create-ailk 0.24.0 → 0.25.1

package/templates/apps/api/src/lib/locales.ts

@@ -1,201 +0,0 @@
-/**
- * readLocales — read and validate the `product.locales` field from project.yaml.
- *
- * Mirrors `apps/web/lib/locales.ts`. Duplicated because architecture.yaml does
- * not permit cross-app imports (apps/api may not import apps/web), and the
- * shared package boundary would require either a new package or extending
- * packages/common's architectural surface (which neither apps/api nor apps/web
- * declares as a may-import-from for filesystem helpers today).
- *
- * Validation rules:
- * - `locales` field absent → defaults to `["en"]` (backward-compat with OSS
- *   forks that pre-date the field)
- * - `locales` present → must be a non-empty array of BCP-47 locale tags
- *   matching `/^[a-z]{2}(-[A-Z]{2})?$/` (MVP subset)
- * - `product.default_locale` must be included in the `locales` list; parse
- *   error if not
- * - `locales: []` → parse error (empty array is invalid)
- *
- * Used by the content read routes to validate the `?locale=` query parameter
- * against the configured allowlist before passing to the adapter (defense-in-
- * depth per AC-i18n-07).
- */
-
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-import { parse } from "yaml";
-
-/** BCP-47 MVP subset: `xx` or `xx-XX` (language + optional region). */
-const BCP47_RE = /^[a-z]{2}(-[A-Z]{2})?$/;
-
-/**
- * Reads, validates, and returns the sorted locale list from project.yaml.
- *
- * Walks up from cwd to locate the file:
- *   - When apps/api runs from its own dir, project.yaml lives at `../..`
- *   - When invoked from repo root, project.yaml lives at `./`
- *
- * @param cwd - Directory to search from. Defaults to `process.cwd()`.
- * @returns Sorted `string[]` of enabled locale tags.
- * @throws Error with a descriptive message (file + cause) when validation fails.
- */
-export function readLocales(cwd = process.cwd()): string[] {
-  const filePath = resolveProjectYamlPath(cwd);
-
-  let raw: string;
-  try {
-    raw = readFileSync(filePath, "utf8");
-  } catch (err) {
-    throw new Error(
-      `[locales] Cannot read ${filePath}: ${err instanceof Error ? err.message : String(err)}`,
-      { cause: err },
-    );
-  }
-
-  let doc: unknown;
-  try {
-    doc = parse(raw);
-  } catch (err) {
-    throw new Error(
-      `[locales] YAML parse error in ${filePath}: ${err instanceof Error ? err.message : String(err)}`,
-      { cause: err },
-    );
-  }
-
-  if (!doc || typeof doc !== "object") {
-    throw new Error(
-      `[locales] ${filePath}: expected a YAML mapping at the top level`,
-    );
-  }
-
-  const top = doc as Record<string, unknown>;
-  const product = top["product"];
-
-  const p =
-    product && typeof product === "object"
-      ? (product as Record<string, unknown>)
-      : {};
-
-  const defaultLocale =
-    typeof p["default_locale"] === "string" ? p["default_locale"] : "en";
-
-  const rawLocales = p["locales"];
-
-  if (rawLocales === undefined || rawLocales === null) {
-    return ["en"];
-  }
-
-  if (!Array.isArray(rawLocales)) {
-    throw new Error(
-      `[locales] ${filePath}: product.locales must be an array, got ${typeof rawLocales}`,
-    );
-  }
-
-  if (rawLocales.length === 0) {
-    throw new Error(
-      `[locales] ${filePath}: product.locales must be a non-empty array (got empty array)`,
-    );
-  }
-
-  for (const entry of rawLocales) {
-    if (typeof entry !== "string") {
-      throw new Error(
-        `[locales] ${filePath}: product.locales entries must be strings, got ${typeof entry}`,
-      );
-    }
-    if (!BCP47_RE.test(entry)) {
-      throw new Error(
-        `[locales] ${filePath}: product.locales entry "${entry}" is not a valid BCP-47 locale tag (expected format: xx or xx-XX)`,
-      );
-    }
-  }
-
-  const locales = rawLocales as string[];
-
-  if (!locales.includes(defaultLocale)) {
-    throw new Error(
-      `[locales] ${filePath}: product.default_locale "${defaultLocale}" is not in product.locales [${locales.join(", ")}]`,
-    );
-  }
-
-  return [...locales].sort();
-}
-
-/**
- * Read the project's default locale from project.yaml. Mirrors `readLocales`
- * resolution and fallback semantics. Returns `"en"` when project.yaml is
- * absent or `product.default_locale` is unset — same default as the adapter.
- */
-export function readDefaultLocale(cwd = process.cwd()): string {
-  const filePath = resolveProjectYamlPath(cwd);
-
-  let raw: string;
-  try {
-    raw = readFileSync(filePath, "utf8");
-  } catch {
-    return "en";
-  }
-
-  let doc: unknown;
-  try {
-    doc = parse(raw);
-  } catch {
-    return "en";
-  }
-
-  if (!doc || typeof doc !== "object") return "en";
-  const product = (doc as Record<string, unknown>)["product"];
-  if (!product || typeof product !== "object") return "en";
-  const defaultLocale = (product as Record<string, unknown>)["default_locale"];
-  return typeof defaultLocale === "string" ? defaultLocale : "en";
-}
-
-/**
- * Resolve the validated locale to pass to the adapter.
- *
- * Allowlist enforcement at the API boundary (AC-i18n-07): if `requested` is
- * not in `readLocales()`, silently fall back to the project's `default_locale`.
- * The adapter still applies its own regex check as defense-in-depth.
- *
- * `readLocales` failures (project.yaml absent / malformed) degrade gracefully
- * to a default-locale-only allowlist.
- */
-export function resolveLocale(requested: string | undefined): string {
-  const defaultLocale = readDefaultLocale();
-  if (requested === undefined) return defaultLocale;
-
-  let allow: string[];
-  try {
-    allow = readLocales();
-  } catch {
-    allow = [defaultLocale];
-  }
-
-  return allow.includes(requested) ? requested : defaultLocale;
-}
-
-/**
- * Probe likely locations for project.yaml. Apps run from their own dirs in
- * dev/build (`apps/api/`, `apps/mcp/`) but from repo root in some test setups.
- */
-function resolveProjectYamlPath(cwd: string): string {
-  // Most common case — cwd is repo root, or cwd is an app dir (./../../project.yaml).
-  // Probe in order: cwd, ../, ../../.
-  const candidates = [
-    join(cwd, "project.yaml"),
-    join(cwd, "..", "project.yaml"),
-    join(cwd, "..", "..", "project.yaml"),
-  ];
-  for (const candidate of candidates) {
-    try {
-      readFileSync(candidate, "utf8");
-      return candidate;
-    } catch {
-      // continue
-    }
-  }
-  // Fall back to the cwd-relative path so the caller's error references the
-  // expected location.
-  return candidates[0] ?? join(cwd, "project.yaml");
-}

package/templates/apps/api/src/lib/outbound-http.ts

@@ -1,127 +0,0 @@
-/**
- * Outbound HTTP wrapper — fetch with default timeout + SSRF allow-list.
- *
- * Every outbound HTTP call originating from `apps/api/src/lib/**` SHOULD route
- * through this wrapper. Two guarantees:
- *
- *   1. Default 10s timeout via `AbortSignal.timeout(timeoutMs)`. Overridable
- *      per call. Without this, a hung peer can pin a Fastify worker
- *      indefinitely.
- *
- *   2. SSRF allow-list — RFC 1918 / loopback / link-local / metadata-service
- *      addresses are rejected before the fetch is issued. Without this, a
- *      user-influenced URL (webhook config, license-refresh endpoint, etc.)
- *      can probe cloud-provider metadata endpoints (169.254.169.254 →
- *      cloud IAM credentials) or pivot into the cluster network.
- *
- * The wrapper is forward-looking — `apps/api/src/lib` has no outbound fetch
- * callsites in this PR. Subsequent issues that introduce them MUST use this
- * wrapper. Direct `globalThis.fetch` in `apps/api/src/lib/**` is a recon
- * finding waiting to happen.
- *
- * Test-mode escape hatch — `allowPrivate: true` suppresses the SSRF gate.
- * Use only for explicit, internal-by-design traffic (typically tests). One
- * production case is sanctioned (#5851): a destination read from an
- * operator-configured deployment environment variable that is never
- * user-controlled, such as `CONTENT_REVALIDATE_URL`, whose legitimate value is
- * loopback in local development and single-host deployments.
- */
-
-const DEFAULT_TIMEOUT_MS = 10_000;
-
-export type OutboundFetchOptions = RequestInit & {
-  /** Override the default 10s timeout. */
-  timeoutMs?: number;
-  /**
-   * Suppress the SSRF allow-list — tests, plus the sanctioned production case
-   * in the module doc (an operator-configured deployment-env destination).
-   * NEVER pass true for user-controlled URLs.
-   */
-  allowPrivate?: boolean;
-};
-
-/**
- * Returns true if the URL should be blocked by the SSRF allow-list.
- * Pure — no side effects, no fetch issued.
- *
- * Blocked:
- *   - Non-HTTP(S) schemes (file:, javascript:, gopher:, ftp:, …)
- *   - Unparseable URLs
- *   - Hostnames that resolve syntactically to RFC 1918 / loopback / link-local
- *     IPv4 ranges, IPv6 loopback (::1), or the wildcard 0.0.0.0
- *   - The literal hostname "localhost"
- *
- * NOT covered (out of scope for syntactic check):
- *   - DNS rebinding (host resolves to a public IP at check time, then to a
- *     private IP at fetch time). A defense for this would resolve the
- *     hostname here and bind the fetch to the resolved IP — significant
- *     extra complexity, deferred.
- */
-export function ssrfBlocked(rawUrl: string): boolean {
-  let parsed: URL;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    return true;
-  }
-
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    return true;
-  }
-
-  // Node's URL.hostname for IPv6 keeps the brackets (e.g. "[::1]"). Strip
-  // them so the literal-loopback comparison works.
-  const rawHost = parsed.hostname.toLowerCase();
-  const host =
-    rawHost.startsWith("[") && rawHost.endsWith("]")
-      ? rawHost.slice(1, -1)
-      : rawHost;
-
-  if (host === "localhost") return true;
-  if (host === "0.0.0.0") return true;
-
-  // IPv6 loopback (bracketed in URL form)
-  if (host === "::1") return true;
-
-  // IPv4 dotted-quad check
-  const ipv4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (ipv4) {
-    const [a, b] = [Number(ipv4[1]), Number(ipv4[2])];
-    if (a === 127) return true; // 127.0.0.0/8 — loopback
-    if (a === 10) return true; // 10.0.0.0/8 — RFC 1918
-    if (a === 169 && b === 254) return true; // 169.254.0.0/16 — link-local (incl. AWS metadata)
-    if (a === 172 && b >= 16 && b <= 31) return true; // 172.16.0.0/12 — RFC 1918
-    if (a === 192 && b === 168) return true; // 192.168.0.0/16 — RFC 1918
-  }
-
-  return false;
-}
-
-/**
- * Performs an outbound fetch with timeout + SSRF allow-list enforcement.
- *
- * Throws synchronously (well, rejects) before any network call when:
- *   - The URL fails the SSRF check (and `allowPrivate` is not true)
- *
- * Rejects with an AbortError when the per-call timeout fires.
- */
-export async function outboundFetch(
-  url: string,
-  init: OutboundFetchOptions = {},
-): Promise<Response> {
-  const {
-    timeoutMs = DEFAULT_TIMEOUT_MS,
-    allowPrivate = false,
-    ...rest
-  } = init;
-
-  if (!allowPrivate && ssrfBlocked(url)) {
-    throw new Error(
-      `outbound-http: SSRF allow-list blocked URL (disallowed: private/loopback/link-local/non-HTTP)`,
-    );
-  }
-
-  const signal = rest.signal ?? AbortSignal.timeout(timeoutMs);
-
-  return globalThis.fetch(url, { ...rest, signal });
-}

package/templates/apps/api/src/lib/prisma.ts

@@ -1,21 +0,0 @@
-/**
- * PrismaClient singleton for the local auth database.
- * Business data (leads, orders, analytics) lives on the Platform, not here.
- */
-import { PrismaClient } from '@working-theory/database';
-import { PrismaPg } from '@prisma/adapter-pg';
-
-declare global {
-  var prisma: PrismaClient | undefined;
-}
-
-const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL });
-
-export const prisma = globalThis.prisma || new PrismaClient({
-  adapter,
-  log: process.env.NODE_ENV === 'development' ? ['query', 'error', 'warn'] : ['error'],
-});
-
-if (process.env.NODE_ENV !== 'production') {
-  globalThis.prisma = prisma;
-}

package/templates/apps/api/src/lib/proposal-paid-store.ts

@@ -1,66 +0,0 @@
-/**
- * The proposal paid stamp's data boundary (#8516, spec
- * docs/specs/8516-proposals-as-an-artifact-kind-spec.md D13).
- *
- * The Stripe webhook (`routes/webhooks/stripe.ts`) is a commerce primitive
- * registered on every build, so it may import no slice-owned file —
- * `lib/member-store.ts` is one, and importing it would pull the webhook out of
- * every scaffold without the member slice (the #5677 failure). Its one piece
- * write therefore lives here, in the base tree, importing only `prisma.ts`.
- *
- * Three statements and no others, all scoped by a workspace id AND a piece id
- * taken from a Stripe-signed `checkout.session.completed` event's metadata —
- * written by this server when it opened the session (`ailk_proposal`,
- * `ailk_workspace`; `services/proposal-payments.ts`), never settable by the
- * payer: a guarded `updateMany` that stamps an unpaid proposal paid, a
- * `findFirst` by the same pair reading back which session paid it, and a
- * `findFirst` by the same pair reading the proposal's Person — the subject of
- * the checkout's terms grant (#8765 D14). No list, no other model, no read by
- * any other key; never called by a route.
- * `architecture.yaml` names this file as a tenant-scope exclusion with that
- * reason.
- */
-import { prisma } from "./prisma.js";
-
-/**
- * - `stamped`      — this session paid an unpaid proposal; stamped now.
- * - `replay`       — the proposal was already stamped by THIS session.
- * - `already_paid` — a DIFFERENT session already paid it (a second charge).
- * - `not_found`    — no proposal of that id in that workspace.
- */
-export type ProposalPaidOutcome = "stamped" | "replay" | "already_paid" | "not_found";
-
-/** Stamp a proposal paid by `sessionId`, at most once. */
-export async function stampProposalPaid(
-  workspaceId: string,
-  pieceId: string,
-  sessionId: string,
-  now: Date,
-): Promise<ProposalPaidOutcome> {
-  const stamped = await prisma.piece.updateMany({
-    where: { id: pieceId, workspaceId, kind: "proposal", paidAt: null },
-    data: { paidAt: now, paidSessionId: sessionId },
-  });
-  if (stamped.count > 0) return "stamped";
-  const row = await prisma.piece.findFirst({
-    where: { id: pieceId, workspaceId, kind: "proposal" },
-    select: { paidSessionId: true },
-  });
-  if (row === null) return "not_found";
-  return row.paidSessionId === sessionId ? "replay" : "already_paid";
-}
-
-/**
- * The proposal's Person (#8765 D14), or `null` when no proposal of that id
- * is in that workspace.
- */
-export async function proposalPersonId(
-  workspaceId: string,
-  pieceId: string,
-): Promise<string | null> {
-  const row = await prisma.piece.findFirst({
-    where: { id: pieceId, workspaceId, kind: "proposal" },
-    select: { personId: true },
-  });
-  return row?.personId ?? null;
-}

package/templates/apps/api/src/lib/rate-limit-probe.ts

@@ -1,165 +0,0 @@
-/**
- * The live rate-limiter probe's logic (#5040 D9, FR-7). Pure: takes its
- * `fetch` and `sleep` so the CLI bin (`bin/rate-limit-probe.ts`) and the test
- * suite can both drive it without a real network or a real 60-second wait.
- * See the bin's header for what it answers and why.
- */
-
-const TEST_NET_3_PREFIX = "203.0.113.";
-
-export type ProbeFetch = (
-  url: string,
-  init: { headers: Record<string, string> },
-) => Promise<{ status: number }>;
-
-export interface RunRateLimitProbeOptions {
-  origin: string;
-  fetch: ProbeFetch;
-  limit?: number;
-  windowMs?: number;
-  sleep?: (ms: number) => Promise<void>;
-  log?: (msg: string) => void;
-}
-
-function isAllowedOrigin(origin: string): boolean {
-  let url: URL;
-  try {
-    url = new URL(origin);
-  } catch {
-    return false;
-  }
-  if (url.protocol === "https:") return true;
-  if (url.protocol !== "http:") return false;
-  const host = url.hostname;
-  return host === "localhost" || host === "127.0.0.1" || host === "::1";
-}
-
-function randomTestNet3(exclude: ReadonlySet<string>): string {
-  let candidate: string;
-  do {
-    candidate = `${TEST_NET_3_PREFIX}${1 + Math.floor(Math.random() * 254)}`;
-  } while (exclude.has(candidate));
-  return candidate;
-}
-
-function describeError(err: unknown): string {
-  if (
-    err !== null &&
-    typeof err === "object" &&
-    "code" in err &&
-    typeof (err as { code?: unknown }).code === "string"
-  ) {
-    return (err as { code: string }).code;
-  }
-  return err instanceof Error ? err.message : String(err);
-}
-
-const PROBE_PATH = "/v1/aeo/score/example";
-
-/**
- * Runs the two-fact probe (#5040 D9) against `origin`. Returns the process
- * exit code the bin should use: `0` on `burst: holds`, `1` on every other
- * conclusive-but-not-holding outcome (`limiter: not-observed`,
- * `burst: exceeded`, `burst: inconclusive`), `2` on a refused origin or a
- * network/status error.
- */
-export async function runRateLimitProbe(
-  opts: RunRateLimitProbeOptions,
-): Promise<number> {
-  const {
-    origin,
-    fetch,
-    limit = 10,
-    windowMs = 60_000,
-    sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)),
-    log = (msg: string) => console.log(msg),
-  } = opts;
-
-  if (!isAllowedOrigin(origin)) {
-    log("probe: error invalid-origin");
-    return 2;
-  }
-
-  const url = `${origin}${PROBE_PATH}`;
-  const used = new Set<string>();
-  const identityA = randomTestNet3(used);
-  used.add(identityA);
-
-  async function send(identity: string): Promise<number> {
-    const res = await fetch(url, { headers: { "x-forwarded-for": identity } });
-    return res.status;
-  }
-
-  let lastStatus: number | undefined;
-  try {
-    for (let i = 0; i < limit + 1; i++) {
-      const status = await send(identityA);
-      if (status !== 200 && status !== 429) {
-        log(`probe: error ${status}`);
-        return 2;
-      }
-      lastStatus = status;
-    }
-  } catch (err) {
-    log(`probe: error ${describeError(err)}`);
-    return 2;
-  }
-
-  if (lastStatus !== 429) {
-    log("limiter: not-observed");
-    return 1;
-  }
-
-  const identityB = randomTestNet3(used);
-  used.add(identityB);
-  let survives: boolean;
-  try {
-    const status = await send(identityB);
-    if (status !== 200 && status !== 429) {
-      log(`probe: error ${status}`);
-      return 2;
-    }
-    survives = status === 200;
-  } catch (err) {
-    log(`probe: error ${describeError(err)}`);
-    return 2;
-  }
-  log(survives ? "xff: survives" : "xff: overwritten");
-
-  let burstIdentity: string;
-  if (survives) {
-    burstIdentity = randomTestNet3(used);
-  } else {
-    await sleep(windowMs + 2_000);
-    burstIdentity = identityA;
-  }
-
-  const total = 3 * limit;
-  let successes = 0;
-  try {
-    const results = await Promise.all(
-      Array.from({ length: total }, () => send(burstIdentity)),
-    );
-    for (const status of results) {
-      if (status !== 200 && status !== 429) {
-        log(`probe: error ${status}`);
-        return 2;
-      }
-      if (status === 200) successes += 1;
-    }
-  } catch (err) {
-    log(`probe: error ${describeError(err)}`);
-    return 2;
-  }
-
-  if (successes === 0) {
-    log(`burst: inconclusive (0/${total})`);
-    return 1;
-  }
-  if (successes > limit) {
-    log(`burst: exceeded (${successes}/${total})`);
-    return 1;
-  }
-  log(`burst: holds (${successes}/${total})`);
-  return 0;
-}