create-ailk 0.24.0 → 0.26.0

package/templates/apps/web/lib/hub-session/__tests__/sign-in-gate.test.tsx

@@ -1,10 +1,13 @@
 /**
- * HubSignInGate (#7894 D10) as #8790 AC-1/AC-2 shape it: the site's inner-page
- * header (back arrow + mark), a label-size heading, the one hub sign-in
- * action, and a prospect line only when the site's messages carry it.
+ * HubSignInGate (#7894 D10) as #8790 AC-1/AC-2 and #9662 shape it: the site's
+ * inner-page header (the back arrow), then the one hub sign-in action inside
+ * the one card's frame — the mark in the tile, "Sign in to <site>", the toggle
+ * line to the hub's /sign-up (or the site's own prospect line when its
+ * messages carry one), and the Terms + Privacy acknowledgement.
  */
-import { render, screen } from "@testing-library/react";
+import { render, screen, within } from "@testing-library/react";
 import en from "../../../messages/en.json";
+import { SITE_NAME } from "../../site-brand";
 import { HubSignInGate } from "../sign-in-gate";
 
 type Gate = Record<string, string>;
@@ -12,9 +15,15 @@ let gateMessages: Gate;
 
 jest.mock("next-intl/server", () => ({
   __esModule: true,
-  getTranslations: jest.fn(async () => {
-    const t = (key: string) => gateMessages[key] ?? `copy:${key}`;
-    t.has = (key: string) => key in gateMessages;
+  getTranslations: jest.fn(async ({ namespace }: { namespace: string }) => {
+    const messages: Gate =
+      namespace === "signIn" ? (en.signIn as Gate) : gateMessages;
+    const t = (key: string, values?: Record<string, string>) =>
+      (messages[key] ?? `copy:${key}`).replace(
+        /\{(\w+)\}/g,
+        (_match, name: string) => values?.[name] ?? `{${name}}`,
+      );
+    t.has = (key: string) => key in messages;
     return t;
   }),
 }));
@@ -42,58 +51,97 @@ async function renderGate(pathname?: string): Promise<void> {
 
 beforeEach(() => {
   gateMessages = { ...(en.account.gate as Gate) };
-  mockConfig.mockReset().mockReturnValue({ clientId: "spoke_1" });
+  mockConfig
+    .mockReset()
+    .mockReturnValue({ clientId: "spoke_1", hubOrigin: "https://hub.example" });
 });
 
-describe("<HubSignInGate/> (#8790 AC-1)", () => {
-  it("wears the site's inner-page header: a back arrow to the home and the mark", async () => {
+describe("<HubSignInGate/> (#8790 AC-1; #9662)", () => {
+  it("wears the site's inner-page header: a back arrow to the home; the mark is the card's tile (#9662)", async () => {
     await renderGate("/account");
     const header = screen.getByTestId("account-sign-in-gate-header");
     const back = screen.getByTestId("nav-back-link");
     expect(header).toContainElement(back);
     expect(back).toHaveAttribute("href", "/");
     expect(back).toHaveAccessibleName(en.account.gate.homeLink);
-    expect(screen.getByTestId("account-sign-in-gate-mark")).toContainElement(
+    expect(header).not.toContainElement(screen.getByTestId("site-mark"));
+    expect(screen.getByTestId("auth-card-logo")).toContainElement(
       screen.getByTestId("site-mark"),
     );
   });
 
-  it("sets the heading at the label size and offers the one sign-in action", async () => {
+  it("titles the card 'Sign in to <site>' from the deployment's own name and offers the one sign-in action inside it", async () => {
     await renderGate("/account/settings");
-    const heading = screen.getByRole("heading", { level: 1 });
-    expect(heading).toHaveTextContent(en.account.gate.hubHeadline);
-    expect(heading).toHaveClass("text-heading-2");
-    expect(screen.getByTestId("account-hub-sign-in")).toHaveAttribute(
+    // The gate is the whole page, so the card's heading is its one h1.
+    expect(
+      screen.getByRole("heading", {
+        level: 1,
+        name: `Sign in to ${SITE_NAME}`,
+      }),
+    ).toBeInTheDocument();
+    const action = screen.getByTestId("account-hub-sign-in");
+    expect(screen.getByTestId("auth-card")).toContainElement(action);
+    expect(action).toHaveAttribute(
       "href",
       "/api/hub-session/sign-in?next=%2Faccount%2Fsettings",
     );
   });
 
-  it("renders no prospect line by default (the shipped messages carry no prospect keys)", async () => {
+  it("carries the toggle line to the hub's /sign-up and the acknowledgement on this site's policy routes (#9662)", async () => {
     await renderGate();
-    expect(screen.queryByTestId("account-sign-in-gate-prospect")).toBeNull();
+    expect(screen.getByTestId("auth-card-prospect")).toHaveTextContent(
+      /^Don't have an account\? Sign up$/,
+    );
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "https://hub.example/sign-up",
+    );
+    const footnote = screen.getByTestId("auth-card-footnote");
+    expect(footnote).toHaveTextContent(
+      /^You acknowledge that you read, and agree to our Terms of Service and our Privacy Policy\.$/,
+    );
+    expect(
+      within(footnote).getByRole("link", { name: "Terms of Service" }),
+    ).toHaveAttribute("href", "/terms");
+    expect(
+      within(footnote).getByRole("link", { name: "Privacy Policy" }),
+    ).toHaveAttribute("href", "/privacy");
   });
 });
 
 describe("<HubSignInGate/> prospect line (#8790 AC-2)", () => {
-  it("renders the line and its link when the site fills all three keys", async () => {
+  it("replaces the toggle line with the site's own when it fills all three keys", async () => {
     gateMessages.prospectPrompt = "New here?";
     gateMessages.prospectLink = "See if we fit";
     gateMessages.prospectHref = "/fit";
     await renderGate();
-    const line = screen.getByTestId("account-sign-in-gate-prospect");
-    expect(line).toHaveTextContent("New here? See if we fit.");
+    // The card's line ends on its link — no trailing period (#9662).
+    expect(screen.getByTestId("auth-card-prospect")).toHaveTextContent(
+      /^New here\? See if we fit$/,
+    );
     expect(screen.getByRole("link", { name: "See if we fit" })).toHaveAttribute(
       "href",
       "/fit",
     );
   });
 
-  it("renders nothing when any of the three keys is absent", async () => {
+  it("keeps the toggle line when any of the three keys is absent", async () => {
+    gateMessages.prospectPrompt = "New here?";
+    gateMessages.prospectLink = "See if we fit";
+    await renderGate();
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "https://hub.example/sign-up",
+    );
+  });
+
+  it("draws no prospect line in the not-configured state, even with the site's three keys", async () => {
+    mockConfig.mockReturnValue(null);
     gateMessages.prospectPrompt = "New here?";
     gateMessages.prospectLink = "See if we fit";
+    gateMessages.prospectHref = "/fit";
     await renderGate();
-    expect(screen.queryByTestId("account-sign-in-gate-prospect")).toBeNull();
+    expect(screen.queryByTestId("auth-card-prospect")).toBeNull();
   });
 
   it("keeps the not-configured state when the hub is not configured", async () => {
@@ -102,6 +150,7 @@ describe("<HubSignInGate/> prospect line (#8790 AC-2)", () => {
     expect(screen.getByRole("heading", { level: 1 })).toHaveTextContent(
       en.account.gate.emptyHeadline,
     );
+    expect(screen.queryByTestId("auth-card-prospect")).toBeNull();
     expect(screen.getByTestId("account-sign-in-gate-home")).toHaveAttribute(
       "href",
       "/",

package/templates/apps/web/lib/hub-session/sign-in-gate.tsx

@@ -10,25 +10,34 @@
  * route and starts a flow the visitor did not ask for.
  *
  * #8790 — the gate reads as one of the site's inner pages, not a bare
- * full-height stop: the site's inner-page header (the back arrow at the start
- * edge, the mark centred — the shape `Nav bar="bare"` draws, composed here
- * from the same `NavBackLink` and `siteLogo()`), a heading at the label size
- * (`heading-2`), and an optional quiet prospect line a site turns on by
- * adding `account.gate.prospectPrompt` + `prospectLink` + `prospectHref`
- * to its messages — absent, the shipped default, renders nothing.
- * The document title is the account page's job (`generateMetadata` there
- * reads the session and names this state "Sign in · <site>").
+ * full-height stop: the back arrow at the start edge (`NavBackLink`), then the
+ * card. The document title is the account page's job (`generateMetadata`
+ * there reads the session and names this state "Sign in · <site>").
+ *
+ * The one card (#9662, operator 2026-10-24): the single hub action sits in
+ * `AuthCard`'s frame — the site's mark in the 48px tile, "Sign in to <site>"
+ * (`SITE_NAME`, the deployment's own name, never the request's), the
+ * "Don't have an account? Sign up" line to the hub's `/sign-up`, and the
+ * Terms + Privacy acknowledgement on this site's own policy routes. A site
+ * that fills `account.gate.prospectPrompt` + `prospectLink` + `prospectHref`
+ * replaces the toggle line with its own. The acknowledgement is built here
+ * rather than from the `(auth)` group's builder: a spoke carries no `(auth)`
+ * group (create-ailk's `SPOKE_REMOVAL_SEEDS`).
  *
  * Not configured (`hubSessionConfig()` is `null`: a client id, secret or
- * session secret missing), it renders the account area's existing "sign-in
- * isn't available yet" state, whose one action leads back to the site.
+ * session secret missing), the card says "sign-in isn't available yet" and
+ * its one action leads back to the site.
  */
 import { localeHref } from "@working-theory/ui";
+import { AuthCard } from "@working-theory/ui/blocks";
 import { NavBackLink } from "@working-theory/ui/chrome";
-import { Button, Heading, Link, Text } from "@working-theory/ui/primitives";
+import { Button, Link, Text } from "@working-theory/ui/primitives";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
+
+import { SITE_NAME } from "../site-brand";
 import { siteLogo } from "../site-logo";
+
 import { hubSessionConfig } from "./config";
 import { HUB_SESSION_FALLBACK_PATH } from "./session";
 
@@ -46,7 +55,8 @@ export async function HubSignInGate({
   requestHeaders,
 }: HubSignInGateProps): Promise<ReactElement> {
   const t = await getTranslations({ locale, namespace: "account.gate" });
-  const configured = hubSessionConfig() !== null;
+  const signIn = await getTranslations({ locale, namespace: "signIn" });
+  const config = hubSessionConfig();
   const next =
     requestHeaders.get("x-pathname") ??
     localeHref(locale, HUB_SESSION_FALLBACK_PATH);
@@ -56,79 +66,93 @@ export async function HubSignInGate({
   // presence is the switch; hence the cast on `has`.
   type Key = Parameters<typeof t.has>[0];
   const has = (key: string): boolean => t.has(key as Key);
-  const prospect =
-    has("prospectPrompt") && has("prospectLink") && has("prospectHref")
+  // Only a configured gate offers a way in; the not-configured state has none.
+  const prospect = !config
+    ? undefined
+    : has("prospectPrompt") && has("prospectLink") && has("prospectHref")
       ? {
           prompt: t("prospectPrompt" as Key),
           linkLabel: t("prospectLink" as Key),
           href: t("prospectHref" as Key),
         }
-      : null;
+      : {
+          prompt: signIn("prospectPrompt"),
+          linkLabel: signIn("prospectLink"),
+          href: `${config.hubOrigin}/sign-up`,
+        };
 
   return (
     <div
       className="flex min-h-screen flex-col"
       data-testid="account-sign-in-gate"
     >
-      {/* The site's inner-page header: back arrow at the start, the mark centred (#8790 AC-1). */}
+      {/* The site's inner-page header: the back arrow at the start (#8790 AC-1); the card carries the mark (#9662). */}
       <header
-        className="grid h-16 grid-cols-[1fr_auto_1fr] items-center px-5 md:px-8"
+        className="flex h-16 items-center px-5 md:px-8"
         data-testid="account-sign-in-gate-header"
       >
-        <div className="justify-self-start">
-          <NavBackLink href={home} label={t("homeLink")} />
-        </div>
-        <Link
-          href={home}
-          variant="unstyled"
-          className="inline-flex h-7 items-center [&>img]:h-full [&>img]:w-auto [&>img]:object-contain"
-          data-testid="account-sign-in-gate-mark"
-        >
-          {siteLogo()}
-        </Link>
-        <div />
+        <NavBackLink href={home} label={t("homeLink")} />
       </header>
-      <div className="flex flex-1 flex-col items-center justify-center gap-4 py-section text-center">
-        <Heading level={1} visual={2}>
-          {configured ? t("hubHeadline") : t("emptyHeadline")}
-        </Heading>
-        <Text variant="body-sm" tone="muted" className="max-w-xs">
-          {configured ? t("hubDescription") : t("emptyDescription")}
-        </Text>
-        {configured ? (
-          // The primary action: 44px on a phone, 36px from md up.
-          <Button asChild className="max-md:min-h-11">
-            <Link
-              href={`${HUB_SIGN_IN_ROUTE}?next=${encodeURIComponent(next)}`}
-              variant="bare"
-              data-testid="account-hub-sign-in"
-            >
-              {t("hubSignIn")}
-            </Link>
-          </Button>
-        ) : (
-          <Button asChild variant="secondary" className="max-md:min-h-11">
-            <Link
-              href={home}
-              variant="bare"
-              data-testid="account-sign-in-gate-home"
-            >
-              {t("homeLink")}
-            </Link>
-          </Button>
-        )}
-        {configured && prospect ? (
-          // A wrapping div carries the hook: `Text` forwards no data-* attributes.
-          <div data-testid="account-sign-in-gate-prospect">
-            <Text as="p" variant="body-sm" tone="muted">
-              {prospect.prompt}{" "}
-              <Link href={prospect.href} variant="inline">
-                {prospect.linkLabel}
-              </Link>
-              .
-            </Text>
-          </div>
-        ) : null}
+      <div className="flex flex-1 flex-col items-center md:justify-center md:py-section">
+        {/* AuthShell's 400px column: the cap sits on the wrapper, never on the card (AuthShell.tsx). */}
+        <div className="w-full max-w-100">
+          <AuthCard
+            intent="sign-in"
+            footer="none"
+            // The page's one heading (#7894): the gate is the whole page.
+            headingLevel={1}
+            logo={siteLogo()}
+            labels={{
+              signInHeading: config
+                ? t("hubHeadline", { site: SITE_NAME })
+                : t("emptyHeadline"),
+            }}
+            subhead={config ? t("hubDescription") : t("emptyDescription")}
+            {...(prospect ? { prospect } : {})}
+            body={
+              config ? (
+                // The primary action: full width at `big` (44px).
+                <Button asChild size="big" className="w-full">
+                  <Link
+                    href={`${HUB_SIGN_IN_ROUTE}?next=${encodeURIComponent(next)}`}
+                    variant="bare"
+                    data-testid="account-hub-sign-in"
+                  >
+                    {t("hubSignIn")}
+                  </Link>
+                </Button>
+              ) : (
+                <Button
+                  asChild
+                  variant="secondary"
+                  size="big"
+                  className="w-full"
+                >
+                  <Link
+                    href={home}
+                    variant="bare"
+                    data-testid="account-sign-in-gate-home"
+                  >
+                    {t("homeLink")}
+                  </Link>
+                </Button>
+              )
+            }
+            footnote={
+              <Text as="p" variant="caption">
+                {signIn("acknowledgement")}{" "}
+                <Link variant="inline" href={localeHref(locale, "/terms")}>
+                  {signIn("termsLink")}
+                </Link>{" "}
+                {signIn("acknowledgementAnd")}{" "}
+                <Link variant="inline" href={localeHref(locale, "/privacy")}>
+                  {signIn("privacyLink")}
+                </Link>
+                {signIn("acknowledgementEnd")}
+              </Text>
+            }
+          />
+        </div>
       </div>
     </div>
   );

package/templates/apps/web/lib/prisma-for-auth.ts

@@ -14,8 +14,11 @@
  * `lib/sign-up-agreements.ts`'s account hook writes the new user's `sign_up`
  * consent grants through `consentGrant.createMany` on the transaction client
  * Better Auth's sign-up transaction runs on — only rows for the user that
- * transaction is creating, never a read and never any other row. It imports
- * nothing from here; it reaches the client through the adapter.
+ * transaction is creating, never a read and never any other row. A
+ * magic-link sign-up (#9667 D5) writes the same rows from the session hook,
+ * on the transaction the adapter opens for them, for the user that verify
+ * just created. It imports nothing from here; it reaches the client through
+ * the adapter.
  *
  * Every other business-logic caller goes through apps/api, never the
  * database directly (architecture.yaml `apps/web` may_not_import_from

package/templates/apps/web/lib/relay.ts

@@ -132,7 +132,7 @@ type RateLimitBucket = {
 // Module-scoped store, shared by the visitor (`visitor|<identity>`) and
 // session (`session|<identity>`) budgets (D7: same identity, window and
 // store). Ported from the hub's own limiter
-// (`apps/api/src/middleware/rate-limit.ts`), not imported — `apps/web`
+// (`packages/api/src/middleware/rate-limit.ts`), not imported — `apps/web`
 // cannot import `apps/api`.
 const rateLimitBuckets = new Map<string, RateLimitBucket>();
 let requestsSinceSweep = 0;
@@ -181,7 +181,7 @@ function hit(key: string, now: number): RateLimitBucket {
 
 /**
  * The eight hextets of a valid IPv6 address, or `null`. Ported from the
- * hub's own `expandIpv6` (`apps/api/src/middleware/rate-limit.ts`).
+ * hub's own `expandIpv6` (`packages/api/src/middleware/rate-limit.ts`).
  */
 function expandIpv6(address: string): number[] | null {
   let text = address;

package/templates/apps/web/lib/release-scope.ts

@@ -0,0 +1,47 @@
+/**
+ * Whether create-ailk's release scope marks the Free level released (#9534).
+ *
+ * `/.well-known/mcp.json` leaves `create_project` out while Free is held, in
+ * step with `apps/mcp`, whose `isFreeLevelReleased()` (`src/tools/
+ * create_project.ts`) registers the tool on the same read. apps/web cannot
+ * import apps/mcp, so this is the same predicate over the same file:
+ * `<cwd>/packages/create-ailk/release-scope.json` — present only in a
+ * monorepo checkout started from the repo root, which is also the only place
+ * the MCP server can spawn the CLI. The scope FILE alone decides (the CLI's
+ * `AILK_RELEASE_SCOPE=ignore` bypass is not honoured); a missing or
+ * unreadable file fails closed, with one line on stderr.
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+let releaseScopeFileOverride: string | undefined;
+
+export function isFreeLevelReleased(): boolean {
+  const file =
+    releaseScopeFileOverride ??
+    join(process.cwd(), "packages/create-ailk/release-scope.json");
+  try {
+    const scope = JSON.parse(readFileSync(file, "utf8")) as {
+      levels?: Record<string, unknown>;
+    };
+    return scope.levels?.["free"] === "released";
+  } catch (err) {
+    console.warn(
+      `[web] create_project is left out of /.well-known/mcp.json: release scope ${file} could not be read (${
+        err instanceof Error ? err.message : String(err)
+      })`,
+    );
+    return false;
+  }
+}
+
+/** Test-only: point {@link isFreeLevelReleased} at a scope copy. */
+export function __setReleaseScopeFileForTest(file: string | undefined): void {
+  if (process.env["NODE_ENV"] !== "test") {
+    throw new Error(
+      "__setReleaseScopeFileForTest is test-only and cannot run outside a test",
+    );
+  }
+  releaseScopeFileOverride = file;
+}

package/templates/apps/web/lib/server-api.ts

@@ -17,7 +17,7 @@
  * hand-rolled `fetch`. This module supplies exactly the two things that
  * namespace doesn't own: the cookie/origin-forwarding `init` (B0's additive
  * `init?: { headers }` on `http.get`) and the envelope→`ApiError` unwrap
- * (mirrors `apps-paid/admin/lib/api-error.ts`'s `unwrapEnvelope`, adapted to
+ * (mirrors `packages-paid/admin/lib/api-error.ts`'s `unwrapEnvelope`, adapted to
  * the `@working-theory/api-client` `ApiResult<T>` shape B0 already returns
  * rather than re-parsing the wire envelope by hand).
  */