`: CI runs this suite before the package's dist is built, so it
-// may not resolve at all — the factory stands in either way.
-jest.mock(
-  "@working-theory/spoke-checkout",
-  () => ({
-    __esModule: true,
-    createSpokeCheckout: (config: unknown) => mockCreateSpokeCheckout(config),
-  }),
-  { virtual: true },
-);
-
-const mockTopology: { value: "hub" | "spoke" } = { value: "spoke" };
-// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426), not a runtime input; the seam IS the boundary between a hub and a spoke build, and no env or HTTP surface selects it.
-jest.mock("../../../../lib/topology.generated", () => ({
-  __esModule: true,
-  get TOPOLOGY() {
-    return mockTopology.value;
-  },
-}));
-
-import { checkoutConfig } from "../../../../lib/checkout-config";
-import { spokeCheckoutConfig } from "../../../../lib/checkout";
-import { GET, POST } from "../[offering]/route";
-
-const ROUTE_SOURCE = readFileSync(
-  join(__dirname, "..", "[offering]", "route.ts"),
-  "utf8",
-);
-
-function ctxFor(offering: string) {
-  return { params: Promise.resolve({ offering }) };
-}
-
-function request(method: "GET" | "POST"): Request {
-  return new Request("https://acme.example.com/api/checkout/example", {
-    method,
-  });
-}
-
-describe("the standard buy route (#8748 AC-2)", () => {
-  beforeEach(() => {
-    mockBuyGet.mockReset();
-    mockBuyPost.mockReset();
-  });
-
-  it("answers 404 with no-store on a hub, and never builds the package's handlers (D11)", async () => {
-    mockTopology.value = "hub";
-    for (const res of [
-      await GET(request("GET"), ctxFor("example")),
-      await POST(request("POST"), ctxFor("example")),
-    ]) {
-      expect(res.status).toBe(404);
-      expect(res.headers.get("cache-control")).toBe("no-store");
-    }
-    expect(mockCreateSpokeCheckout).not.toHaveBeenCalled();
-    expect(mockBuyGet).not.toHaveBeenCalled();
-    expect(mockBuyPost).not.toHaveBeenCalled();
-  });
-
-  it("serves the package's buy handlers on a spoke, built once from spokeCheckoutConfig", async () => {
-    mockTopology.value = "spoke";
-    const fromGet = new Response(null, { status: 303 });
-    const fromPost = new Response(null, { status: 303 });
-    mockBuyGet.mockResolvedValue(fromGet);
-    mockBuyPost.mockResolvedValue(fromPost);
-
-    const getRequest = request("GET");
-    const getCtx = ctxFor("example");
-    expect(await GET(getRequest, getCtx)).toBe(fromGet);
-    expect(mockBuyGet).toHaveBeenCalledWith(getRequest, getCtx);
-
-    const postRequest = request("POST");
-    const postCtx = ctxFor("example");
-    expect(await POST(postRequest, postCtx)).toBe(fromPost);
-    expect(mockBuyPost).toHaveBeenCalledWith(postRequest, postCtx);
-
-    expect(mockCreateSpokeCheckout).toHaveBeenCalledTimes(1);
-    const [config] = mockCreateSpokeCheckout.mock.calls[0] as [
-      typeof spokeCheckoutConfig,
-    ];
-    expect(config).toBe(spokeCheckoutConfig);
-    expect(config.offerings).toBe(checkoutConfig.offerings);
-  });
-
-  it("names no offering of the site's own", () => {
-    for (const slug of Object.keys(checkoutConfig.offerings)) {
-      const quoted = new RegExp(`["'\`]${slug}["'\`]`);
-      const property = new RegExp(`\\b${slug}\\s*:`);
-      expect(ROUTE_SOURCE).not.toMatch(quoted);
-      expect(ROUTE_SOURCE).not.toMatch(property);
-    }
-  });
-
-  it("reads no Stripe setting and imports no Stripe client (AC-4)", () => {
-    expect(ROUTE_SOURCE).not.toContain("STRIPE_");
-    expect(ROUTE_SOURCE).not.toContain("stripe-client");
-  });
-});

package/templates/apps/web/app/api/checkout/__tests__/success-path.test.ts

@@ -1,86 +0,0 @@
-/**
- * @jest-environment node
- */
-
-/**
- * The buy route's success path (#8757 D12, AC-10): a buyer signed in when
- * checkout starts returns to `/account`, everyone else to the thank-you page.
- *
- * The route hands the checkout package a `successPath` hook built on the
- * site's generated session seam (`readSession` in lib/topology.generated —
- * Better Auth on a site, the sealed hub session on a hub-sign-in spoke, none
- * on a spoke without sign-in). The package is mocked: what it does with the
- * answer is its own suite's (`buy-route.test.ts`). These cases prove the hook
- * answers `"/account"` for a request with a session and `null` without one.
- */
-const mockCreateSpokeCheckout = jest.fn((_config: unknown, _options?: unknown) => ({
-  buy: { GET: jest.fn(async () => new Response(null, { status: 303 })), POST: jest.fn() },
-}));
-// `virtual`: CI runs this suite before the package's dist is built.
-jest.mock(
-  "@working-theory/spoke-checkout",
-  () => ({
-    __esModule: true,
-    createSpokeCheckout: (config: unknown, options?: unknown) =>
-      mockCreateSpokeCheckout(config, options),
-  }),
-  { virtual: true },
-);
-
-const mockReadSession = jest.fn();
-// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426), not a runtime input; the seam IS the boundary between a hub and a spoke build, and no env or HTTP surface selects it.
-jest.mock("../../../../lib/topology.generated", () => ({
-  __esModule: true,
-  TOPOLOGY: "spoke",
-  readSession: (headers: Headers) => mockReadSession(headers),
-}));
-
-import { GET } from "../[offering]/route";
-
-type SuccessPath = (request: Request) => Promise<string | null>;
-
-/** The `successPath` the route built its handlers with. */
-async function successPathHook(): Promise<SuccessPath> {
-  await GET(new Request("https://acme.example.com/api/checkout/example"), {
-    params: Promise.resolve({ offering: "example" }),
-  });
-  expect(mockCreateSpokeCheckout).toHaveBeenCalledTimes(1);
-  const [, options] = mockCreateSpokeCheckout.mock.calls[0] as [
-    unknown,
-    { successPath?: SuccessPath } | undefined,
-  ];
-  expect(typeof options?.successPath).toBe("function");
-  return options!.successPath!;
-}
-
-describe("the buy route's success path (#8757 AC-10)", () => {
-  let successPath: SuccessPath;
-
-  beforeAll(async () => {
-    successPath = await successPathHook();
-  });
-
-  beforeEach(() => {
-    mockReadSession.mockReset();
-  });
-
-  it("a request with a session answers /account", async () => {
-    mockReadSession.mockResolvedValue({
-      user: { email: "cleo@x.io", emailVerified: true },
-    });
-    const request = new Request("https://acme.example.com/api/checkout/example", {
-      headers: { cookie: "session=abc" },
-    });
-    await expect(successPath(request)).resolves.toBe("/account");
-    expect(mockReadSession).toHaveBeenCalledTimes(1);
-    const [headers] = mockReadSession.mock.calls[0] as [Headers];
-    expect(headers.get("cookie")).toBe("session=abc");
-  });
-
-  it("a request without one answers null", async () => {
-    mockReadSession.mockResolvedValue(null);
-    await expect(
-      successPath(new Request("https://acme.example.com/api/checkout/example")),
-    ).resolves.toBeNull();
-  });
-});

package/templates/apps/web/app/api/webhooks/stripe/__tests__/route.test.ts

@@ -1,92 +0,0 @@
-/**
- * @jest-environment node
- */
-
-/**
- * The standard Stripe webhook route (#8748 D1, D11; spec
- * docs/specs/8748-a-standard-spoke-checkout-route-spec.md AC-2, AC-4).
- *
- * The checkout package is mocked: its verification, filters, retries and
- * duplicate guard are proven by its own suites. These cases prove the route
- * is wiring only — built once from `spokeCheckoutConfig`, serving the
- * package's `webhook` handler on a spoke and a 404 anywhere else.
- */
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-const mockWebhookPost = jest.fn();
-const mockCreateSpokeCheckout = jest.fn((_config: unknown) => ({
-  webhook: { POST: mockWebhookPost },
-}));
-// `virtual`: CI runs this suite before the package's dist is built, so it
-// may not resolve at all — the factory stands in either way.
-jest.mock(
-  "@working-theory/spoke-checkout",
-  () => ({
-    __esModule: true,
-    createSpokeCheckout: (config: unknown) => mockCreateSpokeCheckout(config),
-  }),
-  { virtual: true },
-);
-
-const mockTopology: { value: "hub" | "spoke" } = { value: "spoke" };
-// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426), not a runtime input; the seam IS the boundary between a hub and a spoke build, and no env or HTTP surface selects it.
-jest.mock("../../../../../lib/topology.generated", () => ({
-  __esModule: true,
-  get TOPOLOGY() {
-    return mockTopology.value;
-  },
-}));
-
-import { checkoutConfig } from "../../../../../lib/checkout-config";
-import { spokeCheckoutConfig } from "../../../../../lib/checkout";
-import { POST } from "../route";
-
-const ROUTE_SOURCE = readFileSync(join(__dirname, "..", "route.ts"), "utf8");
-
-function delivery(): Request {
-  return new Request("https://acme.example.com/api/webhooks/stripe", {
-    method: "POST",
-    body: "{}",
-  });
-}
-
-describe("the standard Stripe webhook route (#8748 AC-2)", () => {
-  beforeEach(() => {
-    mockWebhookPost.mockReset();
-  });
-
-  it("answers 404 with no-store on a hub, and never builds the package's handlers (D11)", async () => {
-    mockTopology.value = "hub";
-    const res = await POST(delivery());
-    expect(res.status).toBe(404);
-    expect(res.headers.get("cache-control")).toBe("no-store");
-    expect(mockCreateSpokeCheckout).not.toHaveBeenCalled();
-    expect(mockWebhookPost).not.toHaveBeenCalled();
-  });
-
-  it("serves the package's webhook handler on a spoke, built once from spokeCheckoutConfig", async () => {
-    mockTopology.value = "spoke";
-    const answered = new Response(null, { status: 200 });
-    mockWebhookPost.mockResolvedValue(answered);
-
-    const first = delivery();
-    expect(await POST(first)).toBe(answered);
-    expect(mockWebhookPost).toHaveBeenCalledWith(first);
-    const second = delivery();
-    expect(await POST(second)).toBe(answered);
-    expect(mockWebhookPost).toHaveBeenLastCalledWith(second);
-
-    expect(mockCreateSpokeCheckout).toHaveBeenCalledTimes(1);
-    const [config] = mockCreateSpokeCheckout.mock.calls[0] as [
-      typeof spokeCheckoutConfig,
-    ];
-    expect(config).toBe(spokeCheckoutConfig);
-    expect(config.offerings).toBe(checkoutConfig.offerings);
-  });
-
-  it("reads no Stripe setting and imports no Stripe client (AC-4)", () => {
-    expect(ROUTE_SOURCE).not.toContain("STRIPE_");
-    expect(ROUTE_SOURCE).not.toContain("stripe-client");
-  });
-});

package/templates/apps/web/app/api/webhooks/stripe/route.ts

@@ -1,31 +0,0 @@
-// The Stripe webhook route — the standard spoke checkout (#8748), kept current
-// by `create-ailk update`: do not edit it. Every guarantee lives in the
-// spoke-checkout package and arrives by a package bump. This site's checkout
-// data is lib/checkout-config.ts, the one file to edit. It answers 404 on any
-// build that is not a spoke.
-import { createSpokeCheckout } from "@working-theory/spoke-checkout";
-
-import {
-  checkoutNotServed,
-  checkoutServed,
-  spokeCheckoutConfig,
-} from "../../../../lib/checkout";
-
-export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-
-type WebhookRoute = ReturnType<typeof createSpokeCheckout>["webhook"];
-
-let webhook: WebhookRoute | undefined;
-
-/** Built on the first served request and kept for every later one. */
-function webhookRoute(): WebhookRoute {
-  webhook ??= createSpokeCheckout(spokeCheckoutConfig).webhook;
-  return webhook;
-}
-
-// platform-decisions-waiver: api-versioning — the endpoint URL registered in Stripe, not a versioned API contract (spec 8748 §7)
-export async function POST(request: Request): Promise<Response> {
-  if (!checkoutServed()) return checkoutNotServed();
-  return webhookRoute().POST(request);
-}