create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/jest.config.cjs

@@ -1,13 +1,17 @@
 module.exports = {
   preset: 'ts-jest',
   globalSetup: require.resolve('../../tools/jest/pin-timezone.cjs'),
+  reporters: require('../../tools/jest/reporters.cjs'),
   testEnvironment: 'node',
   roots: ['<rootDir>/src'],
   testMatch: ['**/__tests__/**/*.test.ts', '**/?(*.)+(test).ts'],
   testPathIgnorePatterns: ['/node_modules/', '.*\\.spec\\.ts$'],
   // Ignore node_modules except jose (ESM-only, loaded transitively via @working-theory/license → @working-theory/schema-pack-registry → @working-theory/schema).
   transformIgnorePatterns: ['/node_modules/(?!(\\.pnpm/)?(jose@?[^/]*?|cookie@?[^/]*?|@vercel(?:\\+analytics@[^/]*?|/analytics)|@working-theory(?:\\+[^/]*?@?[^/]*?|/[^/]+))(/|$))'],
-  moduleFileExtensions: ['ts', 'js', 'json'],
+  // `tsx` so the mapped @working-theory/email source can resolve its React
+  // Email templates (`./templates/*.js` → `*.tsx`) — #9446.
+  moduleFileExtensions: ['ts', 'tsx', 'js', 'json'],
+  // #9564 D7: the shared test setup moved to the package with the base code.
   setupFilesAfterEnv: ['<rootDir>/src/__tests__/setup.ts'],
   collectCoverageFrom: ['src/**/*.ts', '!src/**/*.d.ts', '!src/__tests__/**'],
   // Use v8 coverage provider for better async code tracking (route handlers via Fastify inject)
@@ -23,6 +27,8 @@ module.exports = {
   moduleNameMapper: {
     // @working-theory/* resolve from the installed packages; their ESM
     // dist is converted by the transform below.
+    '^@working-theory/api/routes/webhooks/stripe\\.js$':
+      '<rootDir>/node_modules/@working-theory/api/dist/routes/webhooks/stripe.js',
     // Map Prisma client import for testing (must come before the generic .js stripper).
     // Phase C (#710): the v7 prisma-client generator emits TypeScript source files
     // (client.ts) that use `import.meta.url`, which Jest's CommonJS preset can't
@@ -33,14 +39,14 @@ module.exports = {
     // The tenancy constants subpath (#3627) — real TS source, not a mock: the
     // `database/tenancy.ts` module has no external boundary to fake, so map
     // straight to source, matching the workspace-package-to-src pattern below.
-    '^@working-theory/database/tenancy$': '<rootDir>/../../database/tenancy.ts',
+    '^@working-theory/database/tenancy$': '<rootDir>/node_modules/@working-theory/database/dist/tenancy.js',
     // The flow-presets data subpath (#3958) — same real-TS-source rationale
     // as tenancy above: FLOW_PRESETS is plain data with no external boundary
     // to fake, so map straight to source rather than requiring a package build.
-    '^@working-theory/database/flows/presets$': '<rootDir>/../../database/flows/presets.ts',
+    '^@working-theory/database/flows/presets$': '<rootDir>/node_modules/@working-theory/database/dist/flows/presets.js',
     // The shared listing-diagnostic scoring register (#5001) — same
     // real-TS-source rationale as flows/presets above.
-    '^@working-theory/database/flows/listing-diagnostic$': '<rootDir>/../../database/flows/listing-diagnostic.ts',
+    '^@working-theory/database/flows/listing-diagnostic$': '<rootDir>/node_modules/@working-theory/database/dist/flows/listing-diagnostic.js',
     '^@working-theory/analytics/server$': '<rootDir>/node_modules/@working-theory/analytics/dist/server/index.js',
     '^(\\.{1,2}/.*)\\.js$': '$1',
   },
@@ -59,10 +65,14 @@ module.exports = {
           skipLibCheck: true,
           ignoreDeprecations: '6.0',
           forceConsistentCasingInFileNames: true,
+          jsx: 'react-jsx', // matches packages/email/tsconfig.json (#9446)
         },
         // Allow import.meta syntax to be parsed (source is ESM, but we compile to CommonJS)
         diagnostics: {
-          ignoreCodes: [1343], // Ignore "import.meta only allowed in ESM modules" error
+          // 1343: "import.meta only allowed in ESM modules"; 2823: import attributes
+          // under CJS — the composition's `with: { type: "json" }` manifest probe
+          // (#9571 D5), which the CJS emit drops and `require` serves.
+          ignoreCodes: [1343, 2823],
         },
       },
     ],

package/templates/apps/api/package.json

@@ -1,26 +1,18 @@
 {
-  "name": "@working-theory/api",
+  "name": "@working-theory/app-api",
   "version": "1.0.0",
-  "description": "AI Launch Kit API — Fastify routes + services",
+  "description": "AI Launch Kit API — the boot over @working-theory/api: the composition that passes the six @working-theory/api-<module> module objects (#9564, #9565)",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",
   "scripts": {
     "dev": "tsx watch --exclude \"../../node_modules/**\" src/cli.ts",
-    "abandon:sweep": "tsx src/bin/abandon-sweep.ts",
-    "member-request:match": "tsx src/bin/member-request-match.ts",
-    "followup:sweep": "tsx src/bin/followup-sweep.ts",
-    "listing-csv:sweep": "tsx src/bin/listing-csv-sweep.ts",
-    "retention:sweep": "tsx src/bin/session-retention-sweep.ts",
-    "deliverable:upload": "tsx src/bin/deliverable-upload.ts",
-    "deliverable:resend": "tsx src/bin/deliverable-resend.ts",
-    "seed:presets": "tsx src/bin/seed-presets.ts",
-    "spokes": "tsx src/bin/spokes.ts",
-    "stripe-connections:rekey": "tsx src/bin/stripe-connections-rekey.ts",
-    "flows:copy": "tsx src/bin/flows-copy.ts",
-    "rate-limit:probe": "tsx src/bin/rate-limit-probe.ts",
+    "abandon:sweep": "node node_modules/@working-theory/api/dist/bin/abandon-sweep.js",
+    "spokes": "node node_modules/@working-theory/api-hub/dist/bin/spokes.js",
+    "stripe-connections:rekey": "node node_modules/@working-theory/api/dist/bin/stripe-connections-rekey.js",
+    "rate-limit:probe": "node node_modules/@working-theory/api/dist/bin/rate-limit-probe.js",
     "build": "tsc",
-    "build:vercel": "cd ../../database && pnpm exec prisma generate && cd .. && if [ -d packages/validation ]; then pnpm --filter @working-theory/validation build; fi && pnpm --filter @working-theory/api build && mkdir -p apps/api/public && echo '{}' > apps/api/public/.vercel",
+    "build:vercel": "cd ../.. && pnpm db:generate && if [ -d packages/validation ]; then pnpm --filter @working-theory/validation build; fi && if [ -d packages/api ]; then pnpm --filter @working-theory/api build; fi && pnpm --filter @working-theory/app-api build && mkdir -p apps/api/public && echo '{}' > apps/api/public/.vercel",
     "start": "node dist/cli.js",
     "smoke:dev": "node -e \"const{spawn}=require('child_process');const http=require('http');const PORT=process.env.PORT||'3002';const SLUG=process.env.SMOKE_FLOW_SLUG||'smoke-check';const child=spawn('pnpm',['exec','tsx','watch','src/cli.ts'],{env:process.env,stdio:'ignore'});let done=false;function finish(code){if(done)return;done=true;try{child.kill();}catch(e){}process.exit(code);}function poll(attempt){if(attempt>40){console.error('smoke:dev - timeout waiting for server');finish(1);return;}const req=http.get({host:'127.0.0.1',port:PORT,path:'/v1/flows/'+SLUG},(res)=>{console.log('smoke:dev - GET /v1/flows/'+SLUG+' -> HTTP '+res.statusCode);res.resume();finish(0);});req.on('error',()=>{setTimeout(()=>poll(attempt+1),500);});}child.on('exit',(code)=>{if(!done){console.error('smoke:dev - child exited early with code '+code);finish(1);}});setTimeout(()=>poll(0),500);\"",
     "smoke:build": "node -e \"const{spawn}=require('child_process');const http=require('http');const PORT=process.env.PORT||'3002';const SLUG=process.env.SMOKE_FLOW_SLUG||'smoke-check';const child=spawn('node',['dist/cli.js'],{env:process.env,stdio:'ignore'});let done=false;function finish(code){if(done)return;done=true;try{child.kill();}catch(e){}process.exit(code);}function poll(attempt){if(attempt>40){console.error('smoke:build - timeout waiting for server');finish(1);return;}const req=http.get({host:'127.0.0.1',port:PORT,path:'/v1/flows/'+SLUG},(res)=>{console.log('smoke:build - GET /v1/flows/'+SLUG+' -> HTTP '+res.statusCode);res.resume();finish(0);});req.on('error',()=>{setTimeout(()=>poll(attempt+1),500);});}child.on('exit',(code)=>{if(!done){console.error('smoke:build - child exited early with code '+code);finish(1);}});setTimeout(()=>poll(0),500);\"",
@@ -28,11 +20,7 @@
     "lint": "eslint .",
     "test": "jest",
     "test:watch": "jest --watch",
-    "test:coverage": "jest --coverage",
-    "db:generate": "cd ../../database && prisma generate",
-    "db:push": "cd ../../database && prisma db push",
-    "db:migrate": "cd ../../database && prisma migrate dev",
-    "db:studio": "cd ../../database && prisma studio"
+    "test:coverage": "jest --coverage"
   },
   "dependencies": {
     "@fastify/cors": "^11.2.0",
@@ -41,6 +29,14 @@
     "@prisma/client": "^7.8.0",
     "@working-theory/aeo": "workspace:*",
     "@working-theory/analytics": "workspace:*",
+    "@working-theory/api": "workspace:*",
+    "@working-theory/api-commerce": "workspace:*",
+    "@working-theory/api-content-write": "workspace:*",
+    "@working-theory/api-hub": "workspace:*",
+    "@working-theory/api-multi-tenant": "workspace:*",
+    "@working-theory/api-scheduling": "workspace:*",
+    "@working-theory/api-signal-collectors": "workspace:*",
+    "@working-theory/api-workspace": "workspace:*",
     "@working-theory/common": "workspace:*",
     "@working-theory/content-adapters": "workspace:*",
     "@working-theory/content-projection": "workspace:*",

package/templates/apps/api/src/__tests__/trusted-origins.server.test.ts

@@ -23,7 +23,7 @@ jest.mock("@working-theory/email", () => ({
 }));
 
 // eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted; the DB boundary, mirrors auth.cookie-path.test.ts
-jest.mock("../lib/prisma.js", () => ({
+jest.mock("@working-theory/api/lib/prisma.js", () => ({
   prisma: {
     session: { findUnique: jest.fn() },
     apiToken: {
@@ -69,7 +69,7 @@ describe("#7395 — a listed spoke's cookie write through build()", () => {
     delete process.env.AILK_ENABLED_MODULES;
     jest.resetModules();
 
-    prisma = (require("../lib/prisma.js") as { prisma: typeof prisma }).prisma;
+    prisma = (require("@working-theory/api/lib/prisma.js") as { prisma: typeof prisma }).prisma;
     prisma.session.findUnique.mockResolvedValue({
       id: "ses_1",
       userId: "usr_spoke_visitor",

package/templates/apps/api/src/__tests__/vercel-handler.test.ts

@@ -50,7 +50,7 @@ jest.mock('@working-theory/observability', () => ({
 // the handler actually reads/calls, each cast to the real type ONCE at a
 // dedicated boundary function — avoids the `as unknown as <T>` double
 // assertion pattern the rest of the call sites would otherwise repeat
-// (mirrors apps/api/src/lib/__tests__/require-paid-tier.test.ts's
+// (mirrors packages/api/src/lib/__tests__/require-paid-tier.test.ts's
 // `asReply`/`StubReply` pattern).
 
 interface MockVercelRequest {
@@ -246,7 +246,7 @@ jest.mock('@working-theory/analytics/server', () => ({
   track: jest.fn().mockResolvedValue(undefined),
 }));
 // eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock('../lib/prisma.js');
+jest.mock('@working-theory/api/lib/prisma.js');
 
 /** Stripe's v1 scheme: `t=<ts>,v1=<hex HMAC-SHA256(secret, "<ts>.<payload>")>`. */
 function stripeSignature(payload: string, secret: string): string {
@@ -260,7 +260,7 @@ describe('vercel-handler — raw bytes reach webhook verification (#7440)', () =
 
   beforeEach(async () => {
     jest.resetModules();
-    const { stripeWebhookHandler } = require('../routes/webhooks/stripe');
+    const { stripeWebhookHandler } = require('@working-theory/api/routes/webhooks/stripe.js');
     app = Fastify();
     await app.register(async (webhooksScope) => {
       webhooksScope.addContentTypeParser(
@@ -292,7 +292,7 @@ describe('vercel-handler — raw bytes reach webhook verification (#7440)', () =
   });
 
   function webhookSecret(): string {
-    const { config } = require('../config') as { config: { STRIPE_WEBHOOK_SECRET?: string } };
+    const { config } = require('@working-theory/api/config/index.js') as { config: { STRIPE_WEBHOOK_SECRET?: string } };
     if (!config.STRIPE_WEBHOOK_SECRET) throw new Error('test setup sets STRIPE_WEBHOOK_SECRET');
     return config.STRIPE_WEBHOOK_SECRET;
   }

package/templates/apps/api/src/index.ts

@@ -7,7 +7,7 @@
  */
 import { logger } from '@working-theory/observability';
 
-import { config } from './config/index.js';
+import { config } from '@working-theory/api';
 import { build } from './server.js';
 
 export async function start() {

package/templates/apps/api/src/lib/__mocks__/prisma.ts

@@ -138,7 +138,7 @@ export const prisma = {
     // mock inherited a fake success.
     //
     // A bare `jest.fn()` resolves `undefined`, which every resolver in
-    // `apps/api/src/lib/site.ts` reads as "no such workspace" and rejects —
+    // `packages/api/src/lib/site.ts` reads as "no such workspace" and rejects —
     // so a suite that needs a workspace to resolve must SAY SO, keyed on the
     // id it actually expects to be asked for:
     //
@@ -399,10 +399,13 @@ export const prisma = {
   // ── Inbox namespace (WaitlistScore — #4662 D6) ───────────────────────────
   // `upsert` — the ONLY write path into waitlist_scores (scoreCompletedSignup).
   // `findMany` — the #4732 follow-up sweep's tier lookup, batched by leadId.
-  // `count` — the #4998 project-listings dashboard's waitlistCount join.
+  // `groupBy` — the #4998 project-listings dashboard's waitlistCount join
+  // (one grouped read per call since #9243). `count` — the single-row
+  // waitlistCount in project-listing-decision.ts.
   waitlistScore: {
     upsert: jest.fn(),
     count: jest.fn(),
+    groupBy: jest.fn(),
     findMany: jest.fn(),
   },
   // ── Inbox namespace (PlaybookInstance — FEAT-074 U4a #4715, extended U4b #4718) ──
@@ -449,7 +452,7 @@ export const prisma = {
   // updateMany (row absent vs. present-with-newer-watermark); `create` — the
   // create-eligible arm, wrapped in the caller's own `isUniqueViolation`
   // retry. `findMany` — the tenant-scoped GET /v1/schedule/appointments read
-  // (apps/api/src/routes/schedule/appointments.ts).
+  // (packages-paid/api-scheduling/src/routes/schedule/appointments.ts).
   appointment: {
     create: jest.fn(),
     findFirst: jest.fn(),
@@ -632,7 +635,7 @@ function workspaceFindUnique(client: WorkspaceMockHost): jest.Mock {
  * unless the test named the id under test.
  *
  * Keyed on the REQUESTED id, and that is the load-bearing part:
- * `resolveWorkspaceIdForAlias` (`apps/api/src/lib/site.ts`) returns the
+ * `resolveWorkspaceIdForAlias` (`packages/api/src/lib/site.ts`) returns the
  * ALIAS on mere truthiness of the row it gets back and never reads that
  * row's own id, so a blanket `mockResolvedValue({ … })` resolves whatever
  * it is handed — permissive by another name, and the rejection cases each

package/templates/apps/api/src/modules/commerce.ts

@@ -0,0 +1,10 @@
+// oss: false
+/**
+ * The commerce module object, re-exported from its package (#9565 D2/D5). This
+ * file stays so the boot (`../server.ts`) keeps loading it through the #5304
+ * specifier-constant form: the stripped public tree, which drops this
+ * `oss: false` file, still compiles, and the slice-reachability scripts keep
+ * a constant to trace. The object itself — plugins and the claim read — is
+ * `@working-theory/api-commerce`'s.
+ */
+export { commerceModule as module } from "@working-theory/api-commerce";

package/templates/apps/api/src/modules/content-write.ts

@@ -0,0 +1,10 @@
+// oss: false
+/**
+ * The content-write module object, re-exported from its package (#9565 D2/D5). This
+ * file stays so the boot (`../server.ts`) keeps loading it through the #5304
+ * specifier-constant form: the stripped public tree, which drops this
+ * `oss: false` file, still compiles, and the slice-reachability scripts keep
+ * a constant to trace. The object itself — plugins and the claim read — is
+ * `@working-theory/api-content-write`'s.
+ */
+export { contentWriteModule as module } from "@working-theory/api-content-write";

package/templates/apps/api/src/modules/multi-tenant.ts

@@ -0,0 +1,10 @@
+// oss: false
+/**
+ * The multi-tenant module object, re-exported from its package (#9565 D2/D5). This
+ * file stays so the boot (`../server.ts`) keeps loading it through the #5304
+ * specifier-constant form: the stripped public tree, which drops this
+ * `oss: false` file, still compiles, and the slice-reachability scripts keep
+ * a constant to trace. The object itself — plugins and the claim read — is
+ * `@working-theory/api-multi-tenant`'s.
+ */
+export { multiTenantModule as module } from "@working-theory/api-multi-tenant";

package/templates/apps/api/src/modules/scheduling.ts

@@ -0,0 +1,10 @@
+// oss: false
+/**
+ * The scheduling module object, re-exported from its package (#9565 D2/D5). This
+ * file stays so the boot (`../server.ts`) keeps loading it through the #5304
+ * specifier-constant form: the stripped public tree, which drops this
+ * `oss: false` file, still compiles, and the slice-reachability scripts keep
+ * a constant to trace. The object itself — plugins and the claim read — is
+ * `@working-theory/api-scheduling`'s.
+ */
+export { schedulingModule as module } from "@working-theory/api-scheduling";

package/templates/apps/api/src/modules/signal-collectors.ts

@@ -0,0 +1,10 @@
+// oss: false
+/**
+ * The signal-collectors module object, re-exported from its package (#9565 D2/D5). This
+ * file stays so the boot (`../server.ts`) keeps loading it through the #5304
+ * specifier-constant form: the stripped public tree, which drops this
+ * `oss: false` file, still compiles, and the slice-reachability scripts keep
+ * a constant to trace. The object itself — plugins and the claim read — is
+ * `@working-theory/api-signal-collectors`'s.
+ */
+export { signalCollectorsModule as module } from "@working-theory/api-signal-collectors";

package/templates/apps/api/src/modules/workspace.ts

@@ -0,0 +1,10 @@
+// oss: false
+/**
+ * The workspace module object, re-exported from its package (#9565 D2/D5). This
+ * file stays so the boot (`../server.ts`) keeps loading it through the #5304
+ * specifier-constant form: the stripped public tree, which drops this
+ * `oss: false` file, still compiles, and the slice-reachability scripts keep
+ * a constant to trace. The object itself — plugins and the claim read — is
+ * `@working-theory/api-workspace`'s.
+ */
+export { workspaceModule as module } from "@working-theory/api-workspace";