create-ailk 0.23.0 → 0.24.0

package/templates/apps/api/src/routes/checkout/__tests__/offerings-authorization.test.ts

@@ -86,6 +86,9 @@ const mockClientForOrganization = jest.fn();
 jest.mock("../../../services/offerings/connection.js", () => ({
   getStripeConnectionSummary: (...args: unknown[]) =>
     mockConnectionSummary(...args),
+  // The connection state Offerings sells on (#9285): the stub answers both.
+  getOfferingsConnectionState: (...args: unknown[]) =>
+    mockConnectionSummary(...args),
   stripeClientForOrganization: (...args: unknown[]) =>
     mockClientForOrganization(...args),
 }));
@@ -209,6 +212,8 @@ const SECRETS = [
   "Growth_Monthly",
   "growth_pro_monthly",
   "wendi_retainer",
+  "ailk-pro-plus_monthly",
+  "ailk-pro_yearly",
   PROD_A.id,
   PROD_B.id,
   PROD_C.id,
@@ -451,6 +456,47 @@ describe("AC-1 — every miss is one 404 that never echoes the key", () => {
   });
 });
 
+// ── #9338 DD5: the Offerings path never sells a hub plan ───────────────────
+
+describe("#9338 DD5 (AC-5) — the anonymous Offerings path refuses the hub's plans", () => {
+  const PROD_HUB = product("prod_Hub9338");
+  const HUB_PP_MONTHLY = recurringPrice("price_Hub9338ppm", "ailk-pro-plus_monthly", PROD_HUB);
+  const HUB_PRO_YEARLY = {
+    ...recurringPrice("price_Hub9338proy", "ailk-pro_yearly", PROD_HUB),
+    recurring: { interval: "year", interval_count: 1, usage_type: "licensed" },
+  };
+
+  beforeEach(() => {
+    // The hub Product is enabled AND shown, so only the guard can refuse it.
+    givenRows([PROD_A.id, PROD_HUB.id], [PROD_A.id, PROD_HUB.id]);
+    client = fakeClient({
+      growth_monthly: [PRICE_A],
+      "ailk-pro-plus_monthly": [HUB_PP_MONTHLY],
+      "ailk-pro_yearly": [HUB_PRO_YEARLY],
+    });
+  });
+
+  it.each(["ailk-pro-plus_monthly", "ailk-pro_yearly"])(
+    "%s, shown and enabled, answers the one 404 before any read or Stripe call",
+    async (key) => {
+      const res = await post({ ...BODY, productCode: key });
+      expect(res.statusCode).toBe(404);
+      expect(res.body).toBe(JSON.stringify({ error: "unknown-product-code" }));
+      expect(mockClientForOrganization).not.toHaveBeenCalled();
+      expect(mockReadEnabledProductIds).not.toHaveBeenCalled();
+      expect(mockReadWorkspaceSelection).not.toHaveBeenCalled();
+      expect(client.prices.list).not.toHaveBeenCalled();
+      expect(client.checkout.sessions.create).not.toHaveBeenCalled();
+      expect(mockRecordCheckoutSession).not.toHaveBeenCalled();
+    },
+  );
+
+  it("growth_monthly from the same fixtures still sells", async () => {
+    const res = await post();
+    expect(res.statusCode).toBe(201);
+  });
+});
+
 // ── AC-2: the stamped, anonymous, recorded session (A6, A7, A11) ────────────
 
 describe("#9070 D5 (AC-5) — a workspace saved per Price sells only its shown Prices", () => {
@@ -698,6 +744,24 @@ describe("AC-3 (A9) — the env path, composed with the real stripe-client and m
     expect(mockChargeWriteBudget).not.toHaveBeenCalled();
   });
 
+  it("the re-keyed Pro Plus (ailk-pro-plus_monthly, ailk_group plan) answers the 404 (#9338 DD5)", async () => {
+    mockEnvPricesList.mockResolvedValue({
+      data: [
+        {
+          id: "price_EnvPP",
+          type: "recurring",
+          product: { id: "prod_EnvPP", metadata: { ailk_group: "plan" } },
+        },
+      ],
+    });
+
+    const res = await post({ ...BODY, productCode: "ailk-pro-plus_monthly" });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json()).toEqual({ error: "unknown-product-code" });
+    expect(mockEnvSessionsCreate).not.toHaveBeenCalled();
+  });
+
   it("a Product with no ailk_group still sells on the env path", async () => {
     mockEnvPricesList.mockResolvedValue({
       data: [
@@ -1298,3 +1362,65 @@ describe("AC-6 — what the logs and the bodies never carry", () => {
     }
   });
 });
+
+// ── #9285: an Organization selling through the environment key ──────────────
+
+describe("#9296 — an Organization on the environment key never takes the Offerings path", () => {
+  const SPOKE = { "x-ailk-spoke-key": "spoke-key-9285" };
+
+  beforeEach(() => {
+    mockConnectionSummary.mockResolvedValue("environment");
+  });
+
+  it("keeps the env path even when the workspace has a saved selection", async () => {
+    // The default fixtures give the workspace a selection (givenRows).
+    const res = await post();
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({ error: "stripe-not-configured" });
+    expect(mockClientForOrganization).not.toHaveBeenCalled();
+    expect(mockRecordCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  it("keeps the env path while the workspace has no selection", async () => {
+    mockReadWorkspaceSelection.mockResolvedValue(null);
+
+    const res = await post();
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({ error: "stripe-not-configured" });
+    expect(mockClientForOrganization).not.toHaveBeenCalled();
+    expect(mockRecordCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  it("refuses a spoke's workspace as unconnected, selection or not", async () => {
+    const res = await post(BODY, SPOKE);
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json()).toEqual({ error: "unknown-product-code" });
+    expect(mockClientForOrganization).not.toHaveBeenCalled();
+  });
+
+  it("still takes the Offerings path for a stored connection", async () => {
+    mockConnectionSummary.mockResolvedValue(SUMMARY);
+
+    const res = await post();
+
+    expect(res.statusCode).toBe(201);
+    expect(mockClientForOrganization).toHaveBeenCalledWith(ORG);
+    expect(mockRecordCheckoutSession.mock.calls[0][0]).toMatchObject({
+      workspaceId: WS,
+      organizationId: ORG,
+    });
+  });
+
+  it("leaves a non-owner (no connection) on the env path, as before", async () => {
+    mockConnectionSummary.mockResolvedValue(null);
+
+    const res = await post();
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({ error: "stripe-not-configured" });
+    expect(mockClientForOrganization).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/api/src/routes/content/get-page.ts

@@ -28,50 +28,36 @@
  * composed from the deployment's `_site.mdx` identity (identity node, optional
  * secondary, WebSite) rather than the page title. Every other type's body is
  * the page's own JSON-LD, spread at the root, as before.
+ *
+ * #7169: the document is built by `readContentDocument` in
+ * `@working-theory/content-adapters` — the shared seam the `read_content` MCP
+ * tool answers through, parsing the same `@working-theory/validation` exports —
+ * over the `_site.mdx` this route still reads (the package may not import
+ * `@working-theory/site-config`).
  */
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
 import {
-  SCHEMA_ORG_TYPES,
+  readContentDocument,
   type ContentAdapter,
-  type ContentPage,
   type MdxContentAdapter,
-  type MdxPageSource,
-  type SchemaOrgType,
 } from "@working-theory/content-adapters";
-import {
-  buildJsonLd,
-  composeGraph,
-  graphNodes,
-  type ContentPageInput,
-  type JsonLdObject,
-  type SitewideIdentityInput,
-} from "@working-theory/schema";
 import {
   SiteConfigSchema,
   type SiteConfig,
 } from "@working-theory/site-config/schema";
+import {
+  contentPageParamsSchema,
+  contentPageQuerySchema,
+} from "@working-theory/validation";
 import type { FastifyPluginAsync } from "fastify";
 import { parse as parseYaml } from "yaml";
-import { z } from "zod";
 
 import { getContentRoot } from "../../lib/content-adapter.js";
 import { resolveLocale } from "../../lib/locales.js";
 import { resolvePublicContentAdapter } from "../../services/public-site-resolver.js";
 
-import { SLUG_PATTERN } from "./slug.js";
-
-const paramsSchema = z.object({
-  type: z.enum(SCHEMA_ORG_TYPES),
-  slug: z.string().regex(SLUG_PATTERN),
-});
-
-const querySchema = z.object({
-  locale: z.string().optional(),
-  include: z.enum(["body"]).optional(),
-});
-
 /**
  * The raw-body capability, probed by the exact name the MDX adapter declares
  * and the database adapter borrows (#5874) — the same idiom, and the same
@@ -114,38 +100,6 @@ function readSiteConfig(contentRoot: string): SiteConfig | undefined {
   return siteConfigByRoot.get(contentRoot) ?? undefined;
 }
 
-/**
- * The `HomePage` body's `@graph` (#6597, spec D11): the spine plus the site's
- * sitewide identity nodes. The WebSite's `inLanguage` is the spine's own, so
- * both carry one value; the Organization falls back to the page's `image` as
- * its `logo` when the identity declares none, as the title-derived node did.
- */
-function homePageGraph(
-  primary: JsonLdObject,
-  image: string | undefined,
-): { "@context": "https://schema.org"; "@graph": JsonLdObject[] } {
-  const config = readSiteConfig(getContentRoot());
-  let site: SitewideIdentityInput | undefined;
-  if (config !== undefined) {
-    const identity = config.siteIdentity;
-    site = {
-      origin: config.baseUrl.replace(/\/+$/, ""),
-      siteName: config.siteName,
-      baseUrl: config.baseUrl,
-      inLanguage:
-        typeof primary["inLanguage"] === "string" ? primary["inLanguage"] : undefined,
-      identity:
-        identity.kind !== "Person" && identity.logo === undefined && image !== undefined
-          ? { ...identity, logo: image }
-          : identity,
-    };
-  }
-  return {
-    "@context": "https://schema.org",
-    "@graph": graphNodes(composeGraph({ primary, site, isHomePage: true })),
-  };
-}
-
 export const getPageRoute: FastifyPluginAsync = async (fastify) => {
   fastify.get<{
     Params: { type: string; slug: string };
@@ -153,7 +107,7 @@ export const getPageRoute: FastifyPluginAsync = async (fastify) => {
   }>(
     "/v1/content/:type/:slug",
     async (request, reply) => {
-      const parsed = paramsSchema.safeParse(request.params);
+      const parsed = contentPageParamsSchema.safeParse(request.params);
       if (!parsed.success) {
         return reply.status(400).send({
           error: "Invalid type or slug",
@@ -161,7 +115,7 @@ export const getPageRoute: FastifyPluginAsync = async (fastify) => {
         });
       }
 
-      const queryParsed = querySchema.safeParse(request.query);
+      const queryParsed = contentPageQuerySchema.safeParse(request.query);
       if (!queryParsed.success) {
         return reply.status(400).send({
           error: "Invalid query parameters",
@@ -191,74 +145,35 @@ export const getPageRoute: FastifyPluginAsync = async (fastify) => {
         // Refused before any content query, so a caller asking for a body this
         // deployment cannot serve is never charged a read whose result is then
         // discarded.
-        let readSource: MdxContentAdapter["getPageSource"] | undefined;
-        if (include === "body") {
-          if (!hasPageSource(adapter)) {
-            return reply.status(400).send({
-              error: "Invalid query parameters",
-              details: [
-                {
-                  path: ["include"],
-                  message: "body is not available from this content adapter",
-                },
-              ],
-            });
-          }
-          readSource = adapter.getPageSource.bind(adapter);
+        if (include === "body" && !hasPageSource(adapter)) {
+          return reply.status(400).send({
+            error: "Invalid query parameters",
+            details: [
+              {
+                path: ["include"],
+                message: "body is not available from this content adapter",
+              },
+            ],
+          });
         }
 
-        // #5927: ONE adapter call supplies everything the response sends.
-        // `readSource` (bound above, only when `include=body`) returns BOTH
-        // the frontmatter and the body from the SAME read, so the two halves
-        // can never straddle a publish that lands between two independent
-        // calls. Without the parameter, `getPageBySlug` is the only call, as
-        // it always was. `source` stays `undefined` on that path — the
-        // `source && {...}` below never attaches a body to the response.
-        let source: MdxPageSource | null | undefined;
-        let page: ContentPage | null;
-        if (readSource) {
-          source = await readSource(type as SchemaOrgType, slug, locale);
-          page = source === null ? null : source.frontmatter;
-        } else {
-          page = await adapter.getPageBySlug(type as SchemaOrgType, slug, locale);
-        }
-        if (!page) {
+        // #5927: ONE adapter call supplies everything the response sends —
+        // the builder reads `getPageSource` only when `include=body`, and
+        // `getPageBySlug` alone otherwise, so the two halves can never
+        // straddle a publish that lands between two independent calls.
+        const document = await readContentDocument(
+          adapter,
+          { type, slug, locale, include },
+          readSiteConfig(getContentRoot()),
+        );
+        if (!document) {
           return reply.status(404).send({
             error: "Page not found",
             type,
             slug,
           });
         }
-
-        // #8746 — the site's origin, from `_site.mdx`'s `baseUrl`, for a
-        // builder that needs an absolute URL (JobPosting's ApplyAction).
-        const origin = readSiteConfig(getContentRoot())?.baseUrl.replace(/\/+$/, "");
-        const input: ContentPageInput = {
-          type: page.type,
-          slug: page.slug,
-          title: page.title,
-          description: page.description,
-          ...(origin !== undefined && { origin }),
-          ...(page.publishedAt !== undefined && {
-            publishedAt: page.publishedAt,
-          }),
-          ...(page.updatedAt !== undefined && { updatedAt: page.updatedAt }),
-          ...(page.image !== undefined && { image: page.image }),
-          ...(page.schema !== undefined && { schema: page.schema }),
-          // ADR-0026: carry the page's typed sections so recipes compose entity
-          // JSON-LD from real section data (e.g. FAQPage.mainEntity from `faq`
-          // sections) rather than a hand-rolled `schema` override. The adapter
-          // now preserves `sections`; before, it was stripped at validation.
-          ...(page.sections !== undefined && { sections: page.sections }),
-        };
-        const primary = buildJsonLd(input);
-        const jsonLd =
-          page.type === "HomePage" ? homePageGraph(primary, page.image) : primary;
-        return reply.send({
-          ...jsonLd,
-          page,
-          ...(source && { body: source.body }),
-        });
+        return reply.send(document);
       } catch (error) {
         request.log.error({ err: error }, "[Content] getPage failed");
         return reply.status(500).send({ error: "Internal server error" });

package/templates/apps/api/src/routes/content/list-pages.ts

@@ -5,43 +5,32 @@
  * pageSize 20; pageSize is capped at 100 to keep response payloads bounded.
  *
  * Response envelope is an `ItemList` JSON-LD document carrying the page
- * frontmatter under `items` and pagination metadata alongside. A deployment
- * whose site cannot be resolved (#5852) answers 404, not an empty list.
+ * frontmatter under `items` and pagination metadata alongside, built by
+ * `listPagesItemList` in `@working-theory/content-adapters` — the shared seam
+ * the `list_pages` MCP tool answers through, parsing the same
+ * `@working-theory/validation` exports (#7168). A deployment whose site
+ * cannot be resolved (#5852) answers 404, not an empty list.
  *
  * Phase 3 S3: optional `?locale=<locale>` query parameter. Validated against
  * `readLocales()` allowlist; invalid or unknown locale silently falls back to
  * the project's default locale (AC-i18n-07).
  */
-import { SCHEMA_ORG_TYPES, type SchemaOrgType } from "@working-theory/content-adapters";
+import { listPagesItemList } from "@working-theory/content-adapters";
+import {
+  contentListParamsSchema,
+  contentListQuerySchema,
+} from "@working-theory/validation";
 import type { FastifyPluginAsync } from "fastify";
-import { z } from "zod";
 
 import { resolveLocale } from "../../lib/locales.js";
 import { resolvePublicContentAdapter } from "../../services/public-site-resolver.js";
 
-const paramsSchema = z.object({
-  type: z.enum(SCHEMA_ORG_TYPES),
-});
-
-const PAGE_SIZE_MAX = 100;
-
-const querySchema = z.object({
-  page: z.coerce.number().int().min(1).default(1),
-  pageSize: z.coerce
-    .number()
-    .int()
-    .min(1)
-    .default(20)
-    .transform((v) => Math.min(v, PAGE_SIZE_MAX)),
-  locale: z.string().optional(),
-});
-
 export const listPagesRoute: FastifyPluginAsync = async (fastify) => {
   fastify.get<{
     Params: { type: string };
     Querystring: { page?: string; pageSize?: string; locale?: string };
   }>("/v1/content/:type", async (request, reply) => {
-    const params = paramsSchema.safeParse(request.params);
+    const params = contentListParamsSchema.safeParse(request.params);
     if (!params.success) {
       return reply.status(400).send({
         error: "Invalid type",
@@ -49,7 +38,7 @@ export const listPagesRoute: FastifyPluginAsync = async (fastify) => {
       });
     }
 
-    const query = querySchema.safeParse(request.query);
+    const query = contentListQuerySchema.safeParse(request.query);
     if (!query.success) {
       return reply.status(400).send({
         error: "Invalid query parameters",
@@ -74,19 +63,9 @@ export const listPagesRoute: FastifyPluginAsync = async (fastify) => {
         });
       }
 
-      const all = await adapter.listPages(type as SchemaOrgType, locale);
-      const totalItems = all.length;
-      const totalPages = Math.max(1, Math.ceil(totalItems / pageSize));
-      const start = (page - 1) * pageSize;
-      const items = all.slice(start, start + pageSize);
-
-      return reply.send({
-        "@context": "https://schema.org",
-        "@type": "ItemList",
-        type,
-        items,
-        pagination: { page, pageSize, totalItems, totalPages },
-      });
+      return reply.send(
+        await listPagesItemList(adapter, { type, page, pageSize, locale }),
+      );
     } catch (error) {
       request.log.error({ err: error }, "[Content] listPages failed");
       return reply.status(500).send({ error: "Internal server error" });

package/templates/apps/api/src/routes/content/search.ts

@@ -7,11 +7,12 @@
  * parity contract in the root CLAUDE.md. Until this route existed the parity
  * was one-sided, the tool having no endpoint to map to.
  *
- * Query:
- *   q        required, 1..200 chars — the search string. The ceiling matches
- *            the `search_content` MCP tool's own cap (`searchContentInputSchema`)
- *            so the pair rejects the same inputs, and bounds the work an
- *            unauthenticated caller can ask of the scorer per request.
+ * Query — parsed with `contentSearchQuerySchema` (`@working-theory/validation`),
+ * the export the `search_content` MCP tool parses with too, so the pair
+ * accepts and rejects the same inputs (#7167):
+ *   q        required, 1..200 chars — the search string. The ceiling bounds
+ *            the work an unauthenticated caller can ask of the scorer per
+ *            request.
  *   type     optional — a schema.org page type
  *   category optional — a LEAF slug from the site-category registry. Outside
  *            the registry is a 400, not an empty result: the registry is
@@ -26,10 +27,10 @@
  * ordering is belt-and-braces, and `/v1/content/types` is the same shape that
  * already proves it.
  *
- * The response is an `ItemList` JSON-LD document. `items` is the adapter's own
- * `SearchResult[]`, unreshaped: a caller comparing this route against the MCP
- * tool must see the same objects, and a projection here would be the place
- * they silently diverged.
+ * The response is an `ItemList` JSON-LD document, built by
+ * `searchContentItemList` in `@working-theory/content-adapters` — the shared
+ * seam the MCP tool answers through, so the pair cannot diverge. `items` is
+ * the adapter's own `SearchResult[]`, unreshaped.
  *
  * Rate limiting is inherited: `server.ts` registers the limiter GLOBALLY with
  * the content ceiling (`rate-limit.ts`'s `CONTENT_RATE_LIMIT_UNAUTH` /
@@ -46,30 +47,13 @@
  * carries no detail an unauthenticated caller could use to tell it apart
  * from "nothing matched" (AC-WCE-05).
  */
-import {
-  SCHEMA_ORG_TYPES,
-  type SearchOptions,
-} from "@working-theory/content-adapters";
-import { CategorySlugSchema } from "@working-theory/schema/categories";
+import { searchContentItemList } from "@working-theory/content-adapters";
+import { contentSearchQuerySchema } from "@working-theory/validation";
 import type { FastifyPluginAsync } from "fastify";
-import { z } from "zod";
 
 import { resolveLocale } from "../../lib/locales.js";
 import { resolvePublicContentAdapter } from "../../services/public-site-resolver.js";
 
-const LIMIT_MAX = 50;
-const LIMIT_DEFAULT = 10;
-/** Mirrors `searchContentInputSchema`'s `query` cap — the pair rejects alike. */
-const QUERY_MAX = 200;
-
-const querySchema = z.object({
-  q: z.string().min(1).max(QUERY_MAX),
-  type: z.enum(SCHEMA_ORG_TYPES).optional(),
-  category: CategorySlugSchema.optional(),
-  limit: z.coerce.number().int().min(1).max(LIMIT_MAX).default(LIMIT_DEFAULT),
-  locale: z.string().optional(),
-});
-
 export const searchContentRoute: FastifyPluginAsync = async (fastify) => {
   fastify.get<{
     Querystring: {
@@ -80,7 +64,7 @@ export const searchContentRoute: FastifyPluginAsync = async (fastify) => {
       locale?: string;
     };
   }>("/v1/content/search", async (request, reply) => {
-    const query = querySchema.safeParse(request.query);
+    const query = contentSearchQuerySchema.safeParse(request.query);
     if (!query.success) {
       return reply.status(400).send({
         error: "Invalid query parameters",
@@ -91,13 +75,6 @@ export const searchContentRoute: FastifyPluginAsync = async (fastify) => {
     const { q, type, category, limit } = query.data;
     const locale = resolveLocale(query.data.locale);
 
-    const options: SearchOptions = {
-      limit,
-      ...(type !== undefined && { type }),
-      ...(category !== undefined && { category }),
-      locale,
-    };
-
     try {
       // Site resolution precedes any content query (#5852, #5910). A refusal
       // is a 404 sharing the same "Page not found" error string a
@@ -112,15 +89,9 @@ export const searchContentRoute: FastifyPluginAsync = async (fastify) => {
         });
       }
 
-      const items = await adapter.searchPages(q, options);
-
-      return reply.send({
-        "@context": "https://schema.org",
-        "@type": "ItemList",
-        query: q,
-        items,
-        totalItems: items.length,
-      });
+      return reply.send(
+        await searchContentItemList(adapter, { q, type, category, limit, locale }),
+      );
     } catch (error) {
       request.log.error({ err: error }, "[Content] searchPages failed");
       return reply.status(500).send({ error: "Internal server error" });