create-ailk 0.23.0 → 0.25.1

package/templates/apps/mcp/__tests__/tools/create_project.test.ts

@@ -1,243 +0,0 @@
-/**
- * Tests for the ailkCreateProject MCP tool handler.
- *
- * Acceptance criteria verified here:
- * - scaffoldInputSchema validates correct inputs
- * - scaffoldInputSchema rejects invalid inputs (empty projectName, missing targetDir)
- * - ailkCreateProject scaffolds into a tmp dir: package.json + ≥1 file created
- * - ailkCreateProject fails cleanly when targetDir is non-empty (rejects with Error)
- * - Output validates against scaffoldOutputSchema
- * - No direct create-ailk import in apps/mcp (architectural guard)
- *
- * Hermetic: uses os.tmpdir() + unique subdir. No network calls.
- * Integration tests pass CLI_PATH explicitly to ailkCreateProject (second arg)
- * so they don't depend on process.cwd() being the repo root in Jest.
- */
-
-import {
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-
-import { scaffoldInputSchema, scaffoldOutputSchema } from "@working-theory/validation";
-
-import { ailkCreateProject } from "../../src/tools/create_project.js";
-
-// ── Input schema tests ────────────────────────────────────────────────────────
-
-describe("scaffoldInputSchema", () => {
-  it("accepts valid input with targetDir and projectName", () => {
-    const result = scaffoldInputSchema.safeParse({
-      targetDir: "/tmp/my-site",
-      projectName: "my-site",
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("accepts valid input with optional preset", () => {
-    const result = scaffoldInputSchema.safeParse({
-      targetDir: "/tmp/my-site",
-      projectName: "my-site",
-      preset: "default",
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("rejects input missing targetDir", () => {
-    const result = scaffoldInputSchema.safeParse({
-      projectName: "my-site",
-    });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects input with empty projectName", () => {
-    const result = scaffoldInputSchema.safeParse({
-      targetDir: "/tmp/my-site",
-      projectName: "",
-    });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects input missing projectName", () => {
-    const result = scaffoldInputSchema.safeParse({
-      targetDir: "/tmp/my-site",
-    });
-    expect(result.success).toBe(false);
-  });
-});
-
-// ── Output schema tests ───────────────────────────────────────────────────────
-
-describe("scaffoldOutputSchema", () => {
-  it("accepts a valid success output", () => {
-    const result = scaffoldOutputSchema.safeParse({
-      targetDir: "/tmp/my-site",
-      filesCreated: 5,
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("accepts zero filesCreated (empty template edge case)", () => {
-    const result = scaffoldOutputSchema.safeParse({
-      targetDir: "/tmp/my-site",
-      filesCreated: 0,
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("rejects output missing targetDir", () => {
-    const result = scaffoldOutputSchema.safeParse({ filesCreated: 5 });
-    expect(result.success).toBe(false);
-  });
-});
-
-// ── Handler integration tests ─────────────────────────────────────────────────
-
-// Resolve CLI_PATH relative to the repo root using __dirname traversal.
-// __tests__/tools → __tests__ → apps/mcp → apps → repo root
-const REPO_ROOT = resolve(__dirname, "../../../..");
-const CLI_PATH = join(REPO_ROOT, "packages/create-ailk/dist/cli.js");
-// NO_HAND_IMPLEMENT_OK: trunk fix for a red main (CI run 36386534464), operator-attended session.
-// The CLI substitutes `workspace:*` versions from create-ailk's gitignored
-// `versions.json`, which only `build-templates` writes ("empty before the first
-// build"); with it absent every scaffold throws "no version found for …".
-// Turbo gives this package's test no dependency on create-ailk's build-templates
-// step, so whether the file exists here depends on shard packing. Every case
-// that runs the CLI therefore skips — with a warning, never a failure — until
-// both the CLI and its version map are on disk.
-const VERSIONS_PATH = join(REPO_ROOT, "packages/create-ailk/versions.json");
-
-/** True (after warning) when the CLI cannot scaffold in this checkout yet. */
-function skipUnlessCliReady(): boolean {
-  if (!existsSync(CLI_PATH)) {
-    console.warn("[create_project.test] skipping integration test — CLI not built");
-    return true;
-  }
-  if (!existsSync(VERSIONS_PATH)) {
-    console.warn(
-      "[create_project.test] skipping integration test — run `pnpm --filter create-ailk run build-templates` first",
-    );
-    return true;
-  }
-  return false;
-}
-
-describe("ailkCreateProject handler", () => {
-  let scratch: string;
-
-  beforeAll(() => {
-    if (!existsSync(CLI_PATH)) {
-      console.warn(
-        `[create_project.test] create-ailk CLI not built: ${CLI_PATH} missing. ` +
-          "Run `pnpm --filter create-ailk build` first.",
-      );
-    }
-  });
-
-  beforeEach(() => {
-    scratch = mkdtempSync(join(tmpdir(), "ailk-mcp-scaffold-"));
-  });
-
-  afterEach(() => {
-    rmSync(scratch, { recursive: true, force: true });
-  });
-
-  it("scaffolds at least one file into a fresh tmp dir and reports targetDir", async () => {
-    if (skipUnlessCliReady()) return;
-    const target = join(scratch, "my-site");
-    const output = await ailkCreateProject(
-      { targetDir: target, projectName: "my-site" },
-      CLI_PATH,
-    );
-    expect(output.targetDir).toBe(target);
-    expect(output.filesCreated).toBeGreaterThan(0);
-  });
-
-  it("scaffolds package.json when full templates are built (build-templates required)", async () => {
-    if (skipUnlessCliReady()) return;
-    const TEMPLATES_DIR = join(REPO_ROOT, "packages/create-ailk/templates");
-    const PKG_JSON_IN_TEMPLATES = join(TEMPLATES_DIR, "package.json");
-    if (!existsSync(PKG_JSON_IN_TEMPLATES)) {
-      console.warn(
-        "[create_project.test] skipping package.json assertion — run `pnpm --filter create-ailk run build-templates` first",
-      );
-      return;
-    }
-    const target = join(scratch, "my-site");
-    await ailkCreateProject({ targetDir: target, projectName: "my-site" }, CLI_PATH);
-    expect(existsSync(join(target, "package.json"))).toBe(true);
-  });
-
-  it("scaffolds app dir when full templates are built (build-templates required)", async () => {
-    if (skipUnlessCliReady()) return;
-    const TEMPLATES_DIR = join(REPO_ROOT, "packages/create-ailk/templates");
-    const PKG_JSON_IN_TEMPLATES = join(TEMPLATES_DIR, "package.json");
-    if (!existsSync(PKG_JSON_IN_TEMPLATES)) {
-      console.warn(
-        "[create_project.test] skipping app dir assertion — run `pnpm --filter create-ailk run build-templates` first",
-      );
-      return;
-    }
-    const target = join(scratch, "my-site");
-    await ailkCreateProject({ targetDir: target, projectName: "my-site" }, CLI_PATH);
-    // The template produces apps/web/app/ from the monorepo template snapshot.
-    const hasApp =
-      existsSync(join(target, "app")) ||
-      existsSync(join(target, "apps", "web", "app"));
-    expect(hasApp).toBe(true);
-  });
-
-  it("returns at least one file (schema-typed page seed or README.md)", async () => {
-    if (skipUnlessCliReady()) return;
-    const target = join(scratch, "my-site");
-    await ailkCreateProject({ targetDir: target, projectName: "my-site" }, CLI_PATH);
-    // At minimum README.md is always emitted by the template.
-    expect(existsSync(join(target, "README.md"))).toBe(true);
-  });
-
-  it("returns output conforming to scaffoldOutputSchema", async () => {
-    if (skipUnlessCliReady()) return;
-    const target = join(scratch, "my-site");
-    const output = await ailkCreateProject(
-      { targetDir: target, projectName: "my-site" },
-      CLI_PATH,
-    );
-    const result = scaffoldOutputSchema.safeParse(output);
-    expect(result.success).toBe(true);
-  });
-
-  it("rejects with a clear error when targetDir is non-empty", async () => {
-    if (skipUnlessCliReady()) return;
-    const target = join(scratch, "populated");
-    mkdirSync(target);
-    writeFileSync(join(target, "existing.txt"), "data");
-
-    // The create-ailk CLI exits non-zero with a ValidationError message when
-    // the target exists and is non-empty. The MCP handler rejects with a
-    // descriptive Error whose message matches the CLI stderr output.
-    await expect(
-      ailkCreateProject({ targetDir: target, projectName: "populated" }, CLI_PATH),
-    ).rejects.toThrow(/non-empty|exists/i);
-  });
-});
-
-// ── Architectural guard ───────────────────────────────────────────────────────
-
-describe("architectural guard — no create-ailk direct import", () => {
-  it("apps/mcp/src/tools/create_project.ts does not import create-ailk directly", async () => {
-    const { readFileSync } = await import("node:fs");
-    const { resolve: res } = await import("node:path");
-    const src = readFileSync(
-      res(__dirname, "../../src/tools/create_project.ts"),
-      "utf-8",
-    );
-    // Must not have a static import of create-ailk or its dist
-    expect(src).not.toMatch(/from ['"]create-ailk['"]/);
-    expect(src).not.toMatch(/require\s*\(\s*['"]create-ailk['"]/);
-  });
-});

package/templates/apps/mcp/__tests__/tools/purchase.test.ts

@@ -1,451 +0,0 @@
-/**
- * Tests for the ailkPurchase MCP tool.
- *
- * Rewritten for #6001: three security reviews on PR #5991 flagged that an
- * anonymous MCP caller could forward its own successUrl/cancelUrl/
- * allowPromotionCodes to `checkout.createSession` — a phishing-amplification
- * open redirect off the seller's real checkout — so the tool is now gated by
- * `purchaseMcpInputSchema`, a `.strict()` `.pick()` of the shared
- * `purchaseInputSchema` exposing exactly `productCode` + `quantity`. A call
- * carrying any of the three excluded fields now FAILS validation rather than
- * having them silently stripped, and both redirects are ALWAYS derived from
- * `AILK_BASE_URL`.
- *
- * `purchaseInputSchema` itself is unchanged (#5971 shape, still shared with
- * the Server Action / API route, which are not anonymous surfaces) — its own
- * schema tests below stay as coverage of the SHARED schema, distinct from
- * `purchaseMcpInputSchema`'s tests, which cover the tool's OWN gate.
- *
- * `__tests__/start_purchase.test.ts` owns the parity proof and the
- * hosted-URL/unknown-offering behaviour; this suite keeps the schema coverage
- * and the architectural guard alongside it.
- *
- * Acceptance criteria verified here:
- * - purchaseInputSchema (the shared schema) accepts/rejects per the route's
- *   own validation — unchanged coverage, since the schema itself is
- *   byte-unchanged (#6001 AC3)
- * - purchaseMcpInputSchema (the tool's own gate) accepts exactly
- *   productCode + quantity and REJECTS successUrl/cancelUrl/
- *   allowPromotionCodes outright (#6001 AC1)
- * - purchaseOutputSchema validates the { url: string } live shape
- * - ailkPurchase calls POST /v1/checkout/sessions through the api-client seam
- * - ailkPurchase always derives successUrl/cancelUrl from AILK_BASE_URL, with
- *   and without the env var set, and never forwards allowPromotionCodes
- *   (#6001 AC2)
- * - ailkPurchase returns { url } on success, a typed body on bad input
- * - No Stripe SDK import in apps/mcp (architectural guard)
- */
-
-import { checkout } from "@working-theory/api-client";
-import {
-  purchaseInputSchema as PurchaseInputSchema,
-  purchaseMcpInputSchema as PurchaseMcpInputSchema,
-  purchaseOutputSchema as PurchaseOutputSchema,
-} from "@working-theory/validation";
-
-import {
-  __setMcpCommerceClaimForTest,
-  resetMcpCommerceClaim,
-} from "../../src/lib/commerce-claim.js";
-import { ailkPurchase } from "../../src/tools/purchase.js";
-
-jest.mock("@working-theory/api-client", () => ({
-  checkout: { createSession: jest.fn() },
-}));
-
-const createSession = checkout.createSession as jest.MockedFunction<
-  typeof checkout.createSession
->;
-
-function sessionCreated(url: string) {
-  return { ok: true as const, body: { sessionId: "cs_test_id", url } };
-}
-
-beforeEach(() => {
-  // Every direct `ailkPurchase` call below bypasses registration, so gate 2
-  // would answer the module-disabled body under the fail-closed default.
-  __setMcpCommerceClaimForTest("claimed");
-});
-
-afterEach(() => {
-  jest.clearAllMocks();
-  resetMcpCommerceClaim();
-  delete process.env.AILK_BASE_URL;
-});
-
-// ── Shared input schema (purchaseInputSchema — byte-unchanged, #6001 AC3) ──────
-
-describe("PurchaseInputSchema — the shared schema (Server Action / API route)", () => {
-  it("accepts valid input with productCode and quantity", () => {
-    const result = PurchaseInputSchema.safeParse({
-      productCode: "price_test_123",
-      quantity: 1,
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("accepts valid input with productCode only (quantity defaults)", () => {
-    const result = PurchaseInputSchema.safeParse({
-      productCode: "price_test_abc",
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("accepts valid input with successUrl and cancelUrl", () => {
-    const result = PurchaseInputSchema.safeParse({
-      productCode: "price_test_123",
-      successUrl: "https://example.com/success",
-      cancelUrl: "https://example.com/cancel",
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("accepts an optional allowPromotionCodes boolean", () => {
-    const result = PurchaseInputSchema.safeParse({
-      productCode: "price_test_123",
-      allowPromotionCodes: true,
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("rejects a non-boolean allowPromotionCodes", () => {
-    const result = PurchaseInputSchema.safeParse({
-      productCode: "price_test_123",
-      allowPromotionCodes: "yes",
-    });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects input missing productCode", () => {
-    const result = PurchaseInputSchema.safeParse({ quantity: 1 });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects input with empty productCode", () => {
-    const result = PurchaseInputSchema.safeParse({ productCode: "" });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects a productCode outside the route's character set", () => {
-    const result = PurchaseInputSchema.safeParse({
-      productCode: "has spaces",
-    });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects a productCode longer than 200 characters", () => {
-    const result = PurchaseInputSchema.safeParse({
-      productCode: "a".repeat(201),
-    });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects input with non-integer quantity", () => {
-    const result = PurchaseInputSchema.safeParse({
-      productCode: "price_x",
-      quantity: 1.5,
-    });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects input with quantity less than 1", () => {
-    const result = PurchaseInputSchema.safeParse({
-      productCode: "price_x",
-      quantity: 0,
-    });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects input with quantity above the route's maximum of 999", () => {
-    const result = PurchaseInputSchema.safeParse({
-      productCode: "price_x",
-      quantity: 1000,
-    });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects a non-http(s) redirect URL the route would reject", () => {
-    const result = PurchaseInputSchema.safeParse({
-      productCode: "price_x",
-      successUrl: "javascript:alert(1)",
-    });
-    expect(result.success).toBe(false);
-  });
-});
-
-// ── MCP-only input schema (purchaseMcpInputSchema — the tool's own gate) ───────
-
-describe("PurchaseMcpInputSchema — the registered tool's OWN gate (#6001)", () => {
-  it("accepts productCode and quantity", () => {
-    const result = PurchaseMcpInputSchema.safeParse({
-      productCode: "price_test_123",
-      quantity: 2,
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("accepts productCode alone (quantity optional)", () => {
-    const result = PurchaseMcpInputSchema.safeParse({
-      productCode: "price_test_123",
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("rejects a call carrying successUrl", () => {
-    const result = PurchaseMcpInputSchema.safeParse({
-      productCode: "price_test_123",
-      successUrl: "https://example.com/success",
-    });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects a call carrying cancelUrl", () => {
-    const result = PurchaseMcpInputSchema.safeParse({
-      productCode: "price_test_123",
-      cancelUrl: "https://example.com/cancel",
-    });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects a call carrying allowPromotionCodes", () => {
-    const result = PurchaseMcpInputSchema.safeParse({
-      productCode: "price_test_123",
-      allowPromotionCodes: true,
-    });
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects a call carrying all three excluded fields at once", () => {
-    const result = PurchaseMcpInputSchema.safeParse({
-      productCode: "price_test_123",
-      successUrl: "https://attacker.example/phish",
-      cancelUrl: "https://attacker.example/cancel",
-      allowPromotionCodes: true,
-    });
-    expect(result.success).toBe(false);
-  });
-
-  it("still rejects missing/invalid productCode, same as the shared schema", () => {
-    expect(PurchaseMcpInputSchema.safeParse({}).success).toBe(false);
-    expect(
-      PurchaseMcpInputSchema.safeParse({ productCode: "" }).success,
-    ).toBe(false);
-    expect(
-      PurchaseMcpInputSchema.safeParse({ productCode: "has spaces" }).success,
-    ).toBe(false);
-  });
-
-  it("still rejects a quantity above the route's maximum of 999", () => {
-    const result = PurchaseMcpInputSchema.safeParse({
-      productCode: "price_x",
-      quantity: 1000,
-    });
-    expect(result.success).toBe(false);
-  });
-});
-
-// ── Output schema (live shape) ────────────────────────────────────────────────
-
-describe("PurchaseOutputSchema", () => {
-  it("accepts the live success shape { url: string }", () => {
-    const result = PurchaseOutputSchema.safeParse({
-      url: "https://checkout.stripe.com/pay/cs_test_abc123",
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("rejects output missing url", () => {
-    const result = PurchaseOutputSchema.safeParse({});
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects output where url is not a string", () => {
-    const result = PurchaseOutputSchema.safeParse({ url: 42 });
-    expect(result.success).toBe(false);
-  });
-});
-
-// ── ailkPurchase handler ──────────────────────────────────────────────────────
-
-describe("ailkPurchase — valid input", () => {
-  it("calls POST /v1/checkout/sessions with the mapped payload", async () => {
-    createSession.mockResolvedValueOnce(
-      sessionCreated("https://checkout.stripe.com/pay/cs_test_abc123"),
-    );
-
-    await ailkPurchase({
-      productCode: "growth_monthly",
-      quantity: 1,
-    });
-
-    expect(createSession).toHaveBeenCalledTimes(1);
-    const payload = createSession.mock.calls[0]![0];
-    expect(payload.productCode).toBe("growth_monthly");
-    expect(payload.quantity).toBe(1);
-  });
-
-  it("never forwards allowPromotionCodes — it is not part of the tool's input", async () => {
-    createSession.mockResolvedValueOnce(
-      sessionCreated("https://checkout.stripe.com/pay/cs_test_promo"),
-    );
-
-    await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(createSession.mock.calls[0]![0]).not.toHaveProperty(
-      "allowPromotionCodes",
-    );
-  });
-
-  it("returns { url } on success", async () => {
-    createSession.mockResolvedValueOnce(
-      sessionCreated("https://checkout.stripe.com/pay/cs_test_xyz"),
-    );
-
-    const output = await ailkPurchase({
-      productCode: "growth_monthly",
-    });
-
-    expect(output).toEqual({
-      url: "https://checkout.stripe.com/pay/cs_test_xyz",
-    });
-  });
-
-  it("output validates against PurchaseOutputSchema", async () => {
-    createSession.mockResolvedValueOnce(
-      sessionCreated("https://checkout.stripe.com/pay/cs_test_valid"),
-    );
-
-    const output = await ailkPurchase({ productCode: "growth_monthly" });
-    expect(PurchaseOutputSchema.safeParse(output).success).toBe(true);
-  });
-});
-
-describe("ailkPurchase — invalid input (typed error body, no side effect)", () => {
-  it("returns validation_failed for a missing productCode before any call", async () => {
-    const result = await ailkPurchase({ quantity: 1 } as never);
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("returns validation_failed for an empty productCode before any call", async () => {
-    const result = await ailkPurchase({ productCode: "" });
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("returns validation_failed for a call carrying successUrl (#6001 AC1)", async () => {
-    const result = await ailkPurchase({
-      productCode: "price_test_123",
-      successUrl: "https://attacker.example/phish",
-    } as never);
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("returns validation_failed for a call carrying cancelUrl (#6001 AC1)", async () => {
-    const result = await ailkPurchase({
-      productCode: "price_test_123",
-      cancelUrl: "https://attacker.example/cancel",
-    } as never);
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("returns validation_failed for a call carrying allowPromotionCodes (#6001 AC1)", async () => {
-    const result = await ailkPurchase({
-      productCode: "price_test_123",
-      allowPromotionCodes: true,
-    } as never);
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-});
-
-describe("ailkPurchase — always derives redirects from AILK_BASE_URL (#6001 AC2)", () => {
-  it("derives both redirect URLs from AILK_BASE_URL when it is set", async () => {
-    process.env.AILK_BASE_URL = "https://example.com";
-    createSession.mockResolvedValueOnce(
-      sessionCreated("https://checkout.stripe.com/pay/cs_test_base"),
-    );
-
-    await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(createSession).toHaveBeenCalledWith({
-      productCode: "growth_monthly",
-      successUrl:
-        "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
-      cancelUrl: "https://example.com/purchase/cancel",
-    });
-  });
-
-  it("falls back to the tool's existing default when AILK_BASE_URL is unset", async () => {
-    delete process.env.AILK_BASE_URL;
-    delete process.env.NEXT_PUBLIC_BASE_URL;
-    createSession.mockResolvedValueOnce(
-      sessionCreated("https://checkout.stripe.com/pay/cs_test_fallback"),
-    );
-
-    await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(createSession).toHaveBeenCalledWith({
-      productCode: "growth_monthly",
-      successUrl:
-        "http://localhost:3000/purchase/success?session_id={CHECKOUT_SESSION_ID}",
-      cancelUrl: "http://localhost:3000/purchase/cancel",
-    });
-  });
-
-  // #6084 AC-6/D1 — the literal template token survives, and cancelUrl
-  // carries no session parameter at all.
-  it("successUrl carries the literal {CHECKOUT_SESSION_ID} token; cancelUrl carries no session parameter (#6084 D1)", async () => {
-    process.env.AILK_BASE_URL = "https://example.com";
-    createSession.mockResolvedValueOnce(
-      sessionCreated("https://checkout.stripe.com/pay/cs_test_braces"),
-    );
-
-    await ailkPurchase({ productCode: "growth_monthly" });
-
-    const payload = createSession.mock.calls[0]![0] as {
-      successUrl: string;
-      cancelUrl: string;
-    };
-    expect(payload.successUrl).toContain("{CHECKOUT_SESSION_ID}");
-    expect(payload.cancelUrl).not.toContain("session_id");
-    expect(payload.cancelUrl).not.toContain("{CHECKOUT_SESSION_ID}");
-  });
-});
-
-describe("ailkPurchase — parity shape with purchaseAction", () => {
-  it("success shape is { url: string } matching the Server Action shape", async () => {
-    createSession.mockResolvedValueOnce(
-      sessionCreated("https://checkout.stripe.com/pay/cs_test_parity"),
-    );
-
-    const output = await ailkPurchase({
-      productCode: "growth_monthly",
-    });
-
-    expect(output).toHaveProperty("url");
-    expect(typeof (output as { url: string }).url).toBe("string");
-  });
-});
-
-// ── Architectural guard ───────────────────────────────────────────────────────
-
-describe("architectural guard — no Stripe import", () => {
-  it("apps/mcp/src/tools/purchase.ts does not import stripe", async () => {
-    const { readFileSync } = await import("node:fs");
-    const { resolve } = await import("node:path");
-    const src = readFileSync(
-      resolve(__dirname, "../../src/tools/purchase.ts"),
-      "utf-8",
-    );
-    expect(src).not.toMatch(/import.*['"]stripe['"]/);
-    expect(src).not.toMatch(/require\s*\(\s*['"]stripe['"]/);
-  });
-});