create-ailk 0.23.0 → 0.25.1

package/templates/apps/mcp/src/lib/public-workspace.ts

@@ -1,133 +0,0 @@
-/**
- * The MCP server's own workspace resolution (#5876 spec D2/D4/D6/D7) — which
- * workspace `CONTENT_ADAPTER=database` content reads serve, resolved ONCE at
- * bootstrap and read synchronously thereafter by `content-adapter.ts`.
- *
- * WHY RESOLUTION HAPPENS AT BOOTSTRAP, NOT PER CALL (D4). Workspace
- * resolution is I/O (a `workspace.count()` + `findUnique()`), but
- * `getMcpContentAdapter()` stays SYNCHRONOUS — every one of its thirteen
- * call sites (nine read tools, `audit-single-page.ts`, and the three write
- * tools) calls it without `await`. Making it async would force `await` at
- * every one of those sites, a needless cross-cutting edit to a hard-floor
- * surface (`apps/mcp/src/tools/**`). So `apps/mcp/src/index.ts` awaits
- * `initMcpPublicWorkspace()` once, before either transport branch, and the
- * result is memoised here for `mcpPublicWorkspace()`'s synchronous read.
- *
- * A tool invoked before `initMcpPublicWorkspace()` has resolved sees the
- * module's initial `{ kind: "not-required" }` state — which the seam reads
- * exactly like an unresolved deployment under `database` mode (the empty
- * adapter, never content). That is the accepted, safe-direction cost D4
- * names, and it's what keeps the 350 pre-existing tests — which never call
- * `init` — on the byte-identical MDX path.
- *
- * NO-OP UNLESS THE ENVIRONMENT SELECTS `database` (D6). On `mdx` and
- * `projection`, `initMcpPublicWorkspace()`'s first statement is the same
- * `resolvedAdapterKind()` test the seam itself uses, and it returns before
- * any `await import()` — no database round-trip, no `DATABASE_URL` read, on
- * every MDX-only deployment.
- *
- * THE ONE-WORKSPACE PREDICATE IS SHARED, NOT REIMPLEMENTED (D2). This module
- * issues no direct tenant-model query of its own — it delegates to
- * `@working-theory/database/tenancy`'s `resolveDefaultWorkspaceRow`, the same
- * predicate `apps/api/src/services/default-tenant.ts` re-points at. One
- * predicate, reached from two apps, never two predicates (NFR-7).
- *
- * THE LAZY CLIENT (D7). The `prisma` injection option is the seam AC-1/AC-2
- * are scored through: when the caller supplies one, `./prisma.js` (the
- * module that constructs a real `PrismaClient`) is never imported — which is
- * what keeps every test in this repo's ordinary Jest run off a real
- * database connection (NFR-6).
- */
-import {
-  resolvedAdapterKind,
-  type ArtifactPrismaClient,
-} from "@working-theory/content-adapters";
-import {
-  resolveDefaultWorkspaceRow,
-  type WorkspacePredicateClient,
-} from "@working-theory/database/tenancy";
-
-/**
- * The three answers the MCP server's own workspace resolution can reach.
- * `reason` exists for the caller's own logging only — no MCP tool emits it
- * to the (anonymous, unauthenticated) caller (NFR-4, mirroring
- * `apps/api/src/services/public-site-resolver.ts`'s identical
- * `PublicSiteResolution`). Unlike that HTTP twin, there is no `host-unmatched`
- * arm here: an MCP stdio session carries no HTTP request and no host to
- * mismatch against (§2.3 — a host→workspace branch is explicitly out of
- * scope, #3635's to add).
- */
-export type McpWorkspaceResolution =
-  | { kind: "not-required" }
-  | { kind: "resolved"; workspaceId: string; prisma: ArtifactPrismaClient }
-  | { kind: "unresolved"; reason: "ambiguous" };
-
-export interface InitMcpPublicWorkspaceOptions {
-  /**
-   * Injection seam for tests (D7, D11) — when supplied, `initMcpPublicWorkspace()`
-   * uses it and never loads `./prisma.js`. Typed as the narrow surface THIS
-   * function itself calls (`workspace.count`/`findUnique`); the real
-   * `PrismaClient` (or a caller-injected structural equivalent) is
-   * structurally wider and also satisfies `ArtifactPrismaClient`, which is
-   * what the seam later forwards to `resolveContentAdapter()`.
-   */
-  prisma?: WorkspacePredicateClient;
-}
-
-let resolution: McpWorkspaceResolution = { kind: "not-required" };
-
-/**
- * Resolves the MCP server's workspace, once. Memoises the result for
- * `mcpPublicWorkspace()`'s synchronous read. Safe to call more than once
- * (each call re-resolves and re-memoises) — production calls it exactly once,
- * at bootstrap (`index.ts`).
- */
-export async function initMcpPublicWorkspace(
-  options: InitMcpPublicWorkspaceOptions = {},
-): Promise<McpWorkspaceResolution> {
-  if (resolvedAdapterKind() !== "database") {
-    resolution = { kind: "not-required" };
-    return resolution;
-  }
-
-  // Deferred — see this file's header (D7) and #5852's identical deferral of
-  // apps/api's own client (`services/public-site-resolver.ts`).
-  const prisma =
-    options.prisma ?? (await import("./prisma.js")).getMcpPrismaClient();
-  const workspace = await resolveDefaultWorkspaceRow(prisma);
-  resolution =
-    workspace === null
-      ? { kind: "unresolved", reason: "ambiguous" }
-      : {
-          kind: "resolved",
-          workspaceId: workspace.id,
-          prisma: prisma as unknown as ArtifactPrismaClient,
-        };
-  return resolution;
-}
-
-/**
- * The memoised resolution, read synchronously. `content-adapter.ts`'s
- * `database` branch is the one caller in production; every arm other than
- * `{ kind: "resolved" }` maps to the fail-closed empty adapter.
- */
-export function mcpPublicWorkspace(): McpWorkspaceResolution {
-  return resolution;
-}
-
-/** Test-only injector — sets the memoised resolution directly, bypassing the
- * tenancy predicate entirely. This is the seam `read_content.test.ts`,
- * `list_pages.test.ts` and `fail-closed-tools.test.ts` use: they care about
- * the CONTENT tools' behaviour under a given resolution, not about exercising
- * the resolution logic itself (that's `public-workspace.test.ts`'s job, via
- * the real `initMcpPublicWorkspace({ prisma: <stub> })`). */
-export function __setMcpPublicWorkspaceForTest(
-  next: McpWorkspaceResolution,
-): void {
-  resolution = next;
-}
-
-/** Test-only reset — returns to the module's initial, pre-bootstrap state. */
-export function resetMcpPublicWorkspace(): void {
-  resolution = { kind: "not-required" };
-}

package/templates/apps/mcp/src/lib/resolve-locale.ts

@@ -1,30 +0,0 @@
-/**
- * resolveLocale — validate a caller-supplied locale against the project's
- * allowlist. Phase 3 S3.
- *
- * Returns the requested locale when it's present in `readLocales()`;
- * otherwise silently falls back to the project's default locale (AC-i18n-07).
- *
- * Failures reading `project.yaml` degrade to a default-locale-only allowlist
- * — mirrors the same defensive behavior in `apps/api/src/routes/content/*`.
- *
- * This boundary check is defense-in-depth on top of the adapter's BCP-47
- * regex; the adapter still applies its own check and fallback chain on
- * every read.
- */
-
-import { readDefaultLocale, readLocales } from "./locales.js";
-
-export function resolveLocale(requested: string | undefined): string {
-  const defaultLocale = readDefaultLocale();
-  if (requested === undefined) return defaultLocale;
-
-  let allow: string[];
-  try {
-    allow = readLocales();
-  } catch {
-    allow = [defaultLocale];
-  }
-
-  return allow.includes(requested) ? requested : defaultLocale;
-}

package/templates/apps/mcp/src/lib/shown-offerings.ts

@@ -1,105 +0,0 @@
-/**
- * The MCP read of the site's Offerings shown set (#8933, spec D6).
- *
- * `get_pricing` and `get_offerings` answer a connected site's shown set —
- * the persisted Stripe snapshot `GET /v1/content/shown-offerings` serves
- * (#8924) — rather than its page content. apps/mcp reaches Offerings data
- * only over HTTP (#8876 D9), so this file reads that route through
- * `@working-theory/api-client` and hands the tools the current set, or
- * `null` for the content path:
- *
- * 1. The deployment's own claim first: unless `mcpCommerceClaim()` reads
- *    `claimed`, no HTTP call is made at all. The API's claim, read inside
- *    the route, still decides; this one only spares an unlicensed host the
- *    call.
- * 2. One `apiClient.offerings.shown()`, raced against
- *    `MCP_SHOWN_SET_BUDGET_MS`, so a hung API never holds a tool call.
- * 3. A refusal, a body `shownOfferingsAnswerSchema` refuses, the budget
- *    passing or a rejection is `null` and one `console.error` line.
- * 4. Otherwise `currentShownSet` — a `current` set with offerings, or `null`.
- *
- * The workspace is the API's: api-client sends the deployment's own spoke
- * key, and no tool argument names one (identity-blind). No Stripe package is
- * imported here or anywhere in apps/mcp (T7).
- *
- * T6 — every log line is `{ event, outcome }` plus an HTTP `status` or an
- * error's class name as `errName`: never a body, a message, the shown set, a
- * lookup key, an id, a name or a description. The log calls live here
- * because the tool files may not call `console.*`.
- */
-
-import { apiClient } from "@working-theory/api-client";
-import { currentShownSet } from "@working-theory/content-adapters";
-import {
-  shownOfferingsAnswerSchema,
-  type WorkspaceShownSetWire,
-} from "@working-theory/validation";
-
-import { mcpCommerceClaim } from "./commerce-claim.js";
-
-/** The longest one tool call waits on the shown set before answering content. */
-export const MCP_SHOWN_SET_BUDGET_MS = 5000;
-
-const OVER_BUDGET = Symbol("over-budget");
-
-/** An error's class name only — never its message, which may carry Stripe text. */
-function errName(err: unknown): string {
-  return err instanceof Error ? err.constructor.name : typeof err;
-}
-
-/** The site's current shown set, or `null` for the content path. */
-export async function mcpCurrentShownSet(): Promise<WorkspaceShownSetWire | null> {
-  if (mcpCommerceClaim() !== "claimed") return null;
-
-  // Caught before the race, so a rejection after the budget is never unhandled.
-  const read = apiClient.offerings.shown().catch((err: unknown) => {
-    console.error({
-      event: "shown-offerings",
-      outcome: "unreachable",
-      errName: errName(err),
-    });
-    return null;
-  });
-  let timer: NodeJS.Timeout | undefined;
-  const budget = new Promise<typeof OVER_BUDGET>((resolve) => {
-    timer = setTimeout(() => resolve(OVER_BUDGET), MCP_SHOWN_SET_BUDGET_MS);
-  });
-  let res: Awaited<typeof read> | typeof OVER_BUDGET;
-  try {
-    res = await Promise.race([read, budget]);
-  } finally {
-    clearTimeout(timer);
-  }
-
-  if (res === OVER_BUDGET) {
-    console.error({ event: "shown-offerings", outcome: "over_budget" });
-    return null;
-  }
-  if (res === null) return null;
-  if (!res.ok) {
-    console.error({
-      event: "shown-offerings",
-      outcome: "refused",
-      status: res.status,
-    });
-    return null;
-  }
-  const parsed = shownOfferingsAnswerSchema.safeParse(res.body);
-  if (!parsed.success) {
-    console.error({ event: "shown-offerings", outcome: "unreadable" });
-    return null;
-  }
-  return currentShownSet(parsed.data);
-}
-
-/**
- * Logs a shown-set mapping that threw (D12): the tool then answers its
- * content path, so no `ZodError` message ever reaches the agent.
- */
-export function reportMappingFailure(err: unknown): void {
-  console.error({
-    event: "shown-offerings",
-    outcome: "mapping_failed",
-    errName: errName(err),
-  });
-}

package/templates/apps/mcp/src/lib/stripe-tax-signal.ts

@@ -1,59 +0,0 @@
-/**
- * stripe-tax-signal — reads `commerce.stripe_tax` from project.yaml (#5949 D4).
- *
- * The declaration the audit's `tax-code-when-stripe-tax` rule grades against:
- * "this site's Stripe account has Stripe Tax enabled, so every priced page owes
- * a `stripe.taxCode`". Declarative only — nothing here calls Stripe, and no
- * license claim is read.
- *
- * The actual YAML read + field extraction delegates to `loadCommerceConfig`
- * (`@working-theory/aeo`, exported from the package root since #6012) — this
- * file's own job is the directory PROBE: apps run from their own dirs in
- * dev/build (`apps/mcp/`) but from repo root in some test setups, mirroring
- * `apps/mcp/src/lib/locales.ts`'s own project.yaml probe (the same three
- * candidates it walks; `apps/*` may not import `apps/*`, so a shared probe
- * helper isn't an option either — only the parse/extract logic was the
- * duplicate #6012 removes).
- *
- * NEVER throws. An unreadable, absent, malformed or non-boolean value all
- * resolve to `undefined` — the site declares no Stripe Tax posture, and the
- * rule passes saying so.
- */
-
-import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-
-import { loadCommerceConfig } from "@working-theory/aeo";
-
-/**
- * Probe likely locations for project.yaml. Apps run from their own dirs in
- * dev/build (`apps/mcp/`) but from repo root in some test setups — the same
- * three candidates `locales.ts` walks.
- */
-function resolveProjectYamlPath(cwd: string): string {
-  const candidates = [
-    join(cwd, "project.yaml"),
-    join(cwd, "..", "project.yaml"),
-    join(cwd, "..", "..", "project.yaml"),
-  ];
-  for (const candidate of candidates) {
-    try {
-      readFileSync(candidate, "utf8");
-      return candidate;
-    } catch {
-      // continue
-    }
-  }
-  return candidates[0] ?? join(cwd, "project.yaml");
-}
-
-/**
- * `commerce.stripe_tax` at `projectRoot` (default: the process cwd), or
- * `undefined` when the site declares none.
- */
-export function readStripeTaxSignal(
-  projectRoot: string = process.cwd(),
-): boolean | undefined {
-  const resolvedPath = resolveProjectYamlPath(projectRoot);
-  return loadCommerceConfig(dirname(resolvedPath)).stripeTaxEnabled;
-}

package/templates/apps/mcp/src/request-context.ts

@@ -1,52 +0,0 @@
-/**
- * Per-request context for @working-theory/mcp, shared by the HTTP transport
- * and the MCP lead-write tools (#8073).
- *
- * Deliberately dependency-free beyond `@working-theory/api-client` (already
- * loaded by every tool): `http-transport.ts` imports Fastify and the full
- * HTTP stack, and `src/index.ts`'s stdio branch dynamic-imports `server.js`
- * specifically to avoid loading that stack for a local stdio caller. A tool
- * importing `trustedCallerAddress` straight from `http-transport.ts` would
- * pull Fastify into every stdio boot and, worse, close an import cycle
- * (`http-transport.ts` → `server.ts` → `tools/*.ts` → `http-transport.ts`).
- * This module sits below both: `http-transport.ts` populates the store,
- * the tools read it, neither imports the other.
- */
-
-import { AsyncLocalStorage } from "node:async_hooks";
-
-import { visitorForwardHeaders } from "@working-theory/api-client";
-
-/**
- * The caller address the transport trusted for the POST request currently
- * being handled — `request.ip`, Fastify's own `trustProxy`-resolved value
- * (the Vercel entry trusts exactly one hop, #8070 D5), never the raw,
- * caller-forgeable leftmost `X-Forwarded-For` entry. Populated by
- * `http-transport.ts` for the duration of one `transport.handleRequest()`
- * call and read by the three MCP lead-write tools (#8073) so they can
- * forward it to the hub without the tool gaining an identity argument.
- * `undefined` outside an HTTP request — stdio has no client address to
- * forward.
- */
-export const trustedCallerAddress = new AsyncLocalStorage<string>();
-
-/**
- * The two visitor-forwarding headers (`x-ailk-visitor-ip`,
- * `x-ailk-visitor-forward-key`) for the request this call is running inside,
- * or `undefined` when there is no trusted address for this call (not an HTTP
- * request), no `AILK_VISITOR_FORWARD_KEY`, or `visitorForwardHeaders` itself
- * declines (an unsafe transport, an unsafe key value). Read by the lead-write
- * tools right before they call the hub (#8073).
- */
-export function visitorForwardHeadersForThisCall():
-  | Record<string, string>
-  | undefined {
-  const address = trustedCallerAddress.getStore();
-  if (!address) return undefined;
-  return visitorForwardHeaders(
-    {
-      get: (name: string) => (name === "x-forwarded-for" ? address : null),
-    },
-    process.env.AILK_VISITOR_FORWARD_KEY,
-  );
-}